February 2007 - Test - lists.nanog.org

Wireless Network Question
by Azinger, Marla 14 Feb '07

14 Feb '07

Hello- I'm looking for anyone that can send me some suggestions based on experience with a wireless network. My problem: It is possible with our current wireless network that a situation could arise where the IP address pool for a specific service location could be exhausted due to Windows clients acquiring an IP address without being authenticated. Thus, if we have a large event taking place in-market, the IP addresses would be assigned and reassigned out (on a one-hour lease) to each Windows client connected to the network, possibly quickly exhausting a small IP address pool if enough clients were simultaneously up and connected. Does anyone have a good suggestion on how to avoid this from happening (aside from over assigning and wasting IP addresses or ignoring the problem)? Thank you for your time MArla Azinger Frontier Communications

1 0

DNS: Definitely Not Safe?
by MARLON BORBA 14 Feb '07

14 Feb '07

Security of DNS servers is an issue for network operators, thus pertaining to NANOG on-topics. This article shows a security-officer view of the recent DNS attacks. "Despite well-publicized attacks on domain name servers in 2000 and 2001, evidence suggests that many companies simply have not taken the steps necessary to protect this vital part of their networks. Experts differ on just how much danger companies generally face. However, they seem to agree that, depending on the circumstances and the company, the results could include electronic attacks and unknowingly providing confidential information to competitors." -- http://www.csoonline.com/read/020107/fea_dns.html?source=nlt_csoupdate Abraços, Marlon Borba, CISSP, DataCenter Associate Técnico Judiciário - Segurança da Informação TRF 3ª Região (11) 3012-1683 -- 1997-2007 - Dez Anos da DSUP. Conhecimento Gerando Soluções. --

5 4

Re: Solaris telnet vuln solutions digest and network risks
by MARLON BORBA 14 Feb '07

14 Feb '07

I agree with Gadi. Everything which affects Internet stability (e.g. DNS denial-of-service attacks) deserves attention of network operators. IMHO it's time to think about a new NANOG AUP. If, as Gadi says, "not all of us can handle all that an ISP would care", all of us (network operators, sysadmins, CISSPs ;-)) MUST work together (with the best of everyone's experience and knowledge) to bring a cleaner, safer, faster Internet for everyone. Marlon Borba, CISSP >>> Gadi Evron <ge(a)linuxbox.org> 14/2/2007 10:09:30 >>> [...] We may not care about phishing or this or that virus here, but we do about things we need to *deal with on our networks*. By we I obviously can't mean all of us, but not all of us can handle all that an ISP would care about from a network standpoint. Some only care about BGP, others only about DNS. Yet more others only about security. What we have here is a clash of cultures with changing times. Gadi.

2 1

Time to think about a new NANOG AUP?
by michael.dillon＠bt.com 14 Feb '07

14 Feb '07

> I agree with Gadi. Everything which affects Internet > stability (e.g. DNS > denial-of-service attacks) deserves attention of network > operators. IMHO > it's time to think about a new NANOG AUP. Back in the beginning of December, I posted a message: http://www.merit.edu/mail.archives/nanog-futures/msg01600.html which points out that times have changed over the past 10 years and that we need to change to accomodate the new realities. This discussion really belongs on the nanog-futures mailing but it isn't easy to find where to subscribe that list. For the record, if you look on this page: http://www.nanog.org/email.html you can subscribe to nanog-futures and tell us what you think a new AUP would look like. --Michael Dillon

1 0

RE: Solaris telnet vuln solutions digest and network risks
by michael.dillon＠bt.com 14 Feb '07

14 Feb '07

> Subject: Re: Solaris telnet vuln solutions digest and network risks > This post appears to have been written for another mailing > list (where it is > probably on-topic). Why did you repost it to NANOG-L? Do you know of any network operators who have no Solaris boxes at all used in the management of some part of their network? Seems to me that it is very common for network operators to use Solaris boxes to manage their networks. And while they may have ACLs to prevent access from the outside world, this probably does not prevent employee access. So it is a big deal when there is an exploit that allows anyone to break into these management devices. Also, there is a subset of network operators whose business is hosting servers and these companies often use Solaris servers at least partly. Again, seems relevant to me. By the way, your posting seems to have been written for purposes which are not on-topic on this list. Why did you post it to NANOG-L? --Michael Dillon

