February 2006 - Test - lists.nanog.org

Fed Bill Would Restrict Web Server Logs
by Jon R. Kibler 14 Feb '06

14 Feb '06

> Message: 3 > Date: Thu, 09 Feb 2006 00:14:23 -0800 > From: Declan McCullagh <declan(a)well.com> > Subject: [Politech] Delete web server logs, or get fined by the Feds? > Ed Markey's new bill [fs] > To: politech(a)politechbot.com > Message-ID: <43EAF9DF.2000602(a)well.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > I've posted the text here: > http://www.politechbot.com/docs/markey.data.deletion.bill.020806.pdf > > A summary is here: > http://news.com.com/2100-1028_3-6036951.html > "A bill just announced in Congress would require every Web site operator > to delete information about visitors, including e-mail addresses, if the > data is no longer required for a "legitimate" business purpose. > > An open question is whether Rep. Ed Markey's bill would require that > Internet addresses be deleted by default from Apache and other web > server logs. One reading is that it would be. But it's not clear whether > an IP address falls under the definition of personal information. > > This bill applies to anyone running a web site, including individuals > and bloggers. So it's not just companies that have to worry. > Original posting from Declan McCullagh's PoliTech mailing list. Thought NANOGers would be interested since, if this bill passes, it would impact almost all of us. Just imagine the impact on security of not being able to login IP address and referring page of all web server connections! Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

14 14

Re: protocols that don't meet the need...
by Andrew Dul 14 Feb '06

14 Feb '06

> -------Original Message------- > From: Valdis.Kletnieks(a)vt.edu > Subject: Re: protocols that don't meet the need... > Sent: 14 Feb '06 13:10 > > On Tue, 14 Feb 2006 12:35:19 PST, Tony Hain said: > > Rather than sit back and complain about the results, why not try to > > synchronize meeting times. Not necessarily hotels, but within a reasonable > > distance of each other so the issue about ROI for the trip can be mitigated. Not a substitute for attendance and face-to-face meetings, but ISOC has started publishing the IETF journal. It is a pretty long read, but I've found it useful to catchup on working groups. http://ietfjournal.isoc.org/

1 0

NANOG36-NOTES 2006.02.14 talk 7 Randy IRR routing security revisited
by Matthew Petach 14 Feb '06

