- ripe-list - mailman.ripe.net

RIPE22: accomodation
by RIPE NCC Staff 06 Sep '95

06 Sep '95

********************************************************************* 22nd RIPE meeting Amsterdam, October 1995 Details of Hotels in Amsterdam <> All phone numbers below require the prefix 31 20 <quoted number>. <> All tram connections are from central station. <> Data are subject to change, please check first Low Budget Hotels (price range 80-120 Hfl) ----------------------------------------- Name Address Phone Fax Tram International Centrum Linnaeusstraat 2 6925111 9 Barbacan Plantage Muidergracht 89 6236241 6272041 9 Parklane Plantage Parklaan 16 6224804 9 Parkzicht Roemer Visscherstraat 33 6180897 5 Roemer Visscher Roemer Visscherstraat 10 6125511 5 Fita Jan Luyckenstraat 37 6790976 5 Mid range (price range 170-280 Hfl) ---------------------------------- Name Price Address Phone Fax Tram sgl/dbl Museum *** 170/244 PC Hooftstraat 2 6621402 6733918 5 Trianon *** 170/244 JW Brouwerstraat 3-7 6732073 6738868 16 Terdam *** 170/244 Tesselschadestraat 23 6126876 6838313 5 Holland *** 170/244 PC Hooftstraat 162 6764253 6765956 5 Beethoven **** 190/280 Beethovenstraat 43 6644816 6621240 24 Lairesse **** 240/280 De Lairessestraat 5-7 6719596 6711756 16 Karena Hotels Group (all centrally located) ------------------- Doelen ) Caransa ) -- Central Reservation number 626 2922 626 6831 Rembrandt ) Schiller ) If RIPE people want to benefit from the cheap rate of NLG 170 at any of those four hotels, then they have to ask the TERENA Secretariat to make the reservation for them. The TERENA secretariat is reachable at : E-mail: secretariat(a)terena.nl tel: +31206391131 If all the hotels are full or you are experiencing difficulty, try the following: Business Hotel Services - tel +31 20 691 6969 / fax +31 20 691 6209 This service is free of charge: you just tell them what kind of accommodation you need, where and the rate you want to pay, and they find it for you.

