- Test - lists.nanog.org

Re: Reporting Little Blue Men
by Dennis Simpson 23 Jan '98

23 Jan '98

> From: Dean Anderson <dean(a)av8.com> > > But when you take the step from advocacy to actions you are violating the > law in almost every case. You can advocate anything, but you can't go > tearing down buildings, or in this case, intercepting communications. Filtering packets is not interception, it is disregard. If I ignore your packets and do not pass them to the next machine in the link, I am not intercepting your communications, I am ignoring them. Unless you are paying me to do so, I have no obligation to carry your packets. If my server checks message headers to determine validity before transferring to a spool file, I am not intercepting, I am determining message routing. As above, if you aren't paying me, I have no obligation to deliver something you handed me for delivery. Or are you suggesting mail servers should deliver mail without determining who it is for? If I review the content of your message, and then make decisions about who gets to read it (as opposed to discarding it), then I am intercepting, and reprehensible. I cannot block mail espousing causes I disagree with, but I have no obligation to deliver them either. Find yourself another path to my client; I won't do anything to permit or prevent it. I am not blocking you. I am also not assisting you. That is neither illegal nor immoral. SPAM yourself silly. dennis

10 11

Reporting Little Blue Men
by Eric Wieling 23 Jan '98

23 Jan '98

Just about every night someone(s) tries to use us as the "innocent third party" in smurf attacks. Of course, we block and log all the broadcast packets. Is there any point in trying to report these attacks? Who would we report them to? We don't know what the source is, after all the address is spoofed. It seems kind of pointless to notify the victim -- they already know they have been smurfed. I want to do my part to try to stop attacks, but I'm baffled on this one. --Eric -- Eric Wieling (eric(a)ccti.net) Chesapeake Communications Corporation Sales: sales(a)ccti.net 504-585-1850, Support: support(a)ccti.net 504-525-5449 We have changed our name! Corporate Communications Technology is now known as Chesapeake Communications Corporation.

16 18

Re: Reporting Little Blue Men
by James R. Fisher 22 Jan '98

22 Jan '98

I have had just the opposite experience; my local LAN is w.x.48.0/20 , and so I have 15 perfectly good w.x.y.0 and w.x.y.255 addresses other than the wire/broadcast addresses. I have assigned most of them to a variety of machines, and so far the only grok-failure came from Windows95 boxen, which dislike w.x.y.255 . This is not altogether surprising, given MS's notable proficiency in networking... -jrf +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ At 11:41 AM 1/22/98 -0500, Eric Osborne wrote: >In other words, I can't prevent my customers from sending packets to >a broadcast address, esp. on a subnet smaller than /24. You might be >able to block outgoing packets for destination x.y.z.255, but if you've got >a mask >/24 (/23, etc..), couldn't .255 be a valid host address? Yes, it could be, actually. I tried to use it as WAN pool address once though and it horrendously confused the RAS, as well as several UNIX boxen on the network. ************************************************************** Justin W. Newton voice: +1-650-482-2840 Senior Network Architect fax: +1-650-482-2844 PRIORI NETWORKS, INC. http://www.priori.net Legislative and Policy Director, ISP/C http://www.ispc.org "The People You Know. The People You Trust." **************************************************************

1 0

Identifying type of DOS attacks?
by Peter Helmenstine 22 Jan '98

22 Jan '98

How do most of you identify the latest type of DOS attack of the week? I know that some are usually more obvious than others and if you have exhisting filters it helps to narrow down some problems but other than seeing that ping times are in seconds the seconds and noticing that your pipe is hosed, how does one determine that it's a DOS attack when it's happening rather than say a bad piece of hardware. Is there anything that you all look for in particular. Does DOS Tracker tell you the type of attack that is being used? Other monitoring tools? -Pete --------------------- Peter Helmenstine --------------------------- WWW: http://marin.uoregon.edu/~pete E-mailto:pete@marin.uoregon.edu UofO Computing Center, Eugene, Or 97403 (541) 346-1629

