- Test - lists.nanog.org

RE: RFC1918 addresses to permit in for VPN?
by Richard Welty 02 Jan '01

02 Jan '01

> So the picture that emerges is that Randy is very definitely > speaking of NAT as Bi-directional or Two-Way NAT (in the terminology > of RFC 2663), where no address conservation is practiced, and > machines with private addresses are directly reachable via public > addresses, through a fixed incoming mapping applied by the NAT > device. umm, fixed is not a requirement here. you can go two way through addresses allocated out of a pool easily enough. yes, the hacker won't have control over what is in the pool that he is trying to hack into, and the externally visible addresses of systems may change, but as long as the NAT is being done and is two way, there are things which are subject to attack. the combination of RFC 1918 space and NAT is a sorry excuse for security. you need some sort of packet filtering or access control on the path, possibly in the box doing the NAT, possibly in some other box, but you _must_ have it. if a network is completely isolated from the public internet, then the RFC1918 issue is irrelevant, as the network is inaccessible regardless of what network addresses are being used. richard

1 0

NANOG 21 -- Registration Open
by Carol Wadsworth 02 Jan '01

02 Jan '01

***************************** NANOG 21 Registration Open ***************************** Happy New Year Everyone! Registration is now open for the 21st Meeting of the North American Network Operators' Group. The meeting will be held February 18-20 at the Sheraton Atlanta Hotel in Georgia and will be hosted by Riverstone Networks. ---------------------- Online Registration: https://www.merit.edu/nanog/registration.form.html.0102 ---------------------- Hotel Reservations: http://www.nanog.org/mtg-0102/hotel.html ---------------------- Call for Presentations: Submission deadline: January 8 http://nanog.org/mtg-0102/call21.html http://www.nanog.org/mtg-0102/call21.pdf Hope to see you in Atlanta! Carol Wadsworth Merit Network, Inc.

1 0

RE: public route servers
by Jeremy Furr 02 Jan '01

02 Jan '01

There is also: route-server.ip.att.net (12.0.1.28) Jeremy jfurr(a)va.rr.com -----Original Message----- From: Neil J. McRae [mailto:neil@DOMINO.ORG] Sent: Saturday, December 30, 2000 5:24 AM To: snoble(a)sonn.com Cc: goemon(a)sasami.anime.net; nanog(a)merit.edu Subject: Re: public route servers Ones I know of are: ner-routes.bbnplanet.net route-server.exodus.net and route-server.colt.net Neil. > > I randomly check www.traceroute.org at the bottom... they tend to have a > nice list. > > On Fri, Dec 29, 2000 at 04:32:26PM -0800, Dan Hollis wrote: > > > > route-server.cerf.net appears to have been shut down, so all I have left > > is route-views.oregon-ix.net... > > > > What are some others...? > > > > -Dan > > > > -- > ---------------------------------------------------------------------------- --- > : Steven Noble / Network Janitor / Be free my soul and leave this world alone : > : My views = My views != The views of any of my past or present employers : > ---------------------------------------------------------------------------- --- > >

1 0

Packeteer
by Hank Nussbacher 02 Jan '01

02 Jan '01

Can anyone point me to a user forum, newsgroup, mailing list discussing Packeteer? Thanks, Hank

1 0

Re: RFC1918 addresses to permit in for VPN?
by Ryan O'Connell 02 Jan '01

02 Jan '01

On Fri, Dec 29, 2000 at 11:31:17AM -0500, Andrew Brown wrote: > speaking of rfc1918 addresses...one of my machines at home got poked > at, so i did the usual thing which was perhaps waste about five > minutes poking back from some place else if i feel like it. what i > saw piqued my interest: [snip bt.net traceroute] BT have little-to-no-clue in their ISP technical management it seems. They filter out all ICMP to their web servers, then use NT web servers that set the DF bit. (NANOGs passim) As a result, you can't access BTs web servers if there's any network with an MTU of less than 1500 between you and BT. (Which covers many default Frame Relay configs...) Talking to BT tech support is useless, they refuse the escalate any problem unless they get large numbers (tens/hundreds) or users complaining. (Kudos to Unet for rapidly escalating the problem to their top engineers and 'fixing' their network by upping the Frame Relay MTU, when it wasn't even their problem in the first place.) They're also totally inflexible in their sales department - refuse to sell just a leased line with BGP peering, they insist on supplying a router too because it's "too difficult" to support a customer that doesn't have an ISP-provided router, apparently. They only appear to want to sell to clueless customers. I've also had issues with BT leaking routes they shouldn't be and their NOC probing (Telnet and SNMP) routers I've managed, because they weren't sure what they were. (They were not in their network, they were in a colo facility) Rant over. :-) -- Ryan O'Connell - <ryan(a)complicity.co.uk> - http://www.complicity.co.uk I'm not losing my mind, no I'm not changing my lines, I'm just learning new things with the passage of time

1 0

Re: Dialup congestion and winter weather
by Sean Donelan 02 Jan '01

02 Jan '01

On Thu, 28 December 2000, Shawn McMahon wrote: > Data circuits are not a priority for the repairs, they're more concerned > with restoring power to the hospitals and 911 service to residences. With the increase in telemedicine, EDI for ordering supplies, and even scheduling; data circuits aren't as optional as they were.

