- Test - lists.nanog.org

Re: tcp,guardent,bellovin
by Richard A. Steenbergen 12 Mar '01

12 Mar '01

On Mon, Mar 12, 2001 at 11:25:35PM +0100, bert hubert wrote: > > The 50.000 foot view: There is a further vulnerability in TCP/IP if > you can determine the Initial Sequence Number without actually > starting a connection. By exploiting your knowledge of the remote > host, a telephone modem user can cause webservers to become massive > Denial of Service agents, targeting arbitrary targets. Lots of > consumer editions of windows come with easily guessable sequence > numbers. ... > Now, if you are able to guess the number '14' above, and you know the > packet sizes a server will produce, you can invent ACKs from arbitrary > source IP addresses. The Server Computer doesn't notice anything > interesting, and blasts out data at speeds possibly exceeding its > interface or line speed. And since the "victim" will have the current sequence number for inbound data, what would keep it from (correctly) sending an RST and tearing down this false connection? Also, even given the assumption that Windows is easily ISN spoofable (which I would certainly hope is not the case, I thought everyone learned that lesson years ago), I don't see many consumer editions of windows being readily available to hackers, running webservers with large files on fast uplinks. I think any kind of useful ISN-guessing based DoS would require sniffing access to the server in question. It might be possible to "speed up" the transmission of an already established connection inproperly for a short time, but this would quickly fall over and die. It might also be possible to trick the "big server" into sending more data to a host which does not exist and cannot reply then it can successfully deliver outbound for an extremely short time, but I think if your "big server" is ISN-guessable you have bigger problems to worry about. And if the hacker does have ISN-sniffable access, why would it not be easier for them to launch the attack directly from their compromised machine on the same network? BTW If you wanted to force the packets to a known size, this could easily be done with a small MSS option. Infact its probably far deadlier to establish a real connection to a big webserver with a tiny MSS and watch it send tons of small packets. To my knowledge there is no (reasonable) minimium size limit for a requested MSS? -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

3 2

RE: Looking Glass Code
by Ukyo Kuonji 12 Mar '01

12 Mar '01

You could always code in expect. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Don Simpson Sent: Monday, March 12, 2001 3:18 PM To: nanog(a)merit.edu Subject: Looking Glass Code I have been thinking about putting together a looking glass site on my network and have looked at Ed Kern's (DIGEX) html and perl script but do not want to enable rsh (anywhere) and do not want to reinvent the wheel if not necessary. Has anyone seen an updated script written to use other access means like telnet or ssh to exchange CLI/commands and results with an IOS router? ---------------------------------------------- Don Simpson ---------------------------------------------- _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

massive mail replication from 24.93.35.225
by Randy Bush 12 Mar '01

12 Mar '01

the host 24.93.35.225, from roadrunner space, tried to dump MASSIVE mailing list recycles on me. like many thousands of messages. randy

