August 2005 - NANOG - lists.nanog.org

August 2005: Drone Army Botnet C&C listing
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

Keeping is step with Gadi's language from last month: Below is a periodic public report from the Drone Army(DA)/Botnet Research and mitigation mailing list. For this report it should be noted that we base our analysis on the data we have accumulated from various sources. According to our analysis of information we have conducted thus far, we are now publishing our regular reports, with some additional information, which may vary from time to time, as needed. As of this July 2005, any responsible party that wishes to receive information about botnet C&C's in their net space can contact us and be added to our notification list. The principle contact is Paul Ferguson (Fergie). - ferg ==== Special appreciation is due to Staminus who took quick action to resolve the suspect C&Cs of the last report and rapidly resolved all of the suspect C&Cs which appeared during this current survey. AS responsible Parties ranked by top 10 open unresolved suspect C&Cs: ASN Responsible Party Total Open 30058 FDCSERVERS - FDCservers.net LL 123 43 21840 SAGONET-TPA - Sago Networks 53 26 13680 AS13680 Hostway Corporation Ta 23 23 15083 INFOLINK-MIA-US - Infolink Inf 37 21 6461 MFNX MFN - Metromedia Fiber Ne 28 17 8560 SCHLUND-AS Schlund + Partner A 26 17 30083 SERVER4YOU - Server4You Inc. 37 16 13237 LAMBDANET-AS European Backbone 15 12 9800 UNICOM CHINA UNICOM 14 11 27645 ASN-NA-MSG-01 - Managed Soluti 18 11 Historical Report ranked by past suspect C&Cs mapping into the AS: ASN Responsible Party Total Open Percent Resolved 14742 INTERNAP-BLOCK-4 - Internap Ne 142 2 99% 14744 30058 FDCSERVERS - FDCservers.net LL 123 43 65% 10913 INTERNAP-BLK - Internap Networ 84 0 100% 25761 STAMINUS-COMM - Staminus Commu 58 0 100% 21840 SAGONET-TPA - Sago Networks 53 26 51% 3356 LEVEL3 Level 3 Communications 43 5 88% 21844 THEPLANET-AS - THE PLANET 38 5 87% 30083 SERVER4YOU - Server4You Inc. 37 16 57% 15083 INFOLINK-MIA-US - Infolink Inf 37 21 43% 11739 DIGITAL-FOREST-NW - digital.fo 29 0 100% 16237 NXS Nxs Internet BV 29 0 100% The report summary includes a Percent Resolved Column in order to recognize the mitigation efforts of the AS Responsible Parties. The Opens Unresolved column represents the number of unique C&C which reported as open to the survey's connection attempts and which have neither been investigated nor cleared by the Responsible Party (to the extent of our knowledge). The Total mapping count may include multiple names mapping to a single IP within an AS. We count each mapping count as a unique C&C. Stats for the DA group compiled by: Randal Vaughn Professor Information Systems Baylor University Randy_Vaughn (at) Baylor.edu -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Peering Contact Database
by Deepak Jain 31 Aug '05

31 Aug '05

Hey. Hopefully this is operational. If someone could send me a copy of the current (or most recent) Peering Contact Database. I know Bill Norton used to distribute it, but I seem to have fallen off the distribution list or its getting eaten by my spam filters. (really operational: I want to make sure there are no prospective peers at Equinix/Ashburn that I may have missed on my last survey). Thanks, Deepak Jain AiNET

3 2

Re: Yahoo! -- A "Phisher-friendly" hosting domain?
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

Someone is... or trying to, at least, watch and contact the responsible owners/registrars, but in some cases they aren't apparently eager to assist. That's why the ones that are caught end up in various RBL's... - ferg -- Alex Rubenstein <alex(a)nac.net> wrote: Shouldn't someone be watching these, though? root@sodium:~# whois paypal.com [...] PAYPAL.COM.SV04.COM PAYPAL.COM.LIMITSPEED.NET PAYPAL.COM While I agree in concept that this is not how the internet runs, and I am not proposing a domain name police force be instituted, it seems to me that things like this are easily caught. Not to mention, the purpose of them is clear. On Wed, 31 Aug 2005, Fergie (Paul Ferguson) wrote: > > That's good, however, I regret that the issue had to be > aired here because it didn't get attention it deserved > through "proper channels" and elsewhere... > > - ferg > > > -- Florian Weimer <fw(a)deneb.enyo.de> wrote: > >> But it caught my eye that SOMEBODY at Yahoo! ought to be reviewing >> domain names like "bankofthewestupdate.com" > > Registrars should as well, but this is not the way the Internet works. > Sometimes, this is a good thing, sometimes, it's not. > > It seems that the A RR has been pulled around 2005-08-30 21:00 UTC, so > this particular issue has already been resolved. > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net > ferg's tech blog: http://fergdawg.blogspot.com/ > -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben Net Access Corporation, 800-NET-ME-36, http://www.nac.net

2 1

RE: Katrina: directNIC Stays Online - Blog + Images
by Peering 31 Aug '05

31 Aug '05

Some ISPs managed to get FEMA to let a tanker through and that's how we're back up. It wasn't pretty though. Marshall Eubanks: I remember that after 9/11 the real network hits started about 3 days later, when the diesel generators started running out of fuel in the downtown telco hotels, and there was no way to physically get fuel trucks to their location. The equipment and generators were fine, they just ran out of fuel. If you look at the flooding in downtown New Orleans, it looks like this might happen again there.

