- Test - lists.nanog.org

Re: Rooted boxen and the law
by Scott Gifford 05 Jun '01

05 Jun '01

Jamie Norwood <jnorwood(a)adelphia.net> writes: > I am just curious, in these days where every script kiddie with a > few spare hours is out cracking into every box in sight, what do you > all do when it happens? I know the isolate/reinstall stuff, I am > specifically more interested in administrative stuff. Do you log it? > Report it to the police? FBI? Who? When we had a cracked box on our network, and a reasonable chance of catching the guy, we got absolutely zero help from the FBI. We were only able to get ahold of the agent handling our case once, and never got phone calls returned. That was from the Detroit office; you may have better luck depending on where you're at. Calling CERT might not be a bad idea; might make law enforcement more willing to listen, and somebody at CERT might be able to help apply pressure if needed. > Basically, I just had a box cracked, and have time to kill before I > get access to it to reinstall (Damn cheap colo provider...) and am > wondering if I should just reinstall and get on with life, or if I > should be covering my ass, since I have things on their that will > make me unhappy if they are taken and released to the public domaine > (Reg codes for software and the like.) I would back up the whole thing as it stands now, both to tell what happened and to provide evidence if it comes to that. Hell, hard drives are cheap enough; maybe you should just pull the HD from your cracked machine, and reinstall onto a fresh one. ----ScottG.

1 0

Re: PSI statement on C&W peering issue
by Morris, Gary 05 Jun '01

05 Jun '01

>>> Good for CW. Companies shouldnt cut off peering with >>> others and not think that one day it might just happen to them. What I find alarming about this is what is stopping CW from asking a prohibitive sum of money from other providers? Providers can't simply 'transit through somebody else' free of charge because ultimately somebody is paying for the transit rights.

3 2

C&W Peering Problem?
by Charles Scott 05 Jun '01

05 Jun '01

All: Just got off the phone with C&W's NOC trying to find out why NASA.GOV had fallen off the edge of the earth. When I asked if this had anything to do with the C&W peering policy, the answer was yes. Does anyone have any more information on this? Chuck

8 9

RE: engineering --> ddos and flooding
by Matt Zito 05 Jun '01

05 Jun '01

> Sorry but IMESHO null routing a /32 during a DoS attacck > doesn't exactly > strike me as engineering. It is more like dealing with the attack in > real-time. To mean engineering would mean desinging networks > to be resistant to DDoS and flooding in the first plsce. > > To that end no NSP should ever allow spoofed IP addresses outside of > their network. (not just RFC 1918 addresses but valid IPs that don't > belong to that NSP) > > e.e if I'm have a circut from C&W nd I try to spoof a packet > eith a source address of 216.35.172.135 it should be dropped as > close to the edge of C&W's network as possible. > > note on RFC 1918 addresses: These should never get past customer > edge routers IMESHO. > > Two NSPs should rate limit DoS traffic (ICMP & SYNs) within their > networks in such a way that it can never DoS a T-1 (or E-1 if you are > not in the US). [note: I'm not sure if ciso's are up for this workload > since I primarily work with Juniper.] > Rate-limiting ICMP is not so difficult - rate-limiting SYNs is basically useless. Syn floods work not because the amount of traffic they do, but because they fill up state tables or make them so horribly inefficient as to make the box cease responding on that port. Given that, say, a linux box has a default queue depth of 128, I can send 128 spoofed SYNs at a rate of one a second, and in two minutes that box will stop responding. The larger you make the queue, the longer it will stand up to a slow SYN attack, but the more costly each incoming SYN and SYN+ACK becomes, as the data structures become more and more unwieldy. Thanks, Matt -- Matthew J. Zito Systems Engineer Register.com, Inc., 11th Floor, 575 8th Avenue, New York, NY 10018 Ph: 212-798-9205 PGP Key Fingerprint: 4E AC E1 0B BE DD 7D BC D2 06 B2 B0 BF 55 68 99

2 1

ORBS go bye bye?
by Eric Whitehill 05 Jun '01

05 Jun '01

Anyone know what happened to ORBS? I can't get their web page - all I get is "Due to circumstances beyond our control, the ORBS website is no longer available. " I have my mail servers attempted at being used as relays and it becoming a spammers haven - some customers of mine are getting 1500+ messages and it's starting to become an issue. (From other people relaying to me) Any word? Ideas? I don't want to start a MAPS vs. ORBS thing here.... -Eric

7 8

PSI statement on C&W peering issue
by Sean Donelan 05 Jun '01

05 Jun '01

PSI statement from their website Cable & Wireless chose to terminate connectivity with PSINet on 2June01. Over 90% of the traffic that used to be routed through C&W is now being routed via other means through our robust global free peering infrastructure. The remaining 10% or so represents C&W customers that have been deliberately cut off from PSINet by C&W. While PSINet is ready and willing to re-establish connectivity with C&W at any time, it is up to C&W to choose to reverse their previous decision. In the meantime, PSINet can offer services directly to those C&W customers that are affected. http://www.psi.net/cgi-bin/netstatus.pl5 Does the 10% number mean C&W's network reach has shrunk, or that a growing number of networks are multihomed?

