- Test - lists.nanog.org

IP QoS case-studies
by Pete Kruckenberg 03 Feb '03

03 Feb '03

I've found there's no shortage of advice and theory about the viability of IP QoS (DiffServ) in a large wide-area (converged) network. I have not had much luck with finding documentation about experiences implementing and operating such a beast. Presumably that's yet another (silent) confirmation that It Doesn't Work or There's a Better/Easier Way. Nevertheless, I'd still like to find anyone who has tried (successfully or not) to converge (ie VoIP/H.323/data) a high-speed (~ 1Gb/s) IP network and use IP QoS for what it is sold to do. White paper/presentation references or off-line conversation would be appreciated. Pete.

2 1

Re: Bell Labs or Microsoft security?
by Steven M. Bellovin 02 Feb '03

02 Feb '03

In message <OFDEB694D1.26DC1EE2-ON80256CBE.0042DB9E-80256CBE.0042FC0C(a)radianz.c om>, Michael.Dillon(a)radianz.com writes: > >> PS: Worm? Virus? Who wrote this up concisely first? > >Shockwave Rider by John Brunner No -- "When Harlie was One", by David Gerrold. It was published in 1972; "Shockwave Rider" was from 1975. (Source: catalog.loc.gov) Gerrold, btw, called it a virus that spread via autodialers (well, this was 1972). He also described a "vaccine" program. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

shuttle flash crowd statistics
by Scott Weeks 02 Feb '03

02 Feb '03

Hello, I write this to ask network operators to share your statistics of this flash crowd with NANOG. For example, if possible, could NASA folks let us know the peak and average hit rate to NASA TV (rtsp://198.116.66.254) or the traffic rates on the routers leading into this server? (border.hcn.hq.nasa.gov and realhq.hq.nasa.gov) Similarly, for UUnet folks (as you're the provider) or anyone that has collected statistics that they're willing to share. Graphical (MRTG-esq) would be the best. If folks don't want to hear about this, I'll take any info privately and summarize to anyone that asks me. Thanks, scott

6 7

Idiots trash NASA web sites
by Sean Donelan 02 Feb '03

02 Feb '03

EBay has already cancelled "auctions" of shuttle debris. I can't confirm this. The computers were offline by the time I checked. I checked Google for several of the sites, but didn't find any cached pages. >From http://www.securitynewsportal.com/ Hackers deface numerous NASA web servers on day of Space Shuttle Disaster Trippin Smurfs picked the wrong time to deface NASA 02-01-2003 5:50:50 PM CST -- from the SNP Mailbox On a day of national tragedy, with the folks at NASA in grief at the lost of the space shuttle Columbia and the seven astronauts onboard, a hacking group known as Trippin Smurfs decided to defaced a number of NASA web servers with a rant about Iraq.... http://maggiore.jpl.nasa.gov http://arezzo.jpl.nasa.gov http://palermo.jpl.nasa.gov http://pisa.jpl.nasa.gov http://roma.jpl.nasa.gov http://sondrio.jpl.nasa.gov http://borgo.jpl.nasa.gov http://como.jpl.nasa.gov http://urbino.jpl.nasa.gov Suffice to say that their timing was in extremely poor taste and will probably result in NASA's JPL security dudes putting in some overtime to catch the Trippin Smurfs. Given the tragedy that unfolded today over the skies of Texas, I don't think there is a court in the land that would have much sympathy for the hackers when sentencing. Tip of the hat and thanks to our friends who wrote to us about this poorly timed multiple web site defacement.

1 0

Shuttle Columbia - not necessarily nanog related
by Darin Wayrynen 01 Feb '03

01 Feb '03

The Space Shuttle Columbia seems to have broken up during re-entry over Texas. You might need to check your connections to the major news sources and NASA as your users start looking for information. :-( Darin