1 0

RIPE22 meeting announcement
by RIPE NCC Staff 06 Sep '95

06 Sep '95

[ Apologies for multiply received messages ] R I P E meeting announcement ============================ (This announcement can also be viewed using "finger meeting(a)ncc.ripe.net") This is to announce that the 22nd RIPE meeting will take place: Dates: 11th October, 1995 begin: 14:00* 12th October, 1995 13th October, 1995 end: 16:00* * these times may change. Also, it is likely that there will be an EOF meeting at 11th October, 09:00. Venue: CWI Kruislaan 413 1098 SJ Amsterdam The Netherlands Host: NIKHEF Registration: Please use the registration form (which will follow in a separate mail) to give notice of your coming as soon as possible. General Information: -------------------- Currency: 1 UK pound = Hfl 2.5 1 ECU = Hfl 2.1 1 US$ = Hfl 1.6 Appended to this announcement: ------------------------------ <> directions to the meeting place Documents to follow (separate mail messages): --------------------------------------------- <> details of hotels in Amsterdam close to meeting venue <> registration form for attendance at the meeting ================================================================== CWI - The RIPE meeting venue: How do I get there? ------------------------------------------------------------------ To ease any possible confusion, two postscript maps can be found in the RIPE document store. One shows the bus and tram stops around the meeting site and the other is a more general map of the area. Both maps are available by ftp: ftp.ripe.net:ripe/Next-Meeting/area-map.ps ftp.ripe.net:ripe/Next-Meeting/area-map.ps.Z ftp.ripe.net:ripe/Next-Meeting/local-transport-map.ps ftp.ripe.net:ripe/Next-Meeting/local-transport-map.ps.Z a) Recommended public transport route from Amsterdam Schipol airport: <> Take the train from the airport railway station to the Central Railway station (Amsterdam CS). Then from Amsterdam Central Station : <> Take tram number 9 till the stop at the intersection of Middenweg and Kruislaan (15 min ride). The stop is just before the intersection. <> Walk down the Kruislaan in the direction of the railway bridge. Cross under the bridge and continue. Take the 2nd entrance left and follow the signs to the meeting (15 min walk all together). Instead of walking down Kruislaan you can take the shuttlebus for 2 stops. Turn into Kruislaan and the bustop is a little way down on the right hand side of the road. or from Central Station you can: <> Take bus 22 in the direction 'Indische Buurt' to the stop at the 'Muiderpoort Station' and take shuttlebus 66 which stops outside CWI. b) Alternatively from Amsterdam Schipol: <> Take the train from the airport railway station to the RAI station in Amsterdam. (These are the 'stop trains' to Lelystad, Utrecht or Amersfoort.) NOTE: Amsterdam Central Station (CS) is on another line. Then from the RAI station: <> From the RAI station take the city bus number 69 or CN bus number 169 in the direction `Amstel Station'. From the Amstel Railway Station <> From the Amstel station take the city bus number 15 the direction `Muiderpoort Station' to the stop on the corner of Kruislaan and Linnaeusparkweg (15 min ride, ask the driver where to get off) or proceed to 'Muiderpoort Station' and take shuttlebus 66. You can also take the shuttlebus 66 from the Kruislaan and Linnaeusparkweg intersection as described above. d) Taxi from the airport <> Takes 15 mins and will cost approximately Hfl. 60.00 e) Connections away <> Tram 6, 10 to Leidseplein (now with conductor on tram) Tram 9, 14 to Rembrandtplein and Dam Square (9 goes to Central Station) ==================================================================== Public Transport - how much does it cost and where can I get tickets? -------------------------------------------------------------------- Tickets of 15 strips (`Strippenkaart' costing Hfl. 10.75) can be bought in Post Offices, railway stations and cigarette shops. Tickets of 2 and 3 strips can be bought on the bus or the tram but they are much more expensive. You have to validate the ticket yourself in the metro stations and in the trams (except on lines 4, 6, 7, 10, 12 and 13). In the buses the driver will validate the ticket. Amsterdam is divided into zones: the old city is in zone `Centrum' whereas CWI is in zone `Oost'. You need to count how many zones you will be travelling through (from the centre - CWI is 2 zones) and count up that number of strips on your ticket + 1 extra. So in the above example you will need to stamp the 3rd strip. In case of overflow you stamp the last strip of the first ticket and start counting the remaining strips on the next ticket. Confused? Ask any member of the local organizing committee. Warning: BEWARE of pickpockets in crowded places. --------------------------

1 0

RIPE DNS hostcount for August 1995
by Mirjam Kuehne 05 Sep '95

05 Sep '95

Dear all, Here is the hostcount for August 1995. The table shows an increase since last month of almost 80,000 (or 4.7%) to a total of almost 1,800,000 hosts in the DNS in Europe. The UK shows the highest increase for August with more than 15,000 hosts more than in June. The hostcount can also be found under ftp.ripe.net/ripe/hostcount. Kind regards, Mirjam Kuehne RIPE NCC RIPE DNS Hostcount Previous Count : Mon Jul 31 1995 This Count : Thu Aug 31 1995 CY SOA COUNTED DUPL REAL CHANGE ============================================================ al 4 1 0 1 + 1 am 4 63 1 62 + 30 at 896 47348 1114 46234 + 1874 az 3 16 0 16 0 be 694 25413 679 24734 + 318 bg 37 667 39 628 - 50 by 1 5 0 5 0 ch 691 70093 627 69466 + 4486 cy 17 201 9 192 + 9 cz 294 16519 303 16216 + 1420 de 4106 457568 15391 442177 +12928 dk 668 40476 706 39770 + 3423 dz 2 16 0 16 0 ee 104 2807 33 2774 + 344 eg 6 225 0 225 0 es 831 42842 692 42150 + 599 fi 1013 120233 2582 117651 + 5123 fo 13 471 0 471 0 fr 1791 119058 2328 116730 + 4548 gb 1 30 0 30 + 2 ge 5 40 0 40 + 40 gr 309 7102 534 6568 + 847 hr 107 2674 481 2193 + 71 hu 161 12114 234 11880 + 1720 ie 89 10195 138 10057 + 516 il 393 14599 94 14505 - 328 is 124 7293 77 7216 + 321 it 1821 55258 2388 52870 + 2321 li 11 47 0 47 + 6 lt 29 288 3 285 + 15 lu 77 1620 21 1599 + 52 lv 36 1056 30 1026 + 86 ma 1 0 0 0 0 mk 11 108 32 76 + 74 mt 2 5 2 3 + 1 nl 1186 146592 2262 144330 + 7827 no 1346 74508 3408 71100 + 5673 pl 643 18255 1592 16663 + 953 pt 262 10026 909 9117 + 167 ro 88 1161 37 1124 + 157 ru 343 5573 487 5086 - 96 se 1717 119503 3402 116101 + 7014 si 129 3696 112 3584 + 135 sk 106 2583 105 2478 + 292 su 369 8905 392 8513 + 495 tn 3 71 2 69 + 1 tr 133 3708 85 3623 - 47 ua 132 2018 388 1630 + 176 uk 5843 395367 33018 362349 +15661 va 0 0 0 0 0 yu 3 0 0 0 0 ============================================================ 26655 1848417 74737 1773680 +79205

