April 2006 - Test - lists.nanog.org

Could someone from the U.S. DoD contact me.
by L. Jason Godsey 03 Apr '06

03 Apr '06

Could someone from U.S. DoD contact me off list? I've been trying to report what looks like a security problem. I keep getting the run around and transfered to public affairs type mail boxes which end up not working or being full.

3 2

Paging someone from siemens.com's postmaster staff
by Suresh Ramasubramanian 03 Apr '06

03 Apr '06

Please email me offlist when you have a moment to spare.. thanks srs -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

AT&T: 15 Mbps Internet connections "irrelevant"
by Mikael Abrahamsson 03 Apr '06

03 Apr '06

http://arstechnica.com/news.ars/post/20060331-6498.html "In the foreseeable future, having a 15 Mbps Internet capability is irrelevant because the backbone doesn't transport at those speeds," he told the conference attendees. Stephenson said that AT&T's field tests have shown "no discernable difference" between AT&T's 1.5 Mbps service and Comcast's 6 Mbps because the problem is not in the last mile but in the backbone." Is this something held generally true in the US, or is it just pointed hair-talk? Sounds like "nobody should need more than 640kb of memory" all over again. I can definately see a difference between 2 meg, 8 meg and even faster, even when web browsing, especially transferring large pictures when running gallery or alike. When I load www.cnn.com with 130ms latency I get over 1 megabit/s and that's transatlantic with a lot of small objects to fetch. Most major newspapers here in Sweden will load at 5-10 megabit/s for me, and downloading streaming content (www.youtube.com) will easily download at 10-20 megabit/s if bw is available. flickr.com around a couple of megabits/s. (all measured with task-manager in XP, very scientific :P) I can relate to there being a sweetspot around 1.5-3 megs/s when larger speed doesn't really give you a whole lot of more experience with webbrowsing, but the more people will start to use services like youtube.com, the more bw they will need at their local pipe and of course backbone should be non-blocking or close to it... -- Mikael Abrahamsson email: swmike(a)swm.pp.se

18 30

Call for Presentations - NANOG 37 - June 5-7, 2006
by Steve Feldman 03 Apr '06

03 Apr '06

The North American Network Operators' Group (NANOG) will hold its 37th meeting June 11-14, 2006, in a location TBA. The meeting will be hosted by UltraDNS. NANOG conferences provide a forum for information exchange among network operators, engineers, and researchers. Meetings are held three times each year, and include panels, presentations, tutorial sessions, and BOFs. NANOG solicits presentations highlighting issues relating to technology already deployed or soon to be deployed in the Internet. The NANOG community is invited to attend and participate in this forum, which offers numerous opportunities to share ideas, explore research and development, and interact with leaders in this important field of network operations. Vendors are encouraged to work with operators to present deployment experiences with the vendor's products and interoperability. General Session =============== The community is invited to develop panel sessions or present talks on topics relevant to the NANOG community, including: Network Operations Present-day operational case studies Everyday life in the NOC and tools of interest Exchange point technologies and implementation Peering/colocation coordination issues Content provider issues Security attacks/mitigation, tools, and analysis State of OAM tools for IP and MPLS networks Disaster recovery and planning Deployment Experience Mergers and their impact on interconnected networks Alternative and emerging last-mile technologies (metro/rural, broadband, radio, optical, etc.) VoIP deployment, architecture, peering, and interconnect Anycast IPTV Large-scale wireless Fiber and wavelength use by enterprises Research, Policy, and New Technology Approaches to securing the global routing system (e.g., s*BGP and/or other tools) Routing system scalability Capacity planning standards and tools Inter-provider MPLS/QoS/PCE RIR policy (e.g., implications of HD ratio) Active standards organizations and areas of interest IPv6: economics, deployments, and adoption rates Approaches to IPv6 scalability, e.g., Shim6 Panels ====== Panel selection will be based on the importance, originality, focus and timeliness of the topic; expertise of proposed panelists; as well as the potential for informative and controversial discussion. The panel leader should provide an abstract describing the panel theme, list of panelists, and an outline of how the panel will be organized. After acceptance, the panel leader will be given the option to invite panel authors to submit their presentations to the NANOG Program Committee for review. Until then authors should not submit their individual presentations for the panel. Lightning Talks =============== Topics for short (10-20 minute) lightning talks will be solicited on-site at the meeting. "Technologies to Watch" topics will be appropriate for this session. Lightning talks were a hit in Dallas so collect your thoughts early! Research Forum ============== Researchers are invited to present short (10-minute) summaries of their work for operator feedback. Topics include routing, network performance, statistical measurement and analysis, and protocol development and implementation. Studies presented may be works in progress. Researchers from academia, government, and industry are encouraged to present. Tutorials ========= Proposals are also invited for tutorial sessions from the introductory through advanced level on all related topics, including: Disaster Recovery Planning Troubleshooting BGP Best Practices for Determining Traffic Matrices Options for Blackhole and Discard Routing BGP/MPLS Layer 3 VPNs How to Present ============== Submit an abstract and draft slides for the presentation in email to nanog-support(a)nanog.org. See this web page for submission guidelines. Your submission should include: Author's name(s) Preferred contact email address Submission category (General Session, Panel, Tutorial, Research Forum) Presentation title Abstract Slides (attachment or URL), in PDF (preferred) or Powerpoint format We are also developing an online submission system, and hope to have it available shortly. Check the NANOG main page for updates. The deadline for proposals is April 17, 2006. While the majority of speaking slots will be filled by April 17, a limited number of slots may be available after that date for topics that are exceptionally timely, important, or critical to the operations of the Internet. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by May 8. Final drafts of presentation slides are due by May 24, and final versions May 31.

