March 2005 - Test - lists.nanog.org

Re: Is current DDoS detecting method effective?
by Joe Shen 07 Mar '05

07 Mar '05

Hi, > It frightens me that you're sitting on 11Gb/s+ and > unable to utilize > existing toold to determine what is within profile > for your network and > what is not. That what makes me think it's not possible to determine "legal" traffic model by available tools. The total BW keeps increasing, and network attack keeps going on. We could estimate traffic scheme by monitoring BW utilized, but it may has exhaust customer's server resource when we consider those DoS packet with our traffic scheme. So, Arbor and alike may be useful to enterprise users, but to ISPs its effectiveness is questionable. > > I'm certain that you'll be contacted by many > commercial vendors who have > working profiling solutions. I've discussed with some persons, they just disclame but no demonstration and analysis. Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

1 0

Re: Is current DDoS detecting method effective?
by Fergie (Paul Ferguson) 06 Mar '05

06 Mar '05

That, my friend, is the crucible. What can we do? First off, stop bickering. - ferg -- Joe Shen <joe_hznm(a)yahoo.com.sg> wrote: So, how can we do with DoS in ISP network? -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

drone armies C&C report - Feb/2005
by Gadi Evron 06 Mar '05

06 Mar '05

Below is a periodic public report from the drone armies / botnets research and mitigation mailing list. For this report it should be noted that we base our analysis on the data we have accumulated from various sources. According to our incomplete analysis of information we have thus far, we now publish two reports. The ISP's that are most often plagued with botnet C&C's (command & control) are, by the order listed: ---------------------------------- Responsible Party Count ASN SAGONE Sago Networks 16-20 21840 THEPL-1 THE PLANET* 16-20 {21844,13884} PNAP Internap Network Services 11-15 {10913,13790,14742,14744} STAMIN-2 Staminus Communicatio 11-15 25761 ATRIV Atrivo 11-15 27595 MSG-48 Managed Solutions Group 8-10 27645 YIPS Yipes Communications Inc 8-10 6517 LEVEL3 Level 3 Communications 8-10 3356 * Note that the above details are only for botnet C&C's that are still active. * We would gladly like to establish a trusted relationship with these and any organizations to help them in the future. * Please note the serious decrease in live Korean botnets, largely due to the efforts of KrCERT. The Trojan horses most used in botnets: --------------------------------------- The below details have not changed much, although we are seeing an increase in rBot variants. 1. Korgobot. 2. SpyBot. 3. Optix Pro. 4. rBot. 5. Other SpyBot variants and strains (AgoBot, PhatBot, actual SDbots, etc.). Contact information: Hank Nussbacher <hank(a)mail.iucc.ac.il> Gadi Evron (as specified below) -- Gadi Evron, Information Security Manager, Project Tehila - Israeli Government Internet Security. Ministry of Finance, Israel. gadi(a)tehila.gov.il gadi(a)CERT.gov.il Office: +972-2-5317890 Fax: +972-2-5317801 http://www.tehila.gov.il The opinions, views, facts or anything else expressed in this email message are not necessarily those of the Israeli Government.

1 0

Re: US slaps fine on company blocking VoIP
by Nathan Allen Stratton 06 Mar '05

06 Mar '05

On Sat, 5 Mar 2005, David M. Dowdle wrote: > If Pepsi put a chain-link fence up around every Coca-Cola vending machine > in your city, do you think the authorities would do something about it? Give me a break, this is totally different. This ISP is not blocking ports on other ISPs networks, they are choosing what they allow on their network or not. Just like other networks have done with many other things. > Worse, in this case, there's laws that say you MUST be able to get > diet soda (911 calls) at all times. Hhehe, actually in this case there are NOT laws that say you must be able to reach 911 at all times. Sure their are people that are trying to make it that way and as a VoIP provider we are trying to get as close to lifeline as we can, but frankly we don't ship a UPS with every ATA. We don't protect the last line IP network. So I am sorry, no we can't offer 911 calls to our customers at all times. In fact because of the lame way current providers are doing 911 (hading calls to PSAP administration lines) BroadVoice does not offer 911 at all yet. I would rather NOT offer it and tell users to have a way to call 911 via CELL or PSTN then to have them count on me getting them to a PSAP with the current options. ><> Nathan Stratton BroadVoice, Inc. nathan at robotics.net Talk IS Cheap http://www.robotics.net http://www.broadvoice.com

2 1

Re: More on Vonage service disruptions...
by Fergie (Paul Ferguson) 04 Mar '05

04 Mar '05

..and apparently this is happening more and more. There was actually a story in USA Today a couple of days ago where a family tried calling 911 on their VoIP service during a burglary only to be told by a recorded message that they must "dial 911 from another phone"... http://www.usatoday.com/tech/news/2005-02-28-voip-usat_x.htm This story accurately highlights some of the issues. - ferg -- Adi Linden <adil(a)adis.on.ca> wrote: Who would in their right mind rely on MSN Messenger for 911 access? Today residential VoIP service offered by Vonage or like companies is nothing more or less than your instant messenging gizmo. Perhaps it is more useful but by no means more reliable. Adi -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

