August 2004 - Test - lists.nanog.org

RE: On the back of other security posts (well some over a year ag o now)....
by Hosman, Ross 27 Aug '04

27 Aug '04

Wow... Glad to see we know the real reason foonet got raided. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Matthew Sullivan Sent: Friday, August 27, 2004 4:41 AM To: nanog Subject: On the back of other security posts (well some over a year ago now).... Need I say more...? http://www.securityfocus.com/news/9411 My thanks to those who listened and helped me. My thanks to those who helped Spamhaus, and my thanks to anyone else who got involved with the whole deal. / Mat

3 2

Weekly Routing Table Report
by Routing Table Analysis 27 Aug '04

27 Aug '04

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 28 Aug, 2004 Analysis Summary ---------------- BGP routing table entries examined: 144261 Prefixes after maximum aggregation: 85919 Unique aggregates announced to Internet: 69594 Total ASes present in the Internet Routing Table: 17870 Origin-only ASes present in the Internet Routing Table: 15497 Origin ASes announcing only one prefix: 7274 Transit ASes present in the Internet Routing Table: 2373 Transit-only ASes present in the Internet Routing Table: 75 Average AS path length visible in the Internet Routing Table: 4.8 Max AS path length visible: 22 Prefixes from unregistered ASNs in the Routing Table: 30 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 16 Number of addresses announced to Internet: 1331425836 Equivalent to 79 /8s, 91 /16s and 242 /24s Percentage of available address space announced: 35.9 Percentage of allocated address space announced: 58.1 Percentage of available address space allocated: 61.9 Total number of prefixes smaller than registry allocations: 65356 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 27805 Total APNIC prefixes after maximum aggregation: 13969 Prefixes being announced from the APNIC address blocks: 26034 Unique aggregates announced from the APNIC address blocks: 14136 APNIC Region origin ASes present in the Internet Routing Table: 2114 APNIC Region origin ASes announcing only one prefix: 627 APNIC Region transit ASes present in the Internet Routing Table: 329 Average APNIC Region AS path length visible: 4.8 Max APNIC Region AS path length visible: 22 Number of APNIC addresses announced to Internet: 158085760 Equivalent to 9 /8s, 108 /16s and 50 /24s Percentage of available APNIC address space announced: 72.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 82155 Total ARIN prefixes after maximum aggregation: 50156 Prefixes being announced from the ARIN address blocks: 63556 Unique aggregates announced from the ARIN address blocks: 22488 ARIN Region origin ASes present in the Internet Routing Table: 9438 ARIN Region origin ASes announcing only one prefix: 3399 ARIN Region transit ASes present in the Internet Routing Table: 924 Average ARIN Region AS path length visible: 4.5 Max ARIN Region AS path length visible: 18 Number of ARIN addresses announced to Internet: 230906400 Equivalent to 13 /8s, 195 /16s and 90 /24s Percentage of available ARIN address space announced: 68.