- Test - lists.nanog.org

RE: Specialty Technical Publishers
by Michel Py 19 Aug '04

19 Aug '04

>> Michel Py wrote: >> File a complaint with the BBB of Vancouver, BC. They are known >> to the BBB. Then, let their collection goons waste their time >> and their money, and tell them that if they want to see it back >> they have to send you a prepaid box. > Mike Lewinski wrote: > Ah, excellent pointer! I see the Vancouver BBB lists this > report on their website also indicating a pattern of abuse: > http://166.70.33.197/~van/commonreport.html?bid=105759 Yeah, that's the kind of customer that has a valid address on each side of the US/Canada border, and I'm happy to have their Internet service provided by a competitor. Sooner or later, someone is going to get pissed and let some steam out with one of these $65 DDOS that Alexei mentioned sometime ago. Michel.

1 0

RE: Specialty Technical Publishers
by Michel Py 19 Aug '04

19 Aug '04

> Mike Lewinski wrote: > Has anyone else has run into these scumbags? Sometime last > winter I received a call along the lines of "We'd like to > send you some materials to review". Well, they sent some > "Internet Law encyclopedia" along with an invoice for ~$700. > Of course, there was no cost mentioned in the sales call- > for all I knew they were going to send me a brochure about > their product. I can say with 100% certainty that I would > never have authorized them to send me something like this > had they mentioned the cost without much further discussion > as to what I was receiving. This is just a general heads-up > to a sleazy business practice for a sleazy company that is > now attempting to extort money. File a complaint with the BBB of Vancouver, BC. They are known to the BBB. Then, let their collection goons waste their time and their money, and tell them that if they want to see it back they have to send you a prepaid box. Michel.

2 1

Domain Name System protection
by Joe Shen 18 Aug '04

18 Aug '04

Hi, We are trying to extend our DNS service system in near future. In current stage, it consist of 2 SUN FIRE Server with Solaris8 and BIND9 installed. Each server is configured with a IP address which is known to our customers. The DNS server is set up as Cache Server because it only servers our customers to lookup domain names. We noticed there is continous name resolution requests from IP address outside of our address pool and also there is requests not conforming to DNS documents ( like those from 10/8, 192.168/16 or something for microsoft proxy server name). We think these request waste our resource and we don't want these system stable, secure and high performance. The amount of DNS requests processed in past week is about 0.8Billion. What I'm not sure with designing new Cache Server farm is : 1. Is that really required to protect DNS server by firewall? How does those ISPs, e.g. AT&T, Sprint,mae their DNS system highly available? Could we do that by filtering traffic besides port destinated to port 53? 2. How could we extend our server farm by adding new servers while announcing the same IP addresses to our customers? 3. Is there any evaluation result of DNS server software? e.g. performance, resource required, stability, security etc.? 4. Which hardware/OS platform is better for DNS service? 5. Is that possible to filter those requests not conforming to DNS documents? Each word will be highly appreciated! Joe __________________________________________________ Do You Yahoo!? Download the latest ringtones, games, and more! http://sg.mobile.yahoo.com

13 22

WashingtonPost computer security stories
by Sean Donelan 18 Aug '04

18 Aug '04

The Washington Post is running a group of stories this weekend about computer security and the problems a reporter went through with her Windows 98 computer. Interestingly, instead of ISPs the articles identify other sources of frustration for even technically savvy home computer user with software vendors and overzealous advertisers. A Digital Doctor Treats Computer Contamination http://www.washingtonpost.com/wp-dyn/articles/A64481-2004Aug14.html By Glenn Paterson Special to The Washington Post Sunday, August 15, 2004; Page F01 [...] Her PC was in such bad shape, it required 10 1/2 hours of surgery to restore it to working condition. [...] Finally, I abandoned ship, reinstalling the entire Windows 98 operating system to repair the damage to Internet Explorer and allow Kathleen's computer to access the Internet and update the Norton AntiVirus definitions. [...] So to sum up, I spent one day cleaning up problems created by ne'er-do-well hackers and overzealous advertisers and four more trying to resolve a known problem with a product that is supposed to help prevent problems, not create new ones. Yes, some of the trouble could have been avoided if Kathleen had kept her anti-virus and operating system software up to date. However, much of the responsibility lies with Symantec and the rest of the computer industry. [...] What a Tangled Web I Wove Computer Naivete Cost Me a Bundle And a Bit of Sanity http://www.washingtonpost.com/wp-dyn/articles/A64483-2004Aug14.html By Kathleen Day Washington Post Staff Writer Sunday, August 15, 2004; Page F01 My problem began the last Sunday in July, when my nearly teenage daughter, newly returned from a month away at camp, announced, "Something's wrong with the computer." [...] In fact, her comment marked the start of a much larger headache, one that launched an odyssey that has taken $800 and roughly 48 man-hours over nearly three weeks to end. [...] I wondered if maybe some of the programs I was trying to kill weren't really spyware but something essential to Windows that I shouldn't try to delete. I called Microsoft and was passed from operator to operator as I asked where I could find a list of legitimate Microsoft applications so I would know what to kill and what to leave alone. But the only response I got from one person after another -- most of them in foreign tech-support centers like those in India I had been reading so much about lately -- was that I needed to go to Microsoft's online sales. After 45 minutes of this, I hung up. Then I gave up. I actually stood up and walked away from my computer. [...]

