- Test - lists.nanog.org

RE: How important is IM? was RE: How important is the PSTN
by James Smith 25 Jun '02

25 Jun '02

> -----Original Message----- > From: Christopher J. Wolff [mailto:chris@bblabs.com] > Sent: Tuesday, June 25, 2002 3:17 PM > To: nanog(a)merit.edu > Subject: How important is IM? was RE: How important is the PSTN > > So my question for the group is, do chat programs (IM, IRC, > yahoo) serve a > substantial network support purpose or are they more of a distraction, > allowing staff to communicate with friends, relatives, > drifters, interlopers > on company time? > > Regards, > Christopher J. Wolff, VP CIO > Broadband Laboratories > http://www.bblabs.com > > It also allows other employees to ask/answer quick questions, have an impromptu engineering con-call (with hard copy!) without having to get someone to approve the cost, provide a support channel for customers (ever try to talk a dyslexic through a command line config? cut-paste is your friend...), and several other things that we find useful. In fact, every engineer in the company is told to get a hotmail account and load MSN Messenger when they come on board. IMHO, abuse of company resources should be handled in HR, not IT. Tools don't waste time, people waste time... James H. Smith II NNCDS NNCSE First Call Response Center Professional Services - Network Engineer The Presidio Corporation

1 0

Bet on with my boss
by Pawlukiewicz Jane 25 Jun '02

25 Jun '02

Hi, How important is the phone to you? I mean, given some situation that arises, can we solve it without the phones? Just curious. You can ignore me if you want. That's okay. Jane

16 19

Re: Bet on with my boss
by Pawlukiewicz Jane 25 Jun '02

25 Jun '02

Hi Jeff, I'm finally collating this information. I may have won the bet but now I have to figure out what percentage of y'all said what. I'll post the results but my boss . . . go figure. Anyway, what's IM stand for? Thanks, Jane Jeff Shultz wrote: > > No phone? No way... I may dislike the gadget, but it is in large part > the reason for my existence here. If more people had a clue about IM, > it might take up some of the slack. > > *********** REPLY SEPARATOR *********** > > On 6/21/2002 at 3:37 PM Pawlukiewicz Jane wrote: > > >Hi, > > > >How important is the phone to you? I mean, given some situation that > >arises, can we solve it without the phones? > > > >Just curious. > > > >You can ignore me if you want. That's okay. > > > >Jane > > -- > Jeff Shultz > Network Support Technician > Willamette Valley Internet > 503-769-3331 (Stayton) > 503-390-7000 (Salem) > tech(a)wvi.com

1 0

Re: packet inspection and privacy
by Steven M. Bellovin 25 Jun '02

25 Jun '02

In message <3D1879B5.4010405(a)marconi.com>, David Charlap writes: > >Steven M. Bellovin wrote: >> Mark Kent writes: >>> >>> I recently claimed that, in the USA, there is a law that prohibits an >>> ISP from inspecting packets in a telecommunications network for >>> anything other than traffic statistics or debugging. >>> >>> Was I correct? >> >> No. Or at least you weren't; the Patriot Act may have changed it. >> (I assume you're talking about U.S. law.) >> >> There was a quirk in the wording of the law -- what you say is correct >> for *telephone* companies, but not ISPs. > >You're referring to "common carrier" status, I think. No, I'm referring to the wiretap act. And this is based on conversations with various Federal prosecutors. > >This isn't exclusively restricted to phone companies, but that's the way >it is right now. I think it may also apply to non-voice carriers that >sell circuits. I'm pretty certain that it does not apply to ISPs. > >A common carrier is not allowed to monitor/filter traffic on customer >circuits. They also can't be held responsible for the traffic on those >circuits. > I'm referring to 18 USC 2510 and 2511, which you can find at http://www4.law.cornell.edu/uscode/18/2510.html and 2511.html. In particular, 18 USC 2511(2)(a)(i) says: It shall not be unlawful under this chapter for an operator of a switchboard, or an officer, employee, or agent of a provider of wire or electronic communication service, whose facilities are used in the transmission of a wire or electronic communication, to intercept, disclose, or use that communication in the normal course of his employment while engaged in any activity which is a necessary incident to the rendition of his service or to the protection of the rights or property of the provider of that service, except that a provider of wire communication service to the public shall not utilize service observing or random monitoring except for mechanical or service quality control checks. Note that the ban on random monitoring applies to a "provider of wire service communication services". 2510(1) defines "wire communication" as "aural transfer", i.e., voice. ISPs provide "electronic communication" services, as defined in 2510(12); ''electronic communication'' means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce, but does not include - (A) any wire or oral communication; (B) any communication made through a tone-only paging device; (C) any communication from a tracking device (as defined in section 3117 of this title); or (D) electronic funds transfer information stored by a financial institution in a communications system used for the electronic storage and transfer of funds; I'll let a real lawyer tell me what category VoIP or EFT over the Internet falls under... Btw, I referred to Eckenwiler's presentation. See http://www.nanog.org/mtg-0010/justice.html for the full thing; see especially slide 12, which discusses what system operators can do, and the part that says "phone companies more restricted than ISPs". Eckenwiler is an attorney at DoJ. And yes, I was the one who suggested that he speak at NANOG, precisely to clear up some of these points. Oh yes -- since I have the statute in front of me, see 2511(2)(a)(ii)(B): No provider of wire or electronic communication service, officer, employee, or agent thereof, or landlord, custodian, or other specified person shall disclose the existence of any interception or surveillance or the device used to accomplish the interception or surveillance with respect to which the person has been furnished a court order or certification under this chapter, except as may otherwise be required by legal process and then only after prior notification to the Attorney General or to the principal prosecuting attorney of a State or any political subdivision of a State, as may be appropriate. Any such disclosure, shall render such person liable for the civil damages provided for in section 2520.

