September 2003 - Test - lists.nanog.org

Trends in network operator security
by Sean Donelan 30 Dec '03

30 Dec '03

Its 2003 and everyone is making their predictions. What trends are network operators seeing for Internet security? Old favorites Buffer overflows Distributed Denial of Service Poor passwords (cisco/sanfran) Poorly coded systems Blame the user for not protecting poorly coded systems Trends Attack the network (why? because we can) Proxy relay hiding (its not just for SMTP anymore) Combo Bot/Trojan/Worms Embedded software "upgrades" Any other trends network operators are seeing?

2 2

Cheap temperature sensors
by Robert Boyle 22 Oct '03

22 Oct '03

From time to time this thread pops up. I found something which looked interesting and the price was right. I bought one and WOW! It is VERY impressive stuff for any price especially considering how cheap it was. I purchased 10 individual temperature sensors and two temp/humidity sensors, and the SNMP Ethernet module. From unpacking the box to installing the eight sensors in the inlet and outlet ducting of our four A/C units, two more to the inside of two server racks and yet two more to the UPS and general rack areas for ambient temp/humidity monitoring to setting up MRTG graphing and SNMP traps total time was under 4 hours! Very nice stuff. It works out of the box with minimal setup and no fabrication, or development/programming needed. All of this for $445.00 delivered!!! I'm going to order a spare because I like the equipment so much and it is so cheap. http://dcf.sk/microweb/snmpmain.html -Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Good will, like a good name, is got by many actions, and lost by one." - Francis Jeffrey

4 3

Re: Some very strange network behaviors
by Gregory Hicks 07 Oct '03

07 Oct '03

> Date: Thu, 11 Sep 2003 13:35:37 -0700 > From: Crist Clark <crist.clark(a)globalstar.com> > > Mike Lewinski wrote: > > [...snip...] > OS's IP stack is misbehaving badly, Zone Alarm should not see the traffic > on the LAN that does not have his MAC address on it. > > How would a switch/router be deciding that these other IP addresses > should go to his PC's NIC (MAC address)? Unless the switch got confused when the MAC address changed as it did...? Then the switch would go into "broadcast" or "flood" mode where every packet is delivered to evey port because the switch doesn't know where to send it. Regards, Gregory Hicks > -- > Crist J. Clark crist.clark(a)globalstar.com > Globalstar Communications (408) 933-4387 --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com Never attribute to malice that which is adequately explained by ignorance or stupidity. Asking the wrong questions is the leading cause of wrong answers "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

4 3

ICMP Blocking Woes
by CA Windon 03 Oct '03

03 Oct '03

Dear NANOG-ers, I work for an information security company that is dependant upon ICMP for network mapping purposes (read: traceroute). On or about August 18, we were told, our upstream provider began blocking ICMP packets at its border in the Chicago NAP in an effort to cut down on the propagation of 'MSBlast'. This has effected our ability to accurately map our customers networks. We've been in contact with an engineer in this provider's NOC who is either unable or unwilling to remove this ACL for our block of IPs. Currently, we've been given two options. (1) Deal with the effect of the ACL until 'MSBlast' traffic subsides, or (2) they are willing to reroute our traffic out of the Chicago NAP to a border router that, they claim, does not have the same ACL. The problem with option 2 is that they would force us to renumber. This is a problem for us, as it would impact our customers as well. What options can I take to my management that would cause the least impact to the services we provide while not causing undue work for our clients. Also, what other options could I suggest to my upstream provider? TIA, C. Windon __________________________________ Do you Yahoo!? The New Yahoo! Shopping - with improved product search http://shopping.yahoo.com

15 20

Re: Alternative Satellite news feed needed
by Pete Ashdown 02 Oct '03

02 Oct '03

My cursory investigations reveal there is no apparent alternative to Cidera in the US right now. I'd be interested in talking to anyone who knows the technology behind uplinking a newsfeed in order to replace Cidera's news service. I'd guess there is a whole lot of infrastructure on the client end collecting dust as of today.

