- Test - lists.nanog.org

Any way to P-T-P Distribute the RBL lists?
by Drew Weaver 26 Sep '03

26 Sep '03

I know you all have probably already thought of this, but can anyone think of a feasible way to run a RBL list that does not have a single point of failure? Or any attackable entry? Disregard this if im totally out of line, but it would seem to me that this would be possible. Thanks, -Drew

13 15

Re: New Team Cymru IP2ASN whois server
by Pekka Savola 26 Sep '03

26 Sep '03

On Fri, 26 Sep 2003, Stephen Gill wrote: > $ whois -h whois.cymru.com 4.2.2.1 > ASN | IP | Name > 3356 | 4.2.2.1 | LEVEL3 Level 3 Communications Do you plan to support IPv6 -> ASN mappings as well, at some point? Another interesting feature related to that would be supporting special resolution of 6to4 addresses (RFC3056); looking up 2002:0102:0304:: would give you also the info on IP 1.2.3.4. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

2 1

College increases fine for virus computers to $100
by Sean Donelan 26 Sep '03

26 Sep '03

Rollins College in Florida has increased its fine for students with infected computers to $100. Despite repeated warnings, nearly 1/3 of the 1,100 students ignored instructions to install the patch and anti-virus software. The College sent teams door-to-door on campus looking for infected computers to fix them. Even after that, 35 students still didn't fix their computers, and the college turned off their network access. http://www.orlandosentinel.com/news/education/orl-locvirus26092603sep26,0,4… In Anchorage, the cable modem provider has started cutting off 500 infected customers. When the customer calls in, GCI won't let them re-connect to the network until they fix their computers. Which can be a difficult process for some customers since the only way Microsoft distributes the patches is on-line. http://www.adn.com/business/story/4002138p-4023398c.html How many other ISPs are turning off customers due to worms isn't known.

1 0

New Team Cymru IP2ASN whois server
by Stephen Gill 26 Sep '03

26 Sep '03

Fellow networkers, Team Cymru is happy to announce the availability of a public whois server dedicated to mapping IP numbers to ASNs, located at whois.cymru.com. You can find the link to this tool at: http://www.cymru.com/BGP/whois.html This link has been added to our main BGP data page available at: http://www.cymru.com/BGP/index.html We have also extended the functionality of this daemon to support BULK IP submissions for those who wish to further optimize their queries with netcat. Following is a quick overview of how to use it: $ whois -h whois.cymru.com <IP> Where <IP> is replaced by the IP you'd like to map, like so: $ whois -h whois.cymru.com 4.2.2.1 ASN | IP | Name 3356 | 4.2.2.1 | LEVEL3 Level 3 Communications You can also include port information, and/or timestamps in your queries. Be sure to include quotes around your queries, or the daemon will interpret your request as multiple lines: $ whois -h whois.cymru.com "4.2.2.1 -0600 GMT" ASN | IP | Info | Name 3356 | 4.2.2.1 | -0600 GMT | LEVEL3 Level 3 Communications For instructions on how to submit BULK queries via netcat, simply issue the following command: $ whois -h whois.cymru.com help We hope you find this tool useful. Stay tuned for more features! If you have any comments or suggestions as to how we might improve this service, feel free to let us know! Thanks, Steve, for Team Cymru http://www.cymru.com -- Stephen Gill

