- Test - lists.nanog.org

Re: register.com down sev0?
by Fergie 27 Oct '06

27 Oct '06

I don't want to detract from the heat of this discussion, as important as it is, but it (the discussion) illustrates a point that RIPE has recognized -- and is actively perusing -- yet, ISPs on this continent seem consistently to ignore: The consistent implementation of BCP 38. It is nothing less than irresponsible, IMO... Why _is_ that? - ferg -- "Patrick W. Gilmore" <patrick(a)ianai.net> wrote: [snip] There is no single "appropriately[sic] place" which can absorb 50Mpps. If you meant "appropriately placed" (as in topologically dispersed locations), a well crafted attack could still guarantee _at least_ a partial DoS from an end user PoV. It is essentially impossible to distinguish end-user requests from (im)properly created DoS packets (especially until BCP38 is widely adopted - i.e. probably never). Since there is no single place - no 13 places - which can withstand a well crafted DoS, you are guaranteed that some users will not be able to reach any of your listed authorities. This is not speculation, this is fact. All a good provider can do, even with 1000s of server, is minimize the impact of any DoS. [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

8 8

Re: 10,352 active botnets (was Re: register.com down sev0?)
by Fergie 27 Oct '06

27 Oct '06

Jose's numbers are conservative. Given some mathematical acrobatics, I'd suggest examining some of the (shocking) number sin Microsoft's Security Intelligence Report (Google it) -- these are reflective: "Of the 4 million computers cleaned by the company's MSRT (malicious software removal tool), about 50 percent (2 million) contained at least one backdoor Trojan. While this is a high percentage, Microsoft notes that this is a decrease from the second half of 2005. During that period, the MSRT data showed that 68 percent of machines cleaned by the tool contained a backdoor Trojan." Ref: http://www.eweek.com/article2/0,1759,2036439,00.asp If you're wondering why DDoS attacks are so effective, look no further than your backyard. - ferg -- Sean Donelan <sean(a)donelan.com> wrote: On Thu, 26 Oct 2006, alex(a)pilosoft.com wrote: > Well, let's talk about "worst-case ddos". Let's say, 50mpps (I have not > heard of ddos larger that that number). Let's say, you can sink/filter > 100kpps on each box (not unreasonable on higher-end box with nsd). That > means, you should be able to filter this attack with ~500 servers, > appropriately place. Say, because you don't know where the attack will > come in, you need 4 times more the estimated number of servers, that's > 2000 servers. That's not entirely unreasonable number for a large enough > company. Botnets were the topic at today's Info Security conference in New York City. <http://www.infosecurityevent.com> Coincidences? Or just as random as your iPod shuffle? Jose Nazario estimated that there were 10,352 botnets active on the Internet earlier this year. You will probably always be outnumbered on the public Internet. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 4

Re: register.com down sev0?
by Fergie 26 Oct '06

26 Oct '06

Chris, W.R.T. #2 below: Be for real: No one ever suggested that backbone service providers attempt to ingress filter traffic -- this is an edge function. Cheers, - ferg -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: On Thu, 26 Oct 2006, Fergie wrote: > and co-authored -- and likewise, cannot figure out for life of > me, why there is such push-back from the Ops community on doing > The Right Thing. you could google answers from other folks but in shor: 1) it doesn't always work as advertised 2) people don't always tell you the routes the hold 3) equipment vendors don't alway splan properly for 'features' Not everyone is as smart as you (both) and can manage that problem as they scale... -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Re: register.com down sev0?
by Fergie 26 Oct '06

26 Oct '06

We all have our opinions, Randy. Hammers and nails being what they are... - ferg -- Randy Bush <randy(a)psg.com> wrote: > what's curious, to me atleat, is that folks equate 'botnet' and 'spoofed > source attacks' more often than I'd think is reasonable. I've not got > 'hard numbers' but almost every time the attack is determined to be > 'botnet' it's not spoofed. > > Odd... (not that I'm against bcp38, I just think the distraction in > conversation from 'bcp38 is good' to 'we must stop bots' is not helpful) bingo! when you have religion about a hammer, everything looks like a nail. randy -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: BCP38 thread 93,871,738,435 (was Re: register.com down sev0?)
by Fergie 26 Oct '06

