July 2003 - Test - lists.nanog.org

Trends in network operator security
by Sean Donelan 30 Dec '03

30 Dec '03

Its 2003 and everyone is making their predictions. What trends are network operators seeing for Internet security? Old favorites Buffer overflows Distributed Denial of Service Poor passwords (cisco/sanfran) Poorly coded systems Blame the user for not protecting poorly coded systems Trends Attack the network (why? because we can) Proxy relay hiding (its not just for SMTP anymore) Combo Bot/Trojan/Worms Embedded software "upgrades" Any other trends network operators are seeing?

2 2

AT&T NYC
by Bryan Heitman 04 Sep '03

04 Sep '03

Anyone seeing any problems with ATT in new york? Best regards, Bryan Heitman Interland, Inc.

10 11

New Trojan
by netadm 07 Aug '03

07 Aug '03

Anyone having any fallout from: http://www.eweek.com/article2/0,3959,1130765,00.asp <http://www.eweek.com/article2/0,3959,1130765,00.asp>

7 6

WANTED: ISPs with DDoS defense solutions
by Lane Patterson 07 Aug '03

07 Aug '03

We have some DDoS-sensitive customers asking us to refer them to the best ISPs for "in-the-core" DDoS defense. Other than UUnet (hi Chris!) and MFN, I'm not aware of any ISPs in North America developing a reputation for consistent DDoS defense. Could folks contact me either off-list or on-list? It seems that large content providers and Tier2/3 bandwidth buyers would do well to collaborate on group RFP's for this type of thing to send the message to ISPs it is something to invest in (dare I say productize?). While UUnet's detection/blocking is great, it would be wonderful to see some more intelligent filtering of DDoS traffic ala RiverHead or similar approach that doesn't completely blackhole victim IPs. Cheers, -Lane Equinix

25 74

RE: "The internet is slow"
by Jack.W.Parks＠alltel.com 03 Aug '03

03 Aug '03

Rebooting the Internet once a month might prevent future problems. Power off, count to ten, then restart...Proactive Management!? Jack -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: Thursday, July 31, 2003 2:57 PM To: Richard A Steenbergen; Rick Ernst Cc: NANOG Subject: RE: "The internet is slow" But isn't that the purpose of NANOG? To fix the major problems before the world knows about them. I would much rather discuss a problem here and solve it and tell a reported, Yes (sir,or mam) the Internet commnity worked togather to solve the problem...... Than say, I don't it just cleared up it's all a mystery....... :) J -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Thursday, July 31, 2003 3:53 PM To: Rick Ernst Cc: NANOG Subject: Re: "The internet is slow" On Thu, Jul 31, 2003 at 12:02:32PM -0700, Rick Ernst wrote: > > Packet loss within UUNET, apparently localized to the Portland (OR) > area. I've turned down our peer with them and things are looking much > better. > > Thanks for all the help/responses. Shhhhhhh, next thing you know some reporter is going to be writing a story about how the NANOG mailing list fixed that darn "the internet is slow" problem everyone has been complaining about. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

5 4

RE: North America not interested in IP V6
by Irwin Lazar 02 Aug '03

02 Aug '03

> -----Original Message----- > From: Michel Py [mailto:michel@arneill-py.sacramento.ca.us] > Sent: Thursday, July 31, 2003 12:16 PM > To: Jeroen Massar > Cc: nanog(a)merit.edu > Subject: RE: North America not interested in IP V6 > > > Jeroen Massar wrote: > > It has a timeline (slides 47-50) showing the US falling behind > > for at least 3 years... come on US show what you are good for :) > > Show me where there is money to make with IPv6 first :-) > There are some > exceptions, but here v6 is somehow like ISDN: I Still Don't Need. > > Michel. > Christian Huitema of Microsoft presented on IPv6 at our Catalyst conference last month. He noted that Microsoft had a very difficult time creating xBox live due to issues with IPv4/NAT, which is one of the reasons they are pushing for IPv6 as the basis for future collaborative/peer-to-peer applications (for example, 3degrees). I believe Sony is also IPv6 enabling their products for the same reason. For these services to truly scale you've got be able to have true peer-to-peer computing. Right now, I'm not able to directly connect to my neighbor's computer to play a game if we are both on home LANs. I'm not able to directly connect to my PC at home when I'm on the road. I can't accept incoming phone calls to my netmeeting client without static configuration of my NAT gateway (same for an IP softphone). It would be a configuration nightmare to get four Vonage phones each with their own phone number. Christian provided a wonderful demonstration of a future interactive video application that would be difficult to scale if proxy/NAT services got in the way. There are lots of things that just don't work, and lots of opportunities for making money with IPv6. My own personal opinion is that over the next 5-10 year everything will come out of the box with IPv6 capabilities, making it fairly straightforward to turn on. I doubt we'll see much acceptance in the enterprise space before then, but there are significant opportunities to bring additional services into the home and serve those on home networks if we can eliminate NAT. As one person noted in response to Christian's speech. If there is no addressing shortage, why do I have to pay $75 a month for a DSL connection with a static IP address when a floating IP address only costs me $40 per month? Just my .02c irwin

