- Test - lists.nanog.org

India cites security concerns, blocks Huawei bid to expand their indian ops
by Suresh Ramasubramanian 18 Aug '05

18 Aug '05

By K.C. Krishnadas, EE Times Aug. 16, 2005 URL: http://www.informationweek.com/story/showArticle.jhtml?articleID=168602118 BANGALORE, India — Chinese telecom equipment maker Huawei Technologies' expansion plans here have again drawn the attention of Indian security agencies. For the second time in the last five years, Indian security agencies have moved to slow Huawei's expansion plans out of concern for India's strategic telecom network. In 2001, U.S. intelligence sources reportedly tipped off the Indian government about Huawei's activities here. Huawei has been embroiled in several high-profile intellectual property disputes with telecom rivals in recent years. Indian authorities are also concerned about Chinese links to India's neighbor and long-time adversary Pakistan. According to a report in The Times of India on Tuesday (August 16), the Indian government has put on hold Huawei's plans to use $60 million in new equity for its Indian subsidiary, Huawei Technologies India Pvt. Ltd. The report quoted the Research and Analysis Wing, an Indian intelligence agency, as saying Huawei "has been responsible for sweeping and debugging operations in the Chinese embassy [in India]. In view of China's focus on cyber warfare, there is a risk in exposing our strategic telecom network to the Chinese." The report said senior officials from Indian intelligence agencies recently discussed the matter and formed a committee to review guidelines for foreign companies involved in projects in sensitive industries. The committee will submit a report in September, when Huawei's case for increasing its equity is likely to be decided. The report quoted officials in the Indian Ministry of External Affairs as saying that Huawei attracted "adverse notice" from India's security agencies which expressed "reservations regarding the company's links with the Chinese military." A Huawei spokesperson here could not be reached for comment. Huawei launched a small Indian software development operation in 1999, but formally opened a development center in 2001. About a 1,000 people work for the company in India, making it Huawei's largest software development center outside China. Earlier this year it announced plans to set up a $60 million manufacturing unit in Bangalore, with plans to spend an additional $40 million to expand its existing R & D center here. Huawei is believed to have so far invested $100 million in the R & D center. Huawei's manufacturing plan is designed to cash in on India's expanding telecom infrastructure. The network expansion could eventually be worth billions of dollars to global telecom equipment suppliers. The Huawei probe illustrates the uneasy relationship between China and India. The regional rivals fought a war in 1962. Relations have improved over the last decade, but China's close military ties with Pakistan have fueled concerns here about Huawei's intentions. Meanwhile, a recent nuclear power deal between India and the United States has raised concerns in Beijing.

9 8

CESM over IP vendor recommendations
by Malayter, Christopher 18 Aug '05

18 Aug '05

Good Morning, I am looking for recommendations for CESM over IP devices, in particular, for carrying T1 traffic. Please contact me off-list. I will summarize all off-list responses if there is interest. Chris Malayter TDS Telecom - Network Services Data Network Engineering chris.malayter(a)tdstelecom.com Phone: (608) 664-4878 FAX: (608) 664-4644

1 0

Re: zotob - blocking tcp/445
by surfer＠mauigateway.com 18 Aug '05

18 Aug '05

NetBIOS was never meant to be a WAN protocol, so no problem in blocking it. For example: grc.com/su-techzone1.htm scott ----- Original Message Follows ----- From: Gadi Evron <ge(a)linuxbox.org> To: nanog list <nanog(a)merit.edu> Subject: zotob - blocking tcp/445 Date: Mon, 15 Aug 2005 21:51:43 +0200 > I heard from several different big ISP's that to stop the > spread of the worm they now block tcp/445. I suppose it > works. > > Gadi.

19 32

Re: Blocking certain terrorism/porn sites and DNS
by Miquel van Smoorenburg 18 Aug '05

18 Aug '05

In article <cistron.ce8d9033050818025539aefd62(a)mail.gmail.com>, Abhishek Verma <abhishekv.verma(a)gmail.com> wrote: >Okay, so i am not talking about blocking or removing a name server. I >am talking of removing that offending entry (like www.abc.com) from >the whois database or whereever the central database is mantained. The database you're talking about is DNS, not the WHOIS database. There is no central DNS database. The DNS database is distributed in a tree-like fashion. Mike.

