- Test - lists.nanog.org

RE: Is my router owned? How would I know?
by Barry Greene (bgreene) 14 Jan '06

14 Jan '06

Here are some other new things (Cisco IOS specific): Login Security Enhancements. The Cisco IOS Login Enhancements feature allows users to better secure their Cisco IOS devices when creating a virtual connection, such as Telnet, secure shell (SSH), or HTTP. Thus, users can help slow down dictionary attacks and help protect their router from a possible denial-of-service (DoS) attack. http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_ guide09186a00801d1cb3.html Configuration Change Notification and Logging. Releases of Cisco IOS software prior to 12.3(4)T/12.2(25)S lack the ability to track the origin of changes to the running configuration. The only way to determine if a Cisco IOS software configuration has been changed is to pull the running and startup configurations offline and do a line-by-line comparison. This comparison will identify all the changes that have occurred between the two configurations, but it will not specify the sequence in which the changes occurred or the person responsible for the changes. The Configuration Change Notification and Logging (Configuration Logging) feature allows the tracking of configuration changes entered on a per-session and per-user basis by implementing a configuration log. The configuration log will track each configuration command that is applied, who applied the command, the parser return code for that command, and the time that the command was applied. This feature also adds a notification mechanism that sends asynchronous notifications to registered applications whenever the configuration log changes. http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_ guide09186a00801d1e81.html And then there is 'security passwords min-length'. If you set this to 6 more more, it would knock out 'cisco' as a possible password on the router. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Rob Thomas > Sent: Thursday, January 12, 2006 10:19 AM > To: NANOG > Subject: Is my router owned? How would I know? > > > Hi, NANOGers. > > You all know how I love a good segue... ;) > > How can you tell if your router has been owned? In general > the configuration will be modified. This is why we advocate > using rancid (or something akin to it) as both a > configuration backup tool AND an early warning tool. If you > have a router running BGP, it also pays to peer with it > externally. You can use a private ASN and rackspace with a > buddy. You can use this peering to detect announcements you > don't expect or necessarily condone. > > How else can you tell? Here are some tips: > > If there is a new user account, or if the enable and access > passwords have changed, look out! The miscreants love to > scan and find routers with "cisco" as the access and enable > passwords. They know that other miscreants are doing the > same thing. In fact this is even more widespread thanks to a > module found in rBot and rxBot. Yes, even bots are scanning > for routers now. > > If there are new or changed ACLs, look out! The miscreants > love to use routers as IRC bounces. To avoid detection by > IRC server proxy monitors, the miscreants will block access > to the router (generally all access, sometimes just TCP 23) > from those proxy monitors using ACLs. > > If there are new or changed SNMP RW community strings, look out! > One of the tricks they employ is to leave a SNMP RW community > backdoor. Is this to avoid the actions of we good folk? No, > it's usually employed in the case where a compromised router > is stolen from one miscreant by another. > > If the banner has changed, look out! As with the ACLs, this > is a method by which the miscreants attempt to fool any proxy > monitors. > The most common banner we see identifies the router as a FreeBSD box. > > If tunnels suddenly appear on the router, look out! Chaining > together lots of routers is also common now. This provides > obfuscation and sometimes encryption. > > Most of the changes are based on templates. Consider this > bundled clue, where the prowess of the template user isn't at > all a factor. > > Use the flows. :) > > Thanks, > Rob. > -- > Rob Thomas > Team Cymru > http://www.cymru.com/ > ASSERT(coffee != empty); >

4 3

RE: Odd policy question.
by Drew Weaver 13 Jan '06

13 Jan '06

in named.conf zone "2.96.192.in-addr.arpa" { type master; file "primary/bogus.ia"; }; in the zone file * PTR some.schmuck.lame.delegated.to.RAIN.PSG.COM. or zone "someschmuck.com" { type master; file "primary/bogus.fwd"; }; and @ MX 0 some.schmuck.lame.delegated.to.RAIN.PSG.COM. * MX 0 some.schmuck.lame.delegated.to.RAIN.PSG.COM. # Sorry, we don't actually host this guy's domain or what not, I meant he leased like co-lo or a dedicated server from us in which he hosted his own DNS server and then he left, leaving his nameserver records pointing at our IP addresses. Anyway this one got away from me so I'll leave it at that (once I start seeing goatse.cx in the replies I just step away slowly from the thread. -Drew

