- Test - lists.nanog.org

Re: BGP Security and PKI Hierarchies (was: Re: Wifi Security)
by Sandy Murphy 07 Dec '05

07 Dec '05

>in operation, this means that there could be isp- (or ufo-)centric >isp identity certification (a la web of trust, for example) which >could have a very separate cert chain from that of address space >allocation, which, aside from the legacy issue, could come via the >rirs. So when one receives an update, which part is it that you verify with the certificate derived from the RIR chain and which part is it that you verify with the certificate derived from the web-of-trust? I'm guessing the answer in part is that there's a signature attesting to the prefix origination based on the RIR-rooted certificate, but I'm not certain what you are suggesting you would sign with the web-of-trust based ISP identity certificate (the origination announcement, indicating that it is not only authorization to originate but also source authentication?) If the RIR-rooted certificate says that ISP XYZ is allocated prefix P, does the web-of-trust ISP identify certificate have to say exactly "ISP XYZ"? Is that exact match the link between what the RIR-rooted cert is proving and what the web-of-trust identify cert is proving? --Sandy

8 19

QoS for ADSL customers
by Kim Onnel 06 Dec '05

06 Dec '05

Hello everyone, We have Juniper ERX as BRAS for ADSL, its GigE interface is on an old Cisco 3508 switch with an old IOS, its gateway to the internet is a 7609, our transit internet links terminate on GigaE, Flexwan on the 7600 The links are now almost always fully utilized, we want to do some QoS to cap our ADSL downstream, to give room for the Corp. customers traffic to flow without pain. I'm here to collect ideas, comments, advises and experiences for such situations. Our humble approach was to collect some p2p ports and police traffic to these ports, but the traffic wasnt much, one other thing is rate-limiting per ADSL customers IPs, but that wasnt supported by management, so we thought of matching ADSL www traffic and doing exceed action is transmit, and police other IP traffic. Doing so on the ERX wasnt a nice experience, so we're trying to do it on the cisco. Thanks

10 19

Bogon Filters Removal REQ, 124/7, 126/8
by Noel 06 Dec '05

06 Dec '05

Dear colleagues, This is a resend of APNIC message issued Feb this year, many of you have not removed the filters creating problems for many networks in Australia and other APNIC covered countries, as the below mentioned 'near future' has been well underway for some couple of months. It would be appreciated if you could act on this notice at your very earliest convenience if you suspect you are a guilty party :) Thanks in advance. N Subject: [APNIC Members] [Apnic-announce] APNIC new IPv4 addresses Date: Fri, 4 Feb 2005 16:28:07 +1000 (EST) Dear colleagues APNIC received IPv4 address blocks 124/7 and 126/8 from IANA in January 2005 and will be making allocations from these ranges in the near future. This announcement is being made for the information of the Internet community so that network configurations such as routing filters may be updated as appropriate. For more information on the resources administered by APNIC, see: http://www.apnic.net/db/ranges.html

1 0

RE: Ethernet over SDH tutorial/concepts.
by Michael K. Smith 06 Dec '05

06 Dec '05

Hello: It could also just be a direct Ethernet path over a SONET circuit without the inherent 802.17 resiliency. You should ask them for more information about their infrastructure. Are they using 802.17? Is it path-protected on the SONET side? Mike -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Paul Khavkine Sent: Wednesday, November 30, 2005 12:05 PM To: MARLON BORBA Cc: nanog(a)merit.edu Subject: Re: Ethernet over SDH tutorial/concepts. This is most likely something like RPR/802.17 which is Ethernet over Sonet/SDH. Cheers Paul On Wed, 30 Nov 2005, MARLON BORBA wrote: > >Dear NANOGers, > >We are in process of choosing a new corporate ISP for our company. One of them offered us connection to their backbone using Ethernet over SDH. I'd like to find some introductory texts or prospects about that technology and some advice about its pros/cons when compared to traditional data circuits. > > > >Abraços, >Marlon Borba, CISSP. >-- >GTER 20/GTS 02.05 - Participe! >http://eng.registro.br/gter20/prog.html >-- > > ************************************************ Paul Khavkine Networks/Systems Planning and Engineering DISTRIBUTEL Communications. 740 Notre Dame West, Suite 1135 Montreal, Quebec, Canada, H3C 3X6 +1-514-877-5505 x 263 http://www.distributel.net ************************************************