3 2

new.net: yet another dns namespace overlay play
by Paul A Vixie 12 Mar '01

12 Mar '01

[ this came from http://www.new.net/about_us_press.tp and appears not to be a joke. its operational impact will not be felt today, but if it's even moderately popular before it dies, operational impact WILL be felt. i'm quite surprised by some of the folks they list as their partners. --vix ] Contact: Claudia de Llano or Lisa Doiron Connors Communications (310) 452-7540 claudia(a)connors.com or lisa(a)connors.com Brad Copeland New.net, Inc. 626-229-7800 pr(a)new.net New.net Expands Internet Naming With Launch of 20 New Top-Level Domain Names New Domain Name Registry's Technology Uses Existing Internet Naming System to Make Available Sensible, Meaningful Web Addresses Pasadena, Calif. - March 5, 2001 - New.net (http://www.new.net) a domain name registry created to meet the market demand for Web addresses with logical, easy-to-remember extensions that make Internet navigation easier, today officially released its first 20 new top-level domains. New.net has developed a novel, proprietary approach, using software technology deployed at either the network level by partner ISPs or on individual PCs, that uses the existing Internet naming system to enable millions of users to gain access to these new addresses. With this launch, the Internet community will be able to purchase and use domain names with extensions ("top-level domains") that were previously unavailable. Each of the new top-level domains was chosen to enable organizations and individuals to create Web addresses that more clearly describe their product, service offering, group activity or passion. The first 20 top-level domains being released are: .CHAT .GMBH .LTD .SPORT .CLUB .HOLA .MED .TECH .FAMILY .INC .MP3 .TRAVEL .FREE .KIDS .SHOP .VIDEO .GAME .LAW .SOC .XXX "New.net will dramatically broaden the scope of available domain names," said David Hernand, CEO of New.net. "Our research has indicated a tremendous market demand to move beyond .com and .net. We believe these new extensions will make it far easier for companies and individuals to market their Web sites using more intuitive addresses and for Internet users to navigate the Web." Availability Domain names using the initial set of extensions are available on a first-come, first-served basis for a flat fee of $25 per year. New.net anticipates that the availability of such descriptive extensions will inspire purchasers to provide content that is relevant to the specific domain names purchased. However, as an added benefit to parents, the company will require those purchasing domain names ending in .kids to offer Web sites that contain kid-friendly content and comply with the Children's Online Privacy Protection Act, and it reserves the right to revoke names that aren't used accordingly. Partnerships Through strategic relationships with leading Internet Service Providers (ISPs), including EarthLink, Excite@Home, and NetZero, over 16 million users will have access to the New.net domains beginning this week. Other Web users can activate their Internet browsers to recognize the new domain names in a few seconds by visiting www.new.net. "EarthLink is excited to partner with New.net as we identify new ways for our subscribers to more easily find information on the Internet and in turn, make their own Web sites more readily accessible to others," said, Jon Irwin, executive vice president of EarthLink's user experience. "By automatically making New.net available to our customer base, we are enhancing EarthLink's online experience and helping to provide an open, uncensored connection to the real Internet." New.net has also embarked on a series of partnerships designed to promote the mass downloading of its browser plug-in and widespread use of its new domain names. In the first of these announcements, New.net has partnered with MP3.com. As a result of this partnership, MP3.com will be an exclusive third-party seller of .mp3 domain names and will encourage its millions of visitors to activate New.net's browser plug-in. MP3.com's Web site hosts what it believes is the largest collection of digital music available on the Internet, with audio files posted from over 135,000 digital artists and record labels. These artists will be able to sign up for unique Web addresses with their name and the .mp3 extension (e.g., www.artistname.mp3) Opportunities also exist for current registries and registrars of .com and other domain names. New.net is currently in discussions with a wide variety of companies to offer the New.net domains to their customers. New.net is making additional efforts to win the trust of parents that .kids sites will be appropriate for their children. As part of that effort, New.net has reached an agreement in principle with .KIDS Domains, Inc. to be the official registry of .kids domain names. Those applying for .kids domain names will be required to publish content that is "kid-friendly" and in compliance with the Children's Online Privacy Protection Act (COPPA) and .KIDS Domains guidelines. .KIDS Domains will be screening all requests for .kids domain names for appropriateness and will be implementing a process to evaluate sites' compliance with guidelines for kid-friendly content. The International Solution "We believe that New.net's new domains will be particularly attractive to the international community, which has been long-neglected by the existing naming system," added Hernand. "By adding .gmbh, .ltd and .soc, in addition to .inc, we can provide a more sensible naming system for businesses in a wide variety of countries. And by introducing the .hola extension, we have a unique top-level domain that will appeal to the growing population of Spanish-speaking Internet families in the U.S. and around the world. In addition, New.net's technology will allow the use of foreign-language characters in both the domain name and the extension, unique among naming systems." The Technology New.net is able to provide use of these new, top-level domains through innovative, patent-pending technology that allows the New.net names to live within the existing Internet domain name system. Whether on an individual browser level via the New.net plug-in, or through software resident on a participating ISP's server, requests to display Web pages with New.net domain names are resolved by appending the additional extension .new.net onto the address. As a result, requests are automatically routed to New.net's DNS servers to determine the correct IP address of the computer hosting the Web page. New.net has partnered with UltraDNS, one of the Internet's leading DNS infrastructure services companies, to provide scalable, global DNS services. The Future New.net plans to introduce additional new top-level domains based on consumer and business demand. The company is engaged in ongoing market research to narrow the list of possibilities and is actively seeking consumer feedback on its Web site in order to assist in making sound, market-driven choices. New.net will also consider proposals submitted by third parties interested in having particular top-level domains released. About New.net New.net (http://www.new.net) is building the Internet's leading market-driven domain name registry business by selling domain names with logical, easy-to-remember top-level domain extensions that make the Internet easier to navigate. Based in Pasadena, California, the company was started in May 2000 by idealab!, a leading Internet incubator. Since that time, New.net has developed propriety technology that allows its domain-naming system to exist alongside the traditional naming systems currently in use on the Internet. # # # © 2001 New.net, Inc. All rights reserved.

32 46

Re: new.net
by Scott Gifford 12 Mar '01

12 Mar '01

richb(a)pioneer.ci.net writes: > Corporate entities should be *required* to register in the flat dot-com > namespace, IMHO, and not be *allowed* names in any other namespace. I like the idea of creating a new ".tm" TLD (or something less likely to conflict with a CCTLD), and requiring anybody who wants trademark protection to register there; everything else is a free-for-all, as it pretty much is now. Let them have their little trademark disputes over there, and let less litigious heads rule in the other TLDs. -----ScottG.

