- ripe-list - mailman.ripe.net

URGENT CERT message -- CERT#7023
by CERT Coordination Center 18 Dec '95

18 Dec '95

============================================================================= Alert to Network Service Providers - Widespread attacks on Internet sites CERT Coordination Center December 18, 1995 ============================================================================= Over the last several weeks, the CERT Coordination Center has been working on related incidents where the intruders have launched widespread attacks against Internet sites. Due to the scope of this incident, we ask that you alert your customers/constituency as soon as possible, and urge them to take action to ensure that systems are protected against these attacks. Please feel free to redistribute this message. Hundreds of sites have been attacked, and many of the attacks have been successful, resulting in root compromises at the targeted sites. We are working directly with the root-compromised sites. We continue to receive reports, and we believe that more attacks are going undetected. ************************************************************************** NOTE -- all of the vulnerabilities exploited in this attack are known, and are addressed by CERT advisories. ************************************************************************** The MO of the attacks and advisories that address these vulnerabilities are listed below. We cannot emphasize enough the importance of taking the actions suggested in these advisories and README files. - using automated tools to scan sites for NFS and NIS vulnerabilities * CA-94:15.NFS.Vulnerabilities and CA-94:15.README * CA-92:13.SunOS.NIS.vulnerability - exploiting the rpc.ypupdated vulnerability to gain root access * CA-95:17.rpc.ypupdated.vul and CA-95:17.README - exploiting the loadmodule vulnerability to gain root access * CA-93:18.SunOS.Solbourne.loadmodule.modload.vulnerability, CA-95:12.sun.loadmodule.vul and CA-95:12.README - installing Trojan horse programs and packet sniffers * CA-94:01.ongoing.network.monitoring.attacks and CA-94:01.README - launching IP spoofing attacks * CA-95:01.IP.spoofing and CA-95:01.README The CERT advisories and README files are available from: ftp://info.cert.org:/pub/cert_advisories Please feel free to forward this alert to other providers of Internet services, in addition to notifying your customers/constituents of this attack. We will also be launching CERT advisory CA-95:18.widespread.attacks this morning. I have appended a copy of this advisory below. Communicating with us - ---------------------- Warning: For sensitive information, use encrypted email. You will find the CERT public PGP key at the end of this document. If you would prefer to use DES, please call the CERT hotline: +1 412 268 7090 to exchange a DES key over the phone. If you or one of your customers find a compromise, please complete and return the Incident Reporting Form (IRF) appended below. This completed form will help us better assist you. Because of our workload, we must ask you not to send log files of activity, but we would be happy to work with you as needed on how to interpret data that you may collect. If you see activity that indicates an attack is in progress, we encourage you to contact your customer, or other sites involved or their service provider. We will also be happy to provide guidance and advice, if needed, on how to handle incidents and work with law enforcement. CERT Public Key - ---------------------- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi2a4WoAAAEEAN0IPkqCmoGRud0Kts3g4ZGgZ4zyqY8C5VTOgUcqU+D2U1so 21K6dxj/lewKFduXtNpqDeg6C0wR6GIMJ2jWLU4GUEq0xHohioWGGg5O3QTvCpN3 rnLIKO9urv4Wjgkp1n1ys7xcOYl5jb7kuhdlXs3kNgKi4zBB5XVP+x0t4w7BAAUR tChDRVJUIENvb3JkaW5hdGlvbiBDZW50ZXIgPGNlcnRAY2VydC5vcmc+iQCVAgUQ LZrkOXVP+x0t4w7BAQEI3QP/d9gl7GD52Pd8KbsBMb0hiploigL8kZW1Q1fVsIm1 cO9xumU89CLf2jrN+IdrIMpVWAO3DyJjZooZTaJBg/9jjv3HltHTq/XFD5c+WYlM G+fQZVuR8qu8+D8P8pPbNVm94wxj9fyKO39/dnub1UfjDedJBtt+zgMJmstADkOv QBM= =N6E5 - -----END PGP PUBLIC KEY BLOCK----- Incident Reporting Form - ---------------------- Please complete this form if you are reporting a compromise. CERT(sm) Coordination Center Incident Reporting Form CERT has developed the following form in an effort to facilitate our interaction with members of the Internet community. We would appreciate your completing the form included below in as much detail as possible. The information is optional, but the more information you can provide, the better we will be able to assist you. Note that our policy is to keep confidential any information you provide unless we receive your permission to release that information. (See questions 8 and 11 below.) Please feel free to duplicate any section as required. Please return this form to cert(a)cert.org. If you are unable to e-mail this form, please send it via FAX. Our FAX telephone number is +1 412-268-6989. Thank you for your cooperation and help. 1) Incident number (after assigned by CERT): 2) Reporting site information Organizational Name (e.g. CERT Coordination Center): Domain Name (e.g. cert.org) 3) Your contact information Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (for CERT internal use only): 4) Additional contact information (if available) Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (for CERT internal use only): 5) Compromised host(s) at your site (one entry per host please) Hostname: IP address: Vendor: Hardware: OS: Version: Security patches applied: 6) Please list the other sites compromised that you have notified, and the contact information for each site (one entry per site please) Hostname: IP address: Contact information: Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (optional, for CERT internal use only): 7) Please list the other sites compromised that you have not yet notified (one entry per site please) Hostname: IP address: Contact information (if available): Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (optional, CERT internal use only): 8) Would you be willing to contact these sites if CERT provided you the relevant contact information (Yes/No): Or, can CERT give your contact information to these sites when we contact them (Yes/No): 9) Incident category (Yes/No) Probe: Prank: Mail Spoofing: Break-in: Installed Trojan Horse: Intruder gained root access: NIS (yellow pages) attack: NFS attack: TFTP attack: FTP attack: Telnet attack: Rlogin or rsh attack: Product vulnerability: Worm: Virus: Other (please specify): 10) Are you currently using (Yes/No/Periodically) COPS (The Computer Oracle and Password System): TCP access control using packet filtering: Host access control via modified daemons or wrappers: Crack: Tripwire: Proactive password checkers (e.g. npasswd, passwd+): Shadow passwords: Other (please specify): 11) Miscellaneous Please specify any other incident response team(s) you have contacted Team: Contact information Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (optional, CERT internal use only): If you have not contacted another incident response team, could we give them your contact information (Yes/No): Please specify any law enforcement agency(ies) you have contacted Agency: Contact information Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (optional, CERT internal use only): If you have not contacted any law enforcement agency, could we give them your contact information, if necessary (Yes/No): 12) Detailed description of incident (e.g. method of intrusion, etc) 13) What assistance would you like from CERT? Copyright 1995 Carnegie Mellon University This form may be reproduced and distributed without permission provided it is used for noncommercial purposes and the CERT Coordination Center is acknowledged. CERT is a service mark of Carnegie Mellon University. ============================================================================= CA-95:18 CERT Advisory December 18, 1995 Widespread Attacks on Internet Sites ----------------------------------------------------------------------------- Over the last several weeks, the CERT Coordination Center has been working on a set of incidents in which the intruders have launched widespread attacks against Internet sites. Hundreds of sites