- Test - lists.nanog.org

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> I look forward to your paper on "the end to end concept, and > why it doesn't > apply to email" ;) Clearly the answer is that it never has applied to email in the pasts. Hosts don't email each other, people do. People have always relied on Internet postmaster services to enable Internet email. Given that we have already thrown out the end-to-end concept from day one, why must we maintain such a brain-dead flat architecture. People who wanted the end-to-end concept used to use "talk" on UNIX and Windows popup messages until recently. Now, even those people have shifted to a hierarchical architecture of instant-messaging servers. > I'm not convinced there is an email architecture problem of > relevance to the > discussion. People mistake a security problem for its most > visible symptoms. There is more than one security problem here. A well-thought-out email architecture will only address one of those security problems. > The SMTP based email system has many faults, but it seems > only mildly stressed > under the onslaught of millions of hosts attempting to > subvert it. It depends where you measure that stress. The decline of Internet email mindshare in favour of IM and Web forums indicates to me that it is severely stressed at the user level. > We may need a trust system to deal with identity within the > existing email > architecture, Bingo! > but I see no reason why that need be > hierarchical, indeed > attempts to build such hierarchical systems have often failed > to gather a > critical mass, but peer to peer trust systems have worked > fine for decades > for highly sensitive types of data. Peer-to-peer is a form of hierarchy. If you decide to trust X, Y, and Z and also trust all the hosts that X, Y and Z trust, then you have a trust hierarchy carved out of the peer-to-peer space. So if I trust AOL, Earthlink and Verizon, and I also trust all those trusted by these three, then you can't talk to my mail server until you arrange trust with me, or with one of the three trusted mail systems. Fact is that the email architecture does not include any form of trust and things like Sender-ID and DKIM are only bandaids that don't solve the problem and introduce additional insecurities. Additionally, if we can introduce hierarchy into the mail flow, we also introduce points at which cost-based models of spam prevention can be tried. If you can pay a penny a message to guarantee that your mail gets delivered quickly, bypassing any spam-filtering checkpoints, then that is something that the majority of users would buy into and the money provides grease for the wheels of the system, making it worthwhile to do things like set up an email peering agreement. Let's face it, the Internet of the early 90's is gone. It won't be coming back either. The challenge now is to operate a network that is capable of being *THE* global communications infrastructure. If the public Internet doesn't adapt to this job, then other networks will leverage the IETF's technology to do so. --Michael Dillon

3 2

RE: botnets: web servers, end-systems and Vint Cerf
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> NATting firewalls don't help at all with email-delivered malware, > browser exploits, etc. If the firewall is configured to block all outgoing traffic to port 25 servers, then it helps considerably. After all outgoing email should be going to port 587. And if the system designer is creative enough, then this firewall thingy which is reputed to protect you from bad stuff, would also download and install the latest patches to protect against browser exploits. If this is all run on a separate CPU it can also do some pretty in-depth inspection and do things like block .exe attachements in email. None of this is rocket science. The hardware available today can do this. This hardware is not expensive. It does, however, require systems vendors to have a bit of imagination and that seems to be in rather short supply in the modern world. --Michael Dillon

2 1

Re: Measurement data on transit traffic in IP routers?
by Frank Coluccio 19 Feb '07

19 Feb '07

>Your statement makes something of a presumption >as to the architecture of a network. In many >networks, edge aggregation devices do not >participate in backbone routing, but simply >pass the traffic they are aggregating into the core. My first reaction, as well. However, I was reminded by Andrew Odlyzko that the cable tv industry's (MSOs') peering universe constitute a form of flattened 'edge', if one were to consider the larger Internet's core against the MSO community, which makes for another form of interesting analysis, since much of today's (especially more capacious) residential "broadband" flows begin and end on MSOs' networks, and sometimes never touch the larger core, fwiw. And this opens the door to other forms of "walled garden" environments, including intranets, some providers' CDNs, extranets, and so on. Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile On Sun Feb 18 10:54 , Andrew Lee sent: > >Hi Chris > >Your statement makes something of a presumption as to the architecture >of a network. In many networks, edge aggregation devices do not >participate in backbone routing, but simply pass the traffic they are >aggregating into the core. > >One fairly well instrumented network that does have this edge/core >collapsed model is the Internet2 network. You can find a lot of traffic >and other data for the network at: >http://noc.net.internet2.edu/i2network/live-network-status.html >You should be able to extract all the info you need from there. > >/Andrew > >Chris Develder wrote, On 2/18/07 5:46 AM: >> >> Hi All, >> >> In preparation of a course, I'm looking for reference material (paper, >> report, talk...) giving real world data on the amount of transit traffic >> (ie. not locally dropped or added, but passing through to other >> (backbone) routers) in a "typical" edge router of a core network, esp. >> ratio of local vs passthrough traffic (is it 30%, 40%...?) -- I don't >> need absolute figures, just realistic estimates of that ratio. >> >> Any help in locating such references would be highly appreciated. >> >> Kind regards, >> Chris >>

