- Test - lists.nanog.org

Cellphone Virus
by Edward B. Dreger 15 Jun '04

15 Jun '04

Scratch the comments about telephone CPE not being hacked and rolling up big bills. Interesting timing considering the recent circlej^H^H^H^H^H^H^Hthreads re who's responsible for what. http://www.newscientist.com/news/news.jsp?id=ns99995111 Eddy -- EverQuick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

(Routing-101) Protocol redistribution question BGP into OSPF
by Rich Sena 15 Jun '04

15 Jun '04

Working on what I thought was going to be an easy solution - but hey... Have 2 campus networks with 2 different autonomies now joined together. As an initial step we will leave the different autonomies and try to glue them together. Each campus has a distinct OSPF network and each campus has separate BGP peering sessions with unique AS's at it's borders. What we are trying to do is this. The campuses are connected via 2 PtP circuits that are internal to each campus. We have established separate BGP peering on each circuit - completely distinct from one another. We chose iBGP because of some 3rd party sites that are dual homed to each campus, local-pref seemed to be the best way to deal with route preference. So each site is using the same ASN on these internal iBGP sessions. But there are 2 main peering routers and at each campus (i-e: not a full mesh but 2 separate iBGP instances). The routers on the same campus do not peer with one another. Rather each router in addition to the BGP session is an ASBR into a common OSPF area on each campus. The thought is that the routes learned from iBGP will be redistributed and weighted via OSPF into the local campus WAN. There are 3 entry points into each LAN from a BGP/OSPF transition - each is independent of the other and each will originate default into OSPF. Now the quandary is this - how to get the campus routes to exchange from BGP - to OSPF and back again - *without enabling* "redistribute internal" on BGP. A few of us are/were of the opinion that once the routes are populated in the routing table from BGP - the OSPF instance would then re-advertise them since they are valid routes (of course with a specific network statement in OSPF) but practice is telling us that this is not working. The only way we can get this working at all is by enabling "redistribute internal" in BGP and then redistributing BGP in OSPF with a route filter. Does anyone have something similar working with a method differing from "redistribute internal" in BGP. Please contact me off-list. -- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0

RE: "Default" Internet Service
by Smith, Donald 15 Jun '04

15 Jun '04

First are the consumers willing to pay for a "safer" internet DSL/dial/isdn? I believe if they were there would be a safer service available. I have seen several "secure" isp's fail in the last few years. If you have any data that shows that there is a market for a more secure dialup/DSL/isdn... please share it. 2nd blaming infected machines on the internet is similar to blaming your postal carrier for bringing you junk mail and bills. About 1/2 of all of the large "infection" events on the internet are the result of people running unpatched unsecured applications on their machines. The other half of the infections I see are due to an end user opening an email and running an attachment. Even with a secure OS this simple method of infection will continue to work. How and when did it become the responsibility of the ISP to protect the end users machines? Do ISP's get paid to protect end user machines? If you want to blame someone maybe the company that provided the insecure os that requires monthly patches to fix portions of the broken code they sold. Or you could blame the end users who open unknown attachments. I would like a real solution to the problem. Simply blocking ports is not successful. So I recommend 2 steps. First buy OS's that are more secure out of the box. 2nd Teach users NOT to click on every thing they see. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC Brian Kernighan jokingly named it the Uniplexed Information and Computing System (UNICS) as a pun on MULTICS. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Matthew Sullivan > Sent: Sunday, June 13, 2004 5:02 PM > To: nanog > Subject: Re: "Default" Internet Service > > > > Christopher L. Morrow wrote: > > >On Sat, 12 Jun 2004, John Curran wrote: > > > > > > > >>The real challenge here is that the "default" Internet service is > >>wide-open Internet Protocol, w/o any safeties or controls. This > >>made a lot of sense when the Internet was a few hundred > sites, but is > >>showing real scaling problems today (spam, major viruses, > >>etc.) > >> > >>One could imagine changing the paradigm (never easy) so that the > >>normal Internet service was proxied for common applications > and NAT'ed > >>for everything else... This wouldn't eliminate all the > problems, but > >>would dramatically cut down the incident rate. > >> > >> > > > >This sounds like a fantastic idea, for instance: How much direct IP > >does joe-average Internet user really require? Do they > require anything > >more than imap(s)/pop(s)/smtp(+tls) and dns/http/https ? I > suppose they > >also > >need: > >1) internet gaming > >2) voip > >3) kazaa/p2p-app(s)-of-choice > >4) IM > > > >Actually I'm sure there are quite a few things they need, > things which > >require either very smart NAT/Proxy devices or open access. The > >filtering of IP on the broad scale will hamper creativity and > >innovation. I'm fairly certain this was not what we want in the long > >term, is it? > > > > > I acutally suggested something like this at the recent AusCERT 2004 > conference... It's not such a bad idea.... > > The real question being "why are we giving mum's and dad's > who sign up > to the internet, and know nothing about either the Internet or > computers, full unrestricted incoming and outgoing access...?" ... > answer because the more bandwidth they use the more the ISP > earns... so > the ISPs don't care (in some cases) if the mum's and dad's > get trojaned, > because it's all money. > > My suggestion to the AusCERT delegates was to introduce a new default > service which has very limited access, and if people ask for > more, give > them the access after they have read through various 'educational' > pages.... Perhaps a simple online quiz at the end -just 3-5 > questions > with the answers being very clearly explained in the previous pages - > just to show the people have actually read the pages, rather than > skipped to the end and hit 'I accept'. > > I also suggested that if ISPs have the technology perhaps a simple IP > pools method of allocating the users IP, where they could turn on and > turn off access to certain protocols - eg: have a pool for > P2P users, a > pool for VOIP etc... > > / Mat > > > >

