- Test - lists.nanog.org

Re: Class B Address
by Sean Donelan 21 May '00

21 May '00

On Sat, 20 May 2000, Patrick Evans wrote: > And then watch certain tier-Ns filter out your routes? As far as I know, every provider has relented and will accept announcements on ARIN/RIPE/APNIC allocation bounderies. Even the original Sprint access-list 112 was modified to match the allocations. The problem was people wanted to announce smaller blocks than the allocation, e.g. /24's out of traditional class B/16 space.

2 1

Re: Time line for love bug alerts
by Sean Donelan 21 May '00

21 May '00

Due to some timezone problems, and machines with bad clocks, things aren't always what they seemed. In particular Bugtraq's extremely early alert appears to be a bad clock. I believe this is the actual order of alerts. I can't verify the Financial Services Information Sharing Alert, but this is the time given in the congressional hearing. Some folks sent me internal company alerts which were earlier, in some cases much earlier. A Swiss bank issued an intra-company alert very early. I suppose I wasn't clear, my interest was only "public," or at least semi-public alerts such as the FS/ISAC. So I've left private alerts out of the list, except for the intra-government ones discussed at the Senate hearing. One intersting thing came out during the Senate hearing. Things really haven't changed that much since the Internet Worm in 1988. People turned off their Internet connection which also kept them from getting the "cure." On the other side, out-of-date contact information and lack of an out-of-band method to alert people meant many didn't receive the alert because their e-mail systems had already been filled by the bug. 4-May-2000 07:00 UTC Financial Services Information Sharing and Analysis Center (FS/ISAC) Alert (unverified), it remains unclear to me who FS/ISAC alerted, e.g. only its 22 member companies or others 4-May-2000 08:57 UTC alt.comp.virus posting from the UK 4-May-2000 09:45 UTC FBI/NIPC Watch Center notified by a representative from private industry 4-May-2000 10:17 UTC NANOG posting from BBC in UK 4-May-2000 10:40 UTC Department of Defense Joint Task Force for Computer Network Defense (JTF-CND) first alerted by a unit 4-May-2000 11:18 UTC Telecommunications Information Sharing and Analysis Center (T/ISAC) notified by a carrier, I have found no information T/ISAC notified any of its members 4-May-2000 11:44 UTC JTF-CND begins to notify DOD components 4-May-2000 11:45 UTC NIPC notifies FedCIRC about virus 4-May-2000 11:45 UTC FedCIRC begins to notify federal agencies 4-May-2000 12:54 UTC AP news story (Hong Kong) 4-May-2000 13:17 UTC Reuters news story(London) 4-May-2000 13:30 UTC ZDNet news story 4-May-2000 13:31 UTC F-Secure press release 4-May-2000 14:30 UTC CERT/CC public alert 4-May-2000 14:38 UTC Symantec press release 4-May-2000 15:00 UTC FBI/NIPC first public alert 4-May-2000 15:05 UTC Computer Associates press release 4-May-2000 16:19 UTC Trend Micro press release 4-May-2000 16:56 UTC Bugtraq posting

1 0

First Internet outage reported
by Sean Donelan 21 May '00

21 May '00

Traditional carriers have not treated Internet affecting outages as reportable events. Local, long-distance, 9-1-1, SS7 are typical services listed on the FCC outage reports. I believe GlobalCrossing's FCC outage report is one of the first, if not the first, to list the Internet as the service affected by a carrier outage. http://www.fcc.gov/Bureaus/Engineering_Technology/Filings/Network_Outage/20…

1 0

Re: Class B Address
by Sean Donelan 21 May '00

21 May '00

On Sat, 20 May 2000, "HANSEN CHAN" wrote: > Can someone point me to some documents/weblink on how many class B > addresses are still available? Have the registries like RIPE/ARIN/APRIN > exhausted class B addresses already? IPv6 Forum presentations have me > believed class B addresses are exhausted and the situation is especially > bad for country like China. However, after checking with some Chinese I > was told just the opposite. So I am wondering is address scarcity just a > hype? My question is what is your requirement for a "classfull" address? With CIDR you can create the same number of addresses out of any of the traditional Class A, B, or C areas. There are plenty of /16 address blocks available. I have no idea of any need a country such as China has which couldn't be satisfied by using /16 CIDR blocks. If you stop thinking in terms of traditional classfull address blocks, I think you find much of the "scarcity" goes away.

