From mailnull@www1.ietf.org Fri Jan 3 13:22:54 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15316 for ; Fri, 3 Jan 2003 13:22:54 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h03IVkB13357 for rpsec-archive@odin.ietf.org; Fri, 3 Jan 2003 13:31:46 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h03IVkJ13353 for ; Fri, 3 Jan 2003 13:31:46 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15290 for ; Fri, 3 Jan 2003 13:22:23 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h03IUhJ13243; Fri, 3 Jan 2003 13:30:43 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h03ITjJ13113 for ; Fri, 3 Jan 2003 13:29:45 -0500 Received: from sequoia.muada.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15251 for ; Fri, 3 Jan 2003 13:20:21 -0500 (EST) Received: from localhost (iljitsch@localhost) by sequoia.muada.com (8.11.3/8.9.3) with ESMTP id h03INiq57492 for ; Fri, 3 Jan 2003 19:23:44 +0100 (CET) (envelope-from iljitsch@muada.com) Date: Fri, 3 Jan 2003 19:23:43 +0100 (CET) From: Iljitsch van Beijnum To: Message-ID: <20030103192050.Q53797-100000@sequoia.muada.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [RPSEC] RIPE meeting Sender: rpsec-admin@ietf.org Errors-To: rpsec-admin@ietf.org X-BeenThere: rpsec@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Routing Protocol Security Requirements List-Post: List-Help: List-Subscribe: , Hi, There is a RIPE meeting at the end of the month. This would be an excellent opportunity to see what real-life operators think of routing protocol security in general and the soBGP and S-BGP approaches in particular. Is anyone going? Or maybe some of you have already presented some of this at a NANOG meeting? If so, what were the reactions? Iljitsch _______________________________________________ RPSEC mailing list RPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/rpsec From mailnull@www1.ietf.org Fri Jan 10 10:20:58 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA00421 for ; Fri, 10 Jan 2003 10:20:58 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h0AFXCP06543 for rpsec-archive@odin.ietf.org; Fri, 10 Jan 2003 10:33:12 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0AFXCJ06540 for ; Fri, 10 Jan 2003 10:33:12 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA00410 for ; Fri, 10 Jan 2003 10:20:27 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0AFURJ06429; Fri, 10 Jan 2003 10:30:27 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0AFTbJ06383 for ; Fri, 10 Jan 2003 10:29:37 -0500 Received: from rtp-msg-core-1.cisco.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA00326 for ; Fri, 10 Jan 2003 10:16:52 -0500 (EST) Received: from cisco.com (localhost [127.0.0.1]) by rtp-msg-core-1.cisco.com (8.12.2/8.12.2) with ESMTP id h0AFKpHp013889 for ; Fri, 10 Jan 2003 10:20:51 -0500 (EST) Received: from ruwhite-u10.cisco.com (ruwhite-u10.cisco.com [64.102.48.251]) by cisco.com (8.8.8/2.6/Cisco List Logging/8.8.8) with ESMTP id KAA02820 for ; Fri, 10 Jan 2003 10:20:09 -0500 (EST) Date: Fri, 10 Jan 2003 10:20:09 -0500 (EST) From: Russ White Reply-To: Russ White To: rpsec@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [RPSEC] IETF Agenda.... Sender: rpsec-admin@ietf.org Errors-To: rpsec-admin@ietf.org X-BeenThere: rpsec@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Routing Protocol Security Requirements List-Post: List-Help: List-Subscribe: , Anyone have any agenda items for the next IETF meeting? How are we on merging the threats drafts? Any other drafts we need to present? :-) Russ __________________________________ riw@cisco.com CCIE <>< Grace Alone _______________________________________________ RPSEC mailing list RPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/rpsec From mailnull@www1.ietf.org Mon Jan 20 15:53:43 