- Test - lists.nanog.org

RE: Ironcore foundry
by David Hubbard 29 Mar '05

29 Mar '05

Issam Hakimi [ Killix ] wrote: > I am in the search of documentation on the ironcore generation of the > routers foundry. All the urls are the welcomes. > Thanks. > > Regards, > Issam Hakimi http://www.foundrynet.com/services/documentation/index.html David

2 1

abuse & security issues > Israel
by Gadi Evron 29 Mar '05

29 Mar '05

Hello. Back in the mid 90th, it has become a fact that Israel was one of the main focal points of Internet abuse in the world, and reaching abuse contacts was very difficult. Today, we no longer hold that title. Also, some of the ISP's in Israel are now very responsive to abuse, it is not true with most others. Still, a lot of abuse originates from Israeli net space and finding working abuse contacts in meat space remains difficult. We at CERT.gov.il are responsible for the Government's net space [AS8867 / gov.il] and are available to help with any problems originating from our networks if such exist. We are also aiming to help clue up Israeli ISP's in general to Internet abuse, but for now, if anyone has abuse and security issues that need resolving, and yet find it difficult to find who to contact and/or get response/action, feel free to ping me personally here at CERT.gov.il. We will do our best to connect you with the right people, and follow up. Aside to that, I am pleased to announce IL-ops. An active Israeli network operators group that discusses mainly security and spam issues between Israeli ISP's. We here in Israel are making an effort - let us help you. Yours, -- Gadi Evron, Information Security Manager, Project Tehila - Israeli Government Internet Security. Ministry of Finance, Israel. gadi(a)tehila.gov.il gadi(a)CERT.gov.il Office: +972-2-5317890 Fax: +972-2-5317801 http://www.tehila.gov.il

1 0

Re: DNS cache poisoning attacks -- are they real?
by Florian Weimer 29 Mar '05

29 Mar '05

* Brad Knowles: > At 12:09 AM +0200 2005-03-28, Florian Weimer wrote: > >> I doubt this will work on a large scale. > > It's already been done on a large scale. > >> At least recent BIND >> resolvers would discard replies from the abused caching resolvers >> because they lack the AA bit, so only clients using the resolvers as >> actual resolvers are affected. > > Incorrect. Indeed. > The resolver requiring that the AA bit be set would prohibit anyone > from forwarding queries to another server, which might be answering > from cache. Would you point me to such a configuration? I don't think it will work reliably for this purpose because BIND 9 only waives the requirement for the AA bit if the authority section of the response remotely looks like a referral. I doubt that this is the case if you simply redirect to a cache.

1 0

Ironcore foundry
by Issam Hakimi [ Killix ] 29 Mar '05

29 Mar '05

I am in the search of documentation on the ironcore generation of the routers foundry. All the urls are the welcomes. Thanks. Regards, Issam Hakimi

1 0

Spoofing and Internet Filtering
by Robert Beverly 28 Mar '05

28 Mar '05

Hi all, I'm working on a project designed to determine the extent of ingress and egress filtering on the Internet. Specifically interested in the ability to forge headers and source spoofed packets. The project relies on clients running an active measurement program from as wide a distribution of netblocks as possible. If you're curious about your connection, your upstream or how prevalent filtering is on other's networks, try out the source or one of the binaries from: http://momo.lcs.mit.edu/spoofer/ Many more details of the program, methodology and current results are on the web site as well. Thanks! rob

1 1

VoIP Security Alliance Elects Board of Directors, Announces Projects and Issues Call for Participation
by Fergie (Paul Ferguson) 28 Mar '05

28 Mar '05

Somewhat related to operational issues: "AUSTIN, Texas March 28, 2005 The Voice over IP Security Alliance (VOIPSA), today announced its newly elected board of directors as well as its short-term projects to develop a threat taxonomy and document security requirements for VoIP networks. VOIPSA is an open group with the purpose of improving the public awareness of issues and best practices for security and privacy of Voice over IP, and is inviting participation in the new projects." http://www.voipsa.org/press/03282005.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: "Bandwidth Advisors" - www.bandwidthadvisors.com
by Randy Bush 28 Mar '05

28 Mar '05

>>> The NANOG list is not an appropriate place for speculative critiques of >>> the business models of individual companies. >> censorship rears its ugly head again. thank you censors. this >> is sick. > No, this is not censorship at all. since i am helping folk who seem not able to do their literature searches this week, let me help you too http://www.m-w.com/cgi-bin/dictionary?va=censorship which requires you also read http://www.m-w.com/cgi-bin/dictionary?va=censor it is when i don't like what someone has to say that i have to remember to defend their right to say it. this is one of those times. randy