1 0

ripe-m-21.txt
by Roderik Muit 31 Aug '95

31 Aug '95

Abovementioned file now has no control characters inside anymore. Apologies, Roderik.

1 0

RIPE21: Draft Minutes available: ripe-m-21
by RIPE NCC 29 Aug '95

29 Aug '95

RIPE Minutes Announcement ------------------------- The RIPE21 minutes are now available from the RIPE document store : ripe-m-21 20th meeting 1995 May GARR/CNR - Roma FTP Access ---------- All RIPE minutes (and more) are available via anonymous FTP from host ftp.ripe.net. Type "ftp ftp.ripe.net". Login with username "anonymous" supplying your email address as the password. After logging in, type "cd ripe/minutes/" followed by the command "get filename". The relevant filenames for this document are: ripe-m-21.txt for the ASCII version ripe-m-21.ps for the PostScript version Electronic Mail Retrieval of Documents -------------------------------------- Documents can also be retrieved from the RIPE document store using a mail server program. For more information on how to use the program, send email to: mail-server(a)ripe.net with "send HELP" in the body text. RIPE NCC Interactive Information Server --------------------------------------- Type "telnet info.ripe.net". This is a menu driven service allows the document store to be browsed. After reading documents you are prompted as to whether you would like to receive an email copy of the document you have just read. If you would, you simply enter your email address and the document will be mailed to you. Below are details of alternative methods of access. Gopher Access ------------- The same documents are available via a "gopher" server at "gopher gopher.ripe.net". WWW Access ---------- For those who wish to add this home page at the RIPE NCC to their own customized home pages, it can be accessed as: http://www.ripe.net MIME Mail Reader ---------------- Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the RIPE document by FTP or mail server. SEND ripe/minutes/ripe-m-21.txt

1 0

IETF Report Abstract
by Jill.Foster＠newcastle.ac.uk 22 Aug '95

22 Aug '95

Apologies if you receive more than one copy of this. Jill IETF - Stockholm: July 17th - 21st, 1995 ======================================== Trip Report: Jill Foster - Newcastle University, UK UK Mailbase Director Netskills Director Abstract ======== The IETF (Internet Engineering Task Force) met for a week in Stockholm. The report deals mainly with the areas of User Support and Networked Information Retrieval, although reports of some of the plenary sessions are also included. The sessions covered are: Internet Schools Networking Working Group User Services Working Group HTML Working Group Uniform Resource Identifiers Working Group Registration of MIME content types (BOF) Networking Training Materials Working Group "Read the Label" BOF (on whether or not to provide film type ratings (PG etc) to networked information) This report is stored on the UK Mailbase Server. ftp://mailbase.ac.uk/pub/lists/wg-isus/files/ietf.07.95 It is also available via gopher and WWW from mailbase.ac.uk To retrieve a copy via email, send a message to: Mailbase(a)mailbase.ac.uk with the following command in the body of the message: send wg-isus ietf.07.95 -- Jill Foster

