- Test - lists.nanog.org

Re: Warning - new trend of attempts to infect ISP users (possibly virus)
by Kevin Oberman 03 Mar '04

03 Mar '04

> Date: Wed, 3 Mar 2004 16:15:39 +0000 (GMT) > From: "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> > Sender: owner-nanog(a)merit.edu > > > > > Erm is it me or are the writers of Bagle and Netsky determined to keep morphing > > > their code to outwit the virus scanners.. is this a new trend in virus writing - > > > beat the systems by evolving your code quicker than the security firms can > > > release updates? > > > > new trend in that it started only a decade ago? > > Perhaps I'm only following this as its affecting us more, but I dont recall a > time previously when I've had so many viruses hitting us and getting thro our > scanners with nothing we can do about it. I dont recall seeing viruses with > variants as high as 'j' before, especially in the relatively short time since > the previous variants were out > > Seriously, drop some references if I'm off-track.. its just my perception and > I'm not an expert at all with viruses... They are getting batter at it, but the WANK worm (1989) used self-modifying code so that no two replicas were the same. (Note: This worm only infected VMS systems running on the global DECNET internet, mostly DOE, NASA, and DEC corporate systems.) -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0

Looking for bandwidth around Penn Station NYC
by Paul Wouters 03 Mar '04

03 Mar '04

Hi guys, Is there anyone with a fiber drop or something around Penn Station in NYC? Or some non T-Mobile wireless presence? We're trying to get some bandwidth in the Pennsylvania Hotel in july, and I had hoped to do this through T-Mobile's wireless, but that doesn't seem to be an option they're willing to offer. Paul

1 0

RE: UUNet Offer New Protection Against DDoS
by Terranson, Alif 03 Mar '04

03 Mar '04

Hi John, While the formalities of the C&W acquisition have yet to kick in, I have no reason to believe that anything will change here: Savvis pioneered the 15 minute response time for DoS issues - whether or not it's our customer calling in. If it involves Savvis customers in any way, we will have the oncall security person on the phone and working the issue in less than 15 minutes - *always* (usual times are closer to 3 minutes because of the oncall cell phone). //Alif Alif Terranson OpSec Engineering Manager Operations Security Department Savvis Communications Corporation (314) 628-7602 Voice (314) 208-2306 Pager (618) 558-5854 Cell -----Original Message----- From: John Obi [mailto:dalnetuzer@yahoo.com] Sent: Wednesday, March 03, 2004 1:21 AM To: nanog(a)merit.edu Subject: UUNet Offer New Protection Against DDoS Hello Nanogers! I'm happy to see this, and I hope C&W, Verio, and Level3 ..etc will do the same! MCI/WorldCom Monday unveiled a new service level agreement (SLA) to help IP services customers thwart and defend against Internet viruses and threats. http://informationweek.securitypipeline.com/news/18201396 It's the right time before it's too late! Regards, -J Do you Yahoo!? Yahoo! Search - Find what youre looking for faster.

1 0

RE: UUNet Offer New Protection Against DDoS
by Douglas.Dever＠alltel.com 03 Mar '04

03 Mar '04

From: On Behalf Of John Obi Sent: Wednesday, March 03, 2004 2:21 AM > MCI/WorldCom Monday unveiled a new service level agreement (SLA) At the risk of sounding thoroughly underwhelmed... Uhm, where's the beef? All I see is the opportunity to get a service credit should one complain loud enough after a DoS attack. Maybe I'm missing something here, but I doubt it. I've never seen an SLA that guarantees 5 9's of reliability keep a T1 from going down - but the paper it was written on was nice... somewhat soft, and you didn't have to worry about your finger poking through it. -- Douglas A. Dever ACI/IT Network Services ALLTEL Communications Inc. 330.963.1720 ****************************************************************************************** The information contained in this message, including attachments, may contain privileged or confidential information that is intended to be delivered only to the person identified above. If you are not the intended recipient, or the person responsible for delivering this message to the intended recipient, ALLTEL requests that you immediately notify the sender and asks that you do not read the message or its attachments, and that you delete them without copying or sending them to anyone else.