26 Oct '06

This would appear, on its face, to be an easy exercise in educating the IPSs in the foodchain. Is there reasonable enough interest with NANOG to do that? If so, I volunteer to workshop at the next NANOG. But only if there is reasonable consensus to that effect. Or someone else could do it, too. :-) The point I'm trying to make is that if the community thinks it is valuable, then the path is clear. If not, then... - ferg -- Sean Donelan <sean(a)donelan.com> wrote: The only data I have is from the MIT anti-spoofing test project which has been pretty consistent for a long time. About 75%-80% of the nets, addressses, ASNs tests couldn't spoof, and about 20%-25% could. The geo-location maps don't show much difference between parts of the world. RIPE countries don't seem to be better or worse than ARIN countries or APNIC countries or so on. ISPs on every continent seem to be about the same. http://spoofer.csail.mit.edu/summary.php If someone finds the silver bullet that will change the remaining 25% or so of networks, I think ISPs on every continent would be interested. On Thu, 26 Oct 2006, Fergie wrote: > No. > > I think that is indicative of the problem. > > Don't you? > > -- Sean Donelan <sean(a)donelan.com> wrote: > On Thu, 26 Oct 2006, Fergie wrote: >> I don't want to detract from the heat of this discussion, as >> important as it is, but it (the discussion) illustrates a point >> that RIPE has recognized -- and is actively perusing -- yet, ISPs >> on this continent seem consistently to ignore: The consistent >> implementation of BCP 38. >> >> It is nothing less than irresponsible, IMO... >> >> Why _is_ that? > > Do you have any data concerning the actual consistent deployment of > BCP38++ in different parts of the world? -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

passports for NANOG-39, Toronto
by Robert E. Seastrom 26 Oct '06

26 Oct '06

You may have heard that the US and Canada are going to start requiring passports for air travel between them beginning "soon". That date is currently set as 8 Jan 2007, which is before February NANOG. MERIT has noted this on the web site, but a cursory check of my list archives didn't turn up mention of it (sorry if I overlooked it; the last couple of weeks have been hectic), so I figured I'd include the pointer: http://www.nanog.org/mtg-0702/passport.html as well as a link to the State Department: http://travel.state.gov/passport/passport_1738.html Normal passport processing is "within six weeks", but that probably doesn't take the holiday season into account. If you don't have a passport already and plan to travel from the US to NANOG 39 in Toronto, getting on that project sometime in the next month or so would allow plenty of spare time. No reason to pay expedite fees if you don't have to. ---Rob

3 2

Re: BCP38 thread 93,871,738,435 (was Re: register.com down sev0?)
by Fergie 26 Oct '06

26 Oct '06

Actually, I misspoke earlier, but not quite. ;-) Rob Beverly has an ongoing project which I have wholly endorsed, but it has gotten relatively little attention: http://spoofer.csail.mit.edu/ I would highly recommend that folks how choose to so, please participate. :-) - ferg p.s. Statistics available: http://spoofer.csail.mit.edu/summary.php -- Sean Donelan <sean(a)donelan.com> wrote: On Thu, 26 Oct 2006, Fergie wrote: > I don't want to detract from the heat of this discussion, as > important as it is, but it (the discussion) illustrates a point > that RIPE has recognized -- and is actively perusing -- yet, ISPs > on this continent seem consistently to ignore: The consistent > implementation of BCP 38. > > It is nothing less than irresponsible, IMO... > > Why _is_ that? Do you have any data concerning the actual consistent deployment of BCP38++ in different parts of the world? -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Need help finding CAIS SDSL equipment manual
by Ganbold Tsagaankhuu 25 Oct '06