14 Feb '06

Many apologies...I'm no Stan Barber, but still doing my best to keep up with the note-taking. ^_^;; Matt Slides are on Randy's site at http://rip.psg.com/~randy/060214.nanog-pki.pdf What I want for Eid ul-Fitr Randy Bush randy at psg.com Definition of Eid ul-Fitr; end of Ramadan; breaking of the fasting period, and of all evil habits. Roughly October 24th this year. 10 years ago Randy plead for people to use IRR; he gives, it didn't work, it has bad data, it doesn't work. Let's get rid of it. Routing security is what we need. Routing security gap assume router has been captured. routing security (not router) is a major problem. http://rip.psg.com/~randy/060119.janog-routesec.pdf need PKI, storing and passing and signing certificates. Public Key Infrastructure PKI Database RIR Certs ISP Certs End Site Certs IP Addresss Attestations ASN Attestations IP and AS Attestations specifies identity == pyblic ckey of recipient signed by allocator's private key Follows allocation hierarchy IANA (or whomever) to RIR RIR to ISP ISP to downstream ISP or end user enterprise IP allocation example IANA to RIR S.iana (192/8, rir) RIR allocatees to ISP S.rir(192.168/16) and so on down the chain. Each chain uses the private key to sign the certs to hand down the chain. ISP/End-site-certs May be acquired anywhere. Don't have to be chained to a single master organization, and can use the same one for multiple RIRs, orgs, etc. RIRs can issue as a service for members who don't get them anywhere. They need no attestation because they are only used in business transactions where they are exchanged and managed by contract, or Bound to IP or ASN attestations by the RIRs or upstream ISPs. Big ISPs may use an ARIN identity for an APNIC allocation or business transaction. Since the keys are acquired separately, doesn't matter where the certs come from, or where used. RIR Identity similar. it's their public key can get it from 'above', RIR< NRO, IANA, or they can even self cert. No provision for revocation, however. PKI Interfaces/Users Nice slide showing the interrrelationships; go see the slides for it, I won't try to render it in ASCII in realtime. The certificates are directly exchanged as part of the business transaction when goods (IPs, ASNs, etc) are exchanged. Goal is to have formally verifiable route attestations, so want replicas of data near routers to be used to determine validity of route origination and propagation. Transacting with PKI RFC2585 descripts FTP and HTTP transport for PKI no need for transport security! Tools for RIRs Generate and receive ISP certs Receive ASN and IP space attestations from upstairs Tools for ISPs generate/get certs register role certs generate certs for downstreams sign allocations to downstreams Open Issues Coordination of updates one central repository not feasible LDAPv3 RFC3377 and RFC2829 for authentication Cert/key rollover and revocatoin not covered May require a separate and secured communication channel NSF via awared ANI-0221435 Steve Bellovin & JI >From microphone, are there TTLs on certs? Yes, which is why ISP certs are separated out. Addresses from ARIN are only "yours" as long as you keep paying ARIN. Tie certs to contract terms. But the ISP identity cert is yours, nobody else should have control over rollover and expiration. APNIC is working to have web pges Andrew Dole, Boeing; how to get funded--Randy will take cash donations. Andrew thinks it'll take 10 million to get the ball rolling. Randy doesn't think that's the problem. The operator community would prefer to see a rigorously correct and verifiable solution with reasonable security infrastructure rather than one more hack on the IRR. Second question. What is forum to discuss and nail down the details? He'll be at APNIC in 2 weeks; for this region the ARIN meeting in Montreal, and this meeting is good too. Nobody seems to be sure where the right place to do this is. But Randy thinks the important part is to SEND the message, that there is a valid path. Vince Fuller. Soliciting input from this group is a good thing, but be more targetted. Figure out why the previous efforts failed, and target them. Chris Morrow, Ted Seely...Randy targets some specific people in the audience. Chris Morrow notes that one challenge he faces is being able to verify if filters are correct. Randy notes the ROUTER will verify the validity itself. Chris feels doing it in OSS system is safer. RS--how do you deal with crufty stuff? RIRs and community will have to deal with that, he's just talking about giving tools to make it possible. Sandy Murphy, Sparta--Randy, you've said there's no prefix lists needed for this; but this could be used for building filter lists, or checking updates, or for tracking customers who call in with issues, etc. this is a first step for a whole BUNCH of things. So no matter what else we want to build on top of it, this really is the first level of the foundation that needs to be built. Beer and Gear at 5:30 directly beneath us today. Surveys will be online this afternoon--fill it out today or tomorrow!! Especially give feedback on M-W vs Sun-Tue format; next one will be M-W, then S-Tu for ARIN, after that there will be flexibility. Head for lunch, back by 2.

1 0

NANOG36-NOTES 2006.02.14 talk 4 Flooding via routing loops
by Matthew Petach 14 Feb '06

14 Feb '06

2006.02.14 talk 4 Flooding attacks Jianhong Xia A new talk added right before lunch by Randy Bush will push us to 12:25. Two talks coming up about DoS attacks against control information Flooding Attacks by exploiting persistent forwarding loops. Introduction: routing determines forwarding path. Transient forwarding loops happen all the time during convergence; that's normal. But this focuses on persistent fowarding loops. why would persistent loops exist? Example on neglecting pull-up routes. Router announces 18.0/16 to internet router A has default pointing to B router A uses 18.0.0/24 only Any traffic to 18.0.1.0-18.0.255.255 will enter the forwarding loop between A and B Risk of persistent forwarding loops can amplify based on ttl of packets injected into the looping pair of routers. Can create a denial of service by flooding the upstream links between routers in front of host they want to knock off. any other hosts behind that link are "imperiled addresses" Measurement Design: balancing granularity and overhead samples 2 addresses in each /24 IP block Addresses space collection addresses covered by RouteView table de-aggregate prefixes into /24 prefixes fine-grained prefixes data traces traceroute to 5.5 million fine-grained prefixes measurement lasts for 3 weeks in sept 2005 Almost 2.5% of routable addresses have persistent forwarding loops Almost .8% of routable addresses are imperiled addresses. Validating these persistent forwarding loops from multiple places from asia, europe, west and east cost of US 90% of shadowed prefixes consistently have persistent forwading loops Validation to multiple addresses in shadowed prefixes sampling 50 addresses in each shadowed prefix 68% of shadowed prefixes shows that... Properties of the loops How long are the loops? 86.6% of loops are 2 hops long 0.4% are more than 10 hops long some are more than 15 hops location 82.2% of persistent loops happen within destination domain implications significantly amplify attacking traffic can be exploited from different places. (oops. Matt gets paged out to deal with issue, so no more notes for a while).

