Re: One-element vs two-element design

2004-01-18 Thread Petri Helenius
Eric Kuhnke wrote: Last year, a Boeing in flight over the middle of the pacific ocean had its entire glass cockpit system go dark. After frantic conversation with the air traffic controllers a decision was made to toggle the circuit breakers for the TRIPLE-REDUNDANT computer system onboard,

Re: What's the best way to wiretap a network?

2004-01-18 Thread Chris Brenton
On Sat, 2004-01-17 at 21:08, Sean Donelan wrote: > > Assuming lawful purposes, what is the best way to tap a network > undetectable The best way to go undetectable is easy, run the sniffer without an IP address. The best way to tap a network varies with your setup. If your repeated, just plug in

Re: New IPv4 Allocation to ARIN

2004-01-18 Thread Petri Helenius
[EMAIL PROTECTED] wrote: It's those dang Nachi-sized ICMP echo/echo-replies. We block those at all our transit points and dial-up ports. Nachi was killing our cisco access-servers until we did this to stop the spread. Unfortunately, this breaks Windows tracert as it uses 92-byte echo request

Re: New IPv4 Allocation to ARIN

2004-01-18 Thread Pete Templin
Petri Helenius wrote: [EMAIL PROTECTED] wrote: It's those dang Nachi-sized ICMP echo/echo-replies. We block those at all our transit points and dial-up ports. Nachi was killing our cisco access-servers until we did this to stop the spread. I know what they are and how to get around them. I

Re: New IPv4 Allocation to ARIN

2004-01-18 Thread Petri Helenius
Pete Templin wrote: He has a reason: that virus was melting down his network (and was melting down lots of networks). I point to the word "backbone". If your dial servers melt, block the packets at dial servers, donĀ“t launch weapon of mass packet destruction to all traffic. Filtering should be

Re: New IPv4 Allocation to ARIN

2004-01-18 Thread jlewis
On Sun, 18 Jan 2004, Petri Helenius wrote: > >It's those dang Nachi-sized ICMP echo/echo-replies. We block those at all > >our transit points and dial-up ports. Nachi was killing our cisco ^^^ > >access-servers until we did thi

Re: What's the best way to wiretap a network?

2004-01-18 Thread Paul Vixie
> > Assuming lawful purposes, what is the best way to tap a network > > undetectable > > ... > The best solution I've found is to use an Ethernet tap. It allows you to > piggy back off of an existing connection and monitor all the traffic > going to and from that system. Its pretty undetectable,

Re: What's the best way to wiretap a network?

2004-01-18 Thread Steven M. Bellovin
In message <[EMAIL PROTECTED]>, Paul Vixie writes: > >i'm fairly sure that this is what law enforcement uses for wiretap warrants. I believe you're correct. In fact, I first learned of these devices from government documents during the Carnivore discussions a few years ago. -

OT: tos bits - current usage

2004-01-18 Thread Simon Waters
Can anyone point me to any resources describing the current usage of the tos precedence bits. Specifically what happens in practice, not what is suppose to happen (I can find the RFC's and IETF documents okay). Prompted by noting that a lot of spambots set the lowest precedence bit (tos 0x20 in

Re: Nanog30 socialising

2004-01-18 Thread Bill Woodcock
If your too-many-frequent-flyer-miles aren't on United, you may not have noticed the following: http://www.hemispheresmagazine.com/three/2003/south-beach.htm This month's "Three Perfect Days" column in the United in-flight magazine features South Beach. And they have a previous one on Miami ge

Re: What's the best way to wiretap a network?

2004-01-18 Thread Bohdan Tashchuk
> You can plug a mini-hub in line and use that as a tap point to monitor > the stream. Up side is its cheap and easy. Down side is you have to > drop to half duplex. Not a problem in most situations but in some the > drop in performance can be an issue. Don't throw out your old hubs. It's hard to f

Re: What's the best way to wiretap a network?

2004-01-18 Thread Sean Donelan
On Sun, 18 Jan 2004, Steven M. Bellovin wrote: > In message <[EMAIL PROTECTED]>, Paul Vixie writes: > >i'm fairly sure that this is what law enforcement uses for wiretap warrants. > > I believe you're correct. In fact, I first learned of these devices > from government documents during the Carniv

Re: SMTP problems from *.ipt.aol.com

2004-01-18 Thread E.B. Dreger
SR> Date: Sat, 17 Jan 2004 08:24:06 +0530 SR> From: Suresh Ramasubramanian SR> AOL has, since the past several months (over a year I think) SR> set up their dynamic IP pool *.ipt.aol.com to hijack port 25 I recall seeing this in November 2002, and believe it had already been in place for a few

Re: sniffer/promisc detector

2004-01-18 Thread E.B. Dreger
DJ> Date: Sat, 17 Jan 2004 14:57:19 -0500 DJ> From: Deepak Jain DJ> I know most people don't take the time to hard code their DJ> MACs onto their switch ports, but it really only takes a few DJ> seconds per switch with a little cutting & pasting -- as DJ> customer switches a network port, they j