1 0

External (not in the same domain) name server
by Antti Louko 03 Mar '04

03 Mar '04

Hello, I searched if this issue has been around previously, but neither google or Nanog list search produced anything recent and relevant. There has been some discussion on whois host entries etc, however. The real issue, why this seems impossible with many registrars, is explained in the end of this email. Background: (I use private IP addresses in this example, but in the real life they would be normal routable IP addresses) I have in my mind a setup where: - There is one main domain, which is used for "master" name servers: mxx1.net NS ns1.mxx1.net mxx1.net NS ns2.mxx1.net mxx1.net NS ns3.mxx1.net mxx1.net NS ns4.mxx1.net ns1.mxx1.net A 10.1.1.2 ns1.mxx1.net A 10.1.2.2 ns1.mxx1.net A 10.2.1.2 ns1.mxx1.net A 10.2.2.2 ns1, ns2, ns3 and ns4 are well connected and quite permanently in their IP addresses. - There are a number of cooperating organizations each having one dedicated name server (which can also handle other tasks, like act as an secondary SMTP server etc.) - Organizations are (there may be tens or hundreds of them): cxx-1.com cxx-2.com . . - Each cxx-n.com has its domain registered like this: cxx-1.com NS ns1.cxx-1.com.e.mxx1.net. cxx-1.com NS ns2.cxx-1.com.e.mxx1.net. cxx-1.com NS ns3.cxx-1.com.e.mxx1.net. cxx-1.com NS ns4.cxx-1.com.e.mxx1.net. cxx-1.com NS ns5.cxx-1.com.e.mxx1.net. , cxx-2.com NS ns1.cxx-2.com.e.mxx1.net. cxx-2.com NS ns2.cxx-2.com.e.mxx1.net. cxx-2.com NS ns3.cxx-2.com.e.mxx1.net. cxx-2.com NS ns4.cxx-2.com.e.mxx1.net. cxx-2.com NS ns5.cxx-2.com.e.mxx1.net. etc. - Each cxx-n.com.e.mxx.1.net zone name server offers records like this: ns1.cxx-1.com.e.mxx1.net 600 A 10.20.1.2 ; server at cxx-1's location ns2.cxx-1.com.e.mxx1.net 600 A 10.20.2.2 ; server at cxx-2's location ns3.cxx-1.com.e.mxx1.net 600 A 10.20.3.2 ; server at cxx-3's location ns4.cxx-1.com.e.mxx1.net 600 A 10.20.4.2 ; server at cxx-4's location ns5.cxx-1.com.e.mxx1.net 600 A 10.20.5.2 ; server at cxx-5's location ns1.cxx-4.com.e.mxx1.net 600 A 10.20.4.2 ; server at cxx-4's location ns2.cxx-4.com.e.mxx1.net 600 A 10.20.5.2 ; server at cxx-5's location ns3.cxx-4.com.e.mxx1.net 600 A 10.20.6.2 ; server at cxx-6's location ns4.cxx-4.com.e.mxx1.net 600 A 10.20.7.2 ; server at cxx-7's location ns5.cxx-4.com.e.mxx1.net 600 A 10.20.8.2 ; server at cxx-8's location Pro: - {ns1,ns2,ns3,ns4}.mxx1.net don't have to handle all NS requests to different cxx-n.com domains. - Each cxx-n.com.e.mxx.net name server can monitor if each of its name servers is alive and change the A record to more suitable address when necessary. Con: - Needs careful configuration - Requires more DNS requests than simpler setup: + To resolve eg. www.cxx-1.com A (traditional setup): www.cxx-1.com:A --> A.GTLD-SERVERS.NET cxx-1.com NS ns-1.cxx-1.com 10.20.1.2 ns-1.cxx-1.com A 10.20.1.2 www.cxx-1.com:A --> 10.20.1.2 www.cxx-1.com A 10.20.1.3 is 2 transactions + New setup: www.cxx-1.com:A --> A.GTLD-SERVERS.NET cxx-1.com NS ns1.cxx-1.com.e.mxx1.net ns1.cxx-1.com.e.mxx1.net:A --> A.GTLD-SERVERS.NET mxx1.net NS ns1.mxx1.net ns1.mxx1.net A 10.1.1.2 ns1.cxx-1.com.e.mxx1.net:A --> 10.1.1.2 ns1.cxx-1.com.e.mxx1.net A 10.20.1.2 www.cxx-1.com:A --> 10.20.1.2 www.cxx-1.com A 10.20.1.3 is 4 transactions and if we separate each cxx-1.com.e.mxx1.net zone in a different name server, we get 5 transaction. The difference is that we can adjust with TTL values which parts of the name resolution are short lived and which are long lived. And now the problem with some registrars (or is it the same with all of them): godaddy.com: Does only allow to use "registered hosts" as name servers in .com and .net domains. If the name server host is in com or net domain and it is not in the same domain, it needs to be a registered host which basically means that it has to be (or have been) a NS of its SLD with glue record (an A record). But for example, any .fi ending (Finland) host name can be entered as a name server and it gets automatically "registered" without an A record. joker.com: Same as godaddy.com but doesn't allow foreign (like .fi) host names as name servers if they have too many dots in the host name. I didn't dare to try Network Solutions because it was very slow last time I tried the WWW interface. To summarize: I have read this <URL:http://cr.yp.to/djbdns/notes.html#gluelessness> and understand that point of view. Am I trying accomplish something which is not really needed or would such an approach be useful in some situations?

