August 2003 - Test - lists.nanog.org

RE: East Coast outage?
by Wesley Vaux 14 Aug '03

14 Aug '03

http://www.cnn.com/2003/US/08/14/power.outage/index.html Power outage information Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com -----Original Message----- From: Aaron D. Britt [mailto:flip@deru.com] Sent: Thursday, August 14, 2003 4:32 PM To: nanog(a)merit.edu Subject: East Coast outage? I just lost 80 circuits (Voice and Data), across multiple states on the East Coast in the last 10 minutes. Is there a Northeast power outage or fiber cut that anyone knows about? Any info would be appreciated... -Aaron

1 0

RE: Power outage in North East
by Sean Crandall 14 Aug '03

14 Aug '03

> Has anyone heard of a big Power outage in the North east? > I just got a call from one of my tech's in the GBLX bldg in Newark, NJ at 1085 > raymond and they are telling him that they lost power! > But I also got a call from AT&T in NY that they also lost Power! I have customers in East Rutherford, NJ and Manhattan that lost power to their HQs. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. 6691 Owens Drive Pleasanton, CA 94588 (925) 201-2530 (office) (925) 201-2550 (fax)

2 1

Re: Port blocking last resort in fight against virus
by Joe Provo 14 Aug '03

14 Aug '03

On Tue, Aug 12, 2003 at 12:11:48PM -0500, John Palmer wrote: [snip] >Yes, some providers however react improperly to certain situations > and do not listen to their paying customers. > > RCN in Chicago is one example. One day, they just started blocking > outbound port 25 on their network. Now, I use other SMTP servers > other than the RCN one. In my case, they're my servers and all I > have to do is set up my SMTP to listen on an additional port. For > others, they aren't so lucky and may have a legitimate gripe with > them for censoring traffic. If I recall correctly, that was a reaction to abuse, which was done network wide for the basic class of residential customers. Enforcement of a 'no servers' clause for HTTP is also common among broadband providers. But to get back on topic... > In the case of 135-139, no one who uses these ports legitimatly > should have a need to use them "in the wild" unless in a tunnel. [snip] Yup. Back in the day good old windows 3.1 had access control problems and tried to share information in classful broadcast boundaries. Blocking these netb* ports was effective across- the-board protection and anyone who called with an issue got educated and fixed. This is all about the edges, and frankly even with all messages regarding "The Backbone", I can't think about any "backbone" who isn't an edge. Everyone should police their edges for their own customers' sake, and be willing to help customers' policing efforts when asked. Seems there's an undercurrent of willfull ignorance that perpetuates all sorts of abuse. Once upon a time we studied for what purpose our networks were used, and were able to optimize for the traffic that was in demand, making customers happy. There just happened to be a side effect of squashing badness that was purposeful along with that which was just 'brokeness'. Perhaps if we were all paying more attention to what purposes the networks were being used, even if it is because of brokeness this time, we'd wind up optimizing and making customers happy? I'm all for the invisible system administrator and the transparent network, but there is a business case for visible differentiation, giving the customers a reason to stay. It is nice when that differentiation isn't based on marketing glossies and run-from-chapter-11 fire sale pricing but the actual (technical) product. Cheers, Joe -- RSUC / GweepNet / Spunk / FnB / Usenix / SAGE

1 0

RE: The impending DDoS storm
by Josh Fleishman 14 Aug '03

14 Aug '03

Has anyone determined a method for triggering the DOS attack manually? We've attempted this by changing an infected machine's clock, however it did not work on our test box. If anyone has triggered the attack, do you have a copy of the sniffed data stream? It sounds like uRPF is going to be of very little benefit to blocking the attack if the spoofed addresses come from the infected host's subnet/parent subnet. -Josh -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mark Vallar Sent: Wednesday, August 13, 2003 7:18 PM To: nanog(a)merit.edu Subject: Re: The impending DDoS storm Jack Bates Wrote: > I have no affiliation with Microsoft, nor do I care about their > services or products. What I do care about is a worm that sends out > packets uncontrolled. If there is the possibility that this "planned" > DOS will cause issues with my topology, then I will do whatever it > takes to stop it. The fact that user's can't reach windowsupdate.com > is irrelevant. > There will most likely be issues with a lot of networks. I had a glimpse of what is to come on the 16th on Tuesday. We have a firewall customer that had an infected machine behind the firewall and the RTC clock was set incorrectly to 8/16. The firewall was *logging* ~50 attempts per second trying to connect on port 80 to windowsupdate.com. Since the worm was sending from a spoofed source address the firewall was denying the packets. This customers network is a /24 out of traditional Class B space and I was seeing random source addresses from almost every IP out of the /16. This is not a forensic analysis, just what I observed in the firewall logs. Is it a coincidence that 8/16 is a Saturday....I think not. A lot less personal on-site to deal with possible issues. -Mark Vallar

5 4

OT: APAC circuit costs
by Brennan_Murphy＠NAI.com 14 Aug '03

14 Aug '03

I am hoping to ask some questions of an enterprise network engineer/manager who knows a bit about circuit costs in APAC. Specifically, I have a vendor telling me a WAN link from Beijing to SanFran is cheaper than Beijing to almost anywhere else in APAC: Singapore, Hong Kong, Sydney and Tokyo. Just looking for someone to contact me off the list and confirm whether that is actually the case.... Thanks! -BM

1 0

RE: Microsoft to ship new versions with firewall enabled
by Drew Weaver 14 Aug '03

