October 2004 - Test - lists.nanog.org

RE: BW Management solutions advice
by Albinati, Luis Martin 25 Oct '04

25 Oct '04

AFAIK, Allot boxes do have an option to decide whether or not to drop traffic above a certain definable number of connections, which is not really an attack recognition but its as close as it gets in their box. Anyway, as you say, they don't react automatically, you need to set it first :( > On Fri, 22 Oct 2004, Albinati, Luis Martin wrote: > > I am considering some bandwidth management solutions and > would like to > > know if some of you people have had some real world > experiences with > > this kind of boxes. More specifically I am looking at some > Large-ISP > > or Carrier-Grade solutions with at least the following > specifications: > > > > >= 1Gbps traffic capacity > > >500k simultaneous connections > > Layer 7 stateful packet inspection (via protocol signatures and/or > > protocol analysis) Traffic prioritization, shaping, QoS and > bandwidth > > provisioning based on custom defined policies (vlan id, ip ranges, > > tos, time of day, etc) possibility to easily update and > deploy new or > > modified protocol definitions without affecting availability. > > Add here: "automatic rate-limiter adaptation" / "attack > pattern recognition". > > Do we still have solutions on the table? I'd be interested > what kind of solutions are available in Gbit/s-grade which do > not need you to configure certain kind of rate-limiters a > priori, but can automatically react to most kinds of attacks, > even simple ones (e.g., TCP SYN floods). > > -- > Pekka Savola "You each name yourselves king, yet the > Netcore Oy kingdom bleeds." > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings > >

1 0

ATM PNNI Idea bounce
by John Bittenbender 25 Oct '04

25 Oct '04

Nanogers, Sorry to bother, but I'm looking to bounce some ideas off someone that has experience in a large (150+) node ATM PNNI network. Please contact me offlist if you can spare a few moments to read a quick write-up and reply with thoughts. Thanks, John Bittenbender

1 0

Routing to external?
by joe 24 Oct '04

24 Oct '04

Greetings, I have an odd question that I'm faced with regarding routing to external address spaces. The senario is a large network (global) with multiple points, each POP has tail sites that home and default to that Ipop as a gateway of last resort. The question I'm wrestling with is at each pop I have a /24 range, would it be best practice to route internally to those address spaces versus routing through my pop to each? In otherwords, if say I have a network thats located in Russia and I'm attempting to get to it from North America, wouldn't it make more sense to route through my own WAN versus the internet? My thought is that since I have more control over my WAN than the internet, I can better anticipate the results, but one could argue that it may make more sense to use the internet from each pop. Any comments or thoughts are appreciated, Joe Blanchard

2 2

domain isn't registred, but does exist in root-servers?
by diederik＠dmclf.org 23 Oct '04

23 Oct '04

just wondering about the following: there is no whois-info for sedgq.com (response: No match for "SEDGQ.COM".) but, host sedgq.com sedgq.com has address 66.218.79.155 sedgq.com has address 66.218.79.147 sedgq.com has address 66.218.79.148 sedgq.com has address 66.218.79.149 how can this be? i mean, afaik a domein needs to be registred before its 'known' this because of an email i received like: ---- Received: from [66.179.231.27] (helo=ims-2.prv.ampira.com) by dmclf.com with esmtp (Exim 4.31) id 1CLSdk-0002yb-2c for dmclf(a)dmclf.com; Sat, 23 Oct 2004 22:37:28 +0200 Received: from cws-3.ampira.com ([66.179.231.35] helo=cws-3.prv.ampira.com) by ims-2.prv.ampira.com with esmtp (Exim 4.24) id 1CLSdc-0002q2-8O for dmclf(a)dmclf.com; Sat, 23 Oct 2004 16:37:20 -0400 Received: (from www@localhost) by cws-3.prv.ampira.com (8.11.7p1+Sun/8.11.7) id i9NKbGF19224; Sat, 23 Oct 2004 16:37:16 -0400 (EDT) Date: Sat, 23 Oct 2004 16:37:16 -0400 (EDT) From: auto-confirm(a)amazon.com To: dmclf(a)dmclf.com Subject: Amazon Security Request Dear Amazon User, During our regular update and verification of the accounts, we could not verify your current information. Either your information has changed or it is incomplete. As a result, your access to buy on Amazon has been restricted. To continue using your Amazon account again, please update and verify your information by clicking the link below : http://www.amazon.com@sedgq.com/exec/obidos/subst/home/?EnterConfirm&UsingSS L=0&pUserId=&us=445&ap=0&dz=1&Lis=10&ref=br_bx_c_2_2 Thank you very much for your cooperation! Amazon Customer Support Please note: This e-mail message was sent from a notification-only address that cannot accept incoming e-mail. Please do not reply to this message. Thanks again for shopping with us. Amazon.com Earth's Biggest Selection

3 2

Akamai
by Robert Scott 23 Oct '04

23 Oct '04

Any body else having trouble with Akamai site this AM. Started about an hour ago. C:\>tracert www.symantec.com Tracing route to a568.d.akamai.net [69.45.79.30] over a maximum of 30 hops: 1 <10 ms <10 ms <10 ms 10.69.98.1 2 <10 ms <10 ms <10 ms 68.216.192.17 3 16 ms <10 ms <10 ms 205.152.111.94 4 <10 ms 16 ms 15 ms axr01mia-7-0-0-1.bellsouth.net [65.83.237.50] 5 * * * Request timed out. 6 * * * Request timed out. 7 * * * Request timed out. 8 * * * Request timed out. AppleBees says "No Anheuser" Robert Scott says "NO APPLEBEES!" Join The Boycott! Robert D. Scott Associate Director Computer Services and Telecommunications Network Operations University of Central Florida Robert(a)mail.ucf.edu CSB-310 407-823-0662 Voice 407-823-5476 FAX 345-0662 Sun-Com 877-549-5390 Pager

