- Test - lists.nanog.org

st. louis open meeting agenda, nominations, registration
by Randy Bush 27 Sep '06

27 Sep '06

comments and additions to proposed agenda for st. louis are solicited o SC Report - PC and MLC appointment processes - Elections process o PC Report o MLC Report o Financial Overview (more limited than last times. read the web pages _beforehand_ if you want to discuss detail) o Charter Amendment Proposals o SC Nominees who wish to speak will have five minutes each this time we are going to try to get through the agenda with a bit more alacrity. but we don't want to throttle constructive discussion. so please get issues on the agenda now. also, please participate in the nomination process. see <http://nanog.org/elections06.html>. the following sc members' terms are expiring in october: Jared Mauch Philip Smith Randy Bush AND PLEASE REGISTER FOR THE ST. LOUIS JOINT MEETING WITH ARIN! <https://www.nanog.org/registration/> thank you. randy, for the sc

1 0

RE: decline of customer service
by Brian Johnson 26 Sep '06

26 Sep '06

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Philip Lavine > Sent: Monday, September 25, 2006 11:50 PM > To: nanog > Subject: decline of customer service > > > Times have changed, > > My experience has been recently that ISP's and ASP's have > dramatically malnourished their first level support staff > which in turn has created a resentful and lazy second teir. I > am sick of the "It must be your network/cabling/CPE" attitude > that I am getting from some teir 1 ISP's. I sick of replacing > CSU's and checking extended demarcs while some clown in the > POP is re-seating cards in the mux. > > Moreover stop accusing my network of latency issues. I ran > the packet capture 100 times and the client is still send a > FIN. The reason your application is slow is because your > programmers think sockets are something you plug a can opener into. > > Finally, YOU are my vendor. I pay you money for exceptional service. > > Thank you for your time. > Uh.... OK. Where did this come from? Did Philip have a seisure? ARE YOU OK PHILIP? :-P Brian

1 0

Re: icmp rpf
by Mark Kent 26 Sep '06

26 Sep '06

I asked: > Who among AS1239, AS701, AS3356, AS7018, AS209 does loose RPF > (not just strict RPF on single-homed customers)? and Patrick answered: >> I'm wondering why that is relevant. It's relevant because it was suggested that loose RPF should be a "best common practice" so I was curious which of those ASes decided that the benefits outweighed the negatives and actually do it. Don't worry, those were randomly chosen AS. I didn't intend to make any suggestion that the answer would be more important to me for that set of ASes than any other. But, you were correct that I wasn't asking the question I really wanted answered. What I wanted to know was, among the attentive nanog membership, which of you think and/or know that any/all of those AS do loose RPF? The motivation here is that, if asked last week, I would have guessed that none of them run loose RPF. But at least one of them does. The two answers, how many actually do plus whether everyone knew it, will help me decide if I need to spend more time reading nanog email and nanog proceedings (or actually go to a meeting), or not... Thanks, -mark

3 2

Bad cross post
by brett＠the-watsons.org 26 Sep '06

26 Sep '06

My apologies to the list for my forward post from the DA list. I was wading through nanog mail and simply not paying attention to subject tags when I replied. Completely unintentional. -b -- sent from my blackberry (typing with thumbs)

1 0

2005-02 implementation: IP assignments for anycasting DNS
by leo vegoda 26 Sep '06

26 Sep '06

Dear Colleagues, Following a request, this announcement is being sent to a few ops focused mailing lists. We are pleased to announce that we will be able to accept e-mailed requests for assignments for anycasting DNS servers from 2 October 2006. The request form and supporting notes will be available from the RIPE Document Store at: http://www.ripe.net/ripe/docs/internet-registries.html We will make a separate announcement when it is possible to make requests via the LIR Portal. Assignments for anycasting DNS will come from reserved blocks: * IPv4 Anycast Assignments (/24) from 194.0.0.0/18 * IPv6 Anycast Assignments (/48) from 2001:0678::/29 You may want to update your filters. Regards, -- leo vegoda RIPE NCC Registration Services Manager

