- Test - lists.nanog.org

Re: Last Call: IPSEC drafts -> Proposed Standards
by Sean Doran 05 Jul '95

05 Jul '95

Bill - No offense, but please don't send IETF-related material here; we have real work to do, and probably already have seen it anyway. Sean. - -- Sean Doran <smd(a)sprint.net> / <smd(a)icp.net>

1 0

bgp flap dampening
by Sean Doran 02 Jul '95

02 Jul '95

I should point out that there are now a couple of large networks playing around with code derived from the paper Curtis Villamizar presented at the NANOG meeting at NCAR. Initial testing with route-dampening seems to hold out some promise. Probably the main question now will be how aggressively to attack the issues of flapping prefixes. With the current default values, and given that it's not exactly peak usage time, there are some 100 prefixes from essentially all over the Internet being dampened. Sean.

1 0

Re: Bill Manning considered fatal
by fred＠cisco.com 01 Jul '95

01 Jul '95

At 2:37 AM 6/30/95, Tony Li wrote: >The power-off of the last IPv4 network. What, Tony, are you trying to tell me that we have to get rid of all the dumb routers out there now to get rid of dumb routing? That the Shiva Fastpath will not implement OSPF and cost less than $3000? That old copies of FTP Software's PC code that can't deal with non-octet-aligned subnet masks (let alone supernets) are going to be in use by SOMEBODY as long as there is such a benighted nightmare as an IBM PC? Naw, no way, I simply can't believe that. And by the way, ATM is going to take over the world tomorrow, because we all know that computers are going to stop sporting RS-232-C interfaces Real Soon Now. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= If you're looking to find the key to the Universe, I have some bad news and some good news. The bad news is -- there is no key to the Universe. The good news is -- it has been left unlocked.

2 1

Re: Bill Manning considered fatal
by Tony Li 30 Jun '95

30 Jun '95

>- There are many networks which are NOT the Internet. CIDR only >applies to the Internet. > You want to loose sleep? Imagine a world wide Novell network! Actually, that scares me a LOT less. Less broken installed base to put up with. Renumbering is infinitely easier. Tony

1 0

Re: Bill Manning considered fatal
by Tony Li 30 Jun '95

30 Jun '95

>- Please recall that the technical savvy of the beginner customer base >has dropped two orders of magnitude in just the last three years. > This is a relative drop. Humans have not gotten dumber, the technology has gotten much more sophisticated! What do we do when we can't find humans that can understand what is going on and how to deal with it? Excuse me, but you miss my point. The technical expertise of the human trying to join the Internet today HAS dropped considerably. And we are not even yet to mainstream PC users yet. You raise a very good question, which I don't have the solution to. We _need_ an entirely self-configuring network. But that's a different discussion. Tony

1 0

IGRP considered fatal
by bmanning＠ISI.EDU 30 Jun '95

30 Jun '95

With Appologies to YR. two questions (and a task) for the list(s) 1. Please let me know (by private email) which IGP you are using. Replies to bmanning(a)isi.edu. 2. What will it take to get router vendors to modify default setup to select a classless IGP instead of (RIP,IGRP)? -- --bill

3 3

Re: Bill Manning considered fatal
by nordlund＠databank.com 30 Jun '95

30 Jun '95

> > two questions (and a task) for the list(s) > > 2. What will it take to get router vendors to modify default > setup to select a classless IGP instead of (RIP,IGRP)? > >The power-off of the last IPv4 network. > >You should understand that there are many reasons for this: > >- All of the classful protocols today are incredibly hard to work with >for a beginning user. OSPF has about 3 orders of magnitude more knobs >than it needs. EIGRP (which we tried REALLY hard to keep simple) is >about two orders of magnitude too hard. Both are resource intensive >and require careful hand-holding. RIP2 is less piggish, but still is >two orders of magnitude too messy. > When the world gets complicated, the tools to deal with it get complicated. I am not sure that AI is mature enough to deal with all this. >- Please recall that the technical savvy of the beginner customer base >has dropped two orders of magnitude in just the last three years. > This is a relative drop. Humans have not gotten dumber, the technology has gotten much more sophisticated! What do we do when we can't find humans that can understand what is going on and how to deal with it? >- You don't need classful in a stub network for CIDR purposes. Yes, >it helps for address efficiency IF the user can figure out VLSM. > >- The defaults need to be for the most common case: rank beginner in a stub. > >- There are many networks which are NOT the Internet. CIDR only >applies to the Internet. > You want to loose sleep? Imagine a world wide Novell network! >I sympathize, but this is a case where the intelligent actually must >lose to the tyranny of the majority. > SIGH----- >Tony Dave Nordlund Dir of Technical Svcs Databank, Inc 913/842-6699 1473 Hwy 40 nordlund(a)databank.com Lawrence, KS 66044 "Your Key to the Internet

