- Test - lists.nanog.org

"How to assess your ISP's security policy" article
by Martin Cooper 10 Feb '99

10 Feb '99

For those of you that have not already seen it, I thought you might be interested to read my article published in Network Week (UK) today, "How to assess your ISP's security policy". You can find it in the RTFM section. Flames etc. to /dev/null please - I realise this article may not go down well with all service providers if their security needs some work - a possibility for which I make no apologies! Regards, Martin -- Martin Cooper <m.j.cooper(a)ucs.cam.ac.uk> /* Statements made above are my Network Systems Group, Network Division own and not those of the University Computing Service, Cambridge University Computing Service */

1 0

Multiple BGP sessions between the same router pairs at IXPs
by Alex Bligh 10 Feb '99

10 Feb '99

Anyone feel like sanity checking this for me: As far as I know, if you have this config RTRA BGP ID 4.4.4.4 ASN 4 2.2.2.4 / \ 3.3.3.4 2.2.2.0/24 | | 3.3.3.0/24 2.2.2.5 \ / 3.3.3.5 RTRB BGP ID 5.5.5.5 ASN 5 and you configure on router A router bgp 4 neighbor 2.2.2.5 remote-as 5 nieghbor 3.3.3.5 remote-as 5 and on router B router bgp 5 neighbor 2.2.2.4 remote-as 4 nieghbor 3.3.3.4 remote-as 4 then only one peering session will come up, as routers only support one BGP session with any given router ID. We hit this problem when renumbering the LINX, I think, in that you have to make sure you take down old sessions to get new sessions to work. This would also affect people who set up new peerings over the ATM MAE's, who also have existing peerings on the FDDI fabric between the same routers, right? -- Alex Bligh GX Networks (formerly Xara Networks)

3 2

Huh? Too early for this.
by alex＠nac.net 10 Feb '99

10 Feb '99

Network Next Hop Metric LocPrf Weight Path *>i2.52.228.144/32 209.83.160.97 100 0 6347 1239 i [root@netflow /root]# whois -h rs.arin.net 2.0 Internet Assigned Numbers Authority (IANA) (RESERVED) (NET-RESERVED-2) 10 sl-bb2-chi-4-0-0.sprintlink.net (144.232.0.142) 38.508 ms 48.093 ms 42.923 ms 11 144.228.252.11 (144.228.252.11) 93.257 ms 42.579 ms 95.072 ms 12 sl-paterno-2-0-128k.sprintlink.net (144.228.52.2) 99.467 ms 105.426 ms 115.518 ms 13 sl-gw11-chi-9-1-TS5-128k.sprintlink.net (144.228.52.1) 50.118 ms 41.066 ms 41.413 ms I'd be curious to know if this is the source of any spam. Hrm. Wait. Looking at 2.52.228.144 in the mirror = 144.228.52.2 [root@netflow /root]# whois -h rs.arin.net 144.228 Sprint (NET-SPRINT-INNET5) Government Systems Division 13221 Woodland Park Road Herndon, VA 22071 Netname: SPRINTLINK Netnumber: 144.228.0.0 What the hell is this? -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

2 1

SMURF Detector Software
by prue＠ISI.EDU 10 Feb '99

10 Feb '99

Hi, I, as many of you have had to deal with various types of denial of service attacks or other attacks. A good number of these attacks can be characterized by one host sending to many destinations, many hosts on one subnet sending to one destination, one host sending to very similar or the same IP address (host/port scans) etc. Confronted with detecting this to warn my customers if they are victims, or admonish my customers if they are the culprits, I wrote a tool to give me some indication when this kind of thing is going on, while it is still happening using netflow data. I modified Ciscos' fdget program they make available on one of their ftp sites to look for self similar source or destination addresses in netflow data blocks. Thanks go to Cisco for leting me distribute this to the group. You can give it a try if you want. It is avaliable via anonymous ftp on venera.isi.edu in subdirectory mon. The file names you will need to know to retrieve by name are: smurfind.c C program README.smurfind documentation flowdata.h C program definitions (written by cisco folks) smurfind.rc sample data file You can't do an ls on the directory. I used version 5 netflow data to debug the code. I haven't tested it against version 1 or other versions. B.T.W. The program dumps legitimate data as suspect. If however the rate at which the program shows suspect data changes, that is when you need to look more closely. The output from the program is very valuable to confront the guilty party to demonstrate that something inapropriate is going on. Let me know what you think. Walt Prue Los Nettos

