May 2006 - Test - lists.nanog.org

IPv6 Transit?
by Mat Sharpe 15 Jun '06

15 Jun '06

Hi, Does anyone have any info on IPv6 deployment at the Tier-1 / Tier-1.5 level? We are multi-homed to both Level3 and Abovenet in the UK and Level3 only in the US. Level3 did have a promising sounding beta program last year but that seems to have stalled. Abovenet apparently have no schedule to deploy v6 at the moment. I would like to be able to v6 enable our network but without a transit provider that’s going to prove a bit tricky. Any thoughts appreciated! Cheers, Mat Sharpe Qube Networks Ltd P.S. I hope I’m not about to re-start the who is/is not a Tier-1 / Tier-2 argument! :)

7 6

MEDIA: ICANN rejects .xxx domain
by william(at)elan.net 13 Jun '06

13 Jun '06

http://www.icann.org/announcements/announcement-10may06.htm ---------- Forwarded message ---------- Date: Thu, 11 May 2006 08:46:40 -0400 From: David Farber <dave(a)farber.net> To: ip(a)v2.listbox.com Subject: [IP] ICANN rejects .xxx domain Begin forwarded message: As reported in: http://abcnews.go.com/Business/print?id=1947950 ICANN has reversed their earlier preliminary approval, and has now rejected the "dot-xxx" adult materials top-level domain. I applaud this wise decision by ICANN, which should simultaneously please both anti-porn and free speech proponents, where opposition to the TLD has been intense, though for totally disparate reasons. Nick's AP piece referenced above notes that there are still Congressional efforts to mandate such a TLD. It is important to work toward ensuring that these do not gain traction. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, IOIC - International Open Internet Coalition - http://www.ioic.net Moderator, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com DayThink: http://daythink.vortex.com

27 45

BCP for Abuse Desk
by dlr＠bungi.com 02 Jun '06

02 Jun '06

Of late, I have found many large ISPs that are employing anti-spam filters on their abuse@ addresses. Needless to say, they seem surprised that their customers have any abuse issues involving spam at all :-) I know that there was a Abuse Desk BCP working group started a few years ago. Can anyone give me an update on BCP practices that I can refer ISPs to? --

6 6

Cisco ACL question
by Jon R. Kibler 01 Jun '06

01 Jun '06

Greetings All, Sorry for the slightly off-topic question, but I suspect that this is an issue that others have faced or may soon face as ISP continue to push out more PPP-oriented networks. One of our customer's ISP is converting from static IP assignments to PPP IP assignments for all customers' Internet facing routers. This is creating a security problem that I do not know how to fix and for which the ISP is no help. Problem: how to ACL on a dynamic IP? Assume that we have the following (partial) configuration on a Cisco 2801 and are assigned the static netblock 1.2.3.0/29. This was what worked before the ISP made the change. ! Old config example interface serial0/2/0 ip address 1.2.3.1 255.255.255.248 ip nat outside ip access-group 110 in ... interface fastethernet0/0 ip address 172.17.100.254 255.255.255.0 ip nat inside ... ip nat pool localstatic 1.2.3.2 1.2.3.2 prefix 29 ip nat inside source list 1 pool localstatic overload ip nat inside source static tcp 172.17.100.22 22 1.2.3.5 12322 ip nat inside source static ... access-list 1 permit 172.17.100.0 0.0.0.255 access-list 1 deny any log access-list 110 permit tcp any 1.2.3.0 0.0.0.7 established access-list 110 permit tcp host a.b.c.d host 1.2.3.5 eq 12322 access-list 110 deny tcp any any log access-list 110 permit udp host d.n.s.1 eq 53 host 1.2.3.2 access-list 110 permit udp host d.n.s.1 host 1.2.3.2 eq 53 access-list 110 permit udp host n.t.p.1 eq 123 1.2.3.2 access-list 110 deny udp any any log access-list 110 permit icmp any host 1.2.3.2 echo-reply access-list 110 permit icmp any host 1.2.3.2 unreachable access-list 110 permit icmp any host 1.2.3.2 time-exceeded access-list 110 deny icmp any any log access-list 110 deny ip any any log In the new configuration, the serial0/2/0 interface now has a dynamic IP. How can I put ACLs on that IP that will permit NTP, DNS, and ICMP originating from within the router to work? Everything behind the router works, but anything generated by the router itself breaks (because the external IP is not permitted in an ACL). In the new configuration, this is the only change I made (other than PPP stuff): ! New config example interface serial0/2/0 ip address negotiated ip nat outside ip access-group 110 in ... Everything from behind the router continues to work fine. However, the router is unable to do NS lookups, set time, etc. Basically, all traffic to the dynamic IP is blocked. Is there a SIMPLE way to fix this problem AND keep the router secured? I have searched the Cisco site, and Google, and cannot seem to find an answer that I can fully comprehend. I thought that maybe 'ip nat outside' was my fix, but I could not get it to do what I expected. Thanks in advance for your help! Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

