March 2004 - NANOG - lists.nanog.org

Possibly yet another MS mail worm
by Todd Vierling 02 Mar '04

02 Mar '04

This one may be a variant of the recent worms. It's spreading by way of zipfile attachments. I don't have more info yet, but my $orkplace has just been hit by it and it's unknown to McAfee and Symantec at this time. It's not W32.Netsky, as best I can tell, because of the attachment filename: this one uses things like accabaacc.zip that are new to me. I don't have more info on it at this time, but will try to snare a sample in transit if it hits my home system. Just a heads-up, -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com>

15 20

RE: Dns help.
by McBurnett, Jim 02 Mar '04

02 Mar '04

Ejay, I found a great link some time ago: www.dnsstuff.com http://www.dnsstuff.com/pages/expert.htm This one has an option to do a lookup to any public DNS server... Pick some of the random Internation DNS servers and try it out.. It helped me out awhile back when an old DNS hoster still had us in their named.conf...... Later, Jim ---From Ejay--- Hi all. nanog(signal,noise++) I have a customer that is reporting intermittent reachability issues to Stormpay.com, and need a off-network perspective on dns. The end-user reports not being able to resolve the domain, but it's been okay everywhere I looked. Most of the complaints have been international, but there are a couple of charter and EarthLink addresses mixed in. Last dns change was 2 almost weeks ago, so I don't suspect a propagation issue. It should resolve to 207.65.19.39. Thanks, Ejay. (Who now owes two rounds at the next <400mi from Nashville after-nanog-bar-huddle)

2 1

RE: First Post! Annoying Debate at Work.
by Christopher Aldridge 01 Mar '04

01 Mar '04

-----Original Message----- From: Patrick W.Gilmore [mailto:patrick@ianai.net] Subject: Re: First Post! Annoying Debate at Work. >Please do not take this the wrong way, but I thought it was useful >input. Perhaps not to you, but maybe to those who think that getting >their MCSA will teach them all they need to know. It seems as though you MAY not be up to date on the MCSA. It stands for "Microsoft Certified Systems Administrator", FYI. To obtain the MCSA certification, I took the following exams: Exam 70-218: Managing a Microsoft Windows 2000 Network Environment Exam 70-215: Installing, Configuring, and Administering Microsoft Windows 2000 Server Exam 70-210: Installing, Configuring, and Administering Microsoft Windows 2000 Professional Exam 70-216: Implementing and Administering a Microsoft Windows 2000 Network Infrastructure One who thinks these exam topics cover (as you say" "all they need to know", should really investigate this certification. >Some of the things you asked were extremely basic. What "things" were these? I can only find one question in my entire email that requests a response which was: "What's your take and why?", which was obviously referencing the previous statement: --------------------------------------------------------- The argument non-persuasively put is as follows: Is a USB Ethernet Adapter a "converter"? Personally, I say "no". My coworkers seem to say "yes". --------------------------------------------------------- What this means my friend, is I wouldn't ever refer to a USB Ethernet Adapter as a "converter". A few co-workers seem to disagree, hence my request for the opinion of the nanog community. >I've never taken >any of the certifications you list, but I thought they would cover the >basics - especially after 3 of them (from 3 different vendors, I >think?) Unfortunately, MS and Cisco certifications do not generally cover the opinions of those who would and wouldn't classify an Ethernet Adapter as falling under the broad "converter" definition. If you feel that an Ethernet Adapter is a "converter", I suggest taking a different approach. >All that said, if you don't at least start asking, you will never find >out. Asking what? I'm not sure what you're talking about here, but I have received great responses from many people here who actually contributed to this discussion. >So I would not take this as an attack on you personally - lots of >people answered took the time to answer your questions, asking not even >a favor in return as payment. The people who responded helpfully to my post, will receive any help and assistance in the future from me as a fellow nanog'er; without the POINTLESS sarcasm and flaming. > I would take it as a note to people with >certifications or going for certifications that a cert != clue. I agree here 100%. However you have also made it very clear that no_cert != clue. >(Did any of those certs have >labs, or just multiple-guess tests?) Google is your friend. http://www.microsoft.com/learning/mcp/mcsa/requirements.asp http://www.cisco.com/en/US/learning/le3/le2/le0/le9/learning_certificati on_type_home.html >P.S. I kinda expected as much from MS, but it's sad that a cisco cert >doesn't mean much any more. :( Notice mostly everyone who provided useful feedback on this agreed with my opinion on this. Common sense has nothing to do with certs. Having both isn't a bad trait however. FYI, thanks for everyone who contributed to this.

