- Test - lists.nanog.org

in-addr survey?
by Patrick Greenwell 11 May '01

11 May '01

I'm attempting to convince "the powers that be" that attempting to use reverse lookups to determine geographic locale is extremely inaccurate. One of the reasons among the many this is the case (I believe) is that significant portion of admins do not have properly configured in-addr. Has anyone done this sort of survey(Bill Manning?) If so, anyone have a pointer handy? Thanks.

3 2

RE: Solaris/IIS worm hits 9000 boxes in 48 hours
by Petri Stephen 11 May '01

11 May '01

That list of IP addresses is from Tuesday. I know of a number of machines that were compromised that were not on that list. I can only imagine what the number has climbed to since Tuesday. Stephen Petri -----Original Message----- From: Ian Cooper [mailto:icooper@equinix.com] Sent: Friday, May 11, 2001 4:26 PM To: nanog(a)merit.edu Subject: Re: Solaris/IIS worm hits 9000 boxes in 48 hours At 16:14 5/11/2001 -0400, Petri Stephen wrote: >http://www.theregister.co.uk/content/6/18882.html > >......The quite reliable hacker tracker attrition.org is reporting that >nearly nine thousand machines had been auto-defaced by the sadmind/IIS worm >as of Tuesday, making it one of the most effective little scripts ever >loosed on the Net....... Quite. However, since this is NANOG you missed the most interesting parts: "Attrition has posted the IPs of all the boxes known to have been hit..." "What's ironic here is that the worm exploits two separate holes which were reported and patched ages ago. Call it proof-of-concept that sysadmins spend an awful lot of time on activities other than absorbing security bulletins."

1 0

Re: Solaris/IIS worm hits 9000 boxes in 48 hours
by Ian Cooper 11 May '01

11 May '01

At 16:14 5/11/2001 -0400, Petri Stephen wrote: >http://www.theregister.co.uk/content/6/18882.html > >......The quite reliable hacker tracker attrition.org is reporting that >nearly nine thousand machines had been auto-defaced by the sadmind/IIS worm >as of Tuesday, making it one of the most effective little scripts ever >loosed on the Net....... Quite. However, since this is NANOG you missed the most interesting parts: "Attrition has posted the IPs of all the boxes known to have been hit..." "What's ironic here is that the worm exploits two separate holes which were reported and patched ages ago. Call it proof-of-concept that sysadmins spend an awful lot of time on activities other than absorbing security bulletins."

1 0

Solaris/IIS worm hits 9000 boxes in 48 hours
by Petri Stephen 11 May '01

11 May '01

http://www.theregister.co.uk/content/6/18882.html ......The quite reliable hacker tracker attrition.org is reporting that nearly nine thousand machines had been auto-defaced by the sadmind/IIS worm as of Tuesday, making it one of the most effective little scripts ever loosed on the Net....... Stephen Petri

