June 2004 - Test - lists.nanog.org

"Sizing router buffers" paper
by Mikael Abrahamsson 23 Jun '04

23 Jun '04

http://yuba.stanford.edu/~appenz/pubs/sigcomm-extended.pdf Anyone care to comment on this paper? I find that it confirms my beliefs and gut feeling I have had since 2000 or so, and my real life experiences with L3 switches with just a few ms of packet buffer. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 1

Packeteer
by rwcrowe＠comcast.net 23 Jun '04

23 Jun '04

Anyone had any good/bad experiences with the PacketSeeker or PacketShaper product ? (http://www.packeteer.com/) It looks like a good sub-$10,000 traffic monitor that will allow you to see all Layers of traffic utilization and reporting. Plus you can upgrade it to shape traffic with a license and firmware upgrade. Rob

3 2

Time Warner Telecom Launches Managed Security Services (DDoS)
by John Obi 23 Jun '04

23 Jun '04

Hello, Another network to add stuff against DDoS after other NSPs. Check it here http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/06-2… Thanks, -J __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

1 0

real-time DDoS help?
by Charles Sprickman 22 Jun '04

22 Jun '04

Howdy, Is there any place where people with experience dealing with DDoS attacks hang out? I'm getting very little assistance from my upstream beyond "call whomever is in charge of each IP attacking and make them stop", and "even though we null route the destination IP being attacked, this traffic will be billed". I've got a nice snippet of flows, so I can mostly see where everything is coming from, and it's obvious what the target is, but my flow-stat/flow-report skills are pretty weak. Oddly, in eight years of working for smallish ISPs I've never been hit very hard, believe it or not. Is the response from my upstream typical? I was expecting a bit more cooperation rather than them seeing as this as an opportunity to bill me for lots of traffic. Thanks, Charles -- Charles Sprickman spork(a)inch.com

10 14

APNIC New IPv6 address block
by John Tran 22 Jun '04

22 Jun '04

Dear colleagues APNIC received the IPv6 address range 2001:4400::/23 from IANA in June 2004 and will be making allocations from this range in the near future. This announcement is being made for the information of the Internet community, and so that network configurations such as routing filters may be updated as appropriate. For more information on the resources administered by APNIC, see: http://www.apnic.net/db/ranges.html For information on the minimum allocation sizes within address ranges administered by APNIC, see: http://www.apnic.net/db/min-alloc.html Kind regards Son ____________________________________________________________________ Resources Services Manager <Son(a)apnic.net> Asia Pacific Network Information Centre phone: +61 7 3858 3100 http://www.apnic.net fax: +61 7 3858 3199 Helpdesk phone: +61 7 3858 3188 email: helpdesk(a)apnic.net Please send Internet Resource Requests to <hostmaster(a)apnic.net> _____________________________________________________________________

1 0

Re: real-time DDoS help?
by Bubba Parker 22 Jun '04

22 Jun '04

My IRC server is at irc.citynetwireless.net. It runs dancer-ircd 1.0.35 along with its own services (Nick/ChanServ/etc) and stays up as long as my DS3 does :). On Sun, Jun 20, 2004 at 08:29:40PM -0700, ken(a)calpop.com wrote: > > > > Hey, > > > Let me know if the IRC server has been setup... > I do know there is already a #nanog channel on EFNet.. > > > Regards, > Ken > Network Engineer > CalPOP.com, Inc. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Bubba Parker > Sent: Saturday, June 19, 2004 9:01 PM > To: nanog(a)merit.edu > Subject: Re: real-time DDoS help? > > I could host and/or setup the irc server if anyone is interested. > > On Sun, Jun 20, 2004 at 03:23:06AM +0000, Christopher L. Morrow wrote: > > > > > > On Sat, 19 Jun 2004, Charles Sprickman wrote: > > > > > > > > On Sun, 20 Jun 2004, Suresh Ramasubramanian wrote: > > > > > > > On Sat, 19 Jun 2004, Jonathan Slivko wrote: > > > > > > > > > Maybe if NANOG had irc.nanog.org, maybe that might be something > to > > > > > consider - a real-time network of communication for network > operators > > > > > to deal with issues, etc. > > > > > > > > There's always > http://puck.nether.net/mailman/listinfo/nsp-security > > > > > > I can tell you right off AS8059 doesn't meet the requirements. I'd > gladly > > > respond to any reports of attacks from them, but I don't think you'd > ever > > > see any. > > > > which of your 2 upstreams isn't helping out? I'm fairly certain both > > providers have security groups, and do mitigate attacks for customers > on a > > regular basis. Perhaps you are not getting in touch with the correct > > customer service folks? We often have this issue ;( > > > > > > > > Basement multihomers unite. > > > > > > > hurray! > > -- > Bubba Parker > sysadmin(a)citynetwireless.net > CityNet LLC > http://www.citynetinfo.com/ > -- Bubba Parker sysadmin(a)citynetwireless.net CityNet LLC http://www.citynetinfo.com/