1 0

Weekly Routing Table Report
by Routing Table Analysis 13 Jan '06

13 Jan '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 14 Jan, 2006 Analysis Summary ---------------- BGP routing table entries examined: 178241 Prefixes after maximum aggregation: 100088 Unique aggregates announced to Internet: 86613 Total ASes present in the Internet Routing Table: 21314 Origin-only ASes present in the Internet Routing Table: 18535 Origin ASes announcing only one prefix: 8793 Transit ASes present in the Internet Routing Table: 2779 Transit-only ASes present in the Internet Routing Table: 70 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 25 Prefixes from unregistered ASNs in the Routing Table: 6 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1479800576 Equivalent to 88 /8s, 51 /16s and 247 /24s Percentage of available address space announced: 39.9 Percentage of allocated address space announced: 58.9 Percentage of available address space allocated: 67.8 Total number of prefixes smaller than registry allocations: 86075 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 37421 Total APNIC prefixes after maximum aggregation: 15858 Prefixes being announced from the APNIC address blocks: 35204 Unique aggregates announced from the APNIC address blocks: 17260 APNIC Region origin ASes present in the Internet Routing Table: 2459 APNIC Region origin ASes announcing only one prefix: 695 APNIC Region transit ASes present in the Internet Routing Table: 380 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 17 Number of APNIC addresses announced to Internet: 210417088 Equivalent to 12 /8s, 138 /16s and 181 /24s Percentage of available APNIC address space announced: 65.8 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 93767 Total ARIN prefixes after maximum aggregation: 56293 Prefixes being announced from the ARIN address blocks: 73107 Unique aggregates announced from the ARIN address blocks: 28060 ARIN Region origin ASes present in the Internet Routing Table: 10429 ARIN Region origin ASes announcing only one prefix: 3880 ARIN Region transit ASes present in the Internet Routing Table: 964 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 282273280 Equivalent to 16 /8s, 211 /16s and 38 /24s Percentage of available ARIN address space announced: 70.1 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 35082 Total RIPE prefixes after maximum aggregation: 23659 Prefixes being announced from the RIPE address blocks: 32064 Unique aggregates announced from the RIPE address blocks: 21437 RIPE Region origin ASes present in the Internet Routing Table: 7550 RIPE Region origin ASes announcing only one prefix: 3961 RIPE Region transit ASes present in the Internet Routing Table: 1246 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 25 Number of RIPE addresses announced to Internet: 229596032 Equivalent to 13 /8s, 175 /16s and 91 /24s Percentage of available RIPE address space announced: 68.4 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 10127 Total LACNIC prefixes after maximum aggregation: 3418 Prefixes being announced from the LACNIC address blocks: 8320 Unique aggregates announced from the LACNIC address blocks: 4826 LACNIC Region origin ASes present in the Internet Routing Table: 662 LACNIC Region origin ASes announcing only one prefix: 213 LACNIC Region transit ASes present in the Internet Routing Table: 124 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 22 Number of LACNIC addresses announced to Internet: 23623168 Equivalent to 1 /8s, 104 /16s and 118 /24s Percentage of available LACNIC address space announced: 35.2 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1838 Total AfriNIC prefixes after maximum aggregation: 860 Prefixes being announced from the AfriNIC address blocks: 1197 Unique