1 0

Re: Any way to P-T-P Distribute the RBL lists?
by Rich Braun 26 Sep '03

26 Sep '03

Drew Weaver <drew.weaver(a)thenap.com> inquired: > I know you all have probably already thought of this, but can > anyone think of a feasible way to run a RBL list that does not have a single > point of failure? Or any attackable entry? Fedex. "Never underestimate the bandwidth of a station wagon loaded with DLT cartridges barreling along the highway at 70mph"... Seriously, as has already been pointed out, the distribution side of the equation is the easy part. Server admins can use an out-of-band technique like ordinary dialup to get access to the blocklist. But generating the blocklist requires real-time reporting back to a central server. Even if the server is decentralized, it will still require a relatively small handful of accessable IP addresses. An out of band layer-2 network could be created for that at the peering points, so as to prevent outside attack. Probably worth doing among major ISPs. Wouldn't scale to end users, of course. But end users could still subscribe to the blocklist through periodic updates. The other obvious thing that could be done would work pretty much like caller ID: create a set of SMTP enhancements that allow email recipients to accept mail from those who have provided traceable ID to the ISPs that participate, and who have agreed to acceptable-use policies that place strict limits on bulk email. Wait, hasn't that been done? The pre-1987 ARPAnet? Oh yeah, we've outgrown that... Public humiliation might also work. Bring back the stockades so we can place spammers out front of courthouses everywhere. Too bad society's outgrown that too... -rich

3 2

Verisign Responds
by Leo Bicknell 25 Sep '03

25 Sep '03

http://www.icann.org/correspondence/lewis-to-twomey-21sep03.htm I quote: ] As to your call for us to suspend the service, I would respectfully ] suggest that it would be premature to decide on any course of action ] until we first have had an opportunity to collect and review the ] available data. One would think it would be equally premature to roll out the service without first asking the appropriate people for their opinion first, starting with ICANN. Looks like the lawsuits are going to be the ones to settle this dispute...anyone think there's a chance of ICANN pulling .COM and .NET from Verisign due to breach of contract? I think it's highly unlikely. -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

20 28

Average case performance vs. Worst-case guarantee
by Harsha Narayan 25 Sep '03

25 Sep '03

Hi, I have this question to which I have not been able to get a conclusive answer (I have heard different things). When an ISP buys a router does it want a worst-case guarantee about the router's capabilities? Or will it buy a router which can give better performance in the average case (it may drop some packets if the traffic pattern changes suddenly)? Assuming both cost the same. Could you please give your opinion? Harsha.

1 0

Re: Increase in tcp traffic from spoofed source to bogon?
by Mike Tancsa 25 Sep '03

25 Sep '03

Is it all to 135 ? I drop lots of that at my border. Each time I traced it back to the customer, it was some infected machine that was not being natted for various reasons. e.g. Deny TCP 172.16.4.1:4616 192.100.103.4:135 We also see the odd ntp request. Is it bogon as in RFC 1918 or bogon as in not yet allocated / routed ? ---Mike At 05:26 PM 25/09/2003, Mark Segal wrote: >While cleaning the narchi virus icmp traffic.. I noticed a lot of tcp >traffic (it seems to be increasing) from spoofed address to bogon space? >Any ideas on what virus or worm this is? Is it new? > >Regards, >Mark > >-- >Mark Segal >Director, Network Planning >FCI Broadband >Tel: 905-284-4070 >Fax: 416-987-4701 >http://www.fcibroadband.com > >Futureway Communications Inc. is now FCI Broadband

1 0

Increase in tcp traffic from spoofed source to bogon?
by Mark Segal 25 Sep '03

25 Sep '03

While cleaning the narchi virus icmp traffic.. I noticed a lot of tcp traffic (it seems to be increasing) from spoofed address to bogon space? Any ideas on what virus or worm this is? Is it new? Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband

1 0

Re: williams spamhaus blacklist
by Kai Schlichting 25 Sep '03

25 Sep '03

On 9/25/2003 at 3:04 PM, "Susan Harris" <srh(a)merit.edu> wrote to me: > This is the third time I've contacted you concerning violations of the > NANOG list AUP. Your message below focuses on spam/blacklists, issues > that are not considered operational and are therefore off-topic for the > list. This is your last warning - if subsequent messages violate any > terms of the NANOG list, we'll need to remove your posting privileges from > the list. > Please refer to the AUP: > http://www.nanog.org/aup.html > Susan Harris, Ph.D. > Merit Network/Univ. of Mich. (above is a template, btw) oops - too late - been busy writing the next post that is SUPPOSEDLY off topic, and I hit 'send' before seeing this one. Now tell me: why are you not posting this notice to the list to kill the thread, if that is the desired effect? bye,Kai

1 0