5 4

north american backbone network diagrams
by Matt Bazan 23 Oct '04

23 Oct '04

I know these may be scarce now due to terrorist concerns but does anyone know where I can dig up current maps of MCI's and AT&T's north american nets? MCI appears to have yanked their american diagram..Thanks

5 5

level3 security operations contact?
by Henry Yen 23 Oct '04

23 Oct '04

Is there a Level3 Security Operations contact listening? Your reporting script is returning a ticket value of [null]. -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

1 0

BW Management solutions advice
by Albinati, Luis Martin 23 Oct '04

23 Oct '04

Hi, I am considering some bandwidth management solutions and would like to know if some of you people have had some real world experiences with this kind of boxes. More specifically I am looking at some Large-ISP or Carrier-Grade solutions with at least the following specifications: >= 1Gbps traffic capacity >500k simultaneous connections Layer 7 stateful packet inspection (via protocol signatures and/or protocol analysis) Traffic prioritization, shaping, QoS and bandwidth provisioning based on custom defined policies (vlan id, ip ranges, tos, time of day, etc) possibility to easily update and deploy new or modified protocol definitions without affecting availability. In the past days I've been analyzing solutions from Allot and P-Cube, and some of them would seem to be fine, but I would like to know if you have had experiences with these or other products that might fit for the job. I would greatly appreciate all the advices, recommendations or suggestions that you may want to share about this. Thanks in advance. Regards, Luis M. Albinati Prima S.A. Argentina (AS10481)

3 2

RE: short Botnet list and Cashing in on DoS
by Hannigan, Martin 22 Oct '04

22 Oct '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Paul Vixie > Sent: Thursday, October 07, 2004 12:29 PM > To: nanog(a)merit.edu > Subject: Re: short Botnet list and Cashing in on DoS > > > > > > ..., a-la spamhaus. Bothaus anyone? > > > > The problem with that is the list rapidly updates and must > be maintained > > with some level of frequency and there's a level of trust > involved in it > > as well. > > i consider www.cymru.com to be an excellent beginning toward > that goalset. > > > Going after the bots is lesser effort. The controllers are > a priority. > > wide scale BCP38 conformity is the only way any of this will > ever happen. You mean the bots? The controllers are behind the bots. Also, in John's presentation..: http://www.nanog.org/mtg-0410/pdf/kristoff.pdf [..]we additionally request that they resolve the RR to 127.0.0.3 before they lock out and reload the zone. We picked 127/8 as the standard. RFC 1918 wasn't suitable for obvious reasons. -M

2 1

Weird MTU and TCP retranmission problem
by Sam Stickland 22 Oct '04

22 Oct '04

I haven't seen anything like this before, so I'm hoping someone here could enlighten me. We have a customer that has taken a single co-located server from us. They can download large files from this server to any machine, except the Mac OS X machines at the end of their shared leased line at their office premises. Windows and OS9 machines at this site can download these files fine, as can Mac OS X machines at the end of consumer ADSL lines (offsite). Downloads just stall shortly after starting, which initially appears to an MTU problem. Lowering the MTU on the affect Mac OS X machines fails to solve the problem until the MTU is set to 100 (yes 100) bytes. Strange that the windows machines don't have this problem. These affected Mac OS X machines don't experience this problem if the exact same files are downloaded from a different server in the same datacentre, behind the same router. An ethereal dump of a failed download shows the following: 1.873772 Mac -> Server TCP [TCP Dup ACK 203#32] 7798 > http [ACK] Seq=786 Ack=106053 Win=65535 Len=0 TSV=4064715650 TSER=2370598 1.874145 Server -> Mac HTTP Continuation 1.885515 Mac -> Server TCP [TCP Dup ACK 203#33] 7798 > http [ACK] Seq=786 Ack=106053 Win=65535 Len=0 TSV=4064715650 TSER=2370598 1.885889 Server -> Mac HTTP Continuation 1.897384 Mac -> Server TCP [TCP Dup ACK 203#34] 7798 > http [ACK] Seq=786 Ack=106053 Win=65535 Len=0 TSV=4064715650 TSER=2370598 1.897758 Server -> Mac HTTP Continuation 1.909627 Mac -> Server TCP [TCP Dup ACK 203#35] 7798 > http [ACK] Seq=786 Ack=106053 Win=65535 Len=0 TSV=4064715650 TSER=2370598 1.921996 Mac -> Server TCP [TCP Dup ACK 203#36] 7798 > http [ACK] Seq=786 Ack=106053 Win=65535 Len=0 TSV=4064715650 TSER=2370598 1.933865 Mac -> Server TCP [TCP Dup ACK 203#37] 7798 > http [ACK] Seq=786 Ack=106053 Win=65535 Len=0 TSV=4064715650 TSER=2370598 which leads me unsure as to whether the server is failing to receive the ACKs (hence the ACK retransmission) or whether the Mac is failing to receive the next packet so is retransmitting what it believes to be a lost ACK for the last packet? The server is an HP Proliant running Windows 2003, setup and installed by HP. It's running the built-in windows firewall (ICF), but the effects are the same if this is disabled. Any suggestions of where to continue to look would be very much appreciated. Sam

1 0