1 0

wifi for 600, alex
by Carl Karsten 19 Feb '07

19 Feb '07

Hi list, I just read over: http://www.nanog.org/mtg-0302/ppt/joel.pdf because I am on the PyCon ( http://us.pycon.org ) team and last year the hotel supplied wifi for the 600 attendees was a disaster (they probably were not expecting every single one to have and use a laptop the whole time). Joel's pdf was for a conference in 2002 or 3, so I am hoping much has changed. But from what I have found, I think my hopes may be just a dream. Does anyone have any advice or URLs of more recent case studdies in supplying wifi for 600 laptop wielding geeks? Thanks, Carl K ps, Google is one of our sponsors, and I see that they want to be the next inertube or something - maybe we can get them to do it :)

12 18

Datapipe.net
by Eric Ortega 19 Feb '07

19 Feb '07

Can someone from Datapipe.net contact me off list? Thanks, Eric Ortega Midcontinent Communications Network Engineer 605.357.5720 eric.ortega(a)midco.net -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.441 / Virus Database: 268.18.2/692 - Release Date: 2/18/2007 4:35 PM

1 0

RE: botnets: web servers, end-systems and Vint Cerf
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> > It is regularly done with servers connected to the Internet. > > There is no *COMPUTING* problem or technical problem. > > I beg to differ. Yes, it is possible for tech-savvy users to secure > their machines pretty effectively. But the level of technical > knowledge required to do so is completely out of line with, say, the > level of automotive knowledge required to safely operate an > automobile. You need, at minimum, weeks of training in order to safely operate an automobile. But to safely operate on the Internet, you simply open the box, plug the DSL cable into the DSL port of the NAT/firewall/switch/gateway box, plug the brand new unsecured computer into the Ethernet port, and you can now safely operate on the Internet. The technical problem has been solved for a long, long time. The same factors which drive down the cost of computers, have also driven down the cost of NAT/firewall devices to the point where they could actually be integrated right into the PC's hardware. > We know how -people with specialized knowledge- can secure them, not > ordinary people - and I submit that we in fact do not know how to > clean and validate compromised systems running modern > general-purpose > operating systems, that the only sane option is > re-installation of OS > and applications from scratch. This is an entirely different issue. It's like trying to cure AIDS and syphilis. Maybe prevention is an easier problem to tackle. Condoms are also fairly simple technology that works. --Michael Dillon

2 1

R Scott Perry (HopOne/Superb.net collateral damage)
by Simon Waters 19 Feb '07

19 Feb '07

Anyone have an email for him, could they drop it to me off list. He seems to have stuff hosted with that the den of spammers at HopOne Internet. On the upside it seems there is at least one genuine service amongst the address space we blocked at HopOne. But that is 1 address out of 32 class Cs we blocked. They seem to have a virulent PayPal Phish sender at 66.36.228.37 as well this week. Ho Hum Simon

1 0

remove
by Tushar Patel 19 Feb '07

19 Feb '07

2 1

Measurement data on transit traffic in IP routers?
by Chris Develder 18 Feb '07

18 Feb '07

Hi All, In preparation of a course, I'm looking for reference material (paper, report, talk...) giving real world data on the amount of transit traffic (ie. not locally dropped or added, but passing through to other (backbone) routers) in a "typical" edge router of a core network, esp. ratio of local vs passthrough traffic (is it 30%, 40%...?) -- I don't need absolute figures, just realistic estimates of that ratio. Any help in locating such references would be highly appreciated. Kind regards, Chris -- Chris Develder, PhD Ghent University - IBBT, Dept. of Information Technology (INTEC), IBCN Gaston Crommenlaan 8, bus 201 BE-9050 Gent, Belgium T: +32 9 3314961 (secr: +32 9 3314900) F: +32 9 3314899 E: chris.develder(a)intec.ugent.be

3 2

RE: botnets: web servers, end-systems and Vint Cerf
by michael.dillon＠bt.com 18 Feb '07

18 Feb '07

> >Therefore, I assert that securing systems adequately for use on the > >Internet is indeed a SOLVED PROBLEM in computing. > > A HUNDRED MILLION machines beg to differ. You misunderstand. The problem of securing machines *IS* solved. It is possible. It is regularly done with servers connected to the Internet. There is no *COMPUTING* problem or technical problem. The problem of the 100 million machines is a social or business problem. We know how they can be secured, but the solution is not being implemented. --Michael Dillon

8 7