aggregates announced from the AfriNIC address blocks: 843 AfriNIC Region origin ASes present in the Internet Routing Table: 143 AfriNIC Region origin ASes announcing only one prefix: 44 AfriNIC Region transit ASes present in the Internet Routing Table: 25 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2972672 Equivalent to 0 /8s, 45 /16s and 92 /24s Percentage of available AfriNIC address space announced: 8.9 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 995 6450 206 CHINANET-BACKBONE 9583 837 109 14 Sify Limited 4755 777 258 63 Videsh Sanchar Nigam Ltd. Aut 4766 717 3929 300 Korea Telecom (KIX) 1221 665 1364 471 Telstra Pty Ltd 7545 514 108 70 TPG Internet Pty Ltd 9498 495 211 68 BHARTI BT INTERNET LTD. 17676 477 6901 102 Softbank BB Corp. 17488 436 26 9 Hathway IP Over Cable Interne 9443 399 89 85 Primus Telecommunications 4802 356 74 160 Wantree Development 2907 338 1763 315 SINET Japan 9929 332 217 50 China Netcom Corp. 7474 329 227 227 SingTel Optus Pty Ltd 18101 326 68 23 Reliance Infocom Ltd Internet 17974 310 73 36 PT TELEKOMUNIKASI INDONESIA 17557 306 24 160 Pakistan Telecom 4780 283 226 16 Digital United Inc. 9837 271 78 169 Powertel Ltd 9800 256 410 67 CHINA UNICOM ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1471 6297 959 AT&T WorldNet Services 4323 1202 723 235 Time Warner Telecom 174 1042 5825 959 Cogent Communications 721 1031 21938 308 DLA Systems Automation Center 6197 970 435 505 BellSouth Network Solutions, 701 969 8099 812 UUNET Technologies, Inc. 18566 891 272 8 Covad Communications 2386 876 500 684 AT&T Data Communications Serv 1239 850 2805 606 Sprint 209 661 3606 529 Qwest 20115 657 537 339 Charter Communications 11492 642 89 12 Cable One 22773 606 1478 33 Cox Communications, Inc. 19262 596 1719 146 Verizon Global Networks 852 570 1092 379 Telus Advanced Communications 855 563 243 65 Canadian Research Network 19916 563 49 54 OLM LLC 6478 528 1454 291 AT&T Worldnet Services 3602 522 127 106 Sprint Canada, Inc. 3356 518 10601 398 Level 3 Communications, LLC RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 587 1953 465 UUNET - Commercial IP service 3352 303 1500 34 Ibernet, Internet Access Netw 3301 302 1071 288 TeliaNet Sweden 3320 285 3485 239 Deutsche Telekom AG 8220 274 474 268 COLT Telecommunications 680 244 2024 238 DFN-IP service G-WiN 3246 227 487 217 Song Networks 8708 221 274 205 Romania Data Systems S.A. 6746 211 52 183 Dynamic Network Technologies, 1257 189 712 169 SWIPnet Swedish IP Network 3269 185 1925 70 TELECOM ITALIA 5515 180 840 127 Sonera Solution Autonomous Sy 786 173 1794 173 The JANET IP Service 8866 173 37 11 Bulgarian Telecommunication C 5400 168 328 137 BT Ignite European Backbone 24863 166 38 9 LINKdotNET AS number 3215 163 1326 82 France Telecom Transpac 6830 162 669 33 UPC Distribution Services 3300 159 169 90 AUCS Communications Services 12479 157 322 5 Uni2 Autonomous System LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 545 808 211 UniNet S.A. de C.V. 22047 380 141 43 VTR PUNTO NET S.A. 16814 295 18 7 NSS, S.A. 11172 294 109 76 Servicios Alestra S.A de C.V 14117 184 11 6 Telefonica del Sur S.A. 13999 175 52 9 Mega Cable S.A. de C.V. 7303 153 73 18 Telecom Argentina Stet-France 6147 150 118 21 Telefonica Del Peru 11556 130 64 3 Cable-Wireless Panama 19169 123 8 30 Telconet 10481 121 48 8 Prima S.A. 6503 115 148 76 AVANTEL, S.A. 21826 113 14 19 INTERCABLE 5639 112 12 9 Telecommunications Services o 6505 107 88 80 Global One Communicaoes Ltda 11311 101 8 14 Sinectis S.A. 18822 99 8 10 TELEFONICA MANQUEHUE 7315 96 6 3 Grupo Rey Moreno 14522 95 12 8 SatNet S.A. 4270 93 17 9 Red de Interconexion Universi AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 273 812 230 The Internet Solution 8452 142 60 7 TEDATA 5536 122 8 16 Internet