June 2004 - Test - lists.nanog.org

RE: IT security people sleep well
by Michel Py 07 Jun '04

07 Jun '04

> Valdis.Kletnieks(a)vt.edu wrote: > OK.. Say you can get it into the code train for 200K. What do > you do with all those routers that have only 100K or 125K of > space left in the flash (if that), and the flash is NOT going > to get any bigger without massive abuse of a soldering iron Being one of these who have massively abused the soldering iron (I run 12.2T on a 3102 and I _do_ plan on running it on an IGS) the fact of the matter is that these days are gone. On my all-mighty home router (7507/RSP2) I have 64 _megs_ of flash that cost me a mere 20 bucks at Fry's and 128 megs of RAM that cost me $0 because I scrounged them from an old server. The RSP2 does not support el-cheapo digital camera flash? That's true, it's not in the list of approved memory. Nevertheless :-D cisco7507#sh diagbus Slot 2: EEPROM format version 1 Route/Switch Processor 2, HW rev 1.02, board revision F0 Flags: cisco 7000 board; 7500 compatible cisco7507#sh ver cisco RSP2 (R4700) processor with 131072K/2072K bytes of memory. R4700 CPU at 100Mhz, Implementation 33, Rev 1.0 64000K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). In modern environments, I have to admit that 2500s are a though call but I will also point out that a 2600 goes for near-to-nothing on eBay, and even when you re-license IOS and upgrade it still costs near-to-nothing. For the enjoyment of Nanog readers, the following links display what you should _not_ do if you don't want to void the warranty on your brand new Cisco 3102 (it was before I decided to run 12.2(T) on it, more soldering has happened since). Michel. http://arneill-py.sacramento.ca.us/photo_albums/first%20album/high/cisco %203000%20decapitated%20serial.jpg http://arneill-py.sacramento.ca.us/photo_albums/first%20album/high/cisco 3000.jpg What do you mean, it's not new? It was new when I bought it!

1 0

RE: IT security people sleep well
by Jason Frisvold 07 Jun '04

07 Jun '04

> -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > OK.. Say you can get it into the code train for 200K. What > do you do with all > those routers that have only 100K or 125K of space left in > the flash (if that), > and the flash is NOT going to get any bigger without massive > abuse of a > soldering iron because not all the needed address lines are > brought out to the > flash chip (a fine tactic dating back decades - I remember > seeing a 16K ROM > nailed to the top quarter of the 64K address space, and only > 14 address lines > brought to the chip - it was nailed to the top 16K by feeding > A14 and A15 to an > AND gate which fed the 'Chip Select' pin...) Agreed, but what are those routers used for these days? We use those routers for management (old 2511's) ... Any existing 2500's in the core network (yes, I'm ashamed to say some still exist) are ensured to have the max memory they can get ... Again, this is purely theoretical for me as management here has not deemed it appropriate to deploy ssh ... But, if ssh were added to all IOS's, it would greatly reduce the number of routers that could *not* include SSH due to flash limitations... I can say that in other networks that I consult for, I try to ensure ssh is available, as well as acl's and other security techniques... :) Jaosn Frisvold Penteledata

2 1

RE: IT security people sleep well
by Michel Py 07 Jun '04

07 Jun '04

> Henning Brauer wrote: > not seeing the problem with cleartext telnet for remote > logins in 2004, wether ACL'd or not, is just ... oh man, > I don't have words for this. I have: I encourage my competitors to do it. Michel.

2 1

EMS systems?
by Matthew Crocker 06 Jun '04

06 Jun '04

Hello, I have been looking through the archives and RFC and I can't seem to find what I'm looking for. I'm in search of an Element Management System or Inventory tracking system that can keep track of my hardware (routers, switches, SONET, patch panels) and ports (DS-1, DS-3, CDS-3, Ethernet, GigE, OC-x) and circuits (connecting two ports together). I don't need SNMP/NMS functionality per se but an add-on capability would be nice. I need a system that can track a customer circuit from their location (UNE DS1) to the Verizon CFA / circuit ID at my colo through my M13 mux into my SONET and into the router. It would be great if I could click on a customer and list all of their circuits and equipment involved with the circuits. Is there an RFC which defines such a database? Is there an open source system available to maintain the data? A database package where I can say 'I need an available DS-1 port in this CO and get a Verizon circuit ID I can use on the order'. I know the big guys have something, I'm a little guy, do I need to write it myself? -Matt

1 0

RE: Site elimination service -:) - I received offer by 's'p'a'm'
by Michel Py 06 Jun '04

06 Jun '04

> Stephen J. Wilcox wrote: > I've not had any.. perhaps its a targeted marketing > list, have you bought similar services in the past? :) Do you think there's a money back guarantee if the attacked site stays up? Michel.

