June 2010 - Test - lists.nanog.org

huawei-nsp
by Jared Mauch 10 Jun '10

10 Jun '10

I've created a new list on puck, huawei-nsp You can subscribe here: https://puck.nether.net/mailman/listinfo/huawei-nsp - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Re: Nato warns of strike against cyber attackers
by dlr＠bungi.com 10 Jun '10

10 Jun '10

[In the message entitled "Re: Nato warns of strike against cyber attackers" on Jun 8, 16:03, "J. Oquendo" writes:] > > All humor aside, I'm curious to know what can anyone truly do at the end > of the day if say a botnet was used to instigate a situation. Surely > someone would have to say something to the tune of "better now than > never" to implement BCP filtering on a large scale. Knobs, Levers, Dials > and Switches: Now and Then (please sir, may I have some more ?) is 7 > years old yet I wonder in practice, how many networks have 38/84 > filtering. I'm wondering why it hasn't been implemented off the shelf in > some of the newer equipment. This is not to say "huge backbones" should > have it, but think about it, if smaller networks implemented it from the > rip, the overheard wouldn't hurt that many of the bigger guys. On the > contrary, my theory is it would save them headaches in the long run... > Guess that's a pragmatic approach. Better that than an immediate > pessimistic one. > It's really way, way past time for us to actually deal with compromised computers on our networks. Abuse desks need to have the power to filter customers immediately on notification of activity. We need to have tools to help us identify compromised customers. We need to have policies that actually work to help notify the customers when they are compromised. None of this needs to be done for free. There needs to be a "security fee" charged _all_ customers, which would fund the abuse desk. With more than 100,000,000 compromised computers out there, it's really time for us to step up to the plate, and make this happen. --

20 36

Best Practices checklists
by Michael Dillon 10 Jun '10

10 Jun '10

I expect that the collected members of this list could do a good job of defining some network security practices checklists. Now that NANOG has been spun out as an independent entity, I would hate to see it become just another conference organizer. In the recent past many professions have learned how valuable a simple checklist is in preventing errors and ensuring that work adheres to a certain standard. So I am suggesting that NANOG take on the task of compiling and publishing checklists for various areas of network operations. We could have a NANOG wiki where people can publish, and work over, suggestions for checklist topics and content. Then at the conferences, a BOF-style meeting could hash out the official published versions. We could have an interesting debate on whether or not this would make a difference and whether or not NANOG should take on this role. But I hope that we are now at a point where we see that network sloppiness and insecurity are becoming such major issues that action is needed. Let's act first, and evaluate the usefulness of the work, later. --Michael Dillon

4 3

Google Issues?
by Thomas Magill 10 Jun '10

10 Jun '10

Is anyone seeing warnings today from Google that they suspect that searches are coming from an automated source and asking to complete some captcha-type authentication to complete a search? We have had a couple of reports on this and I want to make sure it isn't a google issue. I know this isn't really an operator issue but there are enough knowledgeable people here that I thought I would ask. Thomas Magill Network Engineer Office: (858) 909-3777 Cell: (858) 869-9685 mailto:tmagill@providecommerce.com <mailto:tmagill@providecommerce.com> provide-commerce 4840 Eastgate Mall San Diego, CA 92121 ProFlowers <http://www.proflowers.com/> | redENVELOPE <http://www.redenvelope.com/> | Cherry Moon Farms <http://www.cherrymoonfarms.com/> | Shari's Berries <http://www.berries.com/>

2 2

Re: Nato warns of strike against cyber attackers
by dlr＠bungi.com 10 Jun '10

10 Jun '10

[In the message entitled "Re: Nato warns of strike against cyber attackers" on Jun 8, 13:33, Owen DeLong writes:] > > I realize your fond of punishing all of us to subsidize the ignorant, = > but I would rather see those with compromised machines pay the bill for = > letting their machines get compromised than have to subsidize their = > ignorant or worse behavior. > I'm fond of getting the issues addressed by getting the ISPs to be involved with the problem. If that means users get charged "clean up" fees instead of a "security" fee, that's fine. ISPs remain in the unique position of being able to identify the customer, the machine, and to verify the traffic. It can be done. --