2 1

Re: Clueless anti-virus products/vendors (was Re: Sober)
by W.D.McKinney 06 Dec '05

06 Dec '05

>-----Original Message----- >From: Daniel Senie [mailto:dts@senie.com] >Sent: Friday, December 2, 2005 11:27 AM >To: nanog(a)nanog.org >Subject: Clueless anti-virus products/vendors (was Re: Sober) > > >At 03:12 PM 12/2/2005, Michael Loftis wrote: > > > >>--On December 2, 2005 2:02:15 PM -0600 Dennis Dayman >><dennis(a)thenose.net> wrote: >> >>> >>>Interested, but I see many Sober postings and outages on other lists and >>>not here...has anyone been having issues? I know the ISP's are fighting >>>the living out of the virus. >> >>I've been seeing a few really large bursts into our mailserver. Not >>sure if it's a new variant or a reoccurrence of an old strain. I >>put in a good number of new port 25 inbound blocks for infected >>systems and attempted to put up a few checks inside of our front end >>mail servers rather than in the virus and spam filtering (which >>happens later for us, so for bad surges we put a few custom rules up >>front early in postfix). > >Only stuff we're seeing is a lot of blowback from dumb mail systems >that accept email, THEN scan for viruses, and ultimately decide to >send a note back to the From: address in the body of the infected >email. Since the From: is invariably forged, the uninvolved owner of >those forged email addresses gets hammered. > >Can people building virus scanning devices PLEASE GET A %^&*^ CLUE? >This means you, Barricuda Networks, more than anyone else, but we >also see this annoyance from Symantec devices, and from some AOL >systems as well. > It's a simple switch in the GUI of Barracuda Networks to turn of this annoyance. More operator error than Barracuda's fault, IMHO. -Dee >Blasting a note back does two things: > >1. It allows the worm or virus author an opportunity to implement an >amplified attack on a third party using your filtering systems. > >2. The bounce messages mostly include an advertisement for the >filtering box's vendor. Get a clue... this is a REALLY negative >advertisement for your spam & virus filtering technology. If you >can't manage to realize the virus laden email should perhaps be >dropped, then it makes your box look poorly designed. > >Oh, and please delete the infected file rather than sending that along too. > >OK, off my soapbox. > >Dan > >

6 9

RE: Clueless anti-virus products/vendors (was Re: Sober)
by Daniel Senie 05 Dec '05

05 Dec '05

At 10:27 PM 12/4/2005, Church, Chuck wrote: >What about all the viruses out there that don't forge addresses? As others have noted, these are so far lost in the noise as to not be a factor. >Sending a warning message makes sense for these. Why? Because you need to be the one to tell the sender they are infected? Let sites patrol their own users. Furthermore, if you did your virus scanning during the SMTP transaction, you'd be able to send back a 5xx error response during the transaction, thereby avoiding any concern about spamming an innocent third party. > Unless someone has >done the research to determine the majority of viruses forge addresses, >you really can't complain about the fact that the default is to warn. As others have noted, the vendors can and should know. >Calling vendors 'clueless' because a default doesn't match your needs Excuse me, I think you may notice that a LOT of folks have piped up on this issue. The simple fact is as configured many vendors spam third parties adding to the noise floor. While backbone operators might in fact make a bit extra as a result, those of us who actually pay for bandwidth do not appreciate it. We certainly can and do blacklist sites that hammer us with bogus bounces, just the same as we'd block any company knowingly sending us undesired email. > is >a little extreme, don't you think? The ideal solution would be for the >scanning software to send a warning only if the virus detected is known >to use real addresses, otherwise it won't warn. See question above, re: why do you think it's your systems' place to police the rest of the Internet, sending warnings out? Either reject virus-laden email during the SMTP session, or quietly own it (and dispose of it). >Chuck > > >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >Todd Vierling >Sent: Sunday, December 04, 2005 4:53 PM >To: W.D.McKinney >Cc: nanog(a)merit.edu >Subject: RE: Clueless anti-virus products/vendors (was Re: Sober) > > >On Sun, 4 Dec 2005, W.D.McKinney wrote: > > > > (Virus "warnings" to forged addresses are UBE, plain and simple.) > > > > Since when? I disagree. > >UBE = "unsolicited bulk e-mail". > >Which of those three words do[es] not apply to virus "warning" >backscatter >to forged envelope/From: addresses? Think carefully before answering. > >-- >-- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

