Re: Industry best practices (was Re: large organization nameservers

2007-08-11 Thread Sean Donelan
Followups probably should go to the dnsops mailing list. I got tired of things and went back to the original question, and put together my list of what the minimum packets needed for full DNS performance on the modern Internet. It is the minimum, based on the security principle deny

Industry best practices (was Re: large organization nameservers sending icmp packets to dns servers)

2007-08-08 Thread Sean Donelan
On Tue, 7 Aug 2007, Kevin Oberman wrote: This has been a pain for me for years. I have tried to reason with security people about this and, while they don't dispute my reasoning, they always end up saying that it is the standard practice and that, lacking any evidence of what it might be

Re: large organization nameservers sending icmp packets to dns servers.

2007-08-06 Thread Sean Donelan
On Mon, 6 Aug 2007, Drew Weaver wrote: Is it a fairly normal practice for large companies such as Yahoo! And Mozilla to send icmp/ping packets to DNS servers? If so, why? And a related question would be from a service provider standpoint is there any reason to deny ICMP/PING packets to name

I35 bridge collapse in Minneapolis

2007-08-01 Thread Sean Donelan
Telephone call gapping by the major long distance carriers into the region seemed to be in effect for a while. I don't believe this is one of the five critical Mississippi River fiber crossing points, so Internet traffic appears mostly unaffected.

DNSSEC deployment at IANA (was Re: DNS Hijacking by Cox)

2007-07-26 Thread Sean Donelan
On Sun, 22 Jul 2007, Steven M. Bellovin wrote: And people wonder why I support DNSsec Followups probably should go to the DNS mailing lists At IEPG, IANA gave an update on the progress being made to implement signing of the root/infrastructure-tlds zones.

Re: Why do we use facilities with EPO's?

2007-07-25 Thread Sean Donelan
On Wed, 25 Jul 2007, Leo Bicknell wrote: What I found interesting is that a single EPO is not a hard and fast rule. They walked me through a twisty maze of the national electric code, the national fire code, and local regulations. Through that journey, they left me with a rather interesting

History of the EPO (Emergency Power Off)

2007-07-25 Thread Sean Donelan
The interesting thing about the EPO and data centers is it wasn't orginally for life-safety, but came out of a recommendation by IBM to the NFPA for property protection. But like many things, the original reasoning been lost to history, and the codes grew in different ways.

Bots back to full throttle

2007-07-24 Thread Sean Donelan
The DNS entries for the EFnet and other mainline IRC servers previously affected appear to have timed-out/been removed from various ISP caching DNS resolvers I checked. I didn't check if all the routing blackholes have cleared up. User-based IRC servers should back to being pummled by Bot

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-24 Thread Sean Donelan
On Tue, 24 Jul 2007, Joe Greco wrote: So I'm supposed to invent a solution that does WAY MORE than what Cox was trying to accomplish, and then you'll listen? Forget that (or pay me). Since it was a false positive, isn't the correct answer to not include irc.vel.net in the Bot CC list rather

How should ISPs notify customers about Bots (Was Re: DNS Hijacking by Cox)

2007-07-23 Thread Sean Donelan
On Sun, 22 Jul 2007, Joe Greco wrote: We can break a lot of things in the name of saving the Internet. That does not make it wise to do so. Since the last time the subject of ISPs taking action and doing something about Bots, a lot of people came up with many ideas involving the ISP

Re: DNS Hijacking by Cox

2007-07-23 Thread Sean Donelan
On Tue, 24 Jul 2007, Perry Lorier wrote: doing it[1]. If you're interested in finding people that Undernet detects as being open proxies or such like, put an IDS rule looking for :[^ ]* 465 [^ ]* :AUTO . Of course, then someone would flame the ISP for running a sniffer/wiretap on their

Re: DNS Hijacking by Cox

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: I'll accept that argument once you've explained to all your family members how to do it - and they've actually done it, successfully. Let's be real now. If we're going to be real now, consider how rarely ISPs have done this over the last several years.

