July 2003 - Test - lists.nanog.org

Dept of Homeland security takes a crack at predicting the activit ies of haxx0rs.
by Drew Weaver 31 Jul '03

31 Jul '03

http://www.msnbc.com/news/946460.asp?0dm=C12MT <http://www.msnbc.com/news/946460.asp?0dm=C12MT> Do you guys think that now the DHS has announced this that the kiddies are more likely or less likely move faster on their plans? All I know is this is bad, it was bad enough when it only affected certain versions of Windows running IIS. Going to be a long August. -Drew

1 0

RE: WANTED: ISPs with DDoS defense solutions
by Stephen J. Wilcox 31 Jul '03

31 Jul '03

> I did a test about 6 months ago. almost a honeypot, but not quite. > put a standard windows ME system on a RW IP > put a $60 cable router in front of a similiar system. > the ME was compromised and made into a Bot in 3 hours. > The $60 router protected one was not compromised in the > 2 weeks it was used. > > Both had AV and were updated daily via automation. Ok I've not done this but I wasnt aware vanilla installs that are patched had such glaring holes? My first thought is surely a default install has no open ports other than netbios and I assume all file sharing is disabled? No? Steve

1 0

RE: "The internet is slow"
by McBurnett, Jim 31 Jul '03

31 Jul '03

But isn't that the purpose of NANOG? To fix the major problems before the world knows about them. I would much rather discuss a problem here and solve it and tell a reported, Yes (sir,or mam) the Internet commnity worked togather to solve the problem...... Than say, I don't it just cleared up it's all a mystery....... :) J -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Thursday, July 31, 2003 3:53 PM To: Rick Ernst Cc: NANOG Subject: Re: "The internet is slow" On Thu, Jul 31, 2003 at 12:02:32PM -0700, Rick Ernst wrote: > > Packet loss within UUNET, apparently localized to the Portland (OR) area. > I've turned down our peer with them and things are looking much better. > > Thanks for all the help/responses. Shhhhhhh, next thing you know some reporter is going to be writing a story about how the NANOG mailing list fixed that darn "the internet is slow" problem everyone has been complaining about. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

1 0

"The internet is slow"
by Rick Ernst 31 Jul '03

31 Jul '03

Gah.. I hate these kind of vague problems. I have multiple users complaining about "the internet is slow"; specifically to sites such as aol, cnn, amazon. Our support folks are also having trouble getting to postini's admin pages. Things are excruciatingly slow. I don't see any indications on router load, link utilization, bouncing routes, etc. that jump up as obvious problems. I tried using the lookingglass at algx.net, but I'm getting null responses for all requests (ping, traceroute and BGP). I'm not, however, seeing any issues with traceroute servers getting to us. Anybody know of anything broken anywhere? I don't think the problem is us, but if somebody would like to respond off-list with any oddities you may see with AS6423, and/or traceroutes to 206.103.37.166, I'd appreciate it. Thanks, Rick

6 6

Re: WANTED: ISPs with DDoS defense solutions
by Paul Vixie 31 Jul '03

31 Jul '03

> However, since improvements are always welcome, please recommend tools > which would allow us to progress "above and beyond" C and it's deficencies. I've never been able to program a buffer overrun vulnerability in Modula 3, or Perl, or any version of Lisp or Scheme. It's possible that the physics has advanced enough that "low level programming" now costs more than it saves.

1 0

RE: "The internet is slow"
by St. Clair, James 31 Jul '03

31 Jul '03

tell ur user a gerbil got sick and the wheel isn't spinning as fast today....

1 0

RE: North America not interested in IP V6
by Michel Py 31 Jul '03

31 Jul '03

> Jeroen Massar wrote: > It has a timeline (slides 47-50) showing the US falling behind > for at least 3 years... come on US show what you are good for :) Show me where there is money to make with IPv6 first :-) There are some exceptions, but here v6 is somehow like ISDN: I Still Don't Need. Michel.

2 1

RE: WANTED: ISPs with DDoS defense solutions
by McBurnett, Jim 31 Jul '03

31 Jul '03

I tend to agree here. I have noticed so many attacks etc coming from APNIC as of recent that on our corp network we have an ACL to block a number of APNIC blocks. If there was a dynamic method to add null0 routes to identified zombies, I think that would help. IE. security company A provides a feed (BGP etc) to null route zombies that it has identified. But that opens a whole other can of worms..... J -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: Thursday, July 31, 2003 9:24 AM To: variable(a)ednet.co.uk; Rob Thomas Cc: NANOG Subject: Re: WANTED: ISPs with DDoS defense solutions I would say that because backdoored hosts are easily available in large quantities, spoofing does not make sense and usually alarms various systems more quickly than packets from legitimate addresses. Pete ----- Original Message ----- From: <variable(a)ednet.co.uk> To: "Rob Thomas" <robt(a)cymru.com> Cc: "NANOG" <nanog(a)merit.edu> Sent: Thursday, July 31, 2003 4:17 PM Subject: Re: WANTED: ISPs with DDoS defense solutions > > On Wed, 30 Jul 2003, Rob Thomas wrote: > > > I've tracked 1787 DDoS attacks since 01 JAN 2003. Of that number, > > only 32 used spoofed sources. I rarely see spoofed attacks now. > > Do you have any ideas as to why that is? Is it due to more providers > doing source filtering? It wouldn't make sense for attackers to become > less sophisticated unless they became more difficult to catch for other > reasons (e.g. botnets getting bigger). > > Rich > >

2 1

RE: North America not interested in IP V6
by Ben Buxton 31 Jul '03

31 Jul '03

> -----Original Message----- > From: Jeroen Massar [mailto:jeroen@unfix.org] > Ronald van der Pol wrote: > > > On Wed, Jul 30, 2003 at 12:30:25 -0400, Marshall Eubanks wrote: > > > > > > I'd be more interested in seeing how many customer connections > > > > are using IPV6. > > > > > > This question came up in discussions at IETF-57, without a > > good answer. > > > > I count 728 /48 entries in the RIPE database. These should > correspond > > to "sites" or customers (a couple of /48s are allocated to IXs). > > The bad news here, or actually good news, is that many ISP's don't > register their client /48's. The SixXS project for instance > has 515 subnets currently given out to it's users. > We've put a REFER in the remark line to our own whois database > which contains up to date and full informations. > This is done because delegations can and will change quite a lot. And further to this...will it be required (or wise at all) to register individual /48 delegations when it becomes commonplace to allocate them to standard home users? Some private home users might be unhappy that their full home address, etc is available to anyone who knows that their ip address(es) are... I recall reading somewhere that it would not be necessary to register individual /48 subnets into RIPE. For one, it'd probably breach European privacy rules. Plus, putting in and maintaining hundreds of thousands of entries (we have a lot of users) would be quite impractical. BB

1 0

Re: North America not interested in IP V6
by neil＠DOMINO.ORG 31 Jul '03

31 Jul '03

> Here at DE-CIX (www.de-cix.net) I can see that more and more ISP are joining > the IPv6 trial (http://www.de-cix.net/info/decix-ipv6/) . Currently already > 20% of all ~120 ISP at DE-CIX have IPv6 enabled. I'd be more interested in seeing how many customer connections are using IPV6. Regards, Neil.

9 11