- Test - lists.nanog.org

RE: Wireless Network Question
by Frank Bulk 15 Feb '07

15 Feb '07

If you forced your customers use 802.1X for authentication they wouldn't get an IP address unless they were authorized. If 802.1X is not in the mix, another solution is to give them a very short lease (say 2 minutes) until they've completed web-based authentication, and then give them the one-hour lease. Any portal-based product for wireless hotspots can help you out here. Frank -----Original Message----- From: Frank Bulk Sent: Wednesday, February 14, 2007 5:40 PM To: nanog(a)merit.edu Subject: Wireless Network Question Hello- I'm looking for anyone that can send me some suggestions based on experience with a wireless network. My problem: It is possible with our current wireless network that a situation could arise where the IP address pool for a specific service location could be exhausted due to Windows clients acquiring an IP address without being authenticated. Thus, if we have a large event taking place in-market, the IP addresses would be assigned and reassigned out (on a one-hour lease) to each Windows client connected to the network, possibly quickly exhausting a small IP address pool if enough clients were simultaneously up and connected. Does anyone have a good suggestion on how to avoid this from happening (aside from over assigning and wasting IP addresses or ignoring the problem)? Thank you for your time MArla Azinger Frontier Communications

1 0

Re: Wireless Network Question
by Anton Kapela 14 Feb '07

14 Feb '07

Many here know I have a rather significant interest in wireless networks. In other forums I'd compose a lengthy and thorough reply, but I think this topic is pretty far "off topic" for a list of mainly network operators who don't operate wireless networks. Perhaps the MLC could comment? -Tk

1 0

Re: DNS: Definitely Not Safe?
by Scott Weeks 14 Feb '07

14 Feb '07

--- christopher.morrow(a)verizonbusiness.com wrote: From: "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> > listen your opinions. i promise not to post porn, ops, FUD material to > nanog again. no one said anything about porn... ------------------------------------------------------------- router porn? Ohh, I never thought about that. Time to go to on a web search... ;-) scott

1 0

Wireless Network Question
by Azinger, Marla 14 Feb '07

14 Feb '07

Hello- I'm looking for anyone that can send me some suggestions based on experience with a wireless network. My problem: It is possible with our current wireless network that a situation could arise where the IP address pool for a specific service location could be exhausted due to Windows clients acquiring an IP address without being authenticated. Thus, if we have a large event taking place in-market, the IP addresses would be assigned and reassigned out (on a one-hour lease) to each Windows client connected to the network, possibly quickly exhausting a small IP address pool if enough clients were simultaneously up and connected. Does anyone have a good suggestion on how to avoid this from happening (aside from over assigning and wasting IP addresses or ignoring the problem)? Thank you for your time MArla Azinger Frontier Communications

1 0

DNS: Definitely Not Safe?
by MARLON BORBA 14 Feb '07

14 Feb '07

Security of DNS servers is an issue for network operators, thus pertaining to NANOG on-topics. This article shows a security-officer view of the recent DNS attacks. "Despite well-publicized attacks on domain name servers in 2000 and 2001, evidence suggests that many companies simply have not taken the steps necessary to protect this vital part of their networks. Experts differ on just how much danger companies generally face. However, they seem to agree that, depending on the circumstances and the company, the results could include electronic attacks and unknowingly providing confidential information to competitors." -- http://www.csoonline.com/read/020107/fea_dns.html?source=nlt_csoupdate Abraços, Marlon Borba, CISSP, DataCenter Associate Técnico Judiciário - Segurança da Informação TRF 3ª Região (11) 3012-1683 -- 1997-2007 - Dez Anos da DSUP. Conhecimento Gerando Soluções. --

5 4

Re: Solaris telnet vuln solutions digest and network risks
by MARLON BORBA 14 Feb '07

14 Feb '07

I agree with Gadi. Everything which affects Internet stability (e.g. DNS denial-of-service attacks) deserves attention of network operators. IMHO it's time to think about a new NANOG AUP. If, as Gadi says, "not all of us can handle all that an ISP would care", all of us (network operators, sysadmins, CISSPs ;-)) MUST work together (with the best of everyone's experience and knowledge) to bring a cleaner, safer, faster Internet for everyone. Marlon Borba, CISSP >>> Gadi Evron <ge(a)linuxbox.org> 14/2/2007 10:09:30 >>> [...] We may not care about phishing or this or that virus here, but we do about things we need to *deal with on our networks*. By we I obviously can't mean all of us, but not all of us can handle all that an ISP would care about from a network standpoint. Some only care about BGP, others only about DNS. Yet more others only about security. What we have here is a clash of cultures with changing times. Gadi.

2 1

Time to think about a new NANOG AUP?
by michael.dillon＠bt.com 14 Feb '07

14 Feb '07

> I agree with Gadi. Everything which affects Internet > stability (e.g. DNS > denial-of-service attacks) deserves attention of network > operators. IMHO > it's time to think about a new NANOG AUP. Back in the beginning of December, I posted a message: http://www.merit.edu/mail.archives/nanog-futures/msg01600.html which points out that times have changed over the past 10 years and that we need to change to accomodate the new realities. This discussion really belongs on the nanog-futures mailing but it isn't easy to find where to subscribe that list. For the record, if you look on this page: http://www.nanog.org/email.html you can subscribe to nanog-futures and tell us what you think a new AUP would look like. --Michael Dillon

1 0

RE: Solaris telnet vuln solutions digest and network risks
by michael.dillon＠bt.com 14 Feb '07