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00340 for ; Mon, 20 Jan 2003 15:53:43 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h0KLAtD14333 for rpsec-archive@odin.ietf.org; Mon, 20 Jan 2003 16:10:55 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0KLAtJ14330 for ; Mon, 20 Jan 2003 16:10:55 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00314 for ; Mon, 20 Jan 2003 15:53:12 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0KLADJ14301; Mon, 20 Jan 2003 16:10:13 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0KL6AJ13526 for ; Mon, 20 Jan 2003 16:06:10 -0500 Received: from web40705.mail.yahoo.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id PAA00217 for ; Mon, 20 Jan 2003 15:48:26 -0500 (EST) Message-ID: <20030120205151.1610.qmail@web40705.mail.yahoo.com> Received: from [129.10.115.162] by web40705.mail.yahoo.com via HTTP; Mon, 20 Jan 2003 12:51:51 PST Date: Mon, 20 Jan 2003 12:51:51 -0800 (PST) From: feng zhu To: manet@ietf.org, rpsec@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Subject: [RPSEC] Security for Ad hoc Networks (including Sensor Networks) Sender: rpsec-admin@ietf.org Errors-To: rpsec-admin@ietf.org X-BeenThere: rpsec@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Routing Protocol Security Requirements List-Post: List-Help: List-Subscribe: , Hi, I have updated my reading list of Security for Ad hoc Networks (including Sensor Networks). http://www.ccs.neu.edu/home/zhufeng/security_manet.html The page contains a list of papers on security for ad hoc networks, including security for Routing Protocols; Key Exchange, Distribution and management, security for Group Communication and Multicast, security for Sensor Network and so on. Hope it helpful for your research. Best, -- Feng ===== ============================== ZHU, Feng zf_manet@yahoo.com http://www.ccs.neu.edu/home/zhufeng/security_manet.html __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com _______________________________________________ RPSEC mailing list RPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/rpsec From mailnull@www1.ietf.org Fri Jan 31 16:57:21 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA20095 for ; Fri, 31 Jan 2003 16:57:21 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h0VM13622289 for rpsec-archive@odin.ietf.org; Fri, 31 Jan 2003 17:01:03 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0VM12J22286 for ; Fri, 31 Jan 2003 17:01:02 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA20079 for ; Fri, 31 Jan 2003 16:56:50 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0VM0SJ22257; Fri, 31 Jan 2003 17:00:28 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h0VLx0J21923 for ; Fri, 31 Jan 2003 16:59:00 -0500 Received: from web40507.mail.yahoo.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id QAA19961 for ; Fri, 31 Jan 2003 16:54:48 -0500 (EST) Message-ID: <20030131215821.29375.qmail@web40507.mail.yahoo.com> Received: from [131.123.39.19] by web40507.mail.yahoo.com via HTTP; Fri, 31 Jan 2003 13:58:21 PST Date: Fri, 31 Jan 2003 13:58:21 -0800 (PST) From: Hasan Gobjuka To: rpsec@ietf.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-27605528-1044050301=:28606" Subject: [RPSEC] Accessing topology-related information behind firewalls Sender: rpsec-admin@ietf.org Errors-To: rpsec-admin@ietf.org X-BeenThere: rpsec@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Routing Protocol Security Requirements List-Post: List-Help: List-Subscribe: , --0-27605528-1044050301=:28606 Content-Type: text/plain; charset=us-ascii Hello all, Is there any way to get *useful* topology-related information from a firewall-protected network? Thanks, --------------------------------- Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now --0-27605528-1044050301=:28606 Content-Type: text/html; charset=us-ascii