2 1

Drone Armies C&C Report - 31 May 2006
by c2report＠isotf.org 31 May '06

31 May '06

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 3151 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 10115 reported C&Cs. Of the suspect C&Cs surveyed, 649 reported as Open, 935 reported as closed, and 569 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 4666 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 54 27 50 19318 AIC-81 Albany International Corp. 49 14 71 4134 CHINANET-BACKBONE 37 16 57 23522 CIT-FOONET 35 20 43 8972 INTERGENIA-ASN intergenia autonomou 35 17 51 4766 KIXS-AS-KR 32 7 78 4314 IIS-64 I-55 INTERNET SERVICES 28 1 96 4837 CHINA169-Backbone 27 8 70 30315 Everyones Internet 25 11 56 33597 InfoRelay Online Systems, Inc. 24 0 100 7132 SBC Internet Services 24 5 79 9318 HANARO-AS 24 8 67 3561 Savvis 23 3 87 8560 SCHLUND-AS 22 5 77 13749 EVRY Everyones Internet 22 2 91 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 20 0 100 29073 COLINKS-AS Colinks web and game hos 19 13 32 27595 ATRIV Atrivo 19 3 84 3462 HINET 19 7 63 21840 SAGONE Sago Networks 18 3 83 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 54 27 50 23522 CIT-FOONET 35 20 43 8972 INTERGENIA-ASN intergenia autonomou 35 17 51 4134 CHINANET-BACKBONE 37 16 57 13237 LAMBDANET-AS 18 14 22 19318 AIC-81 Albany International Corp. 49 14 71 29073 COLINKS-AS Colinks web and game hos 19 13 32 30315 Everyones Internet 25 11 56 174 Cogent Communications 16 10 38 9318 HANARO-AS 24 8 67 4837 CHINA169-Backbone 27 8 70 3269 TELECOM ITALIA 12 7 42 3462 HINET 19 7 63 4766 KIXS-AS-KR 32 7 78 19262 Verizon Internet Services 14 7 50 12322 PROXAD AS for Proxad ISP 6 6 0 28753 NETDIRECT AS NETDIRECT Frankfurt 8 6 25 16265 LEASEWEB AS 11 6 45 3786 ERX-DACOMNET 9 6 33 9600 SONY CORPORATION 7 6 14 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

apops sep 4-8 kaohsiung, taiwan
by Randy Bush 31 May '06

31 May '06

apops and apnic will meet 2006.09.04-08 in kaohsiung, taiwan, see <http://www.apnic.net/meetings/22/index.html> the technical-but-not-policy content that used to be in the apnic sigs is being moved to the apops part of the meeting. this should make for a more ops/research-fun nanog-like event. any ops or research folk who are going, or might be, and would be willing to present, it would be much appreciated. randy

1 0

Re: Black Frog - the botnets keep coming
by Fergie 30 May '06

30 May '06

Sorry, this is not acceptable, regardless of national boundaries. And it will be fought against, regardless of where it originates, or resides. Always. I do not condone collateral damage strategies in this regard, but suggesting that a "wild, wild west" Internet is something that will be a contimuum -- it cannot be, and will not be. As such, I also do not condone such activities as Blue/Black Frog suggest, as it is completely contrary to established practices of mitigation (and removal). - ferg p.s. Now if we could only get the registries onboard... -- "Alexei Roudnev" <alex(a)relcom.net> wrote: Internet IS a wild west. You should live with it. It will never be _quet, dead american's residential area, where dogs do not bark and kids do not play themself on streets in age of 8 (normal dogs bark, and normal kids often play themself when they are 8)_. It is the whole WORLD, not one country. So, we must live with it, and do not hope, that it will have numerous _speed tickets_ and _police officers_ (as 90% of the people live every day, making their own decisions and protecting themselves. It is, in fact, a very effectiv way to stop spammers. But it definitely became a dangerous DDOS service. So - learn how to live with it, it's the only choice. (Make sure, that no single protocol or botnet can kill the whole network or deplete all resources, for example). [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Fwd: 41/8 announcement
by Richard Mikisa 30 May '06

