Re: And Now.... Data Retention. Enjoy!

2006-05-26 Thread Alain Hebert
Duh, Those crazy americans... - (on the premise of: "network data for two years") Some republicans have stocks in SAN/NAS/DVD/Hard Drive/etc markets and need a boost? Around here we're talking about only 70,000 DVD. I see a way to mirror each pipe into a device capable

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Gadi Evron
On Fri, 26 May 2006, Rick Wesson wrote: > > > I am saying I am reading the OARC comments and this is sort of what > > it fees like. As much as Gadi seems to appropriate others credit, > > Randy Vaugh and him have been doing this work for some time and > > deserves some credit so I'd say "have you

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Gadi Evron
On Fri, 26 May 2006, Peter Dambier wrote: > > Sean Donelan wrote: > > On Fri, 26 May 2006, John Kristoff wrote: > > > >>What I'd be curious to know in the numbers being thrown around if there > >>has been any accounting of transient address usage. Since I'm spending > > > > > > I worked with

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Gadi Evron
[top-posting] Time differentials, time-limiting, proxies and NATs, dynamic addresses, different malware, different OS, etc. are all things taken into acount. At some point you just need to have a best guess.. When the situation was by far less horrible, the numbers still didn't matter. Wasn't i

And Now.... Data Retention. Enjoy!

2006-05-26 Thread Fergie
Just a heads-up. CALEA compliance ain't your only concern anymore. [snip] U.S. Attorney General Alberto Gonzales and FBI Director Robert Mueller on Friday urged telecommunications officials to record their customers' Internet activities, CNET News.com has learned. In a private meeting with i

Weekly Routing Table Report

2006-05-26 Thread Routing Analysis Role Account
This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to [EMAIL PROTECTED] If you have any comments please contact Philip Smith <[EMAIL PROTECTED]>. Routing Table Report 04:00 +10GMT Sat 27 May, 2006

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Rick Wesson
I am saying I am reading the OARC comments and this is sort of what it fees like. As much as Gadi seems to appropriate others credit, Randy Vaugh and him have been doing this work for some time and deserves some credit so I'd say "have you spoken to them about how to make their report better" ye

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Martin Hannigan
At 07:09 PM 5/26/2006, Rick Wesson wrote: for this community would trend analysis with the best of who is getting better and the worst of who is getting worse and some baseline counts be enough for this group to understand if the problem is getting better. I am suggesting that NANOG is an a

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Rick Wesson
for this community would trend analysis with the best of who is getting better and the worst of who is getting worse and some baseline counts be enough for this group to understand if the problem is getting better. I am suggesting that NANOG is an appropriate forum to publish general stats o

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Fergie
Not effective against botnets. Think of it this way, thousands of compromised hosts (zombies), distributed to the four corners of the Internet, hundreds (if not thousands) of AS's -- all recieving their instructions via IRC from a C&C server somewhere, that probably also may change due to dynamic

NANOG 37 agenda posted

2006-05-26 Thread Steve Feldman
The complete agenda for the upcoming NANOG 37 meeting, June 4-7 in San Jose, has been posted at: http://www.nanog.org/mtg-0606/agenda.html If you haven't already, please register at http://www.nanog.org, and we'll see you in San Jose! Steve Feldman Program Chair

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Peter Dambier
Sean Donelan wrote: On Fri, 26 May 2006, John Kristoff wrote: What I'd be curious to know in the numbers being thrown around if there has been any accounting of transient address usage. Since I'm spending I worked with Adlex to update their software to identify and track dynamic addresses

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Sean Donelan
On Fri, 26 May 2006, John Kristoff wrote: > What I'd be curious to know in the numbers being thrown around if there > has been any accounting of transient address usage. Since I'm spending I worked with Adlex to update their software to identify and track dynamic addresses associated with subscr

Re: Fwd: 41/8 announcement

2006-05-26 Thread Stephen Sprunk
Thus spake "william(at)elan.net" <[EMAIL PROTECTED]> On Fri, 26 May 2006, Bill Woodcock wrote: Presumably they're double-natting. I had to do that once for Y2K compliance for three large governmental networks that were all statically addressed in net-10 and wouldn't/couldn't renumber in time.

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Peter Dambier
John Kristoff wrote: On Fri, 26 May 2006 11:50:21 -0700 Rick Wesson <[EMAIL PROTECTED]> wrote: The longer answer is that we haven't found a reliable way to identify dynamic blocks. Should anyone point me to an authoritative source I'd be happy to do the analysis and provide some graphs on how

Re: Are botnets relevant to NANOG?

2006-05-26 Thread John Kristoff
On Fri, 26 May 2006 11:50:21 -0700 Rick Wesson <[EMAIL PROTECTED]> wrote: > The longer answer is that we haven't found a reliable way to identify > dynamic blocks. Should anyone point me to an authoritative source I'd > be happy to do the analysis and provide some graphs on how dynamic > addres

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Rick Wesson
John, The short answer is no. The longer answer is that we haven't found a reliable way to identify dynamic blocks. Should anyone point me to an authoritative source I'd be happy to do the analysis and provide some graphs on how dynamic addresses effect the numbers. also note that we are u

Re: Black Frog - the botnets keep coming

2006-05-26 Thread Florian Weimer
* Gadi Evron: > Ignoring is the high-road. How long are we going to cry about the > Internet being a battle-ground, the wild west, or whatever else if > we legitimize DDoS? The project needs to gather supporters before they can do any real damage. Reports exposing their nefarious practices are

Re: Are botnets relevant to NANOG?