have been attacked, and many of the attacks have been successful, resulting in root compromises at the targeted sites. We continue to receive reports, and we believe that more attacks are going undetected. ********************************************************************** All the vulnerabilities exploited in these attacks are known, and are addressed by CERT advisories (see Section III). ********************************************************************** We urge everyone to obtain these advisories and take action to ensure that systems are protected against these attacks. Also, please feel free to redistribute this message. As we receive additional information relating to this advisory, we will place it in ftp://info.cert.org/pub/cert_advisories/CA-95:18.README We encourage you to check our README files regularly for updates on advisories that relate to your site. ----------------------------------------------------------------------------- I. Description Intruders are doing the following: - using automated tools to scan sites for NFS and NIS vulnerabilities - exploiting the rpc.ypupdated vulnerability to gain root access - exploiting the loadmodule vulnerability to gain root access - installing Trojan horse programs and packet sniffers - launching IP spoofing attacks II. Impact Successful exploitation of the vulnerabilities can result in unauthorized root access. III. Solution The CERT staff urges you to immediately take the steps described in the advisories and README files listed below. Note that it is important to check README files as they contain updated information we received after the advisory was published. a. Using automated tools to scan sites for NFS and NIS vulnerabilities * CA-94:15.NFS.Vulnerabilities * CA-94:15.README * CA-92:13.SunOS.NIS.vulnerability b. Exploiting the rpc.ypupdated vulnerability to gain root access * CA-95:17.rpc.ypupdated.vul * CA-95:17.README c. Exploiting the loadmodule vulnerability to gain root access * CA-93:18.SunOS.Solbourne.loadmodule.modload.vulnerability * CA-95:12.sun.loadmodule.vul * CA-95:12.README d. Installing Trojan horse programs and packet sniffers * CA-94:01.ongoing.network.monitoring.attacks * CA-94:01.README e. Launching IP spoofing attacks * CA-95:01.IP.spoofing * CA-95:01.README The CERT advisories and README files are available from ftp://info.cert.org/pub/cert_advisories If you find a compromise, please complete the Incident Reporting Form that we have provided in the appendix of this advisory, and return the form to cert(a)cert.org. This completed form will help us better assist you. Note: Because of our workload, we must ask you not to send log files of activity, but we would be happy to work with you as needed on how to interpret data that you may collect. Also, the CERT staff can provide guidance and advice, if needed, on how to handle incidents and work with law enforcement. If you see activity that indicates an attack is in progress, we encourage you to contact other sites involved and the service providers, as well as the CERT Coordination Center. --------------------------------------------------------------------------- Contacting the CERT Coordination Center For sensitive information, please use encrypted email. The CERT public PGP key is available from ftp://info.cert.org/pub/CERT_PGP.key If you prefer to use DES, please call the CERT hotline +1 412 268 7090 to exchange a DES key over the phone. Other CERT contact information: Internet email: cert(a)cert.org Telephone: +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30 a.m.-5:00 p.m. EST(GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours. Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 USA CERT advisories and bulletins are posted on the USENET newsgroup comp.security.announce. If you would like to have future advisories and bulletins mailed to you or to a mail exploder at your site, please send mail to cert-advisory-request(a)cert.org. Past CERT publications, information about FIRST representatives, and other information related to computer security are available from ftp://info.cert.org/pub/ Copyright 1995 Carnegie Mellon University This material may be reproduced and distributed without permission provided it is used for noncommercial purposes and the copyright statement is included. CERT is a service mark of Carnegie Mellon University. .............................................................................. Appendix: Incident Reporting Form (also available from ftp://info.cert.org/pub/incident.reporting.form) CERT(sm) Coordination Center Incident Reporting Form CERT has developed the following form in an effort to facilitate our interaction with members of the Internet community. We would appreciate your completing the form included below in as much detail as possible. The information is optional, but the more information you can provide, the better we will be able to assist you. Note that our policy is to keep confidential any information you provide unless we receive your permission to release that information. (See questions 8 and 11 below.) Please feel free to duplicate any section as required. Please return this form to cert(a)cert.org. If you are unable to e-mail this form, please send it via FAX. Our FAX telephone number is +1 412-268-6989. Thank you for your cooperation and help. 1) Incident number (assigned by CERT): CERT# 2) Reporting site information Organizational Name (e.g. CERT Coordination Center): Domain Name (e.g. cert.org) 3) Your contact information Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (for CERT internal use only): 4) Additional contact information (if available) Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (for CERT internal use only): 5) Compromised host(s) at your site (one entry per host please) Hostname: IP address: Vendor: Hardware: OS: Version: Security patches applied: 6) Please list the other sites compromised that you have notified, and the contact information for each site (one entry per site please) Hostname: IP address: Contact information: Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (optional, for CERT internal use only): 7) Please list the other sites compromised that you have not yet notified (one entry per site please) Hostname: IP address: Contact information (if available): Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (optional, CERT internal use only): 8) Would you be willing to contact these sites if CERT provided you the relevant contact information (Yes/No): Or, can CERT give your contact information to these sites when we contact them (Yes/No): 9) Incident category (Yes/No) Probe: Prank: Mail Spoofing: Break-in: Installed Trojan Horse: Intruder gained root access: NIS (yellow pages) attack: NFS attack: TFTP attack: FTP attack: Telnet attack: Rlogin or rsh attack: Product vulnerability: Worm: Virus: Other (please specify): 10) Are you currently using (Yes/No/Periodically) COPS (The Computer Oracle and Password System): TCP access control using packet filtering: Host access control via modified daemons or wrappers: Crack: Tripwire: Proactive password checkers (e.g. npasswd, passwd+): Shadow passwords: Other (please specify): 11) Miscellaneous Please specify any other incident response team(s) you have contacted Team: Contact information Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (optional, CERT internal use only): If you have not contacted another incident response team, could we give them your contact information (Yes/No): Please specify any law enforcement agency(ies) you have contacted Agency: Contact information Name: E-mail address: Telephone number: FAX number (optional): Pager number (optional): Home telephone number (optional, CERT internal use only): If you have not contacted any law enforcement agency, could we give them your contact information, if necessary (Yes/No): 12) Detailed description of incident (e.g. method of intrusion, etc) 13) What assistance would you like from CERT? Copyright 1995 Carnegie Mellon University This form may be reproduced and distributed without permission provided it is used for noncommercial purposes and the CERT Coordination Center is acknowledged. CERT is a service mark of Carnegie Mellon University.