30 May '06

This came in from someone in Italy.. ---------- Forwarded message ---------- From: ***** Date: May 24, 2006 11:15 AM Subject: Re: 41/8 announcement To: rmikisa(a)gmail.com > >Turns out the folks at fastweb (Italy) NAT there adsl clients but > >instead of using the rfc1918 space like most people, they use > >unassigned > >global /8s. Well 41/8 is one of there NATted allocations for Turin. No > >amount of emails will get them to respond, calling isn't any better > >as I > >get only Italian speaking people at the other end. Any ideas out > >there? Yes: you lose, sorry. :-) Many of their networking people are less than clueful, and I fear that they are not going to renumber a whole city just to let their customers communicate with a few African networks... Let me know if you need more information. (Feel free to repost this if needed, but please remove my name.) -- ciao, ******* -- cheers Richard

11 13

Are botnets relevant to NANOG?
by Michael.Dillon＠btradianz.com 30 May '06

30 May '06

In recent discussions about botnets, some people maintained that botnets (and viruses and worms) are really not a relevant topic for NANOG discussion and are not something that we should be worried about. I think that the CSI and FBI would disagree with that. In a press release announcing the last CSI/FBI survey http://www.gocsi.com/press/20050714.jhtml the following statement appears: Highlights of the 2005 Computer Crime and Security Survey include: - The total dollar amount of financial losses resulting from security breaches is decreasing, with an average loss of $204,000 per respondent-down 61 percent from last year's average loss of $526,000. - Virus attacks continue as the source of the greatest financial losses, accounting for 32 percent of the overall losses reported. - Unauthorized access showed a dramatic increase and replaced denial of service as the second most significant contributor to computer crime losses, accounting for 24 percent of overall reported losses, and showing a significant increase in average dollar loss. So where do botnets come in? First of all, botnets are used to distribute viruses, the largest source of financial losses. Second, botnets are built on what the CSI calls "unauthorised access", the second largest source of loss. And denial of service, which used to be the 2nd largest, is also something that botnets do. Now NANOG members cannot change OS security, they can't change corporate security practices, but they can have an impact on botnets because this is where the nefarious activity meets the network. Therefore, I conclude that discussions of botnets do belong on the NANOG list as long as the NANOG list is not used as a primary venue for discussing them. One thing that surveys, such as the CSI/FBI Security Survey, cannot do well is to measure the impact of botnet researchers and the people who attempt to shut down botnets. It's similar to the fight against terrorism. I know that there have been 2 terrorist attacks on London since 9/11 but I don't know HOW MANY ATTACKS HAVE BEEN THWARTED. At least two have been publicised but there could be dozens more. Cleaning up botnets is rather like fighting terrorism. At the end, you have nothing to show for it. No news coverage, no big heaps of praise. Most people aren't sure there was ever a problem to begin with. That doesn't mean that the work should stop or that network providers should withold their support for cleaning up the botnet problem. ------------------------------------------------------- Michael Dillon Capacity Management, 66 Prescot St., London, E1 8HG, UK Mobile: +44 7900 823 672 Internet: michael.dillon(a)btradianz.com Phone: +44 20 7650 9493 Fax: +44 20 7650 9030 http://www.btradianz.com One Community One Connection One Focus

6 11

Re: Are botnets relevant to NANOG?
by Fergie 30 May '06

30 May '06

Not effective against botnets. Think of it this way, thousands of compromised hosts (zombies), distributed to the four corners of the Internet, hundreds (if not thousands) of AS's -- all recieving their instructions via IRC from a C&C server somewhere, that probably also may change due to dynamic DNS, or pump-and-dump domain registrations, or any other various ways to continually move the C&C. Simply going after (what may _seem_to_be_) the last-hop router is like swinging a stick after a piñata that you can't actually reach when you are blind-folded. :-) - ferg -- Peter Dambier <peter(a)peter-dambier.de> wrote: Just an afterthought, traceroute and take the final router. I guess for aDSL home users you will find some 8 or 11 routers in germany. My final router never changes. Of course there can hide more than one bad guy behind that router. [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 7