- Test - lists.nanog.org

Identifying type of DOS attacks?
by Peter Helmenstine 22 Jan '98

22 Jan '98

How do most of you identify the latest type of DOS attack of the week? I know that some are usually more obvious than others and if you have exhisting filters it helps to narrow down some problems but other than seeing that ping times are in seconds the seconds and noticing that your pipe is hosed, how does one determine that it's a DOS attack when it's happening rather than say a bad piece of hardware. Is there anything that you all look for in particular. Does DOS Tracker tell you the type of attack that is being used? Other monitoring tools? -Pete --------------------- Peter Helmenstine --------------------------- WWW: http://marin.uoregon.edu/~pete E-mailto:pete@marin.uoregon.edu UofO Computing Center, Eugene, Or 97403 (541) 346-1629

1 0

MCI DS-3/Cascade/Cisco
by Turnando Fuad 22 Jan '98

22 Jan '98

We are turning up a DS-3 to MCI and have been having a heck of a time between our Cisco's 7507 IOS PPP(have upgraded 11.2.9P to 11.2.11P) and MCI's cascade switches. Anyone else had any experience between Cisco and Cascade PPP? Thanks, Turnando Fuad NSNet

3 3

Re: Reporting Little Blue Men
by dlr＠bungi.com 22 Jan '98

22 Jan '98

[In the message entitled "Re: Reporting Little Blue Men" on Jan 21, 17:38, "Dave Stoddard" writes:] > While Paul's BGP feed is excellent for blocking spam, we can > not use it because our customers demand being able to get to > the "entire Internet". Instead, we use filters to block mail > coming to dial-up customers, and we provide information and > tools to help our network customers kill spam on their own > mail servers. We are working hard to make the Internet a > *much* smaller place for spammers ... For what it is worth, you can also use the RBL via DNS, and affect email only. No license is currently required for this, and can be installed in sendmail (and most other mail packages) in seconds. See http://maps.vix.com for details -- Dave Rand dlr(a)bungi.com http://www.bungi.com

1 0

100Mbit ISDN solution
by Luke Parrish 21 Jan '98

21 Jan '98

Hey guys. Ran into a problem the other day. A customer of mine has a 100Mbit network, with 100Mbit hubs. They want ISDN access, so they hook a Pipeline 50 to their hub, dial it up, connect to the internet. But, hey nothing on the network can see it. Doh! I didnt think about the little 10Mbit into 100Mbit hub problem. I called Ascend and they said they do not have a router than can do 100Mbit yet, does anyone here know of an ISDN router that will support 100Mbit, or some kind of AUI transceiver that may go 10 to 100? Any help would be greatly appreciated... Thanks Luke * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Luke Parrish * Email lparrish(a)iamerica.net * * LDS-iAmerica, ISP * Pager 1-800-789-6062 x3910 * * Network Engineer * Phone 1-800-789-6062 x3010 * * AS 4958 * http://cust.iamerica.net/lparrish * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * I love the Internet, and you should too. * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

7 8

RE: Reporting Little Blue Men
by Dave Van Allen 21 Jan '98

21 Jan '98

Start by making sure your RAS users and direct customers (your network's edge) can only output packets that contain their valid source address. If everyone did this, all of the world's problems would go away; Ozone depletion, world hunger, that silly rain forest thing, Smurfs and DoS and maybe even Microsoft! :-) Best regards, David Van Allen - FASTNET(tm) / You Tools Corporation dave(a)fast.net (888)321-FAST(3278) http://www.fast.net FASTNET - Business and Personal Internet Solutions -----Original Message----- From: Eric Wieling [mailto:eric@ccti.net] Sent: Tuesday, January 20, 1998 9:45 AM To: nanog(a)merit.edu Subject: Reporting Little Blue Men Just about every night someone(s) tries to use us as the "innocent third party" in smurf attacks. Of course, we block and log all the broadcast packets. Is there any point in trying to report these attacks? Who would we report them to? We don't know what the source is, after all the address is spoofed. It seems kind of pointless to notify the victim -- they already know they have been smurfed. I want to do my part to try to stop attacks, but I'm baffled on this one. --Eric -- Eric Wieling (eric(a)ccti.net) Chesapeake Communications Corporation Sales: sales(a)ccti.net 504-585-1850, Support: support(a)ccti.net 504-525-5449 We have changed our name! Corporate Communications Technology is now known as Chesapeake Communications Corporation.

2 1

Hello, DIGEX?
by Adam Rothschild 21 Jan '98

21 Jan '98

Any DIGEX employees out there? If so, please respond privately. If not, kindly disregard this message. Thanks, Adam

1 0

NANOG 12 INFO
by Pam Ciesla 20 Jan '98

20 Jan '98

Reminder hotel block expires on 1/25 if you haven't reserved your room be sure to do so. The agenda is full for this meeting and will go to 4:00PM on Tuesday, 2/10. There will be approximately 300 ports available, so bring your laptops. Payment must be received no later then Friday, 1/30 or the charge will be $170. There will also be a $20 charge for cancelations after 1/30. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 734-936-0172 - phone Merit Network, Inc. 734-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