1 0

Re: 10 gige experience
by Frank Coluccio 11 May '01

11 May '01

Off Topic, kinda... check out the caption at the bottom of this page: http://www.iec.org/tutorials/opt_ethernet/topic05.html The tutorial isn't bad, either ;) ------Original Message------ From: "dave o'leary" <doleary(a)juniper.net> To: Mike Leber <mleber(a)he.net>, Vinay Bannai <bannai(a)pacbell.net> Sent: May 10, 2001 2:35:24 AM GMT Subject: Re: 10 gige experience IEEE standards web page at http://grouper.ieee.org is quite helpful for finding the status of the various standards. In particular, check http://grouper.ieee.org/groups/802/3/ae/public/mar01/minutes_0301.pdf for the minutes of the last IEEE 802.3ae Working Group meeting. Target for completion is 1Q 2002. At this point, much of the work has been completed, I believe that all of the outstanding issues were resolved at the meeting and they have gone to working group ballot (don't ask me about all the details of the IEEE decision making process, but they are online). So at least things are close enough that chip sets are being developed and equipment vendors can get underway with confidence that there won't be too much change, such that standards compliant products should be available about in the same timeframe that the standard is completed. dave At 04:14 PM 5/9/01 -0700, Mike Leber wrote: >On Wed, 9 May 2001, Vinay Bannai wrote: > > > Anybody out there have any experience with 10 gigabit ethernet? > > > > I don't think the 10GEA has standarized the draft. It is slated for mid > 2002. > > But some vendors might have non-standard implementations, but I am not > aware of > > it. > >Here is an article that states that IntelliSpace and others are already >using 10 Gigabit Ethernet equipment provided by Extreme Networks. It is >skimpy on the details. > >http://www.computerworld.com/cwi/story/0,1199,NAV47_STO54671,00.html > >I'm trolling to see if anybody in the nanog crowd was willing or able >(NDAs and all) to tell us about any 10 gige equipment they might be using. > >+------------------- H U R R I C A N E - E L E C T R I C -------------------+ >| Mike Leber Direct Internet Connections Voice 510 580 4100 | >| Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | >| mleber(a)he.net http://www.he.net | >+---------------------------------------------------------------------------+ > >

2 1

Re: black hat .cn networks
by Adrian Chadd 11 May '01

11 May '01

On Wed, May 09, 2001, Ehud Gavron wrote: > "Europeans have this knack..." > > OFF-TOPIC and stupid. > > Europeans have this knack of taking a perfectly good on-topic > operational problem and turning it into a whine about how > Americans don't try and speak their N languages. Referring to me? God, I hate being flamed. > Welcome to the Internet. We speak English. Welcome to > telecommunication carriers. We speak English. Welcome to > the International Space Station. We speak English. Welcome > to maritime SOS. We speak English. Welcome to my backyard. > > We speak English. You don't have to like it, but it's not > xenophobic, xenocentric, Americentric, Anglocentric, or anything > other than REALITY created through EXPEDIENCY. Thats strange. I see lots of work with the free unices in an attempt to get internationalisation to work. I see lots of commercial software applications and operating systems which have localisation and internationalisation options. And, on mailing lists with a subscriber base that is non technical and non-English-subscriber-limited, I frequently get emails sent by people in some other language[1]. In fact, I could say that a lot of foreign users can get away being on the internet without a decent understanding of English. The internet != telco != ISS != Maritime SOS != any other internationally agreed upon and perhaps regulated area where English has been accepted as being the "language of choice". The internet has no regulations, and as such you must understand that not everyone on the internet - admin or user - is required to speak English. Adding to that, the intelligence level required to pilot an airplane, operate telco infrastructure, fly a spacecraft or sail a boat is _NOT_ being dumbed down so any idiot user that can read can use. Now, if it were me, I'd force any company with an internet connection and a BGP connection to have a NOC/sysadmin(s) capable of speaking a common language. I'd prefer it to be English because I don't speak any other languages (yes, I'm Australian, and as my dutch friends will be quite happy to point out _i do not speak any other languages_) but I'd be happy with some form of standard. The internet has a bunch of technical standards which we loosely agree to. There's no law stating "thou shalt speak English if connected via BGP4 to thy internet". Live with it. Adrian [1] Generally they are french. :-) -- Adrian Chadd "How could we possibly use sex to get <adrian(a)creative.net.au> what we want? Sex _IS_ what we want!" -- Fraser

13 16

Connectivity from 60 Hudson to NYIIX
by Randy Neals 11 May '01

11 May '01

Has anyone used an Ethernet LAN extension service to get from 60 Hudson to NYIIX? Perhaps you could email me off-list and tell me what layer 1, 2, 8, or 9 issues you ran into getting the circuit installed/working. Trying to decide if that is a workable alternative to dropping a router at NYIIX and using a conventional telco circuit. Thnx Randy Neals Manager, Engineering GT Group Telecom Inc. 20 Bay, Suite 700 Toronto, Ontario.