9 12

Assurant
by Daniel Corbe 15 Jun '04

15 Jun '04

If anyone from the Assurant Group monitors nanog, please contact me off-list. Regards, Daniel Corbe Senior Network Engineer Results Techologies, Inc. 954-921-2400 x104

1 0

RE: Akamai DNS Issue?
by wrolf.courtney＠donovandata.com 15 Jun '04

15 Jun '04

People seem to be getting around this by changing their DNS entries. E.g. www.yahoo.com always used to be a CNAME for www.yahoo.akadns.net. But now: # host www.yahoo.com www.yahoo.com is an alias for www.dcn.yahoo.com. www.dcn.yahoo.com has address 216.109.118.64 www.dcn.yahoo.com has address 216.109.118.65 www.dcn.yahoo.com has address 216.109.118.66 www.dcn.yahoo.com has address 216.109.118.67 www.dcn.yahoo.com has address 216.109.118.68 www.dcn.yahoo.com has address 216.109.118.69 www.dcn.yahoo.com has address 216.109.118.70 www.dcn.yahoo.com has address 216.109.118.71 www.dcn.yahoo.com has address 216.109.118.72 www.dcn.yahoo.com has address 216.109.118.73 www.dcn.yahoo.com has address 216.109.118.74 www.dcn.yahoo.com has address 216.109.118.75 Which is owned by Yahoo! (via HotJobs.com) Wrolf Courtney

1 0

Re: Points on your Internet driver's license (was RE: Even you can
by Paul Vixie 15 Jun '04

15 Jun '04

> So you claim even the ISPs you ran yourself have never attempted to do > any of these things? the last access-side isp i had anything to do with running used uucp and shell and was just getting going on c-slip when i pushed off. (i assure that any rmail or rnews spam was grounds for suspension during my watch.) my last gig at a colo-side isp ended with me moving over to paix due to the board's discomfort over my policies toward certain colo-side customers (who have since improved, yay.) > If you didn't do them, why do you think other people should? so you aren't going to google for "chemical polluter business model", huh?

21 42

RE: Akamai DNS Issue?
by Pranav Sheth 15 Jun '04

15 Jun '04

Seems to be the same thing here in DFW, Texas Google is accessible and yahoo is not fully functional (login pages fail). -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Tycho Eggen Sent: Tuesday, June 15, 2004 8:18 AM To: nanog(a)merit.edu Subject: Re: Akamai DNS Issue? On Tue, Jun 15, 2004 at 09:08:40AM -0400 Leo Bicknell(bicknell(a)ufp.org) wrote: > > From here neither www.google.com, nor www.apple.com work. Both seem > to return CNAMES to akadns.net addresses (eg, www.google.akadns.net, > www.apple.com.akadns.net) and from here all of the akadns.net servers > listed in whois are failing to respond. > > Can someone confirm from another location? Comments from Akamai? we see the same thing here in The Netherlands. it would seem like Akamai has fallen off the net. Tried all NSs on all locations, none of them responded. Regards, Tycho -- Tycho Eggen (Unix|Network) Engineer tycho(a)e-dude.org 0x3FCFB844 I'm going to say an exploit by tommorow. End of the internet by Saturday. All back to normal on Monday - Yet Another Cisco Bug

3 2

RE: Akamai DNS Issue?
by Sean McPherson 15 Jun '04

15 Jun '04

Confirmed from 216.26.128.0/18, 69.2.192.0/19, and 206.196.0.0/20. Seems to be using determinative destinations tho, as it works from some other network sources. I'm guessing only certain bits of the network are under attack or have failed for some reason, or that some parts are handling whatever issue it is better than others. Sean McPherson nanog(a)seanmcpherson.com Director of Operations / RHCE, LPI Xodiax, LLC >From here neither www.google.com, nor www.apple.com work. Both >seem to return CNAMES to akadns.net addresses (eg, www.google.akadns.net, >www.apple.com.akadns.net) and from here all of the akadns.net >servers listed in whois are failing to respond. > >Can someone confirm from another location? Comments from Akamai? > >-- > Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 > PGP keys at http://www.ufp.org/~bicknell/ >Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0

