- Test - lists.nanog.org

Re: New Rules On Internet Wiretapping Challenged
by Vicky Rode 03 Nov '05

03 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 in-line: Adam Chesnutt wrote: > This whole thread is silly! It's not hard to trap and trace a suspect. > It doesn't require a "Whole new generation of routers and switches" - -------------- That was exactly my understanding but I think it goes beyond that. > > Correct me if I'm wrong here, but it seems to me that it's a fairly > trivial task to mirror and upstream, and isolate the traffic required. > I've performed such taps before and usually find it to easily performed > with a single FreeBSD box, and a mirrored port on the router. - --------------- true enough. > > Or maybe I'm just missing the point of this thread. - --------- You might want to take a look at rfc 2804 for some background. regards, /virendra > > Flounder > > > Vicky Rode wrote: > > > comments in-line: > > > Peter Dambier wrote: > > > >>Vicky Rode wrote: > > > > >>>...Raising my hand. > >>>My question is on Terry Hartle's comments, maybe someone with more >>>insight into this could help clear my confusion. > >>>Why would it require to replace every router and every switch when my >>>understanding is, FCC is looking to install *additional* gateway(s) to >>>monitor Internet-based phone calls and emails. >>> > > >>In a datacenter you have lines coming in and lines going out. And you >>have internal equippment. > >>You have to eavesdrop on all of this because the supposed terrorist >>might come in via ssh and use a local mail programme to send his email. > > > > -------------- > How do you differentiate between a hacker and a terrorist? > > For all you know this so called "terrorist" might be coming from a > spoofed machine(s) behind anyone's desk. > > > > > >>So you have to eavesdrop on all incoming lines because you dont know >>where he comes in. Via aDSL? via cable modem? Via a glass fiber? > >>And you have to monitor all internal switches because you dont know >>which host he might have hacked. > >>Guess a cheap switch with 24 ports a 100 Mbit. That makes 2.4 Gig. >>You have to watch all of these. They can all send at the same time. >>Your switch might have 1 Gig uplink. But that uplink is already in >>use for your uplink and it does not even support 2.4 Gig. > > > > ------------- > There are ways to address over-subscription issues. > > > > > >>How about switches used in datacenters with 48 ports, 128 ports, ... >>Where do you get the capacity for multiple Gigs just for eavesdropping? > >>On the other hand - most switches have a port for debugging. But this >>port can only listen on one port not on 24 or even 48 of them. > >>So you have to invent a new generation of switches. > > > > ---------------- > I don't believe this is the primary reason for replacing every router > and every switch. > > I think (correct me if I'm wrong) it has to do with the way wiretap > feature (lack of a better term) that .gov is wanting vendors to > implement within their devices, may be at the network stack level. > > I guess it's time to revisit rfc 2804. > > > > > >>How about the routers? They are even more complicated than a switch. > >>As everybody should know by now - every router can be hacked. So >>your monitoring must be outside the router. > >>The gouvernment will offer you an *additional* gateway. >>I wonder what that beast will look like. It must be able to take >>all input you get from a glass fiber. Or do they ask us to get >>down with our speed so they have time to eavesdrop. > > > > ----------------- > powered by dhs w/ made in china sticker :-) > > I'm not being smarty pants about this...it is actually happening. That's > all I can say. > > > > regards, > /virendra > > > > > > > >>>I can see some sort of >>>network redesign happening in order to accodomate this but replacing >>>every router and every switch sounds too drastic, unless I >>>mis-understood it. Please, I'm not advocating this change but just >>>trying to understand the impact from an operation standpoint. > >>> > > >>Yes, it is drastic. But if they want to eavesdrop that is the only >>way to do it. > > > > > >>>Any insight will be appreciated. > > > >>>regards, >>>/virendra > >>> > > >>Here in germany we accidently have found out why east germany had >>to finally give up: > >>They installed equippement to eavesdrop and tape on every single >>telefone line. They could not produce enough tapes to keep up >>with this :) > >>Not to mention what happened when they "recycled" the tapes and >>did not have the time to first erase them :) > > >>Kind regards, >>Peter and Karin > > > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDakYzpbZvCIJx1bcRAv2XAKDxgQqfs+nZMrUCR7zyKATJjfEBbgCg9/lu N7waCSlgruy6yecfnFwO17M= =1vBJ -----END PGP SIGNATURE-----