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 26719 Total RIPE prefixes after maximum aggregation: 18867 Prefixes being announced from the RIPE address blocks: 23513 Unique aggregates announced from the RIPE address blocks: 15669 RIPE Region origin ASes present in the Internet Routing Table: 5771 RIPE Region origin ASes announcing only one prefix: 3110 RIPE Region transit ASes present in the Internet Routing Table: 995 Average RIPE Region AS path length visible: 5.4 Max RIPE Region AS path length visible: 21 Number of RIPE addresses announced to Internet: 169823552 Equivalent to 10 /8s, 31 /16s and 77 /24s Percentage of available RIPE address space announced: 59.5 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6334 Total LACNIC prefixes after maximum aggregation: 2245 Prefixes being announced from the LACNIC address blocks: 6118 Unique aggregates announced from the LACNIC address blocks: 3518 LACNIC Region origin ASes present in the Internet Routing Table: 389 LACNIC Region origin ASes announcing only one prefix: 117 LACNIC Region transit ASes present in the Internet Routing Table: 78 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 15 Number of LACNIC addresses announced to Internet: 15772672 Equivalent to 0 /8s, 240 /16s and 172 /24s Percentage of available LACNIC address space announced: 47.0 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1218 Total AfriNIC prefixes after maximum aggregation: 682 Prefixes being announced from the AfriNIC address blocks: 823 Unique aggregates announced from the AfriNIC address blocks: 661 AfriNIC Region origin ASes present in the Internet Routing Table: 91 AfriNIC Region origin ASes announcing only one prefix: 21 AfriNIC Region transit ASes present in the Internet Routing Table: 13 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 1994496 Equivalent to 0 /8s, 30 /16s and 111 /24s Percentage of available AfriNIC address space announced: 11.9 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 833 4193 156 Data Communications Bureau 1221 810 1184 584 Telstra Pty Ltd 4766 563 2897 265 Korea Internet Exchange for " 9583 529 41 106 Satyam Infoway Ltd., 4755 369 133 50 Videsh Sanchar Nigam Ltd. Aut 9929 363 162 34 China Netcom Corp. 9443 355 70 81 Primus Telecommunications 2907 353 1840 327 SINET Japan 17676 347 5164 39 XTAGE CORPORATION 17557 321 23 158 Pakistan Telecom 703 315 342 243 UUNET 2764 286 274 233 connect.com.au pty ltd 7474 263 268 200 Optus Communications Pty Ltd 9942 239 73 130 COMindico Australia 4802 234 28 143 Wantree Development 9800 225 369 63 CHINA UNICOM 9498 221 49 49 BHARTI BT INTERNET LTD. 4837 206 2262 107 chinanet IDC center beijing n 10036 202 18 183 C&M Communication Co. Ltd. 9304 177 160 24 Hutchison Telecom (HK) ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1396 6757 963 AT&T WorldNet Services 701 1275 8423 919 UUNET Technologies, Inc. 1239 931 2857 621 Sprint 4323 777 631 215 Time Warner Telecom 18566 741 208 6 Covad Communications 6197 712 362 340 BellSouth Network Solutions, 6347 662 330 122 SAVVIS Communications Corpora 209 620 3430 499 Qwest 721 619 20994 289 DLA Systems Automation Center 20115 583 388 300 Charter Communications 3356 571 10938 440 Level 3 Communications, LLC 852 510 1141 398 Telus Advanced Communications 7843 490 675 104 Adelphia Corp. 6198 457 401 207 BellSouth Network Solutions, 3561 456 2389 346 Cable & Wireless USA 7132 434 8030 376 SBC Internet Services 705 428 163 270 UUNET Technologies, Inc. 2386 408 519 230 AT&T Data Communications Serv 4355 388 323 99 EarthLink, Inc. 5668 388 87 18 Century Telephone RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 657 2020 544 UUNET - Commercial IP service 3320 301 