2 1

Intradomain DNS Anycast revisited
by Joe Shen 28 Mar '05

28 Mar '05

Hi, I'm trying to set up a anycast DNS server farm for customer service. In order to improve availability, we plan to install those servers in one LAN which has the similar structure like : server-(1,3)---switch1---router-1---(outside) | | server-(2,4)---switch2---router-2---(outside) The four unix servers are all unix boxes, switch-1 & switch-2 are interconnected to guarantee the availability. BIND is to be used as DNS cache server software, Quagga OSPFD is used to be routing software. According to above configuration, both routers will know multiple paths to dns cache server, while dns cache server should know two paths to outside network. Here comes my questions: 1) should each dns cache server be configured a static default route (0.0.0.0/0.0.0.0)? If server-(1,3) is configured statically to use router-1 as default router, will Quagga make it use router-2 when router-1 is not reachable? 2) If each server is configured two default router ( router-1 & router-2), or each server learn route 0.0.0.0/0.0.0.0 by OSPF ( our border router inject default route into OSPF ); there should be two equal cost path to 0.0.0.0/0.0.0.0 on each DNS server, the DNS server should disperse any outgoing packets onto the two paths, will that do harm to DNS service ? 3) Is there any requirement on BIND to fit to such multipath routing situation? Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

7 8

Re: DNS cache poisoning attacks -- are they real?
by Suresh Ramasubramanian 28 Mar '05

28 Mar '05

On Mon, 28 Mar 2005 16:40:22 +0100, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > If you want to use your own resolver remotely like this, I can't > really say too much about that. However, in that case I would > encourage you to ensure that the server is closed to queries from > outside sources unless those sources are cryptographically > authenticated. Not even mine as a matter of fact. My DSL ISP's. :)

1 0

Re: Clearwire May Block VoIP Competitors
by Robert Bonomi 28 Mar '05

28 Mar '05

> Date: Mon, 28 Mar 2005 06:27:56 -0500 > From: Chip Mefford <cpm(a)well.com> > Subject: Re: Clearwire May Block VoIP Competitors > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Robert Bonomi wrote: > |>From owner-nanog(a)merit.edu Sat Mar 26 12:37:15 2005 > |>Date: Sat, 26 Mar 2005 13:35:31 -0500 > |>From: Eric Gauthier <eric(a)roxanne.org> > |>To: "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> > |>Cc: nanog(a)merit.edu > |>Subject: Re: Clearwire May Block VoIP Competitors > |> > |> > |> > |>>http://www.advancedippipeline.com/news/159905772 > |>> > |> > |>"...In what the company claims is an effort to preserve the performance > |> of its pre-standard WiMAX network, Clearwire says it reserves the right > |> to prohibit the use of a wide range of bandwidth-hungry applications, a > |> list that apparently includes VoIP as well as the uploading or > |> downloading of streaming video or audio, and high-traffic Web site > |> hosting." > |> > |>Hrm... Isn't a VoIP call realtively low bandwidth? > | > | > | "*ALL* things are relative." <grin> > | > |> I haven't studied > |>this, but Vonage's site seems to imply that the maximum data rate is > 90Kbps > |>(http://www.vonage.com/help_knowledgeBase_article.php?article=190) I > |>typically see speeds greater than this from my web browser... > | > | > | There's a big difference. web browser activity is typically *very* > bursty. > | 'Average' data rate for a any single user is probably in the range of > 1%-3% > | of the burst peaks. > | > | VoIP, on the other hand, has an "average" utilization that > approximates 50% > | of the burst rate. In _both directions. > | > | I suspect that that latter factor is a fair part of the "problem". That > | the cable company has allocated fairly limited bandwidth for the > 'upstream' > | direction (from the customer to the head-end). That that 'available' > | bandwidth is *grossly* over-subscribed, on the "presumption" that traffic > | in that direction would generally be "small", and "infrequent". When > those > | assupmtions get violated, _everything_ goes to h*ll. <wry grin> > | > | Not just for 'he who' commits the violation, but everybody else who is > | sharing that over-subscribed link. > > Well, > > Since I run an ISP that is very small time, > has (at this time) only a single T1 upstream, > all my "subscribers" are wireless clients, > I guess if I have more than 2 subscribers, > I am over subscribed? I'd be willing bet that you do over-subscribe. That's how virtually _every_ provider makes it's money. Selling more downstream bandwidth than it has upstream bandwidth. "On the presumption" that not everybody will be using _all_ the bandwith they 'bought' at the same time. Dunno where you got the 'more than 2 subscribers' bit as defining over- subscribed. Unless you mis-read/mis-interpreted my remark about "50% utilization" for VoIP data. Active VoIP transmission is about 80kbps. on average, somebody is talking about half the time, and listening the other half the time. so you get an "average" of about 40kbps. In each direction. 50% of the 'burst' level. For web traffic, the burst peaks (going downstream) may be a lot higher. but the _average_ traffic level for a customer is a much smaller percentage of the peak level. the bursts are, in effect, much more extreme. And, of course, the upstream traffic is usually 'as nothing', compared to the downstream direction. Unless you've got customers running servers, that is. I'd be surprised if 'requests' from a web client averaged 400 bps for an average customer. Or 1% of a typical VoIP conversation. If somebody designed their system with asymmetric allocation of bandwidh resources between the upstream and downstream direction -- based on the presumption of web-like traffic; VoIP traffic is wildly contrary to 'expectations'. And performance can "go to h*ll". Not only for the VoIP caller, but for everybody else, too. It's not necessarily a result of "bad" network design. Just the usual case of "the world changed out from under you". Implementing the necessary engineering changes, "to make things work right again", can take a while, and cost beaucoup dollars. Which means it may not be _feasable_ to do it, at the price-point of the present service.

1 0