June 2004 - Test - lists.nanog.org

Re: Can a Customer take their IP's with them? (Court says yes!)
by Fergie (Paul Ferguson) 29 Jun '04

29 Jun '04

Regardless, this is not a telephony issue ("Can I take my cell number with me?"), as the courts as seem disposed to diagnose these days, but rather, a technical one insofar as the IP routing table efficiency. "Friends of the court" won't work here unless the technical implications are presented in pablum form, methinks. This is indeed a technical, as well as as an engineering issue (before someone starts yelling about this thread being off-topic). FWIW, and pssing into the wind, the U.S. Courts need a real dose of reality anyways WRT attempting to legislate chaos. My $.02, - ferg -- "william(at)elan.net" <william(a)elan.net> wrote: What you really should try is to have ARIN provide "friend of the court" brief and to explain to judge policies and rules in regards to ip space, so you need to have your laywer get in touch with ARIN's lawyer. You can probably even force them to provide a statement or testimony (if they don't volunterily) as part of discovery process. P.S. You might as well provide name of the customer now. Since its gone through court, its all now public info (i.e. TRO) anyway. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Re: Can a Customer take their IP's with them? (Court says yes!)
by Fergie (Paul Ferguson) 28 Jun '04

28 Jun '04

Of course, this is only possible with NAT at the customer edge. Otherwise, it expands the size of the global routing system exponentially. - ferg -- Alex Rubenstein <alex(a)nac.net> wrote: As you can see, this TRO has widespread effects, and is something that everyone in the industry could be affected by. If this precedent is set, you will soon have everyone acting as if IP's are property, and something that they are entitled to. I ask for input from everyone in the community on this. We don't think we're crazy, but want to make sure. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Strange behavior of Catalyst4006
by Joe Shen 28 Jun '04

28 Jun '04

Hi, We met a strange problem with Catalyst 4006 when provideing leased line service to one of our customers. Catalyst4006 ------------ Customer's firewall ---------------Customer's Intranet The customer is allocated a Class C address block 192.168.5/24. And , they connect their network to our network by using a firewall. The Interface on Cata4006 is set up as "no switchport", and inter-connecting subnet is configured between Cata4006 and firewall interface(10.10.1.122/30). Static route is used on Catalyst4006 to designate route to customer's intranet address. ( ip route 192.168.5.0 255.255.255.0 10.10.1.124 ). Customer setup their email server at 192.168.5.7, dns server at 192.168.5.1, web server at 192.168.5.9. At the very begining all system works fine. After sometime they said they could not acces their email/web/dns server from host outside their company's network. But, when we telnet to Cata4006, we could 'ping' 192.168.5.7, but if we move to host in NOC ping failed all the time. ( ping to server is allowed on firewall). At the same time, their intranet host could access our network. We restart ( shut; noshut) the fastethernet interface on Catalyst4006, and then servers' network access recovered. The phenomon comes up frequently, and our customer said this is a bug with catalyst4006. But, to my understanding, if this is a bug to catos, it should not only affact only three servers. But, why it could be solved by restart catalyst interface? Would you please do some help? ( I attach system info below) Joe Shen ======================-= 4006#sh version Cisco Internetwork Operating System Software IOS (tm) Catalyst 4000 L3 Switch Software (cat4000-IS-M), Version 12.1(12c)EW1, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) TAC Support: http://www.cisco.com/tac Copyright (c) 1986-2002 by cisco Systems, Inc. Compiled Thu 24- Oct-02 23:05 by eaarmas Image text-base: 0x00000000, data-base: 0x00CA7368 ROM: 12.1(12r)EW Dagobah Revision 63, Swamp Revision 24 4006-wulin uptime is 41 weeks, 12 hours, 34 minutes System returned to ROM by power-on System restarted at 05:40:46 RPC Mon Sep 15 2003 System image file is "bootflash:cat4000-is-mz.121-12c.EW1.bin" cisco WS-C4006 (XPC8245) processor (revision 5) with 524288K bytes of memory. Processor board ID FOX05200BRH Last reset from PowerUp 144 FastEthernet/IEEE 802.3 interface(s) 2 Gigabit Ethernet/IEEE 802.3 interface(s) 403K bytes of non- volatile configuration memory. Configuration register is 0x2102 4006# 4006-wulin#sh run int f4/41 Building configuration... Current configuration : 141 bytes ! interface FastEthernet4/41 no switchport ip address 10.10.1.213 255.255.255.252 duplex full speed 100 end 4006# =============================================== ---- Cool Things Happen When Mac Users Meet! Join the community in Boston this July: www.macworldexpo.com

