- Test - lists.nanog.org

RE: North America not interested in IP V6
by Ben Buxton 01 Aug '03

01 Aug '03

> From: Cougar [mailto:cougar@random.ee] > > On Thu, 31 Jul 2003, Ben Buxton wrote: > > > And further to this...will it be required (or wise at all) > to register > > individual /48 delegations when it becomes commonplace to > allocate them > > to standard home users? > [----] > > Plus, putting in and maintaining hundreds of thousands of > entries (we > > have a > > lot of users) would be quite impractical. > > How many home users need /48 ? I see here almost no home > users who need > more than /64.. Read RFC 3177, it recommends /48 so that users get given enough space to never have to worry. We cant predict what will happen in 15 years, so we shouldnt put artifical limitations on this. And includes reasons as to why that was decided upon. Its such a shame that a lot of companies want to restrict innovation by insisting that consumers will only want or need a single ip addres or subnet. Or that people only ever need to access web sites with their net connection. This seems especially so in the states and aus. In europe, when any consumer gets a net connection it's sold as a pipe to do anything you want with (as long as it abides by laws and netiquette. It seems that this silly restrictive mentality will remain even with ipv6... BB

2 1

RE: WANTED: ISPs with DDoS defense solutions
by McBurnett, Jim 01 Aug '03

01 Aug '03

Paul Vixie said: lots of late night pondering tonight. the anti-nat anti-firewall pure-end-to-end crowd has always argued in favour of "every host for itself" but in a world with a hundred million unmanaged but reprogrammable devices is that really practical? if *all* dsl and cablemodem plants firewalled inbound SYN packets and/or only permitted inbound UDP in direct response to prior valid outbound UDP, would rob really have seen a ~140Khost botnet this year? -- ----- YEAH but if I wanted to do it, the best way would be behind the firewall... They would have to put in PIX 535 with GIGE and segment the network into DMZs.. HMM.. I think that if the cable modem had a built in router with NAT this problem could be solved partially.. I did a test about 6 months ago. almost a honeypot, but not quite. put a standard windows ME system on a RW IP put a $60 cable router in front of a similiar system. the ME was compromised and made into a Bot in 3 hours. The $60 router protected one was not compromised in the 2 weeks it was used. Both had AV and were updated daily via automation. IF only cable operators would at least STRESS the security issues OR make the AUP's Stick.. Some of you may have seen my emails asking for help from Charter about security issues. It took me almost 4 months to get someones attention, and then only after I brought up several ARIN and other policies they violated. I hate to say it but I don't think we will see anything change here.. And if so not enough to matter.... maybe from 140K to 120K anyway I am ranting... J

2 1

RE: abuse case management
by William Devine, II 01 Aug '03

01 Aug '03

I started using OTRS (Open Ticket Request System) a month or so ago and LOVE IT. You can setup pre-canned response templates and have multiple users login and maintain various queues. It's open source and works VERY well. http://www.otrs.org/ william -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mikael Abrahamsson Sent: Friday, August 01, 2003 4:08 AM To: nanog(a)nanog.org Subject: abuse case management Is there an abuse case management system as freeware somewhere, something like all the ticket/case handling packages out there, but more specifically aimed at abuse/complaint handling. I googled some but couldnt find any. My idea is that it should provide functions to do the following flow: Abuse complaint comes in via email, is scanned if it's in a certain format, if it is, put it directly into the case handling system. If not, This email is presented to the handler on a web page. The handler looks at the email and decides whether the email has enough information in it to be a complete abuse complaint. If NO, press button to send back a form to the one who complained stating what information is needed and that they can either fill in the email form and return the email, or go to a web page and fill it in (the link should go to their original complaint so they can add information). If YES, the handler puts complaint IP adress, time and type of complaint in some web fields and then presses another button to put the complaint (now categorized) into the case handling system. This, coupled to a customer IP database, will enable daily reporting on top customers who get complained about, bundling of complaints per customer etc, plus it makes the process of cases without enough information take 5-10 seconds to handle. This is a variation on the telia web way that was complained about a month back or so, in that it enables the same categorization by a handler in an efficiant (?) way. It was mentioned in the earlier discussion that we should have a standardized way of reporting abuse via email. Was anything ever done about this, or should we try to just make a de facto form that might spread if more ISPs adopt it? Do the spamcop etc people have any suggestions on how to handle the huge amount of complaints they generate? Any suggestions welcome. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

1 0

RE: WANTED: ISPs with DDoS defense solutions
by Tomas Daniska 01 Aug '03

01 Aug '03

> >However, I would like to see Java or Other Language to run on the > routers, > >(I know you can install and play Quake on one vendor´s > boxes) but I mean > >to do things really belonging to the router but so far I > have yet to see > a vendor > >to take programmable boxen (outside their own development) seriously. > > >Maybe it´s just too hard. > > It's not hard at all technically. The hard part is that > manufacturers do > not want to have to provide support for such flexible boxes > when they have > such a hard time just dealing with the complexity of existing general > purpose routers. Current routers are trying to be all things to all well, although not available for the ip routing stuff, IOS possesess a tcl interpreter and you can deploy virtually anything for voice purposes. you can program your own signalling, voice call processing, interaction with external systems... just bring your fantasy, and some level of tcl skills, too :) and it *is* supported -- deejay

1 0

Re: WANTED: ISPs with DDoS defense solutions
by Michael.Dillon＠radianz.com 01 Aug '03

