- Test - lists.nanog.org

Re: USWest
by Kai Schlichting 30 Aug '00

30 Aug '00

At Wednesday 04:18 PM 8/30/00, John Fraizer wrote: >Will someone from USWest/Qwest please contact me! Your site does not list >any contact information for your abuse/NOC contacts. > >dialupFF60.mpls.uswest.net is currectly blasting out 1000's of SPAMs per >minute using random @enterzone.net addresses as the from address. While this doesn't resolve forwards for me right now: Nothing that a little hostile /24 BGP announcement couldn't fix until such security contact has been found. Which brings us back to the week-before-last week's NANOG discussion: An RBL list for DoS attacks.

2 1

USWest
by John Fraizer 30 Aug '00

30 Aug '00

Will someone from USWest/Qwest please contact me! Your site does not list any contact information for your abuse/NOC contacts. dialupFF60.mpls.uswest.net is currectly blasting out 1000's of SPAMs per minute using random @enterzone.net addresses as the from address. John Fraizer EnterZone, Inc

1 0

New mailing list - 111 8th Avenue
by Adam Rothschild 30 Aug '00

30 Aug '00

Thought this may be of interest to y'all. Sorry for the cross-posting... I've created a mailing list for any and all discussion pertaining to 111 8th Avenue (aka 76 9th Avenue), the New York City carrier hotel building. Everyone is welcome to subscribe, though we're especially trying to attract folks who have space there, be it several floors, or a small fraction of a rack somewhere. To subscribe, shoot a blank mail to <111-8th-subscribe(a)latency.net> from the address you wish to post from. Enjoy, -adam

1 0

Under DDoS attack; what do I do now?
by Chris Adams 30 Aug '00

30 Aug '00

We appear to be under a distributed denial of service attack. We are receiving 7.5+ megabits per second of ICMP traffic (it looks like a smurf attack) from all over to a single address (one that was in our dialup pool). We've taken the IP out of our pool and are routing it to a separate interface with a computer just setup to capture traffic. It isn't causing an immediate problem, since we've routed the traffic away, but what do we do next? We've been contacted by a couple of the people sending the ICMP replies complaining about us pinging them and told them about fixing distributed broadcast and they've said they'll look into it. What do we do to track this down? We've got four upstreams and the traffic appears to be coming in all four; do we need to call all of them? Is there any kind of organization that can help coordinate this? Thanks for any help you can give. -- Chris Adams <cmadams(a)hiwaay.net> Systems and Network Administrator - HiWAAY Information Services I don't speak for anybody but myself - that's enough trouble.

3 2

Re: Under DDoS attack; what do I do now?
by Jim Duncan 30 Aug '00

30 Aug '00

Chris Adams writes: > We appear to be under a distributed denial of service attack. We are > receiving 7.5+ megabits per second of ICMP traffic (it looks like a > smurf attack) from all over to a single address (one that was in our > dialup pool). We've taken the IP out of our pool and are routing it to > a separate interface with a computer just setup to capture traffic. > > It isn't causing an immediate problem, since we've routed the traffic > away, but what do we do next? We've been contacted by a couple of the > people sending the ICMP replies complaining about us pinging them and > told them about fixing distributed broadcast and they've said they'll > look into it. > > What do we do to track this down? We've got four upstreams and the > traffic appears to be coming in all four; do we need to call all of > them? Is there any kind of organization that can help coordinate this? > > Thanks for any help you can give. If Cisco equipment is involved, you can use the information at http://www.cisco.com/warp/public/707/22.html to characterize the attack and perhaps trace it. If you expect assistance from upstream, you'll have to characterize the attack as much as possible. Since the source addresses are usually spoofed, tracing the attack means that senior network engineers have to look at each link along the path, and it's going to be hard to get them interested if the traffic is not well defined. If you don't already know who to contact at each of your upstream providers, open a case with their support desk. Most major ISPs and NSPs have special teams that deal with attacks. If one of the upstreams (or other sources) is a member of the Forum of Incident Response and Security Teams (FIRST), you can look up the specific response team's contact info at http://www.first.org/. There's more info on mitigating DDoS attacks on the Cisco Security Advisories page, http://www.cisco.com/warp/public/707/advisory.html. If you need further help, you can contact the Cisco TAC. If it's a bona-fide emergency, you can engage our group, the Cisco Product Security Incident Response Team, to assist. Jim -- Jim Duncan, Product Security Incident Manager, Cisco Systems, Inc. <http://www.cisco.com/warp/public/707/sec_incident_response.shtml> E-mail: <jnduncan(a)cisco.com> Phone(Direct/FAX): +1 919 392 6209

1 0

B/W Utilization Programs
by Karyn Ulriksen 30 Aug '00

30 Aug '00

Hi All, It approaching my semi-annual review of b/w utilization monitor programs. I'm looking at both ATM and non-ATM solutions. Been using Netscout which works pretty good, but I would like to keep on top of whatever else is out there and have been to busy to look at any recent developments. What's everyone using out there these days to monitor their colos b/w utilization, etc.? --------------------------------------------------------------------- Best regards, Karyn Ulriksen Director of Network Operations PublicHost, A SiteStream Company 22 Mauchly, Suite 200 Irvine, California 92618 USA Phone: (949) 743-2000 email: kulriksen(a)publichost.com URL: http://www.publichost.com ===========================================

