February 2005 - NANOG - lists.nanog.org

72.18.160.0/19 Please Check Filters - BOGON Filtering IP Space 72.0.0.0/8
by Bryan Bradsby 10 Feb '05

10 Feb '05

> Our NOC is opening a lot of tickets for customers that live on our > 72.14.128.0/19 network going towards local and federal government sites > in particular. Our customer - Angelo State U was recently assigned IP space 72.18.160.0/19. They have also seen some issues getting packets to government and other sites. For example, USGS.gov was filtering based on an old bogon list. Rob T - this should be a periodic FAQ: http://www.cymru.com/Bogons/ At your service, -bryan bradsby DIR Capnet Texas State Government Net NOC: 512-475-2432 877-472-4848

3 2

Savvis Contact
by Williams, Ken 09 Feb '05

09 Feb '05

Can any network engineer from the Savvis network please contact me off-line. Kind Regards, Ken Williams Network Security Engineer Sony Pictures Digital Entertainment

1 0

Re: ICANN Engages Independent Evaluation Team to Review .NET Applications
by Darrell Greenwood 09 Feb '05

09 Feb '05

At 5:30 PM +0000 05/2/9, Fergie (Paul Ferguson) wrote: >I'm surprised to have not heard anyone mention this.... > >http://www.icann.org/announcements/announcement-07feb05.htm > I'm surprised that SAIC has been given another opportunity to negatively impact the internet. >From http://www.icann.org/announcements/telcordia-disclosure.htm >Telcordia Technologies is a wholly-owned subsidiary of Science >Applications International Corporation (SAIC). <snip> >Prior to 2000, SAIC had an ownership interest in Network Solutions, Inc (NSI). Cheers, Darrell

1 0

RE: IRC Bot list (cross posting)
by Hannigan, Martin 09 Feb '05

09 Feb '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Bill Nash > Sent: Wednesday, February 09, 2005 12:37 AM > To: william(at)elan.net > Cc: nanog(a)nanog.org > Subject: Re: IRC Bot list (cross posting) > > > > > > You don't mass an army if you're not about to use it. This > situation can > (very quickly) have operational relevance. Bringing it to > light to a wider > forum than special interest groups is a good idea. > > You'd certainly care more if it was pointed at you. > > - billn Bill, haven't we been here before? :) There's TWO places that are doing this botnet stuff and the NANOG AUP discourages cross posting. I for one certainly don't want yet another list full of botnet stuff.

7 6

RE: IRC Bot list (cross posting)
by Hannigan, Martin 09 Feb '05

09 Feb '05

> -----Original Message----- > From: Bill Nash [mailto:billn@billn.net] > Sent: Wednesday, February 09, 2005 3:31 AM > To: Hannigan, Martin > Cc: nanog(a)nanog.org > Subject: RE: IRC Bot list (cross posting) > > > On Wed, 9 Feb 2005, Hannigan, Martin wrote: > [ snip ] > Various persons put forth some amount of effort to, > graciously, give other > operators a heads up to the ongoing/potential abuse of their > networks, and > you're concerned about topical relevance? Why aren't you, in > the least, > THANKING them for their efforts? Maybe it's because these > thousands of > drones are being used to pump out spam across the internet, This is old news, Bill. If anyone wants to sit around and pump out botnet lists to NANOG, fine by me. I never said I can stop them. I just said I didn't want them as a subscriber. I understand that you don't know where these existing lists are. Look hard. If you suddenly care about bots enough in the last 24 hours to spend all night writing a post about me, you should be able to expend the same energy and find a botnet list to enjoy. Gadi probably has already invited you to his list in the last 8 hours. He's good like that. >which may > require (at some point) some form of domain registration at > the end site > pushing whatever product, which at later trickles into > Verisign's coffers? <scratches head> Hmm. A conspiracy theory. What would Kramer do? </scratches head> Uh, plonk? [ snip ]

2 1

ICANN Engages Independent Evaluation Team to Review .NET Applications
by Fergie (Paul Ferguson) 09 Feb '05

09 Feb '05

I'm surprised to have not heard anyone mention this.... http://www.icann.org/announcements/announcement-07feb05.htm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Re: [unisog] Collecting PTR names rather than IP addresses (Was: Re: IRC Bot list (cross posting))
by Valdis.Kletnieks＠vt.edu 09 Feb '05

09 Feb '05

On Wed, 09 Feb 2005 12:11:16 GMT, Ketil Froyn said: > > > http://www.albany.edu/~ja6447/hacked_bots8.txt > > Isn't it a good idea to collect the IP addresses rather than the ptr > name? For instance, if I were an evil person in control of the ptr > record of my own IP, I could easily make the name something like > 1-2-3-4.dsl.verizon.net, and if you didn't collect my IP, you can never > be sure you got the right details! > > Something like this is probably not very widespread (has anyone seen it > in practice?), but I still think that for tracking purposes, ptr records > are useless. IMHO. The kiddies have been doing it for *years* on IRC to make their hostnames show up as various 31337 values on a /who. In fact, if you know what you're doing you don't even need control of the PTR record - many older versions of BIND were incredibly susceptible to DNS cache poisoning.

1 0

UDP Port 80 Flooding
by Greg Boehnlein 09 Feb '05

09 Feb '05

Anyone seen a rash of UDP port 80 packet floods lately? We found a huge flood of packets from an address in Taiwan flooding into a customer's IP on our LAN yesterday, which pushed traffic counts off the charts. Any idea what might be at the heart of this? -- Vice President of N2Net, a New Age Consulting Service, Inc. Company http://www.n2net.net Where everything clicks into place! KP-216-121-ST

2 1

Williams contact needed
by Greg Schwimer 09 Feb '05

09 Feb '05

If someone from Williams Communications is around, please contact me off list. Thanks! Greg Schwimer gschwimer <at> godaddy.com

1 0

Bellsouth and Redbacks
by Pablo's Gmail 08 Feb '05

08 Feb '05

Just curious if anyone from Bellsouth can comment on why they're changing from existing vendor to Redbacks? Please take it offline. http://www.redback.com/PTE?rbAction=press&operation=op_one&nextPage=pressIn…

1 0