Re: DNS Hijacking by Cox

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: And, incidentally, I do consider this a false positive. If any average person might be tripped up by it, and we certainly have a lot of average users on IRC, then it's bad. So, the answer is, at least one false positive. The only way any human activity

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: I think there's a bit of a difference, in that when you're using every commercial WiFi hotspot and hotel login system, that they redirect everything. Would you truly consider that to be the same thing as one of those services redirecting www.cnn.com to

Re: DNS Hijacking by Cox

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: I'd prefer that ISP's tends towards taking no action when taking action has a strong probability of backfiring. Everything has a chance of backfiring. So ISPs should take no action. Please let me know how your next DDOS attack lasts.

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking by Cox)

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Suresh Ramasubramanian wrote: What should be the official IETF recognized method for network operators to asynchronously communicate with users/hosts connect to the network for various reasons getting those machines cleaned up? Most large carriers that are also MAAWG

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: So how do you connect to the real IRC server, then? Remember that most end users are not nslookup-wielding shell commandos who can figure out whois and look up the IP. If those users are so technically unsophisticated, do you really expect the other

Re: DNS Hijacking by Cox

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: I can't help but notice you totally avoided responding to what I wrote; I would have to take this to mean that you know that it is fundamentally unreasonable to expect users to set up their own recursers to work around ISP recurser brokenness (which is

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: Hint: there is no bot. My traffic is being redirected regardless. Were I a Cox customer (and I'm not), I'd be rather ticked off. Hint: the bots are on computers connecting to the irc server, not the irc server. Interfering with services in order to

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: So are you claiming no bots ever try to connect to that server? I don't care if bots ever try to connect to that server. I can effectively stop the bots from connecting to servers by shutting down the Internet, but that doesn't make that solution

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Chris L. Morrow wrote: So, to back this up and get off the original complaint, if a service provider can protect a large portion of their customer base with some decent intelligence gathering and security policy implementation is that a good thing? keeping in mind that in

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: Although this seems to be the first bit mistake in over two years, does that make the practice unacceptable as another tool to respond to Bots? The practice of blocking public EFnet servers? As I've said multiple times, sometimes mistakes happen and the

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: Please enlighten me. Intercept and inspect IRC packets. If they join a botnet channel, turn on a flag in the user's account. Place them in a garden (no IRC, no nothing, except McAfee or your favorite AV/patch set). Wow, you are recommending ISPs

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: Some privacy advocates will be upset with ISP's doing what Cox is doing. Maybe you missed that. If we assume that it is okay for Cox to actually intercept the IRC sessions of their users, we're wa far into that mess anyways. I'm saying do it right if

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking

2007-07-23 Thread Sean Donelan
On Mon, 23 Jul 2007, Joe Greco wrote: Would it be better if ISPs just blackholed certain IP addresses associated with Bot CC servers instead of trying to give the user a message. That doesn't require examining the data content of any messages. The user just gets a connection timeout.

Re: DNS Hijacking by Cox

2007-07-22 Thread Sean Donelan
On Sun, 22 Jul 2007, Andrew Matthews wrote: isn't there a law against hijacking dns? What can i do to persue this? DNS is just another application protocol that runs over IP. You don't have to use those DNS servers to resolve names.

Re: DNS Hijacking by Cox

2007-07-22 Thread Sean Donelan
On Sun, 22 Jul 2007, William Allen Simpson wrote: Comcast still blocks port 25. And last week, a locally well-known person was blocked from sending outgoing port 25 email to their servers from her home Comcast service. MSA port 587 is only 9 years old. I guess it takes some people longer

Multiple different ISPs respond to Bots (was RE: DNS Hijacking by Cox)

2007-07-22 Thread Sean Donelan
On Sun, 22 Jul 2007, Raymond L. Corbin wrote: I agree. They are at least trying to clean up their network. If they are having a lot of problems with zombie bots that DDoS / Spam then this is a good way to stop it, for now. The small group of users can either use other nameservers or something

Re: iPhone and Network Disruptions ...

2007-07-21 Thread Sean Donelan
On Sat, 21 Jul 2007, Prof. Robert Mathews (OSIA) wrote: Cisco, Duke has now come to see the elimination of the problem, see: *Duke Resolves iPhone, Wi-Fi Outage Problems* at http://www.eweek.com/article2/0,1895,2161065,00.asp Since neither Apple, Cisco nor Duke seems willing to say exactly

China Internet problems

2007-07-18 Thread Sean Donelan
Reuters is reporting that some traffic between China and other countries is having some problems. Sina.com and 263.com have notified its users about problems with overseas e-mail.

