Willy Dobbe - routing

Cisco's IP Journal on IP spoofing

Tue, 12 Feb 2008 11:38:12 +0100

Over at the "Internet protocol Jornal (issue 10.4) you can find a good read on the dangers of IP spoofing. This problems is very old and very wide known. Even when I was in networking (1997-2002) this was wideley known and there was an easy cure. So I dont understand why Cisco decided to publish this now, a decade ago it would have been yesterdays news.

Everyone who ever read the TCP/IP bible (TCP/IP illustrated) knows this. All you have to configure on a router is IP UNICAST REVERSE PATH, in combination with cisco CEF. Then all packets that are routed are inspected. If the sender address (the From IP address) is in the routing table, it is checked to see if the router would route it the packet would have been send over the same interface the packet orginated from. If so, the sender is valid and the packet is routed, if not, it is proabbly a forged packet and it is dropped. That simple, one command and there is no IP spoofing anymore. In 1998 cisco released this feature I think, a decade ago!

All ISP's (at least in the Netherlands) have this kind of ingress filtering acitvated on their routers since a decade, it is impossible to spoof and route a packet in the Netherlands and most parts of the world for that matter.

I remember though that Casema (which I used as a cable modem provider between 1996-2001) didnt have this feature for some time. You could route a packet towards 1.1.1.1 with the sender address 10.255.255.255. 1.1.1.1 would give an "ICMP unreachable message" from the border routers of casema and it would be send towards the complete internal network -all systems- of Casema creating a kind of internal DoS.

But to publish this article one decade after a decade seems like rerunning old stories. 10 years is on the net a lifetime.

The Day the routers died

Mon, 05 Nov 2007 05:08:05 +0100

Back in the old days... I did some netmastering for AS1136 (now AS286). And while I am not in to routing anymore, I still like this song performed at the RIPE 55

So bye bye, folks at RIPE 55
Be persuaded to upgrade it or your network will die
IPv6 just makes me let out a sigh
But I spose we'd better give it a try
I suppose we'd better give it a try

See also the grow of the internet and a report from cisco on IPv4 and v6

Other funny quotes:
* ...and all my traceroutes showing stars
* Saw a man with whom I used to peer
* My Cisco shares completely worthless

How Skype bypasses Firewalls and NAT

Sat, 18 Aug 2007 04:32:32 +0200

Some time ago I blogged about the excellent Skype Blackhat presentation. Now you can read on Heise how Skype bypasses NAT and firewall, something that is rather trickey with open standards VOIP protocols.

How Skype get round firewalls

But anyone who has used the popular internet telephony software Skype knows that it works as smoothly behind a NAT firewall as it does if the PC is connected directly to the internet. The reason for this is that the inventors of Skype and similar software have come up with a solution.

Half Duplex ADSL Modem

Sun, 10 Sep 2006 11:30:36 +0200

Since my girlfriend and I are expecting another baby due around 20 November, Brecht will move from here current babyroom to the room that was used by me. So all my computers had to move as well. Last weekend we redid the wooden floor again (oiling), this weekend I moved my computers to the second floor. I rewired the PSNT/ADSL, moved my computers (closed the current case of Willt, this website since it had one harddisk outside), did the switches, the wireless etc. Then I booted and sure enought Linux was comming up fine. And even the ADSL worked, like a charm. Or so it seems.

The connection was very very slow. I open standard some 20 sites in firefox on my laptop and they loaded like when I had PSTN or even worse casema cable in the late 90ies. Showing Pat and mat videos to my doughter (buurman en buurman for the Dutch) from youtube, I found out that the loading took longer then the display time, not normal for the quality connection I have to XS4ALL. Doing some speedtest I saw that my download speed dropped from the normal 4Mb to 200Kb while my upstream capacity stayed at 600Mb (no torrents in the background).

And even worse, when I was doing a huge test download, the ADSL connection dropped after 10 seconds I had a link, so I had to shut the interface on my Linux box or my ADSL modem just to have 10 seconds of slow internet connection. Try to troubleshoot your connection without having a one!

Since I did some netmastering back in the 90-ies, I knew I was going to solve this one. The first thing I saw was that not the ADSL connection was dropping but the ethernet from my Linux box to my ADSL router. So it was local and should be easy to solve. Somehow, the link on my eth1 going to my modem was 10Mb full duplex auto negotiate. Now autonegotiate is bad and if you know the wirespeed on both sides, never use it!

So once I did a

ethtool -s eth1 speed 10 duplex half autoneg off

and the line was stable and fast again! I dont know how the wrong speed was changed. But I am sure glad to be online again. And I might have solved some other problems my website has as well. I'll keep you posted.

Howto make a crossover ethernet

Thu, 27 Apr 2006 02:43:45 +0200

Best Howto make a crossover ethernet cable I have seen...