2 1

UU-Net outage in Santa Clara
by Zaid Ali 20 May '00

20 May '00

I called the UU-Net NOC as one of my pipes is down.. there is no reachability to 660.hssi2-0-0.gw2.scl1.alter.net . I detected the downtime from 3:34pm. Zaid ------------------------------------------ Zaid Ali Network Architect WebEx 110 Rose Orchard Way San Jose, CA 95134 Tel: 408-435-7251 fax: 408-435-7004 www.webex.com ----------------------------------------

2 1

Re: New Internet-draft on DDOS defense...
by Richard Steenbergen 20 May '00

20 May '00

> The proposal suggests that hosts not respond to ICMP Echo broadcasts if > the source address is not within the same subnet as the workstation. > The rational is that even with "no ip directed-broadcast" (or it's > equivalent on non-Cisco routers), smurf attacks can still be launched by > a local machine on the local subnet (provided that there are no filters > in place to prevent forged source-addresses from that subnet). > > Such an attack would only be useful where the aggregate bandwidth to the > Internet from the subnet of the compromised host is signifigantly larger > than the aggregate bandwidth to the Internet from the compromised host > itself. In the traditional case of a simple shared media ethernet, this > is obviously not the case -- rather than launching a "local smurf" > attack to generate 10Mbps worth of flooding, the attacker could simply > have the local machine generate 10 Mbps worth of flooding. In modern > networks, a switch of some sort is likely to be involved, so there is > some potential for amplification. However, given that the individual > devices in such an environment are likely to be attached with a minimum > of 100 Mbps Ethernet (and, assuming they are running a reasonable IP > stack, they should then be able to generate a minimum of, say, 80Mbps of > flooding), the cases where a "local smurf" would be beneficial to an > attacker are limited to sites with switched ethernet and OC-3 or better > connectivity. Experience has shown that such sites are not generally > problematic smurf amplifiers. (OC-3 is actually just a low end number. > Given that any such site is likely to have a lot of other traffic > competing for bandwidth, I think 25% is a good high end number for > maximum amplication effect you'd get. You'll need OC-12 or higher for > any serious level of amplification.) An old idea... Its relatively easy to do this by spoofing the raw frames and making your own l2 broadcast. I can think of at least one major brand name colo provider with multiple customers on shared vlans where such an attack would be quite effective. I can think of others that actually have most of their switches on GigE uplinks and many customers sharing a vlan, where such an attack would be rather devestating. Then again any time you put multiple customers on a single layer 2 switch/vlan without doing some kind of l3 switching or vlan trunking and one vlan per customer you are asking for trouble (ip stealing, arp games, broadcast issues including these kind of attacks, etc).

1 0

Re: Anyone else having on and off problems with netscape.
by Rick Irving 19 May '00

19 May '00

> Yes. Service loads, but it's REALLY slow. But I don't think I would > classify it as a DNS problem. I would. :\ > > Using Dig: (What're you doing using NSlookup?! Shame on you! Plech!) > Heh. Would you feel better if I told you I started with a SIGINT to named, and a grep'd through the output ? :} However, I found the multiple response back from a single nslookup query interesting..... :O > [pbarber@host pbarber]$ dig home.netscape.com a > ; <<>> DiG 8.2 <<>> home.netscape.com a > ;; ANSWER SECTION: > home.netscape.com. 1m43s IN CNAME www-jp.netscape.com. > www-jp.netscape.com. 16m55s IN A 64.236.8.10 > [snip] Actually, one might note that this appears to be leaking in via central B'cast/UDP regions along the NAP's.... Someone Colo a Japanese nameserver in JAM Space , or optionally, a Japanese Root mirror ? At least one possible hypothesis ...... BTW: About a week here, as well... (not years, for -us- anyway) >

