- Test - lists.nanog.org

Out of office/vacation messages
by Mark Prior 31 Dec '03

31 Dec '03

Why do so many supposedly clueful people have their vacation message system respond to mailing list email? Now I'll get to see who also doesn't keep a list of addresses that have already been sent the out of office message :-) Mark.

11 16

AT&T Abuse / RBL contact.
by Ejay Hire 31 Dec '03

31 Dec '03

Hello all. Can an AT&T Abuse/RBL person please contact me off-list. We are getting 550-207.65.4.2 blocked by blacklist.mail.ops.worldnet.att.net. bounces and my emails to abuse_rbl(a)att.net haven't generated a response. Thanks, Ejay Hire ISDN-Net Network Engineer 615-324-3851 615-207-6140

1 0

RE: 2004 network predictions.
by Alon Tirosh 30 Dec '03

30 Dec '03

-----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of batz Sent: Tuesday, December 30, 2003 6:25 AM To: nanog(a)merit.edu Subject: 2004 network predictions. >>Here are some dire predictions for 2004. >> >>While it would be easy to say that the world will end, I think these are all things that reasonably >>could happen, and we could act pre-emptively to mitigate their effects. >> >><snip> >> >>- ISP's use managed anti-virus/security to sell new managed services >> to users. Birth of the fully provider managed home PC? >> >></snip> I wanted to point out that this one is already happening. AOL is working hard on this '9.0 Optimized' with some ancillary teen-market driven service, and is marketing itself as a service that can magically fix your pc without you having to do anything (see TV spot of troubled parents watching toddler bang on mouse with sound hammer, then 'Computer Fixed' prompt appears on screen). Granted, they're capitalizing on what I like to call 'Market Stupidity' and positioning themselves to become the truly idiot-proof provider, but it may actually work. While im hesitant to leave such a large proportion of End-User security in the hands of AOL, it IS a start. It's not ideal, but this might be the first step in the direction of 'enforced measures' to help mitigate malware that works on the basic assumption that nobody patches their machines... Note: I don't completely agree with this approach, but its getting to the point where something has to be done.

1 0

2004 network predictions.
by batz 30 Dec '03

30 Dec '03

Here are some dire predictions for 2004. While it would be easy to say that the world will end, I think these are all things that reasonably could happen, and we could act pre-emptively to mitigate their effects. - Virus infections of handhelds and mobile phones causing widespread problems for cell networks similar to worms that flood out IP networks. - Bonus points for a bluetooth infection vector. - Extra bonus points if it floods newly minted VoIP telecom networks. Grim. - E-mail whitelist technology gains mainstream acceptance as spam hits critical mass. Spam recieved by astronauts in space. - ISP's search for new business models realizing that wireless providers are making a mint charging by the kilobyte, and more users just surf at work. - Wireless network "terrorism" or "porn" incident galvanizes legislators to force hotspot operators to get ID or credit card numbers from customers. - Really Bad instant-messenger worm that we can't do anything about because it doesn't use consistant tcp/udp ports. - ISP's use managed anti-virus/security to sell new managed services to users. Birth of the fully provider managed home PC? - Affinity networks/six-degrees site privacy boondoggle. One is caught selling access data to airlines or transport security or something. Everyone feels sick as Friendster acquired by Equifax? - Private crypted networks used for P2P. Call them blacknets, darknets, or in true arrr-pirate fashion, booty-nets. yo-ho-ho. - Successful virtual worm network forged after a worm spreads its second phase and installs an onion routed virtual network. Maybe a new P2P network? - Linux kernel made illegal, somewhere, for a minute. Presidential candidate may admit to using it once, but didn't look at the source. RIAA/MPAA/DMCA a surprise US election issue. - LEA access to ISP's formalized, spearheaded by Cisco and its "lawful interception" capability. Court gag order placed on participating ISP's, disgruntled admin leaks details to Cryptome or Phrack. - More end-to-end control connections that identify/validate/authenticate end users. Eg, VPN's, SSL, PPP. An assault on anonymity and stateless protocols, or technologies that interrupt the statefulness of the connection between user and their primary providers. (eg, WiFi, P2P, UDP, VoIP). - P2P on the road to obselescence caused by higher metred bandwidth charges to home cable users in line with wireless costs. While there is a glut of bandwidth capacity available for transit, this is not the case for end-user consumption. Cable providers will lower bandwidth caps under the auspices of combatting piracy, enabling them to actually make money. Given these sort of predictions, I don't mind being wrong. Have a good year, I'll post again then. ;) -- batz