14 Aug '03

ipchains and similar firewalls are indeed far superior. I manage "real" firewalls as part of my responsibilities. However the new microsoft policy will help protect the network from Joe and Jane average who buy a PC from the closest "big box" store and hook it up to their cable modem so they can exchange pictures of the kids with the grandparents in Fla. This is the class of users who botnet builders dream about because these people do not see a computer as a complex system which _requires_ constant maintenance but as a semi-magical device for moving images and text around. ---- I don't believe that many people really see ipchains as a real viable firewall. I think it is awesome, but in many corporations simply mentioning it gets you a stern eyeing. Of course these corporations can spend tons of money on Checkpoint and PIX boxen. -Drew

3 2

RE: Microsoft to ship new versions with firewall enabled
by Drew Weaver 14 Aug '03

14 Aug '03

> John Neiberger wrote: > > > > Hmm...I didn't even know XP had a built-in firewall. Any bets on how > > long it is before other companies with software firewall products bring > > suit against Microsoft for bundling a firewall in the OS? > > -- > > No clue, but I can tell you how long it will last before ISP helpdesks > disable the firewall. About 30 seconds, for my customers. In fact, when you configure a dialup connection, the firewall *is* enabled by default, until walk them through turning it off? Why? Because after anywhere from 2 days to 2 months, suddenly things just stop working...usually POP3, but often SMTP, HTTP or HTTPS. Like many things MS, it's broken. --- Is that what causes the random stoppage? I never thought of that, why would it prevent outgoing connections on only some ports though. Seems fishy, thanks for the tip though :-) BTW: I've seen this too. -Drew

1 0

firewall == network diaper, ranting in HTML
by neal rauhauser 402-301-9555 14 Aug '03

14 Aug '03

I've got to wonder about someone who posts a rant to nanog to begin with and I'll give you kudos for having the balls to format it in HTML as well. Below I included the text of the message sans large aqua font & other HTML 'enhancements'. I think you rather missed my point - machines with incontinent TCP/IP stacks or incontinent applications should not be plugged in to the internet for server duty. It is just that simple. Unix has its occasional dribbles, Microsoft needs to be restrained and catheterized. Cisco could make one giant leap for mankind by simply renaming the PIX Firewall to the PIX Network Diaper. Its a more truthful description of what those things do and it might just get the people who sign checks asking why applications straight out of preschool are being placed in the field with a MCWN+N(Microsoft Certified Wet Nurse + Nanny) to watch over them, when perfectly functional adult alternatives exist. I'd really like to get down and roll in the muck with you guys, but I'm busying replacing M$ systems with FreeBSD 4.8 ... ----- Original Message ----- From: neal rauhauser 402-301-9555 To: Måns Nilsson ; nanog(a)merit.edu Sent: Wednesday, August 13, 2003 11:48 PM Subject: Re: Port blocking last resort in fight against virus Måns Nilsson wrote: > > Firewalls are a patch to broken network application architechture. If > > your applications would have been properly designed, you would not have > > the need for firewalls. They are for perimeter defence only anyway. Right on - if you can't plug a machine directly in to the internet and rely on its own defenses & well written code to keep it safe, why are you plugging it in at all? Oh come ON! Let's be a little real about this. How many millions of "don't have a clue, don't want a clue" people do you know who want to get online and see porn or nice pictures in other countries on "THE" Internet as the clueless call internet? How many businesses do you suppose there are that connect through a "disk from an internet service provider" and have the ISP set up a web site FOR them from where they get emails through a mailto link? There are literally MILLIONS of machines that want to be on internet without a clue about protecting at all. If they all knew how to protect, YOU would be working in something else! Lord help me what an attitude! When I was 17 and got my first car, I learned some about keeping it on the road but I found it didn't interest me too much and times and cars have changed since then. So, I get a mechanic to keep my car on the road and pay him. Don't tell me that anything you want to do even outside of computers at all you CAN do? Surely you rely on a mechanic to keep your car on the road. Maybe that mechanic is saying "If you cant keep your car on the road why are you driving at all?" Honestly the attitude of some people in I.T. gives me the shits. I know a LOT of businesses that USE computers but don't make money out of selling or servicing them. Get real - we are the "mechanics" of the computer world and it is up to US to let our customers know the truth. Don't forget, there are a lot of people about who are OLDER than 40 and use computers. Those people can REMEMBER being frustrated with computers even though some of them know as much as YOU do now. 20 something year olds are too young to remember that frustration and they end up with YOUR attitude as a result! There will come a day when the attitude of I.T. security people needs to be friendly to earn money. Learn to be friendly now ahead of time! Greg.

1 0

analysis of msblast
by Steve Bellovin 14 Aug '03

14 Aug '03

There's a disassembly at http://www.securityfocus.com/archive/1/333208/2003-08-11/2003-08-17/0 --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: How much longer..
by Scott Francis 14 Aug '03

14 Aug '03

On Wed, Aug 13, 2003 at 04:09:05PM -0700, dr(a)kyx.net said: > These kinds of inflated damages estimates are dubious at best. > If you've lost that much productivity, odds are you should be pointing > fingers at inapropriate redundancy and planning/procedures in your > computing facilities and not blaming some toy programs written by kids > with too much time. This kind of financial loss hype/fear-mongering is best > left to politicians, and not technical discussions. indeed - and yet companies claim these kind of damages, at least publicly, whenever these worms come along (every month or two, it seems). Two questions spring to mind: 1) where are these figures coming from, and 2) if they're accurate, why in the world would a company make the same mistake that cost them a million bucks last month, again next month? That's the kind of stuff that gets executives fired (you'd think) ... (note: the figures I posted were just gathered from publicly available news sources. We all know how accurate reporters tend to be when covering technical issues, so take them with a grain of salt. The point of the post was, there are a great many companies out there throwing good money after bad, month after month, without seeming to realize it.) -- Scott Francis || darkuncle (at) darkuncle (dot) net illum oportet crescere me autem minui

1 0