July 2003 - Test - lists.nanog.org

The status of consumer rate-limiting?
by Owings, Curtis L [GMG] 22 Jul '03

22 Jul '03

I'm interested in an informal poll of consumer ISP's regarding application rate-limiting. For all you folks out there managing "broadband" networks to residential end-users: Are you controlling peer-to-peer traffic in some way (i.e. rate-limiting, blocking, etc)? Do you have plans to control peer-to-peer traffic? If you don't mind, can you generally describe how you have implemented any limits and how effective those solutions are? Are you imposing other total traffic download/upload limits? Are your limits imposed via "policy" (nag your abusers) or via "network" (they get blocked automatically)? Thanks! ~Curt PCS: (913) 219-8342

3 2

Cisco IOS Vulnerability
by John Timmons 22 Jul '03

22 Jul '03

i have no details regarding the ios vulnerability other than what has already been stated on-list, but the IOS matrix obtained this evening and listed at http://www.0ptical.net/cisco.html shows what versions are affected, and what to upgrade to resolve the mystery issue. not sure why psirt is keeping this under wraps, since most NSPs are publicly scheduling "emergency upgrades" to fix "network problems" that arent being detailed to customers, and those same customers can and will be affected by the same problem. thx, JT _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

23 32

Re: RADb ?
by Kevin Oberman 22 Jul '03

22 Jul '03

> Date: Tue, 22 Jul 2003 14:25:18 -0400 (EDT) > From: mike harrison <meuon(a)highertech.net> > Sender: owner-nanog(a)merit.edu > > > > Does anyone really use the RADb ? Worth the $250 per year? > > Just wondering if it worth renewing.. Registry is worth it, but you might want to think about a free DB (if you are small) or setting up your own with the free irrd software. There is nothing more magical about the RADB than any other member of the IRR. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0

Cisco vulnerability and dangerous filtering techniques
by Adam Maloney 22 Jul '03

22 Jul '03

I had a passing thought over the weekend regarding Thursday's cisco vulnerability and the recent Microsoft holes. The next worm taking advantage of the latest Windows' vulnerabilities is more or less inevitable. Someone somewhere has to be writing it. So why not include the cisco exploit in the worm payload? Based on past history, there will be plenty of vulnerable Windows hosts to infect with the worm. I would also guess that there are lots of organizations and end-users that have cisco devices that haven't patched their IOS. Furthermore, I wonder how many people have applied filtering only at their border? But packets from an infected host inside the network wouldn't be stopped by filtering applied only to the external side. Basically, if you're filtering access to your interface IP's rather than upgrading IOS, remember that the internet isn't the only source of danger to your network. Adam Maloney Systems Administrator Sihope Communications

6 6

Re: Cisco Vulnerability Testing Results
by neil＠DOMINO.ORG 22 Jul '03

22 Jul '03

> You don't know quite how rife that rumour is over here at the moment. Peter, How so unlike you to take an anti-establishment view! Neil

3 2

Potential downside to using (very) old domain as spam trap.
by David A. Ulevitch 22 Jul '03

22 Jul '03

Hi, I've recently been delegated a domain of a dead ISP which hasn't existed in *any* form for about 5+ years. As a test, we setup an MX for it to see what kind of mail it would get since we noted a lot of DNS lookups for it. After going through a few hundred emails it started to look like the domain might be good fodder for a blacklist. We couldn't find a single legit email that passed through spamassassin and a couple other tools. I've seen people put spamtraps on web pages and at the bottom of emails to use as blacklist fodder but not a whole domain. I suppose more rigorous testing could be done to make sure no legit email is being sent to the domain, but I have a strong feeling that it is very, very dead. (It even expired at one point and was available from a registrar.) Is this done? Advisable? Experiences? Thanks in advance, David Ulevitch ---------------------------------------------------- David A. Ulevitch -- http://david.ulevitch.com http://everydns.net -+- http://communitycolo.net Campus Box 6957 + Washington University in St. Louis ----------------------------------------------------

3 2

Re: Cisco vulnerability and dangerous filtering techniques
by jgraun＠comcast.net 22 Jul '03