Egypt Network 2018 117 298 103 Tertiary Education Network 15475 101 84 4 Nile Online 2905 74 155 67 The Internetworking Company o 6713 71 71 10 Itissalat Al-MAGHRIB 24835 67 34 6 RAYA Telecom - Egypt 20928 61 16 2 Noor Advanced Technologies AS 5713 39 167 35 Telkom SA Ltd 33774 35 5 26 AS Number for Telecom Algeria 15706 31 8 3 Sudatel Internet Exchange Aut 23889 25 7 10 MAURITIUS TELECOM 8524 23 1 4 AUCEGYPT Autonomous System 10798 22 1 13 Standard Bank of South Africa 16637 22 10 20 Johnnic e-Ventures 21280 22 4 4 Swift Global Kenya Ltd.Is an 12455 18 6 5 Jambonet Autonomous system 12258 17 3 11 Vodacom Internet Company 15808 17 2 2 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1202 967 Time Warner Telecom 18566 891 883 Covad Communications 9583 837 823 Sify Limited 4134 995 789 CHINANET-BACKBONE 721 1031 723 DLA Systems Automation Center 4755 777 714 Videsh Sanchar Nigam Ltd. Aut 11492 642 630 Cable One 22773 606 573 Cox Communications, Inc. 19916 563 509 OLM LLC 855 563 498 Canadian Research Network 5668 514 490 CenturyTel Internet Holdings, 6197 970 465 BellSouth Network Solutions, 19262 596 450 Verizon Global Networks 7545 514 444 TPG Internet Pty Ltd 9498 495 427 BHARTI BT INTERNET LTD. 17488 436 427 Hathway IP Over Cable Interne 4766 717 417 Korea Telecom (KIX) 3602 522 416 Sprint Canada, Inc. 17676 477 375 Softbank BB Corp. 6467 399 353 E.Spire Communications, Inc. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 38976 UNALLOCATED 62.192.224.0/19 21166 Satgate autonomous s 38976 UNALLOCATED 62.192.232.0/24 21166 Satgate autonomous s 38972 UNALLOCATED 80.251.144.0/21 6828 Ekaterinburg Telegra 38972 UNALLOCATED 80.251.151.0/24 6828 Ekaterinburg Telegra 38972 UNALLOCATED 80.251.152.0/23 6828 Ekaterinburg Telegra 29544 UNALLOCATED 82.151.64.0/19 12956 Telefonica Data Auto Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:5 /10:8 /11:20 /12:87 /13:196 /14:346 /15:677 /16:8640 /17:2950 /18:4967 /19:11193 /20:12345 /21:10557 /22:13631 /23:14839 /24:96822 /25:306 /26:250 /27:199 /28:63 /29:26 /30:54 /31:3 /32:39 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 874 891 Covad Communications 6197 784 970 BellSouth Network Solutions, 7018 745 1471 AT&T WorldNet Services 9583 658 837 Sify Limited 11492 633 642 Cable One 2386 610 876 AT&T Data Communications Serv 4323 577 1202 Time Warner Telecom 19916 557 563 OLM LLC 4766 517 717 Korea Telecom (KIX) 855 435 563 Canadian Research Network 5668 403 514 CenturyTel Internet Holdings, 7011 399 465 Citizens Utilities 702 371 587 UUNET - Commercial IP service 1239 363 850 Sprint 6198 358 493 BellSouth Network Solutions, 6517 335 362 Yipes Communications, Inc. 15270 330 357 PaeTec.net -a division of Pae 22773 313 606 Cox Communications, Inc. 13609 290 332 Choice One Communications Inc 701 280 969 UUNET Technologies, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:43 12:1630 13:1 15:11 16:3 17:3 18:4 20:42 24:719 25:1 30:2 32:67 38:186 40:54 44:3 47:3 52:4 55:1 56:3 57:34 58:113 59:155 60:179 61:817 62:779 63:1886 64:2942 65:2150 66:2967 67:586 68:696 69:1368 70:272 71:45 72:566 73:19 80:726 81:590 82:506 83:352 84:339 85:404 86:263 87:133 88:17 124:1 125:173 128:148 129:172 130:101 131:309 132:32 133:1 134:151 135:46 136:169 137:65 138:179 139:89 140:447 141:136 142:404 143:146 144:228 145:39 146:311 147:134 148:327 149:188 150:113 151:72 152:115 153:98 154:6 155:183 156:91 157:119 158:151 159:174 160:87 161:68 162:250 163:175 164:168 165:171 166:147 167:237 168:478 169:139 170:309 171:12 192:5752 193:3348 194:2463 195:1718 196:721 198:3903 199:3275 200:4154 201:550 202:6385 203:6684 204:3823 205:2082 206:2427 207:2918 208:2010 209:3451 210:1840 211:794 212:1238 213:1444 214:318 215:40 216:3805 217:1150 218:230 219:134 220:641 221:333 222:145 End of report

