- Test - lists.nanog.org

Re: "Packet Shapers"
by shields＠crosslink.net 31 Jul '98

31 Jul '98

In article <2.2.32.19980731064343.006a171c(a)max.ibm.net.il>, Hank Nussbacher <hank(a)ibm.net.il> wrote: > 7) Platform: Look at the OS platform. Packeteer using a proprietary OS, > others may package Linux or NT. None have done any OS hardening on the > system so it is best to run something like ISS against the packet shaper > to determine what security holes exist. Imagine you start using a > packet shaper in production only to have the hackers hack it and set > their own super-duper policies. The risk is worse than that -- a malicious party having access to a box which can view and modify 100% of your outside traffic is a very ugly scenario. There is of course much more to security than running ISS. > 10) ToD: All boxes have the ability to control based on source IP, > destination IP and port. Not all have the ability to control based on > time of day. Suppose you want incoming news to be limited to 128kb > during the day but open it up from 2-8am to 800kb. Packeteer has a line > command called "schedule". Look for GUI's to do this. I would hope anything with this suppport also runs NTP. > 12) Graphs: you want the ability for realtime graphs for each policy so > you can see how your rule changes have affected the bandwidth. > Packeteer has this capability. And hopefully all the data would be SNMPable so you can do your own graphs as well. As with all networking products, the key for an ISP environment is not to provide an all-in-one solution but to provide something with good plugs so it integrades well with the rest of your network. -- Shields, CrossLink.

1 0

The Cidr Report
by Tony Bates 31 Jul '98

31 Jul '98

This is an auto-generated mail on Fri Jul 31 12:00:00 PDT 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 31Jul98 0) General Status Table History ------------- Date Prefixes 240798 52857 250798 52796 260798 52635 270798 53086 280798 53322 290798 52992 300798 52883 310798 52941 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 218.218.180.0 from AS701 AS Summary ---------- Number of ASes in routing system: 3786 Number of ASes announcing only one prefix: 1835 (963 cidr, 872 classful) Largest number of cidr routes: 348 announced by AS3561 Largest number of classful routes: 1134 announced by AS701 1) Gains by aggregating at the origin AS level --- 31Jul98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS3602 534 316 218 40.8% Sprint Canada Inc. AS701 1134 933 201 17.7% Alternet AS271 338 144 194 57.4% BCnet Backbone AS4293 454 265 189 41.6% IMCI AS2493 420 244 176 41.9% iSTAR Internet, Inc. AS3749 222 69 153 68.9% TECNET AS174 711 581 130 18.3% Performance Systems International AS2685 249 157 92 36.9% IBM Global Network - US AS5668 126 48 78 61.9% Century Telephone Inc. AS3221 112 42 70 62.5% EENet Autonomous System AS4755 118 50 68 57.6% Videsh Sanchar Nigam Ltd. India AS3804 220 155 65 29.5% Bell Solutions AS7046 223 165 58 26.0% UUNET-CUSTOMER AS4740 397 339 58 14.6% ASN-OZEMAIL (Ozemail Pty Ltd) AS549 207 152 55 26.6% ONet Backbone AS10928 101 46 55 54.5% UNKNOWN AS3403 180 126 54 30.0% TIAC AS6335 68 19 49 72.1% NTRNET AS72 85 37 48 56.5% Schlumberger Information Network AS719 455 408 47 10.3% LANLINK autonomous system AS1239 537 490 47 8.8% SprintLink Backbone AS4539 71 26 45 63.4% NETROPOLIS AS4200 142 97 45 31.7% AGIS (Apex Global Information Ser AS237 95 50 45 47.4% MichNet Primary AS AS1785 294 253 41 13.9% NYSERNet Backbone AS852 155 115 40 25.8% AGT Advance Communication AS6181 66 26 40 60.6% FUSE-NET AS7122 120 82 38 31.7% MTS ADVANCED Network Policy AS10921 57 19 38 66.7% KIHNETWORK AS762 117 80 37 31.6% WELLFLEET-AS For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

