Newsgroups: bit.listserv.big-lan
Date:         Fri, 6 Nov 1992 10:35:35 EST
From:         BIG-REQ@SUVM.BITNET
Subject:      BIG-LAN Digest, Volume 4, Number 74, Friday, November 6, 1992

BIG-LAN DIGEST           Friday, 6 November 1992       Volume 4 : Issue 74

Today's Topics:

                           Pocket analyzers (A)
               RE: Survey & Disaster Recovery Plans Request
                                ARP Storms
                      NOVELL & Security Summary # 1

Moderated by John Wobus, Syracuse University

Relevant addresses:
                                  Internet                BITNET
Submissions:              big-lan@suvm.acs.syr.edu     BIG-LAN@SUVM
Subscriptions:    big-lan-request@suvm.acs.syr.edu     BIG-REQ@SUVM
LISTSERV/Archives:       listserv@suvm.acs.syr.edu    LISTSERV@SUVM
Moderator:                jmwobus@syr.edu              JMWOBUS@SYREDU
Anonymous ftp archives:           syr.edu

Note: BIG-LAN is redistributed through many mailing lists at other sites
run by other individuals.  If you subscribe(d) through such a
"redistribution" list, you will need to remember its owner.

syr.edu also has a copy of the BIG-LAN "FAQ" memo (answers to frequently
asked questions) under the path information/big-lan/big-lan.faq

BIG-LAN is also available via netnews, through newsgroup
bit.listserv.big-lan.

----------------------------------------------------------------------

Date: 04 Nov 92 18:22 GMT
From: KEE@AppleLink.Apple.COM (Radiant Enterprises, K Nethery,PAS)
Subject:      Pocket analyzers (A)

I use both EtherPeek from the A.G. Group (ag.group@applelink.apple.com) and
NetMinder Ethernet from Neon Software (neon.sw@applelink.apple.com).

Both analyzers run on Macs with ethernet cards. I find it easy to carry my
analyzers around in my pocket (pocket analyzers) on two floppies and to use any
ethernet Mac I happen to be near. I also find their filtering and packet
decoding to be much easier to use than most of the other analyzers in boxes.
There is only one network that I don't use these on. This one network routinely
exceeds 40% bandwidth usage and neither of these analyzers handle above that
amount. But otherwise, these two software analyzers are my preference.

Kee Nethery                           Radiant Enterprises Inc.
Kee@applelink.apple.com               "We make LocalTalk gadgets"

-------------------------------------------------------

Date: Wed, 04 Nov 92 08:44:36 -0800
From: Louis Grandieri <loug@nevada.edu>
Subject:      RE: Survey & Disaster Recovery Plans Request


 RE: Survey:
 -----------

    I hope all the responses will be posted for these survey questions.

    These are the questions that need to be asked in order to help solve
the problems we all face in trying to manage a campus network. Just because
the LAN is stable today doesn't mean that additional manpower is not needed.

    My bigest problem is convincing top maangement that I need additional
help to get cables labled, documentation written on what we have out on
the network and breathing space to do long term planning.

 Disaster Recover Plans Request:
 -------------------------------

     I could use some help on disaster planning. I've been tasked to survey
the network for plans and options in the area of disater preparedness. If
anyone has a document covering diaster recovery for networks, I'd appreciate
your input.

     If you E-Mail it, make sure it is straight ASCII text.

Thanks in advance.
Lou Grandieri

- ---------------------------------------------------------------------------
    ________      loug@nevada.edu
   |        |     Louis Grandieri, UNC-300
   | NEVADA |     Mgr., Telecommunications South
    \       |     UCCSN (University and Community College System of Nevada)
      \     |     System Computing Services
        \ * ;     4505 S. Maryland Parkway
          \|      Las Vegas, NV  89154-4016
                  (702) 895-4525   FAX (702) 895-3791
===========================================================================

-------------------------------------------------------

Date:      Thu, 5 Nov 1992 10:49:43 EST
From:      "Jerry Bryan" <BRYAN%WVNVM.BITNET@SUVM.SYR.EDU>
Subject:      ARP Storms

I have heard the term "ARP Storm" for years.  I know approximately
what it is, but not precisely.  I wonder if there is a good executive
summary (say, 100 to 200 words) that would describe an ARP storm and
its causes that could be posted.  For example, is there a FAQ which
discusses ARP storms?

To give you a feel for the level of detail I am looking for, I do
understand that on a TCP/IP ethernet an ARP is a broadcast
packet requesting a translation of an IP address into a MAC address.
I further understand that all the network nodes save one are expected
to ignore the ARP packet, and that the node corresponding to the
proper IP address is supposed to respond with a packet containing
its own MAC address.  Is my "understanding" basically correct?
If not, please correct me.  If so, please explain how such a simple
mechanism can result in something so disruptive as an "ARP storm".
Thanks in advance.

