September 2003 - Test - lists.nanog.org

RE: Address for making BGP changes w/ Qwest?
by Joel Perez 04 Sep '03

04 Sep '03

Hey Dave, I have been using their QwestSource web page for a while now to make any routing changes. The site is https://qwestsource.net/qwestsource/workTemplate.jsp ---------------------------------------------- Joel Perez <jperez(a)ntera.net> | IP Engineer http://www.ntera.net/ | Ntera 305.914.3412 -----Original Message----- From: Temkin, David [mailto:temkin@sig.com] Sent: Thursday, September 04, 2003 11:05 AM To: nanog(a)merit.edu Subject: Address for making BGP changes w/ Qwest? bgp-admin(a)qwestip.net doesn't work anymore. Is there anyone from Qwest on the list or can someone point me to where I'm supposed to be making these changes now? (Call tech support?!) Thanks, Dave

1 0

What do you want your ISP to block today?
by Sean Donelan 04 Sep '03

04 Sep '03

Which Microsoft protocols should ISP's break today? Microsoft Exchange? Microsoft file sharing? Microsoft Plug & Play? Microsoft SQL/MSDE? Microsoft IIS? It would be so much easier if worm writers followed the RFC's and set the Evil Bit. China has firewalled the entire country, and they have more infected computers than the US. http://www.vnunet.com/Analysis/1143268 > Although companies may have the infrastructure to deal with the current > band of worms, Trojans and viruses, there is currently a line of defence > that is not in place. "The problem isn't Microsoft's products or the > knowledge of the consumer. The problem lies in the ISPs' unwillingness > to make this issue disappear or at least reduce it dramatically," said > Cooper. > He added that ISPs have the view and ability to prevent en-masse > attacks. "All these attacks traverse their networks before they reach > you and me. If they would simply stop attack traffic that has been > identified and accepted as such, we'd all sleep better," Cooper said.

31 73

Re: What do you want your ISP to block today?
by Vinny Abello 04 Sep '03

04 Sep '03

At 02:51 PM 9/3/2003, Sean Donelan wrote: >On Wed, 3 Sep 2003, Johannes Ullrich wrote: > > I just summarized my thoughts on this topic here: > > http://www.sans.org/rr/special/isp_blocking.php > > > > Overall: I think there are some ports (135, 137, 139, 445), > > a consumer ISP should block as close to the customer as > > they can. > >If ISPs had blocked port 119, Sobig could not have been distributed >via USENET. > > >Perhaps unbelievably to people on this mailing list, many people >legitimately use 135, 137, 139 and 445 over the open Internet >everyday. Which protocols do you think are used more on today's >Internet? SSH or NETBIOS? > >Some businesses have create an entire industry of outsourcing Exchange >service which need all their customers to be able to use those ports. > >http://www.mailstreet.net/MS/urgent.asp > >http://dmoz.org/Computers/Software/Groupware/Microsoft_Exchange/ > >If done properly, those ports are no more or less "dangerous" than >any other 16-bit port number used for TCP or UDP protocol headers. > > >But we need to be careful not to make the mistake that just because >we don't use those ports that the protocols aren't useful to other >people. Even on Windows they can be used in a much safer fashion (although I would never attempt it for any of my stuff). It is possible to use IPSec policies on 2000 and higher to encrypt all traffic on specified ports to specified hosts/networks and block all other traffic. I bet some people are using this to join remote locations securely to each other for Windows networking with these ports and IPSec policies. Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN There are 10 kinds of people in the world. Those who understand binary and those that don't.

7 7

Re: Distributed sniffer products
by Greg Maxwell 04 Sep '03

04 Sep '03

> Does anyone have a *GOOD* screenrc example config? I was VERY confused by > the info file. > (OT, I know, but...) Here is one we find useful for monitoring the behavior of a firewall: split split screen -t desktop 0 tcpdump -ni desktop not port 22 focus screen -t external 1 tcpdump -ni external not port 22 focus screen -t server 2 tcpdump -ni server not port 22

1 0

AOL people on list?
by Drew Weaver 04 Sep '03

04 Sep '03

Contact me off-list please. -Drew

1 0

AT&T NYC
by Bryan Heitman 03 Sep '03

03 Sep '03

Anyone seeing any problems with ATT in new york? Best regards, Bryan Heitman Interland, Inc.