1 0

The Cidr Report
by cidr-report＠potaroo.net 13 Jan '06

13 Jan '06

This report has been generated at Fri Jan 13 21:46:55 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 06-01-06 174675 116359 07-01-06 174730 116376 08-01-06 174858 116387 09-01-06 174876 116510 10-01-06 174943 116546 11-01-06 174972 116578 12-01-06 175265 116674 13-01-06 175331 116912 AS Summary 21232 Number of ASes in routing system 8807 Number of ASes announcing only one prefix 2158 Largest number of prefixes announced by an AS AS8151 : Uninet S.A. de C.V. 91312384 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 13Jan06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 176909 116906 60003 33.9% All ASes AS8151 2158 609 1549 71.8% Uninet S.A. de C.V. AS4323 1196 237 959 80.2% TWTC - Time Warner Telecom AS18566 891 9 882 99.0% COVAD - Covad Communications Co. AS4134 991 253 738 74.5% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1031 310 721 69.9% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 604 39 565 93.5% CCINET-2 - Cox Communications Inc. AS7018 1457 954 503 34.5% ATT-INTERNET4 - AT&T WorldNet Services AS855 563 65 498 88.5% CANET-ASN-4 - Canadian Research Network AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS3602 522 107 415 79.5% SPRINT-CA-AS - Sprint Canada Inc. AS6197 967 569 398 41.2% BATI-ATL - BellSouth Network Solutions, Inc AS11492 641 248 393 61.3% CABLEONE - CABLE ONE AS4766 677 302 375 55.4% KIXS-AS-KR Korea Telecom AS17676 477 102 375 78.6% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS17488 436 66 370 84.9% HATHWAY-NET-AP Hathway IP Over Cable Internet AS9498 494 142 352 71.3% BBIL-AP BHARTI BT INTERNET LTD. AS6467 399 54 345 86.5% ESPIRECOMM - e.spire Communications, Inc. AS812 370 27 343 92.7% ROGERS-CABLE - Rogers Cable Inc. AS15270 352 30 322 91.5% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS4755 613 294 319 52.0% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS22047 380 88 292 76.8% VTR BANDA ANCHA S.A. AS18101 326 37 289 88.7% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS9583 836 556 280 33.5% SIFY-AS-IN Sify Limited AS14654 292 13 279 95.5% WAYPORT - Wayport AS3352 303 34 269 88.8% TELEFONICA-DATA-ESPANA Internet Access Network of TDE AS5668 513 244 269 52.4% AS-5668 - CenturyTel Internet Holdings, Inc. AS6167 332 65 267 80.4% CELLCO-PART - Cellco Partnership AS9929 320 57 263 82.2% CNCNET-CN China Netcom Corp. AS16814 295 42 253 85.8% NSS S.A. AS1239 844 604 240 28.4% SPRINTLINK - Sprint Total 19843 6222 13621 68.6% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.25.224.0/20 AS12180 INTERNAP-2BLK - Internap Network Services 64.25.224.0/22 AS15083 INFOLINK-MIA-US - Infolink Information Services Inc. 64.38.96.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 64.127.128.0/17 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.224.0/20 AS3356 LEVEL3 Level 3 Communications 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.9.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.16.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.18.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.20.0/24 AS30085 NHI-COLOCATIONS - New Horizon Collocations 66.117.21.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.186.192.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.216.0.0/18 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.20.224.0/20 AS7788 MAGMA-COMM - Magma Communications Ltd. 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 85.129.3.0/24 AS14585 CIFNET - CIFNet, Inc. 85.129.4.0/24 AS14585 CIFNET - CIFNet, Inc. 88.213.192.0/18 AS16154 TELECOMS-AS Telecoms-Net Ltd. 88.213.192.0/24 AS16154 TELECOMS-AS Telecoms-Net Ltd. 90.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 90.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP DFN-IP service X-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.0.246.0/24 AS3303 SWISSCOM Swisscom Solutions Ltd 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.34.216.0/22 AS6714 ATOMNET ATOM SA 195.66.16.0/21 AS6714 ATOMNET ATOM SA 195.238.66.0/23 AS6714 ATOMNET ATOM SA 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.160.171.0/24 AS7046 UUNET-CUSTOMER - UUNET Technologies, Inc. 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.74.32.0/19 AS9315 CWN-AS-AP Chomanan WorldNet Co., Ltd. 202.80.224.0/19 AS7613 DATALINETHAI-AS-AP Data Line Thai Co., LTD. Internet Service Provider 202.80.231.0/24 AS4750 LOXLEY-TH Loxley Information Co., Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.133.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.138.0/24 AS9237 HUTCHCA-AS Corporate Access (HK) Ltd. 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.145.0/24 AS4637 REACH Reach Network Border AS 203.89.146.0/24 AS4637 REACH Reach Network Border AS 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.108.96.0/19 AS577 BACOM - Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 208.97.128.0/19 AS26347 DREAMHOST-AS - New Dream Network, LLC 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.97.64.0/19 AS6132 INGRESSNET - Ingress Enterprises, Inc w/ Ingress Communications, Inc. 209.112.224.0/20 AS19817 DSLEXTREME - DSL Extreme 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 209.251.0.0/19 AS11036 SISCOM - SISCOM, Inc 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.82.160.0/20 AS20481 CALYX-NL Calyx Internet B.V. Netherlands 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

