May 2004 - Test - lists.nanog.org

Re: New VOIP Peering/Interconnection Mailing List Announcement
by Hannigan, Martin 14 May '04

14 May '04

I think Dan has multiple offers at this point. Dan, new addr? :) Regards, -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 <http://www.verisign.com/> -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: Paul Vixie <vixie(a)vix.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Fri May 14 11:55:15 2004 Subject: Re: New VOIP Peering/Interconnection Mailing List Announcement is Paul is volunteering to host this (perhaps on peering.com)? At 06:49 PM 5/14/2004 +0000, Paul Vixie wrote: >dgolding(a)burtongroup.com (Daniel Golding) writes: > > > Open exchange of ideas is the goal! > > > > Please feel free to forward this announcement freely. > > > > Post message: > > VOIP-Peering(a)yahoogroups.com > > > > Subscribe: > > VOIP-Peering-subscribe(a)yahoogroups.com > >could you put the list someplace else? i don't accept e-mail from yahoo here, >since they don't do any kind of permission/verification and i got tired of >JHD. > >which is too bad since i'm very interested in the topic of this mailing list. > >if you need a place to host a mailing list, i could ask around at my day job. >-- >Paul Vixie

2 1

Re: New VOIP Peering/Interconnection Mailing List Announcement
by Paul Vixie 14 May '04

14 May '04

> is Paul is volunteering to host this i guess so, yes, since i'd like to be able to participate in it. > (perhaps on peering.com)? peering.com belongs to the old day job. if we needed a mailing list created, i'd be asking the current day job if they can do it.

1 0

China ISC Workshop Trip Report
by Dave Crocker 14 May '04

14 May '04

Folks, Richard Cox and I participated in an anti-spam workshop in China last month. A copy of our trip report is at: <http://brandenburg.com/reports/200404-isc-trip-report.htm> d/ -- Dave Crocker <mailto:dcrocker@brandenburg.com> Brandenburg InternetWorking <http://www.brandenburg.com> Sunnyvale, CA USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

