- Test - lists.nanog.org

Re: Stream2
by Jason Legate 31 Jan '01

31 Jan '01

Perhaps if people read the source, and compared it with the original, they would notice that there are not many operational differences, aside from the fact that this goes through the extra step of setting MSS, and calculating the correct checksum. The fact that the _all_ the packet kids can use this, doesn't unleash a deadly new tool, merely a slightly modified one. There are no optimizations in this upon the original, nor are there any real benefits. It was merely written to produce a syn generator that created packets with correct checksums and MSS. The further comment you made regarding the url merely demonstrates your immaturity to deal with a situation when it arises. > Thank you for making available code that now _all_ the packet kids can > use. Releasing this doesn't prove any theories, expose something new, > or have any redeemable value whatsoever. The sound everyone hears is > a collective orgasm of 12-year-olds with linux machines everywhere.

2 1

Re: Stream2
by Steven M. Bellovin 31 Jan '01

31 Jan '01

In message <20010130220354.A43493(a)arpa.com>, jamie rishaw writes: > >you released something that's gonna be a pain in >engineers' asses all over the world? > Regardless of the merits of posting this, the earlier stream. has been out for a *long* time. I don't think the incremental damage from the new one is that great. --Steve Bellovin, http://www.research.att.com/~smb

2 1

beating about the bush (not)
by bmanning＠vacation.karoshi.com 31 Jan '01

31 Jan '01

I'm in favor of the following: Honesty. Publish what you have. If you must, lie. Publish an version that "blends" with the prevaling landscape if you must. Such behaviour is wrong and may lead to further probes since the reported version and the server behaviour don;t jibe. I'm never in favor of "boasts" or "taunts". That is tantamount to asking for further investigation. Blocking queries leads to a false sense of security. Someone will figure out what your running anyway. ------- > > Bill - just a quick question about your post today (pasted below). You're > hinting at what might be a more prudent thing to do, but I'm not getting the > hint. > > Would you rather deny the version.bind query, give an intriguing answer > (e.g. "bad-ass-bind"), an intentionally misleading answer (e.g. 4.8.1 or > 9.5.6), or what? > > ----

1 0

Re: Stream2
by Richard A. Steenbergen 31 Jan '01

31 Jan '01

On Tue, Jan 30, 2001 at 09:42:23PM -0500, Jason Legate wrote: > > This is thrown together partially from the original sources of stream, > and partially from my own ramblings, it was a quick and dirty hack, so > there are parts of it that are messy. For testing purposes on a lan, > if you want to verify packet headers, and not send as fast as it can, > you can define SLOW. > > This version has the fixed tcp cksum, and a MSS window of compile-time > definable size. Jason, you are a disgrace. You didn't learn after being fired from at least 2 companies that I know of for being a packet kiddie, you didn't learn when you released the first version of code you did not write and badly mangled with your idioticy, and you apparently still havn't learned today. In addition, you havn't learned how to code any better either. This accomplishes nothing except destruction of other peoples networks. It disappoints me that after sitting on this for over a year and a half, as soon as I FINALLY release it semi-publicly, you rear your ugly head and put out more crap to destroy networks. I can only hope that some victim of your stupidity decides to sue you for everything you are not worth. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Month for DNS problems
by Sean Donelan 31 Jan '01

31 Jan '01

I don't know if they are related, but anytime you have folks working on working systems there is a chance for error. At least two large telco internet providers appear to have corrupted one or more of their DNS name servers today. E-mail to the affected providers resulted in no response in one case, and directions to use a different name in the other case. Information from third-parties indicates both were configuration errors. No word if this was because they were loading a new version of BIND or they just corrupted their data files conincedently.

1 0

calling attention to servers
by bmanning＠vacation.karoshi.com 30 Jan '01

30 Jan '01

Its a honeypot Chris.... if the goal is to deny intel, don't spraypaint it a neon green. Camo is much nicer... if that is the tactic you wish to take. > > attack away... it's a bit harder to figure out what it is... and bind's > not exploitable (at least not yet...) so as long as all other things are > 'ok' I'm just denying intel to the 'enemy'... besides, tcp queries are > verboten anyway :) > > --Chris > > > On Tue, 30 Jan 2001 bmanning(a)vacation.karoshi.com wrote: > > > lets see... (from previous discussions on the usefullness of tweeking > > the version) > > > > wearing my blackhat, i have to decide which system is worthty > > of my talents... which one should I pick? > > > > version "bad-ass-bind"; > > -or- > > version "9.1.0" > > > > of course I could be running 4.8.1 and simply recompile so it _reports_ > > a bogus version but the profile of a 9.1.0 code base is -very- distinct > > from a 4.8.1 code base... esp on replies to queries. > > > > Pick your targets carefully. > > > > > > > > > Why not jus return some 'bogus' version ??? like this option allows: > > > > > > version "bad-ass-bind"; > > > > > > :) > > > > > > > > --Chris > > > > > > > > ####################################################### > > > > ## UUNET Technologies, Inc. ## > > > > ## Manager ## > > > > ## Customer Router Security Engineering Team ## > > > > ## (W)703-289-8479 (C)703-283-3734 ## > > > > ####################################################### > > > >