23 28

RE: Current street prices for US Internet Transit
by William B. Norton 18 Aug '04

18 Aug '04

Thanks to all who replied with data, and yes, the pricing was all 95th percentile. Wow - the U.S. has an amazingly unhealthy and cut throat transit market in 2004. About 20 folks responded, most saying the Peering Coordinator quotes (below) sounded about right. > > ISP Transit Commits and Prices > >--------------------------------------------------------------------------------------------------------------------- > > if you commit to 1M per month you will pay about $125/Mbps > > if you commit to 10M per month you will pay about $ 60/Mbps > > if you commit to 100M per month you will pay about $45/Mbps > > if you commit to 1000M per month you will pay about $30/Mbps A couple people said these prices were TOO HIGH, particularly for the gig commit, although several multi-gig commits came in tiered; for example, $45/Mbps for 1G commit, $35 for 2G, etc. on down to $21 for 8G commit. (One Tier 2 ISP said that they sold 1G commit as low as $18/Mbps, presumably simply reselling Tier 1 BW so the difference may be negligible.) Three said that these transit prices were TOO LOW, in one case they paid about double these numbers. It was interesting that these three were a content company, a cable company and a DSL company, folks who traditionally don't sell transit. Maybe they are in a retail market for transit, while everyone else buys in the wholesale market. Since so many said these prices are about right, I'll use them for the Peering versus Transit analysis. A couple people pointed to the 10M commit being closer to $80/Mbps, so that may be an adjustment. Given the adjustment, I thought you might be interested in how the U.S. transit prices compare against a handful of other Peering Ecosystems: The Cost of Internet Transit in Commit AU SG JP HK USA 1 Mbps $720 $625 $490 $185 $125 10 Mbps $410 $350 $150 $100 $80 100 Mbps $325 $210 $110 $80 $45 1000 Mbps $305 $115 $50 $50 $30 Round numbers anyway FWIW. Hope this helps. I feel bad for those selling transit these days - at these prices, margins must be mighty thin, and I suspect we will see some more turbulence in the industry. Bill

19 35

Re: SYN flood atacks?
by jgraun＠comcast.net 18 Aug '04

18 Aug '04

Sorry I didnt take the smart ass factor into account when I posted. I have heard that AOL and other mega proxies have been sending enough SYN floods (DDoS style) to knock over Discover and Allstate. I am not talking about small amounts of normal traffic. Jason -------------- Original message -------------- > > > On Tue, 17 Aug 2004 jgraun(a)comcast.net wrote: > > I have been hearing rumors about some SYN flood atacks on the Internet > > today. Anybody hear anything? > > You will need to be more specific. > > There are syn flood attacks, icmp attacks, udp attacks, tcp attacks, dns > attacks, http attacks, im attacks, ipsec attacks, etc going on every day, > all day. > >

3 2

Cisco Security Advisory: Cisco IOS Malformed OSPF Packet Causes Reload
by Cisco Systems Product Security Incident Response Team 18 Aug '04