1 0

The Cidr Report
by cidr-report＠potaroo.net 14 May '04

14 May '04

This report has been generated at Fri May 14 21:43:28 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 07-05-04 134302 94376 08-05-04 134423 94193 09-05-04 134359 94242 10-05-04 134412 94289 11-05-04 134451 94312 12-05-04 134397 94443 13-05-04 134540 94322 14-05-04 134465 94360 AS Summary 17138 Number of ASes in routing system 6939 Number of ASes announcing only one prefix 1413 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 73602304 Largest address span announced by an AS (/32s) AS568 : DISOUN DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 14May04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 134369 94360 40009 29.8% All ASes AS4134 749 152 597 79.7% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 724 201 523 72.2% TWTC Time Warner Telecom AS7018 1413 981 432 30.6% ATTW AT&T WorldNet Services AS6197 697 312 385 55.2% BNS-14 BellSouth Network Solutions, Inc AS7843 496 116 380 76.6% ADELPH-13 Adelphia Corp. AS701 1301 936 365 28.1% UU UUNET Technologies, Inc. AS9583 464 101 363 78.2% SATYAMNET-AS Satyam Infoway Ltd., AS22909 386 37 349 90.4% CMCS Comcast Cable Communications, Inc. AS6198 566 232 334 59.0% BNS-14 BellSouth Network Solutions, Inc AS22773 371 50 321 86.5% CXAB Cox Communications Inc. Atlanta AS27364 358 45 313 87.4% ARMC Armstrong Cable Services AS1239 942 640 302 32.1% SPRN Sprint AS9929 333 31 302 90.7% CNCNET-CN China Netcom Corp. AS17676 339 50 289 85.3% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS6140 384 116 268 69.8% IMPSA ImpSat AS6478 304 48 256 84.2% ATTW AT&T WorldNet Services AS1221 855 618 237 27.7% ASN-TELSTRA Telstra Pty Ltd AS209 736 505 231 31.4% QWEST-4 Qwest AS25844 243 16 227 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS14654 229 4 225 98.3% WAYPOR-3 Wayport AS3356 901 684 217 24.1% LEVEL3 Level 3 Communications AS4766 473 261 212 44.8% KIX Korea Internet Exchange for "96 World Internet Exposition AS9443 357 155 202 56.6% INTERNETPRIMUS-AS-AP Primus Telecommunications AS5668 377 192 185 49.1% CIH-12 CenturyTel Internet Holdings, Inc. AS2386 425 241 184 43.3% ADCS-1 AT&T Data Communications Services AS6327 208 28 180 86.5% SHAWC-2 Shaw Communications Inc. AS6347 401 221 180 44.9% SAVV SAVVIS Communications Corporation AS19262 268 88 180 67.2% VGN-2 Verizon Global Networks AS15270 211 43 168 79.6% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. Total 15892 7203 8689 54.7% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.160.0.0/11 AS20115 CC04 Charter Communications 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 60.254.0.0/20 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.6.224.0/19 AS32392 HOSTI-3 Hosting-Network GmbH 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS568 DISOUN DISO-UNRRA 137.0.0.0/13 AS568 DISOUN DISO-UNRRA 138.136.0.0/13 AS568 DISOUN DISO-UNRRA 158.0.0.0/13 AS568 DISOUN DISO-UNRRA 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 DISOUN DISO-UNRRA 192.172.0.0/19 AS568 DISOUN DISO-UNRRA 192.188.208.0/20 AS568 DISOUN DISO-UNRRA 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 196.192.32.0/24 AS5511 OPENTRANSIT France Telecom 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS568 DISOUN DISO-UNRRA 198.97.80.0/20 AS568 DISOUN DISO-UNRRA 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.192.0/20 AS568 DISOUN DISO-UNRRA 198.97.240.0/20 AS568 DISOUN DISO-UNRRA 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS568 DISOUN DISO-UNRRA 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS568 DISOUN DISO-UNRRA 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.84.0.0/16 AS701 UU UUNET Technologies, Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS568 DISOUN DISO-UNRRA 199.114.128.0/18 AS568 DISOUN DISO-UNRRA 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 DISOUN DISO-UNRRA 199.123.0.0/18 AS568 DISOUN DISO-UNRRA 199.123.16.0/20 AS568 DISOUN DISO-UNRRA 199.123.80.0/21 AS568 DISOUN DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.2.64.0/20 AS9729 IS-AP iAdvantage Limited 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.142.0/24 AS30362 HAWAI-1 Hawaii-Pacific Teleport 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.123.96.0/20 AS9288 COMCEN-AS-AP Com-Cen Pty Ltd 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.155.243.0/24 AS4795 INDOSAT2-ID INDOSATNET-ASN 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 204.69.144.0/22 AS5668 CIH-12 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.41.32.0/19 AS14824 NCC-105 NewSouth Communications Corp. 206.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.169.219.0/24 AS189 GNTY Genuity 209.169.223.0/24 AS189 GNTY Genuity 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL-33 Telesat International Ltd. 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 210.213.0.0/19 AS6453 GLOBEINTERNET Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.133.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.135.0/24 AS11937 TRXI TRX Inc. 216.145.152.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

IPv6/IPv6 threat Comparison Paper available for review
by Darrin Miller 13 May '04

13 May '04

Hello all, Sean Convery and I have done a paper comparing IPv6 and IPv4 security threats. We will be presenting an overview of the paper at the NANOG meeting at the end of the month. We wrote this paper from and enterprise edge perspective, but are looking to potentially expand it's scope to service provider networks as well. In advance of that meeting Sean and I wanted to provide the URL for the paper and ask for comments on the paper and also potential areas of expansion. Thanks. http://www.cisco.com/security_services/ciag/documents/v6-v4-threats.pdf P.S. - It should be noted that this paper was completed in January and needs to be updated with some information from the latest IPv6 developments (site local deprecated, etc.) Darrin Miller Cisco Systems, Inc. dmiller(a)cisco.com (614) 718-2708