1 0

Heads-Up! (INFO#95.16723)
by Thomas Longstaff 29 Jun '95

29 Jun '95

-----BEGIN PGP SIGNED MESSAGE----- Content-Type: text/plain; charset=us-ascii ============================================================================= Heads-Up to Network Service Providers - IP Spoofing Attacks CERT Coordination Center June 29, 1995 ============================================================================== Over the past few weeks, we have received reports of 170 IP spoofing attacks against Internet sites internationally. We are sending you this "heads-up" because you are a likely target. At least 80 of the targets we know of are name servers, routers, and other network operation systems. The attacks have been largely successful, we continue to receive reports, and we are concerned that more attacks are going undetected. We urge you to check your systems and routers for any signs of compromise and to use the information in CERT advisory CA-95:01, "IP Spoofing Attacks and Hijacked Terminal Connections," to help protect yourself, detect IP spoofing attacks, and recover from root compromises. The advisory is available by anonymous FTP from ftp://info.cert.org/pub/cert_advisories This "heads-up" contains additional information about what you can do, as well as issues to consider before taking action. Please feel free to forward this to other providers of Internet services. Communicating with us - ---------------------- Warning: For sensitive information, use encrypted email. You will find the CERT public PGP key at the end of this document. We would appreciate it if you would let us know whether you are watching for IP spoofed packets on your networks (or plan to do so). If you see spoofed packets, we'd like to learn how many you see and from how many different sites; this will help us determine the scope and pattern of the attacks. We will keep all detailed information and the identity of organizations confidential. Because of our workload, we must ask you not to send log files of activity, but we would be happy to work with you as needed on how to interpret data that you may collect. If you see activity that indicates an attack is in progress, we encourage you to contact your customer, or other involved sites or their service provider. We have some general information on IP spoofing and on recovering from a compromise that we can make available to you for your customers' use. We would also be happy to provide guidance and advice, if needed, on how to handle incidents and work with law enforcement. ............................................................................. Some things you can do - ---------------------- It is possible to check network traffic for indications of the type of attack we are currently seeing. Before doing so, please look at the next section, "Issues to consider before taking action." There are several classes of packets that you could watch for. The most basic is any TCP packet where the network portion (Class A, B, or C or a prefix and length as specified by CIDR, the Classless Inter-Domain Routing specification) of the source and destination addresses are the same but neither are from your local network. These packets would not normally go outside the source network unless there is a routing problem, worthy of additional investigation, or the packets actually originated outside your network. The latter may occur with Mobile IP testing, but an attacker spoofing the source address is a more likely cause. For a NAP or NSP, the interface into which a packet arrived indicates the direction of the source of the attack. The packet's destination address indicates the "trusted" host involved in an attack. That information suggests which hosts may be under attack. There are public domain and vendor provided tools available for checking your networks for IP spoofed packets. Among them are Argus, tcpdump, and snoop. Argus 1.5 - --------- Argus is an IP network transaction-auditing tool developed at the Software Engineering Institute of Carnegie Mellon University. The Argus 1.5 distribution includes scripts that perform simple network administrative tasks, one of which is IP spoofing detection. The data that Argus generates makes it possible to analyze network activity and performance in ways that have not been possible before. For example, you can answer questions such as, "Were there any IP spoofing attempts into our firewall network over the past 8 hours?" The developers of Argus have made the tools available from ftp://ftp.sei.cmu.edu/pub/argus-1.5 If you have any questions, comments, or suggestions, please send mail to argus(a)sei.cmu.edu. Scripts - ------- At the end of this document ("Attachment A") are scripts you may want to use to check your network. We are aware that the Internet is now "classless," meaning that the old notion of class A, B, and C addresses is being replaced with a prefix and length notation, also known as CIDR. Even so, the scripts, which are based on classes, may be useful to some service providers. In all the IP spoofing incidents reported to us to date, we believe that the scripts would have shown the spoofed packets. (The problem here is that these scripts may either show other packets labeled as spoofed or not show true spoofed packets due to CIDR.) A standalone machine running tcpdump or equivalent should be able to run these scripts without affecting the performance of the local net. It may