10 15

Netflow/flowscan
by andrew matthews 22 Jun '04

22 Jun '04

Anyone ever done some major flowscan stuff? We tried it once for a while and we had so much traffic our dual zeon 3.06ghz system couldn't keep up. The flows just started getting more and more behind... anyone ever succesfully graphed large amounts of data? If so what kind of systems did you use and what type of capture/processor layout did you have? Thanks in advanced Andrew

3 2

Inside look at a spammer's business
by Michael.Dillon＠radianz.com 22 Jun '04

22 Jun '04

This site http://rejo.zenger.nl/abuse/1085493870.php has an interesting insider's account of running a spamming business and all the support business that exist to help spammer businesses to survive and thrive. --Michael Dillon

2 1

Re: Verisign vs. ICANN
by Dickson, Brian 22 Jun '04

22 Jun '04

Stephen J. Wilcox (SJW) wrote: SJW> I do not believe there is any technical spec prohibiting this, SJW> in fact that DNS can use a wildcard at any level is what enables SJW> the facility. It is not always the case that everything a spec defines, is included or enumerated in the spec, particularly when specs refer to other specs and it is the combination(s) of specs which define proper behaviour. (If every protocol which was built on TCP, had to also include the contents of the TCP spec, the whole RFC system would quicly collapse under its own weight.) SJW> I think this is a non-technical argument.. SJW> altho it was demonstrated that owing to the age and status of the com/net SJW> zones a number of systems are now in operation which make SJW> assumptions about the response in the event of the domain not existing... If it were merely an *internal* issue *within* the DNS system, perhaps there would be areas of disagreement which could be settled via either extending, or clarifying, the relevant RFCs. However, the issue is, to some degree, actually outside of the proper scope of the DNS lookup/resolver system. (see below...) On Sat, 19 Jun 2004, Alexei Roudnev (AR) wrote: AR> The technical roots of the problem are: proposed services VIOLATES AR> internet specification (which is 100% clean - if name do not exist, AR> resolver must receive negative response). AR> So, technically, there is not any ground for SiteFinder - vice versa To make Alexei's argument's syntax agree with the intended semantics: He means to say, "Technically, there is no grounds for implementing SiteFinder by means of inserting wildcards to the .com and .net zones. Rather, there are specific grounds for *not* inserting wildcards, regardless of the purpose of those wildcards, in .net and .com zones. (E.g.: in contrast with .museum zone, which is generally special-purpose, and for which assumptions about which services are expected (www only) are reasonable and valid, the .com and .net zone are general-purpose, and pretty much any service, including all assigned values for TCP and UDP ports from the IANA, should and must be presumed to be used across the collection of IPv4 space.) The crux of the problem appears in a particular case, for which *no* workaround exists, and for which no workaround *can* exist, from a straight derivational logic of state-machine origins. The DNS *resolver* system, is only one of the places where the global namespaces is *implemented*. Any assigned DNS name *may* be placed into the DNS. And *only* the owner of that name has authority to register that name, or cause its value to return from any query. An assigned name, however, can *also*, or even *instead* of being placed into the DNS *resolver* system, be put into other systems for resolving and returning name->address mappings. These include: the predecessor to BIND, which is the archaic "/etc/hosts" file(s) on systems; Sun's NIS or NIS+ systems (local to any NIS/NIS+ domain space); LDAP and similar systems; X.500 (if this is by any chance distinct from LDAP - I'm no expert on either); and any other arbitrary system for implementing name->address lookups. And the primary reason for *REQUIRING* NXDOMAIN results in DNS, is that in any host system which queries multiple sources, only a negative response on a lookup will allow the search to continue to the next system in the search order. Implementing root-zone wildcards, places restrictions on both search-order, and content population, of respective name-resolution systems, which violates any combination of RFCs and best-common practices. And, most importantly, *cannot* be worked around, *period*. Until the RFCs are extended to permit population of zones with authoritative *negative* information, and all the servers and resolvers implement support for such, *and* operators of root zone databases automatically populate assigned zones with such negative values, wildcards *will* break, in unreconcileable fashion, existing, deployed systems which refer to multiple implementations of zone information services, and for which *no* workaround is possible. Apologies for a long, semi-on-topic post. Hopefully this will end this thread, and maybe even put a stake through the heart of the VeriSign filing (at least this version of it). While the law generally doesn't recognize mathematically excluded things as a matter of law, when it comes to affirmative testimony, counter-arguments can demonstrably be shown as de-facto purgury (sp?). Brian Dickson (who has had to deploy systems in heterogeneous environments, and is aware of deployed systems that broke because of *.com)

