October 2003 - NANOG - lists.nanog.org

OT: Chicago field trip, late tonight...
by Bill Woodcock 21 Oct '03

21 Oct '03

In November, 2000, the radio show This American Life condensed twenty-four hours of life in a Chicago neighborhood 24-hour cafe into a one-hour show. This cafe was the site of notable quantitative experiments demonstrating that rotating pies sold significantly better than static ones. We may wish to independently corroborate their results using the same data source. I propose that we conduct this experiment at midnight, tonight. The Golden Apple cafe can be reached on the El, Chicago's elevated railway: http://www.transitchicago.com/maps/maps/F2003N.html Wellington on the Brown Line or Scheffield on the Purple Line (same station). The This American Life radio show, with a textual abstract and full version in Real Audio: http://207.70.82.73/pages/descriptions/00/172.html A restaurant review: http://entertainment.metromix.chicagotribune.com/top/1,1419,M-Metromix-Rest… And a driving map, in case you don't like the train: http://www.mapquest.com/directions/main.adp?go=1&do=nw&ct=NA&1y=US&1a=540+n… If folks like, they can meet in the lobby of the Marriott at 11:20pm. -Bill

1 0

Heads-up: AT&T apparently going to whitelist-only inbound mail
by Jeff Wasilko 21 Oct '03

21 Oct '03

----- Forwarded message ----- Return-Path: <rm-antiattspam(a)ems.att.com> Message-ID: <3F80414B002D0EC2(a)attrh0i.attrh.att.com> (added by postmaster(a)attrh1i.attrh.att.com) Content-Disposition: inline Content-Transfer-Encoding: binary Content-Type: text/plain MIME-Version: 1.0 X-Mailer: MIME::Lite 2.102 (B2.12; Q2.03) Date: Tue, 21 Oct 2003 20:21:50 UT Subject: *** ACTION: IP Address of Outbound SMTP Server Requested (Updated 10/21/03) From: rm-antiattspam(a)ems.att.com AT&T Business Partners & Customers AT&T has received many of the requested IP addresses in response to an e-mail originally broadcast yesterday to our business partners and clients. However, we have also received many concerned responses to the original request. This 2nd e-mail is to let you know that this is a legitimate AT&T request asking for your cooperation, which will let us improve the service that AT&T offers you and that our partnership requires. We have provided a toll-free number below to help you confirm the legitimacy of this request. We have assembled the distribution list for this e-mail by looking up the administrative contacts for each of the known e-mail domains we currently exchange e-mail with, referencing WHOIS and other such services available via the Internet. What AT&T is asking is for you to help AT&T to restrict incoming mail to just our known and trusted sources (e.g., business partners, clients and customers). Therefore, we need to know which IP address(es) are used by your outbound e-mail service so we can selectively permit them. Please send this information to the following e-mail address (rm-antiattspam(a)ems.att.com) If you need assistance determining what these IP addresses are, please contact your company's administrative e-mail server support / network administration personnel. We regret that AT&T is burdening you with this request, but our AT&T security team is advising that we take this step to help safeguard our e-mail systems, which ultimately will help us serve you better. Please contact us with any concerns or questions: AT&T Security Help Desk 1-800-456-4230, prompt 4 (8am - 10pm est) Thank you for your prompt attention to this matter. We appreciate your cooperation. Sincerely, Brian Williams, IP Network Services Tim Scholl - District Manager, IP Network Services Kevin O'Connell - Division Manager, Information Technology Services Engineering Bill O'Hern - Division Manager, Network Security ----- Original Message (Sent Monday, 10/20/03) ----- AT&T has an urgent situation with our anti-spam list. In order to continue to allow email to AT&T you need to provide the IP addresses of all your outbound email gateways. If you do not respond immediately, your access may not continue. The required information should be sent to rm-antiattspam(a)ems.att.com. ----- End forwarded message -----

6 6

Re: Heads-up: AT&T apparently going to whitelist-only inbound mail
by Jamie Reid 21 Oct '03

