February 2005 - Test - lists.nanog.org

Source for IDS data
by Eric Germann 14 Feb '05

14 Feb '05

One more request for the group. Looking for some contacts off list who would be willing to discuss supplying some IDS data. Ideal candidates for this research would have the following characteristics: 1. Have a fairly visible network that draws appreciable attempts. 2. Have an IDS collection point in front of the firewall so ATTEMPTED intrusions are also recorded. 3. Have a fairly extensive history of IDS attempts. This is for a graduate research project I am engaged in and I am willing to discuss with potential suppliers of data. Targets are not required, I want to characterize sources only. If you are interested in supplying data or would like to discuss it further, please contact me OFF-LIST by hitting reply and we can talk off line. Thanks Eric Germann

1 0

RE: The Cidr Report
by Hannigan, Martin 14 Feb '05

14 Feb '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Hank Nussbacher > Sent: Monday, February 14, 2005 3:26 AM > To: Philip Smith > Cc: Nanog > Subject: Re: The Cidr Report > > > > At 10:27 AM 14-02-05 +1000, Philip Smith wrote: > > Well said. At NANOG you get the clueful people cuz they at > least knew to > come. That is a start. But there are hundreds of ISPs out > there who don't > have a clue. RIPE realized this without having to do a > membership poll and > rightly so, goes and does training where it is needed (and > believe me - I > am their biggest critic and all-around pain in the ass when > it comes to > their expenses as Leo and Rob can attest). > > NANOG is not the place to do it. ARIN, as part of their > overhead should do > an east coast, west coast and Chicago area tutorial at least once a > year. And guess what - most of the training material has > already been > written by the other RIRs. Am I misreading the report? That doesn't look like a list of clueless people. Just because another RIR does something doesn't mean we should automatically assume ARIN should too. This is a different area with different dynamics. Regardless, you could always propose this to ARIN instead of NANOG. :-) -M<

2 1

Level3 using uRPF on their access routers
by Lucas Iglesias 14 Feb '05

14 Feb '05

Hi all, Does anybody know if Level3 is performing Unicast Reverse Path Forwarding on it's interfaces with it's customers? Did anybody have problems with this fact (if so)? We have a multihoming customer, and we found out that packets sent to Level3 sourced with IP blocks winning over other provider (the return path not being prefered over Level3) are being filtered on Level3 network entrance (pretty much uRPF behavior), but they told me and they swear they are not using uRPF. Thanks in advanced, ======================== Eng. Lucas Iglesias, CCNP IP Engineering, Tiba S.A Ph: 5411-48068400 ext 6212 ========================

1 0

RE: Verizon wins MCI
by McLean Pickett 14 Feb '05

14 Feb '05

Yes, this includes the former Digex Web Hosting employees (from a former Digex employee...) It does not include the former Digex Leased Line/Intermedia staff - those that still exist. McLean -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of william(at)elan.net Sent: Monday, February 14, 2005 2:23 PM To: Hannigan, Martin Cc: 'nanog(a)merit.edu' Subject: Re: Verizon wins MCI On Mon, 14 Feb 2005, Hannigan, Martin wrote: > I was set on QUUest or UUQwest for the new name, too. What, don't you like UUVeriNET even better? :) > Verizon wins the battle for MCI, pays < 7B. I'm not financier, but this price seems rather low considering how large Worldcom is/used to be and that it includes all former UUNET, MCI, MFS, WCOM, etc. BTW - did this include Digex as well? -- William Leibzon Elan Networks william(a)elan.net

1 0

IRC Bot list (cross posting)
by J. Oquendo 14 Feb '05

14 Feb '05

On Tue, 8 Feb 2005, Justin Azoff wrote: > I found an irc channel with 3000+ irc bots in it including a few hundred > edu's. > I have it posted at > > http://www.albany.edu/~ja6447/hacked_bots8.txt > I started to sort them... Maybe I will finish when I get out of work or so. Here is the prettified/sorted list of the above... http://www.infiltrated.net/nanog-list-botlist lynx -dump http://www.infiltrated.net/nanog-list-botlist|grep -i $MYDOMAIN Further sorted http://www.infiltrated.net/nanog-botlist-comcast http://www.infiltrated.net/nanog-botlist-edu http://www.infiltrated.net/nanog-botlist-optonline http://www.infiltrated.net/nanog-botlist-vz http://www.infiltrated.net/nanog-botlist-cox http://www.infiltrated.net/nanog-botlist-mspring http://www.infiltrated.net/nanog-botlist-rr =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x0D99C05C http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0D99C05C sil @ infiltrated . net http://www.infiltrated.net "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey

13 18

Verizon wins MCI
by David Lesher 14 Feb '05

14 Feb '05

> From: "Hannigan, Martin" <hannigan(a)verisign.com> > I was set on QUUest or UUQwest for the new name, too. > > Verizon wins the battle for MCI, pays < 7B. VerizUUtal? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

RE: The Cidr Report
by John van Oppen 14 Feb '05

14 Feb '05

Hank and Warren are right on. I have seen several ISPs (one of which has been around a long time) who don't even understand the basics of CIDR routing or why they should aggregate their announcements. This same group are the ones who are not subscribed to this mailing list and don't go to Nanog events, and there are surly a large number of them. I think one thing the CIDR report glosses over, with its ranking system is the sheer number of ASes which announce extra routes. At least that is what strikes me when I start punching my local peer (not customer) ASes into the cidr-report website, virtually all of them have an aggregation problem and by percentage of junk announcements, the small ASes are often far worse than the big guys. That being said, perhaps we need some sort of nanog outreach or BGP support community that larger (or clue full) providers can point their less clue full BGP customers towards. The question then becomes, who would maintain such a group and how do we get the large number of currently non-participating ASes involved? John van Oppen PocketiNet Communications AS23265 (which yes, is fully aggregated) -----Ursprüngliche Nachricht----- Von: Hank Nussbacher [mailto:hank@mail.iucc.ac.il] Gesendet: Monday, February 14, 2005 12:26 AM An: Philip Smith Cc: Nanog Betreff: Re: The Cidr Report At 10:27 AM 14-02-05 +1000, Philip Smith wrote: Well said. At NANOG you get the clueful people cuz they at least knew to come. That is a start. But there are hundreds of ISPs out there who don't have a clue. RIPE realized this without having to do a membership poll and rightly so, goes and does training where it is needed (and believe me - I am their biggest critic and all-around pain in the ass when it comes to their expenses as Leo and Rob can attest). NANOG is not the place to do it. ARIN, as part of their overhead should do an east coast, west coast and Chicago area tutorial at least once a year. And guess what - most of the training material has already been written by the other RIRs. -Hank >The BGP tutorials I've been doing on Sundays at NANOG all cover >aggregation - at least, I seem to end up talking about aggregation in each >one. Maybe I need to be more direct? But then again, who am I preaching >to? The choir maybe, I don't know. Maybe we need a specific aggregation >tutorial for those who don't know how to? Those who have operational and >technical reasons not to aggregate have made that decision with prior >knowledge. We should try and give everyone else the knowledge, then at >least we will know that all de-aggregation is done for a reason. > >Then it begs the question, is NANOG the conference actually reaching the >people who'd most benefit from it? I say this as I'm in transit in >Singapore heading back from a hugely successful and enjoyable SANOG (South >Asia NOG) in Bangladesh. Similar idea to NANOG, but heavier emphasis on >education (workshops & tutorials), and we had ISPs falling over themselves >to participate in the first Internet operations meeting held in that country. > >philip >-- >+++++++++++++++++++++++++++++++++++++++++++ >This Mail Was Scanned By Mail-seCure System >at the Tel-Aviv University CC.