2006-05-26 Thread John Kristoff
On Fri, 26 May 2006 10:21:10 -0700 Rick Wesson <[EMAIL PROTECTED]> wrote: > lets see, should we be concerned? here are a few interesting tables, > the cnt column is new IP addresses we have seen in the last 5 days. Hi Rick, What I'd be curious to know in the numbers being thrown around if there

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Fergie
I think the numbers speak for themselves. - ferg -- Rick Wesson <[EMAIL PROTECTED]> wrote: > Some people need whatever bandwidth they can get for ranting. > Of course routing reports, virus reports and botnet bgp statistics > take away a lot of valuable bandwidth that could otherwise be use

Re: Fwd: 41/8 announcement

2006-05-26 Thread Joseph S D Yao
On Fri, May 26, 2006 at 07:44:04AM -0700, william(at)elan.net wrote: > > > On Fri, 26 May 2006, Bill Woodcock wrote: > > > On Fri, 26 May 2006, Mikisa Richard wrote: > > > Can't be sure what they did, but I received an e-mail asking me to > > check > > > on my connectivity to them an

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Rick Wesson
Some people need whatever bandwidth they can get for ranting. Of course routing reports, virus reports and botnet bgp statistics take away a lot of valuable bandwidth that could otherwise be used for nagging. On the other hand without Gadi's howling for the wolves those wolves might be lost spe

Re: Fwd: 41/8 announcement

2006-05-26 Thread Bill Woodcock
On Fri, 26 May 2006, william(at)elan.net wrote: > The only way I see to achieve this is to have dns resolver > on the fly convert remote addresses from same network into some other > network and then NAT from those other addresses. Split-horizon DNS, external to the clients, but

Re: Fwd: 41/8 announcement

2006-05-26 Thread william(at)elan.net
On Fri, 26 May 2006, Bill Woodcock wrote: On Fri, 26 May 2006, Mikisa Richard wrote: > Can't be sure what they did, but I received an e-mail asking me to check > on my connectivity to them and well, it worked. Presumably they're double-natting. I had to do that once for Y2K compli

Re: Are botnets relevant to NANOG?

2006-05-26 Thread Peter Dambier
[EMAIL PROTECTED] wrote: In recent discussions about botnets, some people maintained that botnets (and viruses and worms) are really not a relevant topic for NANOG discussion and are not something that we should be worried about. I think that the CSI and FBI would disagree with that. Some p

Re: Fwd: 41/8 announcement

2006-05-26 Thread Bill Woodcock
On Fri, 26 May 2006, Mikisa Richard wrote: > Can't be sure what they did, but I received an e-mail asking me to check > on my connectivity to them and well, it worked. Presumably they're double-natting. I had to do that once for Y2K compliance for three large governmental networks

Re: AS12874 - FASTWEB

2006-05-26 Thread Michael . Dillon
> >> http://plany.fasthosting.it/dbmap.asp?table=Mappatura > > I take it that this means we can use any ip range allocated to Fastweb > > as if it were RFC1918 space, including the necessary border filters? > I'd personally contract to build a moat around their NOC for Homeland > Security reaso

Are botnets relevant to NANOG?

2006-05-26 Thread Michael . Dillon
In recent discussions about botnets, some people maintained that botnets (and viruses and worms) are really not a relevant topic for NANOG discussion and are not something that we should be worried about. I think that the CSI and FBI would disagree with that. In a press release announcing the la

Re: AS12874 - FASTWEB

2006-05-26 Thread Andrew D Kirch
Bjørn Mork wrote: [EMAIL PROTECTED] (Marco d'Itri) writes: On May 24, Suresh Ramasubramanian <[EMAIL PROTECTED]> wrote: Fastweb seems to think 41/8 is a dsl pool for its users in Turin Indeed. But that list is a bit old, they are also using 59/8 (in use in the APNIC region) an

The Cidr Report

2006-05-26 Thread cidr-report
This report has been generated at Fri May 26 21:54:13 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table Hist

BGP Update Report

2006-05-26 Thread cidr-report
BGP Update Report Interval: 16-May-06 -to- 16-May-06 (0 days) Observation Point: BGP Peering with AS4637 TOP 20 Unstable Origin AS Rank ASNUpds % Upds/PfxAS-Name 1 - AS855 25437 2.4% 44.7 -- CANET-ASN-4 - Aliant Telecom 2 - AS17430 21625 2.1

Re: AS12874 - FASTWEB

2006-05-26 Thread Bjørn Mork
[EMAIL PROTECTED] (Marco d'Itri) writes: > On May 24, Suresh Ramasubramanian <[EMAIL PROTECTED]> wrote: > >> Fastweb seems to think 41/8 is a dsl pool for its users in Turin > Indeed. But that list is a bit old, they are also using 59/8 (in use > in the APNIC region) and a few private DoD networks

Re: Black Frog - the botnets keep coming

2006-05-26 Thread leo vegoda
Gadi Evron wrote: [...] Regular type "fake site" phishing is going to be with us for a long time yet but several of the organized crime groups involved are hard at work at released Trojan horses using root kit technology daily, which basically steals your credentials to every HTTPS site you en

Re: Black Frog - the botnets keep coming

2006-05-26 Thread Gadi Evron
On Thu, 25 May 2006, Sean Donelan wrote: > > On Thu, 25 May 2006, Gadi Evron wrote: > > I hate for this to be a quote by me, but Super Worms which steal credit > > card, account data, login info. etc. for banks, credit card companies and > > ecommerce sites online number at the millions a day. In

Re: Fwd: 41/8 announcement

2006-05-26 Thread steve
well they're not really hijacking it - as in they are not announcing it or affecting unrelated networks on the internet its no different than a private firewall/security policy, except we know they're doing it because they're broken not because they intend to be denying connectivity to those n