21 Oct '03

I'm not sure whether shadenfreude is the right word, however, it seems that, regarding a previous conversation about cutting off users infected with viruses, ATT has decided that putting a bit of stick about is the right thing to do. It will be very interesting to see how this works out, as it may set a very big precedent. I just hope that they do it subnet by subnet over time instead of all at once, so that the interruption can be isolated brifly to small areas over a longer period of time. I don't envy their customers, or their security department for having to resort to this, but we should all be watching for the results, as it may make or break the case for dealing with user sites that expose the network to risk. Best, -j -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "Jeff Wasilko" <jeffw(a)smoe.org> 10/21/03 05:24pm >>> ----- Forwarded message ----- Return-Path: <rm-antiattspam(a)ems.att.com> Message-ID: <3F80414B002D0EC2(a)attrh0i.attrh.att.com> (added by postmaster(a)attrh1i.attrh.att.com) Content-Disposition: inline Content-Transfer-Encoding: binary Content-Type: text/plain MIME-Version: 1.0 X-Mailer: MIME::Lite 2.102 (B2.12; Q2.03) Date: Tue, 21 Oct 2003 20:21:50 UT Subject: *** ACTION: IP Address of Outbound SMTP Server Requested (Updated 10/21/03) From: rm-antiattspam(a)ems.att.com AT&T Business Partners & Customers AT&T has received many of the requested IP addresses in response to an e-mail originally broadcast yesterday to our business partners and clients. However, we have also received many concerned responses to the original request. This 2nd e-mail is to let you know that this is a legitimate AT&T request asking for your cooperation, which will let us improve the service that AT&T offers you and that our partnership requires. We have provided a toll-free number below to help you confirm the legitimacy of this request. We have assembled the distribution list for this e-mail by looking up the administrative contacts for each of the known e-mail domains we currently exchange e-mail with, referencing WHOIS and other such services available via the Internet. What AT&T is asking is for you to help AT&T to restrict incoming mail to just our known and trusted sources (e.g., business partners, clients and customers). Therefore, we need to know which IP address(es) are used by your outbound e-mail service so we can selectively permit them. Please send this information to the following e-mail address (rm-antiattspam(a)ems.att.com) If you need assistance determining what these IP addresses are, please contact your company's administrative e-mail server support / network administration personnel. We regret that AT&T is burdening you with this request, but our AT&T security team is advising that we take this step to help safeguard our e-mail systems, which ultimately will help us serve you better. Please contact us with any concerns or questions: AT&T Security Help Desk 1-800-456-4230, prompt 4 (8am - 10pm est) Thank you for your prompt attention to this matter. We appreciate your cooperation. Sincerely, Brian Williams, IP Network Services Tim Scholl - District Manager, IP Network Services Kevin O'Connell - Division Manager, Information Technology Services Engineering Bill O'Hern - Division Manager, Network Security ----- Original Message (Sent Monday, 10/20/03) ----- AT&T has an urgent situation with our anti-spam list. In order to continue to allow email to AT&T you need to provide the IP addresses of all your outbound email gateways. If you do not respond immediately, your access may not continue. The required information should be sent to rm-antiattspam(a)ems.att.com. ----- End forwarded message -----

1 0

News peering/feeding?
by Drew Weaver 21 Oct '03

21 Oct '03

I know back in the good old days this used to be fairly common, but does anyone still trade news feeds/peering? We just upgraded our NNTP system and have noticed that the incoming feeds we're receiving are a tad incomplete. So we would like to add a few more feeds. Thanks, -Drew

1 0

netgear sntp followup, embedded address I-D
by Dave Plonka 21 Oct '03

21 Oct '03

NANOG folks, I'm posting this as a followup invitation for feedback regarding the SNTP anycast operational strategy I proposed in this talk: http://www.nanog.org/mtg-0310/plonka.html http://net.doit.wisc.edu/~plonka/nanog/nanog29/ [formats other than PDF] The new Internet Draft I mentioned, "Embedding Globally Routable Internet Addresses Considered Harmful", can be found here: http://net.doit.wisc.edu/~plonka/embed-addr/ (it hasn't shown up on the IETF internet-drafts site yet) If you have feedback that would benefit from the group's review, please follow-up in the nanog mailing list, otherwise email me personally. Thanks, Dave -- plonka(a)doit.wisc.edu http://net.doit.wisc.edu/~plonka ARS:N9HZF Madison, WI

