August 2004 - Test - lists.nanog.org

MRV discounts (summary)
by Deepak Jain 26 Aug '04

26 Aug '04

All folks seemed to think 20% was no trouble. One guy suggested 40% was possible on some equipment. Some vendors seemed to choke on that suggestion. :) DJ

2 1

Mega DOS tomorrow?
by Andy Dills 26 Aug '04

26 Aug '04

So, slashdot is linking to some news sites that are reporting that Aleksandr Gostev from Kapersky Labs in Russia has predicted that a large chunk of the net will be shut down tomorrow. I thought the ISC comment was pretty funny: http://isc.sans.org/diary.php -- e-Jihad Begins Thursday, Internet Predicted to Melt Down by Mid-day You should probably starting backing up that gig of gmail to local storage. According to a Russian news site, Kaspersky Labs states that terrorists will launch attacks which will paralyze the Internet this Thursday. This tragically coincides with two weeks of script kiddie attacks (which were scheduled to begin this past Sunday) aimed at disrupting the Republican national convention. In addition, many college students are back on campus this week, which provides the e-terrorists and i-subversives with a veritable candyland of insecure boxes on big pipes. Faced with this triple threat, our beloved Internet will surely fall. The ISC would like to go out on a limb and predict that the Internet will not vaporize into a cloud of nothingness this Thursday, but if it does, it's been our pleasure to help stave off its inevitable annihilation this long. -- Andy --- Andy Dills Xecunet, Inc. www.xecu.net 301-682-9972 ---

12 11

RE: Mega DOS tomorrow?
by Bill Jones 26 Aug '04

26 Aug '04

Can you hear me now? Good. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Chris Allermann Sent: Thursday, August 26, 2004 8:21 AM To: nanog(a)merit.edu Subject: RE: Mega DOS tomorrow? Can you hear me now? (I'm testing my verizon circuits ;-) ) On Thu, 2004-08-26 at 08:46, Jason Graun wrote: > Hello! Can anybody hear me?! This the Internet still there?! > > > Thanks > > > Jason :)

1 0

Fw: Kaspersky: Out of Context
by Matthew McGehrin 26 Aug '04

26 Aug '04

----- Original Message ----- From: "InfoSec News" <isn(a)c4i.org> To: <isn(a)attrition.org> Sent: Thursday, August 26, 2004 5:44 AM Subject: [ISN] 25th August 2004 > http://www.viruslist.com/eng/index.html?tnews=461517&id=2100900 > > 25th August 2004: Who knows what tomorrow will bring? > > A handful of sites are stating that Eugene Kaspersky, founder of > Kaspersky Labs, believes that tomorrow will bring a massive terrorist > attack on the Internet. This is being quoted in a range of ways, > ranging from factual reporting to citing the story as an example of > cyber hysteria. > > However, Kaspersky is not predicting the end of the Internet tomorrow > - or even in the near future. The story stems from brief comments made > yesterday at a press conference which was dedicated to cybercrime and > the problems of spam. > > At this press conference, Kaspersky commented that the possibility of > terrorists using the Internet as a tool to attack certain countries > was a reality. As an example, he cited the fact that a number of > Arabic and Hebrew language websites contained an announcement of an > 'electronic jihad' against Israel, to start on 26th August 2004. > > In an interview today, Kaspersky stressed that such information was > not necessarily trustworthy. 'We don't know who is behind these > statements.' He went on to clarify: 'It's not the first time the term > 'electronic jihad' has been used. We've seen this before, with the > focus being on sending racist emails, and defacing and hacking Israeli > web sites. But it is the first time I have seen sites encouraging the > use of Internet attacks against one country as a form of terrorism.' > > 'As we've already stated many times in the past, it would be easy > enough to use a network of infected computers to launch such an > attack. We saw the impact that Sasser, Mydoom and Slammer had, on the > Internet, businesses and organisations. Just imagine if such an attack > was directed at one country or one critical point in the > infrastructure of the Internet. Computers are a tool - and just like > any tool, they can be used or misused.' > > Kaspersky emphasised that the likelihood of a massive attack directed > against Israeli institutions tomorrow is low. However, he believes > that Pandora's box has now been opened. Hackers and virus writers can > be motivated by a range of factors: money, curiosity, or political > conviction. But whatever their motivation, the insecure nature of the > Internet and weak security precautions offer a wealth of > opportunities. 'Maybe it won't be tomorrow, or the day after tomorrow > - but sooner or later, terrorists will be using the Internet as > another weapon in their arsenal.'