1 0

Re: EOF-7 meeting minutes
by Elise Gerich 14 Aug '95

14 Aug '95

>owner-ripe-list(a)ripe.net writes: > > ----Next_Part(Sat_Aug_12_00:17:40_1995)-- > Content-Type: Text/Plain; charset=iso-8859-1 > Content-Transfer-Encoding: quoted-printable > > Hi, > > I had promised to send out the final minutes to a wider audience > than to the EOF list only earlier, but it fell through the cracks > so some of this may be old news by now. But here it is, anyway. > Note that the new proposed version of the EOF charter is appended > at the end of the minutes. > > Regards, > > - H=E5vard > > [most of text deleted] > 18. AOB > > DFK asked about the "hall of fame" / "hall of shame" messages > sent out recently concerning use of CIDR, and asked how often > people would like to have them and for other suggestions for > improvements. It was agreed that the names of the ASes > injecting the prefixes should be named and that these should be > sent out monthly in connection with the host count statistics. > > DFK asked about how many actively maintained the contents of the > RIPE routing registry, the response was "not very many". There > is currently no script to compare the actual BGP routing tables > with the contents of the routing registry contents. > whoops - shouldn't type with a broken wrist :-( the ra team has an alpha version of a tool which obtains and analyzes routing information from production ciscos and makes the comparison with routes in the IRR. to get the alpha version: ftp:ftp.ra.net/routing.arbiter/radb/tools/cisco.01.tar.Z ^^^^ ^^ CiscoBGP comes with two scripts: cisco_fetch and cisco_check. please send comments to Craig Labovitz (ra-team(a)merit.edu) ^^^^^^^^^^^^^^^^^ --elise

1 0

browser VOL 1.0
by browser＠vol.it 26 Jul '95

26 Jul '95

To whom it may concern, collaborating with Teknema Inc., Video On Line has created "VOL 1.0". "VOL 1.0" is a free Internet browser available in 15 languages, among which the first PC World Wide Web/Internet browser in Arabic: no fee is due for the use and the distribution of this software, which can be used freely by anyone. This software allows connection with all access points of all Internet online services. Anyone can receive, try and distribute "VOL 1.0" simply by downloading from the following location: http://www.vol.it/VOLB/browser.html At the above mentioned location you will also find detailed technical data and information related to the VOL 1.0 Browser. For comments on the functioning of the browser and for requiring versions in different languages, send email to: browser(a)vol.it Best regards, Anna Mussetti Communication Department Video On Line V.le Regina Elena, 16 09125 Cagliari - Italy tel: +39 70 659625 fax: +39 70 655944 email: info(a)vol.it URL: http://www.vol.it/

1 0

RIPE NCC Staff Position: Junior Hostmaster (3 days/week)
by Daniel Karrenberg 24 Jul '95