3 2

4 GB interface s HSRP with two Class C address block
by Joe Shen 13 May '04

13 May '04

Hi, We want to set up a resilent internet connection between backbone and outing going network by using 4 GB ethernet. It's demanded that the four GB ethernet connection are grouped into two GB channels ( two work horse + two backup), HSRP + STP are requirement to enable system reliablity. It's also expected to use 8 IP addresses for network i nterconnection between backbone and outgoing network. We plan to provide such service by using GB interfaces on two catalyst 6509. But, to my understanding if the two GB channels are configured with 2*4 interconnection IP addresses, STP is not required between our switches and customer's switches. And, the two GB channel could participate two HSRP groups, and acts as primary and standby sequently. GB Catalyst6509-A =================== Catalyst6509-B <- outgoing （layer2+layer3) || || || GB Channel || GB Channel || 2GB || Catalyst 2948G =================== Catalyst2948G <-Core ( maybe only layer2 ) network with two class C address To the topology above, I think the 8 interconnection IP addresses are not required. But, if the two GB channels are configured into one VLAN, the number of of host in one collision domain will be 2*256, this will surely derive to broadcast storm. I don't know how to set up IP routing in Layer 3 of 6509-A and 6509-B either. How could it done? Each word will be highly appreciated. Regards Joe Shen ---- Msg sent via Spymac Mail - http://www.spymac.com

1 0

Draft agenda for San Francisco
by Susan Harris 13 May '04

13 May '04

This may change - please keep an eye on www.nanog.org for updates, and see you next week! ---------------------------------------------------------------------- DRAFT AGENDA: NANOG 31 May 23-25, San Francisco Sunday Tutorials --------------- 1:30 - 3:00 p.m. BGP Techniques for Service Providers Level: Introductory/Intermediate Philip Smith, Cisco 1:30 - 3:00 p.m. Using IPsec to Encrypt Your Wireless Traffic at NANOG Level: Introductory, Hands-on Duane Wessels, Measurement Factory 3:00 - 3:30 p.m BREAK 3:30 - 5:00 p.m. BGP Techniques for Service Providers (cont'd.) 3:30 - 5:00 p.m. IS-IS Up to Date Level: Intermediate/Advanced Shankar Vemulapalli, Cisco Sunday Evening Reception ------------------------ 6:00 p.m. at a cool SF location :) Hosted by Switch and Data Monday, May 24 -------------- 9:00 a.m. Welcome, Introductions Susan Harris, Merit Duane Wessels, Measurement Factory Steve Feldman, CNET 9:15 a.m. BGP Wedgies: Bad Routing Policy Interactions that Cannot Be Debugged Tim Griffin, Intel, author Randy Bush, IIJ, presenter 9:45 a.m. IP Over Anything Blaine Christian, MCI 10:15 a.m. Implications of Securing Backbone Router Infrastructure Ryan McDowell, Sprint 10:35 a.m. BREAK 11:00 a.m. Benefits of Negotiated Interdomain Traffic Engineering Ratul Mahajan, David Wetherall, and Thomas Anderson, University of Washington 11:20 p.m. Verifying Wide-Area Routing Configuration Nick Feamster, MIT 12:00 p.m. LUNCH (on your own) 1:30 p.m. Case Studies in Intra-Domain Routing Instability Zhang Shu, Nat'l. Institute of Information and Communications Technology, Japan 2:00 p.m. Implementing Global Network Mobility using BGP Benjamin Abarbanel, Boeing 2:30 p.m. BGP Standards--What's Next? Sue Hares, NextHop 3:00 p.m. BREAK 3:30 p.m. Happy Packets - Initial Results Randy Bush, IIJ 4:00 p.m. Research Forum -------------- Predicting Public Internet Growth With Classical Economic Theory, or, The Wealth of Networks Tom Vest, eyeconomics.com In-Progress Research Designing Support for Troubleshooting Complex Network Problems Livio Ricciulli, Metanetworks Monday Evening BOFs & Key Signing --------------------------------- 7:30 - 9:00 p.m. ISP Security and NSP-SEC BOF V Danny McPherson, Arbor Merike Kaeo, moderators 9:00 - 10:30 p.m. What Does NANOG Want the IETF to Do? Harald Alvestrand, Cisco Alex Zinin, Alcatel, moderators 9:00 p.m. PGP Key Signing Party Joe Abley, ISC, host Tuesday, February 10 -------------------- 9:00 a.m. Appropriate Layer 2 Interconnection Between IXPs Keith Mitchell, XchangePoint 9:30 a.m. Evolution of the U.S. Peering Ecosystem Bill Norton, Equinix 10:15 a.m. BREAK 10:45 a.m. IPv6 IPv4 Threat Comparison Darrin Miller and Sean Convery, Cisco 11:15 a.m. Panel: Network Augmentation--Experiences in Adding IPv6 Services/Support to Existing IPv4 Networks Bill Manning, moderator Rob Rockell, Sprint Brent Sweeny, Internet2 NOC Ed Lewis, ARIN 12:00 p.m. LUNCH (on your own) 1:30 p.m. Coherent Naming Schemes: A Case Study Matthew F. Ringel, Tufts University 2:00 p.m. Tulip: A Tool for Locating Performance Problems Along Internet Paths Ratul Mahajan, Neil Spring, David Wetherall, and Thomas Anderson, University of Washington 2:20 p.m. Near Real-Time Publication of Allocated Netblocks Leo Bicknell, AboveNet Cathy Wittbrodt 2:40 p.m. Preparing RIR Allocation Data for Network Security Analysis Tasks Brian Trammell, CERT 3:00 p.m. Integrated Security for SNMP-Based Management Wes Hardaker, Sparta 3:15 p.m. Adjourn