4 4

Re: Annoying dynamic DNS updates
by Stewart, William C (Bill), RTSLS 01 Oct '03

01 Oct '03

Some cable user's machine running default-configured MS apps is sending Paul dynamic DNS queries that it shouldn't, because somehow it's decided he's got an interesting destination (I'm guessing f.root-servers.net ?) Paul wants the user to get an error popup about it. Well, default-configured Microsoft applications have an application that lets you send a machine popup dialog boxes; it's been discussed here recently because spammers abuse it and (related discussion) it uses Port 135, so it might or might not be blocked by Comcast.net. So the obvious thing to do is find whichever program it is you use to send those messages, and start sending popups, guessing that it might not be blocked. The user's unlikely to have a clue what to do about them, but if you include a URL, you may get their attention.

5 4

Adjusting TCP windows on production systems?
by Temkin, David 01 Oct '03

01 Oct '03

Is there anyone in a production environment who, as part of their system build process, adjusts the TCP receive window/MSS/etc. on production systems? I'm dealing with a few latency issues and the MSS settings improve them, but I'm hesitant to suggest it unless there's something I can point to. -Dave

5 6

Network abuse - Phone Wars
by Sean Donelan 30 Sep '03

30 Sep '03

CNN and Fox News personalities have been trading phone numbers. CNN Tucker Carlson gave out Fox News's Washington bureau phone number on the air. Fox New retaliated by posting Carlson's unlisted home number on its Web site. The result was both sides have been innundated with many phone calls (some might even describe it as harrasment). http://www.washingtonpost.com/wp-dyn/articles/A15000-2003Sep28.html No word if either Fox News or CNN violated Verizon's telephone acceptable use policies or if Verizon will terminate both CNN and Fox News' telephone privileges.

1 0

ATTN: Anyone with RBL clue at att.net
by Ben Browning 30 Sep '03

30 Sep '03

Something must be highly broken at ATT. I have been receiving tons of emails in response to a Usenet posting I made months ago asking if anyone knew how to get out of att.net's private RBL. The procedure: What I did: Called the contact in the whois record... Administrative Contact, Technical Contact: GNMC (VXGTRUVDOO) rm-hostmaster(a)ems.att.com 3324 Hollenberg Bridgeton, MO 63044 US 314-264-9672 fax: 281-664-9975 Asked for their abuse department. Kept asking and calling back and leaving messages, etc, until finally I got a response. It took me several days. AT&T - please document the removal procedures on your website immediately. You are apparently doing some very heavyhanded blocking and professionalism demands you at least give admins some recourse to figure out why they are blocked and how to fix their problems. ~Ben --- Ben Browning <benb(a)theriver.com> The River Internet Access Co. WA Operations Manager 1-877-88-RIVER http://www.theriver.com

1 0

Re: [Re: Don't like it, order the ISPs to block it]
by Joshua Sahala 30 Sep '03

30 Sep '03

Mike Tancsa <mike(a)sentex.net> wrote: > > I would be happy just to see ISPs live up to their own published AUP. > The Internet would be a MUCH nicer place if this were the case. think NIMBY (not in my back-yard, or rather, not at my isp) - as several well-known list members say, "i encourage my competitors to do it..." too many network operators/admins/engineers/managers like the freedom to do as they choose, and will exclude themselve (and/or their friends) from certain policies. execs like to do this as well - who here has had to open the firewall to allow some sort of microsoft 'service' through? *raising hand* it is stupid, and they should know better, but they can't be bothered to think about little things like security all of the time... > Why does the topic of AUP enforcement gravitate towards straw man > discussions of totalitarian governments? Yeah, I am sure the North > Korean ISP scene is no fun. But this is North America. If a company > wines about the fact that they dont have a business plan that allows > for the enforcement of their published rules ("oh, it just costs too > much money"), they should not BS the public that they have such rules > in the first place. it goes deeper than just isps - corporate america doesn't seem to like watching itself. it likes to try and get away with as much as possible (maximize profits while staying within the law (but only just so)) > If we want our industry to be self policing, and not policed by the > public sector, we better start policing ourselves. i'm sure that mci, global crossing, verisign, enron, and others would publicly agree with you, while privately breaking/bending as many rules as possible for their own benefit * note that i only named them because they are recent cases which demonstrate my point - i know there are others, those just happen to be the 'biggest' my $0.02 /joshua > ---Mike > [cut] "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0