CIDR on 3Com Netbuilder
by Martin, Christian 31 Jul '98

31 Jul '98

All, Anyone know how to configure a 3Com NetBuilder to support classless routing? Here is the scenario. I have a class B that is being split up into 24s and 26s. All are being statically routed over the respective WAN interfaces to the customer prem. Most default back to our WAN interfaces (some downstream BGP peers, but not in this scenario). Customer A has a 3Com Netbuilder, with an LAN IP of x.x.200.1 /24. Customer B has a Cisco 2501 with a LAN IP of x.x.23.1 /24. This customer is configured for classless routing using the 'ip classless' IOS global command. All customers can see into this network (cust B), even within the same x.x classfull class B space. But no one in the classfull x.x can see into customer A's network. Actually, their traffic gets there, but the return traffic never leaves, because the NetBuilder is looking at the first 3 bits and ignoring it, thinking that it is local. 3Com thinks that there needs to be static routes in place. I think that this is ridiculous, and that CIDR support is necessary in today's Internet. It would entail me having to ask a customer to add over 25 static routes for networks that the default rtr (me) knows about. Does anyone know how to do this without having a CIDR-aware routing protocol like OSPF running? I have had three 3Com guys on the this ticket for over a week, with no resolution. 3Com employees can redeem their company by supplying a working solution...Anyone? Regards, -Chris

2 1

exchange point in-addrs
by john heasley 31 Jul '98

31 Jul '98

how does one manage to get PTR RRs changed for exchange point addresses? we've tried using the form below and submitting the resulting email template as instructed, but received no response. http://www.isi.edu/div7/naps/ipadd-req.html tried sending mail to hostmaster(a)ep.net (from the SOAs) which stuck in our mail queue because the single MX for ep.net (flag.ep.net) is a laptop (or so we were told). the one time that our queue happened to run and the laptop was accessible; mail to hostmaster bounced w/ user unknown. then, a second MX was added (and has since disappeared), but that host refused to relay for ep.net. is there another path that i have missed? any ideas? TIA, -heas

2 1

"Packet Shapers"
by Scott Gifford 30 Jul '98

30 Jul '98

I was wondering if anybody out there has had any experience with "Packet Shapers," which claim to be able to limit traffic to a particular host, host+port, or host+port+url without dropping packets. They apparently watch traffic flows and keep track of connections, then dink around with TCP window size information to slow traffic down if needed. The one we have been looking at is called "The Packeteer" (http://www.packeteer.com) but I have seen a few others (one of which had a really good picture of a pig in the ad). Do these things work as advertised? Is anybody actively using them inside their networks? I don't know enough down-and-dirty information about TCP to know if this should work, or if it's just a plastic shell filled with snake-oil... Thanks for any information. Email if you like, I will post a summary if people are interested. ------Scott.

2 1

RE: Network Abuse - Netblock x.x.x.x - IMPORTANT
by Martin, Christian 30 Jul '98

30 Jul '98

I guess the fella doesn't realize that smurfers monitor this group... And I thought it was dying down. :( -C -----Original Message----- From: Jay Stewart [mailto:cosmo@olywa.net] Sent: Thursday, July 30, 1998 1:28 PM To: jamie(a)ais.net Cc: nanog(a)merit.edu Subject: Re: Network Abuse - Netblock x.x.x.x - IMPORTANT -----Original Message----- From: James Rishaw <jamie(a)dilbert.ais.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, July 30, 1998 10:20 AM Subject: FW: Network Abuse - Netblock x.x.x.x - IMPORTANT >A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. > > >-----Original Message----- >Sent: Thursday, July 30, 1998 7:36 AM >Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT > > >---------- >From: Andrew Shoemaker[SMTP:wrath@jerky.net] >Sent: Thursday, July 30, 1998 6:43 AM >Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT > >Hello > >My name is Andrew Shoemaker and I am the head security consultant at JNS. We >recently were the target of a denial of service attack that saturated our >Internet connection. This attack, known as a 'smurf' attack, uses unknowing >relays to source the at >tack. By relaying the attack through your network the attack is made >anonymous and increases in strength. This type of attack causes degraded >performance on both the attacked and relay networks and is the result of an >improperly configured router at you >r site. I urge you to fix your routers. If you are unable to do so, or do >not know how I suggest you call a security consultant. JNS is willing to >fix your router permanently for a one time fee of $100 US. If you are >interested in this deal please co >ntact me and I will send you a copy of our security contract and an invoice. > >Netblock de.le.te.d was found to produce 11 replys for each packet sent. >This means if the attacker is sending at T1 speeds the amount of your >bandwidth used in relaying > the attack is equivalent to 11 T1s > >regards, >Andrew Shoemaker >JNS Security >wrath(a)jerky.net >617.442.5408 Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. Jay Stewart Vice President OlyWa.Net - "Olympia's Premier Internet Service Provider" -=-=-=-=- from: http://www.jerky.net/smurf.html The Smurf Relay List This is a list of subnets that can be used for the "smurf" attack. If you find your subnet on this list FIX YOUR FUCKING ROUTERS! If you have subnets you wish to add to this list please email the wrath-mon. Once you fix your router email the above address to get your subnet removed. Until then....everyone feel free to completely FUCK these networks...and remember stupidity should never be tolerated. Updated: 07.29.98

