- Test - lists.nanog.org

Atlanta Internet exchange
by Michael Lucking 04 Sep '03

04 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Recently I have worked with several ISPs to build a new Internet exchange in Atlanta, GA. The AtlantaIX is now operational and accepting connections. We are located in 56 Marietta St. If you have a presence in the building and would like to connect drop me a line. The building owners are one of the sponsors and have given space and power for the exchange. For more information check http://www.atlantaix.com. -----BEGIN PGP SIGNATURE----- iD8DBQE/V2PqYCZjVDyC1X4RAuCaAKC83dg9fhUa++BE4Xi+IOTI1fX9twCfcqNx Zeqo3gDjV8A5th6Zp4fWJpQ= =GhCJ -----END PGP SIGNATURE-----

1 0

RE: BMITU
by Fisher, Shawn 04 Sep '03

04 Sep '03

>You didn't specify operating system but for 500,000 users I wouldn't >even go near Windows. thanks for the feedback..we are a SUN shop so solarius is our OS of choice. >I use a healthy mix of Postfix as the mail server >and Courier-IMAP for POP3/IMAP delivery. They both work extremely well. Chris -- Chris Horry "Don't submit to stupid rules, zerbey(a)wibble.co.uk Be yourself and not a fool. PGP: DSA/2B4C654E Don't accept average habits, Amateur Radio: KG4TSM Open your heart and push the limits."

1 0

Distributed sniffer products
by Austad, Jay 04 Sep '03

04 Sep '03

Anyone have any experience with these? I'm looking for something similar to Network Associates Sniffer product. Are there any open source projects that are decent? What are others using? ---------------- Jay Austad Senior Network Analyst Travelers Express / MoneyGram e: jaustad(a)temgweb.com p: 952.591.3779

10 15

RE: Address for making BGP changes w/ Qwest?
by Joel Perez 04 Sep '03

04 Sep '03

Hey Dave, I have been using their QwestSource web page for a while now to make any routing changes. The site is https://qwestsource.net/qwestsource/workTemplate.jsp ---------------------------------------------- Joel Perez <jperez(a)ntera.net> | IP Engineer http://www.ntera.net/ | Ntera 305.914.3412 -----Original Message----- From: Temkin, David [mailto:temkin@sig.com] Sent: Thursday, September 04, 2003 11:05 AM To: nanog(a)merit.edu Subject: Address for making BGP changes w/ Qwest? bgp-admin(a)qwestip.net doesn't work anymore. Is there anyone from Qwest on the list or can someone point me to where I'm supposed to be making these changes now? (Call tech support?!) Thanks, Dave

1 0

What do you want your ISP to block today?
by Sean Donelan 04 Sep '03

04 Sep '03

Which Microsoft protocols should ISP's break today? Microsoft Exchange? Microsoft file sharing? Microsoft Plug & Play? Microsoft SQL/MSDE? Microsoft IIS? It would be so much easier if worm writers followed the RFC's and set the Evil Bit. China has firewalled the entire country, and they have more infected computers than the US. http://www.vnunet.com/Analysis/1143268 > Although companies may have the infrastructure to deal with the current > band of worms, Trojans and viruses, there is currently a line of defence > that is not in place. "The problem isn't Microsoft's products or the > knowledge of the consumer. The problem lies in the ISPs' unwillingness > to make this issue disappear or at least reduce it dramatically," said > Cooper. > He added that ISPs have the view and ability to prevent en-masse > attacks. "All these attacks traverse their networks before they reach > you and me. If they would simply stop attack traffic that has been > identified and accepted as such, we'd all sleep better," Cooper said.

31 73

Re: What do you want your ISP to block today?
by Vinny Abello 04 Sep '03

04 Sep '03

At 02:51 PM 9/3/2003, Sean Donelan wrote: >On Wed, 3 Sep 2003, Johannes Ullrich wrote: > > I just summarized my thoughts on this topic here: > > http://www.sans.org/rr/special/isp_blocking.php > > > > Overall: I think there are some ports (135, 137, 139, 445), > > a consumer ISP should block as close to the customer as > > they can. > >If ISPs had blocked port 119, Sobig could not have been distributed >via USENET. > > >Perhaps unbelievably to people on this mailing list, many people >legitimately use 135, 137, 139 and 445 over the open Internet >everyday. Which protocols do you think are used more on today's >Internet? SSH or NETBIOS? > >Some businesses have create an entire industry of outsourcing Exchange >service which need all their customers to be able to use those ports. > >http://www.mailstreet.net/MS/urgent.asp > >http://dmoz.org/Computers/Software/Groupware/Microsoft_Exchange/ > >If done properly, those ports are no more or less "dangerous" than >any other 16-bit port number used for TCP or UDP protocol headers. > > >But we need to be careful not to make the mistake that just because >we don't use those ports that the protocols aren't useful to other >people. Even on Windows they can be used in a much safer fashion (although I would never attempt it for any of my stuff). It is possible to use IPSec policies on 2000 and higher to encrypt all traffic on specified ports to specified hosts/networks and block all other traffic. I bet some people are using this to join remote locations securely to each other for Windows networking with these ports and IPSec policies. Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN There are 10 kinds of people in the world. Those who understand binary and those that don't.

7 7

Re: Distributed sniffer products
by Greg Maxwell 04 Sep '03

04 Sep '03

> Does anyone have a *GOOD* screenrc example config? I was VERY confused by > the info file. > (OT, I know, but...) Here is one we find useful for monitoring the behavior of a firewall: split split screen -t desktop 0 tcpdump -ni desktop not port 22 focus screen -t external 1 tcpdump -ni external not port 22 focus screen -t server 2 tcpdump -ni server not port 22

1 0

AOL people on list?
by Drew Weaver 04 Sep '03

04 Sep '03

Contact me off-list please. -Drew

1 0

AT&T NYC
by Bryan Heitman 04 Sep '03

04 Sep '03

Anyone seeing any problems with ATT in new york? Best regards, Bryan Heitman Interland, Inc.

10 11

On the back of other 'security' posts....
by Matthew Sullivan 03 Sep '03

03 Sep '03

Hi All, On the back of the latest round of security related posts, anyone notice the 50% packet loss (as reported to me) across the USA -> NZ links around lunchtime (GMT+10) today? Yet more spoofed traffic aimed at the SORBS nameservers - this time enough to crash a core router of my upstream... Hopefully the commercial damage now may insite people getting damaged by these DDoSes to start proceedings against those ISPs whom continue to show a lack of respobsibility and allow unfiltered spoofed DDoS traffic from their networks. Certainly I have been told to talk to various US authorities about the problem, and will be doing so as soon as I have the nessesary information. In the mean time a plea to people on this list in all countries - watch for the DDoS attacks (particually against 203.15.51.33, 203.15.51.35, 203.15.51.44 & 203.101.254.254) and stop the damn traffic before you are held responsible for your customers actions. There is still a 10k pps SYN flood occuring 8 hours later - this is being rate limited upstream. ..and if the perps are on this list, keep going if you want, the more you do the more likely you'll get caught. You will not force SORBS off the net like you have Osirusoft. I and SORBS will leave when we are good and ready, and not because of some infantile spotty faced 15 year old nerd without a clue on life. / Mat

14 22