2470 238 Deutsche Telekom AG 3301 283 1098 273 TeliaNet Sweden 8220 275 445 262 COLT Internet - International 680 244 2025 239 DFN-IP service G-WiN 13083 217 51 8 Mannesmann Datenverarbeitung 3246 215 473 212 Song Networks 1257 214 747 183 SWIPnet Swedish IP Network 8708 202 113 181 Romania Data Systems S.A. 5515 199 842 145 Sonera Solution Autonomous Sy 3215 182 876 76 France Telecom Transpac 786 177 1794 177 The JANET IP Service 5400 154 210 125 BT Ignite European Backbone 6746 154 29 131 Dynamic Network Technologies, 25186 153 154 109 France Telecom Transpac's Tra 719 151 288 102 LANLINK autonomous system 3269 145 1195 66 TELECOM ITALIA 8866 134 15 15 Bulgarian Telecommunication C 3303 130 609 129 Swisscom Ltd 12302 127 18 33 MobiFon S.A. LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11172 357 100 54 Servicios Alestra S.A de C.V 6140 333 137 63 ImpSat 8151 284 391 130 UniNet S.A. de C.V. 16814 212 13 7 NSS, S.A. 6147 186 86 19 Telefonica Del Peru 11664 157 11 20 Keytech SA 6505 137 90 94 Global One Communicaoes Ltda 6503 136 203 92 AVANTEL, S.A. 7303 121 55 19 Telecom Argentina Stet-France 11992 89 9 30 Integrated Systems 14420 84 6 33 ANDINATEL S.A. 6535 81 5 16 Chilesat Servicios Empresari 10481 81 32 7 Prima S.A. 11556 80 40 2 Cable-Wireless Panama 11311 79 7 19 Sinectis S.A. 5639 77 8 8 Telecommunications Services o 15311 76 21 36 Telefonica Empresas 4270 70 18 9 Red de Interconexion Universi 14117 69 5 4 Telefonica del Sur S.A. 11340 68 21 37 Red Universitaria Nacional AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 252 632 219 The Internet Solution 5536 113 16 4 Internet Egypt Network 2018 94 297 92 Tertiary Education Network 2905 92 276 81 The Internetworking Company o 14988 45 16 1 Botswana Telecommunications C 20928 44 16 1 Noor Advanced Technologies AS 9129 33 3 4 UUNET Kenya 24835 33 18 6 RAYA Telecom - Egypt 6713 27 42 10 Itissalat Al-MAGHRIB 8524 26 2 4 AUCEGYPT Autonomous System 5713 25 125 23 Telkom SA Ltd 16637 24 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 8346 15 7 14 SONATEL-AS Autonomous System 12455 15 4 2 Jambonet Autonomous system 15706 15 4 2 Sudatel Internet Exchange Aut 21491 14 1 3 UTL On-line is RF broadband I 15808 13 1 2 Communication Solutions Ltd i 17148 13 1 7 First National Bank Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 18566 741 735 Covad Communications 4134 833 677 Data Communications Bureau 4323 777 562 Time Warner Telecom 6347 662 540 SAVVIS Communications Corpora 9583 529 423 Satyam Infoway Ltd., 7843 490 386 Adelphia Corp. 6197 712 372 BellSouth Network Solutions, 5668 388 370 Century Telephone 22773 380 362 Cox Communications, Inc. Atla 701 1275 356 UUNET Technologies, Inc. 6467 387 356 E.Spire Communications, Inc. 27364 351 332 Armstrong Cable Services 721 619 330 DLA Systems Automation Center 9929 363 329 China Netcom Corp. 22909 360 323 Comcast Cable Corporation 4755 369 319 Videsh Sanchar Nigam Ltd. Aut 1239 931 310 Sprint 17676 347 308 XTAGE CORPORATION 11172 357 303 Servicios Alestra S.A de C.V 4766 563 298 Korea Internet Exchange for " List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 65217 PRIVATE 192.102.236.0/24 217 University of Minnes 1877 UNALLOCATED 192.108.199.0/24 1876 Southern Methodist U 65512 PRIVATE 192.248.0.0/17 9329 Sri Lanka Telecom In 64572 PRIVATE 219.146.96.0/21 17633 ASN for Shandong Pro 64572 PRIVATE 219.146.104.0/21 17633 ASN for Shandong Pro 