1 0

NANOG36-NOTES 2006.02.14 talk 3 Flamingo Netflow Visualization Tool
by Matthew Petach 14 Feb '06

14 Feb '06

2006.02.14 talk 3 Flamingo netflow visualization Manish (from BGP Inspect project from Merit) bgpinspect.merit.edu:8080 He'll be talking later at the Tools BOF as well apparently. Introduction: What is Flamingo? Visualization The Flamingo Tool combining visualizations with controls Case Studies traffic anomaly network scans worm traffic P2P traffic the slashdot effect. The tool has been under development for a year; John, in audience, and Mike (now employed) have been working on it as undergrads. It's just a view into netflow, no filters or adjustment of data it's just a visualization system. client/server architecture a single server can support multiple clients Visualation methods 5 different views extended quad tree implementation volume by src/dst IP prefix volume by src/dst AS Basic quad tree represent 32bit IP address into fixed space. 4 areas representable by 2 bits. Keep splitting 16 times, you represent 32 bit address in 2D mapping. convert it into 3 dimension, have an axis of freedom to represent additional info. So one side is the quad tree, the Z axis is volume of traffic, so you can see relative volumes. nice slide showing visualization of the traffic flow patterns. Can show traffic flows aggregated by src/dst IP; now there's 2 surfaces needed on the cube, so they use line thickness between the surfaces to show flow sizes between ASes. last visualization incorporates port info as well But since there's only one axis left; so now port level info is on z axis. so IP/port is X1Y1Z1; same for dest IP and port. Once there are coordinates, the line can be drawn, scale the width based on the volume, and now you have the full info in one view. Same colour used to represent traffic from the same source ntuple. combine 2D and 3D representation of data to help keep yourself oriented. They have text representatiosn of information, same as visual data, but in text form. Slider bars allow thresholding of what gets displayed, to prevent clutter; only over a certain size, or only certain ports, etc. Can also apply labels to help pull information out for fast refrence. You can also restrict the address space you care about to only look at certain subnets. Case study: Traffic anomaly sunday Oct 16, 2005 large burst of traffic from one host at umich, lasted 6 hours, four targets, not widely distributed, it was UDP traffic. Was visible in normal view. from 12pm to 6pm. visible on main view, zoomed in, and the 4 million flows show as a huge block. going to src/dest view lets you see where the traffic is going. adding the port info, and you see the entire port space is being sprayed. Another case study--worm traffic doing port 42 scans a fan view on the graph, highly visible. An artificial case study, a host scanning a /24 subnet SSH scans also show up as many many ports probing a single port; a reverse fan. Slashdot effect on campus Oct 31 2004; have before and during pictures showing the huge traffic swing. Zotob worm infection; random destination IPs, but same port, coming from same host, cone effect. P2P traffic; single host with multiple connections to different destinations, significant volume to each. Darkspace traffic visualizations show nothing but scans, show up really dramatically. Conclusion The Flamingo Visualization Tool provides users with the ability to easily explore and extract meaning information regarding traffic flows in their network. More will be discussed at the Tools BOF this afternoon. http://flamingo.merit.edu/ Break now, come back at 10:50. Someone left a jacket at the Yahoo party with a digital camera; describe it to the registration desk to get it back.