Re: Belgian court rules that ISPs must block file-sharing

2007-07-05 Thread Sean Donelan
On Fri, 6 Jul 2007, Chris L. Morrow wrote: On Thu, 5 Jul 2007, Steven M. Bellovin wrote: http://www.pcworld.com/article/id,134159-c,internetlegalissues/article.html Note that this is based on their interpretation of EU law. and a hearty 'good luck' to them... :( I suppose someone could

Re: TransAtlantic Cable Break

2007-06-25 Thread Sean Donelan
On Mon, 25 Jun 2007, Chris L. Morrow wrote: I suppose if you had some special traffic you could qos up that and down everything else but that wasn't quite what Simon was getting at I don't think. Although we may think IP is everything, Internet traffic is not the only type of traffice

Vietnam arrests alledged fiber-optic cable thieves

2007-06-24 Thread Sean Donelan
http://www.thanhniennews.com/society/?catid=3newsid=29347 Police arrested two more people Saturday for stealing undersea fiber-optic cables off the southern coast of Vietnam, including the group.s suspected leader. Ten have been apprehended in the case so far. [...] Eleven kilometers of

Re: TransAtlantic Cable Break

2007-06-22 Thread Sean Donelan
On Fri, 22 Jun 2007, Hank Nussbacher wrote: Tell that to the 10 gig wave customers who lost service. Very few cable systems provide protection at the 10 gig wave level. If you don't pay the extra amount for a protected circuit, why should your circuit get protection for free when others have

Re: Quarantining infected hosts (Was: FBI tells the public to call their ISP for help)

2007-06-18 Thread Sean Donelan
On Mon, 18 Jun 2007, Suresh Ramasubramanian wrote: On 6/18/07, Sean Donelan [EMAIL PROTECTED] wrote: Automation is a non-starter unless you have people to deal with the exceptions. If you don't deal with exceptions, eventually problems with any automated system will overwhelm you. You can

FBI tells the public to call their ISP for help

2007-06-13 Thread Sean Donelan
If your call center volumes go up today... The fine people at the FBI are recommending people call their ISP for home computer technical support, even though most ISPs don't sell home computers, operating system software or application software.

Re: FBI tells the public to call their ISP for help

2007-06-13 Thread Sean Donelan
On Wed, 13 Jun 2007, Brandon Butterworth wrote: The fine people at the FBI are recommending people call their ISP for home computer technical support, even though most ISPs don't sell home computers, operating system software or application software. Sounds like an opportunity, someone will

Re: FBI tells the public to call their ISP for help

2007-06-13 Thread Sean Donelan
On Wed, 13 Jun 2007, Roland Dobbins wrote: It seems to me that the larger inference is that law enforcement are taking the botnet problem more seriously, which is what a lot of folks in the operational community have been advocating for a long time. While one aspect of the messaging is

CableLabs issues CALEA specification

2007-06-12 Thread Sean Donelan
CableLabs announced the release of its new Cable Broadband Intercept Specification. http://www.cablemodem.com/downloads/specs/CM-SP-CBI2.0-I01-070611.pdf While praising CableLabs, the FBI avoided saying the CableLabs specifications were acceptable. The FBI committed to working to further

UK ISPs v. US ISPs (was RE: Network Level Content Blocking)

2007-06-09 Thread Sean Donelan
On Fri, 8 Jun 2007, [EMAIL PROTECTED] wrote: In this case I would suggest that it is in ISPs best interests to get involved with network content blocking, so that ISPs collectively become deep experts on the subject. We are then in a position to modify these activities in a way that is

Re: Network Level Content Blocking (UK)

2007-06-07 Thread Sean Donelan
On Thu, 7 Jun 2007, James Blessing wrote: 1. Revocation of mere conduit status; by inspecting certain content and preventing access to it the ISP is doing more that just passing packets and is getting involved in the content. Its not content blocking, its source/destination blocking. While

