August 2005 - Test - lists.nanog.org

Re: Blocking certain terrorism/porn sites and DNS
by J. Oquendo 18 Aug '05

18 Aug '05

On Thu, 18 Aug 2005, William Allen Simpson wrote: > Bad assumption. After all, terrorist is poorly defined, and from the > perspective of a particular government. Interesting you say this, same comes to mind concerning terrorists using so called cryptography simply because an agent of some government found "crypt.dll" on a machine and decided "By the love of INSERT_YOUR_DEITY_HERE they're using crypto now!" > Funny thing though, they don't seem to call their sites "spam-king", > but instead "opt-in-real-big", or the equivalent. So, we have to > examine their binaries to find the sites. Isn't this sort of ironic. To "not" want to "police" yet want to examine "binaries to find sites." And how may I ask are you going to examine these binaries via traffic. Isn't that to the tune of an illegal tap being you would unlawfully check email in and out of your network. Or did I miss something. As for filtering sites from Spam/Porn/etc., on the ISP level, someone would have to be a complete reject to do so. I know I wouldn't want anything filtered. On a corporate level, I right now have to filter a lot of unwanted junk and recently had to tone down my filtering. HR woman searched for sexual harrassment and could not get information because my rules were stringent. Filtering on an ISP/NSP level I think is a horrible idea because I believe everyone has the right to free speech and thought. Filtering is also likely to introduce unwanted latency. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

2 1

Re: zotob - blocking tcp/445
by Roger Marquis 18 Aug '05

18 Aug '05

Andy Johnson wrote: > I think the point of many on this list is, they are a transit > provider, not a security provider. They should not need to filter > your traffic, that should be up to the end user/edge network to > decide for themselves. How is this different from a transit provider allowing their network to be used for spam? Seems the same hands-off argument was made wrt spam a decade ago but has since proved unsustainable. Our particular problem is with an ISP in Wisconsin, NETNET-WAN. We get tens of thousands of scans to netbios ports every day from their /19. This is several orders of magnitude more netbios than we see from the rest of the net combined. It's eating nontrivial bandwidth and cpu that we pay real money for. They've had our logs for months but seem incapable of doing anything about their infected customers. The suits recommend documenting time and bandwidth costs and sending a bill with a cease and desist request. My question is not what can we do about bots, we already filter these worst case networks, but what can we do to make it worthwhile for bot-providers like NETNET to police their own networks without involving lawyers? -- Roger Marquis Roble Systems Consulting http://www.roble.com/

5 4

Re: New N.Y. Law Targets Hidden Net LD Tolls
by Robert Bonomi 18 Aug '05

18 Aug '05

> From owner-nanog(a)merit.edu Thu Aug 18 01:47:56 2005 > Date: Thu, 18 Aug 2005 02:44:59 -0400 > From: "Eric A. Hall" <ehall(a)ehsco.com> > Cc: nanog(a)merit.edu > Subject: Re: New N.Y. Law Targets Hidden Net LD Tolls > > > > On 8/17/2005 10:04 PM, Fergie (Paul Ferguson) wrote: > > > A new law that's apparently the first in the nation threatens to > > penalize Internet service providers that fail to warn users that some > > dial-up numbers can ring up enormous long-distance phone bills even > > though they appear local. > > aka, make ISPs liable for other people's fraud. What's the thinking here, > anybody know? *NOT* "other people's fraud". Just when you have 'intra-LATA' toll charges for some numbers within a single area-code. If the user is on one side of the area-code, and the provider's POP is on the far side of it, you can have a what appears to be a 'local' number, that does incur non-trivial per-minute charges. Without knowing _where_ a particular prefix is, you can't tell whether there will be toll charges for that call, or not, from any given call origin. Of course, this is true for *every* call in such an area -- if the new law is actually singling out ISPs (and ISPs -only-), I expect it could be successfully challenged as 'discriminatory'. The excessive 'local toll charge' situation is most visible on calls to ISPs, because those calls tend to be somewhat lengthy -- and frequent -- thus, the 'unexpected' charges can reach significant dollar value before the phone customer gets their first bill. Life gets _really_ messy, when the ISP gets phone service from a CLEC, because there is "no telling" _where_ the ILEC uses as the 'rate point' for handing the calls off to that CLEC. And the CLEC bills their customers based on distance from the caller's location to that hand-off point. The ISP equipment may be across the street from the caller, but the ILEC-CLEC hand-off is on the far edge of the area-code. and the 'local toll charges' are applied. The CLEC can't tell you (and thus, neither can the ISP) which prefixes are a 'non-toll' call to their numbeers. And trying to get an authoritative answer from the ILEC about what charges are to the CLEC's prefix can be _very_ difficult.

