- Test - lists.nanog.org

Updated DNS monitoring, take 2
by Rob Thomas 06 Sep '02

06 Sep '02

Hi, NANOGers. Rodney Joffe (thanks, Rodney!) correctly pointed out that my gTLD monitoring was only tracking the Verisign gTLD (com, net, org) name servers. I have now added the other TLDs to the mix. It can all be found in two places: http://www.cymru.com/DNS/ http://bgp.lcs.mit.edu/dnsmirror/ I will shortly have an additional web server on a much faster set of links, as well as another mirror. For the impatient, I recommend the MIT site. Don't forget to check the Lame Report while you're there. :) Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 06 Sep '02

06 Sep '02

Sean, I completely agree with statement. It is not a matter of wanting to know where the importants hubs are - we have a pretty good handle on that, but what the impacts would be of a hub loss from an operational stand point. Maybe this is a discussion that needs to be off-line. My goal is to provide some context and validation for the research that is being carried out. There have been some interesting discussion on this forum about multi- provider cooperation in case of emergencies/catastropes. Your suggestion of the creation of a directory for contacts across providers was an insightful addition. I believe more discussion along these lines would be of benefit. The desire is for something high level, not any network details that could prove compromising. Thanks, sean ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Thursday, September 5, 2002 12:48 pm Subject: Re: Vulnerbilities of Interconnection > > On Thu, 5 Sep 2002 sgorman1(a)gmu.edu wrote: > > very much like to avoid doing the research in a vaccuum. I was > hoping> a discussion on NANOG wold be a good first step. The > project is quite > > hot with the politicos and I very much want to make sure to best > > recommendations are made. Formal industrsy cooperation is one > side of > > this, but I think a lot of information can be gained from an > informal> approach as well. Any and all feedback is greatly > appreciated > http://www.infosecuritymag.com/2002/sep/2002survey/voices/verylarge.sht ml > > On security reporting... > "Since Sept. 11, state, local and federal authorities have tried > to get > their arms around the potential threats to the nation's > infrastructure--including the telecommunications infrastructure. > They have > asked us questions like, 'What are your 100 most vulnerable places > in the > network?'" > > "As much as we would like to help the government in its attempt to > helpus, we believe it would be counterproductive to share such > informationwidely because if it were released, it would provide a > terrorist with a > roadmap to our key locations. Unless the government agrees that it can > protect our information, we will continue to respectfully decline such > blanket requests." > > Bill Smith > CTO and President of Interconnection Services, BellSouth > > > >

3 2

RE: Vulnerbilities of Interconnection
by Crist J. Clark 05 Sep '02

05 Sep '02

"Daniel Golding" <dgolding(a)yahoo.com> wrote: > The crux of the issue are FOIA requests. The government won't make these > types of vulnerability reports immmune to FOIA requests - thus a foreign > terrorist or home-grown "farmbelt fuhrer" could simply order up a list of > the most vulnerable sites, and select some to attack. They already are exempt from FOIA requests. Namely, EXEMPTION 4, "Trade Secrets, Commercial or Financial Information" or possibly EXEMPTION 7(F) "Physical Safety to Protect a wide Range of Individuals." IANAL. -- Crist J. Clark | cjclark(a)alum.mit.edu | cjclark(a)jhu.edu http://people.freebsd.org/~cjc/ | cjc(a)freebsd.org