Re: Network Level Content Blocking (UK)

2007-06-07 Thread Sean Donelan
On Thu, 7 Jun 2007, Chris L. Morrow wrote: Its not content blocking, its source/destination blocking. oh, so null routes? I got the impression it was application-aware, or atleast port-aware... If it's proxying or doing anything more than port-level blocking it's likely it sees content as

Re: Network Level Content Blocking (UK)

2007-06-07 Thread Sean Donelan
On Thu, 7 Jun 2007, Sean Donelan wrote: On Thu, 7 Jun 2007, Chris L. Morrow wrote: Its not content blocking, its source/destination blocking. oh, so null routes? I got the impression it was application-aware, or atleast port-aware... If it's proxying or doing anything more than port-level

Re: Network Level Content Blocking (UK)

2007-06-07 Thread Sean Donelan
On Thu, 7 Jun 2007, Iljitsch van Beijnum wrote: Its more than null routes, but not much more. The router does a re-route on a list of network/IP address, and then for the protocols the redirector box understands (i.e. pretty much only HTTP) it matches part of the application/URL pattern.

Re: Which ISPs Are Spying on You?

2007-05-31 Thread Sean Donelan
On Thu, 31 May 2007, Hank Nussbacher wrote: http://www.wired.com/politics/onlinerights/news/2007/05/isp_privacy Pretty useless reporting, especially since the reporter apparently didn't even do even a little Google research to discover which ISP's (not the ones he queried) were partners

Re: Content provider plans

2007-05-30 Thread Sean Donelan
On Wed, 30 May 2007, Michal Krsek wrote: Few weeks ago I had interesting discussion with *unnamed* Google VIP. His answer has been: Google engineers doesn't see need to spend money on building IPv6 infrastructure. You, as user, can motivate them by sending request supporting this idea. So

Re: Slate Podcast on Estonian DOS atatck

2007-05-24 Thread Sean Donelan
On Thu, 24 May 2007, Bill Woodcock wrote: First of it's kind that it targeted a country. No, at the very least, Moonlight Maze and Titan Rain came before. But by today's standards, Moonlight Maze would have been trivially small. I don't have any numbers for Titan Rain. Anyone know how it

Re: Slate Podcast on Estonian DOS atatck

2007-05-23 Thread Sean Donelan
On Wed, 23 May 2007, Bill Woodcock wrote: http://www.slate.com/id/2166749/fr/podcast/ Downloading it now. John Markoff just called me for the NYT piece. Odd that it's just hitting the news now, two weeks later. I wonder, does this mean Estonia is now more likely to act/re-act to its

Re: Broadband routers and botnets - being proactive

2007-05-14 Thread Sean Donelan
On Mon, 14 May 2007, Gadi Evron wrote: Just a joke, Sean. What would you consider from your experience, the best way to make these third parties take responsibility? First, you need to identify the ODM making the software used in the CPE. -- Warning: Be careful signing up for UltraDNS

Re: Broadband routers and botnets - being proactive

2007-05-13 Thread Sean Donelan
On Sun, 13 May 2007, Florian Weimer wrote: Fortunately, there is a simple solution to this kind of problem: ISPs are very likely liable if they fail to alert customers about security problems, and do not provide updates in a timely manner. After a few painful incidents, the ISPs will learn,

Re: Broadband routers and botnets - being proactive

2007-05-13 Thread Sean Donelan
On Sun, 13 May 2007, Gadi Evron wrote: Passing the buck! Buck passer! (see below - skip to Dilbert link) I guess you missed my attempts 3 or 4 years ago at trying to establish some standards for CPE concerning security. I've been at this party for a long time, I know how the song ends.