8 16

Re: WANTED: ISPs with DDoS defense solutions
by Dave Israel 01 Aug '03

01 Aug '03

On 7/31/2003 at 18:30:12 +0000, Paul Vixie said: > > > However, since improvements are always welcome, please recommend tools > > which would allow us to progress "above and beyond" C and it's deficencies. > > I've never been able to program a buffer overrun vulnerability in > Modula 3, or Perl, or any version of Lisp or Scheme. It's possible > that the physics has advanced enough that "low level programming" > now costs more than it saves. On the other hand, compiled C is still significantly faster than, say, Perl or Java. That may not be important for some apps, but when you're pushing hardware to its very limits (you know, the most important stuff on the Net, like playing games and serving porn) you can really feel it. And if there's a security hole or exploitable bug in Perl or Java itself, it exists in every program written with it. There's nothing wrong with low level languages, and with the proper libraries, they gain some of the advantages of high level languages. Personally, it'll be a long time before I'm convinced that I want my routers running Java. (Like how I brought that almost back on topic in the end, there?)

3 2

RE: North America not interested in IP V6
by Ben Buxton 01 Aug '03

01 Aug '03

> From: Cougar [mailto:cougar@random.ee] > > On Thu, 31 Jul 2003, Ben Buxton wrote: > > > And further to this...will it be required (or wise at all) > to register > > individual /48 delegations when it becomes commonplace to > allocate them > > to standard home users? > [----] > > Plus, putting in and maintaining hundreds of thousands of > entries (we > > have a > > lot of users) would be quite impractical. > > How many home users need /48 ? I see here almost no home > users who need > more than /64.. Read RFC 3177, it recommends /48 so that users get given enough space to never have to worry. We cant predict what will happen in 15 years, so we shouldnt put artifical limitations on this. And includes reasons as to why that was decided upon. Its such a shame that a lot of companies want to restrict innovation by insisting that consumers will only want or need a single ip addres or subnet. Or that people only ever need to access web sites with their net connection. This seems especially so in the states and aus. In europe, when any consumer gets a net connection it's sold as a pipe to do anything you want with (as long as it abides by laws and netiquette. It seems that this silly restrictive mentality will remain even with ipv6... BB

2 1

RE: WANTED: ISPs with DDoS defense solutions
by McBurnett, Jim 01 Aug '03

01 Aug '03

Paul Vixie said: lots of late night pondering tonight. the anti-nat anti-firewall pure-end-to-end crowd has always argued in favour of "every host for itself" but in a world with a hundred million unmanaged but reprogrammable devices is that really practical? if *all* dsl and cablemodem plants firewalled inbound SYN packets and/or only permitted inbound UDP in direct response to prior valid outbound UDP, would rob really have seen a ~140Khost botnet this year? -- ----- YEAH but if I wanted to do it, the best way would be behind the firewall... They would have to put in PIX 535 with GIGE and segment the network into DMZs.. HMM.. I think that if the cable modem had a built in router with NAT this problem could be solved partially.. I did a test about 6 months ago. almost a honeypot, but not quite. put a standard windows ME system on a RW IP put a $60 cable router in front of a similiar system. the ME was compromised and made into a Bot in 3 hours. The $60 router protected one was not compromised in the 2 weeks it was used. Both had AV and were updated daily via automation. IF only cable operators would at least STRESS the security issues OR make the AUP's Stick.. Some of you may have seen my emails asking for help from Charter about security issues. It took me almost 4 months to get someones attention, and then only after I brought up several ARIN and other policies they violated. I hate to say it but I don't think we will see anything change here.. And if so not enough to matter.... maybe from 140K to 120K anyway I am ranting... J

2 1

Re: WANTED: ISPs with DDoS defense solutions
by Paul Vixie 31 Jul '03

31 Jul '03

> Private deployment of software written in C is very different from a > major public release, especially so when included with source code. you're right. when i've been involved in non-opensource products which were written in C and then shipped as binaries, i was scared to death about the lack of public review relative to the size of the user base, and i always argued for rather expen$ive SQA to make up for the weakness of not getting free SQA from all those security companies looking to make a name for themselves by being first to discover a vulnerability. or was that not what you meant?

1 0