- Test - lists.nanog.org

None
by Martin Cooper 27 Feb '99

27 Feb '99

In your white paper "UK Academic Network Architecture" (p27 of 42) at http://www.ja.net/documents/net_arch.html I find the following: 11.2 Commercial Sector The commercial sector has to date shown very little interest in the provision of a pervasive educational network on a national basis. This was a clear outcome from the market test in 1996 and is thought by most to still be the case even though the market has changed considerably with many new Internet Service Providers. The Deloitte Touche value for money study, commissioned by the JISC and delivered in October 1996 made a very clear statement that the benefits arising from JANET heavily outweigh the costs. Some of the Deloitte Touche assumptions now seem a little exaggerated, but there is general acceptance in the community that JANET is good value for money, a view frequently voiced by those in other educational sectors who have attempted to buy similar services on the open market. Most people involved in UK Academic Networking believe that the provision and co-ordination of national service by a not for profit organisation is the right approach. Might I ask what is at the following URL, if not a concrete proposal indicating significant interest from a commercial organisation? I wonder, if UKERNA did not stand to gain quite so much by ruling out collaborating with commercial organisations in meeting UK academic and research community networking requirements, would you perhaps have made reference to it? http://www.edex.net.uk/whitepaper/nen.htm The board of INSnet has a considerable history of service to the UK academic and research networking community through past association with the University of Kent in Canterbury and UKnet (subsequently EUnet GB). Martin Cooper Speaking for myself...

1 0

Re: Suggestion: Add contact entry to whois
by owen＠DeLong.SJ.CA.US 27 Feb '99

27 Feb '99

> The only problem is your collegues want detailed > Administrative, Billing, Technical and now Abuse > and security and who knows what other private data > for be globally available. And how many other people > will use this information, even our phone numbers, > for their own, negative purposes? So while your call > may be benign there are many more callers or mail > advertisers, bulk e-mailers and so on who abuse the > heck out of what should be confidential data. > We want it to be possible for people who choose to to publish this information. Noone was proposing requiring additional data. Owen

1 0

Re: Suggestion: Add contact entry to whois
by Tim Wolfe 26 Feb '99

26 Feb '99

On Fri, 26 Feb 1999, Bob Allisat wrote: > How about this astro... FCN, in protecting the > privacy of it's law-abiding clients, keeps all > information provided PRIVATE and CONFIDENTIAL. > As per our Terms of Service. In the event of > the rare abuse of our services those aflicted > contact the appropriate authorities who, in > term, begin investigating like they would any > other complaint from the public. If the need > arises they seek a court order for information > which is otherwise confidential. The investigation > continues to what is, hopefully, an appropriate > conclusion. All with public oversight, civilian > control and legal safeguards. > How utopian. The only problem with that argument is that stopping a DOS attack does not require that a provider to divulge confidential information about a customer anyways... Unless of course, someone is trying to bring legal action after the fact, which is normally accompanied by the court orders, subpoenas, etc that you cherish so much. Maybe I'm just doing something extraordinary, but if someone calls me up and says, "I'm seeing a massive smurf attack originating from X.Y.Z.A and we see that you own X.Y.Z.A-X.Y.Z.F. Can you verify and take action according to your AUP/TOS?", I can't think of why I would need to divulge client info to accede to that request.. I can just verify the veracity of the accuser's info, and take action. I'm just not following your logic, do you think that if someone calls and says "X.Y.Z.A is (insert DOS)ing me!", you must reply, "Oh yes, it's company XYZ.Net, they are so naughty!" Tim ---------------------------------------------------- Timothy M. Wolfe | Why surf when you can Sail? tim(a)clipper.net | Join Oregon's Premier Sr. Network Engineer | Wireless Internet Provider! ClipperNet Corporation | http://www.clipper.net/ ----------------------------------------------------

1 0

Re: Suggestion: Add contact entry to whois
by owen＠dixon.DeLong.SJ.CA.US 26 Feb '99