Re: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Jason Frisvold wrote: Here's a question that's come up around here. Does a CALEA intercept include hairpining or is it *only* traffic leaving your network? I'm of the opinion that a CALEA intercept request includes every bit of traffic being sent or received by the

Re: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Patrick Muldoon wrote: We've been under the impression that is *all* data. So for us, things like PPPoE Sessions, just putting a tap/span port upstream of the aggregation router will not work as you would miss any traffic going from USER A - USER B, if they where on the

Re: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Daniel Senie wrote: Just had this conversation with one of my clients, and it's a good question. Seems like the telco providing the ATM (or other) access cloud might be the responsible party. The ISP reselling that DSL is too far upstream anyway to capture traffic between

Re: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Joe Provo wrote: Highly likely for most old requests. Your voice folks can tell you the #1 CALEA request is neither kiddie pron nor terrrists, but rather DEA. Remember, CALEA compliance is separate from any intercept orders you receive. If you ask your voice folks,

RE: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Stasiniewicz, Adam wrote: Anyway, here is what I have learned from my experience with our friends in law enforcement (be it local, state, or federal). First and foremost, they like us are only humans trying to make a living. They are not out to get us The troublemakers

Warning about UltraDNS terms

2007-05-02 Thread Sean Donelan
Although UltraDNS/Neustar gives month-to-month pricing, they actually have a 1 year term even if you cancel. So you may want to be aware of it in case you are just testing their service for a few months.

Re: IP Block 99/8 (DHS insanity - offtopic)

2007-04-24 Thread Sean Donelan
On Mon, 23 Apr 2007, Chris L. Morrow wrote: I think the strawman proposals so far were something like: 1) iana has 'root' ca-cert 2) iana signs down certs for RIR's 3) RIR's sign down certs for LIR's 4) LIR's sign down certs for 'users' (where 'users' is probably address-space users, like

RE: IP Block 99/8

2007-04-21 Thread Sean Donelan
On Fri, 20 Apr 2007, Marcus H. Sachs wrote: If we had clean registries and signed/verifiable advertisements this would not be an issue. Most of you know that DHS was pushing the Secure Protocols for the Routing Infrastructure initiative (http://www.cyber.st.dhs.gov/spri.html). Due to budget

Paging Doug Humphrey (formerly Coloco)

2007-03-28 Thread sean donelan
Sorry about the general mail. Network operators sometimes disappear into the ether. If anyone knows how to contact Coloco or Doug Humphrey I'd appreciate finding out how to get my server back from Laurel Maryland.

Re: [funsec] Not so fast, broadband providers tell big users (fwd)

2007-03-13 Thread Sean Donelan
On Tue, 13 Mar 2007, Todd Vierling wrote: Critical mass is approaching. There's only so long that North American consumers can be held back from bandwidth-hogging applications and downloads while parts of the world have long since upgraded to 10Mbit/s bidirectional (and beyond) consumer-grade

Ethernet won (was: RE: [funsec] Not so fast, broadband...)

2007-03-13 Thread Sean Donelan
On Tue, 13 Mar 2007, [EMAIL PROTECTED] wrote: Sure, as long as you're willing to fork over the cash for CPE capable of handling OC-XX linecards. The service cost is hardly the only cost associated with buying that kind of bandwidth. It's amusing to me that we're worrying about FTTH when some

Re: Where are static bogon filters appropriate? was: 96.2.0.0/16 Bogons

2007-03-09 Thread Sean Donelan
On Tue, 6 Mar 2007, Mikael Abrahamsson wrote: Customer gets hacked, one of their boxen starts spewing traffic with spoofed addresses. The way I understand your solution is to automatically shut their port and disrupt all their traffic, and have them call customer support to get any further.

Re: Where are static bogon filters appropriate? was: 96.2.0.0/16 Bogons

2007-03-06 Thread Sean Donelan
On Tue, 6 Mar 2007, Mikael Abrahamsson wrote: Also, all the examples you give implies a BGP transit customer. I am imagining all kinds of customers, from colo customers where I am their default gateway, to residential customers where it's the same way. I tried to give examples upstream of a

Re: Where are static bogon filters appropriate? was: 96.2.0.0/16 Bogons

2007-03-04 Thread Sean Donelan
On Sun, 4 Mar 2007, Mikael Abrahamsson wrote: Instead of dropping packets with unallocated sources addresses, perhaps backbones should shutdown interfaces they receive packets from unallocated address space. Would this be more effective at both stopping the sources of unallocated addresses;