1 0

Hostcount for November 1995
by Mirjam Kuehne 04 Dec '95

04 Dec '95

Dear all, Here comes the hostcount for November 1995. The table shows an increase since last month of over 71,000 (or 3.7%) to a total of 1,999,997 (!) hosts in the DNS in Europe. We leave the 2 Million boundary as a Christmas present :-) The german zone shows a decrease again of more than 13,000 hosts. The reason is that two zones that usually show a very high host number are not listed this time. This means almost 35,000 hosts are missing. We have one new zone: md (Republic of Moldova) that starts with 10 hosts in 5 zones. The UK shows again the highest increase with over 23,000 hosts more than in October. The hostcount can also be found under ftp://ftp.ripe.net/ripe/hostcount/ The graphical version of the hostcount can be found at ftp://ftp.ripe.net/ripe/hostcount/RIPE-Hostcount-{Mo,Qu}.eps The translation of the country codes can be found at ftp://ftp.ripe.net/iso3166-countrycodes I would like to thank all people who help me to create the hostcount every month by counting hosts locally: at Gerhard Winkler <Gerhard.Winkler(a)univie.ac.at> be Herman Moons <Herman.Moons(a)CS.kuleuven.ac.be> ch Christoph Graf <graf(a)chx400.switch.ch> cy Panagiotis Tzounakis <pj(a)ics.forth.gr> cz Jiri Orsag <Jiri.Orsag(a)eunet.cz> de Peter Koch <pk(a)TechFak.Uni-Bielefeld.DE> dk Robert Martin-Legene <robert(a)dknet.dk> es Jose Sanchez-Seco <jose.sanchez(a)rediris.es> fi Petri Ojala <ojala(a)eunet.fi> fr Benoit Grange <grange(a)sagres.inria.fr> gr Panagiotis Tzounakis <pj(a)ics.forth.gr> hr Ivan Maric <Ivan.Maric(a)stribor.srce.hr> ie Mike Norris <mnorris(a)dalkey.hea.ie> il Sason Levi <sason(a)NetVision.net.il> it Antonio_Blasco Bonito <bonito(a)nis.garr.it> no Havard Eidnes <Havard.Eidnes(a)runit.sintef.no> pt Graca Carvalho <fccn(a)dns.pt> ru Andrey Dobrotsvetov <adbr(a)argo.net.kiae.su> sk Ivan Lescak <Ivan.Lescak(a)Slovakia.EU.net> Lubos Elias <Lubos.Elias(a)uakom.sk> tr Yener Yigit <yener(a)knidos.cc.metu.edu.tr> uk JANET NOSC <hostmaster(a)nic.ja.net> If you have any questions, please don't hesitate to contact me. Kind regards, Mirjam Kuehne RIPE NCC RIPE DNS Hostcount Previous Count : Thu Oct 31 1995 This Count : Thu Nov 30 1995 CY SOA COUNTED DUPL REAL CHANGE ============================================================ al 4 1 0 1 0 am 2 45 2 43 - 29 at 1135 55744 1601 54143 + 2679 az 3 15 0 15 0 be 1026 29242 806 28436 + 229 bg 51 918 45 873 + 40 by 7 18 1 17 + 11 ch 1068 80850 1018 79832 + 1107 cy 31 407 12 395 + 32 cz 373 21155 328 20827 + 1844 de 5499 429219 18471 410748 -13526 dk 838 50944 868 50076 + 3396 dz 2 16 0 16 0 ee 150 3704 53 3651 + 2739 eg 10 678 16 662 + 112 es 1116 53077 870 52207 + 5302 fi 1317 148863 3594 145269 + 4571 fo 14 469 0 469 - 2 fr 2199 138837 3656 135181 +15358 gb 1 35 0 35 + 3 ge 10 53 0 53 + 3 gr 353 7390 446 0 - 6944 hr 120 2957 634 2323 + 36 hu 209 15337 274 15063 + 1216 ie 313 13883 145 13738 + 1833 il 547 24639 313 24326 + 508 is 145 8131 73 8058 + 228 it 2237 72338 4525 67813 + 4727 li 17 70 3 67 + 27 lt 31 377 1 376 + 29 lu 86 2008 24 1984 + 328 lv 45 1266 30 1236 + 132 ma 2 199 0 199 - 3 md 5 10 0 10 + 10 mk 12 117 28 89 - 1 mt 8 89 13 76 + 52 nl 1585 168629 2592 166037 + 6846 no 1655 83558 3190 80368 + 2569 pl 743 23493 1624 21869 + 980 pt 332 12181 953 11228 + 998 ro 78 1283 30 1253 - 83 ru 384 9813 868 8945 + 605 se 2461 144484 4656 139828 + 8859 si 168 5161 192 4969 + 575 sk 124 2997 112 2885 - 22 su 402 10516 441 10075 + 285 tn 3 81 4 77 + 2 tr 151 5310 79 5231 + 395 ua 137 2253 424 1829 - 22 uk 8259 464325 37230 427095 +23583 va 1 1 0 1 0 yu 3 0 0 0 0 ============================================================ 35472 2097186 90245 1999997 +71617