1 0

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 05 Sep '02

05 Sep '02

Batz, I believe we are talking about two different perspectives here operational and end user. The concern I have is with the ability of sectors dependent on information infrastructure to operate if there are problems. What web-site is abvailable to the end user is not the value judgement but if NASDAQ can facilitate stock trades, if banks can clear settlements, etc. It does get a little fuzzy in what you consider Internet and what you consider private networks. From a physical perspective they all use a common fiber infrastructure - it all runs in the same trench - so in some terms it does not matter. There has been quite a bit of discussion about physical downage being an inconveniance, and if you limit yourself to just the Internet (web sites, email, porn, etc) this is a valid statement. Where this goes off track is that the Internet is only part of the equation - the operation of several critical infrastructures is dependent on fiber based communications. A cut is a cut - it does discriminate against private networks, security protocols, encryption or anything else. A leased line does not mean you get a special ditch. ----- Original Message ----- From: batz <batsy(a)vapour.net> Date: Thursday, September 5, 2002 7:41 pm Subject: Re: Vulnerbilities of Interconnection > On Thu, 5 Sep 2002 sgorman1(a)gmu.edu wrote: > > :The question is what if someone was gunning for your fiber. To > date > :cuts have been unintentional. Obviously the risk level is much > higher > :doing a phyisical attack, but the bad guys in this scenario are > not > :teenage hackers in the parents basement. > > This happened recently in Quebec where there is a labour > dispute with Videotron and one of the unions representing its workers. > The dispute has been exaserbated by the sabotage of the companies > fiberlines. > > Now, while this may affect Videotrons bottom line, it only becomes > a > critical infrastructure issue when it becomes a Hydro Quebec > issue, > or it interferes with the provinces ability to deliver services. > > Honestly, if a few million people can't get their porn streams, the > world isn't going to end. If 911 operators, or ambulance services > can't direct emergency crews for 10 people, then you have a serious > problem. > > :There is a good foundation of knowledge on the implications of > cyber > :attacks, but the what-if of an intentional physical attack is an > :important question I believe. The context in this discussion has > been > :very valuable and many thanks to everyone that has offered opinions. > > The What-If questions have to be sorted from a particular view, and > it will be the legislators view which will ultimately matter. You > can bluesky, whiteboard, game and scheme all you like, but there are > only a few opinions that matter when it comes to deciding what > is of importance to national security, and until we hear from > them, > we can be as paranoid and imaginative as we want, and it won't help > the infrastructure become more secure. > > So, as for Nasdaq, vs Google, vs the GSA vs Agriculture vs CNN, > until we have the correct order in which to place these entities, > we can't provide a useful or accurate model of how vulnerable the > infrastructure is. > > You mentioned that you thought Nasdaq would be the most important > asset to protect, but what happens if some Internet > traders on AOL can't make their trades because of a fiber cut, vs > not being able to get their infotainment from CNN, vs weather > and crop data data not getting to farmers on time. It's a relative > and ultimately political discussion. > > > -- > batz > > >

1 0

Re: IP address fee??
by Christopher X. Candreva 05 Sep '02

05 Sep '02

On Thu, 5 Sep 2002 nbastin(a)mac.com wrote: > I'm trying to figure out what you think IP space allocation has to do > with bandwidth. IP space is not just another bullet point on the > marketing slide that makes a particular service option that more > attractive - if you can't use it, you can't have it. I have to believe Who said anything about NOT showing justification ? That thread had already been fairly well covered - but didn't address the question as I saw it. The question was about price and that's what I was addressing. You might request justification for any allocation over a single address -- but still not charge until they have 255, or 65,536, or whatever you might decide. ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

1 0

RE: IP address fee??
by Jacob M Wilkens 05 Sep '02

05 Sep '02

I agree. It's my employers policy that a T1 customer recieve a /29 (up to a /28 if they can legitimize it based on the ARIN policy). A T3/DS3 customer is granted a /24 by default. I'm not exactly sure what the purchase price is for additional space, but I do know that whatever space they request must still adhere the ARIN usage and guidelines. (goes for DSL, Dial, etc requests as well) >On Thu, 5 Sep 2002, Owens, Shane (EPIK.ORL) wrote: > >> Quick question, does there exist a practice of charging customer for IP >> address blocks used? My theory is that the first Class C is included with >> the service, but I'm wondering what happens when the customer wants 2,3,4 or >> more? > >Shane: > >I think an important question would be what level of service are they >buying. Including 255 address with a T3 would be very reasonable, less so >with a T1, not very reasonable with DSL, and ridiculous with a dial-up >account. > >There is generally a charge for additional IPs with DSL (or co-location) >services because it is so cheap. You don't usually find this with T1 and >above. But everyone's pricing is different. >