1 0

RE: New N.Y. Law Targets Hidden Net LD Tolls
by Kristal, Jeremiah 18 Aug '05

18 Aug '05

> *NOT* "other people's fraud". Just when you have > 'intra-LATA' toll charges > for some numbers within a single area-code. If the user is > on one side of > the area-code, and the provider's POP is on the far side of > it, you can have > a what appears to be a 'local' number, that does incur > non-trivial per-minute > charges. Without knowing _where_ a particular prefix is, you > can't tell > whether there will be toll charges for that call, or not, > from any given > call origin. Pardon my ignorance, but don't most phone companies require 10 digit dialing for long-distance. We have similar situations in the rural area I live in, but the customers know if they dial more than 7 digits, it WILL be long distance. Not in densely populated urban areas. In NYC there are at least 5 area codes (212, 516, 917, 646, 347) that are local calls. You can also get extended local calling that adds several more area codes (914, 518, and I think one more). In fact you have to do 10-digit dialing for any call in NYC now, even if you're just calling next door. Things are very different in rural areas where each town has a single exchange. In the 80s I was still dialing only 4 digits to call people in the same town. The next town over has a different exchange, but was part of the same local telco coop, so it was 7 digit dialing but still local. The entire state had one area code (still does), but I think you had to use 1+ to call any toll number. > > Of course, this is true for *every* call in such an area -- > if the new law > is actually singling out ISPs (and ISPs -only-), I expect it could be > successfully challenged as 'discriminatory'. Agreed. It's silly to single out ISPs on this one. Any reasonable ISP is already warning customers that numbers that appear local may not be local. Way back in 95 I was working for a NY/NJ-based ISP that was trying to grow rapidly and we ran into this a lot, especially in NJ. After a handful of VERY irate customers called complaining about $500 phone bills, we got much better at knowing exactly where the toll lines were. We also worked with the Bell Atlantic to reduce the bills and started posting disclaimers. We would also do the work to ensure that a call was a local call if the customer asked, and explain to them how they could often get an expanded calling area for a small fee. > > The excessive 'local toll charge' situation is most visible > on calls to ISPs, > because those calls tend to be somewhat lengthy -- and > frequent -- thus, the > 'unexpected' charges can reach significant dollar value > before the phone > customer gets their first bill. Agreed, but is this really the ISPs fault, or is it the customer's fault. I think the fault lies with both. If an ISP is telling customers that they have local dialup numbers, the customer is likely going to believe the ISP. Sure mistakes happen, but if it keeps happening to a given ISP, maybe it is the ISP's fault. > > Life gets _really_ messy, when the ISP gets phone service > from a CLEC, > because there is "no telling" _where_ the ILEC uses as the > 'rate point' > for handing the calls off to that CLEC. And the CLEC bills > their customers > based on distance from the caller's location to that hand-off > point. The > ISP equipment may be across the street from the caller, but > the ILEC-CLEC > hand-off is on the far edge of the area-code. and the 'local > toll charges' > are applied. > > The CLEC can't tell you (and thus, neither can the ISP) which > prefixes are a > 'non-toll' call to their numbeers. And trying to get an > authoritative answer > from the ILEC about what charges are to the CLEC's prefix can > be _very_ > difficult. I have never come across this, but it may be more of a metro area thing. :-) I think in the end this is a typical government attempt to solve a non-problem. They can easily do public service announcements to inform their constituents, or ask the phone companies to deal with it as it really is a problem for them. It is a charge on the hone bill, right. :-) It's a very common problem in densely populated suburban areas. It's probably not much of a problem in North Dakota. I'm kind of perplexed why Mr. Spitzer is proposing this now though. It's not like dial-up is a growth market. I guess there are still people just getting their first internet connection and starting with dial-up. This might have had more traction 8-10 years ago, when people really were getting saddled with $500 phone bills. Jeremiah

