- Test - lists.nanog.org

NANOG 34: Call for Presentations
by Steve Feldman 07 Mar '05

07 Mar '05

* * * * * * * * * * * * * * * * * CALL FOR PRESENTATIONS NANOG 34 May 15-17, 2005 * * * * * * * * * * * * * * * * * The North American Network Operators' Group (NANOG) will hold its 34th meeting May 15-17, 2005, in Seattle, Washington. The meeting will be hosted by Switch and Data and held at the Westin Seattle. NANOG conferences provide a forum for information exchange among network operators, engineers, and researchers. Meetings are held three times each year, and include presentations, tutorial sessions, and BOFs. The meetings are informal, with an emphasis on relevance to current engineering practices. NANOG solicits presentations highlighting issues relating to technology already deployed or soon to be deployed in the Internet. Vendors are encouraged to work with operators to present deployment experiences with the vendor's products and interoperability. The community is invited to present talks or tutorials on: - VOIP architectures and deployment - Peering/collocation coordination issues - Security attacks/mitigation, tools, and analysis - Content provider issues - MSO IPTV deployment and operations - Backbone operational case studies - Exchange point technologies and implementation - Non-telco, last-mile technologies (metro/rural, broadband, radio, and optical) - Implementation experience with Ethernet, e.g., TLS, VPLS, Ethernet private line, and VPWS. - Wavelength use by enterprises - Large-scale wireless deployment - Experiences with native IPv6 transport rollout - State of OAM tools for IP and MPLS networks - Options for blackhole and discard routing - BGP/MPLS layer 3 VPNs - Other interesting network technologies Topics for short (10-20 minute) lightning talks will be solicited on-site in Seattle. Researchers are invited to present short (10-minute) summaries of their work for operator feedback. Topics include routing, network performance, statistical measurement and analysis, and protocol development and implementation. Studies presented may be works in progress. Researchers from academia, government, and industry are encouraged to present. How to Present -------------- Submit an abstract and draft slides for the presentation in email to nanog-support(a)nanog.org. See http://www.nanog.org/presentations.html for submission guidelines. The deadline for abstracts and slides is April 4, 2005. While the majority of speaking slots will be filled by April 4, a limited number of slots may be available after that date for topics that are exceptionally timely, important, or critical to the operations of the Internet. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by April 18. Final drafts of presentation slides are due by May 4, and final versions May 11.

1 0

DNS Blackhole attack
by william(at)elan.net 07 Mar '05

07 Mar '05

[forward from namedroppers ietf dns wg mail list, of interest to nanog] This just appeared on the SANS list. Time to stop arguing and get DNSSEC deployed. Global DNS cache poisoning attack?; Update... We are currently investigating a report from several sites that indicate users being re-directed to malware sites. At this time it appears to be a DNS cache poisoning attack (not a spyware, adware, or browser hijack) and we are seeking more information. Popular domain names such as google.com, ebay.com, and weather.com are being directed to the following servers. Of course when connecting to these servers, "bad things" (tm) will happen, so don't go to them. www.7sir7.com (217.160.169.87) 123xxl.com (217.160.169.87, 207.44.240.79, 216.127.88.131) abx4.com (217.160.169.87, 207.44.240.79, 216.127.88.131) If your site has been affected, please submit the following information: 1. When the attack was first noticed and whether it is still occurring. 2. What DNS server software you having facing the Internet. This information will be kept in strictest confidence. 3. If you identified any other sites that users were being re-directed to (besides the ones listed above). Updates will be made to this diary as we find out more information. Update at 23:40 UTC There appear to be two issues at hand. The first is the DNS cache poisoning. At this time, it appears to be affecting Symantec firewalls with DNS caching. If you recall, there was a vulnerability back in July that made these products very succeptable to DNS cache poisoning. Some victims have responded that they applied the patch, but were still affected. So this could be a different vulnerability or the patch didn't work properly. Maybe someone at Symantec could enlighten us? http://securityresponse.symantec.com/avcenter/security/Content/2004.06.21.ht ml The second issue is the ABX toolbar spyware that gets loaded onto the machine when visiting the target servers. This appears to happen using an ActiveX control. Users running Windows XP SP2 or a web browser that does not support ActiveX will probably not get hit with the spyware if they visit the server. Unfortunately, information on the ABX toolbar spyware is very limited at this time and it doesn't seem to be detected yet by the normal toolset of spyware/antivirus tools. In the meantime, we have been working to get the IP addresses and DNS servers supporting this attack shutdown. Some of the IP addresses are already blackholed. [eof]

3 2

Re: vonage routing issues
by John Neiberger 07 Mar '05

07 Mar '05

>>> Jon Lewis <jlewis(a)lewis.org> 3/4/05 1:17:11 PM >>> > >Anyone else having reachability issues with Vonage? The past two days, >about this time (~2pm), we've been unable to reach www.vonage.com and >customers with vonage phones have lost their service. > >My traces to them end with: > >13. 64.200.88.173 0% 8 8 32 31 33 42 >14. nycmny2wcx2-pos1-0-oc192.wcg.net 0% 8 8 37 37 70 176 >15. ??? Interesting. I can't get to them, either. A trace from my site to theirs (via Sprint) ends here: border23.ge2-0-bbnet1.nyc.pnap.net (209.191.128.92) [AS 10910] John --

