- Test - lists.nanog.org

FYI: download.microsoft.com problem
by Mike Lewinski 19 Sep '02

19 Sep '02

We're seeing bad throughput via http from both IP addresses we resolve for this host (207.46.235.150 and 207.46.235.162). Connections from three unrelated AS all with T1 or better are giving throughput in tests with wget around 28-64Kbps). Each has a unqiue path to MS. One of our clients reports that from his AT&T cable modem, he gets 1.5Mbps+ for the same file at the same time. Perhaps they're caching the files? (not sure how comfortable I'd be with my provider caching something important like an OS update). Our outbound path to MS currently traverses AT&T fwiw. A test to ftp.microsoft.com when this was first reported to us last night yielded closer to 750Kbps peak and slowly climbing when it completed, so this doesn't look like a congestion issue AFAICT. Traceroutes to MS look quite good, no loss and low latency (all under 100ms) as far as they go. Tests to other sites from all three AS I checked looked significantly better by a factor of 20-50; I found no evidence of connectivity issues anywhere I checked except MS. Copies of the test results and traceroutes were sent to the listed MS contacts on jared's noc list. No auto-ack or bounces yet.... I made one last test (using IE instead of wget), and things seem slightly improved, yielding an initial 800kbps that quickly dropped to 300 dropped steadily to a final 112kbps on a 17MB file. Repeating the wget test also showed some improvement, but not as much (round robin makes this tough to accurately guage). Mike

3 2

Whitehouse Tackels Cybersecurity
by sgorman1＠gmu.edu 18 Sep '02

18 Sep '02

A little flavor of what I'd alluded to in some of the previous threads. Any guesses what the proposal to change both BGP and DNS to improve security might entail?? White House tackles cybersecurity By Declan McCullagh Special to ZDNet News September 16, 2002, 6:58 PM PT http://zdnet.com.com/2100-1105-958159.html The White House's cyberspace security plan, scheduled to be released Wednesday, envisions a broad new role for the federal government in maintaining Internet security.

4 3

RE: Vulnerbilities of Interconnection
by Kurtis Lindqvist 18 Sep '02

18 Sep '02

> I know that the capacity throughout the network I was working on > at the time was designed to handle peak loads with a comfortable > margin, and I would surmise that that is the case on many, if not > most networks. It seems obvious that the scope of the analysis of > this issue must include datacenters and servers, not only the net. > > Other than the electrical power issue in NYC, I don't recall any > loss of communications on 9/11/2001 that related directly to the > network. We where providing emergency transit services to operators in Europe during that day who lost parts or all of their transatlantic services. At the same time people where obviously relaying on the net for information (or we wouldn't have seen the congestions) but the net failed to deliver (congestions at the servers). So, perhaps it's time to start re-thinking what we did - to some extent I think that we already have. - kurtis -

1 0

How do you stop outgoing spam?
by Hank Nussbacher 18 Sep '02

18 Sep '02

Please try to keep this discussion technical and not diverge to opinions. I am not looking for opinions or religion. I am trying to find automated tools/systems/boxes that will stop spam from going *out* from an ISP. The ISP has no servers and allocates IP address space to downstream customers who spam. Yes, I know all about ACLs to block offending IPs. The ISP is willing to buy any box or system to stop outgoing spams and thereby stop constantly playing with ACLs. The spamming is usually done (but not only) from an Internet cafe where the spammer inserts a "spammer CD" and blasts away at open mail relays. When SMTP is blocked for that IP, they switch to HTTP and send the spam via MSN, Yahoo, Hotmail, Kukamail, Outblaze, Safe-mail, etc. to name just a few. Blocking port 80 is harder since it requires maintaining an ever larger list of free public web based mail systems or just block port 80 entirely. Technical solutions welcome. Thanks, Hank

