- Test - lists.nanog.org

Re: Deciding whose network block is whose?
by Sean M. Doran 09 Jan '98

09 Jan '98

Geoff Huston <gih(a)telstra.net> writes: > My point was that one direction of addressing Sean Donelan's > original problem was to clearly identify the point in the network > where the announcement is originated and clearly > identify the legitimacy of each advertisement incrementally > through the use of explicit signatures. Grand, so you have all these little signatures floating around. Are you going to process them at all your gateways, or are they there just in case something goes wrong? If the latter, how do you expect the signatures might be used in practice? > It does not address explicitly the issue of routing > policy at a distance, which you identify as a bloody big > scaling problem - and I agree that it is! Is the problem you are trying to solve not "does X have the right to announce prefix Y"? Perhaps I am missing something. Sean.

1 0

Denial of Service Attacks disguised as Spam...
by Barry Shein 09 Jan '98

09 Jan '98

[The purpose of this note is to change your thinking about Spam] Enormous amounts of this so-called "spam" is nothing of the sort, it is malicious people using mail ports to conduct denial of service attacks. And the sooner we wake up to this fact the better. We need a new word for this and to publicize this new attitude. Because as soon as someone says "spam" all that comes to mind is a Sanford Wallace type pathetically trying to make a buck with annoying advertising, and people (in particular law enforcement) just won't give "annoying advertising" a moment's thought. But I assert that we're dealing with crime and criminals here who aren't selling anything. Look at the several consecutive log entries attached below ("Spamf" and "PATMATCH" mean the msg was blocked by our spam filters.) We're receiving about *30,000* of these per day, non-stop, full-blast, every few seconds, for days. The fact that not one of these is getting past our filters doesn't seem to discourage this person, not even over a period of days. The network address of the mail relay source has been hacked (notice how it changes with every msg), the address ("billy(a)bingo.edu") is phony and forged. This person has gone to great length to hide their identity and to make it difficult to block them at the router level. Blocking the message itself is relatively easy, but I don't think they care, just so long as they can hammer at your mail port day and night. Dec 31 14:36:29 5C:world sendmail[3098]: SpamF: <billy(a)bingo.edu> (relay=po1.synapse.or.jp [202.208.174.131]) PATMATCH Dec 31 14:37:09 5C:world sendmail[3614]: SpamF: <billy(a)bingo.edu> (relay=www.dma.be [195.13.24.2]) PATMATCH Dec 31 14:37:10 5C:world sendmail[3623]: SpamF: <billy(a)bingo.edu> (relay=at.atnet.it [193.207.30.132]) PATMATCH Dec 31 14:37:22 5C:world sendmail[3765]: SpamF: <billy(a)bingo.edu> (relay=mail.vienna.at [194.158.143.44]) PATMATCH Dec 31 14:37:23 5C:world sendmail[3775]: SpamF: <billy(a)bingo.edu> (relay=seus.metoc.ns.doe.ca [131.235.30.50]) PATMATCH This person is not the only source of this, others are doing the same thing. I don't believe this person is actually selling anything. Can I repeat that? I DON'T BELIEVE THIS PERSON IS ACTUALLY SELLING ANYTHING I do believe this is a malicious person who has learned that if you stick some text in a message that appears to be selling something law enforcement's mind will go blank and nothing (effective) will be done. "It's just annoying advertising, ignore it". The analogy which comes to mind is a town where door to door salesman can't be considered trespassers on your doorstep. So a group of people who want to annoy you don what appear to be door to door salesmen accouterments (eg, a suitcase full of new household brushes) and stands and bangs and bangs and bangs on your door, day and night. And you tell themm to go away. And they ignore you, they keep banging. So you call the police, and they say "he's a door to door salesman, the law allows him to bang on your door! People bang on people's doors all the time. Stop calling us, we can't do anything, ask him to leave or ignore him." We're being fooled, we're allowing criminals to operate without challenge. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.std.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo*

10 11

You know it's time to quit when...
by Matthew D. Lammers 09 Jan '98

09 Jan '98

This probably doesn't belong here, but this _could_ be considered humorous and we all like humor...I'm forwarding a bit of e-mail that the staff for our Dial In Internet Services received tonight... ----- BEGIN FORWARDED MESSAGE ----- < < The second question has to do with privacy. I noted that when < I went to "the Stalker's Home Page" the server could read < the Domain name for my IP address. Since my Domain name can < change every time I dial in, that's no big deal, but < I have read that credit card numbers and other such < information can be extrapolated from my machine even if I'm < using a temporary IP address. < ----- END FORWARDED MESSAGE ----- How do I 'splain to the user that his IP address is nothing too secretive and what DNS really is for? :) I think he thinks that his IP was read from his hard drive.... Although it is slightly possible that his HD can get "read" with HTML cookies and other methods, do I invoke the fear of God into this poor soul and tell him everything I can or just shut up and play dumb? Maybe some RFCs will clear things up for him...Nah, I'll just tell him it's all magic. And I just wonder how "temporary" IP address space is allocated? Afterall, I was hoping that we could play magical CIDR blocks and get all new ones next week...These /17s are all dirty now and I want new ones. -Matt. -- Matthew D. Lammers -- NetSet Internet Solutions, Inc. http://www.netset.com/