Ed W aka Mr-T big plans...you are not going to like it...

Tue, 18 Apr 2006 17:38:39 +0200

I don't have a lot of time but read this Analysis by the Salon of the rumblings of Ed Whitacre (AT&T CEO) about a multi-teared Internet where content suppliers would have to pay to use Ed's pipes to deliver the content to your home..

After the merger with Bell South and with Verison on T's side the "Ma Bell re-incarnate" will control a large portion of the access into American homes.. It is a clever play because they will be extract money from the consumer through the triple play set-top box nonsense and on the other side from the content producers

I am sure Ed already figured out that he doesn't need the networks (ABC/NBC etc) at all if he can control the internet access to the consumer--access to the scarce medium of tv-broadcasting was what gave the networks their power..

In effect they will create the walled garden without a need to put a lock on the door because it is only dirt-roads outthere...

Ed W comes across a friendly and open southerner with an Texan accent but unlike the other W he is a very clever and sly..

And I don't think this a US only threat...every European broadband Telco/cable company is watching this one with a lot of interest..finally a way to regain control over these pesky consumers who don't want to play their little triple play game...

As the guys from Internet2 point out there is not a lot of technical need for a QOS/CoS Internet. An architect from Cisco told me once that QoS/CoS is poor substitute for bandwidth; using bigger pipes was going to make the client a lot happier. But Cisco makes more money selling expensive routers and management platforms (and consultantcy). Besides Cisco is better in making clever kit than making fast kit..

(and yes the Salon ad is very annoying...deal with it..)

My WiFi

Sun, 05 Mar 2006 13:02:33 +0100

I havent spend much time finishing my PVR. But I did replace an old 10Mb hub and 11Mb accesspoint with a new b/g linksys accesspoint. No problems there, couple of minutes. The Windows install disk sucked camels ass though. The problem was that I use 10.0.1.0/24 inside where the default IP of the AP box was 192.168.1.1. As I said, couple of minutes.

I wanted to change the old AP (Asus 802.11b) to a client so it's ethernet can wire my PVR box. That want as trivial and didnt work out, will take a look at it later. However, I have now a full 100Mb switched network at home (wheee1) instead of an old 10Mb half duplex. And the new AccessPoint has both G and B and I was surpissed to find that my new laptop did G as well. So my internal network is once again up to speed with my internet connection. I have 4 Mb down so my fixed and wireless ethernet were becomming the slowerparts of my internetwork connection.

Ping from the world

Thu, 15 Dec 2005 09:11:55 +0100

just ping. Ping a server or web site using our network with 10 checkpoints worldwide. Check for yourself: Ping a server or web site using our network with 10 checkpoints worldwide.

Linux TCP/IP Help (I needed it, once I was back online :-( )

Sat, 24 Sep 2005 03:53:25 +0200

Some good documents regarding TCP/IP for linux can be found all over the web, but how to access it when you cant connect?
Linux Tutorial - Linux Network Administration

This tutorial covers TCP/IP networking and system configuration basics. Linux can support multiple network devices. The device names are numbered and begin at zero and count upwards.

I made a local copy... just in case.

TCP/IP and more protocols explained

Sun, 07 Aug 2005 12:56:03 +0200

I used to be a [netmaster] but nowadays I'm not into TCP/IP anymore, still TCP/IP Tutorial and Technical Overview is a good read for those who want to bluff their way into the internet.

Cisco Security

Sun, 13 Feb 2005 09:08:03 +0100

A nice rant about Cisco becomming MSFT at
attrition

Most professionals in the security industry have long since given up on vendors such as Microsoft and resigned ourselves to the fact that they don't understand security, and that for all the marketing and PR these companies never will. Year after year, we see stupid and trivial security bugs pop up in their software. Often times these are the same vulnerabilities reborn with a new product, or the same class of vulnerabilities creeping back into the code due to poor programming practices. In other cases, vulnerabilities are found and supposedly patched by vendors. Days or weeks later, it is discovered that the patch does not fully mitigate the original problem and can be bypassed and the software is still vulnerable.

Cisco's Peter Packet

Tue, 18 Jan 2005 05:29:37 +0100

Gee, no wonder the internet is comming to its knees. If this is the way Cisco is teaching the future CCIE's how the net works. This is "TCP/IP Illustrated" to the max I quess

Free Tech Books

Tue, 05 Oct 2004 11:55:28 +0200

As per title, Free Tech books.

Myths of Traffic Management

Wed, 04 Aug 2004 11:52:40 +0200

It is a whitepaper of a vendor, okay. But still it describes the problems one encounters when enabling traffic management in a good way. And the product itself looks okay as well. Found it via a google ad, via Zeus's site; the PDF

BGP4

Wed, 14 Apr 2004 21:46:00 +0200

A rather good site about BGP4, The Border Gateway Protocol that feeds the internet