1 0

Re: Clueless anti-virus products/vendors (was Re: Sober)
by Robert Bonomi 05 Dec '05

05 Dec '05

> From owner-nanog(a)merit.edu Sun Dec 4 22:34:54 2005 > Date: Mon, 05 Dec 2005 04:30:26 +0000 (GMT) > From: "Christopher L. Morrow" <christopher.morrow(a)mci.com> > Subject: Re: Clueless anti-virus products/vendors (was Re: Sober) > To: "Steven M. Bellovin" <smb(a)cs.columbia.edu> > Cc: "Church, Chuck" <cchurch(a)netcogov.com>, nanog(a)merit.edu > > > On Sun, 4 Dec 2005, Steven M. Bellovin wrote: > > > In message <B6621ED4D0AD394BBA73CA657DFD8976869630(a)MSPEXBE01.wamnet.inc>, "Chur > > ch, Chuck" writes: > > > > > >What about all the viruses out there that don't forge addresses? > > >Sending a warning message makes sense for these. Unless someone has > > > > A-V companies are in the business of analyzing viruses. They should > > *know* how a particular virus behaves. > > This has also been said before, but... they are also in the business of > SELLING their product. It seems that the 'default' (note I don't either: > use av, nor scan emails for virii so I'm not sure what defaults to what... > just use something other than outlook and you can care less about it) is > possibly there for advertising effect more than anything else :( > > Hey, bob's company stopped this virus with $PRODUCT_12, why aren't we > using that product $VP_O_IT ?? "Because they 'very thoughtfully' fowarded the entire message, INCLUDING THE VIRUS ITSELF, to us. _Even_though_ the original message did not originate here. "Do you _really_ think we should start forwarding viruses to our customers, 'just because' their address was forged into a message sent us? Just how do you think our customers would respond to _that_?" There _is_ an art-form to backing management into an untennable corner, when they are bound and determined to do something 'wrong'. It's simply a matter of finding the "right" consequences of the action, to illustrate _why_ the proposed thing is 'wrong'. 'Revenues', and 'customer satisfaction' are almost _universal_ "hot buttons" that can frequently be used to advantage.

1 0

Re: Clueless anti-virus products/vendors (was Re: Sober)
by Robert Bonomi 04 Dec '05

04 Dec '05

> From owner-nanog(a)merit.edu Sun Dec 4 17:19:43 2005 > Date: Sun, 04 Dec 2005 15:18:29 -0800 > From: Steve Sobol <sjsobol(a)JustThe.net> > To: Rich Kulawiec <rsk(a)gsp.org> > Cc: nanog(a)nanog.org > Subject: Re: Clueless anti-virus products/vendors (was Re: Sober) > > > Rich Kulawiec wrote: > > > And thus we now have blacklist entries such as: > > > > barracuda1.aus.texas.net > > barracuda.yale-wrexham.ac.uk > > barracuda.morro-bay.ca.us > > barracuda.ci.mtnview.ca.us > > barracuda.elbert.k12.ga.us > > barracuda.fort-dodge.k12.ia.us > > barracuda.ci.garner.nc.us > > barracuda.ship.k12.pa.us > > > > and many, many more. > > Blocking based on rDNS simply because it implies that a certain piece of > equipment is at that address is... not advisable. _UNTIL_ the first backscatter arrives from 'that' equipment, that is. *wry*grin*

1 0

Re: [NANOG] blocking unallocated subnets
by Randy Bush 03 Dec '05

03 Dec '05

> On recent FreeBSD (ipfw2) <doh> cool. i had never followed the changes in ipfw2. thanks! randy

1 0

Need mail admin contact for prodigy.net,sbcglobal,swbell,flash.net,snet.net,pacbell.net
by Mark Jeftovic 03 Dec '05

03 Dec '05

Our mail forwarding customers to those destinations are having their mail hard bounced right now and we received no response from the removeme(a)sbc.sbcglobal.net address. Any mail admins for those destinations please contact me off list? Thanks -mark -- Mark Jeftovic <markjr(a)easydns.com> Founder and CEO, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(866) 273-2892

1 0