NSI Bulletin 098-001 |
by Chuck Gomes 20 Jan '98

20 Jan '98

Effective Tuesday, January 20, 1998, Network Solutions, Inc. will introduce a new Registrant Name Change Agreement, http://rs.internic.net/reg-change/agreement.html, and procedure to change the name of a Registrant for a registered domain name. The instructions for completing this new Agreement are on InterNIC Registration Services' web site located at the URL http://rs.internic.net/reg-change/instructions.html. This new Agreement and procedure will affect those who wish to: 1. Correct typographical or minor errors; 2. Reflect a legal name change of the Registrant; or 3. Transfer the domain name registration to another party. This new Agreement will eventually entirely replace the current domain name transfer procedure wherein parties are required to submit a Delete and New Domain Name Registration Agreement via email to Network Solutions. The new Agreement and the old transfer procedure will both be accepted by Network Solutions through Sunday, March 1, 1998. Beginning on Monday, March 2, 1998, customers will be required to use the new Agreement to effect changes to a Registrant's name. Network Solutions believes this new Agreement will streamline the process of changing the Registrant's name for a domain name registration while affording greater legal protection to all parties involved. If you have questions regarding this new Agreement, please contact Network Solutions' Registration Help Line Monday-Friday, 7:00 a.m. to 9:00 p.m. at (703) 742-4777. _____________________________________ Chuck Gomes Director of Customer Programs Network Solutions, Inc.

1 0

NSI Bulletin 097-011 | New Domain Name Registrant Change Procedures
by Chuck Gomes 20 Jan '98

20 Jan '98

Effective Tuesday, January 20, 1998, Network Solutions, Inc. will introduce a new Registrant Name Change Agreement, http://rs.internic.net/reg-change/agreement.html, and procedure to change the name of a Registrant for a registered domain name. The instructions for completing this new Agreement are on InterNIC Registration Services' web site located at the URL http://rs.internic.net/reg-change/instructions.html. This new Agreement and procedure will affect those who wish to: 1. Correct typographical or minor errors; 2. Reflect a legal name change of the Registrant; or 3. Transfer the domain name registration to another party. This new Agreement will eventually entirely replace the current domain name transfer procedure wherein parties are required to submit a _____________________________________ Chuck Gomes Director of Customer Programs Network Solutions, Inc.

1 0

Draft NANOG agenda
by Susan R. Harris 20 Jan '98

20 Jan '98

Greetings - here's the draft agenda. Watch for updates in the days to come: http://www.nanog.org See you in Albuquerque! -------------------------------------- Sunday, February 8: Evening Tutorials -------------------------------------- 7:30 p.m. BGP 101: An Introduction to the Border Gateway Protocol Paul Ferguson, Cisco 9:00 p.m. BGP 102: A Mid-Sized Network Configuration Case Study Avi Freedman, Net Access Monday, February 9 ------------------- 9:00 a.m. Welcome, Introductions, Future Meetings Bill Norton, Merit 9:30 a.m. A Route-Filtering Model for Improving Global Internet Routing: An IOPS Proposal Jessica Yu, ANS 10:15 a.m. Origin Authentication in BGP Tony Li, Juniper Yakov Rekhter, Cisco 11:00 a.m. SprintLink Backbone Architecture Evolution: IP Over Sonet Ted Studwell, Sprint Vab Goel, Sprint Jian Li, Sprint 11:30 a.m. Operational Use of a Multihomed NAT Ed Kern, DIGEX 12:00 p.m. LUNCH 1:30 p.m. Massively Parallel Routing Vadim Antonov, Pluris David Bernstein, Pluris 2:00 p.m. Squid Caching Update K Claffy, NLANR 2:30 p.m. Next-Generation NAS Architecture for Predictable and Reliable Network Access Services Shuang Deng, Aptis 3:00 p.m. Monitoring your Network with Freely Available Statistics Reporting Tools: An Overview Stan Barber, Academ Consulting Services 3:30 p.m. BREAK 3:45 p.m. Internet Routing Registry Update IRR Security Issues: Presentation and Open Discussion Dave Meyer, Univ. of Oregon Curtis Villamizar, ANS Carol Orange, RIPE Sandy Murphy, TIS Routing Arbiter Update Bill Norton, Merit Ramesh Govindan, ISI Transition to Routing Policy Specification Language (RPSL) Cengiz Alaettinoglu, ISI Distributed IRR Technology and Deployment Cengiz Alaettinoglu, ISI Monday Evening, Feb. 9 ---------------------- 7:30 - 9:30 p.m. Overview and Hands-on Tutorial: Using BGP Communities and MEDs With GateD Sue Hares, Merit 7:30 - 8:30 p.m. BOF: Establishing an Exchange Point in the Middle of Nowhere John Brown, iHighway.net 7:30 - 9:00 p.m. BOF: GIGAswitch/FDDI to Gigabit Ethernet: Interoperability and Migration Strategies Speakers TBA from Celeritas/Digital 9:00 p.m . BOF: Interprovider Operations Jake Khuon, Merit Abha Ahuja, Merit Craig Huegen, Cisco Tuesday, February 10 -------------------- 9:00 a.m. State of the Internet Forum 10:30 a.m. BREAK 10:45 a.m. ARIN Update Kim Hubbard, ARIN 11:00 a.m. Technical Considerations in Preventing Mail Abuse: Presentation and Open Discussion Paul Vixie, Vixie Enterprises 12:00 p.m. LUNCH 1:30 p.m. Multihoming: Problems and Solutions From the Customer Point of View Howard Berkowitz 2:15 p.m. Recent Events in Inter-Provider Multicast Dave Meyer, Univ. of Oregon 2:30 p.m. BREAK 2:45 p.m. IPv6 Solutions/IPv4 Issues Christian Huitema, Bellcore Yakov Rekhter, Cisco 3:45 p.m. Closing Remarks Bill Norton, Merit

1 0