October 2004 - Test - lists.nanog.org

Cracker U.
by frank＠dticonsulting.com 07 Oct '04

07 Oct '04

Try this, instead, if you are getting 404s: http://makeashorterlink.com/?B24816979 --------------- On Thu Oct 7 8:55 , Blaxthos <blaxthos(a)bash.org> sent: >http://www.technologyreview.com/articles/04/10/ap_2100504.asp\?trk=nl > >i get a 404 for that url > >8:55am CDT > >/blax On Thu Oct 7 8:11 , Randy Bush <randy(a)psg.com> sent: > >> "North Korea Has Some 600 Computer Hackers, South Korea Says" > >and in some years, they may catch up to the us > >randy >

1 0

Re: short Botnet list and Cashing in on DoS
by frank＠dticonsulting.com 07 Oct '04

07 Oct '04

Since we're posting articles this morning: "North Korea Has Some 600 Computer Hackers, South Korea Says" >From MIT's Tech Review Newsletter: "They don't need physical nukes to create problems ... They (the North Koreans) could just exploit our network vulnerabilities. It's completely doable." http://www.technologyreview.com/articles/04/10/ap_2100504.asp\?trk=nl frank(a)fttx.org On Thu Oct 7 0:10 , 'J. Oquendo' <sil(a)politrix.org> sent: > > > >I've been slowly compiling a list of known botnets should >anyone care to filter, or check them in your netblocks if someone in your >range is passing off garbage, etc. Information has been passed from others >admins having to deal with these pest. Care to pass on a host that you're >seeing I'll post it for others to see as well. Perhaps when I have >spare time, I may or may not throw up something where admins can check, >add, hosts they're seeing. Don't know if I want my connection getting >toasted for doing so, but it could be something informative, a-la >spamhaus. Bothaus anyone? > >http://www.infiltrated.net/sdbot-irc-servers.txt > > >------------- >Virus writers seek cash from chaos >By John Leyden >The Register >http://www.theregister.co.uk/2004/10/06/vxers_cash_in/ > >Last month Trend Micro, the anti-virus firm, recorded a six-fold increase >in malware compared to September 2003. It detected 1,485 new items of >malware last month, compared to 250 new types of malicious code in the >same period last year. > >... > >Trend also records the emergence of the first JPEG virus in September, and >notes that the most damaging variant of the Sasser worm - Sasser-B - is >still prevalent four months after its first appearance in the wild. >------------- > > >=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ >J. Oquendo >GPG Key ID 0x51F9D78D >Fingerprint 2A48 BA18 1851 4C99 > >CA22 0619 DB63 F2F7 51F9 D78D >http://pgp.mit.edu:11371/pks/lookup\?op=get&search=0x51F9D78D > >sil @ politrix . org http://www.politrix.org >sil @ infiltrated . net http://www.infiltrated.net > >"How can we account for our present situation unless we >believe that men high in this government are concerting >to deliver us to disaster?" Joseph McCarthy "America's >Retreat from Victory"

3 2

Routes Selection
by Abhishek Verma 07 Oct '04

07 Oct '04

Hi, Given two routes similar in preference (BGP steps) where each is received from a different ISP (or technically speaking an AS). How do I as a network operator decide which one to install in the forwarding table? Here goes the list of options that i have: (a) I can install both the routes in my FIB and split the traffic. Packet reordering would not be a problem as most of the modern routers hash packets based on the fields carried in the IP header. Thus similar packets would flow in same direction. OAM can be a minor issue. But its not something that is impossible to sort out. People have been anyway doing it for IGPs. (b) I could select one route based on *some* policy. I would love to get an insight on what kind of policies people use to route traffic. Now, I use just one route. The other comes live into action when the primary or my first one goes down. I get redundancy but I lose bandwidth. To save bandwidth I could write policies/routemaps/etc to send some traffic over one link and the remaining over the other. But then this is static and does not guarantee an equal or a just split of traffic. Any help/comments on this would be highly appreciated. Regards, Abhishek V. -- Class of 2004 Institute of Technology, BHU Varanasi, India

1 0

Leucadia Selloff
by Fergie (Paul Ferguson) 05 Oct '04

05 Oct '04

Leucadia National sold all of its MCI stock. The conglomerate filed an 8-K with the SEC stating that it sold its 5% stake in the carrier. According to the document the sale brought in a pre-tax profit of about $20 million for Leucadia. The investment company says the sale "should not be interpreted to mean that (Leucadia) is no longer interested in acquiring control of MCI, but no assurance can be given that (it) will acquire control of MCI." Leucadia in July filed for permission with the SEC to buy 50% of MCI's shares. http://www.nwfusion.com/edge/news/2004/0928mci.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Re: NANOG 32 PGP key signing
by Jonathan McDowell 05 Oct '04

