- Test - lists.nanog.org

Re: Eugene Kashpureff's Defense Fund
by John J. Buxbaum 25 Nov '97

25 Nov '97

If nothing else, this provides comedic entertainment. -----Original Message----- From: Bob Allisat <tor(a)wtv.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Cc: newdom(a)ar.com <newdom(a)ar.com>; caipcom(a)vrx.net <caipcom(a)vrx.net>; iwar(a)iwar.org <iwar(a)iwar.org>; gtld-discuss(a)gtld-mou.org <gtld-discuss(a)gtld-mou.org> Date: Tuesday, November 25, 1997 3:03 PM Subject: Re: Eugene Kashpureff's Defense Fund On Mon, Nov 24, 1997 Paul A Vixie wrote: >>> How much do I have to pay to keep him in jail forever? On Mon, 24 Nov 1997, Karl Denninger wrote: >> That was MY question :-) At 11:14 PM, Marc Hurst wrote: >As much as we all know the guy is not going to get a fair trial, the >concept of an anti-defence fund is a novel one. Let's not forget that everyone attempted to profit in their own way from Eugene's devil dare and gutsy Alternic pioneering. And, all joking aside, understand that if things do not go "our" way, CORE is successfully rammed down our throats and none of the schemes to counteract IANA pan out there will be a lot more people in jail with Eugene. And it is up to those with similar views and the resources to assist others who actually do the fighting. That's how revolutions worked in history as in our times. Support your local DNS Freedom fighter or there won't be any more. Or was all those past words just hot air and bullship? TeleVirtually Yours, Bob Allisat Director, World TeleVirtual Network http://www.wtv.net PO Box 191 St E Toronto Canada M6H 4E2 tor(a)wtv.net (416) 534-1999 http://www.wtv.net/portfolio.html

1 0

Advisory - tunneling of IP at exchange points.
by Paul Thornton 25 Nov '97

25 Nov '97

-- PLEASE NOTE: If you are replying to this, consider pruning the list -- of cc's rather than crossposting replies wildly! Thanks. The LINX and several of its members have recently had to take action against an ISP that was using GRE tunneling between exchange points to appropriate the capacity of other ISPs. Although the offending party is now unlikely to repeat this abuse, we feel that this is an important vulnerabilty which could potentially be newly exploited by others elsewhere. We have created an advisory which describes details of the vulnerability, and how to detect and prevent it. This advisory can be found at http://www.linx.net/tunnel-advisory.txt Any questions are best referred to the authors listed in the advisory text. I would like to gratefully acknowledge the efforts of Lyndon Levesley and Alex Bligh at GX Networks among others in tracking down the abuse and creating this document. Keith Mitchell Chairman London InterNet Exchange keith(a)linx.org Geneva House, 3 Park Road Peterborough PE1 2UX United Kingdom Phone: +44 1733 705000 (fax 353929) Paul -- Paul Thornton, Network Engineer, London Internet Exchange Ltd. Tel: 07000 783797 Mobile: +44 467 372205

7 9

Important: NANOG List Changes
by William B. Norton 25 Nov '97

25 Nov '97

Hi Guys - Glad to see that many of you have subscribed to the new nanog-post(a)merit.edu mailing list. We've now decided to wait until Monday, December 1, to switch over to the new posting process. After that date, you'll need to also be subscribed to nanog-post(a)merit.edu in order to post to the nanog(a)merit.edu list. (You'll still post your messages to nanog(a)merit.edu, but unless you've subscribed to nanog-post, your messages will rejected.) To subscribe, send e-mail to majordomo(a)merit.edu with 'subscribe nanog-post' (without the quotes) as the text of the message. You will receive a confirmation request, and once answered, you will be able to post to the nanog mailing list. Bill