3 2

Re: BGP list of phishing sites?
by Paul Vixie 28 Jun '04

28 Jun '04

warning. this is about humans rather than about IOS configs. hit D now. > >> Also, an "easy fix" like this may lower the pressure on the parties > >> who are really responsible for allowing this to happen: the makers > >> of insecure software / insecure operational procedures (banks!) and > >> gullible users. > > > actually, a bgp feed of this kind tends to supply the "missing > > causal vector" whereby someone who does something sloppy or bad ends > > up suffering for it. > > ??? I don't understand? the root cause of network abuse is humans and human behaviour, not hardware or software or corporations or corporate behaviour. if most people weren't sheep-like, they would pay some attention to the results of their actions and inactions. actions like buying something from a spammer or clicking the "unsubscribe me" button in spam mail, or running microsoft outlook. inactions like not installing patches that microsoft has supplied free of charge over the years. inactions like leaving their cable/DSL pee cee up 24x7 and never wondering why the activity light on their modem flickers constantly. but the vast majority of humanity is and has always been sheep-like. while i could talk about certain election victories and other meatspace examples, that would be even more off-topic than we already are, so let's just put it like this: if you want people to notice the results of their actions and inactions, then they have to be brought into the equation. don't let worms be symbiotic, make them host-killing parasites, and that will make the host bodies sit up and take notice. this trick works every time. > > ... the internet is very survivable and the necessary traffic always > > finds a way to get through. fixing layer >7 problems by denying > > layer 3 service has indeed proven to be the only way to get remote > > CEO's to care (or notice). > > Still, anti-spam blacklists are pretty much universally applied inside > SMTP implementations these days. So if 3828747.dhcp.bigcable.com is > blacklisted because it sources spam, people subscribing to the > blacklist will no longer receive spam from that host, but the host is > still capable of interacting with the net in general and the blacklist > users in particular over a host of other protocols. i'm trying to figure out why you think it's in your best interest to limit the impact of your defensive activities, or to limit the impact of sheep-like behaviour on the sheep-like humans who own these infected hosts. in psycho- babble the term would best apply to your proposal is "enabler". why do you want to enable this kind of sheep-like behaviour? what's in it for you? if you think it'll leave more pee cee's online and able to access your shopping cart system that's one thing. but if you think you're somehow helping the owners of these pee cees you're wrong. and you are in fact hurting yourself, and the rest of us, every time you choose to be an "enabler" rather than letting these people stew in their own sheep-like juices. if it's easier for you to BGP-blackhole these bad sources and the only reason you don't is because you think it would be unfair, then you're part of the problem and you're helping to make the problem worse. > ... > My position is that end-user networks should decide for themselves if > this is something they want, but it would be wrong for transit > networks to make these decisions for all their customers, especially > as they seem to be growing more and more impervious to incoming email > or phone support requests that require knowledge of the proper order > of the letters "I" and "P". thanks for explaining your position, and very clearly i might add. we're not so different -- i think "decide for themselves" is the right meme. but where we differ is on the questions of ownership and responsibility. every network has to take responsibility for the traffic is spews, and cannot just say "take it up with my customer" since they're getting paid to make the spew possible. and every network has to be able to say "this shall not pass!" concerning traffic that does not match their "AUP", and the only recourse their customers can have is to sign up with a different network. naturally, sean's and chris's employers don't see it that way at all, and prefer to take no responsibility and exercise no control, except where revenue is concerned.