Re: Where are static bogon filters appropriate? was: 96.2.0.0/16 Bogons

2007-03-03 Thread Sean Donelan
On Fri, 2 Mar 2007, Daniel Senie wrote: How do you know, if you're the one being attacked and you have no idea if the originating network or their immediate upstream implemented BCP38? Shall we just discard ingress filtering? If few attacks are using it today, should we declare it no longer

Re: Where are static bogon filters appropriate? was: 96.2.0.0/16 Bogons

2007-03-02 Thread Sean Donelan
On Fri, 2 Mar 2007, Roland Dobbins wrote: Sometimes, network operators have to take the bull by the horns and develop their own systems to do a job that vendors simply don't understand. Concur - but it seems that many seem to be looking for someone else to do this for them (or, perhaps, the

Re: Where are static bogon filters appropriate? was: 96.2.0.0/16 Bogons

2007-03-01 Thread Sean Donelan
On Thu, 1 Mar 2007, Chris L. Morrow wrote: So... again, are bogon filters 'in the core' useful? (call 'core' some network not yours) The cisco auto-secure feature sure showed some fun effects for this too, eh? We managed to fix that mis-application in later releases, but it has human

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-27 Thread Sean Donelan
On Mon, 26 Feb 2007, Eric Gauthier wrote: Generally, we've found that most end users don't even know that their systems are infected - be it with spyware, bots, etc - and are happy when we can help them clear things up as they usually aren't in a position to fix things on their own. I know

Re: Counting tells you if you are making progress

2007-02-23 Thread Sean Donelan
On Wed, 21 Feb 2007, Todd Vierling wrote: I'd say it's severely biased in the overestimation direction -- but that's not to say it isn't a problem, because zombies Suck. People with access to the ppp, dhcp or nat logs for a network can de-dup the counts based on IP addresses to come up with

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-20 Thread Sean Donelan
On Mon, 19 Feb 2007, Rich Kulawiec wrote: Pop quiz, bonus round: how much does it cost Comcast to defend its mail servers from Verizon's spam, and vice versa? Heck, how much does it cost Comcast to defend its mail servers from its own spam? How much do they spend on abuse/customer security?

Counting tells you if you are making progress

2007-02-20 Thread Sean Donelan
If you can't measure a problem, its difficult to tell if you are making things better or worse. On Tue, 20 Feb 2007, Rich Kulawiec wrote: I don't understand why you don't believe those numbers. The estimates that people are making are based on externally-observed known-hostile behavior by

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-17 Thread Sean Donelan
On Sat, 17 Feb 2007, Petri Helenius wrote: After all these years, I'm still surprised a consortium of ISP's haven't figured out a way to do something a-la Packet Fence for their clients where - whenever an infected machine is detected after logging in, that machine is thrown into say a VLAN

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-17 Thread Sean Donelan
On Sat, 17 Feb 2007, Gadi Evron wrote: Public ISPs have been testing these types of systems for over 5 years. What sorts of differences can you think of that would explain why public ISPs have found them not very effective? Public ISPs have been using walled gardens for a long time for user

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-17 Thread Sean Donelan
On Sat, 17 Feb 2007, Gadi Evron wrote: Yes, but that is because the successful ISPs currently often implement their own if they have the resources and RD power. The really big ones have it automated, the small ones have it limited to be activated by an abuse desk person. And I also know many

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-17 Thread Sean Donelan
On Sat, 17 Feb 2007, Gadi Evron wrote: Is there a significant difference between the many ISPs implementing walled gardens and other ISPs as far as infection rates? Yes. Then please share, many people would love to have that data.

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-17 Thread Sean Donelan
On Sat, 17 Feb 2007, Gadi Evron wrote: On Sat, 17 Feb 2007, Sean Donelan wrote: On Sat, 17 Feb 2007, Gadi Evron wrote: Is there a significant difference between the many ISPs implementing walled gardens and other ISPs as far as infection rates? Yes. Then please share, many people would

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-16 Thread Sean Donelan
On Fri, 16 Feb 2007, [EMAIL PROTECTED] wrote: And most ISPs don't provide in-house tech support and an orientation lecture when you sign up - though some *do* provide the free A/V these days. :) Working a day on the help desk at the *other* ISPs, which ever ISP you want to point fingers at,