1 0

RE: The Cidr Report
by Hannigan, Martin 14 Feb '05

14 Feb '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Christopher L. Morrow > Sent: Sunday, February 13, 2005 6:19 PM > To: Michael Smith > Cc: Warren Kumari, Ph.D, CCIE# 9190; Nanog > Subject: Re: The Cidr Report > > > > > On Sun, 13 Feb 2005, Michael Smith wrote: > > > From: "Warren Kumari, Ph.D, CCIE# 9190" <warren(a)kumari.net> > > > On Feb 13, 2005, at 2:31 AM, Christopher L. Morrow wrote: > > > > > > That and the "I have 1 circuit to $good_provider and 1 circuit to > > > $bad_provider and the only way I can make them balance is > to split my > > > space in half and announce more specifics out through > each provider" > > > argument. I have also often seen people do this without > announcing the > > > aggregate because <some undefined bad thing> will > happen, usually > > > justified with much hand-waving. The people who do this > can usually > > > not be reasoned with.... > > > > So, say I'm a provider that has received a /22 from UUNet > (just for example > > Chris :-) ) and I now get another transit provider and > announce the /22 > > there. So, I call UUNet and ask them to announce the /22 > as a more specific > > Meaning you have PA space from UUNET, and you have BGP so you can > multi-home... I'd expect you to know how to deaggregate yourself. You > MIGHT even know how to send no-export on deaggregated > prefixes, or use the > 1996 policies to influence preferences/prepends internal to 701, yes? Is aggregation being covered in the Sunday BoF's? [ hint, hint ] -M<

3 2

Re: The Cidr Report
by Peter Walker 13 Feb '05

13 Feb '05

--On 13 February 2005 01:36 -0600 Jerry Pasker <info(a)n-connect.net> wrote: > > Until there's deep shame, or real financial incentive to not being > listed as a member of the dirty 30, nothing is going to happen in > terms of aggregation. > > Unfortunately, an automated email going out to each of the dirty 30 > weekly from the Cidr Report saying that their network again made > the list of top 30 most shameful examples of how to participate as > an active member in the global routing table would probably have > little effect. If they cared, they'd already be doing something > about it. > > Nothing is going to happen unless enough people (ASNs) take a > simultaneous, and UNITED stand, and make it painful for those that > don't care about the routes they leak to the net. > > Here's an idea, it's probably not the best idea, and has a *lot* of > potential problems, but it's just an idea: > > Pick the top 1 or two worst offenders every week, and automatically > dump them into a route distribution server would work in the same > way as the Team Cymru bogon server list. I bet THAT would get > people to scramble aggregate! Want to make a clear business case > for spending time to clean up routes? How about "global > routability" ? Every week, the top of the list would be singled > out, and they could be placed on the server, and anyone that > wanted to null route them based on that information could do so. A > level of automation would be required to quickly remove them from > the blacklist as soon as they aggregated, and quickly re-add them > without warning if they decide to deaggregate within a certain time > frame of being on the blacklist. If the addition/removal was > automated, it would be clear cut as to why the "victim" was placed > on the list. No favoritism or politics would come in to play. > > It would get results. I'm not sure what those results would be, > and the result might just be a bunch of really mad and aggravated > people, and a slightly more broken internet, but there'd definitely > be results. > > Or something. ;-) > > (I bet it would be a lot like the early days of DNS-RBL for mail > servers) > > I'm sure someone on this list who is wiser than me, has a better > idea. I'd love to hear it discussed. > > I'm going to repeat what I typed earlier: > > Nothing is going to happen unless enough people (ASNs) take a > simultaneous, and UNITED stand, and make it painful for those that > don't care about the routes they leak to the net. > > -Jerry > Perhaps another way this could happen might be by somewhat widespread use of something along the lines of ================= Cisco Version ======================== route-map CIDR_Top10 deny 10 match as-path 10 match ip address prefix-list deagg_pollution route-map CIDR_Abusers permit 1000 ip as-path access-list 10 permit _4323$ ip as-path access-list 10 permit _18566$ ip as-path access-list 10 permit _4134$ ip as-path access-list 10 permit _721$ ip as-path access-list 10 permit _22773$ ip as-path access-list 10 permit _7018$ ip as-path access-list 10 permit _27364$ ip as-path access-list 10 permit _6197$ ip as-path access-list 10 permit _3602$ ip as-path access-list 10 permit _6478$ ip prefix-list deagg_pollution seq 10 permit 0.0.0.0/1 ge 21 ip prefix-list deagg_pollution seq 20 permit 128.0.0.0/2 ge 21 ip prefix-list deagg_pollution seq 30 permit 192.0.0.0/3 ge 24 ======================================================== The as-path could easily be changed to include the top n abusers or to include downstream ASs rather than just source ASs. Just thinking out loud Peter Walker

1 0

NANOG 33 (Las Vegas) Lost/Found
by Carol Wadsworth 12 Feb '05

12 Feb '05

Found: rechargeable battery for laptop (in general session room on Tuesday).

2 1