1 0

Re: Yahoo! -- A "Phisher-friendly" hosting domain?
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

That's good, however, I regret that the issue had to be aired here because it didn't get attention it deserved through "proper channels" and elsewhere... - ferg -- Florian Weimer <fw(a)deneb.enyo.de> wrote: > But it caught my eye that SOMEBODY at Yahoo! ought to be reviewing > domain names like "bankofthewestupdate.com" Registrars should as well, but this is not the way the Internet works. Sometimes, this is a good thing, sometimes, it's not. It seems that the A RR has been pulled around 2005-08-30 21:00 UTC, so this particular issue has already been resolved. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Re: Phone networks struggle in Hurricane Katrina's wake
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

I'll file that comment where it belongs -- in file 13. If a major catastrophe, albeit more human than network-related (although lots of network-related issues here, too), isn't on-topic, than I fail to see what is. - ferg -- Richard A Steenbergen <ras(a)e-gerbil.net> wrote: Did I miss the memo announcing the Slashdot commentary section had been extended to the NANOG mailing list? It is one thing to expand on a story with useful insights, but this entire thread is just restating the obvious for the sake of hearing your own voice (or the digital equivalent thereof). If I wanted to read the uninformed reactions of random people to random news stories wondering why cell phone circuits fill up during natural disasters I would go to slashdot and click "Read More...". This stuff doesn't even come close to being NANOG worthy, let alone on-topic or appropriate. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5

Trunks (etherchannels) between Foundry & Cisco 4506 (IOS Switch)????
by Gregory Edigarov 31 Aug '05

31 Aug '05

Hello Everybody, Please help me with this issue. Any success stories with config samples are welcome... Thanks a lot in advance. -- With best regards, GRED-RIPE

2 1

Re: Yahoo! -- A "Phisher-friendly" hosting domain?
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

There are still remaining issues... - ferg -- Florian Weimer <fw(a)deneb.enyo.de> wrote: > That's good, however, I regret that the issue had to be > aired here because it didn't get attention it deserved > through "proper channels" and elsewhere... If I read the timestamps correctly, your posting arrived via the NANOG list *after* the domain had been pulled.

1 0

beware mailing list bounce automation
by Randy Bush 31 Aug '05

31 Aug '05

[ excuse ops post ] wondered why some queues were getting long. decided to actually look before running the mailing list bounce scrubber. a whole lot of user(a)tulane.edu etc. beware. crank up them queues. exim hack is some variation on tulane.edu * F,12h,30m; G,24h,3h,1.5; F,30d,12h randy

3 2

Re: Phone networks struggle in Hurricane Katrina's wake
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

You get high marks for your crumudgeon level. However, if I have to point it out and lead you to it like a child, then so be it. If I was mistaken in thinking that the referenced article: "Red Cross looks to IT for post-Katrina recovery" http://www.computerworld.com/securitytopics/security/recovery/story/0,10801… ..would perhaps elicit some operational suggestions from the peanut gallery on how to perhaps assist in this effort, or prhaps contribute to the BellSouth issues, etc., then mea culpa. Sniping certainly accomplishes nothing. - ferg -- Richard A Steenbergen <ras(a)e-gerbil.net> wrote: On Wed, Aug 31, 2005 at 01:22:13AM +0000, Fergie (Paul Ferguson) wrote: > > I'll file that comment where it belongs -- in file 13. > > If a major catastrophe, albeit more human than network-related > (although lots of network-related issues here, too), isn't on-topic, > than I fail to see what is. North American Network Operations perhaps? Talking about the impact to networks is on-topic, talking about steps being taken to protect or restore networks is on-topic, talking about networking infrastructure as it relates to the public communications infrastructure is on-topic during an event like this. Replying to idiotic slashdot articles asking really stupid questions is not on topic. Telling the entire NANOG reader base that you like your POTS line and will never switch to VoIP is not on topic. Technically speaking a human tragedy isn't even on topic. Like I said, it might be different if there was some actual insight being provided here. If someone was talking about some specific data relating to the reliability of the infrastructure or otherwise something OPERATIONAL to talk about that would be one thing, but this is not operational, this is simply chatter. Chatter has its place, that is why people read Slashdot and watch the news, but replacing an operational mailing list with the slashdot commentary section and seeing what happens is not my or anyone else's idea of a good time. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC) -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2