25 Oct '06

Hi all, I'm looking for CAIS SDSL equipment manual. I know there is no more CAIS, but I really need their equipment manual/documentation. If somebody worked before for CAIS/Ardent Communicataions or somebody knows the person who worked before for CAIS/Ardent please let me know. It would be really helpful for me. I appreciate if somebody can help me in this regard. thanks in advance, Ganbold

1 0

Mzima Networks.
by Robert Sherrard 25 Oct '06

25 Oct '06

Does anyone on the list have experience as either a vendor or customer with Mzima Networks? Feel free to contact me off list if you do… Thanks in advance, Rob

1 0

Blogger.com posts still fails when posting to the NANOG list!
by Jeroen Massar 24 Oct '06

24 Oct '06

Hi, Apparently there is still some silly [f|s]oul who has to forward NANOG to blogger and blogger still doesn't handle multipart/signed and thus very nicely and totally anonymously reports that it fails. Thank you dear person who is forwarding his subscription to NANOG to his blogger account! This has been for over three months(*) now or something, clearly it is not annoying at all to the folks running the NANOG list and the person doing it clearly gets away with it. Could the blogger folks, who are seemingly uncontactable, please please please with sugar and strawbarries and whipcream on top include at least for what address this message is getting gatewayed for so that the subscription can be yanked from the NANOG list? Of course a full header trail would be even more useful. Google seems to say that this might be the one: http://www.gossamer-threads.com/lists/nanog/users/ Dear NANOG listadmins, is there anything pointing in that direction? Simple way to find out who is the culprit: spam everybody on the list with a subject of their email address and when it bounces from blogger.com check the subject in the message and then use some very huge LART tool to get rid of it. Greets, Jeroen </rant> * = http://www.merit.edu/mail.archives/nanog/msg01712.html -- Return-Path: <postgateway(a)blogger.com> X-Original-To: jeroen@purgatory Delivered-To: jeroen(a)unfix.org Received: (qmail 23472 invoked from network); 23 Oct 2006 22:45:30 -0000 Received-SPF: neutral (gurgle.mediadesign.nl: 66.102.15.83 is neither permitted nor denied by domain of postgateway(a)blogger.com) Received: from ftpout.blogger.com (HELO blogger.com) (66.102.15.83) by gurgle.mediadesign.nl (qpsmtpd/0.32) with ESMTP for jeroen(a)unfix.org; Tue, 24 Oct 2006 00:45:29 +0200 Received: by blogger.com (Postfix, from userid 99) id B67D9B1C8A; Mon, 23 Oct 2006 15:52:03 -0700 (PDT) Received: from bla17.blogger.com (localhost [127.0.0.1]) by blogger.com (Postfix) with ESMTP id A0300B1C8E for <jeroen(a)unfix.org>; Mon, 23 Oct 2006 15:52:03 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Blogger post failed From: postgateway(a)blogger.com To: jeroen(a)unfix.org Message-Id: <20061023225203.A0300B1C8E(a)blogger.com> Date: Mon, 23 Oct 2006 15:52:03 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on bla17.blogger.com X-Spam-Status: No, score=-2.6 required=5.0 tests=ALL_TRUSTED,NO_REAL_NAME autolearn=failed version=3.0.2 X-Spam-Level: X-MD-Spam-Check-By: gurgle.mediadesign.nl X-MD-Spam-Status: No, hits=3.3 required=5.0 tests=AWL,DNS_FROM_RFC_POST,NO_REAL_NAME,SPF_NEUTRAL X-MD-Spam-Level: *** X-MD-Virus-Found: No Blogger does not accept multipart/signed files. Error code: 7.552C93 Original message: From: jeroen(a)unfix.org Date: Mon, 23 Oct 2006 23:35:35 +0100 Subject: Re: Need help explaining in-addr.arpa to Limelight None

3 2