2 1

Traffic generator for loadbalancer test
by Arnold Nipper 10 May '01

10 May '01

I am looking for a traffic generator for stresstesting load balancers. Has anyone an idea if there is software or anything else? I'm particularly interested in testtraffic for DOMAIN and WHOIS. Thanks, Arnold -- Arnold Nipper / nIPper consulting mailto:arnold@nipper.de Heilbronner Str. 34b Phone: +49 700 NIPPER DE D-76131 Karlsruhe Mobile: +49 172 2650958 Germany Fax: +49 180 505255469743

4 3

RE: ISP Filter Policies--Follow Up--Verio Verification
by Murphy, Brennan 10 May '01

10 May '01

I wanted to follow up on my query below. I found a real-world case where a company advertises /16, /19 and /24 nets from the same Class B space....yet all are reachable from Verio's network (I tested this with Verio's Traceroute Server). A phone call to Verio verified for me why all 3 nets are reachable. (interestingly, the traceroutes themselves sort of masked how this was working--hence, the need to talk to Verio) Basically, it was as I had thought--because at least one of the sites advertises /16, this is enough to get traffic off of Verio's net, ie, all traffic destined for any piece of the /16 is passed to its "nearest" neighbor. If that neighbor in turn has the /19 & /24 in addition to the /16, the routing from that point on will be optimal. If not, it passes it to the neighbor from which it received the /16...and so on, until someone has the full /19 or /24 net. So, when I originally posted the note below, I was worried that Verio customers might not be able to reach certain networks with prefixes longer than /16, ie, sort of blackholing the routes to those destinations. (Remember, I'm new to Internet routing.) That would indeed seem to be the case if there were no /16 advertisement in addition to the more specific announcements. That's the generic BGP/Verio lesson I drew. The more specific lesson is that if your working with a large provider like Internap or Genuity in all your sites, traffic destined for your location is going to get back to you as long as they are advertising the /16 in addition to the more specific nets. ...even if the source hosts are on networks like Verio's. Any further comments appreciated. -----Original Message----- From: Murphy, Brennan [mailto:Brennan_Murphy@NAI.com] Sent: Tuesday, May 08, 2001 12:07 PM To: 'nanog(a)merit.edu' Subject: ISP Filter Policies--Effect is what? I'm trying to figure out to what degree the existence of these policies should be accounted for in a BGP design which includes sites around the world. I've read through a few of the threads having to do with Verio's Filtering Policy. And I read the policies listed here: http://www.nanog.org/filter.html Consider the following theoretical scenario: Site BGP Advertisement to ISP Amsterdam 169.61.201.0/24 AMSISP Austin 169.61.111.0/24 Genuity & Internap SanFran 169.61.119.0/24 Genuity & Internap Tokyo 169.61.202.0/24 TOKISP Sydney 169.61.156.0/24 SYDISP 1. Since Verio says they would not accept /24 nets drawn from Class B space, I assume this means that they don't insert a /16 into their tables so that the /24 nets appear to Verio customers as unreachable. In this case, a design that wants to extend connectivity to verio customers (and any other ISP with similar policies) must include a /16 advertisement from at least one of the sites. 2. Suppose a customer of a Verio-like ISP, wishes to go to ftp. foo.org. DNS returns 169.61.201.155 (in amsterdam, see above). Verio passes the traffic to the neighbor it received the /16 advertisement from. At this point, the best thing that could happen is if that neighbor has the /16 and /24 networks in its route table, right? That means, a path exists for that user to the amsterdam server and the only problem with routing to Amsterdam is that Verio possibly handed the traffic to a sub-optimal neighbor. Am I understanding this issue correctly? I'm new to BGP. I've tried to get a handle on this issue on my own and by working with Genuity, Internap and Cisco. No disrespect to those companies but each of them had this vague memory of Verio's policy but couldnt really tell me in plain language how it might affect the above scenario. Obviously, I wasn't talking to chief engineers. Someone from the CCIE mailing list suggested I browse the archives of this list, which I did. But I didnt find a clear enough answer to my questions--perhaps because they are too basic to be discussed here or I'm not good at using this lists archive search engine. Either way, any guidance on the above scenario is greatly appreciated. -BM