1 0

the anti botnet market for ISPs and corporate networks
by Gadi Evron 26 Sep '06

26 Sep '06

Is here. Several companies are rehearsing their old products and buzzwording them for DDoS mitigation or botnets, but not Trend Micro. Trend Micro released a brand new product, implemented with the novel idea of utilizing DNS to detect bots on an ISP or corporate network. Whether by massive requests for a C&C (bots phoning home) or massive requests for an MX record (spam bots), looking for negative caching (NX being cached (as the C&C is not there yet but requested) and beyond. It works. I don't know if that's what Trend Micro is doing, but it's one step in the right direction to better botnet detection and mitigation. Larry Seltzer wrote a good article on it: http://www.eweek.com/article2/0,1759,2020286,00.asp This idea has been explored before: The Domain Name Service as an IDS - NANOG archives: http://www.irbs.net/internet/nanog/0602/0537.html and: http://blogs.securiteam.com/index.php/archives/321 My poor choice of subject lines with quoting the paper's name ("IDS) rather than saying "better utilizing DNS to detect infeted hosts and kill C&C's" got me a lot of flames on being off topic. It also got me a warning on DNS being off-topic, which was withdrawn on-list. The original paper can be found, here: http://staff.science.uva.nl/~delaat/snb-2005-2006/p12/report.pdf (these guys were cool enough to reference me, hehe) Other papers were linked to from the above mentioned post. This is pretty cool, and is worth a look. I guess we will find out what this commercialized technology is worth now that it is out of the home-grown/academic tools realm. Gadi.

1 0

Re: [da] news: Trend Micro launches anti-botnet service
by Fergie 26 Sep '06

26 Sep '06

First, I think that forwarding messages from a private list is something that is frowned upon. Secondly -- and speaking as a Trend employee and someone intimately involved in the ICSS/BASE project -- we don't talk/play in the BGP traffic stream. We simply reap potential target data from a BGP/Origina-AS/perfix-announce dataset, and then allow the ICSS/BASE subscribers to make polict decisions on their merit -- whether to allow their downstream hosts to reselve DNS queries to suspect hosts, or not. We do not, in any way, piss into the BGP traffic stream. :-) It's just an intelligence feed -- one of many. - ferg -- brett watson <brett(a)the-watsons.org> wrote: On Sep 25, 2006, at 9:04 PM, Jeff Kell wrote: >> >> Well, a prefix hijack either means a router has been pwned, as I >> suggested, >> or a router is (as Governor Tarkin put it) "far too trusting" of >> its peers. >> >> And anyhow, I was speaking of BGP flaps in the context of botnets >> - has anybody >> seen an in-the-wild botnet that played BGP games? > > No, but playing some BGP games could certainly help to *mitigate* > them. > Turn the C&C list into a community. I've thrown the idea around > several > times but can't get any takers... been there, tried that: http://www.mainnerve.com/security/darknet.html -b -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: [da] news: Trend Micro launches anti-botnet service
by brett watson 26 Sep '06

26 Sep '06

On Sep 25, 2006, at 9:04 PM, Jeff Kell wrote: >> >> Well, a prefix hijack either means a router has been pwned, as I >> suggested, >> or a router is (as Governor Tarkin put it) "far too trusting" of >> its peers. >> >> And anyhow, I was speaking of BGP flaps in the context of botnets >> - has anybody >> seen an in-the-wild botnet that played BGP games? > > No, but playing some BGP games could certainly help to *mitigate* > them. > Turn the C&C list into a community. I've thrown the idea around > several > times but can't get any takers... been there, tried that: http://www.mainnerve.com/security/darknet.html -b

1 0

decline of customer service
by Philip Lavine 26 Sep '06

26 Sep '06

Times have changed, My experience has been recently that ISP's and ASP's have dramatically malnourished their first level support staff which in turn has created a resentful and lazy second teir. I am sick of the "It must be your network/cabling/CPE" attitude that I am getting from some teir 1 ISP's. I sick of replacing CSU's and checking extended demarcs while some clown in the POP is re-seating cards in the mux. Moreover stop accusing my network of latency issues. I ran the packet capture 100 times and the client is still send a FIN. The reason your application is slow is because your programmers think sockets are something you plug a can opener into. Finally, YOU are my vendor. I pay you money for exceptional service. Thank you for your time.

1 0

Re: New router feature - icmp error source-interface [was: icmp rpf]
by Fergie 26 Sep '06

26 Sep '06

Chris, So, I'm wondering: What happens when you have a traceroute tool that shows you MPLS-lableled hops, too? :-) http://momo.lcs.mit.edu/traceroute/index.php The best (?) of both worls, but I digress... - ferg -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: [snip] What's interesting is that today, in many networks, the usefulness of traceeroute has bee degraded by other non-ip issues (<cough>mpls</cough>) not in ALL cases, but certainly in many you are not seeing quite what you'd expect from the traceroute :( -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2