10 11

On the back of other 'security' posts....
by Matthew Sullivan 03 Sep '03

03 Sep '03

Hi All, On the back of the latest round of security related posts, anyone notice the 50% packet loss (as reported to me) across the USA -> NZ links around lunchtime (GMT+10) today? Yet more spoofed traffic aimed at the SORBS nameservers - this time enough to crash a core router of my upstream... Hopefully the commercial damage now may insite people getting damaged by these DDoSes to start proceedings against those ISPs whom continue to show a lack of respobsibility and allow unfiltered spoofed DDoS traffic from their networks. Certainly I have been told to talk to various US authorities about the problem, and will be doing so as soon as I have the nessesary information. In the mean time a plea to people on this list in all countries - watch for the DDoS attacks (particually against 203.15.51.33, 203.15.51.35, 203.15.51.44 & 203.101.254.254) and stop the damn traffic before you are held responsible for your customers actions. There is still a 10k pps SYN flood occuring 8 hours later - this is being rate limited upstream. ..and if the perps are on this list, keep going if you want, the more you do the more likely you'll get caught. You will not force SORBS off the net like you have Osirusoft. I and SORBS will leave when we are good and ready, and not because of some infantile spotty faced 15 year old nerd without a clue on life. / Mat

14 22

RE: Distributed sniffer products
by Braun, Mike 03 Sep '03

03 Sep '03

We've been playing with Wildpackets http://www.wildpackets.com/. They sniff LAN to Gig and some WAN as well. The Distributed model is still vaporware, but is said to be out soon. The expert analysis is comparable if not better than NAI. Mike Braun -----Original Message----- From: Brennan_Murphy(a)NAI.com [mailto:Brennan_Murphy@NAI.com] Sent: Wednesday, September 03, 2003 1:02 PM To: owen(a)delong.com; JAustad(a)temgweb.com; nanog(a)merit.edu Subject: RE: Distributed sniffer products The cost benefit analysis on Ethereal/etc vs Sniffer on anything but the smallest of networks is usually very easy to make. The fundamental issue is what questions do you have and should you have about your network and what tool answers those questions efficiently and reliably. Good protocol analyzers sell because they save time in answering important questions. Sniffer recently released a SMB Sniffer called Netasyst...worth a look if cost has been an issue in the past. So ends this biased response. :-) -----Original Message----- From: Owen DeLong [mailto:owen@delong.com] Sent: Wednesday, September 03, 2003 2:50 PM To: Austad, Jay; 'nanog(a)merit.edu' Subject: Re: Distributed sniffer products Etherial and other libpcap tools work reasonably well, can be easily deployed using commodity hardware, and would cost you a lot less than NetAssoc. Owen --On Wednesday, September 3, 2003 1:07 PM -0500 "Austad, Jay" <JAustad(a)temgweb.com> wrote: > > Anyone have any experience with these? I'm looking for something > similar to Network Associates Sniffer product. > > Are there any open source projects that are decent? What are others > using? > > ---------------- > Jay Austad > Senior Network Analyst > Travelers Express / MoneyGram > e: jaustad(a)temgweb.com p: 952.591.3779

1 0

RE: Distributed sniffer products
by Brennan_Murphy＠NAI.com 03 Sep '03

03 Sep '03

The cost benefit analysis on Ethereal/etc vs Sniffer on anything but the smallest of networks is usually very easy to make. The fundamental issue is what questions do you have and should you have about your network and what tool answers those questions efficiently and reliably. Good protocol analyzers sell because they save time in answering important questions. Sniffer recently released a SMB Sniffer called Netasyst...worth a look if cost has been an issue in the past. So ends this biased response. :-) -----Original Message----- From: Owen DeLong [mailto:owen@delong.com] Sent: Wednesday, September 03, 2003 2:50 PM To: Austad, Jay; 'nanog(a)merit.edu' Subject: Re: Distributed sniffer products Etherial and other libpcap tools work reasonably well, can be easily deployed using commodity hardware, and would cost you a lot less than NetAssoc. Owen --On Wednesday, September 3, 2003 1:07 PM -0500 "Austad, Jay" <JAustad(a)temgweb.com> wrote: > > Anyone have any experience with these? I'm looking for something > similar to Network Associates Sniffer product. > > Are there any open source projects that are decent? What are others > using? > > ---------------- > Jay Austad > Senior Network Analyst > Travelers Express / MoneyGram > e: jaustad(a)temgweb.com p: 952.591.3779

1 0

Cisco Service Provider code - Any good?
by Jason Frisvold 03 Sep '03

03 Sep '03

All, It was requested that I post this email to the Nanog list as the person in question does not have posting ability... :) Hello All, We're currently looking into migrating our Cisco 72xx and 75xx routers to Service Provider IOS and I was wondering if anyone has had any good luck with a certain version? We've seen that 12.0(25)S1 seems to be an ok version but I have also heard some gripes about it. The PAs that we run in most of the units are the following: ATM-OC3-MM ATM-OC12-MM FastE GigE The IOS would also have to support RFC-1483 connections (Preferrably RBE), BGP, IS-IS and any other basic services of the such. Thanks in advance… -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]

2 2