1 0

Pingable IPs on backbones?
by Christopher A. Woodfield 30 Jan '01

30 Jan '01

I just had one of those "duh" experiences today, and it made me think a bit... At my job at <vijay> a promising local ISP </vijay>, I was turning up a customer, who decided to test his connectivity by trying to ping and trace to www.sprint.net and www.uu.net. As it turns out, both servers are behind firewalls, that block ICMP and UDP, so you can't ping or trace to either server. But then my customer asked me, "OK, can you give me a hostname in UU's netspace that I CAN ping?" It took some thought and experimentation to find one (mail.uu.net and ns1.sprint.net, in case anyone wants to know). What this brought to mind was this question: would it be worth my time to compile a list of pingable and traceable IPs that live on the major backbones for connectivity testing and troubleshooting? I do wind up seeing a lot of cloobies trying to ping a site, and assuming it's down because IMCP-blocked. Thoughts? -C --------------------------- Christopher A. Woodfield rekoil(a)semihuman.com PGP Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB887618B

2 1

Re: Labeling and naming
by Sean Donelan 30 Jan '01

30 Jan '01

On Tue, 30 January 2001, Timothy Brown wrote: > > Is there a database of geographical CLLI codes anywhere available for free? > A portion of CLLI is available as an ANSI standard (not free, but it you don't have to go through Telcordia's lawyers idea of a license agreement).

1 0

Re: Labeling and naming
by Ian MacKinnon 30 Jan '01

30 Jan '01

We try and use poplocation-routerfunction-number At 02:20 PM 24/01/2001, Kurt Erik Lindqvist wrote: >For a project I am currently working on I stumbled upon the following. >What is the best way to lable and name equipment? Although this applies to >all equipment such as SDH ADMs, IP, ATM etc I realised that it seems to be >hardest to find a sensible convention for IP equipment. Preferably I would >like to find a convention that fits all, but I guess that is utopia. > >So, since list contains, PTTs, Telcos, ISPs and wannabees is there any >good common scheme or pointers to something useful? > >- kurtis - -- Ian MacKinnon ian(a)teliauk.net Telia UK Ltd +44 20 7870 5413 (Office) +44 7768 706 052 (Mobile)

3 2

RE: BGP and anycast
by Swede 30 Jan '01

30 Jan '01

Thanks for the reply! Well, I'm actually trying to "stretch" the rules of unicast and go to anycast. The point is to have several places on the internet replying to the same addresses. I'll mirror the same services in these places (on a /24 that is allowed through filters). Masataka Ohta pointed me in this direction (you better be quick, they seem to be about to expire) * draft-ietf-dnsop-ohta-shared-root-server-00.txt * draft-ietf-dnsop-hardie-shared-root-server-02.txt If I understand these correctly I wasn't too fare away on my first guess. *Except* that the "uniquely routable addresses" should come from nearest upstream (which mean they could be longer than /24). Does anyone have any more pointers on this matter (maybe examples on CCO :)? Guess it's time to sign up on the lab reservation list... /Swede --- Mike Schoenecker <MSchoenecker(a)yipes.com> wrote: > > If I understand this correctly you are trying to > advertise one /24 out to 2 > separate providers on the internet. > If this is the case you will need to make sure that > the 2 providers in this > scenario are the same and will allow you to > advertise smaller subnets of > this block. If you advertise the same block out of > 2 separate regions BGP > will not know where to send traffic. BGP will > select the most specific and > route to this destination. If there are 2 similar > advertisements there will > be routing anomalies. If you are trying to connect > the sites together [ one > subnet ] across the internet, the best way to do > this is to establish a VPN > between sites and advertise the entire /24 out of > one region and share the > subnet between regions over the VPN. The points of > the VPN will need to be > of public address space that is either advertised or > routed to you from your > provider. Netscreen has a solution for this. This > will enable you to > receive traffic destined to your network at one > location and forward the > necessary traffic across the internet to your other > region over the VPN. I > have found it very difficult to get anyone to listen > to advertisements less > than a /24 this is why I suggest that the carrier > between regions be the > same it would be easier to get them to satisfy this > request. I thought of > the use of IBGP but you will still experience the > same issues of > reachability i.e the transit carrier would need to > advertise no less than > the /24. > > Hope this helps > PS. get Internetwork Routing Architectures by Cisco > it is the best book on > BGP. > > -----Original Message----- > From: owner-nanog(a)merit.edu > [mailto:owner-nanog@merit.edu]On Behalf Of > Swede > Sent: Monday, January 29, 2001 5:18 PM > To: nanog(a)merit.edu > Subject: BGP and anycast > > > > How does one announce the same net (with the same > origin AS) from different places on the Internet? Or > should the "anycast" networks be announced from > different origin AS:es? > (Can't find "anycast" setup in my BGP for > Dummies<tm>) > > ---------------------------------------- > AS12345 > IGP > (announces net 1.2.3/24 among others) > Connected to several major networks (P, Q, W, Z) > ---------------------------------------- > Isolated* site 1 (one unique routable net and > 1.2.3/24) > Router connected to a major network X, announced as > AS12345 > ---------------------------------------- > Isolated* site 2 (one unique routable net and > 1.2.3/24) > Router connected to a major network Y, announced as > AS12345 > ---------------------------------------- > * Isolated - No contact to main AS via IGP, tunnels > or > telepathy > > So when communicating among the sites (doing zone > transfers etc) I use the unique routable network... > piece of ca... > ...but won't my BGP routers at the different > locations > be a bit puzzled when they see the announcements > from > another AS12345 for my unique networks (and more so > for the anycast)? > The config above does seem to break the concept of > an > AS. > > Feel free to bash my Yahoo mail if this post is > utterly stupid or seems way out of scope > /Swede - still among the clueless aka Anders Plym, > presently without *real* mail access __________________________________________________ Get personalized email addresses from Yahoo! Mail - only $35 a year! http://personal.mail.yahoo.com/

3 3