24 Jul '95

Please distribute this announcement to all possibly interested parties. Thank you Daniel Karrenberg RIPE NCC Manager ------------------------------------------------------------------ RIPE: Coordinating the Internet in Europe. Due to the continuing explosive growth of the European Internet there is an immediate opening at the RIPE NCC for a J u n i o r H o s t m a s t e r for 3 days (24 hours) per week. Every host directly connected to the Internet needs an address. NCC hostmasters play a key role in the distribution of the Internet address space throughout Europe. Duties The general duties NCC hostmasters comprise: - to handle all address space related requests - to help maintain the databases the RIPE NCC keeps - to propose new activities, where needed - to report to the RIPE NCC Manager The specific duties of the junior hostmaster are: - to allocate address space to local Internet registries - to support local registries where needed - to assign address space - to review assignments made by other registries - to answer address space related queries - to refer non-routine requests to appropriate senior staff Almost all communications with customers and other organisations involved in Internet address space assignment is via the Internet itself. The position provides an excellent opportunity to work at the very heart of the European Internet industry. Qualifications Essential - willingness to learn quickly about the Internet environment - ability to perform administrative tasks reliably - good knowledge of written and spoken English - good communication skills - ability to learn and use Unix and X-windows based computer tools Desirable - work experience in an international environment - previous exposure to the Internet - basic experience with Unix and X-windows based computer tools The position is suitable both for those with administrative skills willing to learn about the Internet and to recent graduates with Internet experience willing to do administrative work. Female applicants and applicants from all European countries are explicitly encouraged. Depending on their ambitions and abilities junior hostmasters can be promoted to senior positions at the NCC. R I P E RIPE (Reseaux IP Europeens) is a collaborative organisation open to all European Internet service providers. The objective of RIPE is to ensure the necessary administrative and technical coordination to allow the operation of a pan- European IP network. RIPE does not operate a network of its own. RIPE has been functioning since 1989. Currently more than 80 organisations participate in the work. The result of the RIPE coordination effort is that the individual end-user is presented on his desk top with a uniform IP service irrespective of the particular network his or her workstation is attached to. In January 1995 1197911 hosts were registered on RIPE coordinated networks. The total number of systems reachable on the Internet worldwide is estimated at almost five million. R I P E N C C The RIPE Network Coordination Centre supports all those RIPE activities which cannot be effectively performed by volunteers from the participating organisations. Besides supporting RIPE activities in general the NCC provides the following services to network operators: o NETWORK MANAGEMENT DATABASE containing information about address space, routing, DNS domains and contact persons o DELEGATED INTERNET REGISTRY a clearing house distributing IP address space o RIPE INTERNET ROUTING REGISTRY o RIPE DOCUMENT STORE o RIPE INTERACTIVE INFORMATION SERVICE A detailed description of these activities can be found in the RIPE NCC Activity Plan (document ripe-110). This document can be obtained from the RIPE document store. The RIPE NCC is currently staffed as follows: one NCC manager two senior hostmasters (one more is being hired) one junior hostmaster (two more have already been hired) one NCC administrative staff In addition there is a conscienscious objector performing administrative duties. A deputy manager will also be hired this year. The NCC is funded by all Internet service providers in Europe who operate local Internet registries. NCC staff are formally employed by TERENA. TERENA TERENA is the European Association of research networking organisations and their users. TERENA has been created by a merger of the RARE and EARN associations. TERENA carries out technical activities and provides a platform for discussion and education to encourage the development of a high-quality computer networking infrastructure for the European research community. Conditions RIPE NCC personnel is employed by the TERENA association under their standard employment conditions. The salary will depend on qualifications and experience. Costs of relocation to the Netherlands will be met. The open position is part time for 24h/week on three working days. The distribution of the time over the week can be discussed. The appointment will be for one year with possible extension. Location The RIPE NCC is located at the Scientific Center Watergraafsmeer (WCW) in Amsterdam. The offices will be situated at NIKHEF, the Dutch National Institute for Nuclear Physics and High Energy Physics. Further Information For further information about the RIPE NCC, please see the RIPE document store at http://www.ripe.net/ ftp://ftp.ripe.net/ gopher://gopher.ripe.net/ telnet://info.ripe.net/ For further information about this position please contact: Daniel Karrenberg RIPE NCC Manager Kruislaan 409 NL-1098 SJ Amsterdam Netherlands Tel.: +31 20 592 5065 <Daniel.Karrenberg(a)ripe.net> How to Apply Applications, including a CV and references should be submitted in confidence to the address above and should be received no later than Sunday August 13th 1995.

1 0

Continued IP Spoofing Attacks (INFO#95.16723)
by CERT Coordination Center 21 Jul '95

