January 2006 - Test - lists.nanog.org

BlackWorm: updated snort signatures
by Gadi Evron 25 Jan '06

25 Jan '06

Can be found: http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/sigs/VIRUS/WORM_Nyxem?rev=… Thanks, Gadi.

1 0

BlackWorm infected IP's reporting
by Gadi Evron 25 Jan '06

25 Jan '06

Hi. In the next day or so some of us will cooperate to bring to the attention of all effected AS's information about infected users in their net-space. This will be coordinated with several groups and organizations. Please expect these emails, thanks. Gadi.

2 2

Re: cctld server traffic
by Gustavo Lozano 25 Jan '06

25 Jan '06

At 10:42 AM 1/22/2006 +0900, Randy Bush wrote: >any cctld ops seeing unusual traffic in the last hours? Nope at .mx. Gustavo >randy gus

4 3

Router upgrade for small colo provider
by josh harrington 24 Jan '06

24 Jan '06

Hello, hope this isn't too far offtopic here but being a troller for a long time here I've realized there is a great knowledge base so I wanted to at least see if i could get some tips. I help run a small colocation company in California and I am in the middle of recommending a new 'core router' platform for our network. We offer mainly colo and dedicated servers, and several of our clients use our space for VOIP services so quality even under high peak usage is a must. We are not huge, but as we have had near 200% growth in the past 12 months and need to expand our network asap to keep up. Simply put, I'd love to hear feedback and/or suggestions from any of you guys who have gone through this already. Our network map is real simple: [Carrier 7609] --> 100 mbit --> Our cisco 7206 --> 100 mbit --> racks [the racks on our end are a series of switches, mainly 2948gl3's] We push about 60 mbit to/from our (1) carrier at peak right now, and the router keeps up fine [its a cisco 7206 npe 150 btw, very low end on the 7206 line], and at peak we have under 50,000 packets per second, and our 7206 has little/no features enabled [just static routes and passing all traffic between 2 Ethernet 100 mbit interfaces]. To date we have had 2 problems, both were DOS attacks launched FROM one of our customer's servers flooding a full 100 mbit wire with more packets per second than the router could handle (the 2948gl3's spiked to about 50% cpu load during the attack but the 7200 literally just died for 3 minutes as the interface(s) all rebooted]. So our main goal to grow is something that can handle a lot more in this arena against a DOS, and handle our future growth. In then next 12 months we plan to add a 2nd carrier, at t3, 100mbit, or possibly oc3 speed, and possibly upgrade our main carrier to a GigE connection. Probably maxing combined in the 300 mbit range, more likely closer to half that in 12 months. ==== Problems/Requirements ==== - Budget is in the $5k to $20k range ($20k if its going to outlast me even past my 12 month projections) - must not 'collapse' under simple packet flow DOS attack - must handle BGP4 from 2 carriers with full route tables - We plan to buy used, prices below are based on USED, 30 day warranty ebay postings ===== Choices/Options that we have looked at: ==== Option #1: Cisco VXR 7206 [$4k to $12k] Option #2: Cisco 12008 [$7k to $14k] Option #3: Cisco 6509 [$10k to $15k] Here are the 3 main options, broken down a bit more in depth. [I have not ruled out juniper all together, but not enough experience with them and lots of experience with cisco, makes cisco our better option i think, especially since its easier to find used cisco gear than it is to find used juniper gear at a decent price]. [option #1 - Cisco 7206 VXR] -------------------------------- Estimated: $4,000 [$6,000 with 400 mhz, $12,000 with the 1 ghz cpu upgrade] 1 Cisco 7206 VXR NPE 300 mhz w/max ram 2 AC Power 2 Fast Ethernet Adapters (1 included on the NPE) + lots of experience on this unit + lots of spare cards (most compatible) + can keep old 7200 as a hot standby, minimizing long term downtime - END OF LIFE/sale/support on most of the 7200 product line over 5 years ago! The VXR model is darn close to end of life i suspect - minimal horse power here for the money, prone to death by packet attack [option #2 - Cisco GSR (12008)] -------------------------------- Estimated: $7,000 to $14,000 [varies if I start with GigE or just 100mbit] 1 Cisco12008 GSR 40Gbps 1 Clock Scheduler Card (GSR8) 3 Switch Fabric Card (GSR8) 2 AC Power 1 4 port OC-3c/STM-1 Single Mode 1 GE card or a 4 port x 100 mbit + much higher total bandwidth/packet processing power compared to 7200, for similar money - product is long since obsolete and outclassed by the 760x cisco router, as well as just about any juniper router in the m20+ tier. - I'd bet if i buy this, cisco will classify it end of life within 3 months :) - over priced 'blade cards' to add any other functions/circuits (high costs) [option #3 - Cisco 6509 switch'router' w/MSFC2] ------------------------------------------------------------ Estimated: $10,000 - $15,000 (and up depending on config) 1 WS-C6509 Cisco Catalyst 6500 9-Slot Chassis 1 WS-C6K-9SLOT-FAN Catalyst 6000 Fan Tray for 9-Slot Systems 1 WS-C6X09-RACK Catalyst 6x09 Rack Mount Kit 2 WS-CAC-1300W 1300W AC Power Supply 1 CAB-7513AC AC Power Cord 1 WS-X6K-S1A-MSFC2 Catalyst 6500 Supervisor Engine-2, 2GE, plus MSFC-2 / PFC (WS-X6K-S1A-2GE + MSFC-2 & PFC) 1 MEM-C6K-FLC24M 24MB Flash Card 1 WS-X6408A-GBIC Catalyst 6500 8-Port Gigabit Ethernet Module (Req. GBICs) 1 WS-X6348-RJ-45 Catalyst 6500 48-Port 10/100 RJ-45 Module + could consolidate router/switch into 1 [i.e. replace my 48 port switches in each rack] + still a major product with sales/support, no end of life 'soon', this is still a primary flag ship product - 'not a router' as some would say [though this one is as good as it gets for a switch with router ability built in, so i read at least] - bgp4 support appears limited in previous versions, but the MSFC2 processor supposedly can handle (2) bgp4 sessions properly [makes me nervous] - no support for anything but 100mbit, or gigE links, wont work with t3, or oc3 lines [since i don't know what ill buy from my next carrier this is a draw back since i may very well get a circuit this switch/router can't use] - 'all eggs in 1 basket' theory, if it breaks you loose all your ether switches! [at least with separate routers/switches i can swap in an old 7206 router spare and get back online fast in a worst case scenario. -- OK so if you read this far, you probably wonder why the heck am i asking you guys and not calling cisco and juniper, and others? Well I have, and I have, they all gave me their input- but I'd love to hear from some real people in the field rather than sales engineers and bloated brochures claiming much more capacity than true world usage will produce etc. - Josh Harington jharington68(a)hotmail.com _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