22 Jul '03

That is a bit paranoid, but it could happen. I have not seen anybody do anything that intelligent in the past couple of years. Not to say that there arent people out there that couldn't do that but I think many have thought of using one exploit to expose another, DDoS is the closest I have seen on any of my honeypots. I have learned many things about what most people will try to get into a box from the honeypots, but that is a good point. Filtering or patching should take place on the edge and on the most critical spots on your network. Good Luck > > I had a passing thought over the weekend regarding Thursday's cisco > vulnerability and the recent Microsoft holes. > > The next worm taking advantage of the latest Windows' vulnerabilities is > more or less inevitable. Someone somewhere has to be writing it. So why > not include the cisco exploit in the worm payload? > > Based on past history, there will be plenty of vulnerable Windows hosts to > infect with the worm. I would also guess that there are lots of > organizations and end-users that have cisco devices that haven't patched > their IOS. Furthermore, I wonder how many people have applied filtering > only at their border? But packets from an infected host inside the > network wouldn't be stopped by filtering applied only to the external > side. > > Basically, if you're filtering access to your interface IP's rather than > upgrading IOS, remember that the internet isn't the only source of danger > to your network. > > Adam Maloney > Systems Administrator > Sihope Communications >

2 1

RE: Cisco vulnerability and dangerous filtering techniques
by McBurnett, Jim 22 Jul '03

22 Jul '03

EXACTLY!! Company A fired the wrong person. DDoS internally. Company B has a Business partner that has VPN access, that get's infected. Company C has a home user that uses VPN on a cable modem. he gets infected.... Virus writers will see this and use it... What better DDoS method is there than to take down the network equipment.... I see this as a make or break.... If someone does not upgrade, well think of this as a roll-coaster. Remember the sign? This ride is not advised for people with bad backs, pregnant ladies...... This will be a long year of patches and learning experiences... J -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, July 22, 2003 9:55 AM To: Niels Bakker Cc: nanog(a)merit.edu Subject: Re: Cisco vulnerability and dangerous filtering techniques On Tue, 22 Jul 2003 15:40:02 +0200, Niels Bakker <niels=nanog(a)bakker.net> said: > > * adamm(a)sihope.com (Adam Maloney) [Tue 22 Jul 2003, 15:33 CEST]: > > The next worm taking advantage of the latest Windows' vulnerabilities > > is more or less inevitable. Someone somewhere has to be writing it. > > So why not include the cisco exploit in the worm payload? > > Why would a worm disable a vital component on its path to new infections? It's not part of the spread-the-worm code, it's part of the DDoS engine that it leaves behind. If you get lucky, one of your 20K zombies is the other side of a router along with whoever you're pissed at and want to DDoS, so you send the command, and the zombie sprays 76 packets, goes to sleep for 30 mins, sprays another 76.. lather rinse repeat. I'm going to go out on a limb and say that at least 30% of Ciscos are installed in places that would, if hit with this, have NO CLUE why their router needs to be power cycled every 30 mins.....

2 1

Re: The status of consumer rate-limiting?
by Dr. Jeffrey Race 22 Jul '03

22 Jul '03

On Tue, 22 Jul 2003 20:13:35 +0200, Niels Bakker wrote: >We're asking everybody to turn off HTML when they post to mailing lists. Here's some boilerplate I wrote for this purpose: <http://www.camblab.com/nugget/turnoff.txt>

1 0

Williams/UUNET/Sprint
by Deepak Jain 21 Jul '03

21 Jul '03

Has anyone had to deal with this in their BGP filter tables? 5 washdc5lce1-oc48.wcg.net (64.200.95.118) 4 ms 11 ms 4 ms 6 GigabitEthernet5-0.GW4.IAD8.ALTER.NET (157.130.30.245) 4 ms 4 ms 4 ms 7 0.so-1-2-0.XR2.IAD8.ALTER.NET (152.63.41.34) 3 ms 4 ms 6 ms 8 0.so-0-0-0.CL2.IAD5.ALTER.NET (152.63.38.142) 4 ms 5 ms 5 ms 9 201.at-2-0-0.XR2.DCA6.ALTER.NET (152.63.35.49) 6 ms 6 ms 6 ms 0 0.so-1-3-0.XL2.DCA6.ALTER.NET (152.63.35.118) 6 ms 6 ms 6 ms 1 POS7-0.BR4.DCA6.ALTER.NET (152.63.41.233) 8 ms 6 ms 7 ms 2 POS5-3.sl-bb22-rly.sprint.net (204.255.169.130) 8 ms 8 ms 8 ms Is Williams getting transit to Sprint via UUNET or vice versa? Sorry if I have been out of the loop on this. DJ

3 3