- Test - lists.nanog.org

Re: DNS issues various
by Michael.Dillon＠radianz.com 25 Oct '02

25 Oct '02

> you might remember or look up smb's presentation on 'pushback' at > some nanog or another (those anonymous hotel rooms kinda blur, > especially before first coffee). that's not perfect, but it > scales. and it's an engineering approach to a technology problem, > always a good sign. I find citeseer to be a useful tool for finding this sort of technical information. Go to http://citeseer.nj.nec.com/cs and type in "pushback" then click the search button. Voila! You do have to be careful about what you do with the information you find there. Since these are mostly papers produced by academics the quality can be variable, i.e. a masters course project versus a paper produced by someone who is a leader in their field. If people like what they see in the papers discussing "pushback" then why not push this issue back into the lap of Cisco and Juniper?

1 0

OT: Ameritech/SBC DSL?
by Spencer.Wood＠dot.state.oh.us 25 Oct '02

25 Oct '02

I was wondering, does anyone have a good contact at Ameritech/SBC on the DSL side of the house???? We lost quite a few of our DSL VPN sites earlier this week, and it appears that Ameritech changed there PPPoE authentication method??? Spencer ************************************************************ Spencer Wood, Network Manager Ohio Department Of Transportation 1320 Arthur E. Adams Drive Columbus, Ohio 43221 E-Mail: Spencer.Wood(a)dot.state.oh.us Phone: 614.644.5422/Fax: 614.887.4021/Pager: 866.591.9954 *************************************************************

1 0

The Cidr Report
by cidr-report＠potaroo.net 25 Oct '02

25 Oct '02

This report has been generated at Fri Oct 25 21:44:47 2002 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 18-10-02 114704 82884 19-10-02 115116 82872 20-10-02 114956 82781 21-10-02 114861 82208 22-10-02 115010 82457 23-10-02 115086 82530 24-10-02 115044 82513 25-10-02 114752 82519 AS Summary 13926 Number of ASes in routing system 5448 Number of ASes announcing only one prefix 1750 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73146368 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 25Oct02 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 115124 82508 32616 28.3% All ASes AS3908 1062 559 503 47.4% SUPERNETASBLK SuperNet, Inc. AS701 1750 1260 490 28.0% ALTERNET-AS UUNET Technologies, Inc. AS7843 759 337 422 55.6% ADELPHIA-AS Adelphia Corp. AS2828 472 102 370 78.4% XO-AS15 XO Communications AS7018 1361 1003 358 26.3% ATT-INTERNET4 AT&T WorldNet Services AS7132 415 70 345 83.1% SBIS-AS Southwestern Bell Internet Services AS6198 419 80 339 80.9% BATI-MIA BellSouth Network Solutions, Inc AS4323 519 181 338 65.1% TW-COMM Time Warner Communications, Inc. AS1221 1196 874 322 26.9% ASN-TELSTRA Telstra Pty Ltd AS18566 326 4 322 98.8% COVAD Covad Communications AS7046 587 299 288 49.1% UUNET-CUSTOMER UUNET Technologies, Inc. AS852 737 458 279 37.9% ASN852 Telus Advanced Communications AS6347 350 75 275 78.6% DIAMOND SAVVIS Communications Corporation AS4355 385 125 260 67.5% ERMS-EARTHLNK EARTHLINK, INC AS705 442 203 239 54.1% ASN-ALTERNET UUNET Technologies, Inc. AS4151 292 55 237 81.2% USDA-1 USDA AS209 572 338 234 40.9% ASN-QWEST Qwest AS1239 885 663 222 25.1% SPRINTLINK Sprint AS1 651 434 217 33.3% GNTY-1 Genuity AS4814 232 15 217 93.5% CHINANET-BEIJING-AP China Telecom (Group)Beijing Telecom CompanyBeijing China AS17557 314 118 196 62.4% PKTELECOM-AS-AP APNIC ASN block AS22927 215 20 195 90.7% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS690 517 324 193 37.3% MERIT-AS-27 Merit Network Inc. AS6140 258 65 193 74.8% IMPSAT-USA ImpSat USA, Inc. AS6595 249 56 193 77.5% DODDSEUR DoD Education Activity Network Assistance Center AS17676 224 34 190 84.8% GIGAINFRA APNIC ASN block AS4134 296 113 183 61.8% ERX-CHINALINK Data Communications Bureau AS2048 265 88 177 66.8% LANET-1 State of Louisiana AS174 290 133 157 54.1% PSINET PSINet Inc. AS2548 401 244 157 39.2% ICIX-MD-AS Business Internet, Inc. Total 16441 8330 8111 49.3% Top 30 total Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)lists.apnic.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