1 0

Team Cymru Darknet Project
by Rob Thomas 06 Jun '04

06 Jun '04

-----BEGIN PGP SIGNED MESSAGE----- Hi, team. We are happy to at last release some documentation Darknets and the Team Cymru Darknet Project. You will find the details at the following URL: <http://www.cymru.com/Darknet/> We hope this helps you to gain greater insight into your networks and the flows on them. Comments, feedback, and coffee are always welcome! :) Thanks! Rob, for Team Cymru. - -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQL/W4VkX3QAo5sgJAQG3QQP9FT6jwkPbdLaCFBLds4ftjFaNGAjaBMM7 W9I4ver75yf2Ir8N1ytWqLrqAcAviU0ke8mcAaLRXeT/zNjHdZswyVmSjApBDHEW DSKL+hHd/5mzp7ZGHzYWVUD0XpAnpK3TTkpt35p4Z/RTXHP3hcrTE5wrLPDRZ24W l8jaboMH0tY= =Ug2l -----END PGP SIGNATURE-----

2 1

RE: Site elimination service -:) - I received offer by 's'p'a'm'
by Michel Py 06 Jun '04

06 Jun '04

> Alexei Roudnev wrote: > I received adv., in russian, saying: > Dear sirs. > We are glad to you to give qualitative service, on > elimination of sites. We can kill any site by our > attack, which have name 'DDos attack'. > The prices at us low, 60 dollars for 6 hours. This could be useful to evaluate mitigation gear: setup your own target server on a fat pipe, get the vendor to loan you the mitigation gear then pay 60 bucks to see if it really does mitigate something... You'll only see one set of zombies, but 60 bucks is pretty darn cheap. Michel.

4 6

RE: Worst case worm damage estimates: Research
by Michel Py 06 Jun '04

06 Jun '04

> Sean Donelan wrote: > This is where I agree with Paxson and Weaver, there isn't > a deep supply line for replacement PCs. If 50 million PCs > fall over in a single morning, its unlikely the PC repair > people will have enough replacement machines ready instantly. I'm with you, I was trying to point out that it's a big "if". Modern BIOSes are protected against this, and as Eddy and I pointed out, it's generally not a big deal to recover a trashed BIOS. Besides, after the first million craps out, every radio and TV will be saying not to turn on your PC before you talk to your IT. > Its the supermarket effect before a big snowstorm, they run > out of milk and bread within a couple of hours. But then what > happens? People starve? or is there product substitution? Both at home and at the office I can find a week worth of overdue work that does not require a PC..... Michel.

1 0

RE: Worst case worm damage estimates: Research
by Michel Py 06 Jun '04

06 Jun '04

> Laurence F. Sheldon, Jr. > Just one question--who is paying to get the production > work done while all this is going on? I never said it was free, but nothing close to the figures mentioned earlier. Reality check guys: a desktop PC costs $500 these days, spending $800 to repair a used one does not make sense. If your desktop support guys are half-organized, they have a replacement machine ready to install when the user calls for service, then the machine that as problem (which often is PICNIC: Problem In Chair Not In Computer) goes on the bench where the time it takes to reload a fresh Windows is 5 minutes, time to plug the cables in and pop the Ghost CD in. Michel.

2 1

RE: Worst cast worm damage estimates: Research
by Michel Py 05 Jun '04

05 Jun '04

SD> That's less than $400 per defective motherboard. SD> Your paper estimates it would cost more than double SD> to replace a scrambled BIOS. > Edward B. Dreger > Definitely sounds high, especially considering the > cheap end with socketed a DIPP BIOS: Boot from > "loaner" BIOS chip. Remove loaner BIOS. Insert chip > containing scrambled BIOS. Flash. Indeed. I found out that in most cases the loaner BIOS does not even have to come from the same brand PC and in many cases it will allow to boot DOS to flash the original BIOS back even if it was for another chipset. As far as re-installing Windows, it just takes a few minutes when you have something like Symantec Ghost or Altiris client. Michel.

2 1