- Test - lists.nanog.org

BGP listserv
by Berger, Gary 13 Mar '01

13 Mar '01

Is there a list that purely discusses BGP? Gary Berger Internal Consultant, Principal Dow Jones & Company Enterprise Network Services Voice: 609.520.7323

3 2

News Feed
by Morris Allen 13 Mar '01

13 Mar '01

Off topic Question. Does any body have any information on News Server Feeds. I have lost my, and need to locate another that doesn't want an arm and a leg for a small ISP. Thanks Morris Allen VidcomNet, Inc. P.S. Please reply private to: mallen(a)vidnet.net

2 1

RE: Filtering email messages for canned ham
by Smith, Rick 13 Mar '01

13 Mar '01

I forgot to mention I'm already using rblsmtpd to work with blackhole lists. R -----Original Message----- From: Smith, Rick [mailto:rsmith@atsworld.com] Sent: Tuesday, March 13, 2001 9:17 AM To: 'nanog(a)merit.edu' Subject: Filtering email messages for canned ham Evidently, Nanog(a)merit.edu doesn't accept emails with the four letter word interpretation of my subject line. I have a machine which is the primary MX for my network, a linux box running Qmail (1.03) which scans every inbound mail to my domain for viruses before being passed on to the secondary MX, an Exchange Server. That works well, so I'd like to break the whole thing by adding to it some means of filtering out UCE / <Canned Ham> ;) Anyone used or know of tools that are written for Qmail's interaction ? Thanks, Rick Smith Director of Technical Services Applied Tactical Systems (A division of Vertex Interactive, Inc.) <http://www.atsworld.com> --- <http://www.vertexinteractive.com> (973) 808 - 1750 x382

1 0

Filtering email messages for canned ham
by Smith, Rick 13 Mar '01

13 Mar '01

Evidently, Nanog(a)merit.edu doesn't accept emails with the four letter word interpretation of my subject line. I have a machine which is the primary MX for my network, a linux box running Qmail (1.03) which scans every inbound mail to my domain for viruses before being passed on to the secondary MX, an Exchange Server. That works well, so I'd like to break the whole thing by adding to it some means of filtering out UCE / <Canned Ham> ;) Anyone used or know of tools that are written for Qmail's interaction ? Thanks, Rick Smith Director of Technical Services Applied Tactical Systems (A division of Vertex Interactive, Inc.) <http://www.atsworld.com> --- <http://www.vertexinteractive.com> (973) 808 - 1750 x382

1 0

Prefix length filtering at the ISP-ISP edge
by Alexandre.Gibouin＠sita.int 13 Mar '01

13 Mar '01

Nothing new in this mail but I need some clarification ... - To my understanding, the common practice is, at least, to accept any address block larger or equal to /19 and to filter any block smaller than /24 (except eventually at the customer-ISP edge). ARIN and RIPE have changed for a while their minimum allocation size to /20 so I guess there is no risk of routing blackhole with /20 blocks, right? - What about PI-blocks between 21 and 24 bits? If a end-user network annouces such an address block, what is the risk of routing blackholes throughout the Internet? - Each ISP seems to apply its own filtering policy. Nevertheless, what are the most common filtering practices for the ISP-ISP edge? - Is it common to have different filtering policies depending on the address ranges? I will be grateful for any link to official or non-official documentation. Thanks for your help Alex

1 0

Looking Glass Code
by Don Simpson 13 Mar '01

13 Mar '01

I have been thinking about putting together a looking glass site on my network and have looked at Ed Kern's (DIGEX) html and perl script but do not want to enable rsh (anywhere) and do not want to reinvent the wheel if not necessary. Has anyone seen an updated script written to use other access means like telnet or ssh to exchange CLI/commands and results with an IOS router? ---------------------------------------------- Don Simpson ----------------------------------------------