64573 PRIVATE 219.146.112.0/21 17633 ASN for Shandong Pro 64573 PRIVATE 219.146.120.0/21 17633 ASN for Shandong Pro 64576 PRIVATE 219.146.128.0/21 17633 ASN for Shandong Pro 64576 PRIVATE 219.146.136.0/21 17633 ASN for Shandong Pro 64582 PRIVATE 219.146.144.0/22 17633 ASN for Shandong Pro 64582 PRIVATE 219.146.148.0/22 17633 ASN for Shandong Pro 64584 PRIVATE 219.146.176.0/22 17633 ASN for Shandong Pro 64584 PRIVATE 219.146.180.0/22 17633 ASN for Shandong Pro 64575 PRIVATE 219.146.192.0/22 17633 ASN for Shandong Pro 64575 PRIVATE 219.146.196.0/22 17633 ASN for Shandong Pro 64585 PRIVATE 219.146.224.0/21 17633 ASN for Shandong Pro 64582 PRIVATE 219.147.0.0/24 17633 ASN for Shandong Pro 64572 PRIVATE 222.173.128.0/20 17633 ASN for Shandong Pro 64572 PRIVATE 222.173.144.0/20 17633 ASN for Shandong Pro 64573 PRIVATE 222.173.160.0/20 17633 ASN for Shandong Pro 64573 PRIVATE 222.173.176.0/20 17633 ASN for Shandong Pro 64576 PRIVATE 222.173.192.0/20 17633 ASN for Shandong Pro 64576 PRIVATE 222.173.208.0/20 17633 ASN for Shandong Pro 64582 PRIVATE 222.173.224.0/20 17633 ASN for Shandong Pro 64582 PRIVATE 222.173.240.0/20 17633 ASN for Shandong Pro 64584 PRIVATE 222.174.96.0/20 17633 ASN for Shandong Pro 64584 PRIVATE 222.174.112.0/20 17633 ASN for Shandong Pro 64575 PRIVATE 222.174.160.0/20 17633 ASN for Shandong Pro 64575 PRIVATE 222.174.176.0/20 17633 ASN for Shandong Pro 64585 PRIVATE 222.175.32.0/19 17633 ASN for Shandong Pro Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 4738 South Australian Academic Res 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:6 /11:14 /12:63 /13:133 /14:304 /15:540 /16:7971 /17:2175 /18:3786 /19:9730 /20:10236 /21:7588 /22:10467 /23:12091 /24:78456 /25:246 /26:190 /27:98 /28:37 /29:9 /30:72 /31:0 /32:27 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 725 741 Covad Communications 6197 567 712 BellSouth Network Solutions, 7018 543 1396 AT&T WorldNet Services 6347 482 662 SAVVIS Communications Corpora 702 411 657 UUNET - Commercial IP service 9583 371 529 Satyam Infoway Ltd., 4766 367 563 Korea Internet Exchange for " 1239 364 931 Sprint 701 360 1275 UUNET Technologies, Inc. 5668 339 388 Century Telephone 27364 337 351 Armstrong Cable Services 6198 336 457 BellSouth Network Solutions, 20115 308 583 Charter Communications 9929 290 363 China Netcom Corp. 6467 286 387 E.Spire Communications, Inc. 6517 265 292 Yipes Communications, Inc. 13609 259 302 Choice One Communications Inc 3320 247 301 Deutsche Telekom AG 25844 245 245 Skadden, Arps, Slate, Meagher 14824 242 265 NewSouth Communications Corp. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:2 12:850 13:1 15:5 16:2 17:3 20:9 24:698 32:66 33:2 38:81 40:53 44:4 55:1 56:3 57:16 60:6 61:463 62:502 63:1840 64:2246 65:2053 66:2457 67:362 68:542 69:694 70:34 80:529 81:365 82:206 83:130 84:34 128:95 129:171 130:86 131:170 132:23 134:187 135:17 136:186 137:50 138:173 139:38 140:161 141:107 142:120 143:59 144:101 145:41 146:293 147:93 148:419 149:110 150:88 151:70 152:159 153:68 154:2 155:129 156:64 157:71 158:145 159:158 160:54 161:71 162:390 163:79 164:185 165:159 166:115 167:222 168:285 169:114 170:276 171:9 192:5565 193:2869 194:2104 195:1460 196:581 198:3679 199:3259 200:3700 201:15 202:4830 203:5662 204:3158 205:2065 206:2298 207:2480 208:2147 209:3001 210:1458 211:590 212:987 213:1205 214:95 215:30 216:3725 217:991 218:185 219:93 220:231 221:33 222:84 End of report