Hello all,

 

Is there any way to get *useful* topology-related information from a firewall-protected network?

 

Thanks,


Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now --0-27605528-1044050301=:28606-- _______________________________________________ RPSEC mailing list RPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/rpsec From mailnull@www1.ietf.org Fri Jan 31 22:03:05 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA25815 for ; Fri, 31 Jan 2003 22:03:05 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h1136q503623 for rpsec-archive@odin.ietf.org; Fri, 31 Jan 2003 22:06:52 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h1136qJ03620 for ; Fri, 31 Jan 2003 22:06:52 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA25801 for ; Fri, 31 Jan 2003 22:02:34 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h1133RJ03547; Fri, 31 Jan 2003 22:03:27 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h1130CJ03480 for ; Fri, 31 Jan 2003 22:00:12 -0500 Received: from rtp-msg-core-1.cisco.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA25733 for ; Fri, 31 Jan 2003 21:55:55 -0500 (EST) Received: from cisco.com (localhost [127.0.0.1]) by rtp-msg-core-1.cisco.com (8.12.2/8.12.6) with ESMTP id h1130Jcc020094; Fri, 31 Jan 2003 22:00:19 -0500 (EST) Received: from ruwhite-u10.cisco.com (ruwhite-u10.cisco.com [64.102.48.251]) by cisco.com (8.8.8/2.6/Cisco List Logging/8.8.8) with ESMTP id VAA12201; Fri, 31 Jan 2003 21:59:27 -0500 (EST) Date: Fri, 31 Jan 2003 21:59:27 -0500 (EST) From: Russ White Reply-To: Russ White To: Hasan Gobjuka cc: rpsec@ietf.org Subject: Re: [RPSEC] Accessing topology-related information behind firewalls In-Reply-To: <20030131215821.29375.qmail@web40507.mail.yahoo.com> Message-ID: References: <20030131215821.29375.qmail@web40507.mail.yahoo.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: rpsec-admin@ietf.org Errors-To: rpsec-admin@ietf.org X-BeenThere: rpsec@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Routing Protocol Security Requirements List-Post: List-Help: List-Subscribe: , My 2c.... I don't really think it depends on a firewall in the middle, really. For instance, if you nat'ing, then you lose all sense of what the network inside the nat looks like (moreso if you are pat'ing, rather than nat'ing). If you are not nat'ing, and you are summarizing your advertisements, then you still lose most of the useful routing information, since you've no idea what subnets are actually reachable, what most of the prefix lengths are, etc. ie--if you have 10.1.0.0/24, 10.1.1.0/24, 10.1.2.0/24, and 10.1.3.0/24 summarizaed into 10.1.0.0/22, then you've lost knowledge of what the broadcast addresses are within the network, and a sense of what servers are located on what segments from just the ip addresses. If, however, you are actually advertising destination subnets in your net, you're probably giving away information you should give away. Hiding information is generally good, I think.... :-) Russ On Fri, 31 Jan 2003, Hasan Gobjuka wrote: > > Hello all, > > > > Is there any way to get *useful* topology-related information from a firewall-protected network? > > > > Thanks, > > > > --------------------------------- > Do you Yahoo!? > Yahoo! Mail Plus - Powerful. Affordable. Sign up now __________________________________ riw@cisco.com CCIE <>< Grace Alone _______________________________________________ RPSEC mailing list RPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/rpsec From mailnull@www1.ietf.org Fri Jan 31 22:14:22 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA25931 for ; Fri, 31 Jan 2003 22:14:22 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h113I9c04491 for rpsec-archive@odin.ietf.org; Fri, 31 Jan 2003 22:18:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h113I9J04488 for ; Fri, 31 Jan 2003 22:18:09 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA25913 for ; Fri, 31 Jan 2003 22:13:51 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h113HwJ04468; Fri, 31 Jan 2003 22:17:58 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h113FgJ04416 for ; Fri, 31 Jan 2003 22:15:42 -0500 Received: from web40501.mail.yahoo.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA25882 for ; Fri, 31 Jan 2003 22:11:23 -0500 (EST) Message-ID: <20030201031457.96546.qmail@web40501.mail.yahoo.com> Received: from [131.123.39.19] by web40501.mail.yahoo.com via HTTP; Fri, 31 Jan 2003 19:14:57 PST Date: Fri, 31 Jan 2003 19:14:57 -0800 (PST) From: Hasan Gobjuka Subject: Re: [RPSEC] Accessing topology-related information behind firewalls To: Russ White Cc: rpsec@ietf.org In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1581716241-1044069297=:96506" Sender: rpsec-admin@ietf.org Errors-To: rpsec-admin@ietf.org X-BeenThere: rpsec@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Routing Protocol Security Requirements List-Post: List-Help: List-Subscribe: , --0-1581716241-1044069297=:96506 Content-Type: text/plain; charset=us-ascii Thank you Russ, Actually I'm trying to develop some algorithm and consecutively some open source tool to detect the topology of large multi-subnet netwroks, and consecutively the Internet in layer-2 (Data link layer), so that the tools will be able to detect non-cooperative nodes like hubs besides routers and other cooperative nodes. I'm not worried much about IP level. Instead, I'm working in the MAC address level. So far, I was able to develop some algorithms to detect layer-2 topology for networks which are not behind a firewall, but I need to get some method to get information about nodes protected by firewall so that I may able to use this information to detect such network's layer-2 topology. Russ White wrote: My 2c.... I don't really think it depends on a firewall in the middle, really. For instance, if you nat'ing, then you lose all sense of what the network inside the nat looks like (moreso if you are pat'ing, rather than nat'ing). If you are not nat'ing, and you are summarizing your advertisements, then you still lose most of the useful routing information, since you've no idea what subnets are actually reachable, what most of the prefix lengths are, etc. ie--if you have 10.1.0.0/24, 10.1.1.0/24, 10.1.2.0/24, and 10.1.3.0/24 summarizaed into 10.1.0.0/22, then you've lost knowledge of what the broadcast addresses are within the network, and a sense of what servers are located on what segments from just the ip addresses. If, however, you are actually advertising destination subnets in your net, you're probably giving away information you should give away. Hiding information is generally good, I think.... :-) Russ On Fri, 31 Jan 2003, Hasan Gobjuka wrote: > > Hello all, > > > > Is there any way to get *useful* topology-related information from a firewall-protected network? > > > > Thanks, > > > > --------------------------------- > Do you Yahoo!? > Yahoo! Mail Plus - Powerful. Affordable. Sign up now __________________________________ riw@cisco.com CCIE <>< Grace Alone _______________________________________________ RPSEC mailing list RPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/rpsec --------------------------------- Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now --0-1581716241-1044069297=:96506 Content-Type: text/html; charset=us-ascii