be possible to configure routers to do this check directly but we are not currently aware of any systems on which this is possible. .............................................................................. Issues to consider before taking action - --------------------------------------- Before writing this "heads-up," we consulted colleagues on other response teams, several network service providers, and other technical experts. They raised the following issues, and there surely are others you should consider before taking action. Technical and performance issues: - There may be too many "false positives." Two causes are mobile IP and misconfigurations; there may be other causes as well. - The feasibility of installing network monitors may depend on network topology. - It is not clear how many monitoring machines you would need to pinpoint the problem. - When the tcpdump and snoop scripts were tested on a dedicated Sun IPX connected to a T1, the impact on performance was only marginal. Long-haul tests with similar scripts do not have performance problems either. - Anything above a T1 is going to cause some performance problems (applications like tcpdump and snoop do not work very well at all on DS3 or FDDI interfaces). Legal issues: - - Some service providers believe that checking your network as we suggest is all right; others believe that there may be a problem. We urge you to check with your legal advisors about analyzing packet header information, analyzing traffic content to detect unauthorized activity, and analyzing internal traffic and customer-bound traffic. - - For US service providers, the Digital Telephony Bill of 1994 is relevant; in particular, check the amended provision found at 18 U.S.C. 2511(2) (a) (i), which permits an electronic communications service and its employees to ...intercept, disclose, or use that communication in the normal course of...employment while engaged in any activity which is a necessary incident to the rendition of...service or to the protection of the rights or property of the provider of that service.... .............................................................................. Attachment - Scripts for Checking Networks - -------------------------------------------- We have tested the following scripts on a recent version of tcpdump and snoop (192.9.200.0 would be replaced by the site's local net, of course): --- script for tcpdump --- #!/bin/sh tcpdump 'tcp and not dst net 192.9.200.0 and ( (ip[12]&0x80=0 and ip[12]=ip[16]) or (ip[12]&0xc0=0x80 and ip[12]=ip[16] and ip[13]=ip[17]) or (ip[12]&0xe0=0xc0 and ip[12]=ip[16] and ip[13]=ip[17] and ip[14]=ip[18]) )' (Note this only seems to work with tcpdump-3.0.2 and libpcap-0.0.6 currently.) --- script for snoop --- #!/bin/sh snoop 'tcp and not net 192.9.200.0 and ((ip[12]&0x80=0 and ip[12]=ip[16]) or (ip[12]&0xc0=0x80 and ip[12]=ip[16] and ip[13]=ip[17]) or (ip[12]&0xe0=0xc0 and ip[12]=ip[16] and ip[13]=ip[17] and ip[14]=ip[18]))' (Note that this does not appear to work with Solaris 2.3 machines.) To more accurately analyze network traffic, it is useful to first describe the network topology; for example: ---------------- | INTERNET | ---------------- | ---------- | | NETWORK | ---------------- | MONITOR | | ROUTER | ---------- ---------------- | | | | ----------------------------------------------------------------- |MAC-A |MAC-B |MAC-C --------- --------- --------- |ROUTER | |ROUTER | |ROUTER | --------- --------- --------- | | | | | | | | | | | | | | | | | | | | | | | | | | | Ca Cb Cc Cd Ce Cf Cg Ch Ci (MAC-A, MAC-B, and MAC-C refer to the ethernet addresses of the router interfaces attached to the same network as the network monitor machine.) In this case, the machine used to check network traffic could be any machine capable of running tcpdump, snoop, or any other packet capture and analysis software. This machine could be programmed so that any packets that match the following expression are displayed. tcp and ( not ether src MAC-A and ( src net Ca or src net Cb or src net Cc ) not ether src MAC-B and ( src net Cd or src net Ce or src net Cf ) not ether src MAC-C and ( src net Cg or src net Ch or src net Ci ) ) This expression looks at the source address of each packet and identifies those that did not originate from the correct interface. This example should be extensible to take CIDR into account. For example, if the CIDR specification of network Ca is 192.9.200/21, then the sub-expression: src net Ca should be replaced with: ip[12:4]&0xfffff800=192.9.200.0 .............................................................................. CERT Public Key - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi2a4WoAAAEEAN0IPkqCmoGRud0Kts3g4ZGgZ4zyqY8C5VTOgUcqU+D2U1so 21K6dxj/lewKFduXtNpqDeg6C0wR6GIMJ2jWLU4GUEq0xHohioWGGg5O3QTvCpN3 rnLIKO9urv4Wjgkp1n1ys7xcOYl5jb7kuhdlXs3kNgKi4zBB5XVP+x0t4w7BAAUR tChDRVJUIENvb3JkaW5hdGlvbiBDZW50ZXIgPGNlcnRAY2VydC5vcmc+iQCVAgUQ LZrkOXVP+x0t4w7BAQEI3QP/d9gl7GD52Pd8KbsBMb0hiploigL8kZW1Q1fVsIm1 cO9xumU89CLf2jrN+IdrIMpVWAO3DyJjZooZTaJBg/9jjv3HltHTq/XFD5c+WYlM G+fQZVuR8qu8+D8P8pPbNVm94wxj9fyKO39/dnub1UfjDedJBtt+zgMJmstADkOv QBM= =N6E5 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBL/MOmHVP+x0t4w7BAQF7+QQAp8mm5Bnu+/wiQK2trEn1JtzV6Ls3Z/gP 1SgZe85eTEGzKvRPKb+G3W7HAFn56B6X6JCgixl0Xgj/zcYlOvraug16/DfAd6i0 dkZXcrTQn+GRSHbi6oXPs5FRCE0eE5tFkhouVnROECBLoKJOR9/0dE4NuLzCkm3Q Uf+x64RmkIs= =RBqe -----END PGP SIGNATURE-----