1 0

data request on Sitefinder
by Steve Bellovin 21 Oct '03

21 Oct '03

The session this morning ran out of time, so I didn't get to ask my question. Verisign's review panel has identified a number of problems -- I won't argue if they're minor or not -- that are addressable with software changes. We heard this morning that Postfix is an application that will need to be changed to handle the proposed new version of Sitefinder's MX record. Of course, it's generally considered a good idea to test sofware before deploying it. So -- how much notice would the operator community want before deploying new software? What about for enterprises? (We all know that stuff *can* be deployed more quickly in emergency circumstances. We also know the problems that that can lead to, which is why we generally want testing and controlled deployment.) --Steve Bellovin, http://www.research.att.com/~smb

16 33

Next hop issues inside AS852 ?
by Mike Tancsa 21 Oct '03

21 Oct '03

Anyone seeing any problems getting to AS852 ? I think the problem is coming back, as I can throw packets out to them and they seem to come back fine via 6539. However, going out and coming back via 852 seems to be hosed for me. (AS11647) From their routeserver, route-views.on>show ip bgp 64.236.16.52 BGP routing table entry for 64.236.16.0/20, version 1861266639 Paths: (2 available, best #2) Advertised to non peer-group peers: 198.32.162.100 198.32.162.102 1668 5662 154.11.0.195 from 154.11.0.151 (154.11.0.151) Origin IGP, metric 1119, localpref 180, valid, internal Originator: 154.11.0.195, Cluster list: 154.11.0.151, 154.11.0.222 1668 5662 154.11.0.195 from 154.11.0.150 (154.11.0.150) Origin IGP, metric 1119, localpref 180, valid, internal, best Originator: 154.11.0.195, Cluster list: 154.11.0.150, 154.11.0.222 route-views.on> route-views.on>traceroute www.cnn.com Translating "www.cnn.com"...domain server (209.115.142.1) [OK] Type escape sequence to abort. Tracing the route to cnn.com (64.236.16.52) 1 toroonxngr00.bb.telus.com (154.11.63.85) 4 msec 0 msec 0 msec 2 * * * 3 * * * 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 1

Whois software run by Lacnic and BR?
by Hank Nussbacher 21 Oct '03

21 Oct '03

When trying to determine a country code for 200.150.7.132, I first tried ARIN which pointed me to LACNIC - whois.lacnic.net: inetnum: 200.128/9 status: allocated owner: Comite Gestor da Internet no Brasil ownerid: BR-CGIN-LACNIC responsible: Frederico A C Neves address: Av. das Naחץes Unidas, 11541, 7° andar address: 04578-000 - Sדo Paulo - SP country: BR phone: +55 11 9119-0304 [] owner-c: CGB tech-c: CGB inetrev: 200.128/9 nserver: NS.DNS.BR nsstat: 20031015 AA nslastaa: 20031015 nserver: NS1.DNS.BR nsstat: 20031015 AA nslastaa: 20031015 nserver: NS2.DNS.BR nsstat: 20031015 AA nslastaa: 20031015 remarks: These addresses have been further assigned to Brazilian users. remarks: Contact information can be found at the WHOIS server located remarks: at whois.registro.br and at http://whois.nic.br So off to whois.nic.br: inetnum: 200.150.7/24 aut-num: AS23106 abuse-c: RBS151 owner: COMPANHIA ENERGETICA DE MINAS GERAIS ownerid: 017.155.730/0001-64 responsible: Marcus Vinicius da Silva address: Av Barbacena, 1200, 3 Andar address: 30190-131 - Belo Horizonte - MG phone: (031) 349-4469 [] owner-c: MVS9 tech-c: MVS9 inetrev: 200.150.7/24 nserver: OUTCEMIG1.CEMIG.COM.BR nsstat: 20031018 AA nslastaa: 20031018 nserver: OUTCEMIG2.CEMIG.COM.BR nsstat: 20031018 AA nslastaa: 20031018 created: 20020621 changed: 20020621 inetnum-up: 200.150.0/19 Does anyone know what standard is being used here? It looks like RIPE format but very modified. What bothers me is not the additional tags but rather that an automated script would not be able to determine country from their response. Thanks, -Hank