BLS FastAccess internal tech needed
by Todd Vierling 13 Jan '06

13 Jan '06

Please contact me offlist at tv(a)pobox.com, or via the telephone number in my duh.org contacts. The support IVR and agents are ... less than helpful. (Your new SMTP port filters put in today in the Atlanta market are a step in the right direction, but they are configured incorrectly: They block outbound connections to port 25, which is good -- but they are also blocking *inbound* connections to a local SMTP receiver, which protects nothing and simply annoys those of us who have a clue.) -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

2 2

Re: BLS FastAccess internal tech needed
by Fergie 13 Jan '06

13 Jan '06

This is why AAA is so important. :-) - ferg -- "Steven M. Bellovin" <smb(a)cs.columbia.edu> wrote: In message <20060112.195851.1587.15308(a)webmail05.lax.untd.com>, "Fergie" writes : > >RFC2827/BCP38? > The problem is that an ISP can do all the source filtering it wants, but if it only blocks SYNs to port 25 all it takes is one unfiltered dial-up to spoof that ISP's addresses. --Steven M. Bellovin, http://www.cs.columbia.edu/~smb -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Cisco, haven't we learned anything? (technician reset)
by Gadi Evron 13 Jan '06

13 Jan '06

In this (http://blogs.securiteam.com/wp-admin/post.php?action=edit&post=207) recent Cisco advisory, the company alerts us to a security problem with Cisco MARS (Cisco Security Monitoring Analysis and Response System). The security issue is basically a user account on the system that will give you root when accessed. The account is: 1. Hidden. 2. Default. 3. With a pre-set password. In other words, this is a journey back 10 years when technicians would commonly have special keys (actual keys, electronics or passwords) to access a device if they have to troubleshoot it for anything, or say? the user lost his password. People used to trade these keys online and hidden accounts were a thing of common practice. Today people still trade commonly used default passwords but it is not as popular as it used to be, at least in the online world. On the other hand, the most common practice to hack routers today, is still to try and access the devices with the notoriously famous default login/password for Cisco devices: cisco/cisco. Cisco/cisco is the single most used default password of our time. It got more routers pwned than any exploit in history, and it still does. One would think that a company such as Cisco, especially with this history, would stay away from such ?default? accounts? but the fact that this account is hidden makes it something different. It makes it a backdoor. One much like those used by the Bad Guys. Now? if Cisco knowingly put it there, shame on them. If somebody put it there without their knowledge? well, shame on them. This is indeed a vulnerability, as in a weakness. It is not however a software coding bug that may result in say? a buffer overflow. It is a part of the design of the system. Cisco disclosing this is very nice and commendable, but perhaps they should also let us know whether this was indeed a backdoor somebody put in their system or if it was part of the design? I love eastereggs. I just don?t like surprises in system privileges or backdoors, especially not in a security monitoring and response product. I very much doubt it was anything else but a part of the design but that should be admitted to. As the advisory states: "No other Cisco products are currently known to be affected by this vulnerability." Okay, but how about other vulnerabilities of this type? Are there any more backdoors to other Cisco products? If not, why wouldn?t they just come out and say that? ?There are NO other such backdoors in our products?. I?d even be happy with: ?To our knowledge, there are no other vulnerabilities of this type in our products.? This is not a bug. One can never be sure ALL bugs are eliminated ? however hard one may try. One CAN admit to having no such features in other products, though. Once again we fall upon re-naming of a feature as a bug or a bug as a feature to make the problem sound less severe. IN this case, the judgement is plain and simple: If Cisco were Bad Guys, this is a backdoor. As Cisco are Good Guys, this is a technician reset. Terminology? What?s the difference? The difference is that Cisco are not Bad Guys. If they disclosure a problem they should do it fully, because as a client, I am now concerned. This reminds me of Ciscogate but not for obvious reasons. That was a bad event for everybody involved. It reminds me of the very issue Mike Lynn discussed: Remote exploitation for Cisco is possible, while so far Cisco disclosed all these problems as DoS vulnerabilities. I am not saying Cisco did that on purpose, but in THIS case they CAN set my mind at ease. Why don?t they? Gadi.