1 0

Re: Vulnerbilities of Interconnection
by Dave Israel 05 Sep '02

05 Sep '02

On 9/5/2002 at 16:01:02 -0400, alex(a)yuriev.com said: > > > > The thing is, the major cuts are not "attacks;" the backhoe operators > > aren't gunning for our fiber (no matter how much it seems like they > > are). If I wanted to disrupt traffic, intentionally and maliciously, > > I would not derail a train into a fiber path. Doing so would be very > > difficult, and the legal ramifications (murder, destruction of > > property, etc, etc) are quite clear and severe. However, if I > > ping-bomb you from a thousand "0wn3d" PCs on cable modems, I never had > > to leave my parents' basement, I'm harder to trace by normal police > > methods, and the question of which laws that can be applied to me is > > less clear. > > This fails to address how this affects someone who has no problem with legal > ramfications - i.e. a terrorist. Even a terrorist will tend towards things that allow him to continue to be a terrorist. If I can do X amount of damage, and get caught, or do X amount of damage, and not get caught, then he'll do the second. Even a terrorist that will die to kill will probably not die to inconvenience.

3 2

[Fwd: Re: IP address fee??]
by Manolo Hernandez 05 Sep '02

05 Sep '02

1 0

Re: Vulnerbilities of Interconnection
by Dave Israel 05 Sep '02

05 Sep '02

The thing is, the major cuts are not "attacks;" the backhoe operators aren't gunning for our fiber (no matter how much it seems like they are). If I wanted to disrupt traffic, intentionally and maliciously, I would not derail a train into a fiber path. Doing so would be very difficult, and the legal ramifications (murder, destruction of property, etc, etc) are quite clear and severe. However, if I ping-bomb you from a thousand "0wn3d" PCs on cable modems, I never had to leave my parents' basement, I'm harder to trace by normal police methods, and the question of which laws that can be applied to me is less clear. -Dave On 9/5/2002 at 15:38:56 -0400, sgorman1(a)gmu.edu said: > > "Again, it seems more likely and more technically effective to attack > internally than physically. Focus again here on the cost/benefit > analysis from both the provider and disrupter perspective and you will > see what I mean." > > Is there a general consensus that cyber/internal attacks are more > effective/dangerous than physical attacks. Anecdotally it seems the > largest Internet downages have been from physical cuts or failures. > > 2001 Baltimore train tunnel vs. code red worm (see keynote report) > 1999 Mclean fiber cut - cement truck > AT&T cascading switch failure > Utah fiber cut (date??) > Not sure where the MAI mess up at MAE east falls > Utah fiber cut (date??) > > Then again this is the biased perspetive of the facet I'm researching > > Secondly it seems that problems arise from physical cuts not because > of a lack of redundant paths but a bottlneck in peering and transit - > resulting in ripple effects seen with the Baltimore incident. > > > > ----- Original Message ----- > From: "William B. Norton" <wbn(a)equinix.com> > Date: Thursday, September 5, 2002 3:04 pm > Subject: Re: Vulnerbilities of Interconnection > > > > > At 02:45 PM 9/5/2002 -0400, alex(a)yuriev.com wrote: > > >This obviously would be a thesis of Equinix and other collo space > > providers,>since this is exactly the service that they provide. It > > won't, hower, be a > > >thesis of any major network that either already has a lot of > > infrastructure>in place or has to be a network that is supposed to > > survive a physical > > >attack. > > > > Actually, the underlying assumption of this paper is that major > > networks > > already have a large global backbone that need to interconnect in > > n-regions. The choice between Direct Circuits and Colo-based cross > > connects > > is discussed and documented with costs and tradeoffs. Surviving a > > major > > attack was not the focus of the paper...but... > > > > When I did this research I asked ISPs how many Exchange Points > > they felt > > were needed in a region. Many said one was sufficient, that they > > were > > resilient across multiple exchange points and transit > > relationships, and > > preferred to engineer their own diversity separate from regional > > exchanges. > > A bunch said that two was the right number, each with different > > operating > > procedures, geographic locations, providers of fiber, etc. , as > > different > > as possible. Folks seemed unanimous about there not being more > > than two > > IXes in a region, that to do so would splinter the peering > population. > > > > Bill Woodcock was the exception to this last claim, positing > > (paraphrasing) > > that peering is an local routing optimization and that many > > inexpensive > > (relatively insecured) IXes are acceptable. The loss of any one > > simply > > removes the local routing optimization and that transit is always > > an > > alternative for that traffic. > > > > > > > > > A couple physical security considerations came out of that > > research:> > 1) Consider that man holes are not always secured, > > providing access to > > > > metro fiber runs, while there is generally greater security > within > > > > colocation environments > > > > > >This is all great, except that the same metro fiber runs are used > > to get > > >carriers into the super-secure facility, and, since neither those > who > > >originate information, nor those who ultimately consume the > > information are > > >located completely within facility, you still have the same > > problem. If we > > >add to it that the diverse fibers tend to aggregate in the > > basement of the > > >building that houses the facility, multiple carriers use the same > > manholes>for their diverse fiber and so on. > > > > Fine - we both agree that no transport provider is entirely > > protected from > > physical tampering if its fiber travels through insecure > > passageways. Note > > that some transport capacity into an IX doesn't necessarily travel > > along > > the same path as the metro providers, particularly those IXes > > located > > outside a metro region. There are also a multitude of paths, > > proportional > > to the # of providers still around in the metro area, that provide > > alternative paths into the IX. Within an IX therefore is a > > concentration of > > alternative providers, and these alternative providers can be > > used as > > needed in the event of a path cut. > > > > > > > > 2) It is faster to repair physical disruptions at fewer > > points, leveraging > > > > cutovers to alternative providers present in the collocation > > IX model, as > > > > opposed to the Direct Circuit model where provisioning additional > > > > capacities to many end points may take days or months. > > > > > >This again is great in theory, unless you are talking about > > someone who > > >is planning on taking out the IX not accidently, but > > deliberately. To > > >illustrate this, one just needs to recall the infamous fiber cut > > in McLean > > >in 1999 when a backhoe not just cut Worldcom and Level(3) > > circuits, but > > >somehow let a cement truck to pour cement into Verizon's manhole > > that was > > >used by Level(3) and Worldcom. > > > > Terrorists in cement trucks? > > > > Again, it seems more likely and more technically effective to > > attack > > internally than physically. Focus again here on the cost/benefit > > analysis > > from both the provider and disrupter perspective and you will see > > what I mean. > > > > > > >Alex > > > > > > > -- Dave Israel Senior Manager, DNE SE