05 Oct '04

In article <20041004194249.1ac15275(a)216-80-33-36.drb-bsr1.chi-drb.il.cable.rcn.com> (earth.lists.nanog) you wrote: > Those of you attending NANOG 32 are encouraged to submit your public PGP > key to take part in the regular key signing event. ... > As usual, the group PGP signing event will occur following the nsp-sec > BoF on Monday night. Full details for the NANOG 32 PGP signing event > can be found here: > <http://www.nanog.org/pgp.html> There doesn't seem to be a lot of emphasis on identity verification according to this page. It only says "You might want to bring photo id with you". Personally, and all the keysignings I've been involved with and people I've spoken to about them, you should *always* verify government issue photo id when agreeing to sign someone's key. Len Sassaman's Efficient Group Key Signing Method is worth a read too. It's at: http://sion.quickie.net/keysigning.txt J. -- "Just because I'll spend 4 hours | .''`. Debian GNU/Linux Developer automating a task that takes 4 | : :' : Happy to accept PGP signed minutes by hand doesn't mean I'm | `. `' or encrypted mail - RSA + not lazy." -- Mike Sphar, asr | `- DSA keys on the keyservers.

2 1

NANOG 32 PGP key signing (fwd)
by Susan Harris 05 Oct '04

05 Oct '04

Thanks John! One slight modification - we'll be meeting in Fairfax B rather than in the ballroom. ---------- Forwarded message ---------- Date: Mon, 4 Oct 2004 19:42:49 -0500 From: John Kristoff <jtk(a)northwestern.edu> To: nanog(a)merit.edu Subject: NANOG 32 PGP key signing Those of you attending NANOG 32 are encouraged to submit your public PGP key to take part in the regular key signing event. Even if you may not be able to attend the group PGP key signing event, but will be at NANOG 32, you are encouraged to submit your key anyway. You can always meet up with other PGP key users and sign keys on your own time. Adding your public key to NANOG 32's key ring is easy. Just upload your public key here: <https://www.biglumber.com/x/web?keyring=7840> or send me an email with your PGP public key inline with the subject 'NANOG PGP key' if you'd rather and I'll do it for you. As usual, the group PGP signing event will occur following the nsp-sec BoF on Monday night. Full details for the NANOG 32 PGP signing event can be found here: <http://www.nanog.org/pgp.html> Feel free to drop me an email offlist if you need any assistance, particularly if you are setting up PGP for the first time. John

1 0

Blackhole Routes
by Abhishek Verma 05 Oct '04

05 Oct '04

Hi, There are ways to add static routes that can be blackholed. I can understand the utility of such routes if those are installed in my forwarding table. What bewilders me is why would anyone want to advertise "blackhole" routes using say, BGP? Is it only to prevent some sort of DoS attacks or are there other uses also of advertising black hole routes? Thanks, Abhishek -- Class of 2004 Institute of Technology, BHU Varanasi, India

22 36

China Telecom Contact
by Josh Fleishman 04 Oct '04

04 Oct '04

I'm looking for an Engineering contact at China Telecom. An English speaker is preferred. Thanks and sorry about the spam, however this is urgent. Josh _____________________________ Josh Fleishman Staff Network Engineer, CCNP Earthlink, Inc

1 0

NANOG 32 PGP key signing
by John Kristoff 04 Oct '04

04 Oct '04

Those of you attending NANOG 32 are encouraged to submit your public PGP key to take part in the regular key signing event. Even if you may not be able to attend the group PGP key signing event, but will be at NANOG 32, you are encouraged to submit your key anyway. You can always meet up with other PGP key users and sign keys on your own time. Adding your public key to NANOG 32's key ring is easy. Just upload your public key here: <https://www.biglumber.com/x/web?keyring=7840> or send me an email with your PGP public key inline with the subject 'NANOG PGP key' if you'd rather and I'll do it for you. As usual, the group PGP signing event will occur following the nsp-sec BoF on Monday night. Full details for the NANOG 32 PGP signing event can be found here: <http://www.nanog.org/pgp.html> Feel free to drop me an email offlist if you need any assistance, particularly if you are setting up PGP for the first time. John