6 5

RE: BGP list of phishing sites?
by Smith, Donald 28 Jun '04

28 Jun '04

I agree phishing bgp feed would disrupt the ip address to all ISP's that listened to the bgp server involved. I was addressing a specific issue with listening to such a server and that is the loss of control issue. Sorry if that wasn't clear. So would ISP's block an phishing site if it was proven to be a phishing site and reported by their customers? Donald.Smith(a)qwest.com GCIA pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC Brian Kernighan jokingly named it the Uniplexed Information and Computing System (UNICS) as a pun on MULTICS. > -----Original Message----- > From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] > Sent: Monday, June 28, 2004 2:58 PM > To: Smith, Donald > Cc: Scott Call; nanog(a)nanog.org > Subject: RE: BGP list of phishing sites? > > > Hi Donald, > the bogon feed is not supposed to be causing any form of > disruption, the > purpose of a phishing bgp feed is to disrupt the IP address.. > thats a major > difference and has a lot of implications. > > Steve > > On Mon, 28 Jun 2004, Smith, Donald wrote: > > > Some are making this too hard. > > Of the lists I know of they only blackhole KNOWN active > attacking or > > victim sites (bot controllers, know malware download locations etc) > > not porn/kiddie porn/pr/choose-who-you-hate-sites ... clients > > (infected > > pc's) > > are usually not included but could make it on the list given enough > > attacks. > > It does mean giving up some control of your network which may not be > > acceptable to some ISP's. > > Its not much different then listening to an automated bogon feed. > > > > > > Donald.Smith(a)qwest.com GCIA > > pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC > > Brian Kernighan jokingly named it the Uniplexed Information and > > Computing System (UNICS) as a pun on MULTICS. > > > > > -----Original Message----- > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > > Behalf Of Stephen J. Wilcox > > > Sent: Monday, June 28, 2004 11:56 AM > > > To: Scott Call > > > Cc: nanog(a)nanog.org > > > Subject: Re: BGP list of phishing sites? > > > > > > > > > > > > On Sun, 27 Jun 2004, Scott Call wrote: > > > > > > > On the the things the article mentioned is that ISP/NSPs > > > are shutting > > > > off > > > > access to the web site in russia where the malware is being > > > downloaded > > > > from. > > > > > > > > Now we've done this in the past when a known target of > a DDOS was > > > > upcoming > > > > or a known website hosted part of a malware package, and it > > > is fairly > > > > effective in stopping the problems. > > > > > > > > So what I was curious about is would there be interest in a > > > BGP feed > > > > (like > > > > the DNSBLs used to be) to null route known malicious sites > > > like that? > > > > > > > > Obviously, both operational guidelines, and trust of > the operator > > > > would > > > > have to be established, but I was thinking it might be > > > useful for a few > > > > purposes: > > > > > > > > 1> IP addresses of well known sources of malicious code > (like in > > > > 1> the > > > > example above) > > > > 2> DDOS mitigation (ISP/NSP can request a null route of a > > > prefix which > > > > will save the "Internet at large" as well as the NSP from > > > the traffic > > > > flood > > > > 3> etc > > > > > > > > Since the purpose of this list would be to identify and > > > mitigate large > > > > scale threats, things like spammers, etc would be outside > > > of it's charter. > > > > > > > > If anyone things this is a good (or bad) idea, please > let me know. > > > > Obviously it's not fully cooked yet, but I wanted to throw > > > it out there. > > > > > > Personally - bad. > > > > > > So what do you want to include in this list.. phishing? But > > > why not add bot C&C, > > > bot clients, spam sources, child porn, warez sites. Or if you > > > live in a censored > > > region add foreign political sites, any porn, or other > > > messages deemed bad. > > > > > > Who maintains the feed, who checks the sites before adding > > > them, who checks them > > > before removing them. > > > > > > What if the URL is a subdir of a major website such as > > > aol.com or ebay.com or angelfire.com ... what if the URL is a > > > subdir of a minor site, such as yours or > > > mine? > > > > > > What if there is some other dispute over a null'ed IP, > > > suppose they win, can > > > they be compensated? > > > > > > Does this mean the banks and folks dont have to continue to > > > remove these threats now if the ISP does it? Does it mean the > > > bank can sue you if you fail to do it? > > > > > > What if you leak the feed at your borders, I may not want to > > > take this from you and now I'm accidentally null routing it > > > to you. Should you leak this to downstream ASNs? Should you > > > insist your Tier1 provides it and leaks it to you?.. > > > just you or all customers? > > > > > > What if someone mistypes an IP and accidentally nulls > > > something real bad(TM)? > > > What if someone compromises the feeder and injects prefixes > > > maliciously? > > > > > > What about when the phishers adapt and start changing DNS to > > > point to different IPs quickly, will the system react > > > quicker? Does that mean you apply less checks > > > in order to get the null route out quicker? Is it just /32s > > > or does it need to > > > be larger prefixes in the future? Are there other ways > > > conceivable to beat such > > > a system if it became widespread (compare to spammer tactics) > > > > > > What if this list gets to be large? Do we want huge amounts > > > of /32s in our > > > internal routing tables? > > > > > > What if the feeder becomes a focus of attacks by those > > > wishing to carry out > > > phishing or other illegal activities? This has certainly > > > become a hazard with > > > spam RBLs. > > > > > > > > > Any other thoughts? > > > > > > Steve > > > > > > > > > > > > >

