- Test - lists.nanog.org

Re: PAIX
by Paul Vixie 23 Nov '02

23 Nov '02

> | What application will require this dense peering? > > To power the IPv6 networks of refridgerators, ovens, and light switches, > as well as your 3G video conferencing phone i think we're going to need peering this dense to carry all of the nanog traffic between and among people who say we don't need it. if i ever needed clear evidence that the people who operate networks don't necessarily know who uses them or for what, or clear evidence that the most powerful force on the internet is a single voice claiming that something cannot be done, then the last week of this thread would be it.

1 0

Re: Cyberattack FUD
by Vadim Antonov 23 Nov '02

23 Nov '02

On Thu, 21 Nov 2002, David Schwartz wrote: > Suppose, for example, we'd had closed cockpit doors. The 9/11 terrorists > would have threatened the lives of the passengers and crew to induce the > pilots to open the doors. The pilots would have opened the doors because the > reasoning until that time was that you did whatever the hostages told you to > do until you could get the plane on the ground. > > It was the rules of engagement that failed. Nothing more, nothing less. In the "regular" skyjacking the attackers want to get ransom, or divert an airplane to someplace. They'll get cooperation from pilots, too - without any need to be present in the cockpit. So if it is known that the policy is not to let anyone in, no matter what happens to passengers, the attackers wouldn't even try. In fact, they don't, on airlines which have this policy. Letting deranged people in cockpit, in fact, places _all_ passengers at risk of an unintended crash (imagine an attacker getting agitated and killing pilots, or simply pulling knobs - there were incidents when _little kids_ allowed to cockpit crashed the commercial planes). The rules of engagement were patently absurd > >and then by making life truly miserable for > >those who wish or have to travel, in a fit of post-disaster paranoia. > > The airline industry did that? Your mileage may wary, but I do not find pleasure in being stripped in public just because I've got long hair. As I result I'm avoiding all air travel, if I can. I'm sure a lot of other people do that too. > >It is not enemies who are savvy, it is managers who are stupid. Like, the > >"crash airplane into some high-value target" scenario was well-aired more > >than decade ago > > Not the "crash jetliner full of passengers into high-value target" > scenario. Heh. Our friends Chechens told than in a TV interview back in 1995 that they intend to do precisely that. They identified Kremlin as a target, though. And Israelis as a matter of fact assume that attackers are on a suicide mission. And the fact that US does not exactly inspire adoration in mid-Eastern parts of the world isn't any news, too. > If you were able to make the decision to shoot down or not shoot down the two > jetliners before either struck a building, knowing only that they were not > responding and probably hijaacked, what would you have done? I'd have doors in place, so as to avoid the whole situation. As I told, it is the standard procedure (keep cockpit doors closed) in much of the world outside US. > Again, it's the rules of engagement that failed. Rules are formulated by someone, they are not God-given. That someone is patently incompetent - in both failing to notice explicit early warnings, and failing to follow on the best practices of his peers. > So tell me what they should have done differently. Not allowed knives on the > plane? The terrorists would have used their bare hands. Strip searched every > passenger? Arm their pilots -- they weren't allowed to. I repeat: have doors closed, period. As for "they weren't allowed" part - don't be ridiculous. This is an oligopoly situation, and so they pretty much can get their terms from the government - just look at those multibillion handouts. > > I hope that US airlines > >go out of business and El Al moves in; isn't that what competition is > >supposed to be about? > > Except that there is no competition. Airlines don't get to make their own > security rules, they're largely preempted by the government ownership and > control of airports and the FARs. It takes two to tango. If those large businesses cannot get the reasonable rules from the government, their lobbying groups are incompetent (and so they deserve to go out of business). More likely, they didn't ask. Competition is not only about having seats filled - it is also about dealing with governments, courts, media, etc. > >The same holds for the Internet (with special thanks to the toothless > >antimonopoly enforcement which allowed operating systems to become a > >monoculture). > > This is a great bit of double-think. It has nothing to do with the fact that > people overwhelmingly prefer to have compatible operating systems, it's the > fact that nobody forced them to diversify against their will. Huh? MS was found guilty of monopolistic practices - repeatedly. They also are quite ruthless in going out and strangling competition (just watch their anti-Linux FUD campaign). If you think they are deterred, just take a look at the Palladium thingie - a sure-fire public domain OS killer. In fact, given the enormous positive network externalities associated with the operating systems, it would make a lot of sense to the government to level the playing field with affirmative action - for example, by differential taxation of dominant and sub-dominant vendors. The government procurement could've been more intent on having second supplier of compatible OS software, too - that'd force MS to publish detailed specs on all interfaces, and prevent them from playing proprietary lock-in games. Or give up government market altogether. People overwhelmingly do not care what's inside; they buy _applications_; and given the overwhelmingly monopolistic presense of OS vendor on the market the app vendors have little reason to develop for non-MS market. Of course, the position of MS as the monopoly vendor is supported by the fact that majority of other vendors only have Windows versions of their apps. To secure that unassailable position, MS excludes other parties from developing compatible platforms for running these applications by deliberately hiding, obscuring, and tweaking the APIs. I'm sorry to say, but the "free" market (not that there ever been one) does not always produce sustainable results; and the task of government regulators is to identify those situations and act to prevent them. In this case, the situation was easy to spot, but the reaction was quite botched by stupid (if not to say - incompetent) things, like overly talkative judge. --vadim