21 Jul '95

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================== CONTINUED IP SPOOFING ATTACKS CERT Coordination Center July 21, 1995 ============================================================================== **** This note is the same ``heads-up'' that was originally sent on June 29, **** 1995. It is being resent because some recipients were unable to read **** it. Because of the importance of the subject matter, we are resending **** with a PGP signature but without a MIME header. Over the past few weeks, we have received reports of 170 IP spoofing attacks against Internet sites internationally. We are sending you this "heads-up" because you, a network service provider, are a likely target. At least 80 of the targets we know of are name servers, routers, and other network operation systems. The attacks have been largely successful, we continue to receive reports, and we are concerned that more attacks are going undetected. We urge you to check your systems and routers for any signs of compromise and to use the information in CERT advisory CA-95:01, "IP Spoofing Attacks and Hijacked Terminal Connections," to help protect yourself, detect IP spoofing attacks, and recover from root compromises. The advisory is available by anonymous FTP from ftp://info.cert.org/pub/cert_advisories This "heads-up" contains additional information about what you can do, as well as issues to consider before taking action. Please feel free to forward this to other providers of Internet services. What is IP Spoofing? - -------------------- To gain access, intruders create packets with spoofed source IP addresses. This exploits applications that use authentication based on IP addresses and leads to unauthorized user and possibly root access on the targeted system. Examples are the rsh and rlogin services. It is possible to route packets through filtering-router firewalls if they are not configured to filter incoming packets whose source address is in the local domain. It is important to note that the described attack is possible even if no reply packets can reach the attacker. Examples of configurations that are potentially vulnerable include: - - routers to external networks that support multiple internal interfaces - - routers with two interfaces that support subnetting on the internal network - - proxy firewalls where the proxy applications use the source IP address for authentication Communicating with us - ---------------------- Warning: For sensitive information, use encrypted email. You will find the CERT public PGP key at the end of this document. We would appreciate it if you would let us know whether you are watching for IP spoofed packets on your networks (or plan to do so). If you see spoofed packets, we'd like to learn how many you see and from how many different sites; this will help us determine the scope and pattern of the attacks. We will keep all detailed information and the identity of organizations confidential. Because of our workload, we must ask you not to send log files of activity, but we would be happy to work with you as needed on how to interpret data that you may collect. If you see activity that indicates an attack is in progress, we encourage you to contact your customer, or other involved sites or their service provider. We have some general information on IP spoofing and on recovering from a compromise that we can make available to you for your customers' use. We would also be happy to provide guidance and advice, if needed, on how to handle incidents and work with law enforcement. ............................................................................. Some things you can do - ---------------------- It is possible to check network traffic for indications of the type of attack we are currently seeing. Before doing so, please look at the next section, "Issues to consider before taking action." There are several classes of packets that you could watch for. The most basic is any TCP packet where the network portion (Class A, B, or C or a prefix and length as specified by CIDR, the Classless Inter-Domain Routing specification) of the source and destination addresses are the same but neither are from your local network. These packets would not normally go outside the source network unless there is a routing problem, worthy of additional investigation, or the packets actually originated outside your network. The latter may occur with Mobile IP testing, but an attacker spoofing the source address is a more likely cause. For a NAP or NSP, the interface into which a packet arrived indicates the direction of the source of the attack. The packet's destination address indicates the "trusted" host involved in an attack. That information suggests which hosts may be under attack. There are public domain and vendor provided tools available for checking your networks for IP spoofed packets. Among them are Argus, tcpdump, and snoop. Argus 1.5 - --------- Argus is an IP network transaction-auditing tool developed at the Software Engineering Institute of Carnegie Mellon University. The Argus 1.5 distribution includes scripts that perform simple network administrative tasks, one of which is IP spoofing detection. The data that Argus generates makes it possible to analyze network activity and performance in ways that have not been possible before. For example, you can answer questions such as, "Were there any IP spoofing attempts into our firewall network over the past 8 hours?" The developers of Argus have made the tools available from ftp://ftp.sei.cmu.edu/pub/argus-1.5 If you have any questions, comments, or suggestions, please send mail to argus(a)sei.cmu.edu. Scripts - ------- At the end of this document ("Attachment A") are scripts you may want to use to check your network. We are aware that the Internet is now "classless," meaning that the old notion of class A, B, and C addresses is being replaced with a prefix and length notation, also known as CIDR. Even so, the scripts, which are based on classes, may be useful to some service providers. In all the IP spoofing incidents reported to us to date, we believe that the scripts would have shown the spoofed packets. (The problem here is that these scripts may either show other packets labeled as spoofed or not show true spoofed packets due to CIDR.) A standalone machine running tcpdump or equivalent should be able to run these scripts without affecting the performance of the local net. It may be possible to configure routers to do this check directly but we are not currently aware of any systems on which this is possible. .............................................................................. Issues to consider before taking action - --------------------------------------- Before writing this "heads-up," we consulted colleagues on other response teams, several network service providers, and other technical experts. They raised the following issues, and there surely are others you should consider before taking action. Technical and performance issues: - There may be too many "false positives." Two causes are mobile IP and misconfigurations; there may be other causes as well. - The feasibility of installing network monitors may depend on network topology. - It is not clear how many monitoring machines you would need to pinpoint the problem. - When the tcpdump and snoop scripts were tested on a dedicated Sun IPX connected to a T1, the impact on performance was only marginal. Long-haul tests with similar scripts do not have performance problems either. - Anything above a T1 is going to cause some performance problems (applications like tcpdump and snoop do not work very well at all on DS3 or FDDI interfaces). Legal issues: - - Some service providers believe that checking your network as we suggest is all right; others believe that there may be a problem. We urge you to check with your legal advisors about analyzing packet header information, analyzing traffic content to detect unauthorized activity, and analyzing internal traffic and customer-bound traffic. - - For US service providers, the Digital Telephony Bill of 1994 is relevant; in particular, check the amended provision found at 18 U.S.C. 2511(2) (a) (i), which permits an electronic communications service and its employees to ...intercept, disclose, or use that communication in the normal course of...employment while engaged in any activity which is a necessary incident to the rendition of...service or to the protection of the rights or property of the provider of that service.... .............................................................................. Attachment - Scripts for Checking Networks - -------------------------------------------- We have tested the following scripts on a recent version of tcpdump and snoop (192.9.200.0 would be replaced by the site's local net, of course): --- script for tcpdump --- #!/bin/sh tcpdump 'tcp and not dst net 192.9.200.0 and ( (ip[12]&0x80=0 and ip[12]=ip[16]) or (ip[12]&0xc0=0x80 and ip[12]=ip[16] and ip[13]=ip[17]) or (ip[12]&0xe0=0xc0 and ip[12]=ip[16] and ip[13]=ip[17] and ip[14]=ip[18]) )' (Note this only seems to work with tcpdump-3.0.2 and libpcap-0.0.6 currently.) --- script for snoop --- #!/bin/sh snoop 'tcp and not net 192.9.200.0 and ((ip[12]&0x80=0 and ip[12]=ip[16]) or (ip[12]&0xc0=0x80 and ip[12]=ip[16] and ip[13]=ip[17]) or (ip[12]&0xe0=0xc0 and ip[12]=ip[16] and ip[13]=ip[17] and ip[14]=ip[18]))' (Note that this does not appear to work with Solaris 2.3 machines.) To more accurately analyze network traffic, it is useful to first describe the network topology; for example: ---------------- | INTERNET | ---------------- | ---------- | | NETWORK | ---------------- | MONITOR | | ROUTER | ---------- ---------------- | | | | ----------------------------------------------------------------- |MAC-A |MAC-B |MAC-C --------- --------- --------- |ROUTER | |ROUTER | |ROUTER | --------- --------- --------- | | | | | | | | | | | | | | | | | | | | | | | | | | | Ca Cb Cc Cd Ce Cf Cg Ch Ci (MAC-A, MAC-B, and MAC-C refer to the ethernet addresses of the router interfaces attached to the same network as the network monitor machine.) In this case, the machine used to check network traffic could be any machine capable of running tcpdump, snoop, or any other packet capture and analysis software. This machine could be programmed so that any packets that match the following expression are displayed. tcp and ( not ether src MAC-A and ( src net Ca or src net Cb or src net Cc ) not ether src MAC-B and ( src net Cd or src net Ce or src net Cf ) not ether src MAC-C and ( src net Cg or src net Ch or src net Ci ) ) This expression looks at the source address of each packet and identifies those that did not originate from the correct interface. This example should be extensible to take CIDR into account. For example, if the CIDR specification of network Ca is 192.9.200/21, then the sub-expression: src net Ca should be replaced with: ip[12:4]&0xfffff800=192.9.200.0 .............................................................................. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMA/8F3VP+x0t4w7BAQGKfgQArR6jBz+HjRbPBRAjO88aNIaH/ZbBzt1K cPDE54nLWa0+CP4F4ZWhn+UH1SMdRrLFdYZdD1sn5j56zx+nXmzo2sL3eRvylpdp LigpavVWJoOoC8XY8AJqUCT+A4txd4QacawGZMMbedIi9IyzU/33ia7BIb4wW/k6 bidvD0ExGNQ= =nyX9 -----END PGP SIGNATURE-----

1 0