1 0

Weirder issues ... resolved
by J. Oquendo 26 Aug '04

26 Aug '04

On Tue, 24 Aug 2004, Lane Patterson wrote: > Yes, you have experienced what is known in the field as "air gap > attenuation"--not something you want to depend on if you want a clean > link! A close relative is "knot-in-the-fiber attenuation". > > Your subject says "GigE Media converter" but you say you are deploying > an OC12. Which is it? Apologies. An OC12 was layed down, and I was running the drops from building to building. This is the exact deal of what happened (now that I can sit down for moment and think on a level head): I was setting up the fiber lines (multi mode already layed down) to connect the media converters to my switches. There are altogether about 8 buildings but for clarity I'll focus on the three which the event occurred... Building A - Main point Building B - about 1200 feet from Building A Building C - about 600 feet from Building A In Building A, I hooked up my media converter (Netgear) to Building B. Light was on, I had a signal going out. Walked over to Building B to hook up that media converter (Netgear) and this oddity occurred - link droppage when SC connector was fully plugged. Walked back over to Building A to replicate the incident, meaning I fully plugged Building B and wanted to see if I slightly pulled out Building A's SC if it would drop link. Sure enough it did. Now back in Building A, I took off Building C's media converter (Netgear) and swapped it with Building C which worked fine. Building C took Building B's media converter and pushed light with no problem. Now Building C is ALMOST twice as far as Building B is so if attenuation was the case, when I swapped out the media converters it should have done the same thing. Weirder was, everthing worked except I could not open the browser interface for the switches. At first I thought it was a VLAN issue so I walked back to the main building and added a port to have connectivity to every VLAN on the switch. Didn't work. So... One funky connection for a moment: Linked, pings out everywhere, could ssh everywhere, could do anything BUT open a browser throughout the entire Building B. Just bizarre. > Definitely invest in a light meter that can do the usual flavors > of single and multimode, connector types, and at least 850 and 1310nm > wavelengths. Then simply test strength of light on your receive port > on each side, compare to specifications of your equipment, and add > in-line attenuators as necessary. You'll usually find a range something > like -3 to -27 dBm, and we prefer -15 dBm as our ideal. Also, make > sure you've got the right type of fiber jumpers--mixing up single > (yellow) and multi (orange) mode fiber can cause similar issues. All in all it's up now. After playing switcharoonee with these silly little Netgears, they seemed to bork themselves into working. Thanks to all of the responses from everyone. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

1 0

RFC3834 -
by Stephen Stuart 26 Aug '04

26 Aug '04

For those who like to provide gentle reminders regarding mailing list etiquette to subscribers whose auto-responders reply to mail sent to lists (rather than only replying when the recipient is specifically named), there is now a standards-track RFC that you can reference to reinforce that such responses SHOULD NOT be issued: RFC 3834 Recommendations for Automatic Responses to Electronic Mail Get it from your favorite RFC repository, such as: ftp://ftp.rfc-editor.org/in-notes/rfc3834.txt Stephen

1 0

Anybody at ATT.net email services?
by Vish Yelsangikar 26 Aug '04

26 Aug '04

We're having trouble with ATT delaying our email. They are using a "grey-listing" technique to filter spam. Their mail servers give a "deferred" message and ask you to resend your email two hours later. The mail is allowed through on the retry. This filters out most spam, because most spam engines ignore return codes and will not retry. This is causing problems, because our mail servers are getting all clogged up with email to att.net customers and slowing down. Our difficulty has been in finding someone at AT&T to speak with about this. Can somebody from ATT.net help Netflix? Thanks Vish.

2 1

RE: Toplayer
by Hosman, Ross 25 Aug '04

25 Aug '04

More specifically I'm looking for someone who used/uses attack mitigator IPS 5000 series equipment in a production environment (not in a test lab) -----Original Message----- From: owner-nanog(a)merit.edu Sent: Wednesday, August 25, 2004 8:06 AM To: 'nanog(a)merit.edu' Subject: Toplayer Can someone that works with toplayer equipment please contact me off the list. Ross Hosman HSD Administrator ross.hosman(a)chartercom.com

1 0

Toplayer
by Hosman, Ross 25 Aug '04

25 Aug '04

Can someone that works with toplayer equipment please contact me off the list. Ross Hosman HSD Administrator ross.hosman(a)chartercom.com

1 0

OT: Question for carriers about identity and access management
by Hank Nussbacher 25 Aug '04

25 Aug '04

I am looking for some answers from carriers (not ISPs) in regards to identity and access management on telco equipment. If anyone has 5 minutes - drop me an email and I'll send you the 4 questions. Thanks, Hank

1 0