3 2

Virtual Global Task Force Conference Invitation
by Jonathan Disher 14 Feb '07

14 Feb '07

This is from Travis Haymore of DHS/ICE Cyber Crimes Center: You are invited to attend the Virtual Global Task Force Conference being held in Washington, DC on the 21st and 22nd of February at the Renaissance Mayflower Hotel. The Virtual Global Taskforce (VGT) is made up of law enforcement agencies from around the world working together to fight child exploitation online. The aim of the VGT is to build an effective, international partnership of law enforcement agencies and Internet industry partners, to protect children from online child exploitation. Speakers: Jim Gamble - Chairman, Virtual Global Taskforce & Chief Executive of Child Exploitation and Online Protection Centre, UK Julie Myers - Assistant Secretary of Homeland Security, U.S. Immigration and Customs Enforcement (ICE) Joe Sullivan - Joe Sullivan is a recognised authority on this subject now seconded to CEOP. He is an Honorary Lecturer in Forensic Psychology at the University of Birmingham. Kevin Zuccato - Federal Agent, Australian Federal Police & Director of Australian Hi Tech Crime Centre David Gork - Director for Specialized Crime, Interpol John P. Clark - Deputy Assistant Secretary for Operations, U.S. Immigration and Customs Enforcement (ICE) Ernie Allen - President and Chief Executive Officer, National Center for Missing & Exploited Children (NCMEC) Earla-Kim McColl - National Child Exploitation Co-ordination Centre, Royal Canadian Mounted Police Maggie Eno - M'Lop Tapang ("Under the Tree") Cambodia Dr Ethel Quayle - Director, The COPINE Project, University College Cork, Ireland Interested parties should see www.vgtconference.com for registration. If you have any questions, please feel free to contract Travis directly at 703-293-8005.

3 2

Re: Every incident is an opportunity
by Robert Bonomi 13 Feb '07

13 Feb '07

> Date: Mon, 12 Feb 2007 08:05:08 GMT > From: Brandon Butterworth <brandon(a)rd.bbc.co.uk> > To: nanog(a)merit.edu > Subject: Re: Every incident is an opportunity > > > > During the cold war American kids > > > were trained to hide beneath their desktops in caseof a nuclear > > > attack. Much good that would have done. > > It could have kept them from running around the streets screaming we're > all going to die. > > It may well save people if they are on the edge of the survival zone, > that may not be a good idea but at least they know what to expect > > I don't pretend to know the real reason but keeping control is usually > better even if you can't change the outcome. There is a 'relatively small' area around ground-zero where it wouldn't make any difference what action was taken -- virtually everyone in that radius would be a 'prompt kill' causalty, regardless. 0utside the 'prompt kill' radius, there is a much larger circle where blast/concussion/over-pressure effects are the major cause of _immediate_ injury. _Most_ school-buildings in metro areas were of 'relatively' _survivable_ construction. Although there was likely to be significant damage -- flying glass from broken windows, airborne 'projectile' objects, possible minor thermal-flash triggered fires, etc. -- the buildings were not likely to suffer total collapse. 'Tornado safety' precautions -- "get underground, if you can,", and "get under something _solid_" -- are effective in minimizing immediate injuries. Many urban schools simply _did_not_ have basements. So that 'safety hatch' was not available. In the event of an imminent nuclear 'event', you just DON'T have any 'good' options. Depending on the delivery system, you may have a _maximum_ of from three (3) to 25 minutes warning. This isn't enough time to send the kids home. Assuming home provides better protection than the school building. *BIG* assumption. You don't have a basement to retreat to. You sure-as-hell don't want the kids gawking out the window, and ending up looking into the blast -- even from a range that wouldn't break windows. So, you make the 'best use' of what resources you _do_ have available. You cannot do much about preveting/reducing radiation injury. Given the situational constraints you have to work within. Blast/concussion/over-pressure is another story. When that procedure was promulgated, many classrooms had heavy wooden trestle-type desks. Getting _under_ them was some of the 'best protection available' against flying/falling 'foreign objects'. It is also a matter of experimental fact that having a _plan_ to do 'something' in event of an emergency -- 'right', 'wrong', or 'worthless' -- *IS* better than having no plans. "No plans" degenerates very quicly into 'panic', which is virtually always the 'worst possible thing'. 'Duck and cover' may not have appreciably incresed survival odds for those relatively near ground-zero, but it was (a) "better than nothing", and (b) about the "best that could be done", given the real-world constraints that did exist. BTW, I was in school (elementary/seconndary) in those days (1958-71), in a mid-sized Midwestern city. We -never- had any of those kind of drills. Apparently 'the powers that be' concluded that there was nothing in our vicinity that would be worth dropping a nuke on. :)