1 0

RE: RFC1918 addresses to permit in for VPN?
by Richard A. Steenbergen 01 Jan '01

01 Jan '01

On Mon, Jan 01, 2001 at 03:00:25AM -0500, John Fraizer wrote: > > We use 1918 space in our network -- It's 100% test environment, > unconnected, and secure. If someone breaches physical security, more > power to them amd SMAME ON US! (Please, someone try! It's been a > while since we've had someone at gunpoint and we're forgetting all of > the lines from the Dirty Harry movies.) (Yes, we've had people at > gunpoint before. I doubt they'll EVER try again.) Whoa... How much to get you and Chance Whaley in a caged death match? We can call it "Rumble in the Colo", sell tickets and stream it over the 'net. Just give me 20% of the cut, deal? -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 3

RE: RFC1918 addresses to permit in for VPN?
by Richard A. Steenbergen 31 Dec '00

31 Dec '00

On Sun, Dec 31, 2000 at 02:14:54PM -0800, Bill Woodcock wrote: > > > Don't use RFC1918 addresses on as a security measure. > > That's the clue people are trying to convey here, yes. RFC1918 just > names a block of IP addresses. IP addresses are just integers. No > magic differentiates one from the next. i.e. there's no inherent > difference, security or otherwise, between 9.255.255.255 and 10.0.0.0. > They're just adjacent integers in a continuous range. Lets not get carried away. The difference we care about is, one address is announced and routed from the global internet, and one address is only used locally. This could just as easily be your real IP space which you're not announcing (note: this may actually be more useful then rfc1918 space for some things, like numbering your router interconnects out of such a block to prevent DoS without breaking icmp messages generated from them). Using unrouted IPs can be a very key part of a security policy, and if you want those IPs can be 1918 space. HOWEVER, it must be noted with lots of red flags and buzzers that this is NOT a complete security policy. For example if there is any way for an attacker to get on your local network, globally unrouted IPs won't help you. Also, if you're using NAT hosts can still be subverted in their external connections (perhaps something on your network is using MS Outlook for example). The key thing about this discussion is that it should be common sense. There is nothing "evil" with using globally unrouted IPs as part of your security, just as there is nothing "smart" about relying on it and thinking you're secure. Lets not make the same grossly oversimplified and underclued statements against 1918 addresses as some people would use in favor of them. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6

1 0

public route servers
by Dan Hollis 31 Dec '00

31 Dec '00

route-server.cerf.net appears to have been shut down, so all I have left is route-views.oregon-ix.net... What are some others...? -Dan

10 9

Re: NPIC Warning
by Jason Slagle 31 Dec '00

31 Dec '00

Not likely. Many of the members of this list despise IRC as a waste of resources. Perhaps it is, I won't argue that. One thing one cannot argue is it's ability to guage discover new forms of attacks, which are often utilized against IRC networks first. There have been a number of groups on IRC bragging about, or showing off, large Denial of Service and Distributed Denial of Service networks that are planned for use around the holidays. Already this holiday season this has happened when 12/26 Lineone, a large provider in the UK was knocked offline for nearly 11 hours by Denial of Service attacks. As the operators of many of these networks are away on the holiday season, and NOC's are often left lesser staffed, the time to attack becomes the holiday season, because attacks get harder to trace. Jason Slagle --- Jason Slagle - CCNA - CCDA Network Administrator - Toledo Internet Access - Toledo Ohio - raistlin(a)tacorp.net - jslagle(a)toledolink.com - WHOIS JS10172 /"\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \ / ASCII Ribbon Campaign . If dreams are like movies then memories X - NO HTML/RTF in e-mail . are films about ghosts.. / \ - NO Word docs in e-mail . - Adam Duritz - Counting Crows On Sat, 30 Dec 2000, Marshall Eubanks wrote: > > List members might be interested in this zombie warning : > > http://www.nipc.gov/warnings/advisories/2000/00-063.htm > > as reported in > http://www.wired.com/news/technology/0,1282,40905,00.html?tw=wn20001230 > > Real threat, or someone seeking funding ? > > Happy New Year ! >

2 1