DNS issues various
by Simon Waters 25 Oct '02

25 Oct '02

> From: "Greg Pendergrass" <greg(a)band-x.com> > Subject: RE: WP: Attack On Internet Called Largest Ever > > Future attacks will be stronger and more > organized. So how do we protect the root servers from future attack? As has been discussed here previously (see archive) it is unclear that the root DNS servers are particularly vulnerable, so further effort specifically defending them may be misplaced, compared to efforts to address DDoS in general, or efforts to fortify other parts of the Internet infrastructure. > From: "Joe Patterson" <jpatterson(a)asgardgroup.com> > > would it cause problems, and more importantly would it solve potential > problems, to put some/most/all of the root servers (and maybe gtld-servers > too) into an AS112-like config? Last time it was discussed I thought that the provisions already in the DNS RFC's to allow zone transfer for "." to recursive servers is a neat solution for the root zone. It can be implemented with existing technology, no new servers/routers needed. Bypasses the 13 root server limit. Reduces load on the current root servers. Increases performance when unknown domains are queried. Even if all addresses where the zone was available were public, a persistent DDoS would merely deny the addition of new TLD's, or readdressing of all DNS servers for a TLD, both occur rarely. The gtld-servers, and servers for other key zones, maybe more painful to do without, harder to replace, or less well configured and/or protected than the root servers. > From: "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> > Subject: Re: Testing root server down code > > Microsoft DNS has a poor response and can spin out of control with all root > servers available.. Unfair, Microsoft DNS has a good response and peak throughput when it isn't spining out of control ;-) > From: "Martin J. Levy" <mahtin(a)mahtin.com> > Subject: Re: Testing root server down code > >2. Encourage greater software diversity for DNS sever systems. Currently most DNS servers are based on the BIND Berkeley Internet Name Domain code base. There is also a Microsoft Windows version of DNS that very few groups currently run. > >3. ... > > Hence... At least in the US (and I can't say for the rest of the world), the government have been recommended to consider Microsoft's version of DNS. Others might interpret that as not to run BIND, or Microsoft DNS ;-) Surely that should be "code bases", plural, as BIND 9 is a new code base? So that is BIND 4, BIND 8, BIND 9, MS DNS, UltraDNS and DJBDNS in fairly widespread use (and the one the root servers use if they don't use BIND), or supporting critical domains, but we still need more diversity?! I think promoting correct configuration, and in-balliwick delegation, would be more useful. Now how do I set follow-ups to comp.protocols.tcp-ip.domains ?

2 1

Re: DNS issues various
by Daniel Senie 25 Oct '02

25 Oct '02

At 02:59 PM 10/24/2002, Kelly J. Cooper wrote: >On Thu, 24 Oct 2002 Valdis.Kletnieks(a)vt.edu wrote: > > > On Thu, 24 Oct 2002 18:01:44 -0000, "Kelly J. Cooper" > <kcooper(a)genuity.net> said: > > > > > So, seven years of hardening hosts against SYN attacks. Five years of > > > trying to get people to turn off the forwarding of broadcast packets. > > > Three years of botnets generating meg upon meg of crap-bandwidth. > > > > > > Where are the suuuuuper-geniuses? > > > > You know, most bars have bouncers at the door that check IDs. Sure, > they're > > not perfect, but the bartender can usually be pretty sure the guy > ordering a > > beer is over 21. The average bar isn't run by a soooper-genius. But > it's still > > considered fashionable to let packets roam your network without an ID > check at > > the door. > >Yeah and how's that working so far? The Bouncer/Bartender who serve an underage person are subject to prosecution, and are liable if someone gets drunk and goes driving and gets into trouble. We've had BCPs in place for some time on directed broadcast and ingress issues. I expect it will take lawsuits to get many people to get serious about implementing these. While it's up to lawyers and judges to decide if ignoring an industry Best Current Practice opens a company to negligence, I won't be surprised if I'm asked to testify for a prosecution in such a case.

1 0

Specific Portscans
by blitz 24 Oct '02

24 Oct '02

Is there any consensus of what's scanning all the 1020-1040 ports? (as in what program etc.) Lately, I've seen the scan jump from the 1000 range to 2000, meaning 2035 etc. Is this something that?s been documented? It's annoying at best. Thanks Marc Blitz macronet.net

1 0

charter cable
by Scott Granados 24 Oct '02

24 Oct '02

Could an engineer from Charter Cable contact me off list? Thanks Scott

1 0

Re: More federal management of key components of the Internet needed
by sgorman1＠gmu.edu 24 Oct '02