2 1

Looking for a piece of gear to do...
by Alex Rubenstein 23 Nov '02

23 Nov '02

Hi. I am looking for a very simple piece of gear that will do the following: Fast-E ---- |thing|-------ATM OC3------|thing| ---- Fast-E I am not looking for a discussion on how this, me, or ATM is bad. It's just a solution I need. Anyway, I am looking for 'thing' to be a simple device. Perhaps it would have more than one FE port, and you'd map PVC's to ports, or whatever. The key is that this totally transparent, and able to pass 802.1q vlan tags. It'd be used in a point-to-point topology only. Any clues would be great. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

6 5

RE: Cisco hardware advice needed
by haesu＠towardex.com 22 Nov '02

22 Nov '02

Hello all, A lot of you have replied back to my original email with very good advice. I greatly appreciate everyone's assistance. Thank you --haesu ---------------------------------------------------------------- This mail sent through TowardEX Webmail http://mail.towardex.com

1 0

Re: Weird distributed spam attack
by Joe St Sauver 22 Nov '02

22 Nov '02

Hi, #Here is the kicker. I check where these are coming from, they #are from all over the place. I check for IP address spoofing... #not happening. No IP options or TCP options. # #This came from like about 300 different networks, and yes #I don't accept source routing (IP Options). In addition to thousands of open relays, which are bad enough in their own right, there are also thousands of open proxy servers which a growing number of spammers have been using to launch spam runs lately. I suspect that's what you're seeing. You can see some of the open proxy servers that we've seen traffic from at http://darkwing.uoregon.edu/~joe/open-proxies-used-to-send-spam.html If you aren't blocking traffic from open proxy servers via a dns blacklist, I predict that you will definitely see increasingly aggressive spam attacks coming in from diverse locations (although the more you look at the problem, the easier it becomes to identify the handful of carriers who are open proxy-tolerant). [I will also say that it would really be great if mail-abuse.org would add an open proxy listing project to complement their RSS, DUL, and other initiatives.] Regards, Joe

4 3

Weird distributed spam attack
by dru-nanog＠redwoodsoft.com 22 Nov '02

22 Nov '02

Unless, I missed the posts about this,.. I just (and still am experiencing) a distributed spam attack. I have a small machine at a colo. Today I check my inbox and there are 2000+ extra messages to a domain I have 'zbot.net'. The messages are doing 4 letter combinations for the recipient. (abde, abdf, etc.) The from's are all mybestplacetoshop(a)ainet.us I check my qmail queue -> its at 13405 messages. I shut down mail and remove the email from the queue. Here is the kicker. I check where these are coming from, they are from all over the place. I check for IP address spoofing... not happening. No IP options or TCP options. This came from like about 300 different networks, and yes I don't accept source routing (IP Options). Anyways, it happened to my machine, I stopped accepting mail to that domain from qmail-smtpd, so I'm back to normal. If anyone want's a tcpdump of the connection attempts or the emails. Let me know. Dru Nelson San Carlos, California