1 0

Save Your Computer!
by Britestar＠dub-news-svc-1.compuserve.com 28 Jun '95

28 Jun '95

"Save Your Computer" Surge sentry computer grade with fax/modem. four outlet surge/noise cube with two RJ-11 jacks for fax/modem line and power protection. 3 stage/line circuitry. 1 picosecond clamp response time. Emi/rfi noise rejection to 35db. UL 1449 rating at 330v. 347 joules. Max surge 11,505 amps. Lifetime warranty and power protection. Putty. 2"h x 4"w x 6.5"d. MFG# ds41psg1. Shipping weight 1.721 lbs. Price: $69.95, shipping and handling included. --------------------------------------------------------- "Repair your Computer" Computer tool kit. By Curtis. Can be used to repair maintain and upgrade virtually any microcomputer system. All tools are demagnetized. Lifetime warranty. Zipper vinyl case. Black 6"h x 9"w x 1.37"d. MFG# tk3ctf 20 piece set (l lb). Price $29.95. Shipping and handling included. MFG# tk4ctf 55 piece set (3 lbs). Price $52.99. Shipping and handling included. ----------------------------------------------------- "Super discount" Voice activated telephone recorder. By TT Systems. One button record, pause, fast forward/rewind, volume control, tape counter, cue and review, LED record light, built-in condenser mic for non-phone recording. AC or battery powered. Uses standard cassettes. Black. 1.5"h x 7"w x 4"d. MFG# vtr500tts. Shipping weight 2.28 lbs. Special price $199.95. Shipping and handling included. Save $100 dollars! Send your check or money order to: Britestar Enterprises 3701 Inglewood Ave Suite #304 Redondo Beach, CA 90278 Please list MFG# with your order. Please allow 7 - 10 days for delivery. ------------------------------------------------------- Money Manager Software "MoneyManager," from Times Publishing does virtually everything Quicken does, and even surpasses it in some respects due to a more powerful language it uses. (IBM compatible only). "MoneyManager" for Windows is the software that allows a person to take control of their personal finances by organizing, tracking and reporting income, expenses, assets, liabilities and investments on a daily basis on his PC. "MoneyManager" prints checks, pays bills and reconciles even the most complex bank statement in seconds. "MoneyManager" tracks your checking, savings, credit card and money management. You can record and categorize your expenses, compare them to budgets and know exactly where your money goes. Keep your investment of stocks, bonds and mutual funds portfolio up-to-date with "MoneyManager." Calculate and analyze your gains, losses and returns on investments and tax consequences in an instant. Thinking of buying a home? "MoneyManager" will create a home affordability analysis for you. Lease-or-buy decisions were never easier. Want to pay off that mortgage faster? It will produce amortization schedules and show you the whopping savings in interest you can realize by making small prepayments of principal. How about income statement, balance sheet, cash flow forecasts, and net worth projections? All of these are available at your fingertips with "MoneyManager." Sale price: $24.99 - Shipping and handling included. 7 - 10 days for delivery. Comes in 3 1/2 or 5 1/4 diskettes, (choose one). Send your check or money order to: Britestar Enterprises 3701 Inglewood Ave Suite #304 Redondo Beach, CA 90278 -------------------------------------------------------- Geographics GEO4000 Moving Message Color Sign, from "Geographics" Multi-color: 16 vibrant colors/hues. Displays maximum 27 characters, minimum 14 characters. 3 fonts, 4 text styles, 10 preprogrammed graphics, 46 European characters. "Magic" interface. Network up to 254 signs. 90-day memory backup. Display area: 3"H x 37.6"W. Indoor use only. Includes wireless remote, mounting brackets and adapter. 5.5"H x 39.6"W x 1.4"D. Shipping weight 11 lbs. MFG# 08386EZL. Sale price $370.50, shipping and handling included. --------------------------------------------------- "Fresh Air" "Bionaire" 2 speed personal air purifier/ionizer. Cleans air in a room 10' x 10' x 8' in 12 minutes. 2-speed, low noise, turbo system. 4 stage filtration system. Effective on tobacco smoke, pollen, dust, bacteria. Ion on/off switch. Flame retarded, injection-molded plastic casing. One year limited warranty. Black. 12.5" x 7.5" x 8"d. MFG# f7obio. Price $94.95, shipping and handling included. -------------------------------------------------------- 18 Karat Gold "Cross" 18 Karat Gold Fountain Pen. 18 Karat Gold Fountain Pen available in four 18 Karat nib widths. Piston converter included. Gift boxed. Comes with Lifetime Mechanical Guarantee. Shipping weight 1 lb. MFG# 8036bcro Broad nib MFG# 8036mcro Med. nib MFG# 8036fcro Fine nib MFG# 8036xcro X-fine nib Price $990.64, Shipping and handling included. Save $279.36. Send your check or money order to : Britestar Enterprises 3701 Inglewood Ave Suite #304 Redondo Beach, CA 90278 Please list MFG# with your order. Please allow 7 - 10 days for delivery. --------------------------------------------------------- Snail Mail Order Form Send your check or money order to: Britestar Enterprises 3701 Inglewood Ave Suite #304 Redondo Beach, CA 90278 Name: ________________________________________________________ Address: ______________________________________________________ City/State/Zip:_______________________________________________ Phone: _______________________________________________________ I've enclosed my check or money order for: "MoneyManager" software for Windows. Diskette Size: 3 1/2 ____ 5 1/4 ____ Surge sentry computer grade with fax/modem MFG# ds41psg1 Price 69.95, shipping and handling included. [ ] Computer took kit. By Curtis. MFG# tk3ctf 20 piece set (l lb) Price $29.95, shipping and handling included. [ ] MFG# tk4ctff 55 piece set (3 lbs). Price $199.95, shipping and handling included. [ ] Voice activated telephone recorder. By TT Systems. MFG# vtr500tts shipping weight 2.28 lbs. Special price $199.95. Shipping and handling included. [ ] GEO 4000 Moving Message Color Sign, from :Geographics" MFG# 08386EZL Sale price $370.50, shipping and handling included [ ] "Bionaire" 2 speed personal air purifier/ionizer MFG# f7obio. Price $94.95, shipping and handling included. [ ] "Cross" 18 Karat Gold Fountain Pen MFG# 8036bcro Broad nib [ ] MFG# 8036mcro Med. nib [ ] MFG# 8036fcro Fine nib [ ] MFG# 8036xcro X-fine nib [ ] Price $990.64. Shipping and handling included. "Never leave home to shop" A 544 page catalog, with over 12,356 name brand items, filled with office/electronic products. Names like Sony, Sharp, Magnavox, Panasonic, JVC, Packard Bell, Brother, Cobra, Toshiba, Pioneer, Casio, and over 216 others. Price $8.00, shipping and handling included. [ ] ............................... . BriteStar, Inc. . 3701 Inglewood Ave . Suite 304 . Redondo Beach, CA . 90278 ..................................