-------------------------------------------------------

Date: Wed, 04 Nov 92 14:09:55 EST
From: WILLIAM LEE JR. BAKER <wlbaker%h22ccmail@relay.nswc.navy.mil>
Subject:      NOVELL & Security Summary # 1

Replies to date from:
From: C604441@MIZZOU1.missouri.edu
From: VKATROS%BENTLEY.BITNET@mitvma.mit.edu
From: dlv@dm.com
From: rsmith@baker.ds.boeing.com (Randall E Smith)

ORIGINAL MESSAGE:  <dated 10/21/93>

       I would like to start a discussion about nework and computer/
   operating system security.
       The trade press has been Novell bashing lattly that I think it
   is in _PART_ unearned.  It is true that Novell should fix any security
   hole as fast as possible at no charge to its customers.
       I think it is unfair to give Novell all the blame because they must
   use a workstation as part of their network that has ___NO___ security.
   How can Novell be expected to have a secure NOS when the OS they are
   building from has no security???
       Its time for Microsoft, IBM, SCO and/or others to develop a
   replacement to PC-DOS <32-bit OS> that by default has all the security
   for a standalone computer to be given a A1, or A2 NCSC clearence.
       It is also a given that the ?system manager? should be able to
   remove some or all of the security at instalation or any future date.

Replies and my comments(Name of message author removed):

>I was very curious about these reported security problems, can you tell me
>where I can read about these issues or can you give me some information on how
>the weakness in the DOS/workstation OS contributes to this problem?

   I am sorry to reply that I have no information on the method of the attack
   other than what has be written in the "Trades" such as Federal Computer
   Week.  If anyone needs this information the best source for the data
   would be NOVELL INC, but be ready to show a __VERY_STRONG_NEED__



>I received a note from one of the lists I keep track of, and saw that
>MS is releasing a new version of MS-DOS, 6.0 in 1993, that is *supposed*
>to incorporate networking, etc....
>
>They (MS) is also *supposed* to be releasing a version of DOS that
>will support 32bit operations.  No clue on a release date.

   I have also heard about MS-DOS 6.0 and Windows NT, but have not
   heard if they solve the __VERY_BIG_PROBLEM__ of no security on
   the workstation, have you or anyone else heard????



>    I must agree in principle with your recent network posting about
>Novell and security.  I've been involved in a project to develop secure
>networks at the NCSC A1 level of assurance for the past 8 years and while
>there is an interest in developing A1 products, it is very costly and
>time consuming.  Just to clarify a point, the NCSC provides 'evaluations'
>of computer security products, not 'clearances.'  Also, their highest
>defined category is A1, no one has yet to provide any requirements for
>an A2 evaluation.  Products evaluated against the 'B' criteria (B1, B2,
>or B3) provide multilevel security, or separation between information
>at different security levels.  Products evaluated against the 'C' criteria
>(C1 or C2) provide some form of tracabililty of actions back to the
>originator of the actions.
>
>    As you suggested, a computer system (i.e.: collection of computing
>equipment) is only as secure as it's weakest component.  Running a secure
>networking product on top of a flawed operating system provides many
>opportunities for an attacker.  The security provided by operating systems
>vendors (e.g.: Microsoft, IBM, SCO, ...) is improving.  SCO sells a B1
>version of Unix, while Microsoft is currently working on the security
>features of their new WindowsNT, possibly targeted at the B2 level of
>assurance.


   If A1 is the best then A1 is the best but I think the "goal" should
   be "better than the best".


>One of my clients as a 6-node LAN which I set up. It's now running OS/2 2.0
>(and a little DOS) under IBM Lan server.  Security is a problem under OS/2!!!
>
>For starters, if a user is using a computer 'locally', he's got access to
>'everything'.  We've had a user come locally to the server and f-- aound
>with it, changing system settings, interfering with network printing, crashing
>the net a number of times, etc.  Telling him to stop had no effect.
>Complaining to the management had no effect.  We've had to physically lock
>the darn thing!!!
>
>Also, there's no way to prevent users from doing essentially anything they
>like to their workstations. OS/2 can't stop users from creating oodles of
>junk files in the root directory until it reaches the 512-file limit, or
>from deleting important device drvers from config.sys (and they do!).
>Of course this is not limited to OS/2 and would have been _much_ worse
>under DOS/LoseDoze.
>
>At the end of the month IBM will supposedly supply us with a local security
>hack (part of advanced lan server) but, as far as I can judge from the docs,
>it's a pain in the ass to use.
>
>We've been talking for some time about switching to some Unix derivative
>(we've had OS/2 since 1.0, 1989), and the lack of security is one of the
>major reasons. Instead of calling for a creation of yet another OS, how
>about calling for a bug-free, cheap, secure Unix-like system, like BSD
>(boycott AT&T!) ?


  I for one do not care if the "Security" OS I would like to see built
  is UNIX, DOS, VMS or anyother OS,  I just want a VERY security intensive
  OS that can ___run___ MS-DOS 3.x, 4.x, 5.x, x.x programs.  My main gripe
  is not cost but the ___VERY_VERY_BIG___ seciruty hole in the network
  ___AND___ stand-alone computer system(s) that NO security leaves.

  As for bug-free, dream on, no software package is bug-free.  That is an
  impossible goal, but a goal that all software developers _SHOULD_ aim for.



-------------------------------------------------------


End of BIG-LAN Digest
*********************