July 2006 - NANOG - lists.nanog.org

myspace
by Paul Vixie 24 Jul '06

24 Jul '06

http://news.bbc.co.uk/2/hi/technology/5209496.stm

1 0

ICANN at risk
by Jeremy Kister 23 Jul '06

23 Jul '06

With three days left and no mention of it from the folks that matter, I'm referring NANOG readers to: http://www.ntia.doc.gov/ntiahome/frnotices/2006/NOI_DNS_Transition_0506.htm From the article: > SUMMARY: The United States Department of Commerce's National > Telecommunications and Information Administration (NTIA) seeks comment > on the continuation of the transition of the technical coordination > and management of the Internet domain name and addressing system > (Internet DNS) to the private sector. [...] > Comments are due on or before July 7, 2006. -- Jeremy Kister http://jeremy.kister.net./

5 6

opentransfer.com contact
by Jim Popovitch 22 Jul '06

22 Jul '06

Anyone from opentransfer.com around? I've tried postmaster@, but got no response. I have an email issue wrt mail22.opentransfer.com, can someone please contact me offlist. TIA, -Jim P.

1 0

Canned Emails to Send to Infected End-Users
by Rick Kunkel 22 Jul '06

22 Jul '06

Hello all, Does anyone have a line on any canned emails to send to end-users? Do such things exist? I have a few in my arsenal, but I'm getting sick of writing them. I just realized today that I don't have one for a customer who's is possession of a zombie spambot computer and is spewing emails (blocked on my router from going out) like crazy... Thanks, Rick Kunkel

2 1

final agenda for August 10th DA Workshop
by Gadi Evron 22 Jul '06

22 Jul '06

Probably will have final tweaks. Web site: http://isotf.org/isoi.html Please note, aside to bringing us all together, one of the main goals is seeing the different perspectives and current operations of the different sides of the fight. Namely: Law enforcement, Anti Viruses, Anti Spam, Dynamic DNS Porviders and ISP's. So far, 67 spots out of 75 available at the Cisco facility in San Jose are taken. The agenda is quite tight. Thank you all for your support in setting this up at such short notice, and for the community for getting involved beyond the closed circle groups. Even if the participation vetting remains only for the closed groups, some CFP submissions have been very interesting and allowed. As the communities around DA and MWP were originally started from NANOG and an AV-ers list, I am very glad the NANOG community remains involved at the level it does. Agenda ------ 09:00 - 09:05 - Preview of the day - Gadi Evron (Beyond Security) 09:05 - 09:30 - Early sessions - botnets from different perspectives, hosted by Paul Vixie (ISC): ISP's Barry Greene (Cisco) Anti Virus industry Joe Hartmann (Trend Micro) DynDNS providers Joshua Anderson (Afraid) Anti spam and reputation services Dave Crocker (Brandenburg InternetWorking) Main Lectures: 09:30 - 10:10 Key-note: "Bot, Botnets, Sandbox, Impact" Righard J. Zwienenberg (Norman) 10:10 - 10:45 "MSRC Malware/Exploit Zero Day Response - Case Studies" Greg Galford (Microsoft) 10:45 - 11:20 "The Rough Road Around Us in Botnet Tracking" Jose Nazarijo (Arbor) 11:20 - 11:55 "Malcode Toolkit Profiteering: Feeding the Trend in M.O. from Fame to Fortune" Hubbard Dan (Websense) 11:55 - 12:30 Lunch break Got chow? 12:30 - 13:05 Case Study: *** Levi Gundert (US Secret Service) 13:05 - 13:40 "Recent Bots Detection Information from Microsoft Security Products" Ziv Mador (Microsoft) 13:40 - 14:25 "Router Stress: An Under the Hood Look at How a Router is Really Attacked and DOSed" Barry Raveendran Greene (Cisco) 14:25 - 15:00 "What Keeps Us Up at Night: New & Advanced Difficult to Mitigate DDoS Attacks" Darrel Lewis (Cisco) 15:00 - 15:35 "Phishing and Botnets Organized Crime: Globalization and Tehnology Intelligence Update" Gadi Evron (Beyond Security) 15:35 - 16:10 TBA Jerry Dixon (US-CERT, DHS) Turbo talks: 16:20 - 16:35 "The Global Infection Rate" Rick Wesson (Alice's Registry) 16:35 - 16:50 "Fast-flux Botnet C&C Servers - Detection & Mitigation" Randy Vaughn (Baylor) 16:50 - 17:10 TBA David Ulevitch (EveryDNS / OpenDNS) 17:10 - 18:30 - Community discussion subjects: "The Past Year in Activity" Gadi Evron "Law Enforcement Cooperation Operations TBA "Creating More Actionable Intelligence" TBA "The Ratout AS-based Reporting System, Overview and Future Development" Randy Vaughn "Activity for the Coming Year" Gadi Evron After-party: Dinner, hosted by the ISC. Gadi.