18 Aug '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Malformed OSPF Packet Causes Reload Revision 1.0 For Public Release 2004 August 18 15:00 UTC (GMT) - ---------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures - ---------------------------------------------------------------------------- Summary ======= A Cisco device running Internetwork Operating System (IOS) and enabled for the Open Shortest Path First (OSPF) protocol is vulnerable to a Denial of Service (DoS) attack from a malformed OSPF packet. The OSPF protocol is not enabled by default. The vulnerability is only present in Cisco IOS release trains based on 12.0S, 12.2, and 12.3. Releases based on 12.0, 12.1 mainlines, and all Cisco IOS images prior to 12.0 are not affected. Cisco has made free software available to address this vulnerability. There are workarounds available to mitigate the effects. This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20040818-ospf.shtml. Affected Products ================= Vulnerable Products This vulnerability was introduced by a code change that was committed to the 12.0S, 12.2, and 12.3 based release trains, causing these trains to be vulnerable. All Cisco devices running a vulnerable release train and running OSPF process are vulnerable. Some release trains that are not vulnerable are explicitly listed below for clarification. The release trains that are not mentioned below are not vulnerable. +---------------------------------------------+ | Release Train | Vulnerable | | | Versions | |-------------------------------+-------------| | 10.x based releases | Not | | | vulnerable | |-------------------------------+-------------| | 11.x based releases | Not | | | vulnerable | |-------------------------------+-------------| | 12.0 based releases (except | Not | | for 12.0.S based releases) | vulnerable | |-------------------------------+-------------| | 12.1 based releases | Not | | | vulnerable | |-------------------------------+-------------| | 12.0.S | 12.0(22)S | | | and later | |-------------------------------+-------------| | 12.0.SX | 12.0(23)SX | | | and later | |-------------------------------+-------------| | 12.0.SY | 12.0(22)SY | | | and later | |-------------------------------+-------------| | 12.0.SZ | 12.0(23)SZ | | | and later | |-------------------------------+-------------| | 12.2 mainline | Not | | | vulnerable | |-------------------------------+-------------| | 12.2.B | 12.2(15)B | | | and later | |-------------------------------+-------------| | 12.2.BC | 12.2(15)BC | | | and later | |-------------------------------+-------------| | 12.2.BX | 12.2(15)BX | | | and later | |-------------------------------+-------------| | 12.2.BZ | 12.2(15)BZ | | | and later | |-------------------------------+-------------| | 12.2.CX | 12.2(15)CX | | | and later | |-------------------------------+-------------| | 12.2.EW | 12.2(18)EW | | | and later | |-------------------------------+-------------| | 12.2.MC | 12.2(15)MC1 | | | and later | |-------------------------------+-------------| | 12.2.S | 12.2(18)S | | | and later | |-------------------------------+-------------| | 12.2.SE | 12.2(18)SE | | | and later | |-------------------------------+-------------| | 12.2.SV | 12.2(18)SV | | | and later | |-------------------------------+-------------| | 12.2.SW | 12.2(18)SW | | | and later | |-------------------------------+-------------| | 12.2.SZ | 12.2(14)SZ | | | and later | |-------------------------------+-------------| | 12.2.T | 12.2(15)T | | | and later | |-------------------------------+-------------| | 12.2.YU | 12.2(11)YU | | | and later | |-------------------------------+-------------| | 12.2.YV | 12.2(11)YV | | | and later | |-------------------------------+-------------| | 12.2.ZD | 12.2(13)ZD | | | and later | |-------------------------------+-------------| | 12.2.ZE | 12.2(13)ZE | | | and later | |-------------------------------+-------------| | 12.2.ZF | 12.2(13)ZF | | | and later | |-------------------------------+-------------| | 12.2.ZG | 12.2(13)ZG | | | and later | |-------------------------------+-------------| | 12.2.ZH | 12.2(13)ZH | | | and later | |-------------------------------+-------------| | 12.2.ZJ | 12.2(15)ZJ | | | and later | |-------------------------------+-------------| | 12.2.ZK | 12.2(15)ZK | | | and later | |-------------------------------+-------------| | 12.2.ZL | 12.2(15)ZL | | | and later | |-------------------------------+-------------| | 12.2.ZN | 12.2(15)ZN | | | and later | |-------------------------------+-------------| | 12.2.ZO | 12.2(15)ZO | | | and later | |-------------------------------+-------------| | 12.3 | All 12.3 | | | releases | |-------------------------------+-------------| | 12.3.B | All 12.3.B | | | releases | |-------------------------------+-------------| | 12.3.BW | All 12.3.BW | | | releases | |-------------------------------+-------------| | 12.3.T | All 12.3.T | | | releases | |-------------------------------+-------------| | 12.3.XA | All 12.3.XA | | | releases | |-------------------------------+-------------| | 12.3.XB | All 12.3.XB | | | releases | |-------------------------------+-------------| | 12.3.XC | All 12.3.XC | | | releases | |-------------------------------+-------------| | 12.3.XE | All 12.3.XE | | | releases | +---------------------------------------------+ A Cisco device which is running an OSPF process will have a line in the configuration defining the process number, which can be seen by issuing the command show running-config: router ospf {process number} To determine the software running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the Cisco IOS release name. Other Cisco devices will not have the show version command, or will give different output. The following example identifies a Cisco product running Cisco IOS release 12.0 (3) with an installed image name of C2500-IS-L: Cisco Internetwork Operating System Software IOS (TM) 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE The release train label is "12.0." The next example shows a product running Cisco IOS release 12.0(2a)T1 with an image name of C2600-JS-MZ: Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1) Additional information about Cisco IOS release naming can be found at http://www.cisco.com/warp/public/620/1.html. Products Confirmed Not Vulnerable * Products that are not running Cisco IOS are not affected. * Products running Cisco IOS versions 12.0 and earlier (excluding 12.0 S), 12.1 mainline and 12.2 mainline are not vulnerable. * Products running IOS release trains that are not mentioned in the above table are not vulnerable. * Products running any version of Cisco IOS that do not have OSPF configured are not vulnerable. Details ======= OSPF is a routing protocol defined by RFC 2328. It is designed to manage IP routing inside an Autonomous System (AS). OSPF packets use IP protocol number 89. A vulnerability exists in the processing of an OSPF packet that can be exploited to cause the reload of a system. Several parameters need to be known by an attacker to successfully exploit this vulnerability. These are the OSPF area number, netmask, hello, and dead timers that are configured on the targeted interface. Since OSPF needs to process unicast packets as well as multicast packets, this vulnerability can be exploited remotely. It is also possible for an attacker to target multiple systems on the local segment at a time. Using OSPF Authentication as described in the workarounds section can be used to mitigate the effects of this vulnerability. Using OSPF Authentication is a highly recommended security best practice A Cisco device receiving a malformed OSPF packet will reset and may take several minutes to become fully functional. This vulnerability may be exploited repeatedly resulting in an extended DOS attack. This issue is documented in bug ID CSCec16481. Impact ====== Successful exploitation of this vulnerability results in a reload of the device. Repeated exploitation could result in a sustained DoS attack. Software Versions and Fixes =========================== +--------------------------------------------------+ | Major | Availability of Repaired Releases* | | Release | | |------------+-------------------------------------| | Affected | | | | | 12.0-Based | Rebuild | Interim** | Maintenance | | Release | | | | |------------+-----------+-----------+-------------| | | 12.0(22) | | | | |S6 | |-------------| | | | | | | |-----------| |-------------| | | 12.0(23) | | | | | S5 | | | | |-----------+-----------+-------------| | | 12.0(24) | | | | | S2c | | | | |-----------+-----------+-------------| | 12.0(22)S | 12.0(24) | | | | and later | S4 | | | | |-----------+-----------+-------------| | | 12.0(25) | | | | | S1d | | | | |-----------+-----------+-------------| | | 12.0(25) | | | | | S2 | | | | |-----------+-----------+-------------| | | 12.0(26) | | | | |S1 |-----------|12.0(27)S | | | | | | |------------+-----------+-----------+-------------| | 12.0(23)SX | 12.0(25) | | | | and later | SX2 | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.0(22)SY | to 12.0 | | | | and later | (23)S5 or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.0(23)SZ | | | 12.0(27)SZ | | and later | | | | |------------+-----------+-----------+-------------| | Affected | | | | | 12.2-Based | Rebuild | Interim** | Maintenance | | Release | | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)B | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | 12.2(15) | | | | 12.2(15)BC | BC1c | | | |and later |-----------| | | | | 12.2(15) | | | | | BC2 | | | |------------+-----------+-----------+-------------| | | 12.2(16) | | | | | BX | | | | 12.2(15)BX | Migrate | | | | and later | to 12.3 | | | | | (7)XI1 