- Test - lists.nanog.org

Re: Geo location to IP mapping
by Tao Wan 16 May '06

16 May '06

Here is a tech report with a survey on geolocation and evasion techniques: http://www.scs.carleton.ca/~jamuir/papers/TR-06-05.pdf Thanks, Tao Wan http://www.scs.carleton.ca/~twan

1 0

Drone Armies C&C Report - 16 May 2006
by c2report＠isotf.org 16 May '06

16 May '06

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 3020 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 9826 reported C&Cs. Of the suspect C&Cs surveyed, 666 reported as Open, 734 reported as closed, and 587 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 4597 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 19318 AIC-81 Albany International Corp. 58 15 74 13301 UNITEDCOLO-AS Autonomous System of 54 37 31 30058 FDCSE FDCservers.net LLC 43 17 60 8972 INTERGENIA-ASN intergenia autonomou 40 23 43 3561 Savvis 34 5 85 4134 CHINANET-BACKBONE 32 13 59 30315 Everyones Internet 28 11 61 13749 EVRY Everyones Internet 28 8 71 23522 CIT-FOONET 27 14 48 4766 KIXS-AS-KR 26 4 85 30407 Velcom.com 24 20 17 33597 InfoRelay Online Systems, Inc. 23 0 100 8560 SCHLUND-AS 22 5 77 4314 IIS-64 I-55 INTERNET SERVICES 21 2 90 7132 SBC Internet Services 21 4 81 30083 Server4You Inc. 20 6 70 12832 Lycos Europe 20 0 100 174 Cogent Communications 20 14 30 27595 ATRIV Atrivo 19 2 89 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 19 0 100 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 54 37 31 8972 INTERGENIA-ASN intergenia autonomou 40 23 43 30407 Velcom.com 24 20 17 30058 FDCSE FDCservers.net LLC 43 17 60 19318 AIC-81 Albany International Corp. 58 15 74 174 Cogent Communications 20 14 30 23522 CIT-FOONET 27 14 48 4134 CHINANET-BACKBONE 32 13 59 29073 COLINKS-AS Colinks web and game hos 15 12 20 19166 Alpha Red, INC 16 12 25 30315 Everyones Internet 28 11 61 7018 AT&T WorldNet Services 14 9 36 4713 OCN NTT Communications Corporation 15 9 40 9911 CONNECTPLUS-AP Singapore Telecom 13 8 38 3462 HINET 19 8 58 9121 TTNet 10 8 20 13749 EVRY Everyones Internet 28 8 71 16265 LEASEWEB AS 13 7 46 32748 NOZON NoZone 13 7 46 12322 PROXAD AS for Proxad ISP 7 7 0 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

About Cisco NM-2FE2W-v2
by Md. kamal Hossain 16 May '06

16 May '06

Hi all I purchase a Cisco-2851 and NM-2FE2W-v2 module because i need 4 Fastethernet interface but when i plug the module IOS don't detect the module.Is there any specific IOS for the NM-2FE2W-v2 module?.now IOS version is 12.3.If any one have any idea pls reply me. thanks Kamal -- This message has been scanned for viruses and dangerous content, and is believed to be clean.

1 0

Re: Geo location to IP mapping
by Edward B. DREGER 16 May '06

16 May '06

AH> Date: Mon, 15 May 2006 23:24:13 +0100 AH> From: Alexander Harrowell AH> [W]hen the path is [...] it won't be quite that clear. Exactly. It's a bit different than triangulating cell towers based on signal strength. Since when does the NSA patent things, anyhow? I'd think they would keep secret anything that's actually effective. Eddy -- Everquick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita ________________________________________________________________________ DO NOT send mail to the following addresses: davidc(a)brics.com -*- jfconmaapaq(a)intc.net -*- sam(a)everquick.net Sending mail to spambait addresses is a great way to get blocked. Ditto for broken OOO autoresponders and foolish AV software backscatter.