3 4

ISP CALEA Update: Group Appeals U.S. Government Eavesdropping Ruling
by Fergie 22 Jul '06

22 Jul '06

Just a quick update -- I thought some of you may be interested in the developments here. http://news.com.com/2100-1030_3-6097376.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Qwest Long Distance Network
by Wallace Keith 21 Jul '06

21 Jul '06

We use Qwest as our LD provider at several call centers and have not had any issues reported (and they ARE finicky !). Perhaps it's some sort of issue between your provider and Qwest or something more localized? -Keith -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of S. Ryan Sent: Friday, July 21, 2006 2:56 PM To: nanog(a)merit.edu Subject: Qwest Long Distance Network Perhaps not the best place to ask, but I thought I would try. Anyone know or have more information on the Qwest 14-State LD Network Outage? It's been going on for the better part of this morning. At times, can not call LD from the Qwest network, nor can anyone call into the Qwest network.

2 1

Qwest Long Distance Network
by S. Ryan 21 Jul '06

21 Jul '06

Perhaps not the best place to ask, but I thought I would try. Anyone know or have more information on the Qwest 14-State LD Network Outage? It's been going on for the better part of this morning. At times, can not call LD from the Qwest network, nor can anyone call into the Qwest network.

1 0

Re: Deaggregation Disease
by Fergie 21 Jul '06

21 Jul '06

-- Jared Mauch <jared(a)puck.nether.net> wrote: >On Fri, Jul 21, 2006 at 02:42:04PM +0200, Fredy Kuenzler wrote: >> >> Valdis.Kletnieks(a)vt.edu schrieb: >> >On Fri, 21 Jul 2006 09:51:33 +0200, Fredy Kuenzler said: >> > >> >>>>Prefixes Change ASnum AS Description >> >>>>3263 0->3263 AS4151 USDA-1 - USDA >> >>>so I wonder what's wrong with them. >> > >> >I'm not sure which is more weird - a jump of over 3K routes, or the >> >fact that the starting point is zero.... >> >> Just to make it clear: AS4151 was 9 month ago. Now we see history again >> with new actors. (I guess the actual increase was done by various ASN of >> RENATER). >> >> I wonder why aggregating is that difficult. > > It's not, people are just lazy and since "nobody owns the internet >man", or maybe "it's all a bunch of tubes" there's nobody to force people >to be good actors. Perhaps it's time to bring back the old /19 >filters that were started by sprint & such. > I was just thinking the same thing. :-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 5

Re: Deaggregation Disease
by Fredy Kuenzler 21 Jul '06

21 Jul '06

Valdis.Kletnieks(a)vt.edu schrieb: > On Fri, 21 Jul 2006 09:51:33 +0200, Fredy Kuenzler said: > >>>> Prefixes Change ASnum AS Description >>>> 3263 0->3263 AS4151 USDA-1 - USDA >>> so I wonder what's wrong with them. > > I'm not sure which is more weird - a jump of over 3K routes, or the > fact that the starting point is zero.... Just to make it clear: AS4151 was 9 month ago. Now we see history again with new actors. (I guess the actual increase was done by various ASN of RENATER). I wonder why aggregating is that difficult. F.

5 8