1 0

None
by List-Admin Account 23 Jun '95

23 Jun '95

Walter: You are on the nanog list already. Pam Ciesla >From mcd(a)interview.com Tue Jun 20 19:54:19 1995 Received: from merit.edu (merit.edu [35.1.1.42]) by home.merit.edu (8.6.12/merit-2.0) with ESMTP id TAA13814; Tue, 20 Jun 1995 19:54:19 -0400 Received: from interview.com (mcd(a)interview.com [204.192.25.2]) by merit.edu (8.6.12/merit-2.0) with ESMTP id TAA25322 for <nanog-request(a)merit.edu>; Tue, 20 Jun 1995 19:54:16 -0400 Received: (from mcd@localhost) by interview.com (8.6.12/8.6.12) id TAA14718; Tue, 20 Jun 1995 19:55:21 -0400 From: wjl(a)sura.net Date: Tue, 20 Jun 1995 07:19:14 -0400 Message-Id: <199506201119.HAA12744@hico> To: nanog(a)merit.edu ReSent-Date: Tue, 20 Jun 1995 19:55:15 -0400 (EDT) ReSent-From: Mark Christopher Davies <mcd(a)interview.com> ReSent-To: nanog-request(a)merit.edu ReSent-Subject: Resent mail.... ReSent-Message-ID: <Pine.BSD/.3.91.950620195515.11126I(a)interview.com> Status: R wjl Subject:subscribe subscribe wjl(a)sura.net

1 0