1 0

(no subject)
by hidalgo＠unitru.edu.pe 25 Nov '95

25 Nov '95

Help

1 0

Corrected Hostcount for October 1995
by Mirjam Kuehne 08 Nov '95

08 Nov '95

Dear all, In the hostcount I have sent yesterday was a mistake: The IT domain showed the figures for September. Please find below the corrected version. The new figures for IT also changed the totals. We can now see an increase of 5.4%. The new files can be found at the usual place: ftp://ftp.ripe.net/ripe/hostcount/ ftp://ftp.ripe.net/ripe/hostcount/RIPE-Hostcount-{Mo,Qu}.eps Kind Regards, Mirjam Kuehne RIPE NCC RIPE DNS Hostcount Previous Count : Mon Sep 30 1995 This Count : Thu Oct 31 1995 CY SOA COUNTED DUPL REAL CHANGE ============================================================ al 4 1 0 1 0 am 5 74 2 72 + 10 at 1031 53197 1733 51464 + 2353 az 3 15 0 15 0 be 918 28998 791 28207 + 1322 bg 56 884 51 833 + 57 by 1 6 0 6 - 2 ch 843 79663 938 78725 + 2092 cy 29 374 11 363 + 88 cz 341 19301 318 18983 - 292 de 5191 437726 13452 424274 +22422 dk 773 47607 927 46680 + 4098 dz 2 16 0 16 0 ee 46 947 35 912 - 2158 eg 9 564 14 550 + 264 es 989 47749 844 46905 + 7368 fi 1218 143918 3220 140698 + 7378 fo 14 471 0 471 0 fr 2068 123212 3389 119823 - 3398 gb 1 32 0 32 + 1 ge 10 50 0 50 + 38 gr 353 7390 446 6944 + 204 hr 112 2859 572 2287 - 2 hu 197 14272 425 13847 + 1306 ie 111 12023 118 11905 + 1600 il 501 24141 323 23818 + 2006 is 138 7904 74 7830 + 2 it 2152 67936 4850 63086 + 5161 li 11 41 1 40 - 7 lt 29 348 1 347 + 19 lu 81 1673 17 1656 - 13 lv 39 1142 38 1104 + 262 ma 2 202 0 202 + 202 mk 12 116 26 90 + 7 mt 3 27 3 24 + 21 nl 1453 161665 2474 159191 + 6063 no 1528 80965 3166 77799 + 3087 pl 720 22453 1564 20889 + 1951 pt 315 11254 1024 10230 + 479 ro 103 1366 30 1336 + 157 ru 393 8994 654 8340 + 1373 se 2171 135384 4415 130969 + 7276 si 156 4566 172 4394 + 499 sk 123 2952 45 2907 + 333 su 403 10245 455 9790 + 903 tn 3 77 2 75 + 6 tr 148 4905 69 4836 - 56 ua 144 2284 433 1851 + 22 uk 7394 438838 35326 403512 +23489 va 1 1 0 1 0 yu 3 0 0 0 0 ============================================================ 32351 2010828 82448 1928380 +97991