1 0

MCI DS-3/Cascade/Cisco
by Turnando Fuad 22 Jan '98

22 Jan '98

We are turning up a DS-3 to MCI and have been having a heck of a time between our Cisco's 7507 IOS PPP(have upgraded 11.2.9P to 11.2.11P) and MCI's cascade switches. Anyone else had any experience between Cisco and Cascade PPP? Thanks, Turnando Fuad NSNet

3 3

Re: Reporting Little Blue Men
by dlr＠bungi.com 22 Jan '98

22 Jan '98

[In the message entitled "Re: Reporting Little Blue Men" on Jan 21, 17:38, "Dave Stoddard" writes:] > While Paul's BGP feed is excellent for blocking spam, we can > not use it because our customers demand being able to get to > the "entire Internet". Instead, we use filters to block mail > coming to dial-up customers, and we provide information and > tools to help our network customers kill spam on their own > mail servers. We are working hard to make the Internet a > *much* smaller place for spammers ... For what it is worth, you can also use the RBL via DNS, and affect email only. No license is currently required for this, and can be installed in sendmail (and most other mail packages) in seconds. See http://maps.vix.com for details -- Dave Rand dlr(a)bungi.com http://www.bungi.com

1 0

100Mbit ISDN solution
by Luke Parrish 21 Jan '98

21 Jan '98

Hey guys. Ran into a problem the other day. A customer of mine has a 100Mbit network, with 100Mbit hubs. They want ISDN access, so they hook a Pipeline 50 to their hub, dial it up, connect to the internet. But, hey nothing on the network can see it. Doh! I didnt think about the little 10Mbit into 100Mbit hub problem. I called Ascend and they said they do not have a router than can do 100Mbit yet, does anyone here know of an ISDN router that will support 100Mbit, or some kind of AUI transceiver that may go 10 to 100? Any help would be greatly appreciated... Thanks Luke * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Luke Parrish * Email lparrish(a)iamerica.net * * LDS-iAmerica, ISP * Pager 1-800-789-6062 x3910 * * Network Engineer * Phone 1-800-789-6062 x3010 * * AS 4958 * http://cust.iamerica.net/lparrish * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * I love the Internet, and you should too. * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

7 8

RE: Reporting Little Blue Men
by Dave Van Allen 21 Jan '98

21 Jan '98

Start by making sure your RAS users and direct customers (your network's edge) can only output packets that contain their valid source address. If everyone did this, all of the world's problems would go away; Ozone depletion, world hunger, that silly rain forest thing, Smurfs and DoS and maybe even Microsoft! :-) Best regards, David Van Allen - FASTNET(tm) / You Tools Corporation dave(a)fast.net (888)321-FAST(3278) http://www.fast.net FASTNET - Business and Personal Internet Solutions -----Original Message----- From: Eric Wieling [mailto:eric@ccti.net] Sent: Tuesday, January 20, 1998 9:45 AM To: nanog(a)merit.edu Subject: Reporting Little Blue Men Just about every night someone(s) tries to use us as the "innocent third party" in smurf attacks. Of course, we block and log all the broadcast packets. Is there any point in trying to report these attacks? Who would we report them to? We don't know what the source is, after all the address is spoofed. It seems kind of pointless to notify the victim -- they already know they have been smurfed. I want to do my part to try to stop attacks, but I'm baffled on this one. --Eric -- Eric Wieling (eric(a)ccti.net) Chesapeake Communications Corporation Sales: sales(a)ccti.net 504-585-1850, Support: support(a)ccti.net 504-525-5449 We have changed our name! Corporate Communications Technology is now known as Chesapeake Communications Corporation.

2 1

Hello, DIGEX?
by Adam Rothschild 21 Jan '98

21 Jan '98

Any DIGEX employees out there? If so, please respond privately. If not, kindly disregard this message. Thanks, Adam

1 0

NANOG 12 INFO
by Pam Ciesla 20 Jan '98

20 Jan '98

Reminder hotel block expires on 1/25 if you haven't reserved your room be sure to do so. The agenda is full for this meeting and will go to 4:00PM on Tuesday, 2/10. There will be approximately 300 ports available, so bring your laptops. Payment must be received no later then Friday, 1/30 or the charge will be $170. There will also be a $20 charge for cancelations after 1/30. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 734-936-0172 - phone Merit Network, Inc. 734-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0