1 0

Trends in network operator security
by Sean Donelan 30 Dec '03

30 Dec '03

Its 2003 and everyone is making their predictions. What trends are network operators seeing for Internet security? Old favorites Buffer overflows Distributed Denial of Service Poor passwords (cisco/sanfran) Poorly coded systems Blame the user for not protecting poorly coded systems Trends Attack the network (why? because we can) Proxy relay hiding (its not just for SMTP anymore) Combo Bot/Trojan/Worms Embedded software "upgrades" Any other trends network operators are seeing?

2 2

Cachibility analysis software ?
by Yu Ning 30 Dec '03

30 Dec '03

Hi nanog, Can anyone tell me is there any tool to analysis if a web site is cachable ? Or now many content in a given site is cachable ? What's more, if router does not support WCCP, how can a cache work with him ? Any suggestion ? thanks ! Yu Ning ______________________________________ (Mr.) Yu Ning, Vice Director Networking & Engineering Dep. North Telecom BU, China Telecom Beijing, P.R.China +86-10-66002099 ______________________________________

4 3

Paging RR.COM regarding ISP mail blockage
by Mike Tindor 30 Dec '03

30 Dec '03

I've been trying to get in contact with RR.COM as well regarding blockage of mail from the netblock of our mail servers. Would an RR security/spam rep please contact me via noc(a)1st.net, abuse(a)1st.net or by phone regarding this issue. I have already mailed removal(a)security.rr.com and received an autoreply yesterday morning but have had no dialog with a human as of yet. Thanks, Mike Tindor FIRST Internet 740-695-2280 x 3070

2 1

Automated Network Abuse Reporting
by Jason Lixfeld 29 Dec '03

29 Dec '03

We're a small company but none the less are inundated with firewall logs reporting numerous attempts to find holes in our network; c'est la vie. Seeing as how we are small, we don't have the resources to go through and send emails off to the abuse departments of each network sourcing the probes. Question is: Has there been development of some sort of intelligent unix land app that can understand Cisco syslog output, find the abuse departments of the sourcing networks and send them off a nice little FYI?

9 9

RE: Cachibility analysis software ?
by Yu Ning 29 Dec '03

29 Dec '03

Abdullah, Thanks. We originally get this suggestion from our vendor (you know this major player's name :-). Then we realized, if not running WCCP between router and cache, then the cache is unable to throw back the request. So a more generic question. Can squid, or any other cache engine support by-pass function ? or "throw" back function when it find the request is not cacheable ? All question under no-WCCP condition. BTW, Is there any cache solution, other than Cisco, or Inktomi, that you think working well under 500~1000M backgroud traffic ? thanks ! Yu >-----Original Message----- >From: Abdullah Hameed Sheikh [mailto:ahameed@singtel.com] >Sent: Monday, December 29, 2003 12:20 PM >To: Yu Ning; Nanog >Subject: RE: Cachibility analysis software ? > > >Use policy routing to force all traffic to go out cache >interface. And the cache interface (via connected servers/ >cache engine) cache the web/ftp content and throw rest of the >traffic back to the router to make independent decision. > >If you are good in squid, and can write some IP layer >programming, you can do it in Linux. > >There is a company named something like Macanaye... They have >a very good implementation... The bad thing is that their >company name is so difficult that I cannot remember the >spelling and Due to such a "troubled" name, a lot of my >referral now using other products. :D > >If you are interested, I really need to dig thru my emails... > >regards >Abdullah > >-----Original Message----- >From: Yu Ning [mailto:yuning@ctnt.com.cn] >Sent: Monday, December 29, 2003 11:46 AM >To: 'Nanog' >Subject: Cachibility analysis software ? > > > >Hi nanog, > >Can anyone tell me is there any tool to analysis if a web site >is cachable ? Or now many content in a given site is cachable ? > >What's more, if router does not support WCCP, how can a cache >work with him ? Any suggestion ? > >thanks ! > >Yu Ning > >______________________________________ > >(Mr.) Yu Ning, Vice Director >Networking & Engineering Dep. >North Telecom BU, China Telecom >Beijing, P.R.China +86-10-66002099 >______________________________________ > >