1 0

Hostcount for October 1995
by Mirjam Kuehne 08 Nov '95

08 Nov '95

Dear all, Here is the hostcount for October 1995. The table shows an increase since last month of almost 93,000 (or 5.1%) to a total of over 1,900,000 hosts in the DNS in Europe. The UK shows the highest increase with over 23,000 hosts more than in September. The hostcount can also be found under ftp://ftp.ripe.net/ripe/hostcount/ The graphical version of the hostcount can be found at ftp://ftp.ripe.net/ripe/hostcount/RIPE-Hostcount-{Mo,Qu}.eps I would like to thank all people who help me to create the hostcount every month by counting hosts locally: at Wilfried Woeber <Wilfried.Woeber(a)CC.UniVie.ac.at> be Herman Moons <Herman.Moons(a)CS.kuleuven.ac.be> ch Christoph Graf <graf(a)chx400.switch.ch> cy Panagiotis Tzounakis <pj(a)ics.forth.gr> cz Jiri Orsag <Jiri.Orsag(a)eunet.cz> de Peter Koch <pk(a)TechFak.Uni-Bielefeld.DE> dk Robert Martin-Legene <robert(a)dknet.dk> es Jose Sanchez-Seco <jose.sanchez(a)rediris.es> fi Petri Ojala <ojala(a)eunet.fi> fr Benoit Grange <grange(a)sagres.inria.fr> gr Panagiotis Tzounakis <pj(a)ics.forth.gr> hr Ivan Maric <Ivan.Maric(a)stribor.srce.hr> ie Mike Norris <mnorris(a)dalkey.hea.ie> il Sason Levi <sason(a)NetVision.net.il> it Antonio_Blasco Bonito <bonito(a)nis.garr.it> no Havard Eidnes <Havard.Eidnes(a)runit.sintef.no> pt Graca Carvalho <fccn(a)dns.pt> ru Andrey Dobrotsvetov <adbr(a)argo.net.kiae.su> sk Ivan Lescak <Ivan.Lescak(a)Slovakia.EU.net> Lubos Elias <Lubos.Elias(a)uakom.sk> tr Yener Yigit <yener(a)knidos.cc.metu.edu.tr> uk Duncan Rogerson <D.Rogerson(a)nosc.ja.net> If you have any questions, please don't hesitate to contact me. Kind regards, Mirjam Kuehne RIPE NCC RIPE DNS Hostcount Previous Count : Mon Sep 30 1995 This Count : Thu Oct 31 1995 CY SOA COUNTED DUPL REAL CHANGE ============================================================ al 4 1 0 1 0 am 5 74 2 72 + 10 at 1031 53197 1733 51464 + 2353 az 3 15 0 15 0 be 918 28998 791 28207 + 1322 bg 56 884 51 833 + 57 by 1 6 0 6 - 2 ch 843 79663 938 78725 + 2092 cy 29 374 11 363 + 88 cz 341 19301 318 18983 - 292 de 5191 437726 13452 424274 +22422 dk 773 47607 927 46680 + 4098 dz 2 16 0 16 0 ee 46 947 35 912 - 2158 eg 9 564 14 550 + 264 es 989 47749 844 46905 + 7368 fi 1218 143918 3220 140698 + 7378 fo 14 471 0 471 0 fr 2068 123212 3389 119823 - 3398 gb 1 32 0 32 + 1 ge 10 50 0 50 + 38 gr 353 7390 446 6944 + 204 hr 112 2859 572 2287 - 2 hu 197 14272 425 13847 + 1306 ie 111 12023 118 11905 + 1600 il 501 24141 323 23818 + 2006 is 138 7904 74 7830 + 2 it 1879 62586 4661 57925 0 li 11 41 1 40 - 7 lt 29 348 1 347 + 19 lu 81 1673 17 1656 - 13 lv 39 1142 38 1104 + 262 ma 2 202 0 202 + 202 mk 12 116 26 90 + 7 mt 3 27 3 24 + 21 nl 1453 161665 2474 159191 + 6063 no 1528 80965 3166 77799 + 3087 pl 720 22453 1564 20889 + 1951 pt 315 11254 1024 10230 + 479 ro 103 1366 30 1336 + 157 ru 393 8994 654 8340 + 1373 se 2171 135384 4415 130969 + 7276 si 156 4566 172 4394 + 499 sk 123 2952 45 2907 + 333 su 403 10245 455 9790 + 903 tn 3 77 2 75 + 6 tr 148 4905 69 4836 - 56 ua 144 2284 433 1851 + 22 uk 7394 438838 35326 403512 +23489 va 1 1 0 1 0 yu 3 0 0 0 0 ============================================================ 32078 2005478 82259 1923219 +92830

2 2

BTnet Ticket BTNET.951106 1653 CLOSED
by Nigel Titley 06 Nov '95

06 Nov '95

Ticket Number: BTNET.951106 1653 Ticket Status: CLOSED Ticket Type: UNSCHEDULED Ticket Source: BT Ticket Scope: Router Site/Line: UK Transit Router Ticket Owner: BTnet NOC Problem Fixer: NOC Ticket Opened: 951106 16:53 GMT Problem Started: 950906 12:00 Closed: 951106 20:45 GMT Ended: 951106 19:34 GMT Problem Description: A serial card in the telehouse-transit.bt.net router is showing signs of failure which are causing transit lines to be dropped for short periods. Affected: All BTnet customers Actions: Card replaced and links moved back. Router seems stable.

1 0

BTnet Ticket BTNET.951106 1653
by Nigel Titley 06 Nov '95

06 Nov '95

Ticket Number: BTNET.951106 1653 Ticket Status: OPEN Ticket Type: UNSCHEDULED Ticket Source: BT Ticket Scope: Router Site/Line: UK Transit Router Ticket Owner: BTnet NOC Problem Fixer: NOC Ticket Opened: 951106 1653 GMT Problem Started: 950906 12:00 Closed: Ended: Problem Description: A serial card in the telehouse-transit.bt.net router is showing signs of failure which are causing transit lines to be dropped for short periods. Affected: All BTnet customers Actions: We are moving the US MCI link, the EBONE link and the DANTE/IBDNS link to an alternative card until the faulty card can be replaced. Time to fix: 15 minutes to move links. 4 hours to fix card.

1 0

Re: Abbreviations (was: EOF-7 meeting minutes)
by Jon Crowcroft 29 Oct '95

29 Oct '95

see http://www.cs.ucl.ac.uk/staff/jon/euro.html for the summary so far please inform me of any errors of ommission or commission (or spelling:-) thanks for all your input... cheers jon