1 0

Anyone else having on and off problems with netscape.
by Rick Irving 19 May '00

19 May '00

Any else having on and off problem's with resolving home.netscape.com ? I am finding, upon occasion, that it resolves to a CNAME of www-jp.netscape.com instead of www-mv.netscape.com. The name servers differ as well.... Here are the results of one query, with diagnostics. > home.netscape.com. Server: noc.onecall.net Address: 0.0.0.0 ;; res_mkquery(0, home.netscape.com, 1, 2) ------------ Got answer: HEADER: opcode = QUERY, id = 18746, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 4, authority records = 1, additional = 3 QUESTIONS: home.netscape.com, type = NS, class = IN ANSWERS: -> home.netscape.com nameserver = tdns-me1.netscape.com ttl = 3600 (1H) -> home.netscape.com nameserver = tdns-me2.netscape.com ttl = 3600 (1H) -> home.netscape.com nameserver = tdns2.netscape.com ttl = 3600 (1H) -> home.netscape.com canonical name = www-mv.netscape.com ttl = 500 (8m20s) AUTHORITY RECORDS: -> netscape.com ttl = 3600 (1H) origin = ns.netscape.com mail addr = dnsmaster.netscape.com serial = 528144 refresh = 8600 (2h23m20s) retry = 900 (15M) expire = 604800 (1W) minimum ttl = 3600 (1H) ADDITIONAL RECORDS: -> tdns-me1.netscape.com internet address = 205.188.247.67 ttl = 3600 (1H) -> tdns-me2.netscape.com internet address = 205.188.247.68 ttl = 3600 (1H) -> tdns2.netscape.com internet address = 207.200.77.53 ttl = 3600 (1H) ------------ home.netscape.com nameserver = tdns-me1.netscape.com ttl = 3600 (1H) home.netscape.com nameserver = tdns-me2.netscape.com ttl = 3600 (1H) home.netscape.com nameserver = tdns2.netscape.com ttl = 3600 (1H) home.netscape.com canonical name = www-mv.netscape.com ttl = 500 (8m20s) netscape.com ttl = 3600 (1H) origin = ns.netscape.com mail addr = dnsmaster.netscape.com serial = 528144 refresh = 8600 (2h23m20s) retry = 900 (15M) expire = 604800 (1W) minimum ttl = 3600 (1H) tdns-me1.netscape.com internet address = 205.188.247.67 ttl = 3600 (1H) tdns-me2.netscape.com internet address = 205.188.247.68 ttl = 3600 (1H) tdns2.netscape.com internet address = 207.200.77.53 ttl = 3600 (1H) >

3 3

Re: BGP filtering of supernets out of classful space
by Danny McPherson 19 May '00

19 May '00

> Tell your %^&# pointy-haired sales & marketing pukes not to %^*#ing lie to > their prospects. If you don't have the network that they're selling, you > won't be keeping the customers they get to begin with. Hrmm, let me think about this. ... You're their customer, tell'm yourself. -danny (who will suppress other comments in hopes that this thread will die sooner rather than later)

1 0

Re: BGP filtering of supernets out of classful space
by John Fraizer 19 May '00

19 May '00

On Fri, 19 May 2000, Leigh Porter wrote: > Hiya, > > OK, so you have a seperate router or a zebra daemon or something running as > a BGP route-reflector-client from one of your core routers and with a deny-all > > input dist list. That way, you have a copy of your routing table on a box that > cannot > be used to inject any other routes into the network and that is not in itself > a core > router. > > -- > Leigh Porter > Cable and Wireless > Internet Network Services > http://www.insnet.net http://www.cw.net Leigh, These are the same folks who don't believe that I can take a full boat from them on a box running zebra. They actually think they're peering with a 7513. Little do they know that the PC/Zebra combo is also taking a full boat from 3 other providers. Silly paranoid people. BTW: Who do I contact about exchange point peering with C&W? They have said over and over and over that they want to appear at CMH-IX. We have fiber to you guys. It's time to light it and get you peered up. John Fraizer EnterZone, Inc

1 0