01 Aug '03

>However, I would like to see Java or Other Language to run on the routers, >(I know you can install and play Quake on one vendor´s boxes) but I mean >to do things really belonging to the router but so far I have yet to see a vendor >to take programmable boxen (outside their own development) seriously. >Maybe it´s just too hard. It's not hard at all technically. The hard part is that manufacturers do not want to have to provide support for such flexible boxes when they have such a hard time just dealing with the complexity of existing general purpose routers. Current routers are trying to be all things to all people. They have far too many knobs and their routing software runs on far too many hardware platforms. If they let you run scripts on the box itself, there would be a combinatorial explosion in complexity which would make it a lot harder for the manufacturer's router gurus to help you. But you can still build this yourself for some environments using something like Click, the modular software router. http://www.pdos.lcs.mit.edu/click/ You may not be able to get the type of interfaces that you need because of the need for driver support. Click simplifies the task by using Linux device drivers but Click is not Linux and does not use the Linux kernel. However you can integrate Click into a Linux system as a kernel module rather like building a real-time Linux system There are various manufacturers that make PCI WAN interface cards that can be used in such boxes. http://www.pt.com/products/prodgroup_access.html http://www.brooktrout.com/products/netaccess_pri_pci/ http://www.iphase.com/products/specificProduct.cfm/2/8/190 The real question is whether or not this type of build-your-own router is feasible financially because of the small quantities involved compared to a box manufacturer. And where in your network could you confidently deploy such boxes when you know that you will have to support them yourself. Personally, I think the most interesting spot to try these boxen would be at the provider edge and the customer edge because it's not hard to think up value-added services that could be provided by such boxes and generate additional revenue. --Michael Dillon

1 0

abuse case management
by Mikael Abrahamsson 01 Aug '03

01 Aug '03

Is there an abuse case management system as freeware somewhere, something like all the ticket/case handling packages out there, but more specifically aimed at abuse/complaint handling. I googled some but couldnt find any. My idea is that it should provide functions to do the following flow: Abuse complaint comes in via email, is scanned if it's in a certain format, if it is, put it directly into the case handling system. If not, This email is presented to the handler on a web page. The handler looks at the email and decides whether the email has enough information in it to be a complete abuse complaint. If NO, press button to send back a form to the one who complained stating what information is needed and that they can either fill in the email form and return the email, or go to a web page and fill it in (the link should go to their original complaint so they can add information). If YES, the handler puts complaint IP adress, time and type of complaint in some web fields and then presses another button to put the complaint (now categorized) into the case handling system. This, coupled to a customer IP database, will enable daily reporting on top customers who get complained about, bundling of complaints per customer etc, plus it makes the process of cases without enough information take 5-10 seconds to handle. This is a variation on the telia web way that was complained about a month back or so, in that it enables the same categorization by a handler in an efficiant (?) way. It was mentioned in the earlier discussion that we should have a standardized way of reporting abuse via email. Was anything ever done about this, or should we try to just make a de facto form that might spread if more ISPs adopt it? Do the spamcop etc people have any suggestions on how to handle the huge amount of complaints they generate? Any suggestions welcome. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

3 2

Re: WANTED: ISPs with DDoS defense solutions
by Paul Vixie 31 Jul '03

31 Jul '03

> Private deployment of software written in C is very different from a > major public release, especially so when included with source code. you're right. when i've been involved in non-opensource products which were written in C and then shipped as binaries, i was scared to death about the lack of public review relative to the size of the user base, and i always argued for rather expen$ive SQA to make up for the weakness of not getting free SQA from all those security companies looking to make a name for themselves by being first to discover a vulnerability. or was that not what you meant?

1 0

Dept of Homeland security takes a crack at predicting the activit ies of haxx0rs.
by Drew Weaver 31 Jul '03

31 Jul '03

http://www.msnbc.com/news/946460.asp?0dm=C12MT <http://www.msnbc.com/news/946460.asp?0dm=C12MT> Do you guys think that now the DHS has announced this that the kiddies are more likely or less likely move faster on their plans? All I know is this is bad, it was bad enough when it only affected certain versions of Windows running IIS. Going to be a long August. -Drew

1 0

RE: WANTED: ISPs with DDoS defense solutions
by Stephen J. Wilcox 31 Jul '03

31 Jul '03

> I did a test about 6 months ago. almost a honeypot, but not quite. > put a standard windows ME system on a RW IP > put a $60 cable router in front of a similiar system. > the ME was compromised and made into a Bot in 3 hours. > The $60 router protected one was not compromised in the > 2 weeks it was used. > > Both had AV and were updated daily via automation. Ok I've not done this but I wasnt aware vanilla installs that are patched had such glaring holes? My first thought is surely a default install has no open ports other than netbios and I assume all file sharing is disabled? No? Steve

1 0

RE: "The internet is slow"
by McBurnett, Jim 31 Jul '03

31 Jul '03

But isn't that the purpose of NANOG? To fix the major problems before the world knows about them. I would much rather discuss a problem here and solve it and tell a reported, Yes (sir,or mam) the Internet commnity worked togather to solve the problem...... Than say, I don't it just cleared up it's all a mystery....... :) J -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Thursday, July 31, 2003 3:53 PM To: Rick Ernst Cc: NANOG Subject: Re: "The internet is slow" On Thu, Jul 31, 2003 at 12:02:32PM -0700, Rick Ernst wrote: > > Packet loss within UUNET, apparently localized to the Portland (OR) area. > I've turned down our peer with them and things are looking much better. > > Thanks for all the help/responses. Shhhhhhh, next thing you know some reporter is going to be writing a story about how the NANOG mailing list fixed that darn "the internet is slow" problem everyone has been complaining about. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

1 0