1 0

EOF-7 meeting minutes
by Havard.Eidnes＠runit.sintef.no 26 Oct '95

26 Oct '95

Hi, I had promised to send out the final minutes to a wider audience than to the EOF list only earlier, but it fell through the cracks so some of this may be old news by now. But here it is, anyway. Note that the new proposed version of the EOF charter is appended at the end of the minutes. Regards, - Håvard -*- Text -*- European Operators Forum Minutes of the 7th EOF meeting Havard Eidnes Held at KTH, Stockholm, Friday 14 July 1995 NORDUnet 20 Jul 1995 v2 (draft) ------------------------------ Attendees: Peter Lothberg STUPI roll(a)stupi.se Havard Eidnes NORDUnet he(a)runit.sintef.no Keith Mithcell PIPEX keith(a)pipex.net Anders Lowinger SWIPnet lowis(a)swip.net Per Bilse EUnet bilse(a)eu.net Rudiger Volk Deutsche Telekom rv(a)nic.dtag.de Marc Pichon Transpac/RAIN pichon(a)rain.fr Eric Malmstrom Transpac Sweden eric.malmstrom(a)transpac.se Magnus Risberg Transpac Sweden magnus(a)transpac.net Willem van der Scheun SARA scheun(a)sara.nl Francis Dupont INRIA Francis.Dupont(a)inria.fr Wilfried Woeber VUCC/ACOnet woeber(a)cc.univie.ac.at Andrew Partan UUnet/Alternat asp(a)uunet.uu.net Daniel Karrenberg RIPE NCC dfk(a)ripe.net Philip Bridge Unisource Switzerland bridge(a)dial-switch.ch Ola Johansson Unisource Sweden ola.johansson(a)unisource.se Jan-Olof "Moon" Jemnemo Telia, Sweden moon(a)intg.telia.se Tony Hain ESnet alh(a)es.net Yakov Rekhter Cisco yakov(a)cisco.com Elise Gerich Merit epg(a)merit.edu Bernhard Stockman KTH boss(a)it.kth.se ------------------------------ 1. Welcome PL welcomed everyone to KTH. 2. Minute taker HE was volunteered to take the minutes. 3. Agenda bashing No noted additions to the agenda at this time. AOB is still on the agenda. 4. Apologies None received. 5. Previous minutes Francis Dupont had noticed two typos in the attendance list. No other comments, so the minutes were approved with these corrections. The approved minutes will be re-circulated to the EOF and the RIPE lists. 6. European update Dante/EMPB There was noone present who could officially speak for Dante. The contract for the EMPB network expires in October -95, and Dante has during the spring had a call for tender out and has chosen British Telecom (BT) as the supplier of the follow-on network. The major uncertainty centered around whether the BT- provider follow-on network to EMPB would be a private network to be provided to Dante administratively managed by Dante or whether BT under the contract was free to add commercial customers to their network. Willem van der Scheun had got the impression that the model would probably basically be the same as today, i.e. it would remain a private network. Per Bilse had gotten the opposite impression, i.e. that BT could add other customers to the network if they might choose to do so, i.e. a model more similar to the old ANS / NSFnet model. Noone was present who could confirm or deny any of these. Theis item would probably be brought up during the IEPG meeting on Sunday, where hopefully someone with authoritative information would be present who could clarify this issue. EUnet EUnet has continued to upgrade it's network. They now have 2 x E1 to the US, and only a single international 64kbit/s circuit remains in Amsterdam (Portugal). There has been a recent change in the management of EUnet. Other than that, things are progressing more or less in the "buisness as usual" direction. EBONE Mostly buisness as usual. There has been some recent upgrades: there are now 3Mbit/s (1+2) Stockholm - Paris and 4Mbit/s (2x2) to Amsterdam. EBONE is looking towards establishing an E3-based backbone. PIPEX Keith Mitchell presented an overview of the PIPEX network. Details can be found at http://www.pipex.net/network/connectivity.html Of notable international and european significance is 3 x T1 links to the US east coast, London-Stockholm at 256 kbit/s and London-Paris at 2x128 kbit/s. PIPEX is planning on using VSAT in the eastern countries. They also have a link London-Johannesburg, and as far as they know they are the first ones to implement a European-African link. They also have a planned link to Ghana. The UK-internal network is now mostly 2 Mbit/s based. The notable grief they have at the moment is that they reach Dante customers and EUnet customers via the US. NORDUnet Havard Eidnes gave a brief update of NORDUnet's expansion plans. The current intra-nordic network is based on 2Mbit/s lines with 2 lines going to Finland (except Iceland which is at 256 kbit/s). The central nordic region will approximately in October be operational with an 8 Mbit/s star out of Stockholm to Oslo, Helsinki, and Copenhagen. We have also asked for a price quote for an upgrade of the line to Iceland to 1 Mbit/s. In Iceland there are some organizational changes going on -- the former Suris cooperative is being replaced by a new company called "Internet Iceland" (IntIS for short) with basically the same constituency as the old Suris cooperation but with a more solid organization. NORDUnet will subscribe to the new BT-operated Dante network service at 2 Mbit/s. NORDUnet is in addition thinking of implementing other international circuits in cooperation with other networks. Although not said explicitly at the meeting, it should be noted that NORDUnet is buying access to 24 Mbit/s of the new trans-atlantic 34/45 Mbit/s service and that the NSF is doing the same from the other end. RIPE NCC The RIPE NCC is currently getting it's main transit services from SURFnet who use the Dante services. However, they also peer with EUnet, Dante and EBONE directly to reach customers of those providers, and are willing to peer with anyone else showing up where the RIPE NCC is present. Therefore, critisism that the RIPE NCC does not have a neutral position relative to service providers can now be laid to rest. 7. Ten34 impact on the non-R&D part of Europe The two persons who had been contacted by PL were unable to give a presentation. Thus, noone present could talk in authority concerning the Ten34 initiative, so the following is based on second-hand information: In the 4th european research programme there will be funds available for implementing some sort of high-speed networking for R&D in Europe. This combined with the general need for a better general intra-european infrastructure for R&D has spurred the Ten34 initiative. The members of the Ten34 initiative are the major R&D networks in Europe. It should be mentioned that other parties are after the EU funds as well, notably the "James" initiative which is largely comprised of european PTTs who want to continue the current ATM-based pilot network. The Ten34 constituency does not appear to think that the James initiative contributes a workable solution to the problem the R&D networks are facing (basically because ATM is seen as "too early" technology-maturity-wise, and what is needed is a production network). The EU has indicated that co-funding of a 34 Mbit/s based network could be forthcoming if offers for circuits at prices equal to 4 times 2 Mbit/s would be forthcoming. Should the Ten34 initiative be realized the network will have to maintain an AUP (or at least restrictions on direct "customer" connections) since it will receive public funds paying parts of the cost (at least initially). The concern raised by the group was how this would be integrated into the rest of the existing and forthcoming Internet infra- structure in Europe. Firstly, it is probably premature at this stage to expect this detailed planning -- the rumours seemed to indicate Ten34 to be between 12 and 24 months away if it would be realized. The group then suggested a short recommendation should be written expressing the issues to be taken into account in this arena when planning the network. ACTION: Keith Mitchell and Havard Eidnes to draft a document highlighting the issues to be considered concerning the impact of the Ten34 network on the general Internet in Europe. 