3 2

T1 bonding
by Matt Bazan 24 Jan '06

24 Jan '06

Can someone shed some technical light on the details of how two T1's are bonded (typically). We've got two sets of T's at two different location with vendor 'X' (name starts w/ an 'A') and it appears that we're really only getting about 1 full T's worth of bandwidth and maybe 20% of the second. Seems like they're bonded perhaps using destination IP? It's a vendor managed solution and I need to get some answers faster than they're coming in. Thanks. Matt

5 7

RE: Password Security and Distribution
by (nanog) Brian Battle 24 Jan '06

24 Jan '06

>Our company is starting to grow rather quickly and we are starting >to have growing pains. We are in the need for a better mechanism for >sharing passwords between our engineers. I wish there was a system that let you do the following: * Store and encrypt logins/passwords and access logs in a database * Assign permissions (add new logins/passwords, change password...) to those passwords on a per user/group basis, based on an existing authentication scheme (Windows AD, LDAP, Kerberos...) * SSL web frontend * Reporting. If a user leaves and you want to know which passwords he had access to or has ever accessed so you can change them, this would be really really nice. I've been playing around with Network Password Manager from www.sowsoft.com. It seems like the best product available in this area that I could find that makes sharing passwords kinda easy, but it's a service that runs on Windows, requires a Windows client software installation, and lacks any sort of reporting.

2 1

BlackWorm naming confusing [CME entry now available]
by Gadi Evron 24 Jan '06

24 Jan '06

The CME entry should appear on their site shortly: http://cme.mitre.org Gadi.

1 0

RE: Password Security and Distribution
by McLean Pickett 24 Jan '06

24 Jan '06

Jeremy - I've not found a better solution than PGP. Perhaps more a formalized process for communicating password updates proactively is all you need. Ideally, distributing passwords at 3am is too late. In the past I've used small password database programs on a network share. You are then left with verbal or PGP encrypted communications to distribute a single new password to access the database versus distributing all of the changed passwords. If you're interested try http://www.anypassword.com There are others who read this list that prefer distributing passwords on paper. You can't hack into a piece of paper :) and if you have physical access to the paper then you most likely have physical access to the network equipment as well... McLean -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Jeremy Stinson Sent: Tuesday, January 24, 2006 10:49 AM To: nanog(a)merit.edu Subject: Password Security and Distribution All, Our company is starting to grow rather quickly and we are starting to have growing pains. We are in the need for a better mechanism for sharing passwords between our engineers. Most of these passwords are for our client's systems where some of them are controlling the password schemes (aka requiring shared user accounts). We have a process in which we change passwords every X days but, distributing these passwords to everyone who needs them is starting to become a challenge. Also, handing off passwords to someone who is stepping in to help out at 3am securely is not easy. I have tried to do google searches but I have not been able to find a good way or process to do this. I am wondering if anyone has any ideas on how to handle this? In other companies we have used a PGP keyring to secure a text file that contained all of these passwords and then put them onto a shared customer portal. The problem with this strategy is what happens if you are not on your computer where PGP is installed? Any suggestions will be welcomed. Thanks in advance, Jeremy

3 2

BlackWorm technical information
by Gadi Evron 24 Jan '06

24 Jan '06

Technical information on the worm itself can be found here: http://www.f-secure.com/v-descs/nyxem_e.shtml and http://blogs.securiteam.com/index.php/archives/229 Gadi.

1 0

Re: BLS FastAccess internal tech needed
by Fergie 24 Jan '06

24 Jan '06

RFC2827/BCP38? - ferg -- Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: [snip] What they're *trying* to do is actually quite sensible, and beats spammers trying to do asymmetric routing / source address spoofing type stuff [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 3