8 10

Hijacked IP blocks
by william＠elan.net 21 Oct '03

21 Oct '03

As some of you have seen from sessions today, hijacking of ips has been noticed by many. I want to give report of what the current situation is as I've been monitoring known hijacked ip ranges and active use of those. The active list is included later in this email and is available online at http://www.completewhois.com/hijacked/hijacked_flist-bgp_routed_asannounced… First I want to thank quite a number of companies both large and smaller for helping to deal with this problem. By now very few ip blocks are left that were hijacked and are still in active use, in fact 1/2 of the ones left announcing space are victims that were resold the space (particularly in 146.20.0.0/8 block; I wish they would finally renumber out of these blocks, some of them have had 4 months to do it from original notice). New hijacked blocks do not appear to be such a common occurance by spammers which makes things easier (but we must still remember what happened before and all of you must remember to take care of the resources where you maybe listed as an admin for. If your company is beeing aquired - make sure when you leave the company new administrator is assigned from new company (if this is not possible, inform ARIN ip block will be left without active administrator and what led to this). Those of you that were administrators for companies no longer in business (even going back up to 10 years), please at some if you remember what ip block were to check on what whois currently looks like and who that companie's domains are registered to. If you find problems, address them to ARIN or to completewhois for investigation about what happend to original company. Now today at NANOG meeting I was approached by a group of people concerned that the are too many names of network engineers listed on the site. I have to point it that I make all possible efforts to contact network engineers and have them resolve questionable problems on their own - some just do not answer such emails, but others did and netblocks with references to those people no matter if those people may have been involved in hijacking or not are not mentioned on the site. I would hope that I would not have to approach you in the first place and considering recent ARIN announcement http://www.arin.net/announcements/20031014.html (with which BTW I do not fully agree with - reporting every case to authorities maybe going too far - but they may not have any choice, either do it for all or for none) So I hope that any of you that may have questinable blocks in current use would on your stop and return them to the state they were before in whois or return them to arin or continue using the blocks and apply to officially transfer them (remember ARIN currently does transfers at no extra charge, this will not last forever!!!). The group that approached me had specific concerns because while some may have been mentioned on site as directly involved in hijacking, which I think is appropriate to them; others may have been mentioned indirectly when their whois records were listed under some blocks current use section. I want to stress out that active use in no way implies any connection to hijacking, it is simply result of dns and related whois info on what active use of the block and what it has been (i.e. isp customers, irc, spam sites, etc) and having it comes very usefull for correlation between different cases and people previously asked me to include it in fact. To differentiate about this data, I'm willing to put a desclaimer up in each file regarding data listed in active use section. Please make your suggestions on the best text for this to me privately or on hijacked mail list when I bring this topic up there. I also understand that number of people do not want google and other search engines to be able to reference their names and other data if its in the current use section. Please make a suggestions on how to best achieve this without stopping google from searching other sections of the site. Would the solution of separating current use data into separate files in separate directory and putting robots.txt file there work? Should I also make sure that people are only able to reference those files when they first looked at the data in primary data file? And understand that if I do not hear your concerns, I would not know what maybe wrong with the completewhois hijacked section or what is done wrong as far as investigations go. I do answer emails even if it may take several days sometimes and have in the past made changes based on what has been suggested. Now going back to the top of this post, below is the list of actively advertised hijacked blocks (same program as has been used for bogon advertisements has been used here as well): 142.105.220.0/22 ## AS3908 : SUPERNETASBLK : SuperNet, Inc. 142.105.224.0/22 ## AS3908 : SUPERNETASBLK : SuperNet, Inc. 142.105.228.0/22 ## AS3908 : SUPERNETASBLK : SuperNet, Inc. 142.105.232.0/22 ## AS3908 : SUPERNETASBLK : SuperNet, Inc. 146.20.36.0/22 ## AS20473 : NETTRANS : NetTransactions, LLC 146.20.40.0/21 ## AS20473 : NETTRANS : NetTransactions, LLC 146.20.48.0/20 ## AS23131 : STARLAN : Starlan Communications Inc. 146.20.64.0/19 ## AS12277 : TRACON : Tracon Industries 146.20.80.0/22 ## AS3638 : GLOBALI : Shaman Exchange, Inc. 146.20.80.0/21 ## AS12277 : TRACON : Tracon Industries 146.20.88.0/22 ## AS12277 : TRACON : Tracon Industries 192.107.49.0/24 ## AS30080 : BA-CONSULTING : BA Consulting 198.182.182.0/24 ## AS16631 : COGENT-ASN : Cogent Communications 199.245.138.0/24 ## AS30080 : BA-CONSULTING : BA Consulting 203.29.33.0/24 ## AS3491 : CAIS-ASN : CAIS Internet 203.29.34.0/24 ## AS16631 : COGENT-ASN : Cogent Communications 203.30.20.0/24 ## AS3491 : CAIS-ASN : CAIS Internet 203.30.26.0/23 ## AS3491 : CAIS-ASN : CAIS Internet 203.55.84.0/22 ## AS3409 : INET-1-AS : Internetworks, Inc. 204.155.240.0/20 ## AS16631 : COGENT-ASN : Cogent Communications And for for comparison here is what this looked like on Sep 26th when I started active monitoring (I also have manual data from early August, but it would take too long to put it into email. I can say though, that there were twice as many hijacked announcements then, things have really changed for good in the last several months as more people and RIRs themselve became aware of these issues). 139.81.128.0/17 # AS22653 - GlobalCompass 142.105.0.0/21 # AS19800 - Grant County Public Utility 142.105.220.0/22 # AS3908 - Supernet 142.105.224.0/22 # AS3908 - Supernet 142.105.228.0/22 # AS3908 - Supernet 142.105.232.0/22 # AS3908 - Supernet 142.247.0.0/16 # AS577 - bell.ca (Note - this is proper announcement on behalf on behalf of MDS) 146.20.36.0/22 # AS20473 - NetTransactions 146.20.40.0/21 # AS20473 - NetTransactions 146.20.48.0/20 # AS23131 - Starlan 146.20.64.0/19 # AS12277 - Tracon 146.20.80.0/22 # AS3638 - Globali 146.20.80.0/21 # AS12277 - Tracan 146.20.88.0/22 # AS12277 - Tracan 150.112.0.0/16 # AS8121 - TCH/Layer42.net 157.112.0.0/16 # AS23720 - FUSIONGOL-AS-AP (Note - this is proper announcement, on behalf of Clipper) 166.88.0.0/16 # AS8121 - TCH/Layer42.net 167.179.0.0/16 # AS4768 - Clear Communications 192.107.49.0/24 # AS30080 - BA Consulting (hijacker used named), routed by AS3568 CW 198.133.167.0/24 # AS8121 - TCH/Layer42 199.245.138.0/24 # AS30080 - BA Consulting 203.4.160.0/24 # AS9826 - ILink.net 203.29.32.0/24 # AS9826 - ILink.Net 203.29.33.0/24 # AS3491 - CAIS 203.30.20.0/24 # AS3491 - CAIS 203.30.26.0/23 # AS3491 - CAIS 204.155.240.0/20 # AS16631 - Cogent 205.235.64.0/24 # AS29698 - Internet America LLC (hijacker named used) 205.235.69.0/24 # AS29698 - Internet America LLC