4 3

RE: 95th Percentile = Lame
by Andrew Odlyzko 05 Jun '01

05 Jun '01

The discussion over the last few days has been fascinating. I would like to inject a few remarks. The main one is that there is a huge literature on pricing of communication services and other utilities. The problem is that statements such as > Ideally, the price should match as closely as possible the actual cost to > provide the service. are very appealing, and even agree with conventional economic doctrine, but founder on the difficulty of determining what "the actual cost to provide the service" is. In addition, there are other conventional economic arguments that say prices should match not costs, but rather willingness to pay. Electricity pricing, which has been mentioned here several times, is an interesting case. Original pricing was flat rate (so many dollars or cents for each lightbulb for each month). That was discarded very quickly, largely because of a crucial factor that distinguishes electricity production from telecommunications, namely high marginal costs. Except for hydro (and to some extent nuclear) power, there is a measureable and substantial cost in paying for the fuel that provides each kilowatt-hour of "juice." Even that, though, does not deal with the issues of fixed costs (the generating plant and the transmission lines). How to allocate those costs to various consumers led to extensive discussions and experimentation about a century ago, far more sophisticated than anything that was done in telecommunications at that time or even now. What we have today is usually a combination of fixed rates (dependent on capacity of link) and usage charges (straight fees per kilowatt-hour). Experiments with time-of-day pricing have had mixed outcomes, and there is little of it going on. This might change with smarter appliances, but then it might not. The Internet does not have the high marginal costs that electricity involves. Hence the economic case is different, but even so, theory does not provide an unambiguous answer as to what the answer is. I have several papers that discuss pricing of Internet and other communications (and even more general) services. As a result of the investigations described in those papers, I do come down on a particular side of the debate (namely in favor of flat rates), but also provide extensive references for other arguments. There is a short, 6-page extended abstract entitled "Internet pricing in light of the history of communication," <http://www.research.att.com/~amo/doc/history.communications1.pdf>, (to appear in Proc. ITCom 2001), the full 40-page paper "Internet pricing and the history of communications," <http://www.research.att.com/~amo/doc/history.communications1b.pdf>, to appear in "Computer Networks," and a longer yet and more detailed 160-page manuscript "The history of communications and its implications for the Internet," <http://www.research.att.com/~amo/doc/history.communications0.pdf>. (Replace .pdf in the URLs above with .ps if you are a fan of PostScript.) These might provide some amusement and possibly even enlightenment. Andrew Odlyzko ************************************************************************ Andrew Odlyzko amo(a)research.att.com AT&T Labs - Research voice: 973-360-8410 http://www.research.att.com/~amo fax: 973-360-8178 ************************************************************************

1 0

Agis, PSI, next C&W?
by Sean Donelan 05 Jun '01

05 Jun '01

On Mon, 04 June 2001, "Vivien M." wrote: > It's not likely to be a big technical deal, but the irony I find to be quite > prominent. First PSI forced others to make transit arrangements because of > their greed, and now CW is possibly making PSI do the same, for probably the > same motives. The funny thing about "peering policies" is they are no set policy. Networks can write whatever requirements or non-requirements they choose. Claims that one network or another doesn't meet arbitrary "peering requirements" should always be examined skeptically. Who set these requirements? If you put all the peering requirements into a barral and drew them out randomly, would provider P or C still met any arbitrary requirements from the barrel? Some regular NANOG attendees remember when AGIS implemented their new peering policy. Now, nobody cares about AGIS's peeering requirements. Some regular NANOG attendees remember when PSI implemented their new peering policy. Now, nobody cares about PSI's peering requirements. Cable & Wireless has implemented their new peering policy. I wonder how long it will be before nobody cares about C&W's peering requirements. After their acquisition of InternetMCI customers, C&W was extremely slow in upgrading their network and even slower in upgrading their peering connections. PSI concentrating in international expansion, so their US network is probably smaller than some other US-based providers. On their other hand, if you evaluated PSI as an international provider you might find they meet the "peering requirements" for international providers since other US-based providers are relatively weak elsewhere in the world. Should C&W purchase international transit from PSI? If C&W doesn't want to peer with PSI's international network, I guess C&W will have to decide if they want to buy transit or do without.

1 0

A moment of silence.
by Leo Bicknell 05 Jun '01

05 Jun '01

router>show int fddi5/0/0 Fddi5/0/0 is down, line protocol is down Description: FDDI to mae-east Jun 1 14:36:38.190: %LINK-3-UPDOWN: Interface Fddi5/0/0, changed state to down Jun 1 14:36:39.190: %LINEPROTO-5-UPDOWN: Line protocol on Interface Fddi5/0/0, changed state to down It appears that MFS finally went and did it, and the mae-east we all came to know and love has finally been turned off. Please bow your heads for a moment of silence. -- Leo Bicknell - bicknell(a)ufp.org Systems Engineer - Internetworking Engineer - CCIE 3440 Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

11 13

Re: PSI statement on C&W peering issue
by Richard A. Steenbergen 04 Jun '01

04 Jun '01

On Mon, Jun 04, 2001 at 04:32:45PM -0700, Sean Donelan wrote: > > Does the 10% number mean C&W's network reach has shrunk, or that a > growing number of networks are multihomed? I'm gonna go with "PSI made up a number that sounded good". -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0