1 0

FW: Network Abuse - Netblock x.x.x.x - IMPORTANT
by jamie＠dilbert.ais.net 30 Jul '98

30 Jul '98

A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. -----Original Message----- Sent: Thursday, July 30, 1998 7:36 AM Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT ---------- From: Andrew Shoemaker[SMTP:wrath@jerky.net] Sent: Thursday, July 30, 1998 6:43 AM Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT Hello My name is Andrew Shoemaker and I am the head security consultant at JNS. We recently were the target of a denial of service attack that saturated our Internet connection. This attack, known as a 'smurf' attack, uses unknowing relays to source the at tack. By relaying the attack through your network the attack is made anonymous and increases in strength. This type of attack causes degraded performance on both the attacked and relay networks and is the result of an improperly configured router at you r site. I urge you to fix your routers. If you are unable to do so, or do not know how I suggest you call a security consultant. JNS is willing to fix your router permanently for a one time fee of $100 US. If you are interested in this deal please co ntact me and I will send you a copy of our security contract and an invoice. Netblock de.le.te.d was found to produce 11 replys for each packet sent. This means if the attacker is sending at T1 speeds the amount of your bandwidth used in relaying the attack is equivalent to 11 T1s regards, Andrew Shoemaker JNS Security wrath(a)jerky.net 617.442.5408 -- jamie rishaw (dal/efnet:gavroche) American Information Systems, Inc. Tel:312.425.7140, FAX:312.425.7240 thirty thousand feet above the earth..youre a beautiful thing..

1 0

Re: vacation/auto-responders
by Joe Provo - Network Architect 30 Jul '98

30 Jul '98

> if you must use an auto-responder/vacation program, fix it to handle > mailing lists appropriately. It would help if merit put Precedence headers on messages. And yes, I've mailed the supposed-human address for nanog on this. Most vacation-handlers I know *always* skip 'bulk' or 'list' Precedence messages. Joe -- Joe Provo, Network Architect 508.229.8400 x3006 Commercial Internet Services Group Fax 508.229.2375 UltraNet Communications, Inc., an RCN Company <jprovo(a)ultra.net>

1 0

vacation/auto-responders
by john heasley 29 Jul '98

29 Jul '98

up to five (and counting) responses from auto-responders stating that different folks are "out of the office". no one cares if you're out, permanently. if you must use an auto-responder/vacation program, fix it to handle mailing lists appropriately. > I am out of the office, returning on Monday August 3rd. I will be > checking my email off and on during my vacation, but if this message is > critical, please send email to !@$#@*

1 0

Re: MCI [encore]
by Sean Donelan 29 Jul '98

29 Jul '98

I'm going to have to get a new name/e-mail address, obviously the provider announcements aren't making it all the way down to the "S"'s. Many people forwarded copies of MCI's mail, but I still haven't received a copy directly from MCI yet. Several people sent me several different possible causes. - AOL mail routing/DNS was FUBAR for an indeterminate period - A power plant blew up, which then fried several POPS in the midwest - Two sets of Cisco router problems - Two 'major' providers reported backbone-wide problems - SMURFing was running higher than average yesterday Is anyone correlating this? Did the Internet roll the dice and they just came up snake-eyes yesterday? And this is during the Internet's "slow period" of August. Just wait until the September effect hits. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0