June 2004 - Test - lists.nanog.org

RE: Verizon IP's and ARIN Records
by Bil Herd 08 Jun '04

08 Jun '04

Hopefully we are the type of organization considered to be somewhat clueful but we have yet to figure out how to get Arin to remove our swip info from a former customer's netblock. It has been years, many many times filling out their forms and more emails then I can count. It was less work to get my /18 assigned then to convince them that I would like my information removed from a /24 that belongs to someone else. :/ And of course these are the kind of (ex)customers who like to get and keep viruses resulting in a continuing effort to get our name off their block. Bil -----Original Message----- From: Steven Champeon [mailto:schampeo@hesketh.com] Sent: Tuesday, June 08, 2004 10:57 AM To: 'Nanog' Subject: Re: Verizon IP's and ARIN Records on Tue, Jun 08, 2004 at 01:00:55AM -0700, william(at)elan.net wrote: > I'm not sure what will need to happen for ARIN to understand that > validity and security of whois data is important and people rely on > that all the time and they can't just ignore these issues. > Unfortunetly most people who actually use their data also the ones who > really dont have time or interest to participate in ARIN political process and as such are not heard at all. Well, one thing that has to happen is that ISPs and co-lo providers (such as Inflow, our former - note /former/ - provider) need to "understand that validity and security of whois data is important and people rely on that all the time and they can't just ignore these issues". Which, unfortunately, is what Inflow refused to understand the entire time we were co-lo'd with them, and continue to ignore to this day. I'm not surprised to find that our old netblock is still tagged with my company's name, despite requests to have it updated: Request: 66.45.6.196 connected to whois.arin.net [192.149.252.43:43] ... Inflow NFLO-AR-2 (NET-66-45-0-0-1) 66.45.0.0 - 66.45.127.255 Hesketh INFLOW-55125-5697 (NET-66-45-6-192-1) 66.45.6.192 - 66.45.6.223 # ARIN WHOIS database, last updated 2004-06-07 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database. ...because Inflow didn't give a damn when we were paying them, I can't imagine they'd give a damn now that we've decided to pay someone else. We tried for six months to get them to add an abuse contact field to our ARIN record and they wasted dozens of hours explaining that because it was optional they didn't have to do it, when the point was that it was /necessary/, or at least /being actively requested/, and that the way to keep customers isn't to explain how you don't have to do something, but rather to do what the customer asks. I'm glad that RFCi listing didn't have any real effect on our ability to send mail. :-/ But, as I've said, Inflow is our /former/ co-lo provider, so they can go to hell for all I care. But I really wish they, or someone, would clean up our old ARIN records so that the next spammer they host, or netblock that gets hijacked, doesn't suggest, via ARIN, that my company has anything to do with it. Steve -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nos im/

3 2

Whitelists for email going to hotmail/msn/yahoo?
by crayola＠optonline.net 08 Jun '04

08 Jun '04

Folks, My company is currently exploring getting on AOL's email spam whitelist since we do send a large amount of email, but it is all requested by the people that get it (confirmation of bill payments/financial transactions). Are you aware of any of websites (like AOL's postmaster site) or whitelists for Hotmail/MSN, Yahoo, and other large email providers? Thanks, Mike

2 1

alert tool for out-of-norm bandwidth?
by matthew zeier 08 Jun '04

08 Jun '04

I'm looking for some sort of tool that tracks bandwidth on a switch port and when the bit rate "suddenly" changes from the baseline alerts me. I'm playing with Team Cymru's darknet project and basically need an automated way of noting darknet traffic increase and then trigger a nagios alert. If there isn't something like this, I'll have to write it I guess. thanks. -- matthew zeier - "Curiosity is a willing, a proud, an eager confession of ignorance." - Leonard Rubenstein

1 0

RE: NLB Recommendations
by Burton, Chris 08 Jun '04

08 Jun '04

Depending on the features you need and you price point; the Cisco CSM for the 6500 works great and should scale quite well but is quite pricey. If you are looking for something smaller you could use the Cisco CSS 11500; the CSS works well since the software has been upgraded and has far lower price then the CSM. I personally have not had any wide spread experience with the F5 and Foundry equipment. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of James Baldwin Sent: Tuesday, June 08, 2004 4:33 PM To: North American Network Operators Group Subject: NLB Recommendations I'm looking for recommendations for network load balancers. These, at this time, will primarily be used to attach to a cluster of webservers although I would like a solution which can be repurposed to other applications later. I am looking at F5's Big IP, Cisco's SLB, and Foundry's ServerIron at this time.

1 0

Re: Addresses for latest spam
by Gregory Hicks 08 Jun '04

08 Jun '04

Isn't this called a "dictionary" attack? > To: Adi Linden <adil(a)adis.on.ca> > Cc: nanog(a)merit.edu > Subject: Re: Addresses for latest spam > From: Valdis.Kletnieks(a)vt.edu > Date: Tue, 08 Jun 2004 11:44:50 -0400 > > On Tue, 08 Jun 2004 09:06:35 CDT, Adi Linden <adil(a)adis.on.ca> said: > > > > Does anyone know how the latest email worms assemble the email addresses > > they use? I am getting a large amount of junk destined for non-existant > > (never existant) email accounts. So the address cannot be taken from the > > various address books on the compromised PC's. > > I'll place bets on there being 'userA(a)domain1.net' and 'userB(a)domain2.com' > in the address books, and the worm is creating all 4 combinations of left and > right hand sides (and possibly other permutations too). So you're sitting at > domain1.net and seeing 'userB(a)domain1.net' bouncing (and possibly > 'userB(a)domain2.com' as well....) > > And of course, if it finds 200 addresses, you'll get the 1 valid LHS that > was attached to your domain - and 199 LHS's that used to be attached > to 199 other domain names and were probably never valid at your site. > > But since it's a compromised PC that belongs to somebody else and the > spammer isn't paying for the bandwidth, they might as well try all 200x200, > because they know 200 of them were valid, and maybe they'll get lucky > and another 50 or 75 of the cross-product will happen to match too... ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | Internet: ghicks(a)cadence.com I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