2 1

RE: BGP list of phishing sites?
by Smith, Donald 28 Jun '04

28 Jun '04

Some are making this too hard. Of the lists I know of they only blackhole KNOWN active attacking or victim sites (bot controllers, know malware download locations etc) not porn/kiddie porn/pr/choose-who-you-hate-sites ... clients (infected pc's) are usually not included but could make it on the list given enough attacks. It does mean giving up some control of your network which may not be acceptable to some ISP's. Its not much different then listening to an automated bogon feed. Donald.Smith(a)qwest.com GCIA pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC Brian Kernighan jokingly named it the Uniplexed Information and Computing System (UNICS) as a pun on MULTICS. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Stephen J. Wilcox > Sent: Monday, June 28, 2004 11:56 AM > To: Scott Call > Cc: nanog(a)nanog.org > Subject: Re: BGP list of phishing sites? > > > > On Sun, 27 Jun 2004, Scott Call wrote: > > > On the the things the article mentioned is that ISP/NSPs > are shutting > > off > > access to the web site in russia where the malware is being > downloaded > > from. > > > > Now we've done this in the past when a known target of a DDOS was > > upcoming > > or a known website hosted part of a malware package, and it > is fairly > > effective in stopping the problems. > > > > So what I was curious about is would there be interest in a > BGP feed > > (like > > the DNSBLs used to be) to null route known malicious sites > like that? > > > > Obviously, both operational guidelines, and trust of the operator > > would > > have to be established, but I was thinking it might be > useful for a few > > purposes: > > > > 1> IP addresses of well known sources of malicious code (like in the > > example above) > > 2> DDOS mitigation (ISP/NSP can request a null route of a > prefix which > > will save the "Internet at large" as well as the NSP from > the traffic > > flood > > 3> etc > > > > Since the purpose of this list would be to identify and > mitigate large > > scale threats, things like spammers, etc would be outside > of it's charter. > > > > If anyone things this is a good (or bad) idea, please let me know. > > Obviously it's not fully cooked yet, but I wanted to throw > it out there. > > Personally - bad. > > So what do you want to include in this list.. phishing? But > why not add bot C&C, > bot clients, spam sources, child porn, warez sites. Or if you > live in a censored > region add foreign political sites, any porn, or other > messages deemed bad. > > Who maintains the feed, who checks the sites before adding > them, who checks them > before removing them. > > What if the URL is a subdir of a major website such as > aol.com or ebay.com or angelfire.com ... what if the URL is a > subdir of a minor site, such as yours or > mine? > > What if there is some other dispute over a null'ed IP, > suppose they win, can > they be compensated? > > Does this mean the banks and folks dont have to continue to > remove these threats now if the ISP does it? Does it mean the > bank can sue you if you fail to do it? > > What if you leak the feed at your borders, I may not want to > take this from you and now I'm accidentally null routing it > to you. Should you leak this to downstream ASNs? Should you > insist your Tier1 provides it and leaks it to you?.. > just you or all customers? > > What if someone mistypes an IP and accidentally nulls > something real bad(TM)? > What if someone compromises the feeder and injects prefixes > maliciously? > > What about when the phishers adapt and start changing DNS to > point to different IPs quickly, will the system react > quicker? Does that mean you apply less checks > in order to get the null route out quicker? Is it just /32s > or does it need to > be larger prefixes in the future? Are there other ways > conceivable to beat such > a system if it became widespread (compare to spammer tactics) > > What if this list gets to be large? Do we want huge amounts > of /32s in our > internal routing tables? > > What if the feeder becomes a focus of attacks by those > wishing to carry out > phishing or other illegal activities? This has certainly > become a hazard with > spam RBLs. > > > Any other thoughts? > > Steve > > >