1 0

RE: ARIN Policy on IP-based Web Hosting (fwd)
by sigma＠pair.com 30 Aug '00

30 Aug '00

>No, but I've done due diligence to minimize the requirement and have created >an environment that is directed towards minimization. As far as the concern >regarding using a "premium", last I checked this is a commercial venture. Most of us are running commercial ventures. Consequently, we don't appreciate your interpretation of the policy to allow your business model but disallow others. The implication is that your model is more valid because you charge extra for something. ARIN policy has no place in deciding such matters. Your interpretation may be wrong, or it may not. There isn't enough information from the ARIN policy to determine those ramifications, just like they skipped over all of the other per-IP services that are commonly associated with Web hosting. >> By what justification does this poorly-thought-out policy >> interfere with >> business models or competitive advantages between hosts? > >Could you clarify what you are asking here? I'm rhetorically asking if it's acceptable for ARIN policies to identify one business model as preferable over another, and if so, why. I'll keep that question to the ARIN lists in the future, however, as it's not operational (only the impact of such policy is operational). >> Great for your customers, then. > >They butter my bread. Gotta keep them happy. Same here. >> Are you proposing to circumvent the policy? > >Uh... No. I just accept the challenge of doing more with less. I'm always >game for problem solving, that's why I do what I do. That's why they pay me >the big bucks. I was accused of proposing to circumvent the policy. I do not propose that, and I'm glad you don't either. Although your interpretation is your own. What I and many others would like to see is a more clear and reasonable policy from ARIN. We do provide anonymous FTP service with every per-IP domain. It's part of the service. It's not a premium. Many customers use it. Many customers use other virtualized services we provide by default as well. If that gets us an exception from ARIN, and I'm not at all certain it will, that's great for us, but it still isn't fair to other hosts. Kevin

1 0

RE: ARIN Policy on IP-based Web Hosting (fwd)
by Karyn Ulriksen 30 Aug '00

30 Aug '00

> >There is only a small number of services that currently > really require > >dedicated IPs. HTTPS and Anonymous FTP. Although, the > HTTPS is a concern - > >not that many customers actually use the Anonymous FTP > service. We ended up > >offering Anonymous FTP as a premium service (I like to think > that this cuts > >down on warez and script kiddie distribution). > > Aha, I was waiting for someone to say that. > > So it's going to be OK to use per-host IP addresses if it's sold as a > "premium" service? So that business model is OK, but not > another? What if > we say all of our services are "premium"? What if too many of your > customers start paying you for that "premium" service? Where's the > threshold? Are you more justified in your IP usage because > you charge your > customers more for it? No, but I've done due diligence to minimize the requirement and have created an environment that is directed towards minimization. As far as the concern regarding using a "premium", last I checked this is a commercial venture. > > By what justification does this poorly-thought-out policy > interfere with > business models or competitive advantages between hosts? Could you clarify what you are asking here? > > >A few customers will whine, but 98% don't know > >the difference, understand and accept the limititations, or > are just so damn > >happy it works that they don't mind. > > Great for your customers, then. They butter my bread. Gotta keep them happy. > > >Although I do agree that ARIN does tend to be anal, I > believe some system > >architects would have shot us all in the foot by now if they > hadn't put > >their foot down. We just have to be cleverer than them and > I think that > >shouldn't be too hard, right? > > Are you proposing to circumvent the policy? Uh... No. I just accept the challenge of doing more with less. I'm always game for problem solving, that's why I do what I do. That's why they pay me the big bucks.

1 0

RE: ARIN Policy on IP-based Web Hosting
by Karyn Ulriksen 30 Aug '00

30 Aug '00

I've been running webhosting farms for over five years and for the past year, we have been running entirely Host Header based webhosting. Also, because we run everything clustered we've had to become inventive if it isn't a good candidate for NAT (too many IPs and not enough management resources on the load balancer, etc). There is only a small number of services that currently really require dedicated IPs. HTTPS and Anonymous FTP. Although, the HTTPS is a concern - not that many customers actually use the Anonymous FTP service. We ended up offering Anonymous FTP as a premium service (I like to think that this cuts down on warez and script kiddie distribution). HTTPS is offered as a premium service as well, but is served out of it's own cluster so we don't have to make sure that IPs are predefined for the sites. Code can be altered to reflect hostnames based on user logins or can be simply made generic or NoName branded. A few customers will whine, but 98% don't know the difference, understand and accept the limititations, or are just so damn happy it works that they don't mind. Although I do agree that ARIN does tend to be anal, I believe some system architects would have shot us all in the foot by now if they hadn't put their foot down. We just have to be cleverer than them and I think that shouldn't be too hard, right? Karyn

1 0

RE: ARIN Policy on IP-based Web Hosting
by Roeland M.J. Meyer 30 Aug '00

30 Aug '00

It's about time I looked into this as well. > -----Original Message----- > From: J Bacher [mailto:jb@jbacher.com] > Sent: Wednesday, August 30, 2000 6:53 AM > To: Roeland M.J. Meyer > Cc: nanog(a)merit.edu > Subject: RE: ARIN Policy on IP-based Web Hosting > > > > > > On Tue, 29 Aug 2000, Roeland M.J. Meyer wrote: > > > It sounds more like ARIN wants to shut down web-hosting companies or > > prevent them from doing SSL. The only other way to read this is that > > someone at ARIN is incompetent. Frankly, I'd like to know which. > > http://www.arin.net/announcements/election.html. > > Any volunteers? > >

1 0