29 76

Re: How do you stop outgoing spam?
by Dave Crocker 18 Sep '02

18 Sep '02

At 02:11 PM 9/16/2002 -0400, Greg A. Woods wrote: > > 2. The issue with email is authentication, not privacy. Authentication can > > be achieved can be achieved easily over port 25, without encryption. > >Well, no, not securely it can't. You cannot have a secure authenticated >service running over a raw TCP circuit across public networks. 1. You are adding to the requirement. No matter how reasonable or advisable, encryption (privacy) is a separate function from authentication. And the rationale for doing port 25 port blocking has to do with accountability, not privacy. 2. Just so there is no confusion, I meant encryption as in privacy (content encryption) rather than as part of an authentication mechanism. 3. SMTPAUTH does not require an alternate port, yet it is sufficient for ensuring accountability. Hence it is sufficient for dealing with the reason that port 25 is blocked, without requiring that it be blocked. > > Hence, blocking port 25 blocks legitimately validated email, > > as well as possible spam. > >Well, yes, but obviously that doesn't matter. This is the real world Dave. Thanks for noticing that. That is why I keep citing the impact on real, mobile users and the implication for such minor opportunities such as wireless hotspots. d/ ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

3 3

Re: How do you stop outgoing spam?
by Dave Crocker 18 Sep '02

18 Sep '02

At 01:09 PM 9/18/2002 -0400, Greg A. Woods wrote: > > I guess the last 20 years of Internet use have been entirely invalid > > then. >Not necessarily -- it's a matter of what level of risk is acceptable in >a given scenario. Thank you. That was my point. It therefore is essential to pay attention to fixing only real-world problems that have an operational basis -- or an extraordinarily unacceptable downside -- before imposing significant change on a large installed base of users. >However we've now reached a point where spammers resort daily to theft >of service against remote mail server and to direct attacks against >target remote mail servers. As bad as that is, it is a long way from stealing connections. Entirely different technical basis. The current situation is technically trivial. Stealing connections is not. Perhaps that is why the former happens all the time and the latter does not. >You're pointing out that some users don't want to live with that more >restrictive framework. I am pointing out that there is a balancing act to perform, and that 100 million users is more than "some". And lest you note that all 100 million are not mobile, and that some mobile users are not inconvenienced, I'll respond that whatever the number is, the impact on mobile hotspot users should finish the question about scale of the impact. >I.e. you can do what you want to do if you use the right tools, but you >can't do it over TCP port 25. If you think a bit harder about your assertion, you will realize that the port number neither creates nor restricts the protection. All that changing the port number does is to impose guaranteed inconvenience on the entire population of mobile users. > > Too bad the 100 million current Internet users do not know that. >Indeed it is. Your kind of F.U.D. doesn't help any either. Noting the impact on the installed base of Internet users is FUD? And by the way... For all the supposed benefit of port blocking -- eg, we don't see as much dial-in spam sourcing -- do we have less spam in the world? Is spam less of a problem? So the inconvenience to mobile users has not solved or even reduced the global problem. Mechanisms for controlling globe-scaled misbehaviors need to be surgical in the care with which they are chosen and applied. Outbound port blocking is a blunt instrument and it is swung blindly. d/ ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

1 0

Re: How do you stop outgoing spam?
by Dave Crocker 18 Sep '02

18 Sep '02

At 11:27 AM 9/18/2002 -0400, Greg A. Woods wrote: >NO. Remote port-25 access, with or without SMTPAUTH, implies raw >unencrypted plain old TCP/IPv4, in which case there is no connection >integrity and thus no accountability. I guess the last 20 years of Internet use have been entirely invalid then. Too bad the 100 million current Internet users do not know that. d/ ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

1 0

IPv6 revisited - I am building a list of IPv6 capable ISP's
by Joe Baptista 18 Sep '02

18 Sep '02

Hello: I am writing a second article on IPv6. My first article is indexed at http://www.circleid.com/articles/2533.asp I have tested IPv6 with the assistance if freenet6.net. It seems to work. In my second article I would like to include a list of ISP's who offer IPv6 to their customers. If you are an ISP that is IPv6 capable please drop me a line and I will include you in a list which will accompany the followup article. regards joe baptista The dot.GOD Registry, Limited http://www.dot-god.com/

2 2

N.I. Observer
by hostmaster 17 Sep '02

17 Sep '02

Anybody willing to share with me (off list) some experiences with Network Instruments' Observer and Analyst packs ? Rating A-E (A=best) perhaps ? As always obliged. Bert Fortrie hostmaster(a)nso.org

1 0

Port 2002
by Scott Call 17 Sep '02

17 Sep '02

Thanks for the quick response everyone, searching for "udp 2002" found way to many things at first, and then I found the info (within 1 minute of sending my email, of course). My apologies again for the time wasting :) -S

1 0