11 17

NANOG List Statistics
by Chris Malayter 13 Jan '06

13 Jan '06

Good Evening, We are now ready to release our first of monthly list statistics. They are available at: http://www.nanog.org/liststats.html I'd like to offer a huge thanks to the staff at Merit for putting this all together: Dale Fay, Sue Joiner, Brad Robertson, and Jeff Tomaszewski I'd also like to thank the Steering Committee and Mail Admin Committee. We hope they are useful and of interest to the community as a whole! All comments can be directed to nanog-admin(a)merit.edu Regards, Chris Malayter NANOG - Mail list Administration Committee

1 0

EUSecWest papers and CanSecWest CFP
by Dragos Ruiu 12 Jan '06

12 Jan '06

url: http://eusecwest.com url: http://cansecwest.com (CanSecWest Call For Papers attached below) EUSecWest/core06 Conference --------------------------- Announcing the final selection of papers for the EUSecWest conference in London, U.K. on Feb. 20/21 at the Victoria Park Plaza Hotel. The following topics will be covered: Javier Burroni & Carlos Sarraute - Core Security Technologies Analyzing OS fingerprints using Neural Networks and Statistical Machinery van Hauser - thc Attacking the IPv6 protocol suite Yuji Ukai - eeye Exploiting Real-Time OS Based Embedded Systems Using the JTAG Emulator Nguyen Anh Quynh - Keio University XEBEK: A Next Generation Honeypot Monitoring System Fred Raynal - EADS Malicious Crypto Cesar Cerrudo - Argeniss Windows Local Shellcode Injection Andrew Cushman - Microsoft Microsoft Security Fundamentals Shreeraj Shah - Net Square Advanced Web Hacking - Attacks & Defense Justin Clarke - Ernst & Young LLP Practical Automated Web Application Attack Techniques Andy Davis - IRM PLC ColdFusion Security Tim Hurman - Pentest Ltd. ARMed combat: the fight for personal security Raffael Marty - ArcSight A Visual Approach to Security Event Management Michael Boman - KPMG Singapore Network Security Monitoring: Theory and Practice Jim DeLeskie & Danny McPherson - Teleglobe, Arbor Networks Protecting the Infrastructure Andrea Barisani - Inverse Path Lessons in Open Source Security: The Tale of a 0-Day Incident We would also like to announce the final list of Security Masters Dojo courses that will be offered on February 16th and 17th at the Victoria Park Plaza Hotel. Seats are available for all courses, but course registration is limited to only ten students each. We are considering adding additional course sessions on Feb 23/24 if demand warrants it. The hands-on courses offered will be: Gerardo Richarte - Core Security Technologies Assembly for Exploit Writing Marty Roesch - Sourcefire Advanced IDS Deployment and Optimization Maximillian Dornseif & Thorsten Holtz - Aachen University Advanced Honeypot Tactics Philippe Biondi - EADS Mastering the Network with SCAPY Renaud Deraison & Nicolas Pouvesle - Tenable Network Security Vulnerability Scanning: Advanced Nessus Usage Laurent Oudot & Nico Fischbach - rstack, COLT telecom Applied network security and advanced anomaly detection using state-of-the art honeypots and netflow/NIDS Cédric Blancher - EADS Practical 802.11 WiFi (In)Security Adam Laurie & Martin Herfurt & Marcel Holtmann - trifinite Bluetooth Technology Security Vendors Presentations for the Elevator Focus Groups will be announced shortly. Registration: --------------- Seats are available but limited for EUSecWest, and registration is open at: https://eusecwest.com/register.html Security Masters Dojo/London registration is now open at: https://eusecwest.com/courses.html Contact core06(a)eusecwest.com for registration support or corporate sponsorship inquiries. ********************************************************************* CanSecWest/core06 CALL FOR PAPERS -------------------------------- VANCOUVER, Canada -- The seventh annual CanSecWest applied technical security conference - where the eminent figures in the international security industry will get together share best practices and technology - will be held in downtown Vancouver at the the Mariott Renaissance Harbourside on April 3-7, 2006. The most significant new discoveries about computer network hack attacks and defenses, commercial security solutions, and pragmatic real world security experience will be presented in a series of informative tutorials. The CanSecWest meeting provides international researchers a relaxed, comfortable environment to learn from informative tutorials on key developments in security technology, and collaborate and socialize with their peers in one of the world's most scenic cities - a short drive away from one of North America's top skiing areas. In addition to the usual one hour tutorials, panel sessions and highly entertaining 5 minute "lightning" talks, this conference will also feature a new session called "Elevator Focus Groups". Featuring several short sessions, these commercial presentations will showcase new, significantly used, or dramatically innovative new products in the information security realm. Each selected vendor will have a short 10 minute presentation ("elevator pitch"), after which 10 minutes of audience Q&A and interactive discussion amongst the expert security practitioners attending