6 6

Re: zotob - blocking tcp/445 (fwd)
by Bill Nash 18 Aug '05

18 Aug '05

Resent to address formatting misbehaviour: Source proto dstPort count 62.149.195.129 6 42 13018 203.69.204.250 6 445 12889 213.123.129.237 1 2048 12693 70.17.255.43 6 443 12685 217.132.56.139 6 4899 11056 209.181.111.12 6 135 8148 221.210.149.97 6 4899 7368 212.24.201.220 6 135 6451 172.131.83.244 6 135 6025 209.188.172.66 6 445 5055 80.177.36.162 6 445 4982 64.121.65.197 6 4899 4262 64.32.117.250 6 135 3954 213.144.99.241 6 445 3493 64.231.44.65 6 135 3157 213.123.129.237 6 139 2988 222.84.236.98 6 1023 2414 222.84.236.98 6 9898 2398 64.228.209.103 6 135 2305

1 0

Community Update
by Betty Burke 18 Aug '05

18 Aug '05

All: As per the NANOG Charter, the first Steering Committee meeting, via conference call, was held on August 11th. Randy Bush has been selected to serve as chair. The community can post messages to the SC, via steering(a)nanog.org. Steering Committee information, including meeting minutes, is available at <http://www.nanog.org/sc.html> The NANOG support staff and I, welcome the new SC members. We remain excited about the NANOG evolution process. We encourage the community to continue to dialogue with the newly formed Steering Committee, the existing Program Committee, and Mail List Administrators. There is a wonderful group of people working to improve the process, and they value your input. Sincerely, Betty NANOG Project Manager Merit Network

1 0

India cites security concerns, blocks Huawei bid to expand their indian ops
by Suresh Ramasubramanian 18 Aug '05

18 Aug '05

By K.C. Krishnadas, EE Times Aug. 16, 2005 URL: http://www.informationweek.com/story/showArticle.jhtml?articleID=168602118 BANGALORE, India — Chinese telecom equipment maker Huawei Technologies' expansion plans here have again drawn the attention of Indian security agencies. For the second time in the last five years, Indian security agencies have moved to slow Huawei's expansion plans out of concern for India's strategic telecom network. In 2001, U.S. intelligence sources reportedly tipped off the Indian government about Huawei's activities here. Huawei has been embroiled in several high-profile intellectual property disputes with telecom rivals in recent years. Indian authorities are also concerned about Chinese links to India's neighbor and long-time adversary Pakistan. According to a report in The Times of India on Tuesday (August 16), the Indian government has put on hold Huawei's plans to use $60 million in new equity for its Indian subsidiary, Huawei Technologies India Pvt. Ltd. The report quoted the Research and Analysis Wing, an Indian intelligence agency, as saying Huawei "has been responsible for sweeping and debugging operations in the Chinese embassy [in India]. In view of China's focus on cyber warfare, there is a risk in exposing our strategic telecom network to the Chinese." The report said senior officials from Indian intelligence agencies recently discussed the matter and formed a committee to review guidelines for foreign companies involved in projects in sensitive industries. The committee will submit a report in September, when Huawei's case for increasing its equity is likely to be decided. The report quoted officials in the Indian Ministry of External Affairs as saying that Huawei attracted "adverse notice" from India's security agencies which expressed "reservations regarding the company's links with the Chinese military." A Huawei spokesperson here could not be reached for comment. Huawei launched a small Indian software development operation in 1999, but formally opened a development center in 2001. About a 1,000 people work for the company in India, making it Huawei's largest software development center outside China. Earlier this year it announced plans to set up a $60 million manufacturing unit in Bangalore, with plans to spend an additional $40 million to expand its existing R & D center here. Huawei is believed to have so far invested $100 million in the R & D center. Huawei's manufacturing plan is designed to cash in on India's expanding telecom infrastructure. The network expansion could eventually be worth billions of dollars to global telecom equipment suppliers. The Huawei probe illustrates the uneasy relationship between China and India. The regional rivals fought a war in 1962. Relations have improved over the last decade, but China's close military ties with Pakistan have fueled concerns here about Huawei's intentions. Meanwhile, a recent nuclear power deal between India and the United States has raised concerns in Beijing.

9 8

CESM over IP vendor recommendations
by Malayter, Christopher 18 Aug '05

18 Aug '05

Good Morning, I am looking for recommendations for CESM over IP devices, in particular, for carrying T1 traffic. Please contact me off-list. I will summarize all off-list responses if there is interest. Chris Malayter TDS Telecom - Network Services Data Network Engineering chris.malayter(a)tdstelecom.com Phone: (608) 664-4878 FAX: (608) 664-4644

1 0

Re: zotob - blocking tcp/445
by surfer＠mauigateway.com 18 Aug '05

18 Aug '05

NetBIOS was never meant to be a WAN protocol, so no problem in blocking it. For example: grc.com/su-techzone1.htm scott ----- Original Message Follows ----- From: Gadi Evron <ge(a)linuxbox.org> To: nanog list <nanog(a)merit.edu> Subject: zotob - blocking tcp/445 Date: Mon, 15 Aug 2005 21:51:43 +0200 > I heard from several different big ISP's that to stop the > spread of the worm they now block tcp/445. I suppose it > works. > > Gadi.