1 0

NANOG36-NOTES 2006.02.14 talk 1 IRR power tools
by Matthew Petach 14 Feb '06

14 Feb '06

Apologies in advance, notes from this morning will be a bit more scattered, as I was working on an issue in parallel to taking notes. Matt 2006.02.14 talk 1 IRR Power Tools 12:10 to 12:25, extra talk added, not on printed agenda. Thanks to those who submitted lightning talks. PC committee members are doing moderation, Todd Underwood will be handling the first session this morning. There will be 3 talks about tools for operators 1 IRR and 2 Netflow tools. Be thinking of interesting questions to ask. Todd has to introduce RAS at 9am, 7am west coast time which is normally his bedtime. IRR power tools, Dec 2004 first generation re-write. IRR--a quick review People have been asking him "why do we need the IRR?" Any time you have a protocol like BGP that can propagate information, you need some form of filtering in place to limit damage. IRRs are databases for storing lists of customer information. Written to speak RPSL some speak RPSLng. RADB ALTDB VERIO, LEVEL3, SAVVIS RIR-run databases: ARIN, RIPE, APNIC, etc. IRRs better than manual filtering. huge list on the slides. Filtering is needed, and hard to keep updated by hand. Why doesn't everyone use IRR? Many people do In Europe, pretty much total support in Europe; it's required by RIPE, providers won't deal with you if you don't keep your entries up, large exchanges likewise check. Few major networks in US use IRR too: NTT/Verio Level3 Savvis Most people don't. Why doesn't everyone use it? In US, it's too complex for customers. support costs go up if you have to teach customers. Networks don't like to list their customers in a public database that can be mined by competitors RAS figured he could fix at least one piece Wrote a tool to help with: automatic retrieval of prefixes behind an IRR object automatic filtering of bogon or other undesirable routes Automatic aggregation of prefixes to reduce config size Tracking and long-term recording of prefix changes Emails the customer and ISP with prefix changes Exports the change data to plain-text format for easy interaction with non-IRR enabled networks Generates router configs for easy deployments. Doesn't do import/export policies, doesn't do filter-sets, rtr-set, peering-set, etc. Just focuses on essential portions. Tool was written around IRRToolSet initially, but the C++ code didn't compile nicely. This isn't a complete replacement for IRRToolSet, but provides the basic functionality A few conf files: IRRDB.CONF EXCLUSIONS.CONF NAG.CONF ./irrpt_fetch grabs the current database info It also speaks clear english on add/remove of prefixes for access lists; default format is english, but you can change it to diff format. ./irrpt_pfxgen ASNUM generates a prefix list suitable for the customer interface. Can use -f juniper to create juniper filters. http://irrpt.sourceforge.net/ Always looking for more feedback; it's been deployed by a few people in the peering community; this will be its first widescale announcement. Future plans: Add support for IPv6/RPSLng needs IPv6 aggregation tools RADB tool uses a faster protocol, RIPE just breaks down one level; you have to do multiple iterations to get the full expansion. Servers tend to time out before you can get all the answer; RIPE servers have hard 3 minute timeout that closes the socket. Add SQL database support for a backend Convert from a script to a real application IRRWeb -- http://www.irrweb.com/ He'll talk about irrweb at next nanog. Allow end users to register routes without needing to know ANYTHING about RPSL You can play with it, register routes, but it doesn't publish anywhere. That's it--happy valentine's day! Richard A Steenbergen ras at nlayer.net Susan notes that RADB is developed by Merit, the two primary developers are here today Chris Fraiser, main cust interface now Larry Blunk is RPSLng person, also here today. Right now, no mirroring between IRRs, you have to mesh with everyone else when a new IRR comes up. RADB at least does pick up from the others, so right now RADB is the best spot to do your queries against. Todd asks about filters; does it do prefix list only, or prefix list plus as-path? It builds off as's behind other as's, which might not be the best model; latest code is starting to understand as-sets. To do it properly, you might need import/export policy support. Randy Bush, IIJ. Like IPv6, this meeting marks the tenth anniversary of Randy pushing for IRR adoption. And like IPv6, adoption rate has not been going well. What's wrong? Pretty much too complex, which is why this effort is to make it much simpler, to try to get more uptake in the US. Todd notes that 2 things; 1, tools are too difficult; this addresses that. second piece is that in US, allocations aren't tied to registry entry creation; this won't solve that part at all. For the second part, the benefits are seen mostly the closer you are to the registration process. Anyone can register any block; and if you don't use AS123:, people can register anything in your block, whether you want them to or not. Randy notes that they're trying to tweak allocation policy on something that nobody wants; he thinks this might approaching the issue at the wrong end. There's no push for it, so better tools doesn't necessarily help; and the data in the database are poor, so what of the data can really be trusted? Randy feels that certification path for allocation is more needed to formally track and make the data correct and verifiable, so no stale/bogus data can enter the database. Richard will talk at tools BOF this afternoon, and Andrew Dole, Boeing. ARIN region policy, modify ORG template, add ASN entry into registry entry to link AS to prefix in the registry. Could be a useful database that could be used to cross-verify the RADB data. Discuss on ppml list, if you think it needs more, or should be mandatory, etc. RAS notes it would take a communication protocol between RIRs to make it widespread. Sandy Murphy, Sparta. She submitted the policy to the ppml list. There is a security language for RPSLng--with the tools being submitted, is there plans to support those security specifications? You have to have authorization of prefix holder and AS holder before you can create the route entry in RIPE, for example. RAS's goal is to just try to bring US up to level of rest of the world. Need to tie registration of prefix to authority to put entries in routing registry. IRRs are chock full of old stale data, and no way to remove it.