6 6

tcp,guardent,bellovin
by Chris Beggy 12 Mar '01

12 Mar '01

tcp,guardent,bellovin are all mentioned in a WSJ article on DOS and session hijacking, but I don't see anything on CERT yet. Any details? Any incidents using the exploit guardent has identified? Chris

1 0

core router bakeoff at Light Reading
by David Newman 12 Mar '01

12 Mar '01

(apologies for cross-posting) Readers of this list may be interested in the results of a four-vendor core router bakeoff just posted here: http://lightreading.com/testing Each vendor supplied: up to 12 x OC-192c up to 48 x OC-48c The entries were: Charlotte's Networks Aranea-1 Cisco 12416 Foundry NetIron Juniper M160 Tests included: IP baselines MPLS baselines BGP table capacity MPLS LSP capacity longest-match lookup route flapping route convergence filtering class of service There's also a discussion of packet reordering. Regards, David Newman Network Test

1 0

DNS - Bind database
by David Hares 11 Mar '01

11 Mar '01

I'm looking for a database to drive creation of the BIND config and zone files. I've been doing it for years myself, but have turned it over to Customer Service, who cannot seem to get the concept of maintaining forward and reverse mapping. I run BIND 8 on Solaris, so something that runs under Solaris (not MickeySoft) is preferable. Both web and local shell database modification is definitely a plus. I'd rather not reinvent the wheel by programming this myself. Dave ----------- David Hares Director, Network Engineering NetworkTwo Communications Phone: 734.827.3620 650 KMS Place FAX: 734.827.3690 Ann Arbor, MI 48108 Email: dhares(a)networktwo.net

5 4

Re: tcp,guardent,bellovin
by Steven M. Bellovin 11 Mar '01

11 Mar '01

In message <87hf0z59qe.fsf(a)lackawana.kippona.com>, Chris Beggy writes: > > >tcp,guardent,bellovin are all mentioned in a WSJ article on DOS >and session hijacking, but I don't see anything on CERT yet. > >Any details? Any incidents using the exploit guardent has >identified? Not to my knowledge... The folks at Guardent are talking to CERT and to various vendors about the problem before releasing any details. --Steve Bellovin, http://www.research.att.com/~smb

4 3

The Cidr Report
by Tony Bates 11 Mar '01

11 Mar '01

This is an auto-generated mail on Fri Mar 9 23:00:00 PST 2001 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 09Mar01 0) General Status Table History ------------- Date Prefixes 020301 97761 030301 97965 040301 99978 050301 97915 060301 98487 070301 98007 080301 97909 090301 98107 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 91.16.23.0/24 from AS11770 AS Summary ---------- Number of ASes in routing system: 10176 Number of ASes announcing only one prefix: 5971 (3385 cidr, 2586 classful) Largest number of cidr routes: 954 announced by AS701 Largest number of classful routes: 1612 announced by AS1221 1) Gains by aggregating at the origin AS level --- 09Mar01 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1612 1211 401 24.9% Telstra Pty Ltd AS2764 754 539 215 28.5% connect.com.au pty ltd AS701 1416 1258 158 11.2% UUNET Technologies, Inc. AS8006 145 19 126 86.9% Systems & Software Consortium, In AS7545 190 70 120 63.2% TPG Internet Pty Ltd AS9269 162 53 109 67.3% Internet service Provider in Hong AS6429 213 107 106 49.8% RdC Internet AS6595 161 62 99 61.5% DoD Education Activity Network As AS705 331 238 93 28.1% UUNET Technologies, Inc. AS4293 380 287 93 24.5% Cable & Wireless USA AS13999 102 11 91 89.2% Mega Cable S.A. de C.V. AS8013 324 238 86 26.5% PSINet Ltd. Canada AS4151 229 147 82 35.8% USDA AS7018 648 569 79 12.2% AT&T AS4755 209 130 79 37.8% Videsh Sanchar Nigam Ltd. Autonom AS1942 136 64 72 52.9% FR-CICG-GRENOBLE AS816 386 315 71 18.4% UUNET Canada AS577 240 170 70 29.2% Bell Advanced Communications Inc. AS174 496 428 68 13.7% PSINet Inc. AS724 214 148 66 30.8% DLA Systems Automation Center AS5106 101 37 64 63.4% Ameritech Advanced Data Services, AS11170 64 1 63 98.4% Bewell Net AS7657 169 108 61 36.1% The Internet Group Limited AS3749 120 59 61 50.8% Tennessee Board of Regents AS3464 153 93 60 39.2% Alabama SuperComputer Network AS226 154 94 60 39.0% Los Nettos AS376 133 76 57 42.9% Reseau Interordinateurs Scientiqu AS16758 63 6 57 90.5% IKON Office Solutions AS6413 67 11 56 83.6% Southern Online Systems, Inc. AS7568 83 28 55 66.3% C.S. Communications Co., Ltd. For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

2 1