February 2010 - Test - lists.nanog.org

DNS server software
by Claudio Lapidus 23 Feb '10

23 Feb '10

Hello all, We are a mid-sized carrier (1.2M broadband subscribers) and we are looking for an upgrade in our public DNS resolver infrastructure, so we are interested in getting to know what are you guys using in your networks. Mainly what kind/brand of software and which architecture did you use to deploy it, and how did you do the sizing, all of it would be most helpful information. Many thanks in advance for your advice! cl.

6 6

Networks during disasters: coordinating locally
by Sean Donelan 23 Feb '10

23 Feb '10

http://www.computerworld.com/s/article/9160298/Commercial_networks_in_Haiti… IDG News Service - While the communications networks that aid groups set up quickly following the earthquake in Haiti were surely critical to rescue efforts, the new networks have had some negative effects on the local ISP community.

1 0

Re: Email Portability Approved by Knesset Committee
by Robert Bonomi 22 Feb '10

22 Feb '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Mon Feb 22 09:10:55 2010 > Date: Mon, 22 Feb 2010 17:09:45 +0200 > From: Gadi Evron <ge(a)linuxbox.org> > To: NANOG Operators Group <nanog(a)merit.edu> > Subject: Email Portability Approved by Knesset Committee > > The email portability bill has just been approved by the Knesset's > committee for legislation, sending it on its way for the full > legislation process of the Israeli parliament. > > While many users own a free email account, many in Israel still make use > of their ISP's email service. > > According to this proposed bill, when a client transfers to a different > ISP the email address will optionally be his to take along, "just like" > mobile providers do today with phone numbers. > > This new legislation makes little technological sense, and will > certainly be a mess to handle operationally as well as beurocratically, > but it certainly is interesting, and at least the notion is beautiful. Quick! Somebody propose a snail-mail portability bill. When a renter changes to a different landlord, his snail-mail address will be optionally his to take along, "just like" what is proposed for ISP clients. > > The proposed bill can be found here [Doc, Hebrew]: > http://my.ynet.co.il/pic/computers/22022010/mail.doc > > Linked to from this ynet (leading Israeli news site) story, here: > http://www.ynet.co.il/articles/0,7340,L-3852744,00.html > > I will update this as things evolve on my blog, here: > http://gadievron.blogspot.com/ > > Gadi. >

3 2

TWTELECOM.NET to the white courtesy phone!
by Bob Poortinga 22 Feb '10

22 Feb '10

Would someone at twtelecom.net's NOC please contact me about a routing issue we are having with you. You apparently have an internal route for one of our netblocks that is causing packets destined to us to be blackholed. TWTELECOM is an upstream of an upstream. -- Bob Poortinga K9SQL <http://www.linkedin.com/in/bobpoortinga> Technology Service Corp. <http://www.tsc.com> Bloomington, Indiana US +1-812-558-7070

1 0

Announcing xtractr (on pcapr)
by kowsik 22 Feb '10

22 Feb '10

We just released xtractr, a collaborative cloud app for indexing, searching, extracting and reporting on large pcaps. This thread on NANOG is one of the many use cases that xtractr attempts to solve: http://mailman.nanog.org/pipermail/nanog/2009-December/015661.html You can learn more about xtractr on our blog: http://bit.ly/d7yrKl or watch a demo: http://www.pcapr.net/xtractr Thanks, K. --- http://www.pcapr.net/ http://www.mudynamics.com http://twitter.com/pcapr

1 0

Spamhaus and Barracuda Networks BRBL
by Dean Drako 22 Feb '10

22 Feb '10

With respect to Barracuda Networks and Spamhaus. I expect, but I do not know, that Spamhaus probes on port 25 in order to identify Barracuda Spam and Virus Firewalls and then block their access to their RBL. Many Barracuda customers have been cut off without warning causing them trouble and pain. Barracuda attempted to find a deal that would work for licensing Spamhaus for our products, however, spamhaus's desire for money could not be met without significantly increasing the price to each of our customers. They wanted us to charge the spamhaus feed price to each of our customers. We tried to find an arrangement for a long time. I personally love the work that spamhaus has done. I was disappointed that we could not find an arrangement once they changed into a commercial entity and started charging customers. When they were providing a free service we promoted them strongly, but when they started charging the customers that really used it, we had to part ways. It is a pity. We recommend customers use only Barracuda's Free RBL: "BRBL" and this is now built into the Barracuda Spam and Virus Firewall. http://www.barracudacentral.org/rbl The BRBL is provided at no charge to anyone who wants to use it (even non barracuda customers). The BRBL has a full time staff that answers phone and email to correct any false positives and handle removal requests -- unlike competing services that charge money and who do not provide a staff. We will consider providing data feeds if anyone has interest. We currently provide the BRBL as a free service. We make no claims about it being better or worse than any other RBL. It does use a massive amount of data in order to determine which IP's should be on the list. Others have made claims about its accuracy and say great things about it. Others complain that we unjustly block them, however, 99.9% of the people who are blocked and who contact us find a BOT in their network. Sincerely, Dean Drako CEO Barracuda Networks