1 0

New N.Y. Law Targets Hidden Net LD Tolls
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Must be fun days in NY State with Eliot Spitzer as AG. Lots of "(mumble) war on cyber (mumble) crime (mumble) national security (mumble)".... :-) Actually, I kind of like the guy for taking some disreputable companies to task An AP newswire article by Michael Gormley, via Yahoo! News, reveals that: [snip] A new law that's apparently the first in the nation threatens to penalize Internet service providers that fail to warn users that some dial-up numbers can ring up enormous long-distance phone bills even though they appear local. A long distance call even within the same area code can cost 8 to 12 cents a minute, adding up to hundreds, even thousands of dollars a month. Companies face fines of up to $500 for each offense, and consumers could pursue civil action claiming an unfair business practice. The National Conference of State Legislatures said it knows of no similar law elsewhere. [snip] http://news.yahoo.com/news?tmpl=story&u=/ap/20050818/ap_on_hi_te/techbits_i… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Re: What application runs on port 8094?
by Joe Shen 18 Aug '05

18 Aug '05

The situation here is, traffic on the two ports exists continuously. The total load on our egree link sums up to around 3Gbps (max) and 1.6Gbps(min). If both of the traffic is from P2P application, what is it? rebust file transmission over UDP? thanks --- Vulnerability Management <vulnerability(a)messagelabs.com> wrote: > Hi Joe, > > Joe Shen wrote: > > Hi, > > > > Using netflow based monitor tool, I noticed there > is a > > lot of traffic on 8094/UDP and 4662/TCP( both > exceed > > 1Gbps, and exist all the time) > > > > > > What application use that port? Is there any P2P > > application use UDP as transportation protocol? > > > > > Yes - eDonkey - it's listed on Dshield's "most > scanned ports": > > http://dshield.org/port_report.php?port=4662 > > Nothing listed for 8094 > > http://dshield.org/port_report.php?port=8094 > > but they do show a big spike in scans of this port a > couple of days ago. > Perhaps one of the recent MS worms calls home on > this port? UDP, > though... odd! > > \a > > Andrew Simmons > Messagelabs Security > > > > > > thanks in advance. > > > > Joe > > > > -- > "Only the paranoid survive." - Andy Grove (Intel) > > ______________________________________________________________________ > This email has been scanned by the MessageLabs Email > Security System. > For more information please visit > http://www.messagelabs.com/email > ______________________________________________________________________ > __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

1 0

Re: Blocking certain terrorism/porn sites and DNS
by Jonathan M. Slivko 18 Aug '05

18 Aug '05

> Yeps, a sys admin could do that. Sure. But we dont want others also to > see that website. Is it possible by deleting that entery from the > whois database is my question. No - not without some high level intervention at the registry and seeing as they are in the US under US law, it's not very likely to happen (freedom of speech/press, etc.). You could also set the firewall policy company wide at the network distribution point (where the Internet comes into the facility from the outside). But, that's censorship which I don't support except in rare cases. -- Jonathan

1 0

Re: zotob - blocking tcp/445
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Oh,no -- not the "Where will it end?" defense. I should just go ahead and invoke Godwin's Law now and put us all out of thread misery... - ferg -- routerg <routerg(a)gmail.com> wrote: Where will the filtering end? Is your NSP/ISP responsible for filtering virii, spam, phishing? I'm not saying it wouldn't be nice, but considering the types of attacks we see coupled with the fact that many enterprise customers are service providers themselves, providing service to yet other service providers, it is very difficult to take their decission making power away. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Microsoft Ships Zotob Worm Removal Tool
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Ryan Naraine writes in eWeek: [snip] Microsoft Corp. late Wednesday shipped an update to its malware removal tool to detect and delete the fast-spreading "Zotob" worm family. Microsoft typically updates the free utility once a monthon Patch Tuesdaybut with at least a dozen "Zotob" variants squirming through unpatched Windows 2000 systems, the company added detections for 10 mutants to help with the cleanup process. The new version of the Malicious Software Removal Tool will now zap the following worms: Zotob.A, Zotob.B, Zotob.C, Zotob.D, Zotob.E, Bobax.O, Esbot.A, Rbot.MA, Rbot.MB and Rbot.MC. [snip] Article: http://www.eweek.com/article2/0,1759,1849456,00.asp Updated Malicious Software Removal Tool: http://www.microsoft.com/security/malwareremove/default.mspx - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0