1 0

some funky bgp communities
by Richard A Steenbergen 02 Apr '06

02 Apr '06

Holy crap I'm about to make an on-topic nanog post (IPs changed to protect the guilty)... Anyone else out there seeing issues with some funky communities in the global table around oh say: Apr 3 00:29:33.457 UTC: %BGP-6-BIGCHUNK: Big chunk pool request (252) for community. Replenishing with malloc Apparently it seems to be smoking a few Foundry's out there. The only thing I've seen logged is: bgp_read_v4_message: NOTIFICATION received from x.x.x.x (External AS xxxxx): code 3 (Update Message Error) subcode 4 (attribute flags error), Data: d0 08 01 00 04 d7 So, dusting off my rarely used bgp parsing skills for a second... 0d == attribute flags, including extended length 08 == attribute type communities 0x04d7 == 1239 Based on a lead from some other folks who noticed that this particular issue went away when they stopped accepting routes from AS5400, I noticed: * 62.3.160.0/19 (7 entries, 1 announced) Nexthop: x.x.x.x AS path: 5400 5588 8246 8364 I () Communities: 1239:100 1239:110 5400:49 5400:2004 5400:2005 5400:2014 5400:2016 5400:2023 5400:2027 5400:2029 5400:2032 5400:2033 5400:2034 5400:2044 5400:2045 5400:2048 5400:2061 5400:2103 5400:2106 5400:2109 5400:2110 5400:2112 5400:2116 5400:2117 5400:2121 5400:2123 5400:2124 5400:2128 5400:2130 5400:2133 5400:2145 5400:2151 5400:2169 5400:2174 5400:2500 5588:1001 5588:2048 5588:3003 5588:21016 8246:2 8246:31 8246:1050 Anybody else seeing this issue? Just a generic Foundry/extended length bug being set off by as5400 getting a little community happy? -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

1 0

Memory Refresher: Network Problem Over "X" Miles
by Derek J. Balling 02 Apr '06

02 Apr '06

I seem to remember reading a story a while back about someone who got a trouble report that the users couldn't access sites greater than "X" miles away (can't remember X but it was like 100 or 200 or something). Anyhow, tech initially disbelieves story, but sees it for himself, and really odd network problem is diagnosed, problem solved. However, I can't find this story to save my life now. Can anyone refresh my memory on it? Cheers, D [sorry if this got sent twice... it doesn't appear to have gone out the first time, probably because it had an S/MIME signature attachment?] -- Derek J. Balling Systems Administrator Vassar College 124 Raymond Ave Box 13 - Computer Center 221 Poughkeepsie, NY 12604 (845) 437-7231