2 1

Being abused by a spammer.. Need help - AOL/swbell/adelphia.net
by Nicole 21 Jun '04

21 Jun '04

Below are several examples of spam apperantly being sent out forging both my from address domain and Received from server information. Obviously this could become problematic. Fortunatly it's inaccurate. Any help on how I can do something about this or find ouy who and how they are doing it would be greatly appreciated. Also I would share that this started after i started notifying upstream ISP's of spam violations. Who apparently shared my information to earn myself retaliation. The ISP's were most likely Media Dreamland and UUNET/MCI but I cannot be certain of course. Nicole ---------------- Return-Path: <catcall(a)unixgirl.com> Received: (qmail 18818 invoked from network); 21 Jun 2004 14:20:10 -0000 Received: from exprod6mx50.postini.com (HELO psmtp.com) (12.158.35.194) by adams.net with SMTP; 21 Jun 2004 14:20:10 -0000 Received: from source ([67.23.190.129]) by exprod6mx50.postini.com ([12.158.35.251]) with SMTP; Mon, 21 Jun 2004 07:20:08 PDT Received: from unixgirl.com (mx20.webweaver.net [64.124.90.17]) by 67-23-190-129.bflony.adelphia.net (Postfix) with ESMTP id 8F0CC0C0CB for <sgrigsby(a)adams.net>; Mon, 21 Jun 2004 10:19:38 -0500 Message-ID: <100101c457a3$8c0bf833$a4cff4cf(a)unixgirl.com> From: "Denier I. Hobbs" <catcall(a)unixgirl.com> To: Sgrigsby <sgrigsby(a)adams.net> Subject: See the Cutset Chcks Chick Gaping asloeshs filled with Date: Mon, 21 Jun 2004 10:19:38 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0016_C8B1DB09.BE7DF58C" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.10; AVE: 6.20.0.1; VDF: 6.20.0.46; host: 67-23-190-129.bflony.adelphia.net) Hlelo, chief :) Young Cum Wrohe creampie vidoes ready to dlownoad http://hO7paPqK.u.shoppostfalls.org/acfe22eeddf82266e32f/47XHt4LTK/FQUcOgkU… woyAxRJDAMW.htm ----------------------------- Return-Path: <nodding(a)unixgirl.com> Received: from 61-27-138-9.home.ne.jp (61-27-138-9.home.ne.jp [61.27.138.9]) by theta.nas.net (8.11.6/8.10.1) with SMTP id i5L4VbK20918 for <awilbur(a)netaccess.on.ca>; Mon, 21 Jun 2004 00:31:38 -0400 (EDT) Received: from unixgirl.com (mx20.webweaver.net [64.124.90.17]) by 61-27-138-9.home.ne.jp (Postfix) with ESMTP id A5F4DC0886 for <awilbur(a)netaccess.on.ca>; Mon, 21 Jun 2004 00:31:11 -0500 Message-ID: <110101c45750$2fe5a1a8$ccbc5795(a)unixgirl.com> From: "Selfsame R. Routinizing" <nodding(a)unixgirl.com> To: Awilbur <awilbur(a)netaccess.on.ca> Subject: Hot Chick Gteting Jizezd Inetrnally in her Ass Date: Mon, 21 Jun 2004 00:31:11 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_1BC6E4BE.73348A74" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Virus-Scanned: by amavisd-milter (http://amavis.org/) Hlelo teerh! Hot