2 1

Re: Geo location to IP mapping
by Alain Hebert 15 May '06

15 May '06

Yeap, I'm moron. You didn't know it yet? ----- Come on... "The way we disperse static IP" ain't imagination, its fact... We spread a /20 on dynamic dialup and dsl over 2 provinces and since most of the residential services is build like this you cannot get a read of where that ip user is located, unless you have also access to our customers db and authentication account db too. The best you'll get is country. Even then we have some that are LanEx'ed in europe and usa. (FYI: English is not my first language btw... so dont expect too much) David Schwartz wrote: >> I'm sure that everybodies here understand that the city databases >>cannot be accurate more than 50%. >> >> > > They *cannot* be? > > > >> The way we disperse static IP on commercial accounts there is not >>way they can figure out where the destination is. >> >> The last best guest will be the peer router before my routers. >> >> For me the country db is good enought for basic webalizer report for >>the customers websites. >> (This way my customers dont waste queries to countries.nerd.dk on >>non-spam related things) >> >> > > This is a pure argument from lack of imagine. They most certainly can be. > > Hypothetically, consider a company that had access to sales and account >databases from sites like eBay, Amazon, and the like. It extracts from this >database IP/city pairs. From this, it could do much better than 50%. > > You are basing your conclusions on your own lack of imagination. > > DS > > > > -- Alain Hebert ahebert(a)pubnix.net PubNIX Inc. P.O. Box 175 Beaconsfield, Quebec H9W 5T7 tel 514-990-5911 http://www.pubnix.net fax 514-990-9443

4 4

Re: Geo location to IP mapping
by Robert Bonomi 15 May '06

15 May '06

> From owner-nanog(a)merit.edu Mon May 15 17:42:13 2006 > From: Kevin Day <toasty(a)dragondata.com> > Subject: Re: Geo location to IP mapping > Date: Mon, 15 May 2006 17:40:23 -0500 > > We use a Geo/IP location database. It's surprisingly accurate, with a > few exceptions. > [[ sneck ]] > > Comparing the database to the IP that our customers used to make > purchases we exceed 95% accuracy in identifying the country, and > 75-85% in city/state. The big exception is AOL, since their IP > assignments are pretty well randomized with respect to geography. *dynamically* randomized, no less, or so I've been told. As in: _all_ the customer session addresses are assigned out of *one* DHCP pool. I thought that 'unlikely', considering the mayhem on internal routing tables, but the AOL rep was rather insistant that that _was_ the case. They also have 'virtual' POPs, where they just backhaul ('tens if not hundreds' of miles, in same cases) voice, rather than having any physical equipment present.

1 0

Re: MEDIA: ICANN rejects .xxx domain
by Robert Bonomi 15 May '06

15 May '06

> From owner-nanog(a)merit.edu Thu May 11 12:41:20 2006 > Date: Thu, 11 May 2006 13:40:22 -0400 > From: Alain Hebert <ahebert(a)pubnix.net> > To: nanog(a)nanog.org > Subject: Re: MEDIA: ICANN rejects .xxx domain > > > ---------- Forwarded message ---------- > > Date: Thu, 11 May 2006 08:46:40 -0400 > > From: David Farber <dave(a)farber.net> > > To: ip(a)v2.listbox.com > > Subject: [IP] ICANN rejects .xxx domain > > > > Begin forwarded message: > > > > As reported in: > > > > http://abcnews.go.com/Business/print?id=1947950 > > > > ICANN has reversed their earlier preliminary approval, and has now > > rejected the "dot-xxx" adult materials top-level domain. I applaud > > this wise decision by ICANN, which should simultaneously please both > > anti-porn and free speech proponents, where opposition to the TLD > > has been intense, though for totally disparate reasons. > > > > Nick's AP piece referenced above notes that there are still > > Congressional efforts to mandate such a TLD. It is important > > to work toward ensuring that these do not gain traction. > > Why? > > If we can coral them in it and legislate to have no porn anywhere > else than on .xxx ... should fix the issue for the prudes out there. And _that_ is *precisely* "why not". <grin> When you figure out _how_ to accomplish the 'and' part of your statement, *world-wide*, and _how_long_ it would take to do so, *AND*CAN*GET*UNIVERSAL* *AGREEMENT* about what has to be inside the coral(sic), well, then, and -only- then can one consider 'what _useful_ purpose' such a TLD would serve. Note also: attempting to impose additional restrictions on _existant_, registered domains would likely constitute breach of contract. With big liabilities attached -- look at what the hijacking of 'sex.com' ended up costing the registrar that let it happen. Restricting future domain registrations _in_an_exsiting_TLD_ raises a separate can of worms, regarding existing registry operator and registrar contracts.