13 14

Re: death of the net predicted by deloitte -- film at 11
by Brandon Butterworth 13 Feb '07

13 Feb '07

> "So assuming router state based multicast, how do you bill on that if > the stream is exploded on the opposite end of, or in the middle of, a > transit network?" "You're likely getting it from a settlement free peer at the request of your customer who has paid for you to deliver it to them. You can choose to carry it once per customer or once for all your customer paths. Using multicast the latter means you get to keep a proportion of your extra users payment as profit instead of paying network costs" > The simplified answer of "only as the stream actually transiting the > network" won't fly with most bean counters, because in their eyes, > every packet going through the network should be billed as bandwidth > consumed. Pardon me for suggesting they get themselves a viable business model for their current traffic first. All you can eat flat rate broadband is wonderful but not compatible with this argument If heads were to be extracted from sand they may find people willing to pay for a viable multicast model, extra cash for what their customers have already paid for. End of net neutrality debate, supply something extra people want to buy. > because while > multicast saves bandwidth generally, the bandwidth multiplies as it > transits a for-pay network, meaning that more resources are consumed > and thus ... could be billed for money. Or not if we do P2P instead. "Would you like your network lightly or totally spammed?" > Traditional v4 multicast, then, is unlikely to see deployment outside > of an organiation's own garden network, and you have near zero uptake. User demand isn't going away, lots of those gardens will have multicast when they find it useful. As we agree such islands will exist it's a short step to thinking what if all this was connected together into one big network, we could call it an internet Alternatively, if they stay islands an enterprising company may decide there's value in getting access to each island and selling a one stop easy access service. Others may follow and then we're back to that internet thing. brandon

1 0

death of the net predicted by deloitte -- film at 11
by Paul Vixie 13 Feb '07

13 Feb '07

(i'm guessing kc will be on the phone soon, to get from them their data?) ... A recent report from Deloitte said 2007 could be the year the internet approaches capacity, with demand outstripping supply. It predicted bottlenecks in some of the net's backbones as the amount of data overwhelms the size of the pipes. ... http://news.bbc.co.uk/2/hi/technology/6342063.stm

19 30

Major outage in Montreal, Canada
by Vassili Tchersky 12 Feb '07

12 Feb '07

Hi, For thoses that are affected by the fiber outage that currently takes place in Montreal, I've got some clues. It could take some time to repair, as they are currently trying to localise the failure location. The SRDP (http://www.srdptele.com/) is working with the CSEM (http://www.csem.qc.ca) to fix this. UPDATE: they now know where the fibers were cut, and the SRDP is expecting the links to be up in 60-120 minutes. The outage almost isolate the datacentre Canix II from the Internet since today, 5:35PM, and Cogent (http://status.cogentco.com) was affected also. Maybe others. -- Vassili Tchersky Koumbit Network - 514-387-6262 #2

1 0