2 1

OT: Cisco Patches 'Black Hat' IOS Flaw
by Henry Linneweh 03 Nov '05

03 Nov '05

http://www.eweek.com/article2/0,1895,1881303,00.asp Apparently now all the bluster about people capable of fixing problems with the internet without a congressional mandate worked still..... -Henry

1 0

Re: classful routes redux
by Geoff Huston 03 Nov '05

03 Nov '05

At 01:16 PM 3/11/2005, Christopher L. Morrow wrote: >On Wed, 2 Nov 2005, Fred Baker wrote: > > > > > actually, no, I could compare a /48 to a class A. > > > >(someone might already have asked this, but...) why /48? Because the thinking at the time appears to be that to "ease' renumbering reduce the costs associated with address distribution functions (and associated network assessment tasks) and because there were heaps of addresses, all end-sites would get the same address allocation, and the uniform amount that was arrived at was a /48 . When asked whether this referred to _everything_ that may require subnets, the answer was "yes". When asked whether this encompassed everything from a mobile phone to a large corporate the answer given was, once more, "yes". Why /48 rather than /47 or /49? - alignment to nibble boundaries to make DNS delegation easier. Why /48 rather than /32 or /40? I really cannot say - I suspect that /48 is the largest end site number that meets the projected scope as described in RFC 3177. regards, Geoff

2 1

Re: classful routes redux
by Christopher L. Morrow 03 Nov '05

03 Nov '05

On Thu, 3 Nov 2005 bmanning(a)vacation.karoshi.com wrote: > > > > hostroute == /64 > > > > > > > > (and just think of all that spam than can originate from all those > > > > "loose" IP addresses in that /64 for your local SMTP server!!! Yummy) > > > > > > > > -- Oat Willie > > ok... so is it -just- me that gets the willies thinking of the > 2x64-1 available IPv6 addresses that can be forged as source > addresses for spam origination? i REALLY want to have a tidy but, but, but... ipv6 is more SECURE! :) I'm really not sure I understand why my LAN has to have more available ip space than the current Internet, but boy, it sure makes it easy to spam^H^H^H^Hfind available addresses! I view the 48/56/64 boundaries about like Woody does (and I suspect Mr. Narkins and Mr. Bush) they are in the documentation so people use them, it's not particularly a great idea, but it is an idea. (Oh, and some equipment won't do the lovely autoconfig unless you have a /64, someone should open a bug report on that)

1 0

cogent+ Level(3) are ok now
by Jared Mauch 03 Nov '05

03 Nov '05

http://biz.yahoo.com/prnews/051028/laf022.html?.v=27 The internet will not end on November(9)th :) - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

22 35

RE: FW: Using BGP to force inbound and outbound routing through particular routes
by Edward W. Ray 02 Nov '05

02 Nov '05

Yes, you are correct I have decided to go for my CCIE:Security and need some practice before the lab exam. My only choices for multi-homing at home are T1s/DS3s... And cable. I already have a 3-T1 setup where the Class C block is homed now. This is my main business line and hosts my DNS, Web, Mail servers and VPN connections. The ISP I use is has punched a hole in their Class B to allow my Class C block to leak through. At some point I may get a business class cable line. But since I do not know if what I am doing will violate Roadrunner's AUP and/or cause them to disconnect me, I decided to go with the $29.95 special. My ISP already peers with Level3, and Roadrunner peers with Level3 (AS3356) and AOL (AS 1668). My goal is to block all routes via Roadrunner/Level3 and force all inbound and outbound traffic via Roadrunner to go through AS 1668 only. Edward W. Ray -----Original Message----- From: Mike Damm [mailto:symetrix@gmail.com] Sent: Wednesday, November 02, 2005 12:22 PM To: spam Subject: Re: FW: Using BGP to force inbound and outbound routing through particular routes Let me see if I understand what you are saying... You have a real network with routers, T1 lines, all that jazz. And you'd like to multihome with a cable modem? Right? -Mike On 11/2/05, spam <spamjail(a)mmicman.com> wrote: > > I recently made a request to get a cable modem connection at my home. > I went for one of those $29.95 for three month specials in case I run > afoul of some rules prohibiting what I am going to do. I already have > a multi-T1 connection with a Class C block and BGP running on my Cisco > 3640 router, and was looking to become multi-homed. The cable > connection is via bridge/DHCP cable modem, and was going to hook it up > to the Cisco 3640. I have already done the research and know from > what block of IP addresses I will be assigned, and the BGP route tables/peers. > > I would like to use BGP to force inbound and outbound routing only > through particular peers, Sprint (AS 1239) and UUNET (AS 701). I have > been reading "Practical BGP" by Whate, McPherson and Sangli and this > appears to be possible. However, do my adjacent routers need to > support BGP in order for this to work? Could I use other routing > protocols to accomplish this, or would this require knowledge of all possible downstream router IP addresses? > > Edward W. Ray > >

