- Test - lists.nanog.org

NIST best practices for wireless networks?
by Sean Donelan 27 Jul '02

27 Jul '02

NIST has a new draft publication on Wireless Network Security. It is a good consolidation of 802.11 and bluetooth wireless security. http://csrc.nist.gov/publications/drafts/draft-sp800-48.pdf What I would like to call network operator's attention is the checklist of recommended wireless network security best practices. Although the NIST publication says it is applicable to all organizations, the checklist may only be applicable to specific uses of wireless networks. Some universities are on the fourth generation of their wireless network architecture, having found some of the best practices weren't the best thing to do. One example, the NIST recommendation is to "enable all security features of the WLAN product, including the cryptographic authentication and WEP privacy feature." While vendors may like this, a blanket recommendation to enable all (including vendor proprietary?) security features probably isn't a good idea.

1 0

The Cidr Report
by CIDR Report 27 Jul '02

27 Jul '02

This is an auto-generated mail on Fri Jul 26 23:00:01 PDT 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amount of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 26Jul02 0) General Status Table History ------------- Date Prefixes 190702 111736 200702 112010 210702 111833 220702 111748 230702 111737 240702 111820 250702 112023 260702 112031 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 13332 Number of ASes announcing only one prefix: 8124 (4581 cidr, 3543 classful) Largest number of cidr routes: 638 announced by AS3908 Largest number of classful routes: 1206 announced by AS701 1) Gains by aggregating at the origin AS level --- 26Jul02 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1088 838 250 23.0% Telstra Pty Ltd AS701 1206 967 239 19.8% UUNET Technologies, Inc. AS17557 293 101 192 65.5% Pakistan Telecom AS6595 230 58 172 74.8% DoD Education Activity Network As AS852 541 404 137 25.3% Telus Advanced Communications AS7018 808 681 127 15.7% AT&T AS16473 195 77 118 60.5% Bell South AS7303 170 73 97 57.1% Telecom Argentina Stet-France Tel AS1239 514 417 97 18.9% Sprint AS4151 237 142 95 40.1% USDA AS19632 99 5 94 94.9% Metropolis Intercom S.A. AS12302 118 25 93 78.8% MobiFon S.A. AS16814 105 20 85 81.0% NSS, S.A. AS226 171 88 83 48.5% Los Nettos AS7046 299 222 77 25.8% UUNET Technologies, Inc. AS4755 208 132 76 36.5% Videsh Sanchar Nigam Ltd. Autonom AS577 264 191 73 27.7% Bell Advanced Communications Inc. AS2149 347 274 73 21.0% Performance Systems, Inc. AS2048 179 107 72 40.2% State of Louisiana AS724 228 160 68 29.8% DLA Systems Automation Center AS4323 402 334 68 16.9% Time Warner Communications, Inc. AS3464 163 103 60 36.8% Alabama SuperComputer Network AS19834 64 4 60 93.8% NetForce, Inc. AS10620 85 25 60 70.6% TVCABLE BOGOTA AS16758 63 6 57 90.5% IKON Office Solutions AS5515 242 186 56 23.1% Sonera Finland Autonomous System AS3908 299 243 56 18.7% Supernet, Inc. AS209 311 255 56 18.0% Qwest AS9498 83 29 54 65.1% BHARTI BT INTERNET LTD. AS9051 81 27 54 66.7% INCONET Autonomous System Total 55129 42479 12650 22.9% For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Are you lame? :)
by Rob Thomas 27 Jul '02

27 Jul '02

Hello, NANOGers. I recently came across a web site belonging to Justin McNutt that lists all of the lame delegations his name servers have detected. This is a great way to share some clue and keep track of errant domains. I have received his kind permission to mimic his efforts using data collected from three of my name servers. I will update this page weekly, and you will find it here: http://www.cymru.com/DNS/lame.html Justin's page is available here: https://dnps-linux2.telecom.missouri.edu/~mcnuttj/lame.html The DNS root name server statistics are still available, and have moved here: http://www.cymru.com/DNS/dns.html My thanks to the authors of the lamers.sh script, which I modified to suit my purposes. Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

2 1

OID for Voip?
by Alex Rubenstein 26 Jul '02

26 Jul '02

Anyone know the OID to determine how many TDM ports are in use on an AS5300-VOIP box? -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

2 1

RE: Draft of Rep. Berman's bill authorizes anti-P2P hacking
by Rowland, Alan D 26 Jul '02