1 0

Attack of the Killer Spam
by Adam Rothschild 09 Jan '98

09 Jan '98

NANOG folk: Over the past few weeks, I have noticed an influx of SPAM(tm) transmitted by UUNet dynamic IP dial-up users (read: MSN, Earthlink, GTE, etc.) and relayed using Earthlink SMTP relays. Am I turning senile prematurely, or has anyone else noticed this influx? Also, how easy would it be for Earthlink and other nationwide "ISP's" (or more accurately, UU/PSI resellers) to do the following? This would not stop SPAM(tm) dead in its tracks, but I figure it would make it easier to hold spammers accountable at least... unless, of course, they use throw-away accounts, in which case there is not much that can be done... - institute anti-spam rules on their SMTP relays, i.e. only relay mail reporting to be from earthlink.net and the virtual domains they host - only allow SMTP relaying from IP's assigned to *their customers* dynamically (cross-reference Radius logs?) Constructive feedback would be greatly appreciated! Together, we CAN make a difference. Regards, Adam

9 11

RADB based filters
by Justin Newton 08 Jan '98

08 Jan '98

Hi all, I was wondering what those of you who are doing RADB/MCI-RR/ANS RA filtering were doing about large networks which do not register their networks in the RADB. It would seem unwise to simply trust their announcements, and even more unwise to simply ignore their announcements, so... Whats the common parctice in this scenario?

3 2

RE: ATM --> HSSI
by Chad Skidmore 08 Jan '98

08 Jan '98

Try the ADSU from ADC Kentrox. Assuming that it is a DS-3 loop. --------------------------------------------------------- Chad Skidmore Director of Network Engineering Northwest Nexus, Inc. http://www.nwnexus.com 1-888-NWNEXUS -----Original Message----- From: andrew khoo [mailto:andrewk@aussie.net] Sent: Monday, January 05, 1998 9:15 AM To: nanog(a)merit.edu Subject: ATM --> HSSI what box can i use to convert PacBell ATM (for PacBell NAP) into HSSI? ============================================================== andrew khoo - rebel leader aus: +61-2-9223-2777 Ourworld Global Network, Australia usa: +1-415-902-8820 ============================================================== -- We Bite (tm) --

3 2

Newbie question.
by Jim Bachesta 08 Jan '98

08 Jan '98

I'm a network engineer coming up to speed on BGP. I'm currently not running BGP on my router. Are there any tools that will allow me to monitor BGP passively? Any pointers is appreciated. Jim Bachesta bachesta(a)photodisc.com Voice: 206-728-7781 Pager: 206-978-0336 Cell: 206-714-7330

4 3

Re: Things to do to make the network better
by Havard.Eidnes＠runit.sintef.no 08 Jan '98

08 Jan '98

> > Doing this on the customer border routers appears to me to be the > > obviously right place. > > Can you trust the customer border router? I personally don't. Hm, this is probably caused by terminology confusion. When I say "customer border router", I am referring to your router having the interface towards your customers, not a router owned by the customer. - Håvard

1 0

NANOG 12 INFO
by Pam Ciesla 08 Jan '98

08 Jan '98

The attendee list has been posted to the NANOG Webpage http://www.nanog.org. Please check this out. If you are not on the attendee list and should be please contact me. Please book your hotel reservations early the hotel block on rooms expires on 1/25. Hotel info available at http://www.ihighway.net/nanog/ Thanks xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 734-936-0172 - phone Merit Network, Inc. 734-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

Re: Things to do to make the network better
by Havard.Eidnes＠runit.sintef.no 08 Jan '98

08 Jan '98

> We have routers with ISDP PRI links, where the routing > information arrives from RADIUS via a CHAP login. There are 600 > routed objects in the RADIUS database, as well as 10k+ > non-routed (dynamic IP) objects. Every ISDN router therefore > has a potential 600 directly attached neighbors; although no > router has more than 60 links at any one time. Some common > equipment may handle this just barely; other is wholly > inadequate. It sounds to me like what you would really like was something akin to the "RPF check" as done on multicast traffic for unicast traffic on your customer routers, perhaps as a per-interface option. If this feature existed you would not accept a packet from a given source and incoming interface unless the box in question has a route for the source pointing back out the same interface. That way you would not get the administrative burden of maintaining access lists and ensuring they're always in synch with the local view of the routing system. Doing this on the customer border routers appears to me to be the obviously right place. Doing this in a place where asymmetrical routing is the norm (as appears to be the case in the current backbones) is obviously a non-starter. I think this has been mentioned several times to various providers in the past without this feature materializing, but one can still hope. (It's not unconceivable that the current access products have not been engineered with sufficient CPU resources to be able to even perform this task...) - Håvard

2 1