1 0

Draft agenda for Scottsdale
by Susan Harris 10 May '01

10 May '01

DRAFT AGENDA - NANOG 22 SUNDAY TUTORIALS 1:30 - 3:00 p.m. BGP Techniques for Service Providers (Phil Smith, Cisco) 1:30 - 3:00 p.m. Basic ISP Traffic Engineering Tools and Practices (John Brown, Chagres Technologies) 3:00 - 3:30 p.m. BREAK 3:30 - 5:00 p.m. BGP Techniques (cont'd.) 3:30 - 5:00 p.m. ARIN Policies and Guidelines (Richard Jimmerson, ARIN) MONDAY GENERAL SESSION 9:00 a.m. Welcome, Introductions (Susan Harris, Merit, Rodney Joffee, CenterGate) 9:15 a.m. Estimating Global Denial-of-Service Activity (Stefan Savage, UCSD/Asta Networks, David Moore, CAIDA/CAIMIS, Geoff Voelker, UCSD) 9:45 a.m. Observations and Experiences Tracking Denial-Of-Service Attacks Across a Large Regional ISP (Rob Malan, Farnam Jahanian, Jon Arnold, Matthew Smart, Univ. of Mich.; Paul Howell, Russell Dwarshuis, Jeff Ogden, Jon Poland, Merit) 10:15 a.m. An Anomaly-Based Approach to Identifying and Stopping DDoS Attacks (Massimiliano Poletto, Mazu Networks) 10:45 a.m. BREAK 11:05 a.m. A Fine-Grained View of High-Performance Networking (Steve Casner, Cengiz Alaettinoglu, Chia-Chee Kuan, Packet Engines) 12:00 p.m. LUNCH 1:30 p.m. IPv4 Address Space Allocation and Usage Trends (Scott Marcus, Genuity) 1:50 p.m. Progress With the DNS Security Extensions (Edward Lewis, TISlabs) 2:20 p.m. A View of the Future Internet (Peter Lothberg, Stupi LLC) 3:00 p.m. BREAK MONDAY BREAKOUT SESSIONS (3:30 - 5:00 p.m.) Track A: Introduction to IP Multicast Practice (Bill Nickless, Argonne National Lab) Track B: SNMP Update (Jeff Case, SNMP Research) Track C: More on Network Policy--Sequel to a BOF, Prelude to a Tutorial (Stephen Stuart, MFN) ================= 5:30 - 7:30 p.m. Beer 'n Gear! ================= Monday Evening BOF 7:30-9:00 p.m. Internet Routing Registry Coordination (Jerry Winters, Cisco) TUESDAY GENERAL SESSION 9:00 a.m. The New IETF Sub-IP Area: A Brief Summary for Service Providers (Curtis Villamizar, Avici) 9:30 a.m. MPLS Enhancements to Support Layer 2 Transport Services (Jeremy Brayley, Laurel Networks) 10:00 a.m. Very Pleasant/Painful Networking: The Highs and Lows of Building and Maintaining VPNs (Matt Baker, Intel) 10:30 a.m. BREAK 10:50 a.m. OSPF for a Broadband Wireless Campus Backbone (Joseph Hui, Arizona State University) 11:20 a.m. Operational Experience with IPv6 Migration (Bill Manning and Akira Kato, ISI) 11:40 a.m. An Information Sharing and Analysis Center for the Internet (Kelly Cooper, Genuity) 12:10 p.m. Inter-Domain Content Networking (Brad Cain, Cereva Networks) 12:40 p.m. Closing Remarks (Susan Harris, Merit) 12:45 p.m. Adjourn

1 0