3 2

Addresses for latest spam
by Adi Linden 08 Jun '04

08 Jun '04

Does anyone know how the latest email worms assemble the email addresses they use? I am getting a large amount of junk destined for non-existant (never existant) email accounts. So the address cannot be taken from the various address books on the compromised PC's. Adi

2 1

RE: Verizon IP's and ARIN Records
by Dennis Dayman 08 Jun '04

08 Jun '04

Seems that the problem has been addressed and fixed. Turns out that Genuity/Level3 who "owned" that range decided to turn it in to ARIN as unutilized. We are addressing what is Verizon's and what is Level3's at this time. Why is it that I feel an addressing audit coming our way... Thanks to all who responded and were kind of enough to temporarily whitelisted us. -------------------------- Dennis Dayman Verizon Internet Services Operations Security and Legal Compliance vz.security(a)verizon.net -------------------------- > -----Original Message----- > From: Dennis Dayman > Sent: Monday, June 07, 2004 11:36 AM > To: 'Nanog' > Subject: Verizon IP's and ARIN Records > > ARIN has dropped all registry information for 206.46.0.0 - > 255.255.0.0. This range includes our residential and > business mail customers. We are aware of the issue and are > addressing this NOW to have our ARIN records re-published > again. We are not sure why this has happened at this time. > Any sender verification that checks for PTR records will fail > on outbound mail from Verizon Online. > > -------------------------- > Dennis Dayman > Verizon Internet Services Operations > Security and Legal Compliance > --------------------------

1 0

RE: Team Cymru Darknet Project
by Michel Py 08 Jun '04

08 Jun '04

Oops, sorry for the fat fingers. Did not intend to send to the list. -----Original Message----- From: Michel Py Sent: Tuesday, June 08, 2004 1:00 AM To: 'Nicolas FISCHBACH'; NANOG Cc: Rob Thomas Subject: RE: Team Cymru Darknet Project > Nicolas FISCHBACH > If of interest, I covered this and other tools/setups > during BHEU2004: "Building an Early Warning System in > a Service Provider Network" > PPT: http://www.securite.org/presentations/secip/ > BHEU2004-NF-SP-EWS-v11.ppt Est-ce que tu aurais un audio de cette présentation, par hasard? Merci Michel.

1 0

RE: Team Cymru Darknet Project
by Michel Py 08 Jun '04

08 Jun '04

> Nicolas FISCHBACH > If of interest, I covered this and other tools/setups > during BHEU2004: "Building an Early Warning System in > a Service Provider Network" > PPT: http://www.securite.org/presentations/secip/ > BHEU2004-NF-SP-EWS-v11.ppt Est-ce que tu aurais un audio de cette présentation, par hasard? Merci Michel.

1 0

RE: IT security people sleep well
by Jason Frisvold 07 Jun '04

07 Jun '04

> -----Original Message----- > From: Robert Boyle [mailto:robert@tellurian.com] > > Agreed. I really truly don't see the problem with plaintext telnet > management of routers. We have access-lists on vty 0 15 > specifying which > networks can even connect. We can't connect except for from a trusted > internal management network and I control all the routers and > circuits in > the path. If someone is in the middle of one of my circuits > doing some type > of dump of the data to disk, they are probably the NSA or > CIA, and I've got > much bigger problems. Can someone please provide a situation Yeah, that would be a concern... :) > where doing > this can lead to compromise or any type of problem at all? I > just don't see Do you trust every person you work with? Are your internal networks completely segmented (including the ethernet switches?) Here, they are not. And as much as it's been pointed out, they continue to leave everyone in the company on the same segment. Our security guy proved this point by hijacking a switch, convincing it that the traffic had to pass through his computer, and sniffed a TON of traffic ... All within a few minutes, without anyone knowing until he showed it... Through this, he was able to grab a number of passwords all through telnet sessions. Unless you can completely trust everyone in your internal network, ACL's aren't always enough... > it. However, I see people having unpatched servers running > without proper > ACLs every day and this is rarely discussed and as Stephen > Sprunk points > out, lot of people here on nanog don't apply bogon filters or > even source > filter their customers - and this doesn't require a feature > set upgrade to > IOS. (All of which we do, btw) So I'm still not convinced that SSL on > routers is needed. Nice, sure, but needed? no. Please > convince me otherwise > if you feel this is such a hugely pressing need or at least > explain your > position. I've been converted into the "secure it if you can, ensure it's not important if you can't" way of thinking ... I would very much like to change our ACL's to only allow telnet from our server farm (which is SSH *ONLY*), thus allowing a little bit of security ... This would at least bring us into the "if someone's listening, it's gotta be the NSA or CIA" class of security... :) > R Jason Frisvold Penteledata

3 3