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-16 Thread Sean Donelan
On Fri, 16 Feb 2007, [EMAIL PROTECTED] wrote: I hear enough from people who *do* work at Some Other Place. :) Hearing about it is not the same as experiencing it first-hand. Never claimed *our* solution would work everywhere (heck, I even admit it isn't 100% effective for *us*). A very

Re: botnets: web servers, end-systems and Vint Cerf

2007-02-16 Thread Sean Donelan
On Fri, 16 Feb 2007, Eric Gauthier wrote: I run the network for a University with about 12,000 students and 12,000 computers in our dormitories. We, like many other Universities, have spent the last five or six years putting systems in place that are both reactive and preventative. From my

RE: botnets: web servers, end-systems and Vint Cerf

2007-02-16 Thread Sean Donelan
On Fri, 16 Feb 2007, Nicholas J. Shank wrote: How is the acceptable infection rate for universities different than the infection rate of other types of networks? Because other types of networks are expected (expected being the keyword) to have competent administrators. Expected by whom?

Re: RBL for bots?

2007-02-15 Thread Sean Donelan
On Thu, 15 Feb 2007, Drew Weaver wrote: Has anyone created an RBL, much like (possibly) the BOGON list which includes the IP addresses of hosts which seem to be infected and are attempting to brute-force SSH/HTTP, etc? Bots are rarely single purpose engines. If they have been detected

RE: Every incident is an opportunity (was Re: Hackers hit key Internet traffic computers)

2007-02-11 Thread Sean Donelan
On Sat, 10 Feb 2007, Stasiniewicz, Adam wrote: Sean makes a good point, but there is one small problem with his suggestions. He is preaching to the choir. Just trying to get the choir to sing on key. Of course, I know the choir will probably spin off singing 18 different songs. Local

Re: Every incident is an opportunity (was Re: Hackers hit key Internet traffic computers)

2007-02-11 Thread Sean Donelan
On Sun, 11 Feb 2007, Gadi Evron wrote: Colin Powell mentioned at RSA in his extremely good, entertaining and pointless talk something of relevance. During the cold war American kids were trained to hide beneath their desktops in caseof a nuclear attack. Much good that would have done. The

Every incident is an opportunity (was Re: Hackers hit key Internet traffic computers)

2007-02-10 Thread Sean Donelan
On Tue, 6 Feb 2007, Roy wrote: Its amazing how reporters has to butcher technology information to make it understood by their editors http://www.cnn.com/2007/TECH/internet/02/06/internet.attacks.ap/index.html?eref=rss_topstories Do we keep missing opportunities? Yes, it was a minor

SRI-NIC.ARPA 26.0.0.73

2007-02-01 Thread Sean Donelan
Do old packets ever go away on the Internet? How many DNS packets still wander towards SRI-NIC.ARPA's old root server at 26.0.0.73? At some point, regardless of what the lawyers say, you've got to make your own decision and move on. Things change on the Internet, if you don't maintain your

Internet alert plan to warn on failures / Cable repairs delayed

2007-01-29 Thread Sean Donelan
Repair Status Au said today that the five cable systems that have been partially repaired are: Flag North Asia Loop, owned by India's Reliance Communications Ltd.; Reach North Asian Loop, owned by Hong Kong's PCCW Ltd. and Australia's Telstra Corp.; Se-Me-We3, owned by a group including

Re: Colocation in the US.

2007-01-25 Thread Sean Donelan
On Thu, 25 Jan 2007, Bill Woodcock wrote: Obviously convection is the best way, and I've gotten away with it a few times myself, but the usual answer to your why not question is Fire codes. Convection drives the intensity and spread of fires. Which is what furnace chimneys are for. Thus all

Re: Google wants to be your Internet

2007-01-23 Thread Sean Donelan
On Mon, 22 Jan 2007, Daniel Golding wrote: One interesting point - they plan to use Broadband over Power Line (BPL) technology to do this. Meter monitoring is the killer app for BPL, which can then also be used for home broadband, Meter reading is one of the top costs and trickiest problems

Re: Google wants to be your Internet

2007-01-23 Thread Sean Donelan
On Tue, 23 Jan 2007, Chris L. Morrow wrote: globally unique addresses I have an electic company, it's got 2500 partners, all with the same 'internal ip addressing plan' (192.168.1.0/24) we need to communicate, is NAT on both sides really efficient? What do you do when the electric companies