will follow. In this session both the audience and the vendors can get valuable feedback from world leading experts and the attendees can get user evaluations and learn from sharing experiences and real world security applications about practical uses of the products - the "focus group." Hence the name: Elevator Focus Groups. The CanSecWest conference will also feature the availability of the Security Masters Dojo expert network security sensei instructors, and their advanced, and intermediate, hands-on training courses - featuring small class sizes and practical application excercises to maximize information transfer. We would like to announce the opportunity to submit papers, lightning talk proposals, and elevator focus candidate products for selection by the CanSecWest technical review committee. Please make your paper proposal submissions before January 30th, 2006. Slides for the papers must be submitted by March 15th, 2006. Some invited papers have been confirmed, but a limited number of speaking slots are still available. The conference is responsible for travel and accomodations for the speakers. If you have a proposal for a tutorial session then please email a synopsis of the material and your biography, papers and, speaking background to core06(a)cansecwest.com. Only slides will be needed for the March paper deadline, full text does not have to be submitted - but will be accepted if available. The CanSecWest/core06 conference consists of tutorials on technical details about current issues, innovative techniques and best practices in the information security realm. The audiences are a multi-national mix of professionals involved on a daily basis with security work: security product vendors, programmers, security officers, and network administrators. We give preference to technical details and new education for a technical audience. The conference itself is a single track series of presentations in a lecture theater environment. The presentations offer speakers the opportunity to showcase on-going research and collaborate with peers while educating and highlighting advancements in security products and techniques. The focus is on innovation, tutorials, and education instead of product pitches. Some commercial content is tolerated, but it needs to be backed up by a technical presenter - either giving a valuable tutorial and best practices instruction or detailing significant new technology in the products. Paper proposals should consist of the following information: 1) Presenter, and geographical location (country of origin/passport) and contact info (e-mail, postal address, phone, fax). 2) Employer and/or affiliations. 3) Brief biography, list of publications and papers. 4) Any significant presentation and educational experience/background. 5) Topic synopsis, Proposed paper title, and a one paragraph description. 6) Reason why this material is innovative or significant or an important tutorial. 7) Optionally, any samples of prepared material or outlines ready. 8) Will you have full text available or only slides? 9) Please list any other publications or conferences where this material has been or will be published/submitted. Please include the plain text version of this information in your email as well as any file, pdf, sxw, ppt, or html attachments. Please forward the above information to core06(a)cansecwest.com to be considered for placement on the speaker roster, have your lightning talk scheduled, or submit your product for inclusion in the focus groups. Advance Registration is now available for CanSecWest at http://cansecwest.com. -- World Security Pros. Cutting Edge Training, Tools, and Techniques London, U.K. February 20/21 2006 http://eusecwest.com pgpkey http://dragos.com/ kyxpgp

2 1

do bogon filters still help?
by Steven M. Bellovin 12 Jan '06

12 Jan '06

Every time IANA allocates new prefixes, we're treated to complaints about sites that are not reachable because they're in the new space and some places haven't updated their bogon filters. My question is this: have we reached a point where the bogon filters are causing more pain than they're worth? The Team Cymru web page (http://www.cymru.com/Bogons/index.html) gives some justification, but I think the question should be revisited. First, as the page (and the associated presentation) note, most of the benefit comes from filtering obvious stuff -- 0/8, 127/8, and "class" D and E source addresses. Second, the study is about 5 years old, maybe more; attack patterns have changed since then. Third, considerably more address space has been allocated; this means that the percentage of address space that can be considered bogus is significantly smaller. Possibly, there are more sites doing edge filtering, but I'd hate to count on that. So -- I'd like people to re-examine the question. Does anyone have more recent data on the frequency of bogons as a percentage of attack packets? What would that number look like if you filtered just the obvious -- the ranges given above, plus the RFC 1918 prefixes? Are your defenses against non-spoofed attacks really helped by the extra filtering? --Steven M. Bellovin, http://www.cs.columbia.edu/~smb

13 21