14 Feb '07

> Subject: Re: Solaris telnet vuln solutions digest and network risks > This post appears to have been written for another mailing > list (where it is > probably on-topic). Why did you repost it to NANOG-L? Do you know of any network operators who have no Solaris boxes at all used in the management of some part of their network? Seems to me that it is very common for network operators to use Solaris boxes to manage their networks. And while they may have ACLs to prevent access from the outside world, this probably does not prevent employee access. So it is a big deal when there is an exploit that allows anyone to break into these management devices. Also, there is a subset of network operators whose business is hosting servers and these companies often use Solaris servers at least partly. Again, seems relevant to me. By the way, your posting seems to have been written for purposes which are not on-topic on this list. Why did you post it to NANOG-L? --Michael Dillon

3 2

Virtual Global Task Force Conference Invitation
by Jonathan Disher 14 Feb '07

14 Feb '07

This is from Travis Haymore of DHS/ICE Cyber Crimes Center: You are invited to attend the Virtual Global Task Force Conference being held in Washington, DC on the 21st and 22nd of February at the Renaissance Mayflower Hotel. The Virtual Global Taskforce (VGT) is made up of law enforcement agencies from around the world working together to fight child exploitation online. The aim of the VGT is to build an effective, international partnership of law enforcement agencies and Internet industry partners, to protect children from online child exploitation. Speakers: Jim Gamble - Chairman, Virtual Global Taskforce & Chief Executive of Child Exploitation and Online Protection Centre, UK Julie Myers - Assistant Secretary of Homeland Security, U.S. Immigration and Customs Enforcement (ICE) Joe Sullivan - Joe Sullivan is a recognised authority on this subject now seconded to CEOP. He is an Honorary Lecturer in Forensic Psychology at the University of Birmingham. Kevin Zuccato - Federal Agent, Australian Federal Police & Director of Australian Hi Tech Crime Centre David Gork - Director for Specialized Crime, Interpol John P. Clark - Deputy Assistant Secretary for Operations, U.S. Immigration and Customs Enforcement (ICE) Ernie Allen - President and Chief Executive Officer, National Center for Missing & Exploited Children (NCMEC) Earla-Kim McColl - National Child Exploitation Co-ordination Centre, Royal Canadian Mounted Police Maggie Eno - M'Lop Tapang ("Under the Tree") Cambodia Dr Ethel Quayle - Director, The COPINE Project, University College Cork, Ireland Interested parties should see www.vgtconference.com for registration. If you have any questions, please feel free to contract Travis directly at 703-293-8005.

3 2

Re: Every incident is an opportunity
by Robert Bonomi 13 Feb '07

13 Feb '07

> Date: Mon, 12 Feb 2007 08:05:08 GMT > From: Brandon Butterworth <brandon(a)rd.bbc.co.uk> > To: nanog(a)merit.edu > Subject: Re: Every incident is an opportunity > > > > During the cold war American kids > > > were trained to hide beneath their desktops in caseof a nuclear > > > attack. Much good that would have done. > > It could have kept them from running around the streets screaming we're > all going to die. > > It may well save people if they are on the edge of the survival zone, > that may not be a good idea but at least they know what to expect > > I don't pretend to know the real reason but keeping control is usually > better even if you can't change the outcome. There is a 'relatively small' area around ground-zero where it wouldn't make any difference what action was taken -- virtually everyone in that radius would be a 'prompt kill' causalty, regardless. 0utside the 'prompt kill' radius, there is a much larger circle where blast/concussion/over-pressure effects are the major cause of _immediate_ injury. _Most_ school-buildings in metro areas were of 'relatively' _survivable_ construction. Although there was likely to be significant damage -- flying glass from broken windows, airborne 'projectile' objects, possible minor thermal-flash triggered fires, etc. -- the buildings were not likely to suffer total collapse. 'Tornado safety' precautions -- "get underground, if you can,", and "get under something _solid_" -- are effective in minimizing immediate injuries. Many urban schools simply _did_not_ have basements. So that 'safety hatch' was not available. In the event of an imminent nuclear 'event', you just DON'T have any 'good' options. Depending on the delivery system, you may have a _maximum_ of from three (3) to 25 minutes warning. This isn't enough time to send the kids home. Assuming home provides better protection than the school building. *BIG* assumption. You don't have a basement to retreat to. You sure-as-hell don't want the kids gawking out the window, and ending up looking into the blast -- even from a range that wouldn't break windows. So, you make the 'best use' of what resources you _do_ have available. You cannot do much about preveting/reducing radiation injury. Given the situational constraints you have to work within. Blast/concussion/over-pressure is another story. When that procedure was promulgated, many classrooms had heavy wooden trestle-type desks. Getting _under_ them was some of the 'best protection available' against flying/falling 'foreign objects'. It is also a matter of experimental fact that having a _plan_ to do 'something' in event of an emergency -- 'right', 'wrong', or 'worthless' -- *IS* better than having no plans. "No plans" degenerates very quicly into 'panic', which is virtually always the 'worst possible thing'. 'Duck and cover' may not have appreciably incresed survival odds for those relatively near ground-zero, but it was (a) "better than nothing", and (b) about the "best that could be done", given the real-world constraints that did exist. BTW, I was in school (elementary/seconndary) in those days (1958-71), in a mid-sized Midwestern city. We -never- had any of those kind of drills. Apparently 'the powers that be' concluded that there was nothing in our vicinity that would be worth dropping a nuke on. :)

13 14