Chick Fileld with Cum http://oitjl.pMkOx1kQ.0kzP5jE.shoppostfalls.org/acfe22eeddf82266e32f/2wFjk/… wwSFSIIBxoyDQQCERVMAT1ABAY=.htm ---------------------------------- Received: from bm9.sec.tds.net ([216.170.230.79]) by mta02.mail.tds.net with ESMTP id <20040621021413.JVNC3320.mta02.mail.tds.net(a)bm9.sec.tds.net> for <becky(a)tctc.com>; Sun, 20 Jun 2004 21:14:13 -0500 Received: from adsl-209-30-158-163.dsl.rcsntx.swbell.net (adsl-209-30-158-163.dsl.rcsntx.swbell.net [209.30.158.163]) by bm9.sec.tds.net (8.12.10/8.12.2) with SMTP id i5L2E8qt001719 for <becky(a)tctc.com>; Sun, 20 Jun 2004 21:14:10 -0500 (CDT) Received: from unixgirl.com (mx20.webweaver.net [64.124.90.17]) by adsl-209-30-158-163.dsl.rcsntx.swbell.net (Postfix) with ESMTP id 3F39723BDF for <becky(a)tctc.com>; Sun, 20 Jun 2004 22:13:44 -0500 Message-ID: <010001c4573d$5e9cbbbd$6867fa4a(a)unixgirl.com> From: "Frazzled F. Restrains" <Cornelia(a)unixgirl.com> To: Becky <becky(a)tctc.com> Subject: The Httseot Chick gteting their asses fileld with cum Date: Sun, 20 Jun 2004 22:13:44 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0035_D46F3F18.B5679917" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.5; AVE: 6.17.0.2; VDF: 6.17.0.5; host: adsl-209-30-158-163.dsl.rcsntx.swbell.net) Good day. Spam explicatives deleted. http://tvLvT.shoppostfalls.org/acfe22eeddf82266e32f/PAmrZy9Yi/o1DBZY/6Cyo18… NOBcnEwESAUAwAQo=.htm ------------------------- Received: from smtp-dtc01.proxy.aol.com (smtp-dtc01.proxy.aol.com [205.188.118.17]) by rly-ip04.mx.aol.com (v98.19) with ESMTP id RELAYIN10-b40d62f2867; Sun, 20 Jun 2004 20:43:20 -0400 Received: from AC9935A8.ipt.aol.com (AC9935A8.ipt.aol.com [172.153.53.168]) by smtp-dtc01.proxy.aol.com (8.12.11/8.12.11) with SMTP id i5L0hCtZ013596 for <vpr87(a)militaryop.com>; Mon, 21 Jun 2004 00:43:15 GMT Received: from unixgirl.com (mail.webweaver.net [64.124.90.12]) by AC9935A8.ipt.aol.com (Postfix) with ESMTP id C98E8D4C19 for <vpr87(a)militaryop.com>; Sun, 20 Jun 2004 20:42:49 -0500 Message-ID: <000101c45731$462f4644$46a3ec11(a)unixgirl.com> From: "Bolero J. Amalgam" <captivation(a)unixgirl.com> To: Vpr <vpr87(a)militaryop.com> Subject: Nice Amateur Tenes on webcam Date: Sun, 20 Jun 2004 20:42:49 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0018_CC18E230.C1D2B726" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Virus-Scanned: Norton X-Scanned-By: MIMEDefang 2.40 X-Apparently-From: HeyJudebag(a)aol.com X-AOL-IP: 205.188.118.17 -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" -Politicaly Correct UNIX Page http://www.nonsenseband.com *** Spam Sucks and I get tons of it. So I have some tight spam filters. If any email to me bounces, please use your secret decoder ring and please send to blabgoo at yahoo dot com :)

1 0