3 2

Why ICANN did the Right Thing [Was: Re: MEDIA: ICANN rejects .xxx doma in]
by Fergie 13 May '06

13 May '06

Without going into baseless arguments and innuendo, I would suggest that folks ponder the editorial over on OUT-LAW.com which has very thougtful overview of why ICANN did the Right Thing (tm) in this case: http://www.out-law.com/default.aspx?page=6914 I tend to agree with them. Cheers, - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

S-BGP Research Survey
by Paul Main 13 May '06

13 May '06

Greetings, We are two graduate students at the University of California at Irvine. My partner and I are conducting a research project on Secure BGP for our Advanced Networks course. In particular, we want to know how willing organizations are to implement Secure BGP. We have created a survey about Secure BGP. If you have time, we invite you to take part in this survey. It is only 10 multiple choice questions long, and it should take about 2 minutes. The survey does not require a great deal knowledge about Secure BGP, so all are welcome. The survey is completely anonymous, and your identity is not recorded in any way (email, IP address). The URL for the survey is: http://eee.uci.edu/survey/sbgp We thank you for your time. -Paul Main and Paul DiGioia

1 0

Re: MEDIA: ICANN rejects .xxx domain
by Robert Bonomi 12 May '06

12 May '06

> From: Barry Shein <bzs(a)world.std.com> > Date: Fri, 12 May 2006 15:45:46 -0400 > Subject: Re: MEDIA: ICANN rejects .xxx domain > > On May 12, 2006 at 14:51 tv(a)pobox.com (Todd Vierling) wrote: > > The complexity added by TLDs has one extremely critical good side > > effect: distribution of load by explicitly avoiding a flat entity > > namespace. The DNS has a hierarchical namespace for a reason, and > > arguments to the contrary will convince on the order of sqrt(-1) > > people. > > As if you couldn't just hash on whatever the last component is and > pick a server on that basis? Query(server[Sum(bytes) mod Nservers])? That's right, you =couldn't=. In the first case, *WHO* runs that server? What if you are the -only- hit in that hash bucket? What do you do if *nobody* is running a server for that hash bucket when you want to register a name that hashes into it? The current DNS architecture has a 1:1 correspondence with 'levels', 'zones', zone administrators, and administrative authority. Every 'TLD' has its own, *independant*, administrative policies. Some of them have 'structured' second levels, (e.g. .uk., .tw., .jp) others *don't* (e.g. .no, .fr, .ca, .ch). If you just eliminate the top level, then *which* ("in the end, there can only be one") of the various '.com.{CC}" registrars gets to control the 'new' ".com", and what happens to the registrations in all the _other_ '.com.{CC}" 2nd-levels that are now disenfranchised? If you eliminate all the 'structured' name elements, you have a 'mell of a hess' of name collisions to deal have to resolve. *who* gets to use 'McDonalds', for example. the American hamburger chain, or the Scots Clan? Who gets to use "yellowpages"? (anybody remember why Sun had to change the name of their network directory service?) who gets "shaw", 'shaw.ca', or 'shaw.com'? They're *not* the same company. :) > There are probably good answers to people's suggestions for change but > working backwards from "that's the way we've always done it" with > trailing remarks intended to stifle a response isn't, to my mind, an > answer. It is 'unworkable'. because there's a *whole*lot* more to it than just the technical matter of 'serving' DNS records. And any proposal that views things from _that_ standpoint only, is, by *definition*, defective. > The best answer I can think of off-hand is that dropping .com etc > wouldn't add much, if anything. Any savings in typing would be off-set > by having to generate non-colliding names which would've been .com and > .org, etc. It would just be creating a new TLD, the null TLD moving > collision avoidance left by one. It also eliminates one layer in the 'distribution' of load. resulting in a several (decimal) order-of-magnitude concentration of (a) data, and (b) queries, to the top-level servers. The effect of 'b' can be ameliorated by deploying that same several-orders-of magnitude number of additional root servers. the increase in the size of the 'local' database is a whole different issue -- *and* the fact that is is being more-or-less constantly updated; *unlike* the 'root' zone, where the TLDs are fairly static. An argument could be made for splitting '.com' into, say '.com01' through '.com64', by arbitrarily re-assigning all the existing .com's into random members of the new set. *AND* prohibiting any 'party' from owning/controlling the 'same' second-level name in more than one of those TLDs. Continue to allow 'challenges' to a registration, based on trademark, etc. but "deactivate" the 'infringing' registration, rather than 'turn it over to the other party'. This allows for multiple parties who _have_ rights to the same name to all use the same '2nd level' element w/o conflict. A better argument can be made for eliminating almost all of the 'generic' TLDs. '.int' (or an equivalent) needs to be kept around for organizations that are _not_ under the jurisdication of any national government. The other 'classic' generics (.mil, .gov, .net, .com, and .org) could be folded into '.us' as structured 2nd-level names, as is done in many other national TLDs. Note: this proposal _also_ defuses the issue of having ICANN establish UDRP. Since the all the names conflicts now occur under a single body of law, already-established court procedure in *each* jurisdiction can be used to resolve issues in _that_ jurisdiction. "Bye-bye" to the cross-border conflicts/issues on *that* matter. *IF* one is going to have 'generic' TLDs, I'd suggest they should be reserved for major multi-national operations. e.g. the '.net' TLD reserved for network operators with 'physical presense' in at least (say) 25 countries, a .net.