8. Stockholm-US 34/45 Mbit/s service Peter Lothberg gave a short presentation of the details of the recently activated 34/45 Mbit/s service between Stockholm and the US. The implementation work had taken approximately 24 days, and was somewhat complicated. Detailed pictures showing the equipment and cable paths were shown. PL is looking at getting backup of this circuit on the IP level with another european country with a high-speed link. 9. NY/Pennsauken Euro-NAP The 34/45 Mbit/s circuit terminates in the NY NAP facility in Pennsauken (New Jersey). In order to make it possible for other european service providers to connect to the US at high speeds the circuit is not directly attached to the NY NAP switch but to a separate FDDI LAN. PL expected another undisclosed european party to connect to the NY NAP at E3 speed sometime in September. 10. Connectint to the former USSR Tony Hain of ESnet is planning two links into Russia near Moscow at 64kbit/s via satellite to an european termnation point with 64kbit/s onwards to ESnet, and wanted to get some impression of what others are doing wrt. networking into the former USSR. The result was that the people present could inform of a number of links going into different parts of the former USSR from different service providers. The picture is dominated by a lot of more or less un-coordinated efforts, which tends to leave one left with a mildly chaotic impression. The solution recommended for the time being would thus be "do it yourselves". It was noted that RIPE has a working group collecting information about connectivity into the eastern and central european countries (the connectivity working group), they have a number of documents stored in the RIPE document store at the RIPE NCC, and the working group is still active. If any new information surfaces, please submit it to the connectivity working group for inclusion in the RIPE document store. Any questions about this should be directed to <ncc(a)ripe.net>. 11. European interconnects -- status LINX (London InterNet eXchange) The LINX had the initial members: Connected bandwidth PIPEX 10 Mbit/s JANET/UKERNA 18 Mbit/s BTnet 2 -> 10 Mbit/s EUnet/GB 512 kbit/s Demon 2 Mbit/s Recent requests and/or additions: Netkonect, Sprint International, Technocom, INSnet, CableTel. There has been lots more growth in the number of providers wishing to connect to the LINX than expected -- there comes in a valid new request about once every 14 days. When it was first set up there was no formal organization to handle requests for new connections, this apparently needs to be fixed. Implementation-wise they have a Cisco Catalyst ethernet switch at the moment. A second Catalyst and possibly an FDDI ring would be added soon. Other information about the LINX can be found at http://www.linx.net/linx/ KM expressed his satisfaction with Telehouse as a facilities manager: they're not an ISP with it's own agenda in the Internet provider buisness and they are not a phone company with the traditional mindset and restrictions that implies. F-GIX (France) Noone from France Telecom or Renter were present, Mark Pichon gave a short orientation. There is currently an interconnect point where Renater, Oleane, and IN2P3 are connected. Transpac/RAIN has tried to connect to the current exchange point but a response to this request has been unexplicably delayed. There is a proposal for establishing a new exchange point in Paris, however the location has not been decided yet (will probably be decided at the end of the month). Stockholm, D-GIX Currently implemented with 2 Cisco Catalysts and an FDDI ring with plans to add an FDDI switch. Metropolitan Fiber Systems will connect to the exchange point in Stockholm with a layer-2 connection, and will thus be able to extend the geographical coverage of the exchange point to the other POPs MFS has in Stockholm. (This is similar to what they have done at the MAE-East and MAE-West exchange points.) Rule for connecting: must have peer agreement with at least two of the others already present to connect. Amsterdam There is currently an initiative to add another exchange point in Amsterdam in addition to "IBR-lan". Some of the motivation for this move is to not have a single ISP be in control of the exchange point. Geneva As noone present could talk authoritatively about the Geneva exchange point the following is at best second-hand. There was mention that at least part of the exchange point at CERN would be moved to BT premises -- this is in connection with the local implementation of the access ports to the BT-operated EMPB follow-on service from Dante. Whether this move includes the other parts of the CERN exchange point was not clear. Italy There are 2 exchange points currently: one with local co-location (in Milan?) and one using Frame Relay. There has been little public information about these, DFK commented that this may stem from their culture which basically says "don't talk until your're ready". Germany There is or will be an exchange point between at least three German service providers. The rules for connecting to the exchange point are at best unclear, some parties have been turned away with no explanation. There is also an existing de-facto exchange point at the ECRC installation. Ruediger Volk expressed his desire to press for someone to establish an open exchange point somewhere in Germany. Finland A message from Petri Ojala in EUnet/Finland had sent the following message to PL: FICIX (Finnish Commercial Internet Exchange) - Operational since December 1993. National interconnect point for finnish Internet service providers, current members are EUnet Finland, FUNET, Datanet (Telecom Finland), LanLink (Local PTT's Consortium) and Clinet (since June 1995). EUnet Finland has been appointed to manage the FICIX. - FICIX operations has been smoothly and practically trouble-free, currently BGP4 is used between all the provider routers. The FICIX media is being upgraded from shared ethernet to switched ethernet. FICIX members have from 2 to 10 Mbit/s connectivity to their own backbones. Norway HE gave a short presentation. The NIX (Norwegian Internet eXchange) has been in operation since the summer of 1993. The NIX is housed at the University of Oslo, which is also a Uninett POP (Uninett is the norwegian R&D network organization). It currently connects Uninett, EUnet/NO, TelePost, Oslonett, DAXnet, and PowerTech, with at least one coming. The purpose is to contain norwegian traffic inside Norway, one of the premises for connecting is that one have Norway-external connectivity via other means than at the NIX. Ireland There is a plan to set up an interconnect point and establish a local Irish operator's forum. Contact: Mike Norris. 