26 Feb '99

OK, perhaps, then, we should consider two contacts: Complaints contact (the destination for complaints about SPAMMERS and such) (SPAM) Enforcement contact (the destination for people who can respond to real-time hacking concerns) (SMURF, FLOOD, HACKING) Tech contact would still be my bet for Bad BGP, as this is usually accidental and not malicious. Bottom line, the Tech. contact for alot of these providers is an address that gets reviewed once a day or such and doesn't provide anything more effective than a secretary putting a post-it on the door. The Admin contact is supposed to be just that, and usually is. The billing contact, as I see it would only be used by InterNIC and possibly people who want to seek reparations for SPAM. I don't pretend that the names I chose above are necessarily the best terms that can be applied, and I am flexible about what to call them. However, I do think they are needed at this point. Owen > Owen DeLong wrote: > > > We already have Admin, Tech, and Billing. Would it be possible to consider > > the addition of an Abuse contact in whois? > > The existing contacts serve that function. If someone at some place is > smurfing you, you don't want to talk to some secretary who is going to > stick a post-it on some manager's door about it. You want the NOC and > you want the person in the NOC who can initiate immediate investigation > and correct the problem. Well, at least I do. > > Define "abuse". It comes in a lot of categories, anyway. Which category > do you think an abuse contact should be getting them for? Smurf? Flood? > Spam? Bad BGP? Hacking? > > -- > -- *-----------------------------* Phil Howard KA9WGN * -- > -- | Inturnet, Inc. | Director of Internet Services | -- > -- | Business Internet Solutions | eng at intur.net | -- > -- *-----------------------------* phil at intur.net * -- >

5 5

Re: Suggestion: Add contact entry to whois
by Dan Hollis 26 Feb '99

26 Feb '99

On Fri, 26 Feb 1999, Bob Allisat wrote: > FCN gives no contacts for the Domain names > registered here. It is no-one's business who > registers with us. We are not in the business > of acting as snitches for overly snoopy and > prying computer system administrators. If any- > one has a problem they can contact the police > and, accompanied with an appropriate court > order we will be happy to comply with any real, > legitimate investigation. Otherwise fork off, > nosey nerds, it's none of your darned business. So in other words if an fcn host is found to be originating denial of service attacks, you suggest we contact the local police and FBI rather than ringing you up and asking you to disable their ongoing attacks. And in the time it takes to process a court order you will continue to allow those hosts to originate smurf/pingfloods etc. Gotcha. So noted. So we now know that when an fcn host is conducting denial of service attacks, we should immediately start the paperwork filing for criminal negligence and punitive damages ahead of time. -Dan

2 1

Re: Suggestion: Add contact entry to whois
by William X. Walsh 26 Feb '99

26 Feb '99

On 26-Feb-99 Bob Allisat wrote: > It is an issue of privacy, of the right to > control our personal or professional data > which is currently laundered fully in public > by data-miners, advertisers and anyone else > who imagine's it's their right to my name, > address, telephone number etc or those of > my collegues, co-workers or business relation- > ships. All of which are none of their damned > business. And as I said, it is every network providers option whether they chose to allow access to their network from those hosts. Many will simply choose not to provide transport to hosts in a TLD that refuse to provide this information. And that IS their right, and their business. ---------------------------------- E-Mail: William X. Walsh <william(a)dso.net> Date: 26-Feb-99 Time: 15:11:28 ---------------------------------- "We may well be on our way to a society overrun by hordes of lawyers, hungry as locusts." - Chief Justice Warren Burger, US Supreme Court, 1977

1 0

Re: Suggestion: Add contact entry to whois
by owen＠DeLong.SJ.CA.US 26 Feb '99

26 Feb '99

Wow, Bob is angry. I must be doing something right. :-) Anyway, the proposal relates to domains registered with InterNIC and other registries that maintain top-level information (country domains, ARIN, RIPE, APNIC, etc.) As such, I am referring to entries like: Free Community Network (FCN3-DOM) PO Box 191 Station E Toronto, ON M6H 4E2 CA Domain Name: FCN.NET Administrative Contact: Allisat, Bob (BA502) tor(a)WTV.NET (416) 534-1999 (FAX) n/a Technical Contact, Zone Contact: ABRAHAMSEN, GARD (GA663) gard(a)SCRIBA.ORG (770) 652-9537 (FAX) (770) 977-4816 Billing Contact: Allisat, Bob (BA502) tor(a)WTV.NET (416) 534-1999 (FAX) n/a Record last updated on 11-Apr-98. Database last updated on 26-Feb-99 07:15:02 EST. Domain servers in listed order: FCN.NET 208.222.122.41 LOLITA.MSI-SOLUTIONS.COM 208.222.122.34 Gee... Looks like Bob published some information for that domain. :-) Owen > Owen DeLong wrote: > > OK, perhaps, then, we should consider two contacts: > > Complaints contact (the destination for complaints > > about SPAMMERS and such) (SPAM) > > Dan Hollis: > = Abuse contact. > > DeLong: > > Enforcement contact (the destination for people who can > > respond to real-time hacking concerns) (SMURF, FLOOD, > > HACKING) > > Hollis: > = Security contact. > > FCN gives no contacts for the Domain names > registered here. It is no-one's business who > registers with us. We are not in the business > of acting as snitches for overly snoopy and > prying computer system administrators. If any- > one has a problem they can contact the police > and, accompanied with an appropriate court > order we will be happy to comply with any real, > legitimate investigation. Otherwise fork off, > nosey nerds, it's none of your darned business. > > Bob Allisat > > Free Community Network _ bob(a)fcn.net > http://fcn.net _ http://fcn.net/allisat > http://robin.fcn.net > >

