- Test - lists.nanog.org

NANOG Registration
by Pam Ciesla 03 Oct '96

03 Oct '96

I have just updated the list of attendees for the NANOG Meeting on the web. If you have registered and are not on the list please let me know. Thanks Pam Ciesla

2 1

Re: New Denial of Service Attack on Panix
by Paul Ferguson 03 Oct '96

03 Oct '96

I agree completely, but neither one is a panacea. - paul At 08:40 AM 10/3/96 -0400, Dima Volodin wrote: >And if everyone doesn't make any attacks we won't have any problems >either. To rephrase - relying on ingress filtering is putting your >security in someone other's hands, doing host-based stuff is protecting >yourself with your own hands. To rephrase once again - doing ingress >filtering is "being conservative with what you produce", being able to >cope with SYN floods on the host level is "being liberal on what you >accept." We need both, and overemphasising one side of the solution will >do a lot of harm. > > >Dima >

4 3

JVNC and CIX
by Paul A Vixie 03 Oct '96

03 Oct '96

FWIW, CIX allows its point to point members (such as JVNC who has a T1) to have the association filter incoming routes. Most point to point members do not take advantage of this service, since they can filter on their end and have more fine grained control over the results. JVNC's voluntary filtering is: ip as-path access-list 6 permit _46$ ip as-path access-list 6 permit _97$ ip as-path access-list 6 permit _262$ ip as-path access-list 6 permit _263$ ip as-path access-list 6 permit _1250$ ip as-path access-list 6 permit _2697$ ip as-path access-list 6 permit _3132$ ip as-path access-list 6 permit _4628$ ip as-path access-list 6 permit _4629$ Note, though, that at the moment JVNC is sending CIX precisely _no_ routes. Whether this is a coincidence or is related to Petach's complaints, I do not know. When I see routes from them again, I'll hand verify several of them and if they are still doing "the bad thing" to Petach et al, I'll see if I can get JVNC to tighten down the filters on their side.

1 0

"Basic BGP configuration problem"
by Bradley Dunn 03 Oct '96

03 Oct '96

For a good laugh, call: 800-669-8303 and select option 2. -BD

9 10

Fixing "clueless ISPs" etc etc etc, typical NANOG topic answered decisively
by Sean Doran 03 Oct '96

03 Oct '96

I thought this would bring a bright moment to everyone's Thursday. Sean. ------- Start of forwarded message ------- From: James Chellis <jchellis(a)well.com> Newsgroups: alt.internet.guru Subject: Internet Certification Date: 2 Oct 1996 05:19:04 GMT Organization: The WELL Message-ID: <52su08$28j(a)filth.well.com> Microsoft and Novell recently began looking into certification for Internet expertise. Microsoft decided to integrate material related to the Internet into existing MCP programs. Novell took a different approach; they created a new certification called the Novell Internet Professional. Do you see a value in Internet certification? Would you want to be certified in this area? What should the subject matter focus upon (since the Internet is so vast and quickly changing)? Are Microsoft, Novell,and Netscape the right companies to do this, or would a more neutral third party be more appropriate? Just a few questions I'm curious about. Please feel free to reply to this list or to me personally. Thanks. James ------- End of forwarded message -------

4 3

Re: GES (jvnc.net) as the purveyor of bad routing advertisements
by salo＠msc.edu 03 Oct '96

03 Oct '96

> Date: Wed, 2 Oct 1996 20:17:51 -0400 (EDT) > From: Gordon Cook <cook(a)netaxs.com> > To: nanog(a)merit.edu > Subject: GES (jvnc.net) as the purveyor of bad routing advertisements > [...] > I believe that there is ample evidence that the folk at Princeton have to > be very aware of the nature of their provider. Yet I have seen no signs > that Princeton is ready to pull up its stakes. > [...] This begs the question of, if Princeton did "pull up its stakes," where it would replant them. o How should Princeton, for example, measure the "quality" of its NSP? How can Princeton be assured that another NSP would be "better?" o Do you have any measurements which provide an indication of the relative quality of the major NSPs? o Do you have a ranking of the quality of the major NSPs based on, (in the absence of quantitative evidence), informal evidence? o Do you think the work of the IPPM group is likely to help? Why or why not? -tjs

2 1

Re: Fixing "clueless ISPs" etc etc etc, typical NANOG topic answered decisively
by Justin W. Newton 03 Oct '96

03 Oct '96

At 06:06 AM 10/3/96 -0700, Sean Doran wrote: > >I thought this would bring a bright moment to everyone's Thursday. > > Sean. > >------- Start of forwarded message ------- >From: James Chellis <jchellis(a)well.com> >Newsgroups: alt.internet.guru >Subject: Internet Certification >Date: 2 Oct 1996 05:19:04 GMT >Organization: The WELL >Message-ID: <52su08$28j(a)filth.well.com> > >Microsoft and Novell recently began looking into >certification for Internet expertise. Microsoft decided to >integrate material related to the Internet into existing >MCP programs. Novell took a different approach; they >created a new certification called the Novell Internet >Professional. Gee I wonder If they will come up with a side certification Packet Layer Engineer. The we could all go out and become NIP PLE's. Justin Newton Internet Architect Erol's Internet Services

1 0

Re: New Denial of Service Attack on Panix
by Paul Ferguson 03 Oct '96

03 Oct '96

At 11:52 PM 10/2/96 -0400, Dima Volodin wrote: > >I.e. a single compromised host in the "permitted prefix filter range" >can cause as much trouble as the current attacks. Granted, it's a bit >easier to track down a host like this, but eliminating the majority of >compromisable hosts is even more difficult than global implementation of >the cited document. The bitter irony is that non-implementation of this >draft will most probably corelate with presence of compromisable hosts. > Well, that's true, but it's a different facet of the same problem. The draft only attempts to solve what it is that we can solve be ingress filtering. Solutions using firewalls or proxy devices which defat this type of attack are a Good Thing, but if everyone does ingress filtering, a large percentage of this problem disappear. - paul >Thus host-(and firewall-)based solutions are at least as important as >the ingress filtering. > >As of the evidence of these attacks - they were evident long before the >current talking. > >Dima

2 1

Network World
by Hank Nussbacher 03 Oct '96

03 Oct '96

Network World has a 2 part in depth article about the infrastructure of the Internet as a sort of "health" report in Sep 16 issue (part 1). Many people in NANOG quoted. Not a bad article except for ... "Carriers are beginning to mandate use of Complex Inter Domain Routing address blocks, which are analogous to area codes..." Those that have an acct on www.nwfusion.com can find it at #9603. Hank

1 0

Re: New Denial of Service Attack on Panix
by Paul Ferguson 02 Oct '96

02 Oct '96

At 05:32 PM 10/2/96 -0400, Dima Volodin wrote: > >Anyway, filtering packets with SRC addresses known to generate >ICMP_UNREACH at the earliest possible stage might be a good idea. > Well, this is what we [collectively] have been talking about doing as a 'best current practice' since the attacks became evident. Also, see: [snip] A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Network Ingress Filtering Author(s) : P. Ferguson Filename : draft-ferguson-ingress-filtering-00.txt Pages : 6 Date : 10/01/1996 Recent occurrences of various Denial of Service attacks which have employed forged source addresses have proven to be a troublesome issue for Internet Service Providers and the Internet community overall. This paper discusses a simple, effective and straightforward method for using ingress traffic filtering to deny attacks which use "invalid" source addresses; prefixes which are not being legitimately advertized to the Internet via a particular service provider gateway. [snip] Once the document is revised to an acceptable [rough consensus] draft, I'd like to see it become published as a BCP. - paul

2 1