1 0

Re: Land and Cisco question
by Hank Nussbacher 25 Nov '97

25 Nov '97

At 10:58 AM 11/22/97 -0800, John Bashinski wrote: I was *extremely* unclear in what I sent since I was running out the door. Most cisco routers run by ISPs (here on NANOG) have at least 50 interfaces (subinterfaces) and usually average 100. Each and every interface/subinterface has to be blocked. So it is either create an extended access list with all 100 individual interface addresses blocked (and update it as new customers get connected) or block by subnet, i.e if all interfaces come from a 255.255.255.252 (/30) subnetted block, then block the whole /24. But then the problem I discussed below creeps up. Any recommendations on how to block this by subnet (assuming the router side always has the same bit position in the subnet)? -Hank >-----BEGIN PGP SIGNED MESSAGE----- > >> Does BGP use TCP or UDP? > >TCP. > >> If TCP then we are in trouble. > >I don't think so. > >> Almost everyone >> has access to the Internet via BGP. The line IP address is usually made up >> of a pair of addresses in the same subnet. You can IP spoof block all your >> internal IP addresses but if you block the IP address of your BGP connection >> to your BGP peer and BGP uses TCP, then the examples jbash gave out will >> stop BGP updates as well. > >This was my example: > > interface ethernet 0 > ip address 1.2.3.4 255.255.255.0 > ip access-group 101 in > ! > interface ethernet 1 > ip address 5.6.7.8 > ip access-group 101 in > ! > access-list 101 deny tcp 1.2.3.4 0.0.0.0 1.2.3.4 0.0.0.0 > access-list 101 deny tcp 5.6.7.8 0.0.0.0 5.6.7.8 0.0.0.0 > access-list 101 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 > >That only blocks the router talking to itself, not talking to any other >host, whether on the same subnet or not. As far as I know, you don't have >to have a TCP connection to yourself to run BGP, just to your neighbors. > > -- John B. > >-----BEGIN PGP SIGNATURE----- >Version: None of your beeswax > >iQCVAwUBNHcrO3emvD4nAHb9AQHpsAP+OV+xm3uQ+N1Xoc6auDyKfM/j0L9JPqvL >n1pKNh73jqZz8vMzMWOkm8wcnGkW9u+JFQ0tSlkEtpkWrAG96f0kmSpXyfC6BRYo >RvpkXL4hHT0A+1HSbVNmOjGjfThdEyWOdhcE9jJc35PxzErzarsyFTPnjK6Fl5Rl >8wVsoHAPNYU= >=cAK5 >-----END PGP SIGNATURE----- > >

12 15

Re: Eugene Kashpureff's Defense Fund
by Tim Salo 25 Nov '97

25 Nov '97

> From: Marc Hurst <mhurst(a)fastlane.ca> > On Mon, 24 Nov 1997, Karl Denninger wrote: > > On Mon, Nov 24, 1997 at 06:42:35PM -0800, Paul A Vixie wrote: > > > How much do I have to pay to keep him in jail forever? > > That was MY question :-) > > As much as we all know the guy is not going to get a fair trial, the > concept of an anti-defence fund is a novel one. It may be called a "friend of the court" brief, (only probably in Latin). Some well-written papers (briefs) about the dangers posed by those who threaten the Internet infrastructure may be useful in this case. -tjs

3 2

Netflow IP accounting and IP protocol numbers
by steven hessing 25 Nov '97

25 Nov '97

The other day we started using Cisco netflow accounting software together with IP flow export feature of recent Cisco IOS versions. What we found was that although we put a lot of protocols in the nfknown.protocols file of the accounting software (everywthing we could find in the /etc/services file of Solaris and Linux), there is still a lot of traffic under TCP-Other and UDP-Other. This indicated that traffic is going over our network using ports that the software doesn't know about. This could for example be Real-audio, Cuseeme, Pointcast, Backweb etc traffic. Unfortunately, I don't have a list of these newer protocols together with their port numbers. Has anyone compiled such a list? There's the Assigned numbers RFC but the last version of it is RFC 1700 of October 1994. -- Steven

5 4

OPS: SECURITY new packet of death
by Sean Donelan 25 Nov '97

25 Nov '97

Good morning America (and good day or night to the rest of the world), I hope you got a good nights sleep. There is a new packet of death circulating. Sending a SYN packet with the source and destination address & port set to the same value causes some systems to lockup. One such system seems to include several versions of Cisco IOS. Details on Bugtraq. Have a nice day. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

12 11

RE: Eugene Kashpureff's Defense Fund
by Jim Browning 25 Nov '97

25 Nov '97

ROFL.. ---------- From: Bob Allisat [SMTP:tor@wtv.net] Sent: Monday, November 24, 1997 12:22 PM > Eugene Kashpureff's Defense Fund

1 0

RE: Sprint problems
by Michael Bostardi 24 Nov '97

24 Nov '97

For $0.10 a minute you could call their NOC. > -----Original Message----- > From: Dan Hubbard [SMTP:dhubbard@thepalace.com] > Sent: Monday, November 24, 1997 9:24 PM > To: nanog(a)merit.edu > Subject: Sprint problems > > We are having a great deal of packet loss to Sprint ? Any details... > --------------- > Dan Hubbard > The Palace Inc.

1 0

Re: Sprint problems
by cdavisso＠teir.com 24 Nov '97

24 Nov '97

According to the Sprint Technical number, they're having a "network event" in the Washington DC area. Don't have any other details yet. We do have an open trouble ticket. Chuck Davisson TEIR -- ================================= I've no doubt the devil grins, As seas of ink I spatter. Ye gods forgive my literary sins, The other kind don't matter. - Robert W. Service

1 0