18 65

SCO UNIX Errors
by jacob miller 10 Jun '10

10 Jun '10

Hi, Am getting the following error from my SCO UNIX box. Any idea as to what they mean. proto: 0, age: 1274191185 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.3.12 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags :<UP,GATEWAY,HOST,DONE,PMTU,PMTUMOD> proto: 0, age: 1274191200 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.3.12 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags :<UP,GATEWAY,HOST,DONE,PMTU> proto: 0, age: 1274191204 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.10.3 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags :<UP,GATEWAY,HOST,DONE,PMTU,PMTUMOD> proto: 0, age: 1274191206 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.3.12 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags:<UP,GATEWAY,HOST,DONE,PMTU,PMTUMOD> proto: 0, age: 1274191249 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.3.12 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags:<UP,GATEWAY,HOST,DONE,PMTU> proto: 0, age: 1274191250 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.10.3 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags:<UP,GATEWAY,HOST,DONE,PMTU,PMTUMOD> proto: 0, age: 1274191264 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.3.12 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags:<UP,GATEWAY,HOST,DONE,PMTU> proto: 0, age: 1274191268 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.10.3 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags:<UP,GATEWAY,HOST,DONE,PMTU,PMTUMOD> proto: 0, age: 1274191270 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.3.12 172.16.1.254 route: got message of size 120 RTM_LOSING: Kernel Suspects Partitioning: len 120, pid: 0, seq 0, errno 0, flags:<UP,GATEWAY,HOST,DONE,PMTU> proto: 0, age: 1274191297 locks: inits: sockaddrs: <DST,GATEWAY> 172.16.10.3 172.16.1.254 Regards, Jacob

6 7

Broadband Internet Technical Advisory Group
by Marshall Eubanks 10 Jun '10

10 Jun '10

This just popped up - BITAG, the Broadband Internet Technical Advisory Group, which apparently has some Google backing. While it does not impact router configuration today, it sure does sound like they want to in the future. http://www.prnewswire.com/news-releases/initial-plans-for-broadband-interne… http://googlepublicpolicy.blogspot.com/2010/06/broadband-internet-technical… "For some time now, we’ve been advocating for the formation of a group of technical experts to put forward their best thinking on how to manage broadband networks in ways that still preserve and promote an open Internet. We’ve worked closely with Verizon and others in the Internet sector to further develop the concept, and we’re excited by today’s announcement that the Broadband Internet Technical Advisory Group , or BITAG, has begun the process of formally launching." Regards Marshall

2 1

Re: Nato warns of strike against cyber attackers
by Tim Franklin 10 Jun '10

10 Jun '10

> Checklists come in handy in fact if many were followed (BCP > checklists, appropriate industry standard fw, system rules) > the net would be a cleaner place. Sensible checklists that actually improve matters, yes. The audit checklists I've often been subjected to, full of security theatre and things that are "accepted auditor wisdom" rather than contributing to the security of the network in any meaningful way, not so much. Regards, Tim.

1 0

ISP Responsibilities [WAS: Re: Nato warns of strike against cyber attackers]
by Paul Ferguson 10 Jun '10

10 Jun '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 To cut through the noise and non-relevant discussion, let's see if we can boil this down to a couple of issues: 1. Should ISPs be responsible for abuse from within their customer base? 1a. If so, how? 2. Should hosting providers also be held responsible for customers who abuse their services in a criminal manner? 2.a If so, how? I think anyone in their right mind would agree that if a provider see criminal activity, they should take action, no? If that also holds true, then why doesn't it happen? Providers in the U.S. are the worst offenders of hosting/accommodating criminal activities by Eastern European criminals. Period. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFMDzEsq1pz9mNUZTMRAofEAKDsKxNL+5GT0ztuuqq4LpK/i3TFmACeJ4mc wfZppwxJYkvW1vS6cacuuX0= =Xs0E -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

9 11

Re: ISP Responsibilities [WAS: Re: Nato warns of strike against cyber attackers]
by Larry Sheldon 09 Jun '10

09 Jun '10

On 6/9/2010 10:58, Owen DeLong wrote: >> What happened to the acronyms "AUP" and "TOS"? >> > I'm not sure what you mean by that. I'm talking about an ISPs liability to > third party victims, not to their customers. "Acceptable Use Policy" and "Terms of Service" > > AUP/TOS are between the ISP and their customer. Very good. Does that provide an answer to the earlier question about "what is a provider to do?" when a customer misbehaves? Does that provide a method for assigning liability? I am not a lawyer, but it doesn't seem a stretch to me to include, in this context, traffic from peers and transit providers. -- Somebody should have said: A democracy is two wolves and a lamb voting on what to have for dinner. Freedom under a constitutional republic is a well armed lamb contesting the vote. Requiescas in pace o email Ex turpi causa non oritur actio Eppure si rinfresca ICBM Targeting Information: http://tinyurl.com/4sqczs http://tinyurl.com/7tp8ml

4 5