2 1

African porn dialers, civil war and networks
by Eric Kuhnke 29 Dec '03

29 Dec '03

Forwarded from the Risks digest (www.risks.org) ================================================ Date: Sun, 21 Dec 2003 19:37:31 +0000 From: "Patrick O'Beirne" <mail2(a)sysmod.com> Subject: GuineTel seeks ways of clamping down on scam fraud By Brian King, Balancing Act's News Update 188 (21 Dec 2003) http://www.balancingact-africa.com Phantom Calls In 2003, Terri Lockwood of Indianapolis, Indiana received a phone bill with hefty charges for calls to Guinea-Bissau, a West African country she had never heard of, and much less had reason to call. When she disputed the charges, the American operator AT&T told her that the calls were genuine, and that she or someone in her house must have called, or accessed an adult entertainment site on the Internet. The intruder was a program that had slipped unnoticed onto the family computer, and reconfigured the connection to dial a number in Guinea-Bissau (code 245). The number, however, does not officially exist. The national operator, the regulatory body, and the International Telecommunications Union all agree that the number dialed from Terri Lockwood¹s computer is not programmed within the territory of Guinea-Bissau. Communications infrastructure of the country, furthermore, could not conceivably support the graphic-intensive content production and broadcast of many adult entertainment sites. For the last few years the national operator Guine Telecom has been concerned with repairing basic telephony infrastructure damaged in a devastating civil war. At the beginning of this year Guine Telecom had no new cables to repair its network, no wires to install phones for clients, and approximately 50,000 people on waiting lists. This is not a company receiving revenue from a brisk adult entertainment business, legitimate or not, apparently conducted in its name. The History In 1989 the Government of Guinea-Bissau cemented a strategic partnership with Marconi (now part of the Portugal Telecom group) All international traffic to and from Guinea-Bissau would run through Marconi in Portugal. Marconi was also given the right to open and maintain bank accounts abroad in the name of Guine Telecom. Critics of the company say that management of the company became increasingly chaotic and untransparent. Around 1996 Portugal Telecom managers set up a bank of computers at the earth station to receive pornographic calls from abroad. The calls were received at Guine Telecom and were immediately transmitted back without entering the national network. The practice reportedly generated significant new traffic to Guinea-Bissau, and the added revenue funded new investments in infrastructure. On June 7, 1998 a failed coup d¹etat tipped the country into civil war; key infrastructure (such as the earth station) was destroyed and in the midst of it the bank of audiotext (read 'phone sex') computers. After their departure in 1998 Portugal Telecom began withholding settlement payments for international calls terminating in Guinea-Bissau, and has continued to do so. A journalist from the major Spanish newspaper El País confirmed a so-called ³epidemic² of calls to Guinea-Bissau from Spain, appearing on the bills of people who had no relationship with the country. In all these instances the Spanish operator Telefonica responded that the calls were genuine. Around the same time, a dissatisfied Spanish pornography consumer actually called Guine Telecom to complain about the service. Technical Director Malam Fati was alerted, and so discovered for himself the existence of a number of web pages advertising live pornographic video. The pages appear to be designed to target particular countries; all are linked to a home page at www.sexhotel.com. The pages offer 'free' access to live pornographic video without requiring credit card information. Interested viewers need only to call a number on the screen (dialing instructions from each country are included), to receive a password. These access numbers bear the (245) international code, but the regional codes are not assigned within the territory of Guinea-Bissau. For the rest of this story, go to: http://www.balancingact-africa.com Patrick O'Beirne, Systems Modelling Ltd., Gorey, Co. Wexford, Ireland. +353 55 22294

2 1