1 0

To get internet full routing table
by Joe Shen 02 Nov '05

02 Nov '05

Hi, Is that possible to get full internet routing table without help from upstream ISP? or is there anyway to get some backbone network's internet routing table directly? thanks Joe Send instant messages to your online friends http://asia.messenger.yahoo.com

4 3

Using BGP to force inbound and outbound routing through particular routes
by Edward W. Ray 02 Nov '05

02 Nov '05

spam was a lousy name... -----Original Message----- From: spam [mailto:spamjail@mmicman.com] Sent: Wednesday, November 02, 2005 11:44 AM To: 'nanog(a)merit.edu' Subject: FW: Using BGP to force inbound and outbound routing through particular routes I recently made a request to get a cable modem connection at my home. I went for one of those $29.95 for three month specials in case I run afoul of some rules prohibiting what I am going to do. I already have a multi-T1 connection with a Class C block and BGP running on my Cisco 3640 router, and was looking to become multi-homed. The cable connection is via bridge/DHCP cable modem, and was going to hook it up to the Cisco 3640. I have already done the research and know from what block of IP addresses I will be assigned, and the BGP route tables/peers. I would like to use BGP to force inbound and outbound routing only through particular peers, Sprint (AS 1239) and UUNET (AS 701). I have been reading "Practical BGP" by Whate, McPherson and Sangli and this appears to be possible. However, do my adjacent routers need to support BGP in order for this to work? Could I use other routing protocols to accomplish this, or would this require knowledge of all possible downstream router IP addresses? Edward W. Ray

1 0

FW: Using BGP to force inbound and outbound routing through particular routes
by spam 02 Nov '05

02 Nov '05

I recently made a request to get a cable modem connection at my home. I went for one of those $29.95 for three month specials in case I run afoul of some rules prohibiting what I am going to do. I already have a multi-T1 connection with a Class C block and BGP running on my Cisco 3640 router, and was looking to become multi-homed. The cable connection is via bridge/DHCP cable modem, and was going to hook it up to the Cisco 3640. I have already done the research and know from what block of IP addresses I will be assigned, and the BGP route tables/peers. I would like to use BGP to force inbound and outbound routing only through particular peers, Sprint (AS 1239) and UUNET (AS 701). I have been reading "Practical BGP" by Whate, McPherson and Sangli and this appears to be possible. However, do my adjacent routers need to support BGP in order for this to work? Could I use other routing protocols to accomplish this, or would this require knowledge of all possible downstream router IP addresses? Edward W. Ray

1 0

Problem with peering between Gblx and WCG?
by Reeves, Rob 02 Nov '05

02 Nov '05

1 ge4-1-0-226-1000M.ar4.PHX1.gblx.net (67.17.64.89) 0 msec 0 msec 0 msec 2 so1-0-0-2488M.ar1.LAX2.gblx.net (67.17.67.169) 12 msec 8 msec 12 msec 3 lsanca3lcx1-pos13-2.wcg.net (64.200.142.193) 772 msec 796 msec 804 msec 4 anhmca1wcx2-pos5-0.wcg.net (64.200.140.69) [AS 7911] 804 msec 832 msec 852 msec 5 lsanca1wcx1-pos0-0-oc48.wcg.net (64.200.140.142) [AS 7911] 856 msec 988 msec 1000 msec Would anyone happen to be aware of problems between Global Crossing and WCG in CA? We're hearing reports of intermittent latency across this link over the past three days. Thanks, ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Rob Reeves IP Network Engineer Arbinet 703-456-4172 rreeves(a)arbinet.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1