2 1

Discussing, or not discussing, major business outages
by George Herbert 10 Feb '99

10 Feb '99

I am not going to name names, but I have it on good authority that late this week a large hosting provider went out of business abruptly. So far, the news that it did so has not been discussed anywhere, that I can tell, which is starting to disturb me. There have been some significant dislocations related to this shutdown, obviously, and this sort of event seems to me to be something that involved parties should be at least sending warnings out on nanog or other appropriate discussion lists. I and a third party ISP executive discussed this lack of discussion some yesterday; their opinion is that businesses and ISPs formerly hosted at the now defunct site are loath to admit their connecitvity is down lest their customers defect en masse causing a snowball of business failures, when they will be up and stable via new providers shortly and are not themselves fundamentally unsound. I understand that logic but cannot entirely agree with it. I would like to see the issue discussed in general terms at least; what is appropriate for notifications, what are fair responsibilities to customers, the public, other ISPs etc. in terms of this sort of event. -george william herbert gherbert(a)crl.com I am not employed by, and do not speak for, CRL.

10 15

Re: info
by hypnotherapy254＠biocentricb.net 09 Feb '99

09 Feb '99

ACCEPT CREDIT CARDS ONLINE! INCREASE YOUR PROFITS! GO HERE--> http://www.merchantonline.com or http://www.creditco.com

1 0

ADMIN: reminder about posting procedures
by John Hensley 09 Feb '99

09 Feb '99

Hello everyone, There've been a ton of bounces because of this lately, so here's a reminder that to send mail to nanog(a)merit.edu, you need to be subscribed to nanog-post(a)merit.edu. See http://www.nanog.org/email.html. Another document to review while you're thinking of posting, especially in the wake of the "spam whore" fiesta, is the charter of this list, at http://www.nanog.org/aup.html. -- John Hensley <hensley(a)merit.edu> Merit Network, Inc.

1 0

FIBER CUT: South Bend Indiana
by Sean Donelan 09 Feb '99

09 Feb '99

MCI/Worldcom is reporting a fiber cut in South Bend Indiana as of 4:00pm CST 9-FEB-1999. Customer service recordings say techs are en-route. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Palo Alto Power Hit
by Sean Donelan 09 Feb '99

09 Feb '99

Apparently my normal sources inside the carriers got stomped on by senior management, and aren't allowed to talk to me anymore. So here is a summary of unofficial reports from various unofficial sources. The West Coast is experience severe weather, including storms and flash flooding. There are multiple weather advisories up and down most of the coast. Approximately 55,000 people are without power. At the moment, no reported deaths due to the storms. Internet related incidents There were power problems through the early morning hours. A major power surge hit the Palo Alto grid at 7:16am PST. I haven't seen any SCADA information on just how large the surge was. This appears to be the instigating factor for several carrier outages. Several significant Internet trunks pass through the Palo Alto area. Customers of several carriers reported problems including MCI/Worldcom/UUNET/MFS, GTE/BBN, and Sprint. One person reported loss of residential phone service, which may indicate Pacific Bell was also affected. A lot of dead routes, and partially routed CIDR blocks seem to indicate those backbones may have been partitioned for some time. UUNET and MFS customers reported loss of a Palo Alto node. I don't know if this referred to their equipment in the PAIX building, or at another Palo Alto location. MFS had a power problem at PAIX a few years ago, but elected to use utility power instead of PAIX power. PAIX reported their power equipment absorbed the surge, and continues to operate normally. BBN at Stanford appeared to have some communication problems, no word if any rats were implicated. MAE-West-San Jose, Mae-West-Ames, and PacBell AADS appear unaffected. Sprint didn't appear to have any circuits down, but had enough problems with the few people they peer with externally, that Internet routing wasn't working well. A common report was the power surge either blew the fuses, or the entire power supply on a MFS OC192 piece of equipment. This may be the source for some reports of a fiber cut in the area. Most problems cleared up around 9:15PST after the fuse/equipment was repaired. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

ICANN forces the issue
by Henry Linneweh 09 Feb '99

09 Feb '99

ICANN Releases Guidelines For Domain Registrars http://www.internetnews.com/bus-news/article/0,1087,3_65921,00.html Hopefully this will bring some form of sanity to the process. Henry R. Linneweh

1 0