1 0

RE: VeriSign's antitrust suit against ICANN dismissed
by Hosman, Ross 27 Aug '04

27 Aug '04

One stupid lawsuit from Verisign down...one more stupid lawsuit from SCO to go -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Henry Linneweh Sent: Friday, August 27, 2004 9:29 AM To: nanog(a)merit.edu Subject: VeriSign's antitrust suit against ICANN dismissed http://news.com.com/VeriSign%27s+antitrust+suit+against+ICANN+dismissed/2100 -1030_3-5326136.html?tag=nefd.top

2 1

time to bury nethead versus bellhead polemics
by Gordon Cook 27 Aug '04

27 Aug '04

Hope that more than a few here will be interested in some of my recent conclusions - from the November issue that I just published. Why a Layered Model is the Only Reasonable Way to Evaluate Telecom Lines of Business Have Blurred - Making the Regulatory Concept of Vertical Silos Archaic Time Has Come to Bury All "Bellhead versus Nethead" Polemics Introduction Since the bubble burst in late 2000 sending the Internet and the rest of telecom into a tailspin, it has been rather obvious that former stability and predictability of the economics of telecommunications has been shattered. The last several issues of The COOK Report have explored the fallout of those shattered economics in great detail. In this introduction The COOK Report notes that telecom economics is likely to stay broken, first, due to oversupply, and second due to lack of differentiation on anything other than price across too many competitors in services and service providers. Third: because of very loosely bonded brand loyalty. A final and very serious additional problem is regulatory instability as the FCC struggles with historical precedent in its interpretation of legislation. It finds itself whip-sawed between its "vertical silo" model derived from the technology it regulates, and the increasingly advocated "horizontal network layer view" of the IP enabled services, including but not limited to VoIP, Video over IP, and so on. As long-term, and, perhaps, not so long term, readers of The COOK Report are aware, this publication has not only long trumpeted the "bellhead vs. nethead" divide, but taken a partisan position where anything seen to be "bell-headed" was regarded as bad while "netheaded" was seen as the 'nirvana' to which the Internet would guide telecommunications. = = == For the remainder of my Bury "Bellhead versus Nethead" Polemics article please see http://cookreport.com/13.08.shtml -- ============================================================= The COOK Report on Internet Protocol, 431 Greenway Ave, Ewing, NJ 08618 USA 609 882-2572 (PSTN) 415 651-4147 (Lingo) Subscription info & prices at http://cookreport.com/subscriptions.shtml Why Bellhead vs Nethead polemics don't help at: http://cookreport.com/13.08.shtml E-mail cook(a)cookreport.com =============================================================

2 1

Fastmail.fm contact
by George Barnett 27 Aug '04

27 Aug '04

Hi All, I'm looking for an admin bod @fastmail.fm - anybody have a contact to lend me off-list? Many thanks, George -- George Barnett Reality Engineer & Explorer e: george(a)alink.co.za m: +44 778 884 7205 Things must be as they may - William Shakespear, Henry V

1 0

VeriSign's antitrust suit against ICANN dismissed
by Henry Linneweh 27 Aug '04

27 Aug '04

http://news.com.com/VeriSign%27s+antitrust+suit+against+ICANN+dismissed/210…

1 0

DNS
by Paul Gilbert 27 Aug '04

27 Aug '04

I have a friend whom has a problem with we believe DNS. In this case the ISP is NTL. He has a stateful firewall and is running NAT you can see from the tcp dump below that he sends the query to one DNS server but another responds thus breaking the firewall state and therefore it never resolves. Should the provider have the forwarding option on there servers or does he need to punch another hole in his firewall. cheers 09:23:01.216136 80.2.189.69.53 > 194.168.8.100.53: 54051+ [1au][|domain] (DF) 09:23:01.534353 194.168.4.100.53 > 80.2.189.69.53: 54051[|domain] (DF) 09:23:01.534618 80.2.189.69 > 194.168.4.100: icmp: 80.2.189.69 udp port 53 unreachable [tos 0xc0] 09:23:11.238123 80.2.189.69.53 > 194.168.8.100.53: 12113+ [1au][|domain] (DF) 09:23:11.414372 194.168.4.100.53 > 80.2.189.69.53: 12113[|domain] (DF) 09:23:11.414606 80.2.189.69 > 194.168.4.100: icmp: 80.2.189.69 udp port 53 unreachable [tos 0xc0] 09:23:19.634810 80.2.189.69.53 > 194.168.8.100.53: 9737+ [1au][|domain] (DF) 09:23:19.643883 194.168.4.100.53 > 80.2.189.69.53: 9737[|domain] (DF) 09:23:19.644127 80.2.189.69 > 194.168.4.100: icmp: 80.2.189.69 udp port 53 unreachable [tos 0xc0] Paul Gilbert Router Management Solutions, Inc. www.routermanagement.com work: 5167666068 mobile: 5164564983