1 0

Draft NANOG Agenda
by Susan Harris 04 Oct '04

04 Oct '04

NANOG32 DRAFT Agenda October 17-19, 2004 Reston, Virginia Sunday Tutorials/Reception -------------------------- 1:30 - 3:00 p.m. BGP Multihoming Techniques Level: Introductory Philip Smith, Cisco 1:30 - 3:00 p.m. Options for Blackhole and Discard Routing Level: Introductory/Intermediate Joe Soricelli, Juniper Wayne Gustavus, Verizon 3:00 - 3:30 p.m. BREAK 3:30 - 5:00 p.m. BGP Multihoming Techniques (cont'd.) 3:30 - 5:00 p.m. Internet Number Resource Management and Administration Level: Introductory Ray Plzak/Richard Jimmerson, ARIN 5:00 - 7:00 p.m. AOL WELCOME RECEPTION 7:30 - 8:15 p.m. ISP Security Toolkits Level: Introductory/Intermediate Tim Battles, AT&T 7:30 - 9:00 p.m. IPv6 Deployment and Case Studies Level: Introductory/Intermediate Salman Asadullah and Ciprian Popoviciu, Cisco Monday, October 18 ------------------ 9:00 a.m. Welcome, Introductions Ray Plzak, ARIN Rich Collela, AOL Ron da Silva, Time Warner Cable Susan Harris, Merit 9:20 a.m. Good Engineering Practice as it Applies to Unlicensed Wireless Networks Tim Pozar, Late Night Software 10:05 a.m. 802.1X: Deployment Experiences and Obstacles to Widespread Adoption Terry Simons, University of Utah; open1x.org Jon Snyder, Portland State University 10:35 a.m. BREAK 11:05 a.m. Extension of Multi-Service Networks Dave Siegel, Global Crossing 11:35 a.m. Network Design to Support Very High-Capacity Streaming and Caching Infrastructures Vijay Gill, AOL Time Warner 12:00 p.m. LUNCH (on your own) 1:30 p.m. Impressions: An Overview of the Global IPv6 Routing Table Gert Doering, SpaceNet AG, author Cathy Wittbrodt, presenter 2:00 p.m. Botnets John Kristoff, Northwestern University 2:45 p.m. What Will Stop Spam? Charles Stiles, AOL 3:05 p.m. Optical Switching, a Great Tool In Platform Migration at AMS-IX Romeo Zwart, Amsterdam Internet Exchange 3:35 p.m. BREAK 4:05 p.m. RESEARCH FORUM -------------- Sizing Router Buffers Guido Appenzeller, Stanford University Performing BGP Experiments on Semi-Realistic Internet Environment Ke Zhang, Soon-Tee Teoh, Shih-Ming Tseng, Chen-Nee Chuah, Kwan-Liu Ma, and Felix Wu, University of California, Davis Monday Evening BOFs & Key Signing --------------------------------- 7:30 - 9:00 p.m. ISP Security and NSP-SEC BOF VII Danny McPherson, Arbor, and Merike Kaeo, Double Shot Security, moderators 9:00 - 9:30 p.m. PGP Key Signing John Kristoff, Northwestern University, host 9:00 - 10:30 p.m. Optimizing Operational Input to ARIN: What Is Needed and How Do We Get It? ARIN Staff, moderators Tuesday, Oct. 19 ---------------- 9:00 a.m. Evolving the Core: Deployment Challenges and the Internet Scott Marcus, FCC 9:30 a.m. A History of IPv4 and ASN Allocations Geoff Huston and George Michaelson, APNIC, authors Philip Smith, Cisco, presenter 9:45 a.m. DNS Anomalies and Their Impact on DNS Cache Servers Katsuyasu Toyama, Keisuke Ishibashi, Tsuyoshi Toyono, Katsuyasu Toyama, NTT Labs; Masahiro Ishino, Chika Yoshimura, NTT Communications; Kazunori Fujiwara, JPRS 10:15 a.m. BREAK 10:45 a.m. DNSSEC Deployment: Big Steps Forward; Several Steps to Go Steve Crocker, Shinkuro 11:15 a.m. Tracking Global Threats with the Internet Motion Sensor Michael Bailey, Evan Cooke, University of Michigan Danny McPherson, Arbor Networks, Tim Battles, AT&T 11:45 a.m. RPSLng Status Update Larry Blunk, Merit 12:00 p.m. LUNCH (on your own) 1:30 p.m. Detecting Inconsistent Advertisements from Neighboring ASes Nick Feamster, MIT, Z. Morley Mao, Univ. of Michigan Jennifer Rexford, AT&T Research 2:00 p.m. aflow - a Network Analysis Tool Dan Ardelean, ARIN/Purdue University 2:30 p.m. LinkRank: A Tool for Diagnosis of BGP Routing Dynamics Mohit Lad, UCLA; Dan Massey, Colorado State University; Lixia Zhang, UCLA 3:00 p.m. Life and Times of J-Root Piet Barber, Matt Larson, Mark Kosters, and Pete Toscano, Verisign 3:30 p.m. Adjourn

1 0