1 0

Re: Fed Bill Would Restrict Web Server Logs
by Gregory Hicks 14 Feb '06

14 Feb '06

> Date: Tue, 14 Feb 2006 09:47:50 -0500 > From: "Jon R. Kibler" <Jon.Kibler(a)aset.com> > > > Date: Thu, 09 Feb 2006 00:14:23 -0800 > > From: Declan McCullagh <declan(a)well.com> > > > > I've posted the text here: > > http://www.politechbot.com/docs/markey.data.deletion.bill.020806.pdf > > > > A summary is here: > > http://news.com.com/2100-1028_3-6036951.html > > "A bill just announced in Congress would require every Web site operator > > to delete information about visitors, including e-mail addresses, if the > > data is no longer required for a "legitimate" business purpose. > > > > An open question is whether Rep. Ed Markey's bill would require that > > Internet addresses be deleted by default from Apache and other web > > server logs. One reading is that it would be. But it's not clear whether > > an IP address falls under the definition of personal information. > > > > This bill applies to anyone running a web site, including individuals > > and bloggers. So it's not just companies that have to worry. > > > > Original posting from Declan McCullagh's PoliTech mailing list. > Thought NANOGers would be interested since, if this bill passes, it > would impact almost all of us. Just imagine the impact on security of > not being able to login IP address and referring page of all web > server connections! Jon: The proposed bill states to delete when data is no longer required for "legitimate" business purposes. If you business model requires that you keep the logs for some "tracking" function, then keep them. As long as the logs are required for business purposes. Once the business purpose finishes, then delete them. How is this different that the way we operate now? Except that, if the bill passes, then - possible/probably - our "privacy policy" (such as they are) will have to state the business purposes... IANAL, but my $0.002 worth. Regards, Gregory Hicks ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 San Jose, CA 95134 I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

RE: Fed Bill Would Restrict Web Server Logs
by David Hubbard 14 Feb '06

14 Feb '06

From: Andy Davidson > > > Speaking with my e-commerce vendor hat on, server logs (apache, mail, > application audit logs) and other information about visitors > (especially those who have conducted a purchase transaction with > us, or signed up to our newsletter) never stop having a business > purpose - it's called referential integrity. > > We want to use them to track the behaviour fraudulent users > for example. Anyone who runs mailing lists has to keep that info to be able to prove how and when someone opted in. David

2 1

Re: Interesting paper by Steve Bellovin - Worm propagation in a v6 internet
by Suresh Ramasubramanian 14 Feb '06

14 Feb '06

On 2/14/06, Mohacsi Janos <mohacsi(a)niif.hu> wrote: > In the 6NET project we identified, that exhaustive search in IPv6 is not > feasible (e.g. nmap does not support it for IPv6), but there are also Interesting. By the way is there a "currently" missing between "not" and "feasible" there? Even given the sheer size of v6 space some of the other traits noted by SMB - like the tendency of network equipment to be clustered in the first few bits of a /48, and possibly observing new v6 netblocks get announced and routed might be used by someone to make intelligent guesses. And nmap can probably be hacked into doing that kind of scanning. After all when there's an unlimited number of hosts connected to the v6 network, all that needs to happen is a small botnet to develop, and then start to port scan. The potentially larger number of hosts that can get infected will probably help do an exhaustive search for you, so that v6 botnets start small and then grow exponentially in size over time. I rather suspect that the portscanning will grow to keep pace with the actual number of v6 connected hosts. -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

2 1

ISP filter policies
by Ricardo V. Oliveira 14 Feb '06

14 Feb '06

Hi, i would like to know where i can get info about ISP filter policies, namely use of community values? Is there any page other than: http://www.nanog.org/filter.html (lots of broken links)? Thanks! --Ricardo

2 1