19 32

Re: Blocking certain terrorism/porn sites and DNS
by Miquel van Smoorenburg 18 Aug '05

18 Aug '05

In article <cistron.ce8d9033050818025539aefd62(a)mail.gmail.com>, Abhishek Verma <abhishekv.verma(a)gmail.com> wrote: >Okay, so i am not talking about blocking or removing a name server. I >am talking of removing that offending entry (like www.abc.com) from >the whois database or whereever the central database is mantained. The database you're talking about is DNS, not the WHOIS database. There is no central DNS database. The DNS database is distributed in a tree-like fashion. Mike.

1 0

RE: New N.Y. Law Targets Hidden Net LD Tolls
by Kristal, Jeremiah 18 Aug '05

18 Aug '05

> *NOT* "other people's fraud". Just when you have > 'intra-LATA' toll charges > for some numbers within a single area-code. If the user is > on one side of > the area-code, and the provider's POP is on the far side of > it, you can have > a what appears to be a 'local' number, that does incur > non-trivial per-minute > charges. Without knowing _where_ a particular prefix is, you > can't tell > whether there will be toll charges for that call, or not, > from any given > call origin. Pardon my ignorance, but don't most phone companies require 10 digit dialing for long-distance. We have similar situations in the rural area I live in, but the customers know if they dial more than 7 digits, it WILL be long distance. Not in densely populated urban areas. In NYC there are at least 5 area codes (212, 516, 917, 646, 347) that are local calls. You can also get extended local calling that adds several more area codes (914, 518, and I think one more). In fact you have to do 10-digit dialing for any call in NYC now, even if you're just calling next door. Things are very different in rural areas where each town has a single exchange. In the 80s I was still dialing only 4 digits to call people in the same town. The next town over has a different exchange, but was part of the same local telco coop, so it was 7 digit dialing but still local. The entire state had one area code (still does), but I think you had to use 1+ to call any toll number. > > Of course, this is true for *every* call in such an area -- > if the new law > is actually singling out ISPs (and ISPs -only-), I expect it could be > successfully challenged as 'discriminatory'. Agreed. It's silly to single out ISPs on this one. Any reasonable ISP is already warning customers that numbers that appear local may not be local. Way back in 95 I was working for a NY/NJ-based ISP that was trying to grow rapidly and we ran into this a lot, especially in NJ. After a handful of VERY irate customers called complaining about $500 phone bills, we got much better at knowing exactly where the toll lines were. We also worked with the Bell Atlantic to reduce the bills and started posting disclaimers. We would also do the work to ensure that a call was a local call if the customer asked, and explain to them how they could often get an expanded calling area for a small fee. > > The excessive 'local toll charge' situation is most visible > on calls to ISPs, > because those calls tend to be somewhat lengthy -- and > frequent -- thus, the > 'unexpected' charges can reach significant dollar value > before the phone > customer gets their first bill. Agreed, but is this really the ISPs fault, or is it the customer's fault. I think the fault lies with both. If an ISP is telling customers that they have local dialup numbers, the customer is likely going to believe the ISP. Sure mistakes happen, but if it keeps happening to a given ISP, maybe it is the ISP's fault. > > Life gets _really_ messy, when the ISP gets phone service > from a CLEC, > because there is "no telling" _where_ the ILEC uses as the > 'rate point' > for handing the calls off to that CLEC. And the CLEC bills > their customers > based on distance from the caller's location to that hand-off > point. The > ISP equipment may be across the street from the caller, but > the ILEC-CLEC > hand-off is on the far edge of the area-code. and the 'local > toll charges' > are applied. > > The CLEC can't tell you (and thus, neither can the ISP) which > prefixes are a > 'non-toll' call to their numbeers. And trying to get an > authoritative answer > from the ILEC about what charges are to the CLEC's prefix can > be _very_ > difficult. I have never come across this, but it may be more of a metro area thing. :-) I think in the end this is a typical government attempt to solve a non-problem. They can easily do public service announcements to inform their constituents, or ask the phone companies to deal with it as it really is a problem for them. It is a charge on the hone bill, right. :-) It's a very common problem in densely populated suburban areas. It's probably not much of a problem in North Dakota. I'm kind of perplexed why Mr. Spitzer is proposing this now though. It's not like dial-up is a growth market. I guess there are still people just getting their first internet connection and starting with dial-up. This might have had more traction 8-10 years ago, when people really were getting saddled with $500 phone bills. Jeremiah

1 0