12. Focus on three initial exchange points in Europe? PL sketched the problem faced by international and inter- continental Internet service providers who would want to "connect to Europe". To make it possible for such service providers to enter the scene the number of "top-level" Europan exchange point should be limited. The idea is also partly to create a market by defining the product. DFK pointed out that while there is consensus that exchange points are a good thing and should be promoted, this issue fo the EOF designating 'major' exchange points had been discussed before and that it would probably be difficult to establish a consensus as most service providers would like to have an european exchange point "in their own backyard". Some objective criteria and possibly metrics for choosing exchange points could be developed, however, setting the threshold would again be difficult. After a short discussion it was agreed that as a first minimal step today's system should be clearly and consistently documented and e.g. stored in the RIPE document store. ACTION: DFK to write up a proposal for a skeleton for describing an exhange point. ACTION: PL to write a recommendation or guidelines for intercontinental service providers who want to connect their networks in Europe. 13. EOF charter The EOF charter has not really been formally approved yet. The July 1994 version was presented together with requests for additions or deletions from that round of comments (partly with these comments merged into the document). There were no comments to the modified charter. The new modified charter is attached below. 14. Net-39 experiment Moved to IEPG meeting on Sunday 15. MBONE & PIM experiments Andrew Partan talked briefly about their experience in trying to use native multicast on the Cisco routers. The basic goal for this excersise is to only get one copy of a given multicast packet on each link of their infrastructure. They have partly tried to separate the unicast and multicast routing, and are doing this by running DVMRP in addition to PIM to establish a separate RPF lookup table (maintained by DVMRP). Currently the service is CPU bounded on the Cisco routers since the multicast routing and fowarding is process-switched in the Cisco 10.3 code (11.0 will add fast-switching). Yakov Rekhter asked whether a knob to control the CPU consumption and/or bandwidth utilization on a given link caused by multicast to be controlled; the general answer was "yes, this would be useful" -- e.g. some parties already use the bandwidth- limiting feature in mrouted and the corresponding kernel multicast forwarding code. One conclusion from this excercise is that the tools for handling external multicast routing simply are not there yet. 16. Route flap damping Cisco has lately (in a branch of 10.3) implemented Curtiz Villamisar's proposed modifications to BGP to support dampening route flapping on the Internet. The paper describing this can be found in ftp://ftp.ans.net/pub/papers/route-dampen.ps Andrew Partan reported that Alternet has turned on the feature ("router bgp xxx", "bgp dampen"), and both the algorithm and the implementation work. The net effect of this code is to slow the propagation of changes for a given prefix if it has been flapping, so any changes (transitions up or down) will take longer to propagate to remote places. It was noted that there is no "preferred state" for a route, so it can equally well be held down as being kept up longer than earlier. 17. Scaling issues: how small can an ISP be? Keith Mitchell reported his experiences in that several small sites and/or service providers are buying cheap circuits to the US and going to the LINX to be connected there. This happens partly because of the disparity between the prices of international circuits going to the US as compared to intra- european circuits (again caused by the vast difference in the telecommunications regulatory regimes on the two sides of the Atlantic). Common for lots of these small sites is also that they are relatively uninformed of how to set up their service properly with external routing etc., and the issue was raised about how many such service providers the Internet could acommodate. DFK commented that 'regulation' of who can be a service provider at any level is impossible without being accused of anti- competitive practices or even worse encourage moves towards government regulation. The discussion on this and related points will continue at the IEPG meeting on Sunday. 18. AOB DFK asked about the "hall of fame" / "hall of shame" messages sent out recently concerning use of CIDR, and asked how often people would like to have them and for other suggestions for improvements. It was agreed that the names of the ASes injecting the prefixes should be named and that these should be sent out monthly in connection with the host count statistics. DFK asked about how many actively maintained the contents of the RIPE routing registry, the response was "not very many". There is currently no script to compare the actual BGP routing tables with the contents of the routing registry contents. 19. Next meeting The next RIPE meeting has been moved to October 11-13 (the dutch minister of education pulled rank and got the usual RIPE meeting room at NIKHEF), so the next EOF meeting would be held on the 11th in Amsterdam. ------------------------------ European Operators Forum Charter Glenn Kowack et al. Version 1.1 14 July 1995 Technical Mission The mission of the European Operators Forum (EOF) is technical: to provide a continuing environment in which European national and international service providers may meet as a group to discuss operational issues. It will also serve as the regional operators forum for Europe under the IEPG umbrellar. Open Membership Membership in the European Operators Forum (EOF) is open to any person representing a national or international provider of IP services in the European region. As meetings will be very focused on the issues at hand, persons with only educational interests should not attend. It is hoped that all service providers will actively participate in the EOF. Participating organizations are encouraged to send only a few representatives to each meeting, and to maintain as much continuity of representation as possible. Open Process The EOF does not formally create policies, standards, or requirements. It's activities are limited to discussion and consensus building. All EOF minutes and documents will be in the public record. Organisation As present there is no plan for a formal structure, secretariat, or dues, save for the appointment of a Chairman. It is expected that support will be provided by member organisations and the RIPE NCC. EOF meetings will be held as required. Relationship to RIPE and other Organisations The EOF will work in cooperation with RIPE as a working group. In addition, the EOF will act as the European part of the IEPG. It is critical that no single organization or type of network service provider have undue influence on EOF activities or directions.

8 7

Re: EOF-7 meeting minutes
by Havard.Eidnes＠runit.sintef.no 25 Oct '95

25 Oct '95

> > Unit for measuring amounts of data. Amounts to 1.048.576 bits. For > > more information, see http://www.BITNET/ :-). > > I know this has been discussed countless times on the net... i > think that one megabit of trasmissive data is 10^6 ... :) but > the URL is nice! Unfortunately I think Liman is right this time. The term explained was "Mbit", not "Mbit/s". The former is for measuring amounts of data, conventionally 2^20 bits, the latter is a unit for measuring "transmission speed", conventionally 10^6 bits/s. - Håvard

1 0