5 4

NASA TV
by Lucy E. Lynch 01 Feb '03

01 Feb '03

Just a brief reminder - NASA TV is available via multicast. Look for: "NASA television in MPEG-1 format" or use the information found below. Lucy E. Lynch Academic User Services Computing Center University of Oregon llynch(a)darkwing.uoregon.edu (541) 346-1774/Cell: 912-7998 v=0 o=- 61585 0 IN IP4 128.223.214.198 s=NASA TV (MPEG-1) i=NASA television in MPEG-1 format, provided by the University of Oregon. Please contact the UO if you have problems with this feed. e=Hans Kuhn <multicast(a)lists.uoregon.edu> p=Hans Kuhn <541/346-1758> b=AS:1000 t=0 0 a=type:broadcast a=tool:IP/TV Content Manager 3.2.24 a=live:capture:1 m=video 54302 RTP/AVP 32 31 96 c=IN IP4 224.2.231.45/127 a=quality:8 a=framerate:30 a=rtpmap:96 WBIH/90000 a=x-iptv-svr:video 128.223.91.191 live m=audio 28848 RTP/AVP 14 96 0 3 5 97 98 99 100 101 102 10 11 103 104 105 106 c=IN IP4 224.2.145.37/127 a=rtpmap:96 X-WAVE/8000 a=rtpmap:97 L8/8000/2 a=rtpmap:98 L8/8000 a=rtpmap:99 L8/22050/2 a=rtpmap:100 L8/22050 a=rtpmap:101 L8/11025/2 a=rtpmap:102 L8/11025 a=rtpmap:103 L16/22050/2 a=rtpmap:104 L16/22050 a=rtpmap:105 L16/11025/2 a=rtpmap:106 L16/11025 a=x-iptv-svr:audio 128.223.91.191 live

2 1

Re: What could have been done differently?
by Scott Francis 01 Feb '03

01 Feb '03

On Thu, Jan 30, 2003 at 10:39:17AM -0800, hino(a)ccrl.sj.nec.com said: > IIRC, MS's patches has been digitally signed by MS, and their patching > system checks these sign silently. So, they will claim that > compromised route info and/or DNS spoofing does not affect their > correctness. > > Though, I'm not sure what will happen in key revoking situation. interesting side note ... top of the page right now at http://www.ntk.net details a similar problem facing MS in the UK currently. (Remember when they forgot to renew hotmail.com, and some kind Linux geek fixed it for them ... well, apparently their entry in the Data Protection Register (UK) expired January 8. This means all personal data held by them in the UK is now illegal (passport, anyone?) I wonder if something like this would be useful (or even possible) in the US, of if it would be just another opportunity for bureaucratic bungling ...) > Koji -- -= Scott Francis || darkuncle (at) darkuncle (dot) net =- GPG key CB33CCA7 has been revoked; I am now 5537F527 illum oportet crescere me autem minui

2 1

The Spread of the Sapphire/Slammer SQL Worm
by vern＠ee.lbl.gov 01 Feb '03

01 Feb '03

We have completed our preliminary analysis of the spread of the Sapphire/Slammer SQL worm. This worm required roughly 10 minutes to spread worldwide making it by far the fastest worm to date. In the early stages the worm was doubling in size every 8.5 seconds. At its peak, achieved approximately 3 minutes after it was released, Sapphire scanned the net at over 55 million IP addresses per second. It infected at least 75,000 victims and probably considerably more. This remarkable speed, nearly two orders of magnitude faster than Code Red, was the result of a bandwidth-limited scanner. Since Sapphire didn't need to wait for responses, each copy could scan at the maximum rate that the processor and network bandwidth could support. There were also two noteworthy bugs in the pseudo-random number generator which complicated our analysis and limited our ability to estimate the total infection but did not slow the spread of the worm. The full analysis is available at http://www.caida.org/analysis/security/sapphire/ http://www.silicondefense.com/sapphire/ http://www.cs.berkeley.edu/~nweaver/sapphire/ David Moore, CAIDA & UCSD CSE Vern Paxson, ICIR & LBNL Stefan Savage, UCSD CSE Colleen Shannon, CAIDA Stuart Staniford, Silicon Defense Nicholas Weaver, Silicon Defense and UC Berkeley EECS

1 0

Internet Monitoring Center
by Sean Donelan 31 Jan '03

31 Jan '03

Who has the biggest wall of big screen monitors? http://www.washingtonpost.com/wp-dyn/articles/A3409-2003Jan30.html

4 5

Any commodity ISP support end-to-end MTUs > 4470?
by Joe St Sauver 31 Jan '03

31 Jan '03

Hi, Is anyone aware of a commodity ISP supporting end-to-end MTUs greater than 4470 octets (e.g., a 9180 octet "jumbo frame"-clean path, for example)? Feel free to drop me a note directly; I'll summarize for the list if I hear from anyone. Thanks, Joe St Sauver (joe(a)oregon.uoregon.edu) University of Oregon Computing Center

1 0