August 2003 - Test - lists.nanog.org

Measured Internet good v. "bad" traffic
by Raymond, Steven 31 Aug '03

31 Aug '03

Have received complaints from usage-based-billing Internet customers lately about not wanting to pay for the nuisance traffic caused by worm-of-the-day. I believe that in the case of a short-duration, targeted attack that can be eventually be stopped, a billing credit is probably appropriate. But what about these current plagues that go on for weeks or forever- what is your network's response? Some simply want the traffic filtered in our routers- permanently. That is my least favorite option. Others want to simply not be billed for "bad" traffic. My reaction is to suggest that metered billing is probably not for you, then. But I could of course sympathize if I were footing the bill. What are other network operators doing about this issue, if it is an issue for them at all? Thanks

6 11

Mailing list loop
by Michel Py 31 Aug '03

31 Aug '03

Is it just me or do we have a few messages that loop on this mailing list? RE: On the back of other 'security' posts.... Re: What do you want your ISP to block today? Re: Fun new policy at AOL Re: dry pair etc Michel.

1 0

RE: What do you want your ISP to block today?
by John_York＠Dell.com 31 Aug '03

31 Aug '03

From: Owen DeLong > When was the last time you installed a Micr0$0ft security fix that was > less than 5MB? (I have yet to see one) SQL Slammer patch fit on a floppy (I remember - I walked around with that floppy for hours that night). Blaster patch fits on a floppy unless you're running a 64-bit version of Windows, in which case it is over 5MB. Seems like the patch for Windows Server 2003 32-bit may be ~4-5MB, too. > Shall we also compare the realtive timetables between vulnerability > awareness and general patch availablility? Not gonna touch that one. :) FWIW, I only run Linux servers, so I don't have an interest in defending MS - just setting the filesize record straight :) John

1 0

RE: On the back of other 'security' posts....
by Greenhalgh, John 31 Aug '03

31 Aug '03

>That depends on your definition of edge, I suppose. I define it as the >port on one of my routers where the other end of the link is connected >to a machine I don't control. In those terms, edge filtering makes sense >in some cases and not in others. If it's a dial-up or T1 customer which is >a single business, it makes sense. If it's an ISP with a few fortune 500 >customers, it doesn't work out as well. I agree. In the satellite world, such filtering is extremely difficult due to the asymmetric nature of the traffic. A common scenario is that the customer will receive packets from upstream via Provider A to addresses assigned by Provider A. The customer will send packets upstream through Provider B with source addresses belonging to Provider B. If Provider B implements edge filtering, then the only way round is to use GRE tunnels, which gets messy. -- John Greenhalgh

1 0

Re: What do you want your ISP to block today?
by Matthew S. Hallacy 30 Aug '03

30 Aug '03

On Sat, Aug 30, 2003 at 12:08:51PM -0400, Eric Kagan wrote: > How long do we give after the "friendly" notice as you are still infecting > other people before it is okay to shut you off ? Assuming a situation like the blaster worm, I'd expect a call to one of the emergency contacts listed. Response time should be less than an hour. (even if it is just a 'thanks, we're working on it') -- Matthew S. Hallacy FUBAR, LART, BOFH Certified http://www.poptix.net GPG public key 0x01938203

1 0

Re: Fun new policy at AOL
by Miquel van Smoorenburg 30 Aug '03

30 Aug '03

In article <cistron.5ED9A06E-DA3E-11D7-B146-00039388672E(a)muada.com>, Iljitsch van Beijnum <iljitsch(a)muada.com> wrote: >But how about this: in addition to MX hosts, every domain also has one >or more MO (mail originator) hosts. Mail servers then get to check the >address of the SMTP server they're talking to against the DNS records >for the domain in the sender's address. Then customers who use an email >address under their ISP's domain have to use the ISP's relay, while >people with their own (sub) domain get to use their own. Google for "RMX DNS". There's a few other proposals too; see for example http://spf.pobox.com/ Mike. -- RAND USR 16514

12 23

Re: Fun new policy at AOL
by Omachonu Ogali 29 Aug '03

29 Aug '03

On Fri, Aug 29, 2003 at 02:15:49PM -0400, Matthew Crocker wrote: > SMTP_AUTH authenticated users to a mail server. What I'm talking Postfix will let you do SMTP authentication from one mail server to another, and to address the person who said a school was brute- forced, this is from server to server, not everyday-client to server. If you can't set a secure password on server to server relations (it's not like you need to remember it, generate some random concoction of 1-100 characters and use that as a password). It's like the same thing as setting up a BGP password or a RADIUS secret, once it's set, it's not going to be changed often (or at all), let alone remembered.

1 0

RE: dry pair
by Dr. Jeffrey Race 29 Aug '03

29 Aug '03

On Fri, 29 Aug 2003 11:24:35 -0500, Austad, Jay wrote: >I also tried asking for an Alarm Circuit. I even explained to them what it >was, but they still didn't understand. All of the people I talked to >wondered why in the world I would want a pair with no dialtone. This is what happens when you staff your "support" departments with dropouts from McDonalds. They need people who have climbed poles and been down in manholes (among other things). The training is abysmal and management doesn't care. Jeffrey Race

1 0

RE: dry pair
by Randy Neals (ORION) 29 Aug '03

29 Aug '03

>From: Dan.Thorson(a)seagate.com >>From what I recall there is no guarentee that the Qwest >tarrif for NB3 is actually a straight-through copper pair >[section 7.3.1.B.2.a.(4)]... note the restriction of >signaling frequency.... >see the Terms & Conditions in section 7.3.1.B.2.a.(2). By requesting a circuit that offers 60Hz and/or DC signalling that pretty much requires them to use Copper, if they have it available. The only way to know if they have it available is to order the circuit. After a few days the order will hit their design department which will look at the order and determine if facilities exist to provison the circuit. Some newer office towers and subdivisons/developments may be fed with fiber using Digital Loop Carrier(DLC/SLC) equipment in a CEV hut. While there is still a copper loop to each home or business from the CEV/Hut, the loop ends at the SLC and the voice is converted to PCM over fiber to extend to the C.O. Our Telco uses a slightly different wording in their Tariff for this lack of DC continuity disclaimer...: "The provisioning of metallic or DC continuity applied until 1993 12 31. Thereafter, the provisioning of metallic or DC continuity is provided only where metallic facilities currently exist, following normal provisioning practices. Where capacity is exhausted, or where appropriate facilities do not exist, the Company will evaluate all requests and only provide end-to-end metallic facilities at the customer's expense based on the cost incurred by the Company." The largest concern is usually the length of the circuit because how they route the circuit is not always intuitive and the cable may take a circuitous route between your two locations. Usually they can estimate the loop length when the do the design. The limitation on frequency/pulses is largely administrative verbiage. I highly doubt they will install a filter on the circuit to prevent higher speed. (Although it is possible) At one time I think the different speed circuits where priced differently. I suppose a few decades ago the differnce between 30 bits per second and 75 bits per second was considered a large amount of difference. ;-) -Randy

4 4

Re: Blaster author identified, about to be arrested...
by Brandon Butterworth 29 Aug '03

29 Aug '03

> > Where is he "now" and why won't he remove himself to "somewhere a long > > way away", overnight? Obviously, there is something more complex > > happening here. "don't give that lamer credit for my code. Doh!"

1 0