1 0

Re: packet inspection and privacy
by Steven M. Bellovin 25 Jun '02

25 Jun '02

In message <200206241631.g5OGVw2q037988(a)noc.mainstreet.net>, Mark Kent writes: > >I recently claimed that, in the USA, there is a law that prohibits an >ISP from inspecting packets in a telecommunications network for >anything other than traffic statistics or debugging. > >Was I correct? No. Or at least you weren't; the Patriot Act may have changed it. (I assume you're talking about U.S. law.) There was a quirk in the wording of the law -- what you say is correct for *telephone* companies, but not ISPs. > >I'ld also like to get opinions on privacy policies for network >operators. It has been suggested that we should adopt a policy that >says that we'll notify customers if: >1) we inspect traffic, >2) we're aware that an upstream is inspecting traffic >3) we're required to inspect traffic (by anyone). > >Point 3) is just about the same as 1), but it does imply >a slightly different motivation behind the inspection. Point 3 is explicitly prohibited by U.S. wiretap law, if it's a legal, court-approved wiretap under either the regular wiretap statute or the Foreign Intelligence Surveillance Act. Btw -- see the slides from Mark Eckenwiler's tutorial on wiretapping at a recent NANOG (October 2000, as I recall, and definitely in D.C.) --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

2 1

NAT monitoring
by Matt Duggan 25 Jun '02

25 Jun '02

Hi, I'm currently working on a project to determine if it is possible to provide a cross-vendor NAT management/monitoring solution. I would like to know what your thoughts are regarding NAT management and ideally... 1. What hardware do you use with NAT and in what configuration? (just general info, not configs ;-) ) 2. What do you use to monitor/manage NAT? (opensource?) 3. What corners, if any, did you have to cut? 4. Are you aware of any vendor-specific MIBs solely for NAT? - I seem to remember a draft a while ago. Any other thoughts or comments would also be most useful. regards, Matt. _________________________________________________________________ Join the worlds largest e-mail service with MSN Hotmail. http://www.hotmail.com

1 0

Re: packet inspection and privacy
by blitz 25 Jun '02

25 Jun '02

At 09:31 6/24/02 -0700, you wrote: >I recently claimed that, in the USA, there is a law that prohibits an >ISP from inspecting packets in a telecommunications network for >anything other than traffic statistics or debugging. > >Was I correct? I would imagine privacy laws prohibit disclosure of this type of information in some places like Europe, but privacy protection is nil in the US. How else could all this spy-ware be legal to jam down people's throats? >I'ld also like to get opinions on privacy policies for network >operators. We operate much like the FCC rules on radio eavesdropping. If we hear/see something, we do not tell anyone else about it, nor ever use it for financial gain. (One of my major gripes about spyware) >It has been suggested that we should adopt a policy that >says that we'll notify customers if: >1) we inspect traffic, If youre a good network operator, you will always have occasions to do this for performance and security issues that only you can determine the validity of. No need to scare the customer. The customer deserves their privacy to the extent you can facilitate it. By taking their money, they should expect their email and web viewing habits will remain private. You might include a line in your TOS that you might inspect traffic for operational purposes, but anything seen will remain confidential and never used for financial gain. (I'm not a lawyer, so I highly suggest you consult one on this aspect). >2) we're aware that an upstream is inspecting traffic Thats a touchy subject, while we expect our feeds will always be doing similar maintenance/security testing, blowing them in and causing customer angst might get you sued or disconnected. >3) we're required to inspect traffic (by anyone). Since the police-state/anti-privacy measures rammed down our throats post 9.11 they might haul you off to the gulag for doing this. Or worse, declare you an "enemy of the state", strip your citizenship and lock you away forever. >Point 3) is just about the same as 1), but it does imply >a slightly different motivation behind the inspection. I know informing a suspect of a phone tap, in the telecom business will get you hard time. SO again, check with your law people...a lot's changed since 9.11 and the police state is doing things that havent been ruled legal or illegal by the USSC. So beware and get competent legal council before implementing anything. These are offered only as opinions...

3 2

packet inspection and privacy
by Mark Kent 24 Jun '02

24 Jun '02

I recently claimed that, in the USA, there is a law that prohibits an ISP from inspecting packets in a telecommunications network for anything other than traffic statistics or debugging. Was I correct? I'ld also like to get opinions on privacy policies for network operators. It has been suggested that we should adopt a policy that says that we'll notify customers if: 1) we inspect traffic, 2) we're aware that an upstream is inspecting traffic 3) we're required to inspect traffic (by anyone). Point 3) is just about the same as 1), but it does imply a slightly different motivation behind the inspection. Thanks, -mark

3 2

SPEWS?
by Alex Rubenstein 24 Jun '02

24 Jun '02

I've had a little run-in with SPEWS, and the crowd on news:news.admin.net-abuse.email. I'm curious; do folks take these guys serious? I'll admit, we had an issue with a customer who spammed, and it took us a little while to zap him. Nevertheless, he was zapped. He had a /27, and SPEWs listed the entire /24 surrounding it. When I asked about this, they said, in not-so-many-words, that by doing this, punishing innocent bystanders, that as long as the ISP noticed and fixed the issue, this was essentially OK to do. Of course, I disagreed, and was called all sorts of names that I'd not used since I was 14. So, to the point; what is the consensus on SPEWs? I've never really noticed them until this point. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

42 98

Korean Ministry unveils anti-spam guideline
by Hank Nussbacher 23 Jun '02

23 Jun '02

For those suffering from spam: http://www.koreaherald.com/SITE/data/html_dir/2002/06/20/200206200013.asp Just FYI - not to open a discussion. -Hank

1 0