2 1

Re: BGP list of phishing sites?
by Paul Vixie 28 Jun '04

28 Jun '04

> > It's wholy unfair to the innocent parties affected by the blacklisting. > > i.e. the collateral damage. maybe so. but it'll happen anyway, because victims often have no recourse that won't inflict collateral damage. the aggregate microscopic damage of this kind is becoming measurable and "statistically interesting". > > Say a phising site is "hosted" by geocities. Should geocities IP > > addresses be added to the blacklist? > > > > What if it made it onto an akamaized service? Should all of akamai > > be blacklisted? you're using terms like "unfair" and "innocent" and "should" in ways that lead me to wonder if we're having two different conversations here. the internet has no government, no constitution, no laws, no rights, no police, no courts. don't talk about fairness or innocence, and don't talk about what should be done. instead, talk about what is being done and what will be done by the amorphous unreachable undefinable blob called "the internet user base." if the cost:benefit is right for an endsystem to blackhole akamai or geocities then they will do it, no matter how unfair anybody else thinks it is, or how innocent other people think akamai/geocities might be, and no matter how much you or anybody may think that something different "should" be done. welcome to the "dog-eat-dog phase." spammers and phishers don't care about what's fair or who's innocent. sean's and chris's employers certainly don't want to be lectured to about what others think "should" be done. the end result is that victims are caring less and less about false positives or collateral damage -- nobody wants to be the last one to stop caring, since the other name for that person is "rube" (or sometimes "dupe".) while i've been keen to criticize sean's and chris's employers here, i do it for entertainment value (my own, and the lurkers who occasionally tell me i owe them a new keyboard because i was unexpectedly funny) and not because i think sean or chris or their employers are wondering what i think they "should" do. > ... > a) IP address that happen to have $nasty at one end of them; or > b) IP address for whom no abuse desk even gives a response (even > "we know, go away") when informed of $nasty. > ... > Seems to me (b) is, in general, a lot more reasonable than (a) > particularly where there is very likely >1 administrative zone per IP > address (for example HTTP/1.1). It also better satisfies Paul's > criterion of being more likely to engender better behaviour (read: > responsibility of network work operators for downstream traffic) if > behaviour of the reporter is proportionate & targeted. my sister called me last night to tell me that she was unable to receive mail from southwest airlines, and that her e-ticket was in limbo for some flight somewhere. i checked and sure enough southwest airlines has sent me three or messages per day that i don't want, for most days out of the last six months. since neither southwest nor their ISP was willing to take any responsibility for this unwanted e-mail, i blackholed them, and i guess that means they'll have to fax that e-ticket. or something. it's not my problem. as a victim, i can't let it be my problem. if someone wants their traffic to be accepted then they'll have to maintain a good reputation, which will in the future be automated in various ways including webs of trust/guaranty, forfeitable deposits, micropayments, and "living in better neighborhoods". in that way e-space will catch up to meat-space. > WRT "apply greater sanctions", it is possible of course, though perhaps > neither desirable nor scalable, to filter at layer>3 all sites on given IPs > to minimize collateral damage. See > http://www.theregister.co.uk/2004/06/07/bt_cleanfeed_analysis/ collateral damage is irrelevant now. minimizing it makes the problem worse, maximizing it just costs you in lawyer payments, it's every endsystem for itself now. john gilmore warned me that i was hastening this day when i started the first RBL. i didn't consider it avoidable, then or now. we were both right.

1 0

Sprint-Savvis outage Las Vegas
by Philip Lavine 28 Jun '04

28 Jun '04

Has anybody seen an interuption in service in Las Vegas with Sprint or Savvis __________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo

1 0

Any problems with Sprint LasVegas
by Philip Lavine 28 Jun '04

28 Jun '04

Is anybody experiencing issues with Sprint in Ls Vegas? --------------------------------- Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage!

1 0

Persistent DNS Zone Transfer Attempts from IP 128.232.0.31
by Jon R. Kibler 28 Jun '04

28 Jun '04

Greetings, Anyone know anything about IP 128.232.0.31? > # host 128.232.0.31 > 31.0.232.128.in-addr.arpa domain name pointer dns-probe.srg.cl.cam.ac.uk. > We have been getting persistent zone transfer attempts that originate from this IP address. We have had repeated zone transfer attempts against all of our DNS zones -- and against all 7 name servers that we manage. This has been going on now for about a month or two -- more or less. Recently, we have also seen attempts to do zone transfers for non-authoritative domains. Logging shows that this IP apparently never attempts to make legitimate DNS queries, only zone transfers. Anyone know anything about this IP? Anyone else have the appropriate logging enabled and also seeing this IP make zone transfer attempts? Thoughts/comments/suggestions? Thanks! Jon -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

4 3