1 0

RE: BGP Exploit
by Mark Johnson 13 May '04

13 May '04

Hi, > > What if sessions were attacked without MD5 in place. We > would just see > > session resets. As these happen anyway frequently at > peering points is > > there > > any straightforward way to determine if the vulnerability > caused the > > reset? > > If you're referring to session resets because of a peer or user > action then something akin to "Last reset due to FOO" can likely > be gleaned from "show bgp neighbor" output, especially since BGP > performs "graceful shutdown" via notification messages under normal > conditions I think what I'm trying to ask is: 1. Does anyone know if the exploit is actually being used? and 2. I assume there is no way to identify an exploit reset from the usual resets caused by routers hanging, ports failing, DDoS's, etc. However, I thought I'd ask... Kind regards, Mark

2 1

RE: Worms versus Bots
by Michel Py 13 May '04

13 May '04

> William wrote: > but in our ISP office I setup new win2000 servers and first > thing I do is download all the patches. I've yet to see the > server get infected in the 20-30 minutes it takes to finish it It can happen in 5 or 10 minutes (I've seen it) but only if all of the following conditions are met simultaneously: a) administrator's password blank (or something _really_ easy to guess) b) public IP (no NAT) c) no firewall In other words: if one is stupid, one gets worm'ed or bot'ed. > (Note: I also disable IIS just in case until > everything is patched..). Not a bad idea, but sometimes you don't have the choice of doing it (with scripted installs or things like SBS). Besides, IIS is not the main source of trouble on a machine that sits on the Internet unprotected. I consider disabling IIS a second or third line of defense, to be used after you implemented the steps not to get screwed in the first place (which you described). > Similarly when settting up computers for several of my > relatives (all have dsl) I've yet to see any infection > before all updates are installed. Me too. > Additional to that many users have dsl router or similar > device and many such beasts will provide NATed ip block > and act like a firewall not allowing outside servers to > actually connect to your home computer. Indeed. I have a $10 one that I use for installations (even when I install from a "trusted" environment), because the danger does not come only from the Internet, it can also come from your own LAN. By putting the machine being installed alone on its own segment behind a NAT box, you also shield yourself from crud that could be on the trusted network. > On this point it would be really interested to see what > percentage of users actually have these routers and if > decreasing speed of infections by new virus (is there > real numbers to show it decreased?) have anything to > do with this rather then people being more carefull and > using antivirus. Difficult to measure, and here's why: recent worms are polymorphic and propagate/replicate using many different mechanisms. How do you make the difference between a) a worm that arrived trough email and then contaminated x machines on your LAN and b) a worm that arrived through a vulnerability of IIS and then contaminated x machines on your LAN? The trouble here is that if you had all the time in the world _and_ if you did not have x users screaming, you could look at logs and such and finally figure out which of the egg or the chicken was first. In a real world, you clean the mess and when you are done you have to catch up with all the stuff you did not do while cleaning, and you never know. Michel.

17 24

RADB dup lookup?
by Hank Nussbacher 13 May '04

13 May '04

Merit people, Either this link should be taken down or fixed to work: http://www.ra.net/cgi-bin/ra/radb-duplicates.pl Regards, Hank

1 0