7 8

The Geography of Spam
by sgorman1＠gmu.edu 03 Mar '04

03 Mar '04

Thought folks might find this blurb from Sophos on the geography of Spam interesting. 30% of Spam, they report, comes from hijacked PC's. Matches pretty close to what we see across our network - i.e. all sorts of stuff from swbell.net o U.S. Routes More Spam than World Combined, Study Shows Paris -- Intentionally or not, the U.S. routes more spam e-mail traffic than the rest of the world combined, according to a new study by anti-virus firm Sophos. The study concludes that most of the unsolicited junk e-mails originate in Russia and then passes through hacked computers in the U.S. "More than 30% of the world's spam is sent from these compromised computers, underlining the need for a coordinated approach to spam and viruses," said Charles Cousins, Sophos' Asia managing director . The U.S. accounts for a whopping 56% of the global spam pie, followed by Canada with 6.8%. Europe did not fair very well in the report either, with the Netherlands (5th), Germany (7th), France (8th), the U.K. (9th) and Spain (12th) all making the list. http://www.sophos.com/spaminfo/articles/dirtydozen.html

5 4

Re: External (not in the same domain) name server
by Joe Abley 03 Mar '04

03 Mar '04

On 2 Mar 2004, at 21:02, Randy Bush wrote: >>> Does only allow to use "registered hosts" as name servers >>> in .com and .net domains. >> This is a requirement of Verisign registry, and should be >> true for all net/com registrars. > > s;net/com;; > > presuming you mean that there should be registered host rr > for all known servers. otherwise, i suspect the servfails > will get even worse. Actually, no. Verisign registry requires host records with addresses for nameservers named under com and net, and requires host records without addresses for nameservers named within other domains. Most other registries do not follow the verisign schema of inter-relational host and domain objects; typically nameservers are stored as fields in the records for their dependant domains. In those registries no "registration of hosts" is required. Joe

1 0

NANOG 31 Meeting Information
by Carol Wadsworth 02 Mar '04

02 Mar '04

I am pleased to announce that NANOG 31 will be held May 23-25 at the Westin St. Francis, Union Square, in San Francisco. The meeting will be hosted by CNET Networks. The Call for Presentations will be forthcoming next week. Please continue to check www.nanog.org for meeting updates.

1 0

RE: Converged Networks Threat (Was: Level3 Outage)
by Kuhtz, Christian 02 Mar '04

02 Mar '04

> If events are not properly triggered back upstream (ie: > adjencies stay up, bgp remains fairly stable) and you end up > dumping a lot of traffic on the floor, it's sometimes a bit > more dificult to diagnose than loss of light on a physical path. > > On the sunny side, I see this improving over time. > Software bugs will be squashed. Poorly designed networks > will be reconfigured to better handle these situations. But this happens everywhere, everyday, regardless of the underlying technology. ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." 113

1 0

RE: Converged Networks Threat (Was: Level3 Outage)
by Kuhtz, Christian 02 Mar '04

02 Mar '04

> From where i'm sitting, I see a number of potentially > dangerous trends that could result in some quite catastrophic > failures of networks. No, i'm not predicting that the > internet will end in 8^H7 days or anything like that. I > think the Level3 outage as seen from the outside is a clear > case that single providers will continue to have their own > network failures for time to come. (I just hope daily it's > not my employers network ;-) ) I don't agree with this 'the sky is falling' perspective and we've seen these discussions over and over. Survivability was and continues to be a design goal of anything we do here. Was from the first days and it's true to this day. When you implement a critical service, you need to do due diligence on whether the path chosen meets the needs. > Now the question of Emergency Services is being posed > here but also in parallel by a number of other people at the > FCC. We've seen the E911 recommendation come out regarding > VoIP calls. How long until a simple power failure results in > the inability to place calls? There are specific requirements (read: gov't regulations) to implement E911 with a number of redundancy options, typicalling calling for things like triple path redundancy. While I have worked on E911 infrastructure in the past and I'm not aware of an exhaustive analysis for E911 over IP, I don't see a reason off the top of my head why you can't do the same thing on IP. Sure, requires careful planning. But what critical service doesn't? What are you asking for? More gov't regulation? > While my friends that are local VFD do still have the > traditional pager service with towers, etc... how long until > the T1's that are used for dial-in or speaking to the towers > are moved to some sort of IP based system? The global > economy seems to be going this direction with varying degrees > of caution. > > I'm concerned, but not worried.. the network will survive.. What's your point then? :) There's no panacea for poor implementation. That's why knowledge and experience is important in network design and it's importance is directly linked to the definined critical need of the service implemented. Sorry, just angst for me here. No visible life. Thanks Christian ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." 113

1 0