2 1

The Cidr Report
by cidr-report＠potaroo.net 27 Aug '04

27 Aug '04

This report has been generated at Fri Aug 27 21:42:49 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 20-08-04 140707 96788 21-08-04 140804 96668 22-08-04 140728 96674 23-08-04 140727 96681 24-08-04 140829 96703 25-08-04 140971 96790 26-08-04 140909 96844 27-08-04 141076 96827 AS Summary 17798 Number of ASes in routing system 7272 Number of ASes announcing only one prefix 1373 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 85962240 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 27Aug04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 141093 96831 44262 31.4% All ASes AS18566 741 7 734 99.1% CVAD Covad Communications AS4134 782 172 610 78.0% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 775 219 556 71.7% TWTC Time Warner Telecom AS6347 659 122 537 81.5% SAVV SAVVIS Communications Corporation AS7018 1373 944 429 31.2% ATTW AT&T WorldNet Services AS7843 488 103 385 78.9% ADELPH-13 Adelphia Corp. AS22773 379 20 359 94.7% CXAB Cox Communications Inc. Atlanta AS6467 387 31 356 92.0% ACSI e.spire Communications, Inc. AS9583 528 178 350 66.3% SATYAMNET-AS Satyam Infoway Ltd., AS701 1252 904 348 27.8% UU UUNET Technologies, Inc. AS6197 717 395 322 44.9% BNS-14 BellSouth Network Solutions, Inc AS9929 353 34 319 90.4% CNCNET-CN China Netcom Corp. AS22909 361 44 317 87.8% CMCS Comcast Cable Communications, Inc. AS27364 351 37 314 89.5% ARMC Armstrong Cable Services AS1239 940 630 310 33.0% SPRN Sprint AS11172 354 52 302 85.3% Alestra AS17676 345 43 302 87.5% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS4355 380 99 281 73.9% ERSD EARTHLINK, INC AS6478 345 64 281 81.4% ATTW AT&T WorldNet Services AS4766 543 266 277 51.0% KIXS-AS-KR Korea Telecom AS9443 359 109 250 69.6% INTERNETPRIMUS-AS-AP Primus Telecommunications AS6140 369 123 246 66.7% IMPSA ImpSat AS14654 254 10 244 96.1% WAYPOR-3 Wayport AS6198 456 220 236 51.8% BNS-14 BellSouth Network Solutions, Inc AS25844 244 15 229 93.9% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS3561 466 253 213 45.7% CWU Cable & Wireless USA AS6327 226 29 197 87.2% SHAWC-2 Shaw Communications Inc. AS5668 388 196 192 49.5% CIH-12 CenturyTel Internet Holdings, Inc. AS22291 260 68 192 73.8% CC04 Charter Communications AS721 605 427 178 29.4% DNIC DoD Network Information Center Total 15680 5814 9866 62.9% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.83.96.0/19 AS22934 EBNI E Broadband Now Inc. 66.54.112.0/24 AS32108 EZSPY EZ-Spyder 66.54.113.0/24 AS32108 EZSPY EZ-Spyder 66.54.114.0/24 AS32108 EZSPY EZ-Spyder 66.54.115.0/24 AS32108 EZSPY EZ-Spyder 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.80.64.0/19 AS1 LVLT Level 3 Communications, Inc. 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.138.208.0/20 AS1 LVLT Level 3 Communications, Inc. 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.190.16.0/21 AS1 LVLT Level 3 Communications, Inc. 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.81.96.0/19 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.81.109.0/24 AS7657 TIG-US-PAS-AP The Internet Group Limited 202.81.121.0/24 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.84.192.0/19 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.192.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.208.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 204.196.0.0/14 AS1 LVLT Level 3 Communications, Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.133.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.135.0/24 AS11937 TRXI TRX Inc. 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

Cisco Security Advisory: Cisco Telnet Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 27 Aug '04