26 Jul '02

I'd get on my cell phone and call the police. That's their job. Of course there is that little fact of having a legal right to the property in question in the first place. :) I fully agree this is Not Good (TM), hence the BAD in my response. Having said that, satellite providers periodically 'kill' hacked access cards on equipment in the user's home with no legal ramifications. How would this be significantly different? Waiving the fourth amendment flag is just FUD in this case. There's more than sufficient current law out there that applies in this case. The entertainment industry just wants an even easier answer. They're lazy. What's new? WorldComm, Adelphia, AOL, (you and me next?), have made this industry and its practices an easy target. Historically, market segments either clean up their own act, or government steps in. I believe this business is at that point now. How we act in the near future will greatly affect the amount of government involvement we'll see. Arguing in support of haz0r/warez networks won't help the cause. To put a different spin on the DCMA/17USC512 takedown letter issue, does this mean you support opt-out lists for Spam as apposed to opt-in? That's how the entertainment industry views our current process. There's a lot of disucssion on this list (actually OT but we see it here anyway) about identifying questionable E-mail traffic (spam). Is it really that much harder to identify questionable P2P traffic? Or are we all too busy listening to our MP3s playlists and watching the latest Starwars rip? Just my 2¢ Best regards, _________________________ Alan Rowland -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Thursday, July 25, 2002 1:57 PM To: Rowland, Alan D Cc: nanog(a)merit.edu Subject: Re: Draft of Rep. Berman's bill authorizes anti-P2P hacking On Thu, 25 Jul 2002 13:11:00 PDT, "Rowland, Alan D" <alan_r1(a)corp.earthlink.net> said: > IANAL but IMHO spewing cracked copies of say, Photoshop, or other > copyright violations might be considered probable cause with the > specific place/things being the share program and it's contents. If your house was broken into, and your TV stolen, and you were walking along and saw it in your neighbor's living room through the window, would that give you the right to go in and reclaim it? Would it exempt you from having to pay for a new door to replace the one that got broken down? You might want to ask yourself why the now-standard 17USC512 takedown letter isn't sufficient..... I wonder how many 'Hax0rs-R-Us' record labels are about to incorporate. Bad JuJu.

9 9

Draft of Rep. Berman's bill authorizes anti-P2P hacking
by Marshall Eubanks 26 Jul '02

26 Jul '02

Thought this would be considered on-topic as guess who would have to clean up the resulting messes... Regards Marshall Eubanks ----- Forwarded message from Declan McCullagh <declan(a)well.com> ----- From: Declan McCullagh <declan(a)well.com> Subject: FC: Draft of Rep. Berman's bill authorizes anti-P2P hacking To: politech(a)politechbot.com Date: Tue, 23 Jul 2002 20:29:35 -0400 X-URL: http://www.mccullagh.org/ X-URL: Politech is at http://www.politechbot.com/ http://news.com.com/2100-1023-945923.html?tag=politech Could Hollywood hack your PC? By Declan McCullagh July 23, 2002, 4:45 PM PT WASHINGTON--Congress is about to consider an entertainment industry proposal that would authorize copyright holders to disable PCs used for illicit file trading. A draft bill seen by CNET News.com marks the boldest political effort to date by record labels and movie studios to disrupt peer-to-peer networks that they view as an increasingly dire threat to their bottom line. Sponsored by Reps. Howard Berman, D-Calif., and Howard Coble, R-N.C., the measure would permit copyright holders to perform nearly unchecked electronic hacking if they have a "reasonable basis" to believe that piracy is taking place. Berman and Coble plan to introduce the 10-page bill this week. The legislation would immunize groups such as the Motion Picture Association of America and the Recording Industry Association of America from all state and federal laws if they disable, block or otherwise impair a "publicly accessible peer-to-peer network." Anyone whose computer was damaged in the process must receive the permission of the U.S. attorney general before filing a lawsuit, and a suit could be filed only if the actual monetary loss was more than $250. According to the draft, the attorney general must be given complete details about the "specific technologies the copyright holder intends to use to impair" the normal operation of the peer-to-peer network. Those details would remain secret and would not be divulged to the public. The draft bill doesn't specify what techniques, such as viruses, worms, denial-of-service attacks, or domain name hijacking, would be permissible. It does say that a copyright-hacker should not delete files, but it limits the right of anyone subject to an intrusion to sue if files are accidentally erased. [...] ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ Declan McCullagh's photographs are at http://www.mccullagh.org/ ------------------------------------------------------------------------- Like Politech? Make a donation here: http://www.politechbot.com/donate/ ------------------------------------------------------------------------- ----- End forwarded message ----- -- Regards Marshall Eubanks T.M. Eubanks Multicast Technologies, Inc 10301 Democracy Lane, Suite 410 Fairfax, Virginia 22030 Phone : 703-293-9624 Fax : 703-293-9609 e-mail : tme(a)multicasttech.com http://www.multicasttech.com Test your network for multicast : http://www.multicasttech.com/mt/ Status of Multicast on the Web : http://www.multicasttech.com/status/index.html