or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)BZ | to 12.3 | | | | and later | (7)XI1 or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)CX | to 12.2 | | | | and later | (15)BC2 | | | | | or later | | | |------------+-----------+-----------+-------------| | 12.2(18)EW | 12.2(18) | | | | | EW1 | | | |------------+-----------+-----------+-------------| | | 12.2(15) | | | | 12.2(15) | MC2a | | | | MC1 and | available | | | | later | upon | | | | | request | | | |------------+-----------+-----------+-------------| | 12.2(18)S | 12.2(18) | | 12.2(20)S | | and later | S5 | | | |------------+-----------+-----------+-------------| | 12.2(18)SE | | | 12.2(20)SE | | and later | | | | |------------+-----------+-----------+-------------| | 12.2(18)SV | | | 12.2(22)SV | | and later | | | | |------------+-----------+-----------+-------------| | 12.2(18)SW | | | 12.2(20)SW | | and later | | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(14)SZ | to 12.2 | | | | and later | (20)S4 or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.2(15)T | 12.2(15) | | | | and later | T8 | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(11)YU | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(11)YV | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.2(13)ZD | Migrate | | | | and later | to 12.3T | | | | | or later | | | |------------+-----------+-----------+-------------| | 12.2(13)ZE | Migrate | | | | and later | to 12.3 | | | | | or later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(13)ZF | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(13)ZG | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(13)ZH | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.2(15)ZJ | Migrate | | | | and later | to 12.3T | | | | | or later | | | |------------+-----------+-----------+-------------| | 12.2(15)ZK | 12.2(15) | | | | and later | ZK2 | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)ZL | to 12.3 | | | | and later | (7)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)ZN | to 12.3 | | | | and later | (2)T4 or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)ZO | to 12.2 | | | | and later | (15)T8 or | | | | | later | | | |------------+-----------+-----------+-------------| | Affected | | | | | 12.3-Based | Rebuild | Interim** | Maintenance | | Release | | | | |------------+-----------+-----------+-------------| | 12.3 | 12.3(3f) | | 12.3(5) | |------------+-----------+-----------+-------------| | 12.3B | 12.3(5a)B | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.3BW | to 12.3B | | | | | or later | | | |------------+-----------+-----------+-------------| | 12.3T | 12.3(2)T4 | | 12.3(4)T | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.3XA | to 12.3 | | | | | (7)T or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.3XB | 12.3(2) | | | | | XB3 | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.3XC | to 12.3 | | | | | (8)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.3XE | to 12.3 | | | | | (8)T or | | | | | later | | | +--------------------------------------------------+ Obtaining Fixed Software ======================== Customers with Service Contracts Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers without Service Contracts Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. Workarounds =========== The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. There are multiple workarounds available to mitigate the effects of this vulnerability. Using OSPF Authentication OSPF authentication may be used as a workaround. OSPF packets without a valid key will not be processed. MD5 authentication is highly recommended, due to inherent weaknesses in plain text authentication. With plain text authentication, the authentication key will be sent unencrypted over the network, which can allow an attacker on a local network segment to capture the key by sniffing packets. Refer to http://www.cisco.com/warp/public/104/25.shtml for more information about OSPF authentication. Infrastructure Access Control Lists Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/public/707/iacl.html. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Status of This Notice: FINAL ============================ THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. Distribution ============ This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20040818-ospf.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * vulnwatch(a)wulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.netsys.com * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------------+ | Revision | 2004-August-18 | Initial public | | 1.0 | | release. | +---------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. - ---------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBI2heezGozzK2tZARApWuAJ9hmienPQRYULzhMITiWgDd3qOGggCfflUY mTLgN7sQ7dF2G0THEwF6B4s= =zZm1 -----END PGP SIGNATURE-----