6 5

The Cidr Report
by cidr-report＠potaroo.net 22 Nov '02

22 Nov '02

This report has been generated at Fri Nov 22 21:45:21 2002 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 15-11-02 115525 83541 16-11-02 115876 83482 17-11-02 115903 83487 18-11-02 115816 83543 19-11-02 115965 83826 20-11-02 115962 84457 21-11-02 116704 84654 22-11-02 116795 84742 AS Summary 14074 Number of ASes in routing system 5531 Number of ASes announcing only one prefix 2106 Largest number of prefixes announced by an AS AS3908 : SUPERNETASBLK SuperNet, Inc. 72949760 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 22Nov02 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 117134 84750 32384 27.6% All ASes AS3908 2106 1243 863 41.0% SUPERNETASBLK SuperNet, Inc. AS701 1715 1271 444 25.9% ALTERNET-AS UUNET Technologies, Inc. AS7843 665 297 368 55.3% ADELPHIA-AS Adelphia Corp. AS7018 1370 1006 364 26.6% ATT-INTERNET4 AT&T WorldNet Services AS18566 367 5 362 98.6% COVAD Covad Communications AS4323 524 184 340 64.9% TW-COMM Time Warner Communications, Inc. AS6197 457 122 335 73.3% BATI-ATL BellSouth Network Solutions, Inc AS1221 1183 858 325 27.5% ASN-TELSTRA Telstra Pty Ltd AS6347 360 80 280 77.8% DIAMOND SAVVIS Communications Corporation AS4355 403 136 267 66.3% ERMS-EARTHLNK EARTHLINK, INC AS7046 584 323 261 44.7% UUNET-CUSTOMER UUNET Technologies, Inc. AS22927 275 20 255 92.7% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS209 589 338 251 42.6% ASN-QWEST Qwest AS1239 910 660 250 27.5% SPRINTLINK Sprint AS6198 415 167 248 59.8% BATI-MIA BellSouth Network Solutions, Inc AS705 436 203 233 53.4% ASN-ALTERNET UUNET Technologies, Inc. AS4814 247 15 232 93.9% CHINANET-BEIJING-AP China Telecom (Group) AS4151 346 123 223 64.5% USDA-1 USDA AS1 657 441 216 32.9% GNTY-1 Genuity AS6140 267 66 201 75.3% IMPSAT-USA ImpSat AS852 666 467 199 29.9% ASN852 Telus Advanced Communications AS17676 229 30 199 86.9% GIGAINFRA XTAGE CORPORATION AS6595 247 56 191 77.3% DODDSEUR DoD Education Activity Network Assistance Center AS17557 307 122 185 60.3% PKTELECOM-AS-AP Pakistan Telecom AS4134 298 116 182 61.1% ERX-CHINALINK Data Communications Bureau AS690 507 331 176 34.7% MERIT-AS-27 Merit Network Inc. AS2048 264 88 176 66.7% LANET-1 State of Louisiana AS7132 223 67 156 70.0% SBIS-AS Southwestern Bell Internet Services AS2548 390 240 150 38.5% ALGX-ATCW-AS Allegiance Telecom Companies Worldwide AS6327 181 33 148 81.8% SHAWFIBER Shaw Fiberlink Limited Total 17188 9108 8080 47.0% Top 30 total Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)lists.apnic.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Cisco router hardware advice needed..
by haesu＠towardex.com 22 Nov '02