RE: "Default" Internet Service
by Smith, Donald 15 Jun '04

15 Jun '04

Donald.Smith(a)qwest.com GCIA pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC Brian Kernighan jokingly named it the Uniplexed Information and Computing System (UNICS) as a pun on MULTICS. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Matthew Sullivan > Sent: Monday, June 14, 2004 3:26 PM > Cc: nanog > Subject: Re: "Default" Internet Service > > > > Smith, Donald wrote: > > >First are the consumers willing to pay for a "safer" internet > >DSL/dial/isdn? > > > Why should they have to? Because it costs money to mitigate the attacks coming from their infected machines. It takes people and people want to be paid. Given a larger security abuse team we could do more. > > >I believe if they were there would be a safer service > available. I have > >seen several "secure" isp's fail in the last few years. If > you have any > >data that shows that there is a market for a more secure > >dialup/DSL/isdn... please share it. > > > No, but it won't belong before you will find half a dozen > reasons why as > an ISP you will want to do it - but then it may be too late. > > >2nd blaming infected machines on the internet is similar to blaming > >your postal carrier for bringing you junk mail and bills. > > > Crap > > > About 1/2 of all of > >the large "infection" events on the internet are the result > of people > >running unpatched unsecured applications on their machines. > The other > >half of the infections I see are due to an end user opening an email > >and running an attachment. > > > Correct > > > Even with a secure OS this simple method of infection will > continue to > > work. > > > Correct > > However you are ignoring the fact that once the machine is > infected, the > machine can be used by hundreds of people (skript kiddies) to damage > other parts of the internet, further they can (and are) being used by > organised crime to extort money out of large financial > institutions and > companies, and that's not to mention DDoS's on the smaller people who > are just in the way. Agreed. > > >How and when did it become the responsibility of the ISP to > protect the > >end users machines? > > > It hasn't, however the data coming from an ISPs network has > always been > the responsibility of the ISP.... and I would suggest if you > cannot stop > the endusers getting infected, then you should look at stopping those > machines from abusing other machines on the internet.... If you will > not do that you should not be peered. AFAIK all major ISP's are processing 1000's of infected host. This includes notification of the end user, assistence in cleaning and identifing the infections and responses to the people providing the lists of infected hosts. > > >Do ISP's get paid to protect end user machines? > > > No, they get paid for traffic, which is the reason some ISPs > out there > don't care if their customers are DDoSing anothers network. Most US ISP's end users (DSL/DIAL/ISDN/CABLE) are on a flat rate. The end user is not charged for the bandwidth. I have received NO PUSHBACK from sales on any of the projects we have worked on to mitigate the effects of bots/worms/virii on our network. I personally don't believe there are ISP's that don't mitigate so they can get the extra $$$ the worm traffic is generating. > > >If you want to blame someone maybe the company that provided the > >insecure os that requires monthly patches to fix portions of > the broken > >code they sold. Or you could blame the end users who open unknown > >attachments. > > > Yup, we've been doing that for years, and they have been > fixing things > as fast as possible (not always, and not until more recently) however > they are making steps in the right direction, so I feel it's > about time > ISP's started taking some of the responsibility for traffic on their > network. As far as the attachments go, education is the only > way - and > if they cannot be educated they shouldn't be on the Internet. How will you keep them off? > > >I would like a real solution to the problem. Simply blocking > ports is > >not successful. So I recommend 2 steps. > > > >First buy OS's that are more secure out of the box. > > > That's not going to happen anytime soon, even with Microsoft > starting to > follow the 'right' road. I believe there are OSes that are much more secure out of the box then Microsoft's products. > > >2nd Teach users NOT to click on every thing they see. > > > > > ...and how are you going to do that? If you give a user a Education as you stated above. > $10 account > where they have full internet access they click on > everything, then they > get infected, their machine is controlled by someone else across the > world and is used for DDoS attacks or spam (or..hacking, > or...?) .. what > are you going to do to educate them in the middle....? What > is the ISP > going to do to make sure that the enduser has been educated? > What are > you the ISP going to do to ensure the machine that was > infected has now > been disinfected...? You have not convinced me that either of these is currently an ISP responsibility. > > I don't expect you the ISP to solve all these problems, nor > do I expect > you the ISP to stop your users from getting infected.... > However you the > ISP are responsible for traffic coming from and going to your > users, and > most of us don't care if you want to allow your users to get > infected, > however we do care if you allow your customers to attack > us.... Whether > it be an attack in the form of spam, DDoS or trojan/virus spreading. As an ISP I am responsible to ensure my users can send and receive packets. Want to contribute? Consider volunteering time at one of the public internet security sites. Complaining that ISP's are not doing enough is not productive. > > / Mat > > > >

5 5

DDoS mitigation with BGP communities
by Matthew Crocker 15 Jun '04

15 Jun '04

Hello, I just experienced my first official DDoS attack against my network. I never realized how helpless I was :(. I had roughly 70 mbps of traffic aimed at one IP. The IP wasn't even in use, I'm assuming someone typed the wrong IP and meant to send it somewhere else. I shut it down by removing the /24 announcement. This was fine except for the customers on that /24. I know my upstreams have special communities I can set via BGP announcements that effectively say 'route packets to this network to null0'. My question is, what do I need to put on my router (i.e. code examples) to inject the /32 into the BGP announcements. I try to be a good net citizen and announce aggregate blocks. I had to break my /21 up so I could announce everything but the /24 in the middle. Any help would be greatly appreciated. Routers are a couple 7500 series running 12.0.xx -Matt

3 2