2 1

Re: IP address fee??
by Gregory Hicks 05 Sep '02

05 Sep '02

> Date: Thu, 05 Sep 2002 11:00:43 -0700 > From: "Jeff Shultz" <jeffshul(a)wvi.com> > To: nanog(a)nanog.org > Subject: Re: IP address fee?? > > > Possibly because that is what they are still teaching them as in > school? As much as I hate to interject this... CIDR is fairly new to me, but referring to a "Class C" address conveys some pretty specific information ... Similar to referring to 139.98/24. To *me*, Class C implies a specific address range (probably no longer needed) with specific masks, et al... Oh well, back to lurk mode... Regards, gregory Hicks > > Seriously... I'm not sure that the teachers I had for networking and > systems admin had ever heard of CIDR. > > The textbooks hadn't. It was a nice bump in the learning curve when I > hit the real world. > > *********** REPLY SEPARATOR *********** > > On 9/5/2002 at 1:48 PM Richard A Steenbergen wrote: > > >On Thu, Sep 05, 2002 at 01:36:27PM -0400, Derek Samford wrote: > >> Shane, > >> There is a practice on that (At least here.). Generally > we > >> provide a Class C to our customers at no additional charge, but we > have > > > >Why in this day and age, 9 years after the invention of CIDR, are we > still > >refering to "class C"'s? > > > >-- > >Richard A Steenbergen <ras(a)e-gerbil.net> > http://www.e-gerbil.net/ras > >PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE > B6) > > > -- > Jeff Shultz > Network Support Technician > Willamette Valley Internet > 503-769-3331 (Stayton) > 503-390-7000 (Salem) > tech(a)wvi.com > > ...most of us have as our claim to fame the ability to talk to > inanimate objects and convince them they want to listen to us. > -- Valdis Kletnieks in a.s.r > ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | Internet: ghicks(a)cadence.com "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff You can have it done good, fast, or cheap -- pick any two.

1 0