14 15

RE: QoS/CoS in the real world?
by Jeff Hancock 26 Jul '02

26 Jul '02

Kurtis, My apologies on the low SNR. The original question(s) centered around the customer requirements/applications/experience and I thought the product guys could speak to it better than I ... and certainly and without giving away any of our "patent pending processes". :) I think "native" can be translated as to mean "non-ATM". All core links are PPP/POS. MPLS does not imply or require DSCP, or vice versa. DSCP/EXP promotion ensures priority packets to be forwarded ahead of best effort at each hop thru the network. Could this be done other ways? Sure. The original question was how was/is this being done for customer traffic - this is how we do it in the core...along with queueing gymnastics. As for MPLS features, I think fast re-route qualifies. MPLS also provides traffic eng capabilities, as well as in-order packet delivery, which we've found to be useful for customer voice 'n video traffic. J -----Original Message----- From: Kurt Erik Lindqvist [mailto:kurtis@kurtis.pp.se] Sent: Thursday, July 25, 2002 5:54 AM To: nanog(a)merit.edu Subject: RE: QoS/CoS in the real world? Appart from that this to me looks like a marketing post.... > Sorry I didn't see this note earlier, but wanted to make you aware > that Masergy Communications is actually offering such a service on a > native MPLS based IP network. We provide differentiated IP services > via "native MPLS based IP network" ? Native to what? > MPLS based IP network. We provide differentiated IP services via > customer DSCP marking at the network edge. QoS is supported end to end > through the Masergy core via promotion to the MPLS EXP marking. Uhm, I never figured out why we need MPLS to honor the DSCP markings. After reading further in the text it doesn't seem to me as if you are using any of the MPLS "features" either... Sorry - I couldn't resist... - kurtis -

2 1

Fwd: Re: ELF/Scalper-A Spreading?
by senthil ayyasamy 26 Jul '02

26 Jul '02

--- Jeff Shultz <jeffshul(a)wvi.com> wrote: > Date: Fri, 26 Jul 2002 08:24:34 -0700 > From: "Jeff Shultz" <jeffshul(a)wvi.com> > To: "senthil ayyasamy" <mplsgeek(a)yahoo.com> > Subject: Re: ELF/Scalper-A Spreading? > > http://www.glocksoft.com/trojan_list/Kuang2_the_virus.htm > Apparently > not very new. (May 1999) > > Feel free to forward to NANOG - I don't have posting > priviliges. > > *********** REPLY SEPARATOR *********** > > On 7/25/2002 at 9:18 PM senthil ayyasamy wrote: > > >> > But activity in more across 17300. > >> > > >> > (http://www.dshield.org/port_report.php?port=17300) > >> > what might be the reason? > >> > >> yeah. > > > >I have read somewhere that 17300 is used by a new > >virus called *Kuang2 Virus*. Have anyone heard of > such > >names? > > > >__________________________________________________ > >Do You Yahoo!? > >Yahoo! Health - Feel better, live better > >http://health.yahoo.com > > > > -- > Jeff Shultz > Network Support Technician > Willamette Valley Internet > 503-769-3331 (Stayton) > 503-390-7000 (Salem) > tech(a)wvi.com > __________________________________________________ Do You Yahoo!? Yahoo! Health - Feel better, live better http://health.yahoo.com

1 0

Re: ELF/Scalper-A Spreading?
by Drew Linsalata 26 Jul '02

26 Jul '02

Doh! That was a typo in my original message. I meant UDP port 2001. Drew Linsalata The Gotham Bus Company Internet Server and Carrier Neutral Co-Location http://www.gothambus.com > Most of the 'I got flodoed by apache wormed machines' floods are udp/2001 > not 2100... you sure its 2100 in your acls? > >> >> Our border ACLs are catching about three thousand UDP/2100 hits every minute >> tonight. Is anyone else seeing this? It seems as if ELF/Scalper-A (the >> Apache/FreeBSD worm) is spreading. >>

1 0

ELF/Scalper-A Spreading?
by Drew Linsalata 26 Jul '02

26 Jul '02

Our border ACLs are catching about three thousand UDP/2100 hits every minute tonight. Is anyone else seeing this? It seems as if ELF/Scalper-A (the Apache/FreeBSD worm) is spreading. Drew Linsalata The Gotham Bus Company Internet Server and Carrier Neutral Co-Location http://www.gothambus.com

3 3