1 0

BGP-based blackholing/hijacking patented in Australia?
by Bevan Slattery 18 Aug '04

18 Aug '04

Hi, Just to ease peoples concerns, the patent has nothing to do with blackholing. A brief description of the way it works can be found here: http://www.scamslam.com/ScamSlam/whatis.shtml We have not disclosed the site address to the "public" at this stage, the text of the site is only draft form for the purposes of editing and needs to be "polished". Perhaps the article wasn't as articulate in conveying this, but I'm sure you appreciate journalists sometimes don't get it right :) Kind Regards Bevan Slattery PIPE Networks ______________________________________ PIPE Networks/IX Services Australia disclaimer The above email should be read in conjunction with our standard disclaimer/terms which can be found at : http://www.pipenetworks.com/docs/disclaimer.htm

10 13

"Internode Nodemap" network visualization/monitoring software
by Mark Newton 18 Aug '04

18 Aug '04

Posted here on the assumption that some will find it useful: http://nodemap.internode.on.net # Internode Nodemap performs SNMP queries against network devices to # determine the status of network links in complicated networks. # # Using the results of those probes, Nodemap produces visualizations # to convey the "holistic" state of the network. A "drill-down" user # interface is provided which permits detailed link-by-link status # information to be presented at low-levels, with abstracted # summarizations available at higher levels. This enables network # operations staff to determine the current state of a network with # a single glance, without regard to topology complications or the # number of devices on the network. It's GPLed. Simple config examples, screenshots, vast quantities of documentation and mailing list subscription details are on the website referenced above. - mark -- Mark Newton Email: newton(a)internode.com.au (W) Network Engineer Email: newton(a)atdot.dotat.org (H) Internode Systems Pty Ltd Desk: +61-8-82282999 "Network Man" - Anagram of "Mark Newton" Mobile: +61-416-202-223

1 0

RE: Current street prices for US Internet Transit
by Michel Py 18 Aug '04

18 Aug '04

> William B. Norton wrote: > First - As for whether the US Transit > market is healthy or unhealthy... Hmm. For this one topic I think I have the best explanation in the world (tm): it's unhealthy if you bite the dust, it's healthy if one of your competitors bites the dust :-) > It certainly appears that the majors can't make money in > this transit market, and they would probably say that the > bottom feeders are greasing the skids to financial ruin > for this industry. Indeed, and see above. That being said, historically (and valid only for that long) dominant players in a given industry are the ones that survived the slide with greased skids. >> Michel Py wrote: >> Someone mentioned that this was comparing apples to >> oranges. Indeed it is, <stuff deleted> > I would disagree that these are apples and oranges > comparisons - these are real prices (normalized to USD) > for transit that someone in the country would pay to > access the big 'I' Internet. I misread Patrick and withdraw my statement. In the context you meant it, these are apples to apples. What Patrick meant though (which remains extremely valid) (2nd disclaimer, forgive my poor English) is that comparing what it takes to build and/or sell transit in different countries is comparing apples to oranges. However, what you wrote as being the cost of connecting to the big "I" is totally valid (that's where I was trying to get to with my P2P comparison) and has indeed to be understood WRT to Joe's comments: > Joe Abley wrote: > http://www.economist.com/markets/Bigmac/Index.cfm > I suppose a more direct analogy to the Big Mac Index would be > to take some usefully-accurate measure of transit costs in each > country, and use that to weight a comparison between other > related commodities (cell phone calls? televisions? computers?) Please accept my entry for the Big Mac Index: One Mbps worth of residential traffic, link always-on, unlimited, un-metered, in an urban area within 12,000ft of the CO. Valid between 500 Kbps and 3 Mbps, pro-rated to 1Mbps. Please fill-in the blanks, convert your local currency to US$ and send it to me privately, I will post summary results to the ML. Then we can compare to the cost of transit as Bill posted yesterday and have a better grasp at the relevance of the BMI. +-------+----------+---+----+-----+-------+-------+ |Country| State / |ISP|Link|Speed|Monthly|Monthly| | | Province | |type|Mbps | cost | /Mbps | +-------+----------+---+----+-----+-------+-------+ | USA |California|SBC|DSL | 2.5 | US$37 | US$15 | +-------+----------+---+----+-----+-------+-------+ | .. | .... | | | | | | +-------+----------+---+----+-----+-------+-------+ ^ | Big Mac Index > Eric Kuhnke wrote: > You can peg a 100Mb/s FTTH line (which costs about $65 > USD/month on a 1 year contract) from Chunghwa Telecom in > Taipei 24/7, as long as the majority of your traffic > stays on the island of Taiwan... This is not connecting to the big "I" because there are strings attached to it; it's just like an ISP saying "traffic to a web site we also host is free". Joe Consumer does not give a rip to this concept: when he surfs the net it does not matter where the site is. Michel.

1 0