7 6

Assistance Required for Masters Program
by Erik Jacobsen 22 Feb '10

22 Feb '10

I am in the process of enrolling in a Masters of Information Assurance (MSIA) program and need some assistance. The program requires that we complete a case study at the end of each three month term. I have chosen to do my case studies on the Internet Service Provider industry. I worked in the industry for 5+ years, so I am pretty comfortable with the technology. I am looking for a couple of CISSP level engineers or even Information Security officers who work for an Internet service provider to act as industry contacts. The purpose of the case studies is to baseline course content against current industry practices. So, I will be producing a case study that will identify current industry practices and makes recommendations on how the industry as a whole can improve security. My work may even be published in those ubiquitous industry rags. Because security is a sensitive subject, you have the option of remaining anonymous in my reports. Thanks Erik Jacobsen

1 0

In wall switches
by Andrey Khomyakov 22 Feb '10

22 Feb '10

Hi folks, Does anyone know of anything like a small, but managed in wall switch? I have an area where the business needs to deploy more thin client kiosks than I have data drops and it's impossible to add more due to how the walls on that floor (basement) where finished. I found this little device from HP http://www.procurve.com/products/wireless/HP_ProCurve_MultiService_Access_D… under $250 a pop. Even though it's a WiFi AP, I don't care for wifi functionality of that. I just want to avoid throwing 5 port linksys's all over the floor there. Has anyone seen anything like that HP or worked with that HP at all? Can I manage it without buying the controller? Thanks, Andrey PS. You probably have seen posts from me before as Andrey Gordon. I recently changed my name to Andrey Khomyakov. Just making the connection if anyone cares. --

7 9

Chuck Norris Botnet and Broadband Routers
by Gadi Evron 22 Feb '10

22 Feb '10

Last week Czech researchers released information on a new worm which exploits CPE devices (broadband routers) by means such as default passwords, constructing a large DDoS botnet. Today this story hit international news. Original Czech: http://praguemonitor.com/2010/02/16/czech-experts-uncover-global-virus-netw… English: http://www.pcworld.com/businesscenter/article/189868/chuck_norris_botnet_ka… When I raised this issue before in 2007 on NANOG, some other vetted mailing lists and on CircleID, the consensus was that the vendors will not change their position on default settings unless "something happens", I guess this is it, but I am not optimistic on seeing activity from vendors on this now, either. CircleID story 1: http://www.circleid.com/posts/broadband_routers_botnets/ CircleID story 2: http://www.circleid.com/posts/broadband_router_insecurity/ The spread of insecure broadband modems (DSL and Cable) is extremely wide-spread, with numerous ISPs, large and small, whose entire (read significant portions of) broadband population is vulnerable. In tests Prof. Randy Vaughn and I conducted with some ISPs in 2007-8 the results have not been promising. Further, many of these devices world wide serve as infection mechanisms for the computers behind them, with hijacked DNS that points end-users to malicious web sites. On the ISPs end, much like in the early days of botnets, many service providers did not see these devices as their responsibility -- even though in many cases they are the providers of the systems, and these posed a potential DDoS threat to their networks. As a mind-set, operationally taking responsibility for devices located at the homes of end users made no sense, and therefore the stance ISPs took on this issue was understandable, if irresponsible. As we can't rely on the vendors, ISPs should step up, and at the very least ensure that devices they provide to their end users are properly set up (a significant number of iSPs already pre-configure them for support purposes). The Czech researchers have done a good job and I'd like to thank them for sharing their research with us. In this article by Robert McMillan, some details are shared in English: ---------- Discovered by Czech researchers, the botnet has been spreading by taking advantage of poorly configured routers and DSL modems, according to Jan Vykopal, the head of the network security department with Masaryk University's Institute of Computer Science in Brno, Czech Republic. The malware got the Chuck Norris moniker from a programmer's Italian comment in its source code: "in nome di Chuck Norris," which means "in the name of Chuck Norris." Norris is a U.S. actor best known for his martial arts films such as "The Way of the Dragon" and "Missing in Action." Security experts say that various types of botnets have infected millions of computers worldwide to date, but Chuck Norris is unusual in that it infects DSL modems and routers rather than PCs. It installs itself on routers and modems by guessing default administrative passwords and taking advantage of the fact that many devices are configured to allow remote access. It also exploits a known vulnerability in D-Link Systems devices, Vykopal said in an e-mail interview. A D-Link spokesman said he was not aware of the botnet, and the company did not immediately have any comment on the issue. Like an earlier router-infecting botnet called Psyb0t, Chuck Norris can infect an MIPS-based device running the Linux operating system if its administration interface has a weak username and password, he said. This MIPS/Linux combination is widely used in routers and DSL modems, but the botnet also attacks satellite TV receivers. ---------- Read more here: http://www.pcworld.com/businesscenter/article/189868/chuck_norris_botnet_ka… I will post updates on this as I discover them on my blog, under this same post, here: http://gadievron.blogspot.com/2010/02/chuck-norris-botnet-and-broadband.html Gadi.

4 4

Messages in junk/spam box
by Tarig Y. Adam 22 Feb '10

22 Feb '10

Hi Messages we send from our mail sever always received at SPAM box in many Public Mail servers like hotmail, yahoo, and gmail. We made a revers dns lookup, and there is no spamming from our server, still messages go to junk. how to solve this. thanx This message may contain confidential information from Sudanese Universities Information Network (SUIN). If you have received this message by mistake, please inform the sender by sending an e-mail reply. At the same time please delete the message and any attachments from your system without making, distributing or retaining any copies Although all our e-mails messages and any attachments upon sending are automatically virus scanned we assume no responsibility for any loss or damage arising from the receipt. Sudanese Universities Information Network (SUIN), P.O.Box 321/22, University of Khartoum, 11115, Khartoum, Sudan. www.suin.edu.sd

3 2