2 1

Re: Dos attack?
by guy 21 Oct '03

21 Oct '03

Eric, You should start with your upstream's security dept. They may have seen either this incident, a related one, or both. And they more than likely have resources at other transit providers' security depts. You pay for their service, you may as well use it, right? Guy ------------------------------------------------------------------------ Hi, We are getting a LOT of web requests containing what mostly looks like giberish. [Mon Oct 20 21:13:42 2003] [error] [client 172.133.3.204] request failed: erroneous characters after protocol string: \xb8\xcf\xc235\x9f\xc4\x1c\xebj\xd7\xc5\x8e\xe9d>\xfdMe\xed\x16\xca\xd51\xcfReF\x82\xa3qi\x89\x832<\vJ5k\x15\xa2\x0c\ x90\xed\x8bCT\xa3\xa2\x96\xd7\xe8\xa2`S#+W\xfc\xc2\xc2w*\xce\x1a<\xb9\xc3\x91\x14\xb0\x9e\xfe\x14\"7\xaa\xeaR\xd1\x9c \x13\x1a\xf0\x1aN\x8eklP\xdc\xc1\xe3\xb9w\xb0\x1aGt\x04|I4\xae\x06WC\x15NA\x80\xb1\xc5E~\xd59\x85+\xcc\x9e\xb8\xaf(\r \x1f\x97 But this is not the standard Microsoft worm stuff that I can tell. It is coming from numerous IP addresses and nearly took down a few of our servers until we started blocking them with the firewall. So I am trying to find out as much as I can about what is happening, but I don't really know where to start. I don't believe it is considered approperiate to send a list of IPs to this list. So where should I start? The list so far contains about 60 addresses. Thanks, Eric

2 1