8 8

DNS cache poisoning attack?
by Fergie (Paul Ferguson) 04 Mar '05

04 Mar '05

Any additional info. on this or whether it is just localized or widespread? http://isc.sans.org/diary.php [Updated March 4th 2005 18:11 UTC] - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

vonage routing issues
by Jon Lewis 04 Mar '05

04 Mar '05

Anyone else having reachability issues with Vonage? The past two days, about this time (~2pm), we've been unable to reach www.vonage.com and customers with vonage phones have lost their service. My traces to them end with: 13. 64.200.88.173 0% 8 8 32 31 33 42 14. nycmny2wcx2-pos1-0-oc192.wcg.net 0% 8 8 37 37 70 176 15. ??? One of my clients complaining about this said that today in a traceroute, they saw a loop going from sprint->pnap->wcg->sprint->pnap->xo I got interrupted typing this, and I see that in the past 40 minutes routing has changed...now it ends with 13. 0.so-5-0-0.XL1.NYC9.ALTER.NET 0% 4 4 42 41 42 42 14. 0.so-0-0-0.XR1.NYC9.ALTER.NET 0% 3 3 42 42 42 42 15. 181.ATM7-0.GW4.NYC9.ALTER.NET 0% 3 3 42 41 41 42 16. ??? and I get "The document contains no data" from www.vonage.com. Earlier it was painfully slow, but would eventually mostly load. Anyone know what's going on or where the problem is? I'm starting to wonder if Vonage's "your blocking us" news stories have just been coverup for network stability/capacity issues. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

3 2

Re: More on Vonage service disruptions...
by Robert Bonomi 04 Mar '05

04 Mar '05

> From owner-nanog(a)merit.edu Fri Mar 4 11:44:17 2005 > From: Christopher Woodfield <rekoil(a)semihuman.com> > Subject: Re: More on Vonage service disruptions... > Date: Fri, 4 Mar 2005 12:45:54 -0500 > > > > On Mar 3, 2005, at 10:25 PM, Scott Morris wrote: > > > > > Perhaps it varies by state, but I thought part of the E-911 service > > regulations was that if you were offering (charging) for it, you had to > > offer it as "lifeline" service which meant it had to survive power > > outage. > > *shrug* > > > > I guess the original regs weren't written with these things in mind! > > This does bring up a hardware design question...I'm wondering how > difficult of an engineering/marketing problem it would be to design > VoIP adapters with built-in backup batteries. Relatively trivial. Or you could just plug it into a UPS. > How does the power > consumption profile of a VoIP adapter compare to, say, a cellphone? Look at the typical "wall wart" that powers it. Draw is "a few watts". Compare this to the battery rating for a cell-phone. (a few amp-hours, at a few volts -- run-times in the *multiple* "tens of hours") Cell-phone is "order of magnitude", at least, lower in power consumption. VOIP adapters _could_ be designed (at higher cost) to consume considerably less power, but present-day cost/benefit analysis dictates against doing so. > What would this add to the cost of the device, Meaningless question, as stated. Something on the order of "10 seconds" can be handled by simply adding a SuperCap -- cost measured in pennies. OTOH, to ride out a 72-hour power-failure probably adds $100 or more. > and how long could the > battery last? How much battery are you willing to pay for? <grin> However, it isn't _only_ the VOIP adapter that has to have back-up power, *EVERY* piece of gear 'upstream' of it has to be powered, too. This includes, at a minimum the following CPE: the VOIP adapter, any hub/switch/routers in the circuit, any dedicated "firewall" hardware, and the DSL/cable "modem" CPE, itself. "Cable" connections may have in-line amplifiers/repeaters between the customer location and the "head-end" -- gotta have back-up for the power feed (going down the cable, itself) for those devices. *PLUS* back-up power for the 'head end' gear -- DSLAM at the C.O., or cable the concentrator. -- as well as the routers that switch the traffic to the 'backbone'. Now, the CPE can be simply plugged into a stand-by UPS with reasonable battery capacity, and you'll get as much run-time as you're willing to pay for. <grin> Assuming you've only got a VOIP adapter, and a cable/DSL modem to deal with -- call it 20 watts total -- then a UPS rated for 1000 watts, with a run-time of 10 minutes at full load, will probably run at least 10-15 _hours_ powering only the VOIP adapter and cable/DSL modem. Of course, having the CPE powered is _worthless_ if the immediate upstream gear has lost power. I can't see how Vonage, or *any* other "3rd party" (i.e. anybody other than the provider of the gear for the infamous 'last mile' connectivitiy) can _hope_ to claim service 'survivability' in the event of a power failure. Considering that the "Packet8"s, etc. have *no* contract whatsoever with that last-mile provider, they can't even 'specify requirements'. They can "encourage" the customer to put the CPE on UPS, but that's all. Getting somewhat "far afield" from 'network operations', but this issue also arises with regard to "real telephone service" offered by the CABLE TV companies. All too frequently _this_ service relies on CPE that draws 'utility' power. It is frequently the case that they fail to mention to the customer the "desirability" of putting _that_ equipment on UPS. With the resultant loss of dial-tone in the event of _power_ failure.

1 0

Bank One 159.53.0.0/16 contact?
by David Hubbard 04 Mar '05

04 Mar '05

Anyone have a clueful contact at Bank One? Their ARIN POC info is some generic switchboard that is completely unrelated to their allocation and who refuses to connect you to anyone in datacomm if you don't know a specific contact name to ask for. They told me that they'd be happy to write down what was supposedly being attacked by Bank One's network, although they found that hard to believe, and get me a response from a manager if one felt it was appropriate though but that may take a day or two. Nice... Thanks, David

2 1

RE: More on Vonage service disruptions...
by John R Levine 04 Mar '05

04 Mar '05

> There are EMTAs cable modems with VoIP ATA's that have 4 hr battery in the > market already. Sure. Many cable providers offer a superior form of VoIP that's engineered to act like real phone service with reserved bandwidth to their own switches and backup power for all the pieces on the way along with E911 and the other features we expect from real phone service. It needs a name of its own to distinguish it from the parasitic VoIP that Vonage, Lingo, et all offer. > > This still has little to do with port blocking, but a lot to do with > > the whole question of what level of service people are paying for vs. > > what level they think they are paying for. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Mayor "I dropped the toothpaste", said Tom, crestfallenly.

1 0