Thank you Russ,

Actually I'm trying to develop some algorithm and consecutively some open source tool to detect the topology of large multi-subnet netwroks, and consecutively the Internet in layer-2 (Data link layer), so that the tools will be able to detect non-cooperative nodes like hubs besides routers and other cooperative nodes. I'm not worried much about IP level. Instead, I'm working in the MAC address level.

So far, I was able to develop some algorithms to detect layer-2 topology for networks which are not behind a firewall, but I need to get some method to get information about nodes protected by firewall so that I may able to use this information to detect such network's layer-2 topology.

 

Russ White <ruwhite@cisco.com> wrote:


My 2c....

I don't really think it depends on a firewall in the middle, really. For
instance, if you nat'ing, then you lose all sense of what the network
inside the nat looks like (moreso if you are pat'ing, rather than nat'ing).
If you are not nat'ing, and you are summarizing your advertisements, then
you still lose most of the useful routing information, since you've no idea
what subnets are actually reachable, what most of the prefix lengths are,
etc.

ie--if you have 10.1.0.0/24, 10.1.1.0/24, 10.1.2.0/24, and 10.1.3.0/24
summarizaed into 10.1.0.0/22, then you've lost knowledge of what the
broadcast addresses are within the network, and a sense of what servers are
located on what segments from just the ip addresses.

If, however, you are actually advertising destination subnets in your net,
you're probably giving away information you ! should give away.

Hiding information is generally good, I think....

:-)

Russ


On Fri, 31 Jan 2003, Hasan Gobjuka wrote:

>
> Hello all,
>
>
>
> Is there any way to get *useful* topology-related information from a firewall-protected network?
>
>
>
> Thanks,
>
>
>
> ---------------------------------
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now

__________________________________
riw@cisco.com CCIE <>< Grace Alone

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec


Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now --0-1581716241-1044069297=:96506-- _______________________________________________ RPSEC mailing list RPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/rpsec