27 Aug '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Telnet Denial of Service Vulnerability Revision 1.0 For Public Release 2004 August 27 1000 UTC - ------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: INTERIM Distribution Revision History Cisco Security Procedures - ------------------------------------------------------------------------- Summary ======= A specifically crafted Transmission Control Protocol (TCP) connection to a telnet or reverse telnet port of a Cisco device running Internetwork Operating System (IOS) may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases Hypertext Transport Protocol (HTTP) access to the Cisco device. Telnet, reverse telnet, RSH and SSH sessions established prior to exploitation are not affected. All other device services will operate normally. Services such as packet forwarding, routing protocols and all other communication to and through the device are not affected. Cisco will make free software available to address this vulnerability. Workarounds, identified below, are available that protect against this vulnerability. This vulnerability is documented in Cisco bug ID CSCef46191 ( registered customers only) . This Advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml. Affected Products ================= Vulnerable Products - ------------------- This vulnerability affects all Cisco devices that permit access via telnet or reverse telnet and are running an unfixed version of IOS. Products Confirmed Not Vulnerable - --------------------------------- Cisco products that do not run IOS are not affected. Details ======= Telnet, RSH and SSH are used for remote management of Cisco IOS devices. The SSH protocol is also used for Secure Copy (SCP), which allows an encryption-protected transfer of files to and from Cisco devices. HTTP is also used for management of certain Cisco devices. IOS versions prior to12.2(15)T include HTTP server version 1.0, which, if configured, will be unresponsive on a device that is under exploitation. IOS versions after and including 12.2(15)T include HTTP server version 1.1, which is unaffected. Reverse telnet is a feature that allows you to telnet to a Cisco device and then connect to a third device through an asynchronous serial connection. For more information on reverse telnet, consult the following documents: http://cisco.com/en/US/products/sw/iosswrel/ps1828/products_configuration_g… http://cisco.com/en/US/products/sw/iosswrel/ps1826/products_configuration_g… Cisco devices that are operating as a reverse telnet server may have ports open in the ranges of: * 2001 to 2999 * 3001 to 3099 * 6001 to 6999 * 7001 to 7099 After a specially crafted TCP connection to an IOS device on TCP port 23 or the reverse telnet ports listed above, all subsequent telnet, reverse telnet, RSH (TCP port 514), SSH, SCP (SSH and SCP use TCP port 22), and in some cases HTTP (TCP port 80) connections to the device experiencing exploitation will be unsuccessful. Any telnet, reverse telnet, RSH, SSH, SCP and HTTP sessions that are already established with the device will continue to function properly. In Cisco IOS, telnet, reverse telnet, RSH, SSH, SCP and some HTTP sessions are handled by a virtual terminal (VTY). Each telnet, reverse telnet, RSH, SSH and SCP session consumes a VTY. After successful exploitation, the Cisco device can no longer accept any subsequent VTY connections. Though it is not possible to establish new telnet, reverse telnet, RSH, SSH, SCP or HTTP connections to the device after a successful exploitation, the device is only vulnerable on TCP port 23 and the reverse telnet ports listed above. A successful exploitation of this vulnerability requires a complete 3-way TCP handshake, which makes it very difficult to spoof the source IP address. Only remote access services that use VTYs are affected. This includes telnet, reverse telnet, RSH, SSH, SCP and version 1.0 of the HTTP server. Other device services including, but not limited to, routing protocols, TACACS/RADIUS, Voice over IP (VoIP) and packet forwarding are not affected. This vulnerability is addressed by Cisco bug ID: * CSCef46191 ( registered customers only) To determine the software running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS �". On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output. The following example identifies a Cisco product running IOS release 12.0(3) with an installed image name of C2500-IS-L: Cisco Internetwork Operating System Software IOS (TM) 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE The release train label is "12.0". The next example shows a product running IOS release 12.0(2a)T1 with an image name of C2600-JS-MZ: Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1) Additional information about Cisco IOS Banners is available at http://www.cisco.com/en/US/products/sw/iosswrel/ios_abcs_ios_networking_the…. Impact ====== Exploitation of this vulnerability may result in the denial of new telnet, reverse telnet, RSH, SSH, SCP and HTTP connections to a device running IOS. Other access to the device via the console or SNMP is not affected. The device will remain in this state until the problematic TCP connection is cleared, or the device is reloaded (which will clear the problematic session). If no other access methods are available, exploitation of this vulnerability could deny remote access to the device. Depending on your network architecture, workarounds may be available to mitigate this vulnerability. Software will be available to repair this vulnerability. Software Versions and Fixes =========================== Cisco is working to release fixes for this vulnerability in all currently maintained IOS releases. No software upgrade is