4 4

Dns help.
by Ejay Hire 01 Mar '04

01 Mar '04

Hi all. nanog(signal,noise++) I have a customer that is reporting intermittent reachability issues to Stormpay.com, and need a off-network perspective on dns. The end-user reports not being able to resolve the domain, but it's been okay everywhere I looked. Most of the complaints have been international, but there are a couple of charter and EarthLink addresses mixed in. Last dns change was 2 almost weeks ago, so I don't suspect a propagation issue. It should resolve to 207.65.19.39. Thanks, Ejay. (Who now owes two rounds at the next <400mi from Nashville after-nanog-bar-huddle)

1 0

Re: Possibly yet another MS mail worm
by Rubens Kuhl Jr. 01 Mar '04

01 Mar '04

> > I'm not aware of any mail scanner that does this without running an external > > anti-virus or something alike, although is not that intensive to follow the > > zip headers (as they already do with the MIME headers in order to drop > > external attachments). Most scanners can accept an anti-virus plugin and > > them scan inside zip files, but that requires more processing power, more > > queue disk space, more RAM, more administration to update virus patterns, > > and so on. The cost/benefit usually pays off, but more complexity means less > > people will adopt the solution, thus making worm spreading easier. > > your description makes it all sound quite complicated, possibly because > you are passing all the processing down to the end-user's machine. I was talking about central anti-virus processing... although it's easier on administration than updating hundreds or thousands of machines, it establishes a central bottleneck. Doing decompression and extensive pattern matching on a high volume server is not an easy task. > we have anti-virus (clamav) and anti-spam (spamassassin) running at the > server level, and thus save the end-user alot of cycles. Even on low volume servers, this task is not something one would do without some thinking; on high volume, this is achievable but would require a good systems design to cope with the higher latency between mail receive and mail delivery. > clamav will look inside zip files, and automatically updates its signature > database. > > spamassassin uses both global rules and per-user rules to rate incoming email > and reduce the impact of spam. Been there at many installations of MailScanner (http://www.mailscanner.info) > we even run in-line scans of MIME headers during the SMTP process and reject > specific attachments (.exe, .pif, etc) without even bothering the end-user. That kind of filtering is much easier to configure, administer and goes low on resources. Extending this to verify filenames inside zip files would not be difficult to do, and is simple and not intensive enough to lots of people to turn such filters on. Rubens

7 6

RE: First Post! Annoying Debate at Work.
by Christopher Aldridge 01 Mar '04

01 Mar '04

From: Michael.Dillon(a)radianz.com [mailto:Michael.Dillon@radianz.com] Sent: Monday, March 01, 2004 6:04 AM To: nanog(a)merit.edu Subject: Re: First Post! Annoying Debate at Work. >Thanks for your EXCELLENT example of how technical certification >programs are no guarantee of fundamental technical understanding. >P.S. If you don't ask the right questions you will never get the right >answers. Thanks for the useful input!

2 1

Re: First Post! Annoying Debate at Work.
by Michael.Dillon＠radianz.com 01 Mar '04

01 Mar '04

>Network Analyst >CCNA/MCP/MCSA Thanks for your EXCELLENT example of how technical certification programs are no guarantee of fundamental technical understanding. P.S. If you don't ask the right questions you will never get the right answers.

1 0