15 21

public accessible snmp devices?
by Vicky Rode 07 Mar '05

07 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, Just wondering if there are any pool of public accessible (read-only) snmp enabled devices that one can access for testing purposes (such as snmpwalk, polling devices via oid/mib, graphing chart..etc)? I'm looking for a pool of devices that I run my test on. Any pointers will be appreciated. regards, /virendra -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFCJzLfpbZvCIJx1bcRAqLcAJ95PzxXE4v51JgzTpeqfuEDZG6ibgCaAg20 WJxjcsJYroHriTPr635QOBE= =SV3b -----END PGP SIGNATURE-----

6 12

Vonage service suffers outage
by Fergie (Paul Ferguson) 07 Mar '05

07 Mar '05

Amidst all the hoopla w.r.t. "port blocking" their service, this outage couldn't have come at a worse time, methinks. The outage on Friday "left about half of its 500,000 subscribers without phone service for about 45 minutes" and "... was caused by a glitch with a software upgrade on Thursday night." http://www.detnews.com/2005/technology/0503/07/tech-109316.htm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

3 2

RE: US slaps fine on company blocking VoIP
by Network.Security 07 Mar '05

07 Mar '05

Do you also offer premium "80" traffic? Or guaranteed delivery of UDP? Unbundled services will give the best price, and good service. Maybe we won't get the service anytime soon, but 2 out of the magical 3 isn't bad. bradley.swanson(a)target.com -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Adi Linden Sent: Monday, March 07, 2005 8:46 AM To: Bill Nash Cc: Robert Blayzor; nanog(a)nanog.org Subject: Re: US slaps fine on company blocking VoIP > If VOIP doesn't run on your network because you've oversold your > capacity, no amount of QoS is going to put the quality back into your service. > People will find better ISPs. If you deliberately set QoS to favor > your services over a competitor, whom your customers are also paying > for service, you'll be staring down prosecutors, at some point. It's > anti-competitive behavior, as you're taking deliberate actions to > degrade the service of a competitor, simply because you can. Let's say I sell a premium VoIP offering for an additional fee on my network. I apply QoS to deliver my VoIP offering to my customers but as a result all other VoIP service is literally useless during heavy use times you'd consider this anti-competitive behavior? Adi

1 0

Utah considers law to mandate ISP's block "harmful" sites
by Fergie (Paul Ferguson) 07 Mar '05

07 Mar '05

"The Utah governor is deciding whether to sign a bill that would require Internet providers to block Web sites deemed pornographic and that could also target e-mail providers and search engines." http://news.com.com/Utah+governor+weighs+antiporn+proposal/2100-1028_3-5598… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

14 14

Re: Is current DDoS detecting method effective?
by Joe Shen 07 Mar '05

07 Mar '05

Hi, > It frightens me that you're sitting on 11Gb/s+ and > unable to utilize > existing toold to determine what is within profile > for your network and > what is not. That what makes me think it's not possible to determine "legal" traffic model by available tools. The total BW keeps increasing, and network attack keeps going on. We could estimate traffic scheme by monitoring BW utilized, but it may has exhaust customer's server resource when we consider those DoS packet with our traffic scheme. So, Arbor and alike may be useful to enterprise users, but to ISPs its effectiveness is questionable. > > I'm certain that you'll be contacted by many > commercial vendors who have > working profiling solutions. I've discussed with some persons, they just disclame but no demonstration and analysis. Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

1 0

Re: Is current DDoS detecting method effective?
by Fergie (Paul Ferguson) 07 Mar '05

07 Mar '05

That, my friend, is the crucible. What can we do? First off, stop bickering. - ferg -- Joe Shen <joe_hznm(a)yahoo.com.sg> wrote: So, how can we do with DoS in ISP network? -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

drone armies C&C report - Feb/2005
by Gadi Evron 06 Mar '05

06 Mar '05

Below is a periodic public report from the drone armies / botnets research and mitigation mailing list. For this report it should be noted that we base our analysis on the data we have accumulated from various sources. According to our incomplete analysis of information we have thus far, we now publish two reports. The ISP's that are most often plagued with botnet C&C's (command & control) are, by the order listed: ---------------------------------- Responsible Party Count ASN SAGONE Sago Networks 16-20 21840 THEPL-1 THE PLANET* 16-20 {21844,13884} PNAP Internap Network Services 11-15 {10913,13790,14742,14744} STAMIN-2 Staminus Communicatio 11-15 25761 ATRIV Atrivo 11-15 27595 MSG-48 Managed Solutions Group 8-10 27645 YIPS Yipes Communications Inc 8-10 6517 LEVEL3 Level 3 Communications 8-10 3356 * Note that the above details are only for botnet C&C's that are still active. * We would gladly like to establish a trusted relationship with these and any organizations to help them in the future. * Please note the serious decrease in live Korean botnets, largely due to the efforts of KrCERT. The Trojan horses most used in botnets: --------------------------------------- The below details have not changed much, although we are seeing an increase in rBot variants. 1. Korgobot. 2. SpyBot. 3. Optix Pro. 4. rBot. 5. Other SpyBot variants and strains (AgoBot, PhatBot, actual SDbots, etc.). Contact information: Hank Nussbacher <hank(a)mail.iucc.ac.il> Gadi Evron (as specified below) -- Gadi Evron, Information Security Manager, Project Tehila - Israeli Government Internet Security. Ministry of Finance, Israel. gadi(a)tehila.gov.il gadi(a)CERT.gov.il Office: +972-2-5317890 Fax: +972-2-5317801 http://www.tehila.gov.il The opinions, views, facts or anything else expressed in this email message are not necessarily those of the Israeli Government.

1 0