required in order to mitigate this vulnerability. See the information below regarding the available configuration workarounds. The software fixes will appear in regularly scheduled maintenance releases of IOS software. As fixed software becomes available for public release, Cisco will update this section of the advisory. Obtaining Fixed Software ======================== Customers with Service Contracts - -------------------------------- As fixed software becomes available, customers with contracts should obtain the fixed software through their regular update channels. For most customers, this means that such software should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations - ------------------------------------------------- Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade or fixed software, which should be free of charge. Customers without Service Contracts - ----------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their fixed software by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Workarounds =========== The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. Mitigation Strategies - --------------------- Not all of the mitigation strategies listed will work for all customers. Some of the workarounds listed are dependent on which versions and feature-sets of IOS you have in your network. Enabling SSH and disabling telnet - --------------------------------- Note: SSH support is only available in certain IOS feature sets and platforms Cisco devices that support SSH can enable it by following the steps listed here: http://cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_g… To disable telnet access to the device, configure the following on all your VTY lines: Router(config)# line vty 0 4 Router(config-line)# transport input ssh Note: Even if SSH is enabled, the IOS device is not protected until telnet access is disabled. Configuring a VTY Access Class - ------------------------------ It is possible to limit the exposure of the Cisco device by applying a VTY access class to permit only known, trusted devices to connect to the device via telnet, reverse telnet, RSH, SSH or SCP. For more information on restricting traffic to VTYs, please consult: http://cisco.com/en/US/products/sw/iosswrel/ps1835/products_command_referen… Configuring Interface Access Lists (ACLs) - ----------------------------------------- In addition to configuring a VTY Access Class, it may be desirable to block all telnet traffic from entering the network. The example below demonstrates how to block TCP port 23 and the reverse telnet traffic while permitting all other IP traffic. Router(config)# access-list 100 deny tcp any any eq telnet Router(config)# access-list 100 deny tcp any any range 2001 2999 Router(config)# access-list 100 deny tcp any any range 3001 3099 Router(config)# access-list 100 deny tcp any any range 6001 6999 Router(config)# access-list 100 deny tcp any any range 7001 7099 Router(config)# access-list 100 permit ip any any The access list must then be configured to block inbound traffic on all public-facing interfaces: Router(config)# interface Ethernet 0/0 Router(config-if)# ip access-group 100 in Telnet should be blocked as part of a Transit ACL controlling all access to the trusted network. Transit ACLs are considered a network security best practice and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The white paper entitled "Transit Access Control Lists: Filtering at Your Edge" presents guidelines and recommended deployment techniques for transit ACLs: http://www.cisco.com/warp/public/707/tacl.html Configuring Infrastructure Access Lists (iACLs) - ----------------------------------------------- Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/public/707/iacl.html Configuring Receive Access Lists (rACLs) - ---------------------------------------- For distributed platforms, rACLs may be an option starting in Cisco IOS Software Versions 12.0(21)S2 for the 12000 series GSR and 12.0(24)S for the 7500 series. The receive access lists protect the device from harmful traffic before the traffic can impact the route processor. Receive path ACLs are considered a network security best practice, and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The CPU load is distributed to the line card processors and helps mitigate load on the main route processor. The white paper entitled "GSR: Receive Access Control Lists" will help identify and allow legitimate traffic to your device and deny all unwanted packets: http://www.cisco.com/warp/public/707/racl.html Exploitation and Public Announcements ===================================== The Cisco PSIRT is aware of exploitation of this vulnerability and is recommending customers take action to protect themselves. Status of This Notice: INTERIM ============================== THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. CISCO EXPECTS TO UPDATE THIS NOTICE WITHIN 48 to 72 hours FROM THE ORIGINAL DATE OF THIS NOTICE. Distribution ============ This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.netsys.com * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------------+ | Revision | 2004-August-27 | Initial public | | 1.0 | | release. | +---------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBLxMAezGozzK2tZARAj6eAJ0VX9vmrTBin4Vxt3FchPLIddKAlQCgvt20 dDYTV+/GnsCSHsRfmUz5eJw= =1fzl -----END PGP SIGNATURE-----

1 0

On the back of other security posts (well some over a year ago now)....
by Matthew Sullivan 27 Aug '04

27 Aug '04

Need I say more...? http://www.securityfocus.com/news/9411 My thanks to those who listened and helped me. My thanks to those who helped Spamhaus, and my thanks to anyone else who got involved with the whole deal. / Mat

1 0