2 1

Drone Armies C&C Report - 01 Apr 2006
by c2report＠isotf.org 01 Apr '06

01 Apr '06

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 5621 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 8182 reported C&Cs. Of the suspect C&Cs surveyed, 674 reported as Open, 3507 reported as closed, and 678 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 1739 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 14744 PNAP Internap Network Services 118 17 86 10913 PNAP Internap Network Services 96 0 100 3356 Level 3 Communications, LLC 72 0 100 30058 FDCSE FDCservers.net LLC 65 9 86 25761 STAMIN-2 Staminus Communications 64 18 72 19318 AIC-81 Albany International Corp. 61 21 66 13301 UNITEDCOLO-AS Autonomous System of 57 35 39 14779 INKT Inktomi Corporation 56 0 100 4766 KIXS-AS-KR 46 8 83 12182 PNAP Internap Network Services 44 0 100 21844 THE PLANET 40 0 100 30315 Everyones Internet 34 10 71 13790 PNAP Internap Network Services 33 0 100 8972 INTERGENIA-ASN intergenia autonomou 30 17 43 21840 SAGONE Sago Networks 29 3 90 27595 ATRIV Atrivo 29 4 86 8560 SCHLUND-AS 28 4 86 3561 Savvis 27 2 93 8220 COLT COLT Telecommunications 26 14 46 6981 FDN.com 25 15 40 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 57 35 39 19318 AIC-81 Albany International Corp. 61 21 66 25761 STAMIN-2 Staminus Communications 64 18 72 14744 PNAP Internap Network Services 118 17 86 8972 INTERGENIA-ASN intergenia autonomou 30 17 43 30407 Velcom.com 19 17 11 6981 FDN.com 25 15 40 8220 COLT COLT Telecommunications 26 14 46 19875 IPWORL IPWorld Networks 23 13 43 702 MCI EMEA - Commercial IP 22 13 41 23522 CIT-FOONET 18 12 33 15083 IIS-129 Infolink Information Servic 18 11 39 3462 HINET 24 10 58 9318 HANARO-AS 25 10 60 30315 Everyones Internet 34 10 71 174 Cogent Communications 14 10 29 30058 FDCSE FDCservers.net LLC 65 9 86 29073 COLINKS-AS Colinks web and game hos 9 9 0 19166 Alpha Red, INC 12 8 33 4766 KIXS-AS-KR 46 8 83 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

recommendations regarding IPS
by Hegger, Stefan 31 Mar '06

31 Mar '06

Hi, hope not bothering you but I'm looking for some experiences with IPS systems. There are several vendors but is there a recommandation or some tests? As Service provider we need a system which handles the scanning in hardware and it should work as a layer2 bridge (no IP). Stefan -- Stefan Hegger Lycos Europe GmbH Carl-Bertelsmann Str. 21 Postfach 315 33311 Guetersloh email:Stefan.Hegger@lycos-europe.com Tel: +49 5241 80 71334 FAX:+49 5241 80671334 Mob:+49 170 1892720

5 6

Re: recommendations regarding IPS
by Fergie 31 Mar '06

31 Mar '06

I sent a reply privately earlier to original request, about my own personal preferences, but Gadi's reply prompted me to respond publicly. :-) All-in-all, I find that an IDS (NFR-style) has a quite useful utility. Your choice of such a utility is, of ourse, another matter entirely. :-) - ferg -- Gadi Evron <ge(a)linuxbox.org> wrote: Edward W. Ray wrote: > Tipping Point IPS is the gold standard these days. Signature-based, which > annual fee to get the signatures. Signatures are usually weekly at a > minimum. I use the Unity 50, but they do have Gbps IPS. All of their IPSes > are "bump-in-the-wire" which means that you do not have to assign an address > (operates at layer2 instead of layer 3). Not to say anything about Edward, but this thread is going to be mostly full of commercial injections. Except for one network I have been in charge with I have never found the need for any I[DP]S product and find them an almost complete waste of time and money. Gadi. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: recommendations regarding IPS
by Fergie 31 Mar '06

31 Mar '06

Very. That (several sensors), and honeypots. You need to have tiered security posture... an IDS is not an 'end-all-be all' sort of thing -- it's just another tool. Personal experience and opinion, of course. :-) $.02, - ferg ps. I don't believe in 'self-defending' IPS autocracy stuff; you usually end up sepnding more time clearing auto traps as you do setting them up. :-) -- Gadi Evron <ge(a)linuxbox.org> wrote: Fergie wrote: Hi Ferg, :) > All-in-all, I find that an IDS (NFR-style) has a quite useful > utility. How is it useful for your network? -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0