1 0

Re: FYI New Jam space please update filters
by I Am Not An Isp 26 Feb '99

26 Feb '99

At 08:16 AM 2/25/99 -1000, scott w wrote: > > > >US Army Combat Systems Test Activity (ASN-CSTA-CISCO) > Commander, USACSTA > Aberdeen Proving Ground, MD 21005-5059 > > Autonomous System Name: CSTA-CISCO-AS > Autonomous System Number: 666 > > > >*heh*, that's too easy... on purpose perhaps? Yes, the ASN is for real. Maybe Richard was talking about UUNET announcing NAP space to Aberdeen and/or Aberdeen propagating it? TTFN, patrick >scott > > > >On Thu, 25 Feb 1999, Richard Irving wrote: > >> New JAM space, please everyone update the filters..... >> >> BGP routing table entry for 198.32.187.0/24, version 2889259 >> Paths: (1 available, best #1, advertised over IBGP, EBGP) >> 666 701 701 >> hfrom 208.227.1.173 (208.222.222.20) >> Origin IGP, metric 0, localpref 102, valid, external, best >> >> >> Not good. :\ I Am Not An Isp - www.ianai.net ISPF, The Forum for ISPs by ISPs, <http://www.ispf.com> "Think of it as evolution in action." - Niven & Pournelle

2 1

agis outage?
by Dan Hollis 26 Feb '99

26 Feb '99

Just been notified AGIS lost power at their Santa Clara POP, running on backup batteries at the moment. ETA to total failure is 12:00 noon :-( Santa Clara is the cross connect for most of AGIS' network? -Dan

1 0

buggy server re-directors? buggy NATs? Too much RFC 1918 traffic on the net!
by woods＠most.weird.com 26 Feb '99

26 Feb '99

I've been seeing a growing amount of traffic of various sorts from various public internet sites that has a source address in an RFC 1918 private net. In some cases because I have servers running multi-homed on administrative LANs which use these private networks, and because I've installed filters to ensure traffic isn't coming from the wrong nets on the wrong interfaces, this is even causing some services and requests to fail. (Eg. source quenches coming from private nets where even if the filters didn't exist the desired effect is not achieved.) I'm also seeing a growing number of requests on a couple of my transparent web cache machines that seem to be directed at hosts in RFC 1918 private networks -- i.e. it would appear as though the URLs refer either directly to private networks, or perhaps some domain names used in publicly accessible URLs resolve to point at private nets. I'm almost tempted to try and implement a DNS proxy that'll refuse to allow any responses from foreign nameservers to contain RFC 1918 addresses (and of course ensure that my internal DNS is authoritative for all the necessary in-addr.arpa zones). I suspect what's happening is that people are putting load-balanced servers behind service re-directors and are running these servers on RFC 1918 private networks in hopes that the re-director will do the appropriate NAT. Unfortunately most of these re-directors are not yet sophisticated enough to work as full proxies, and they often fail to properly translate associated packets, such as related ICMP traffic. (As has been amply evidenced by the extremely common failure of Path-MTU discovery from several such load-balancing devices.) In cases where I can identify the owners of the errant servers from my filter logs and/or from simple tcpdump traces I do attempt to contact them. However I'd rather try a more preventative approach, perhaps by making this issue more widely known, and perhaps by educating vendors and implementors of devices that might be causing these problems of what mistakes they might be making. I'm interested in exchanging information about these issues with other operators and in trying to track down and identify devices that might be letting some such private traffic slip through, and of course in helping to find and implement fixes to these problems. -- Greg A. Woods +1 416 218-0098 VE3TCP <gwoods(a)acm.org> <robohack!woods> Planix, Inc. <woods(a)planix.com>; Secrets of the Weird <woods(a)weird.com>

1 0