6 5

RE: Would anyone be interested (SQL/Bind)
by Roeland Meyer 13 Mar '01

13 Mar '01

> From: Steven J. Sobol [mailto:sjsobol@NorthShoreTechnologies.net] > Sent: Monday, March 12, 2001 5:44 PM > On Mon, 12 Mar 2001, David R. Conrad wrote: > > > I might point out that BIND version 9 comes with a > Postgres/SQL sample > > "simple database interface" driver that permits the storage > of DNS zone > > data in a Postgres/SQL database. Zone data is extracted > from the database > > per query (the data does not need to be extracted and BIND > reloaded). If > > the DNS load is too high to support SQL queries on a > per-DNS query basis, > > using a stealth primary would most likely work. > > I'll take a look at that. It might be a good idea to make it > modular, if > it isn't already modular[0], so that people could create > "plugins" that > work with other databases. Personally, I'm going to see how > much work is > involved in porting the code to MySQL, since I don't use Postgres. If "other databases" include Oracle 8i, I might be interested. Might as well put it on a production-ready DBMS.

1 0

Re: tcp,guardent,bellovin
by Jim Duncan 13 Mar '01

13 Mar '01

Rafi Sadowsky writes: > No eavesdropping at all ? how can a TCP connection be hijacked if you're > not on the connection path? > (Or capable of diverting the connection past you - > breaking routers/source_routing/<whatever>.... ) The attacker merely has to get his data into the TCP stream on the victim host. No return traffic necessary. This means the attacker can be _outside_ the victim's network if source address forgery isn't prevented. This is _not_ new; same attack Mitnick used on Shimomura. If you're on the path, you certainly don't need to guess the TCP ISN to hijack a connection. This isn't new, either. :-) By the way, Cisco stuff that has the fix we advertised in the security advisory a couple of weeks ago is *NOT* vulnerable to the attack announced by Guardent. The older stuff in IOS is not vulnerable either, but some of our other products _are_ vulnerable. Of course, we already announced that at http://www.cisco.com/warp/public/707/advisory.html . I'll be along with a more official announcement, but I figured I'd mention it here, too. Jim -- Jim Duncan, Product Security Incident Manager, Cisco Systems, Inc. <http://www.cisco.com/warp/public/707/sec_incident_response.shtml> E-mail: <jnduncan(a)cisco.com> Phone(Direct/FAX): +1 919 392 6209

1 0

Re: tcp,guardent,bellovin
by Steven M. Bellovin 13 Mar '01

13 Mar '01

In message <Pine.GSO.4.31.0103121911520.9269-100000(a)meron.openu.ac.il>, Rafi Sa dowsky writes: > > Hi > > Is there anything actually new in this exploit compared to the known TCP >hijacking vulnerabilities as portrayed say in Phrack 50(Juggernaut) ? Juggernaut requires eavesdropping; this one doesn't. --Steve Bellovin, http://www.research.att.com/~smb

2 1

Re: tcp,guardent,bellovin
by Steven M. Bellovin 13 Mar '01

13 Mar '01

In message <200103122349.f2CNndk28613(a)foo-bar-baz.cc.vt.edu>, Valdis.Kletnieks@ vt.edu writes: > >On Mon, 12 Mar 2001 18:09:32 EST, "Richard A. Steenbergen" said: >> And since the "victim" will have the current sequence number for inbound >> data, what would keep it from (correctly) sending an RST and tearing down >> this false connection? > >And THAT my friends, was the *original* purpose for a TCP SYN flood - it >wasn't to DOS the victim, it was to DOS a machine *trusted by* the victim >so you could forge a connection and NOT get nailed by an RST. > >I'm sure that Steve Bellovin can point us at the original discussion >of this, which was *ages* ago. I remember hearing that Kevin Mitnick >used that (in addition to other tricks) against Shimomura's machines >and thinking "Hmm.. so it's *not* just a theoretical attack anymore..." > > More or less. When doing a sequence number guessing attack, one of the problems faced by the attacker is preventing the spoofed machine from replying with an RST to the SYN+AC for a connection it knows nothing about. Morris's original version used a low-rate SYN flood that exploited a bug in the BSD kernel to effectively gag a low-numbered port. His paper can be found at ftp://ftp.research.att.com/dist/internet_security/117.ps.Z This isn't the same weakness that was exploited by the early SYN floods, but it took advantage of the same limit on half-open connections. --Steve Bellovin, http://www.research.att.com/~smb

1 0