May 1998 - NANOG - lists.nanog.org

One more smurf amp fixed
by darcy＠druid.net 01 May '98

01 May '98

I had contacted BBNPlanet about some of their networks being involved in a smurf attack. As a result they have fixed 137.49. iIf you have this one in a block list you can take it out. They have been asking one of their customers with 143.132 to fix their routers. So far that second one is still amplifying. Oh well. One by one we'll get them all. -- D'Arcy J.M. Cain <darcy(a){druid|vex}.net> | Democracy is three wolves http://www.druid.net/darcy/ | and a sheep voting on +1 416 424 2871 (DoD#0082) (eNTP) | what's for dinner.

1 0

Re: More amplifier blocks
by Chuck Davisson 01 May '98

01 May '98

Hi folks, > 204.183.36 11 is mine and is now fixed. Sorry for the problem. Must have missed this interface. Chuck Davisson Network Engineer TTSG

1 0

The Cidr Report
by Tony Bates 01 May '98

01 May '98

This is an auto-generated mail on Fri May 1 12:00:00 PDT 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 01May98 0) General Status Table History ------------- Date Prefixes 240498 51504 250498 51831 260498 51362 270498 51498 280498 51499 290498 51512 300498 51446 010598 51507 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 3510 Number of ASes announcing only one prefix: 1656 (861 cidr, 795 classful) Largest number of cidr routes: 371 announced by AS3561 Largest number of classful routes: 1116 announced by AS701 1) Gains by aggregating at the origin AS level --- 01May98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS2493 638 396 242 37.9% iSTAR Internet, Inc. AS4293 442 218 224 50.7% IMCI AS816 678 459 219 32.3% UUNET Canada (ASN-UUNETCA-AS4) AS174 798 615 183 22.9% Performance Systems International AS701 1116 938 178 15.9% Alternet AS3602 482 309 173 35.9% Sprint Canada Inc. AS3749 219 64 155 70.8% TECNET AS8505 156 30 126 80.8% Middle East Technical University AS7046 256 151 105 41.0% UUNET-CUSTOMER AS5668 118 46 72 61.0% Century Telephone Inc. AS2048 162 90 72 44.4% LaNet AS3221 110 41 69 62.7% EENet Autonomous System AS10928 106 46 60 56.6% UNKNOWN AS271 111 52 59 53.2% BCnet Backbone AS4755 90 32 58 64.4% Videsh Sanchar Nigam Ltd. India AS3804 200 142 58 29.0% Bell Solutions AS1239 555 500 55 9.9% SprintLink Backbone AS549 210 156 54 25.7% ONet Backbone AS1221 275 224 51 18.5% AARNET-AS AS72 84 36 48 57.1% Schlumberger Information Network AS4763 123 76 47 38.2% Telstra New Zealand AS7545 104 58 46 44.2% TPG Internet Pty Ltd AS684 95 53 42 44.2% Manitoba Regional Network Backbon AS852 157 117 40 25.5% AGT Advance Communication AS4740 365 325 40 11.0% ASN-OZEMAIL (Ozemail Pty Ltd) AS4200 131 93 38 29.0% AGIS (Apex Global Information Ser AS3493 163 125 38 23.3% INTERLINK AS6392 69 32 37 53.6% MidWest Communications, Inc. AS803 72 36 36 50.0% SaskNet Backbone AS6335 63 27 36 57.1% NTRNET For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

[Fwd: [Fwd: More amplifier blocks]]
by Jan Czmok 01 May '98

01 May '98

1 0

RE: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
by Dennis Simpson 01 May '98

01 May '98

So that's how we wound up on your list! Please remove any addresses you have for us. We are quite diligent about this, and you are most welcome to test us for smurf sourcing any time. It should definitely not work. Current addresses: 205.189.200/23 205.210.186/23 206.130.244/23 209.212.32/19 Old addresses we no longer use and will be turning back in by June: 204.50.247/24 206.107.177/23 206.186.216/23 209.5.14/23 209.50.76/22 209.50.80/22 If you are smurfed by any our downstreams on any address belonging to one of our blocks, let us know, and we will take steps to prevent their being a participant in a smurf attack. Thx, dennis > From: NOC <NOC(a)mercury.balink.com> > To: "'Erik Muller'" <nc0773(a)corp.netcom.com> > Cc: "'nanog(a)merit.edu'" <nanog(a)merit.edu> > Subject: RE: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!! > Date: Thu, 30 Apr 1998 15:44:58 -0400 > MIME-Version: 1.0 > Content-Transfer-Encoding: 7bit > > Erik, > > The script I wrote isn't really that smart... It just looks for two IP's > within the same /24 that were sending some kind of ICMP packet to the > victim machine. Since NetFlow logs don't break ICMP down to the type > and codes, I had to unilaterally make that decision. If your network is > clean, I sincerely apologize for any embarrassment or hassle this may > have caused, and I will remove it from the list. > > Regards, > Christian > > >-----Original Message----- > >From: Erik Muller [SMTP:nc0773@corp.netcom.com] > >Sent: Thursday, April 30, 1998 12:14 PM > >To: Martin, Christian > >Subject: Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!! > > > > > >> 163.179.230.0 > > > >This one's mine... the entire /24 is broken down as /30s, and .255 will > >respond with nothing more sinister than an ICMP unreachable. Any details > >on what results you saw that pointed to this network as an offender would > >be appreciated (since I can't see any danger from it). > > > >--------------------------------------------------------------------------- - > >Erik Muller, Network Engineer emuller(a)noc.netcom.net > >NETCOM Network Services Support NETCOM On-Line Communication Services > > > > > >On Wed, 29 Apr 1998, Martin, Christian wrote: > > > >> All, > >> > >> Here is my contribution to the block list. The script that generated > >> this will follow. It is 'public domain', in that it can be modified, > >> BUT, please give credit where credit is due! > >>

1 0

RE: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
by Douglas E. Pickett 30 Apr '98

30 Apr '98

> 199.243.210.0 Sorry, that's one of mine, but it should be fixed up now. Regards, Doug.

1 0