{CC} domain in each of those countries, _and_ 'direct' allocation of an IP address block for each of those 'national' operations. > > As to .XXX: > > To my mind the real camel's nose in the tent is that to create it > would seem to urge or at least validate its enforcement and coercive > means would necessarily arise (civil lawsuits, criminal charges, > regulatory apparatus.) *ABSENT* a prohibition on such 'content' under other TLDs, there is nothing to enforce. It was proposed as a place where porn operators _can_ register, not where they _must_ register. *WITHOUT* even getting into the differences in 'definiton' for what would have to be so registered, depending on geography. What do you do with stuff that is _legally_ displayed in public, and openly sold, in Denmark, that mere possession of would get you arrested in the U.S.A.? > Otherwise of what use would it be, in terms of the conceptions of its > champions as opposed to unintended consequences? The champions "think": 1) that all the purveyors of such would _voluntarily_ choose to register there, because, by having a 'place' where such stuff is 'officially sanctioned', they won't get hassled for having/selling such stuff. 2) that those who want to block access to such stuff would have a very simple and effective means of doing so. > The deeper problem is the conception by many (unwashed) that someone > must be in charge, Yeah, it's a misconception, but can you point to _anything_else_ of a man-made nature where there is nobody that is in charge, nor ultimately responsible for it? What we have here is an 'act of man' that is on a par with an 'act of nature', or alternatively, an 'act of God'. It's not really suprising that the 'unwashed' don't 'get it' -- it just may qualify for the term 'unique' in that respect. Whether this uniqueness is a 'good thing', and how long it can survive, remain to be seen. > we used to get calls asking for contact info for > the Internet complaint dept, and they didn't mean us. People were > often shocked to hear that we had no answer. I'm glad _I_ didn't get any of those calls -- it would have been *VERY* *DIFFICULT* to resist giving out Al "I was instrumental in the founding of the Internet" Gore's name and number. If he wants the credit, he gets the blame, too! :) > > And widespread conceptions like that have a way of materializing, sans > some force of resistance. > > I suppose some may say it's 10 years too late for that comment. > > -- > -Barry Shein > > The World | bzs(a)TheWorld.com | http://www.TheWorld.com > Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide > Software Tool & Die | Public Access Internet | SINCE 1989 *oo* > > From owner-nanog(a)merit.edu Fri May 12 14:51:36 2006 > From: Barry Shein <bzs(a)world.std.com> > Date: Fri, 12 May 2006 15:45:46 -0400 > To: "Todd Vierling" <tv(a)pobox.com> > Cc: "Jim Popovitch" <jimpop(a)yahoo.com>, nanog(a)nanog.org > Subject: Re: MEDIA: ICANN rejects .xxx domain > > > > On May 12, 2006 at 14:51 tv(a)pobox.com (Todd Vierling) wrote: > > The complexity added by TLDs has one extremely critical good side > > effect: distribution of load by explicitly avoiding a flat entity > > namespace. The DNS has a hierarchical namespace for a reason, and > > arguments to the contrary will convince on the order of sqrt(-1) > > people. > > As if you couldn't just hash on whatever the last component is and > pick a server on that basis? Query(server[Sum(bytes) mod Nservers])? > > There are probably good answers to people's suggestions for change but > working backwards from "that's the way we've always done it" with > trailing remarks intended to stifle a response isn't, to my mind, an > answer. > > The best answer I can think of off-hand is that dropping .com etc > wouldn't add much, if anything. Any savings in typing would be off-set > by having to generate non-colliding names which would've been .com and > .org, etc. It would just be creating a new TLD, the null TLD moving > collision avoidance left by one. > > As to .XXX: > > To my mind the real camel's nose in the tent is that to create it > would seem to urge or at least validate its enforcement and coercive > means would necessarily arise (civil lawsuits, criminal charges, > regulatory apparatus.) > > Otherwise of what use would it be, in terms of the conceptions of its > champions as opposed to unintended consequences? > > The deeper problem is the conception by many (unwashed) that someone > must be in charge, we used to get calls asking for contact info for > the Internet complaint dept, and they didn't mean us. People were > often shocked to hear that we had no answer. > > And widespread conceptions like that have a way of materializing, sans > some force of resistance. > > I suppose some may say it's 10 years too late for that comment. > > -- > -Barry Shein > > The World | bzs(a)TheWorld.com | http://www.TheWorld.com > Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide > Software Tool & Die | Public Access Internet | SINCE 1989 *oo* >

2 1