RE: Undersea fiber cut after Taiwan earthquake - PCCW / Singtel / KT e tc connectivity disrupted

2007-01-21 Thread Sean Donelan
On Sun, 21 Jan 2007, Rod Beck wrote: Unfortunately it is news to the decision makers, the buyers of network capacity at many of the major IP backbones. Indeed, the Atlantic route has problems quite similar to the Pacific. If this is news to them, perhaps its time to get new decision makers

RE: Undersea fiber cut after Taiwan earthquake - PCCW / Singtel / KT e tc connectivity disrupted

2007-01-21 Thread Sean Donelan
On Sun, 21 Jan 2007, Rod Beck wrote: Well, gentlemen, you have to ask for the fiber maps and have them placed in the contract as an exhibit. Most of the large commercial banks are doing it. It's doable, but it does require effort. Uhm, did you bother to read the NDAI report? The Federal

RE: Undersea fiber cut after Taiwan earthquake - PCCW / Singtel / KT e tc connectivity disrupted

2007-01-21 Thread Sean Donelan
On Sun, 21 Jan 2007, Fergie wrote: This really has more to do with analogies regarding organizations such as DeBeers, and less with Murphy's Law. :-) No, its not a scarcity argument. You have the same problem regardless of the number of carriers or fibers or routes. There wasn't a lack of

RE: Pac Rim Cable Damage Defies Repair [was: AFP article on Taiwan cable repair effort]

2007-01-17 Thread Sean Donelan
On Wed, 17 Jan 2007, Frank Bulk wrote: This article paints a rather dismal picture: Despite optimistic estimates that it would take only three weeks to repair the massive damage done to what are now said to be eight submarine cables by the Dec. 26, 2006, magnitude-6.7 earthquake near Taiwan,

Re: Comment spammers chewing blogger bandwidth like crazy

2007-01-14 Thread Sean Donelan
On Sun, 14 Jan 2007, Tony Finch wrote: I would expect the lists of compromised hosts to be fairly effective - open proxies of various kinds and perhaps botnet hosts. As for SMTP the blacklists would only be a starting point that either provide a cheap preliminary check or feed a more

Re: Network end users to pull down 2 gigabytes a day, continuously?

2007-01-13 Thread Sean Donelan
On Fri, 12 Jan 2007, Stephen Sprunk wrote: There is no technical challenge here; what the pirates are already doing works pretty well, and with a little UI work it'd even be ready for the mass market. The challenges are figuring out how to pay for the pipes needed to deliver all these bits

Demand for 10G connections

2007-01-10 Thread Sean Donelan
On Wed, 10 Jan 2007, William B. Norton wrote: Why are folks turning away 10G orders? In Hollywood, San Francisco and a few other cities with large concentration of movie/entertainment industries 10G network connections have been sold for at least a year, not necessarily connected to the

Re: Network end users to pull down 2 gigabytes a day, continuously?

2007-01-09 Thread Sean Donelan
On Tue, 9 Jan 2007, Gian Constantine wrote: Those numbers are reasonably accurate for some networks at certain times. There is often a back and forth between BitTorrent and NNTP traffic. Many ISPs regulate BitTorrent traffic for this very reason. Massive increases in this type of traffic

Re: Network end users to pull down 2 gigabytes a day, continuously?

2007-01-09 Thread Sean Donelan
On Tue, 9 Jan 2007, [EMAIL PROTECTED] wrote: Multicast streaming may be a big win when you're only streaming the top 5 or 10 networks (for some value of 5 or 10). What's the performance characteristics if you have 300K customers, and at any given time, 10% are watching something from the long

Re: Network end users to pull down 2 gigabytes a day, continuously?

2007-01-07 Thread Sean Donelan
On Sun, 7 Jan 2007, Joe Abley wrote: Setting aside the issue of what particular ISPs today have to pay, the real cost of sending data, best-effort over an existing network which has spare capacity and which is already supported and managed is surely zero. As long as the additional traffic

<    1   2   3   4   5   6   7   8   9   10   >