22 Nov '02

Hello, We currently run a small ISP network with two Linux based routers called ISis (www.imagestream.com) to aggregate all the customers into the backbone. There are two ISis routers and each ISis has two frame-relay T3's. All customers have a frame-relay T1 and we setup the PVC DLCI mappings over the frame cloud.. Now, the ISis routers are too much of a low quality and unacceptable for our ever-growing network. (Please don't reply back to me telling me how Linux for ISP routing is incorrect to begin with, etc, etc.. I understand and agree.. I never made the call the go with Linux based routers in the beginning..) Anyway.. with that being said. We are in process of removing these ISis routers and replacing them with Cisco routers. We are currently thinking of using Cisco 7206VXR's with at least an NPE300 per replacement of ISis. So that would be two Cisco 7206 routers, each with two frame-relay T3's. Each Cisco 7206 router will have about approximately 150 or so serial sub-interfaces for customer PVC mapping.. And each 7206 will have a 100Meg FastEthernet connection to the backbone core router (since two T3's saturating only goes up to about 90Mbps). Now the question is.. Can a Cisco 7200 handle the two frame-relay T3's with 150 or so subinterfaces? My impression of a 7200 is that it is more designed for deployment at the border, not much at the edge/aggregation.. What do you people think? If it cannot handle such pressure, what other models do you guys suggest for us? We are looking at both Cisco and Juniper products, but we would like to use Cisco whenever we can, so Cisco is our preference. Thanks in advance. --haesu ---------------------------------------------------------------- This mail sent through TowardEX Webmail http://mail.towardex.com ----- End forwarded message ----- ---------------------------------------------------------------- This mail sent through TowardEX Webmail http://mail.towardex.com

2 1

On the cyber-security FUD topic
by Richard Forno 22 Nov '02

22 Nov '02

Here's my contribution to the current cyber-security FUD thread. I've been mulling this piece over for a while now, and it can certainly apply to a few different companies in this particluar market. Seeing the current debate, I feel justified in posting this essay to NANOG. -rf Security Through Soundbyte: The 'Cybersecurity Intelligence' Game Richard Forno Essay #2002-12 (c) 2002 Richard Forno. Permission granted to reproduce and distribute in entirety with credit to author. Full article with in-line URLS is available at: http://www.infowarrior.org/articles/2002-12.html Some say that cyberspace is the new battlefield, with its own unique rules, challenges, and concerns for those charged with defending it. If one does consider cyberspace a modern battlefield, intelligence must naturally play a key role in developing appropriate, proactive defenses. Regarding battlefield intelligence, military strategist Sun Tzu wrote that "what is called foreknowledge cannot be elicited from spirits, nor from gods, nor by analog with past events, nor from calculations. It must be obtained from men who know the enemy situation." That's sound advice. During recent months, hardly a week goes by without some reference to some firm's findings or statistics on hackers, crackers, cyberterrorists, and the general state of internet security as they see it. Many times these reports are marketed as cybersecurity "intelligence." As a security professional - and someone 'on the front lines' of the cyberspace battlefield - I'm both curious and dubious about the whole 'cybersecurity intelligence' business concept, and wonder what it takes to both become a 'cybersecurity intelligence' expert and make money at it, too. < - snip - > Full article with in-line URLS is available at: http://www.infowarrior.org/articles/2002-12.html

3 2

Fire in Data Centre of Twente University, Netherlands
by Wouter van Hulten 22 Nov '02

22 Nov '02

for all incident watchers: [Update 20/11/2002 12:30] At this moment the ICT-heart of the university of Twente is burning. The so-called TWRC-building houses the central systems of the university, all servers and PCs will be lost and various affiliated institutes are without Internet connectivity. [...] Hosting and colo company Virtu, the neighbour of the university, has provided an IP adress for the University. Further announcements are made available on http://srv1ut.utwente.virtu.nl/, a abbreviated copy of the university website. [Update 12u30] Op dit moment brandt het ICT-hart van de Universiteit Twente uit. Het zogeheten TWRC-gebouw huisvest het centrale net van de universiteit, alle servers en pc's gaan verloren en diverse geaffilieerde instellingen zitten zonder internetverbinding. [...] Hosting- en colocatieprovider Virtu, de fysiek buurman van de universiteit, 'heeft een machine en een IP-adres ter beschikking gesteld met medeweten en op verzoek van de universiteit. Op deze wijze kan de UT toch mededeling wereldkundig maken via het web', aldus een zegsman van Virtu. De site is een gestripte kloon van www.Utwente.nl. pictures: http://webcam.traserv.com/thumbnails/index.html http://images.fok.nl/upload/utwentebranddichtbijgroot.jpg websites [in Dutch]: http://www.planet.nl/pmm/0,1674,101_1501_1277175,00.html newslog with pictures: http://frontpage.fok.nl/news.fok?id=23971

2 2