24 Oct '02

Any volunteers to inform Congress? They are hiring: (surely they are some out work networking engineers available...) The Congressional Research Service is now accepting applications for the following two positions in its Resources, Science and Industry Division. Interested applicants must either apply online at www.loc.gov/crsinfo (preferred) or call (202) 707-5627 to request an applicant job kit. Please reference the appropriate vacancy number on all correspondence. Applications must be received by October 29, 2002. Specialist in Information and Telecommunication Engineering and Public Policy GS-15 ($92,060 - $119,682) - Vacancy #020233 This position will provide senior leadership and public policy expertise on issues related to telecommunications, networking, and government information policy, including information resources management, convergence, and broadband technologies. The specialist will assess the regulatory, legislative, economic and technical aspects of information and telecommunications technologies in a broad public policy context. Individuals with a policy/research background in telecommunications, engineering, economics, or law are strongly encouraged to apply. This is not an IT or technical position. ----- Original Message ----- From: Richard Forno <rforno(a)infowarrior.org> Date: Thursday, October 24, 2002 5:12 am Subject: Re: More federal management of key components of the Internet needed > > > > Why isn't it against the law to (s)Yell "FUD" at Congress ? > > Wouldn't do any good, they don't know any better. Few if any > Congresscritters are techno-literate -- I spent 3 years on the > Hill, saw it > first hand....and it's not gotten much better. > > The only language most Congresscritters understand is $$$$ and how it > relates to their staying elected by keeping their constituients > somewhathappy and impressed with their performance. > > >> I don't understand how giving the US federal government > management control > >> of key components of the Internet will make it more secure. > > <Sean's Rant about FBI info request removed> > > Remember this is the same 'cybercrime agency' that when I-Love-Y0U was > released, simply posted a NIPC warning saying "A New Virus Has > Been Detected > in the Philippenes." -- I was about to make sure my immunization > recordswere up to date. Even after I called them from my NOC, and > told them that > the security community had already dissected the worm and there > were sigs > and coutnermeasures available, they didn't update the warning on > NIPC.GOVfor like 5 hours. > > A screenshot of that particular example of NIPC's expertise is > immortalizedhere: http://www.infowarrior.or > > Commentary I did about NIPC's warning capability is here, if you're > interested. http://www.infowarrior.or > > > And these are the people that are going to -=improve=- security ? > > Hardly. They have a hard enough time passing information from one > squad to > another within the FBI, they're never going to be able to survive and > interoperate in the Information Age against high-tech threats that > move at > packet speed. And don�t get me started about Infragard.....ugh... > > > I think they should be focusing on terrorist activity, if you ask > > me. > > Good idea, since they still haven't got that task down yet, either. > Remember, the FBI - before and after its 2002 reorg - is, thanks > to its > internal culture, UNABLE to work well with outsiders, be they > cops, the CIA, > or ISP security teams. This has the unfortunate effect of > severely torking > those folks in the FBI that are intelligent and want to make a > difference,but thanks to the system, their initiative is > constrained by the 'status > quo'. I feel sorry for some of these folks, they really do try, > but the > system there prevents them from being effective, thus partially > explainingthe mess the FBI and NIPC is in at the moment in > responding to terrorism or > hacker threats. > > re: The "DNS Attack" -- I'm hearing all this talk about DNS-on-CD > that was > some sort of research project that would be used during a loss of > the roots. > Anyone have any add'l info on what this is/was? > > Cheers from DC, > > Rick > Infowarrior.org > > >

1 0

Re: More federal management of key components of the Internet needed
by Michael.Dillon＠radianz.com 24 Oct '02

24 Oct '02

> Hardly. They have a hard enough time passing information from one squad to > another within the FBI, they're never going to be able to survive and > interoperate in the Information Age against high-tech threats that move at > packet speed. And don¹t get me started about Infragard.....ugh... What government fails to realize is that this is war. In a combat situation, you have to rely on the skill and the initiative of front-line troops to win the battle, not generals and certainly not politicians. It is true that generals and politicians can win wars, but they do this by making the battles irrelevant, i.e. negotiating the surrender of the enemy. However, the war we are involved in is against a disorganized enemy who has no politicians of his own and who probably doesn't even have any generals. Since there are no hacker politicians to negotiate with, political action has little chance of being effective. And since there are no hacker generals making sweeping strategic decisions, there is not much for an organization like the FBI or NIPC to do. The best strategic action that government and crimefighting groups can take is to encourage and support the front-line troops to go out there and fight the enemey. Battles are won by persistence, rapidly adapting to the fluid situation and quick decision making on or near the front-lines. That's why the existing communications channels and information sharing tools used by network operators are superior to Infragard or anything that the FBI or NIPC could think up. They are used to the slow plodding post-mortem analysis of crimes that have been committed. Their goal is only to catch the perp. However, on the net, we are more concerned with mitigating the damage of an attack while it occurs and removing newly discovered vulnerabilities as soon as possible. I think a lot of the debate about infrastructure protection would evaporate if we would be clearer about the goals of the different parties and we would recognize that different goals require different means. The FBI can manage their own program to catch perps who attack the infrastructure while we can manage our program to quickly react to an attack in real time, i.e. fight the front-line battles. Perhaps we need to better document the times when the net community was successful in dealing with an attack and analyze what was good and should be kept versus what was bad and could be improved. One incident that I recall was the wave of SYN flood attacks that led to various OS kernels being hardened against such an attack. At the time I was on both the NANOG list and the firewalls mailing list. I crossposted several messages between the two lists so that both communities would see the full picture and so that both groups could work together to win that one battle over a period of two or three days. The end result was not to eliminate SYN floods but we did mitigate the attacks so that nowadays you cannot knock out a server with a low-bandwidth stream of SYN packets. --Michael Dillon

1 0

Surviving the Fiber-Optic Fire Sale
by Hank Nussbacher 24 Oct '02

24 Oct '02

An interesting read: http://www.wired.com/wired/archive/10.11/fiber_optic.html -Hank

1 0