February 2010 - NANOG - lists.nanog.org

Colocation + ip transit in NY
by pior 25 Feb '10

25 Feb '10

Hello, I need to find a deal for colocation + ip transit in New York in the next 2 hours. (looks like a joke but...) We need 200Mb/s now, 1Gb/s expected in next 12 months. We actually got a pretty good deal but a crossconnect is needed and the price of it really bothers my boss. Greetings, -- Pior Bastida pior(a)pbastida.net

1 0

Security Guideance
by Paul Stewart 25 Feb '10

25 Feb '10

Hi folks... We have a strange series of events going on in the past while.... Brief history here, looking for input from the community - especially some of the security folks on here. We provide web hosting services - one of our hosting boxes was found a while back with root kits installed, un patched software and lots of other "goodies". With some staff changes in place (don't think I need to elaborate on that) we are trying to clean up several issues including this particular server. A new server was provisioned, patched, and deployed. User data was moved over and now the same issue is coming back.... The problem is that a user on this box appears to be launching high traffic DOS attacks from it towards other sites. These are UDP based floods that move around from time to time - most of these attacks only last a few minutes. I've done tcpdumps within seconds of the attack starting and to date been unable to find the source of this attack (we know the server, just not sure which customer it is on the server that's been compromised). Several hours of scanning for php, cgi, pl type files have been wasted and come up nowhere... It's been suggested to dump IDS in front of this box and I know I'll get some feedback positive and negative in that aspect. What tools/practices do others use to resolve this issue? It's a Centos 5.4 box running latest Plesk control panel. Typically we have found it easy to track down the offending script or program - this time hasn't been easy at all... Thanks, Paul ---------------------------------------------------------------------------- "The information transmitted is intended only for the person or entity to which it is addressed and contains confidential and/or privileged material. If you received this in error, please contact the sender immediately and then destroy this transmission, including all attachments, without copying, distributing or disclosing same. Thank you."

22 21

Looking Glass software - what's the current state of the art?
by Joel M Snyder 24 Feb '10

24 Feb '10

We are migrating our web server from platform A to mutually incompatible platform B and as a result the 7-year-old DCL script I wrote that does Looking Glass for us needs to be replaced. (from my comments, looks like I stole the idea from ejk(a)digex.net...) I'm guessing that someone else has done a better job and I should be just downloading and using an open source tool. What's the current thinking on a good standalone Looking Glass that can be opened to the Internet-at-large? jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

3 2

Spamhaus...
by Laczo, Louis 24 Feb '10

24 Feb '10

Folks, I'm looking for comments / suggestions / opinions from any providers that have been contacted by spamhaus about excessive queries originating from their DNS resolvers, typically, as a proxy for customers. I know that certain large DNS providers (i.e. google and level3) have either been banned or have voluntarily blocked spamhaus queries by their resolvers. We're currently in discussion with spamhaus and I wanted to see how others may have handled this. Thanks! --Lou

30 66

log parsing tool?
by fedora fedora 24 Feb '10

24 Feb '10

Greetings, Anyone has good recommendations for an open-sourced log parsing and analyzing application? It will be used to work with syslog-ng and other general syslog and application logs. I have been looking at swatch and logwatch, but would like to find out if there are other good choices, thanks FD

7 7

Re: NANOG48 HD streams now active
by Scott Weeks 24 Feb '10

24 Feb '10

--- gdt(a)gdt.id.au wrote: From: Glen Turner <gdt(a)gdt.id.au> > 7pm appears to be a bad time to tune in if you're in the UK... The streaming is very appreciated. A clock visible to the camera would save the hassle of translating local time to agenda time. ----------------------------------------------- I'd like to second that. Thanks! It's a lot better with the HD stream as compared to the past when I couldn't read the presentation slides on the stream and had to try to follow along with slides next to the stream on one itty bitty laptop screen. It is a lot easier. Also, I can finally see what you all look like after reading your emails for so many years! ;-) scott

1 0

NANOG48 HD streams now active
by Anton Kapela 24 Feb '10

24 Feb '10

Web browser embedded flash player: http://nanog.iristransport.net/nanog48/ VLC direct link: http://204.29.15.165:10001 Enjoy, -Tk

5 4

Email Portability Approved by Knesset Committee
by Gadi Evron 23 Feb '10

23 Feb '10

The email portability bill has just been approved by the Knesset's committee for legislation, sending it on its way for the full legislation process of the Israeli parliament. While many users own a free email account, many in Israel still make use of their ISP's email service. According to this proposed bill, when a client transfers to a different ISP the email address will optionally be his to take along, "just like" mobile providers do today with phone numbers. This new legislation makes little technological sense, and will certainly be a mess to handle operationally as well as beurocratically, but it certainly is interesting, and at least the notion is beautiful. The proposed bill can be found here [Doc, Hebrew]: http://my.ynet.co.il/pic/computers/22022010/mail.doc Linked to from this ynet (leading Israeli news site) story, here: http://www.ynet.co.il/articles/0,7340,L-3852744,00.html I will update this as things evolve on my blog, here: http://gadievron.blogspot.com/ Gadi.

39 81

Re: RE: Security Guideance
by Paul Bosworth 23 Feb '10

23 Feb '10

Place an ids in front of the server and write a rule for the traffic signature. Paul B. Sent with Android On Feb 23, 2010 3:25 PM, "Matt Sprague" <msprague(a)readytechs.com> wrote: The user could also be running the command inline somehow or deleting the file when they log off. Check who was logged onto the server at the time of the attack to narrow down your search. I like the split the users idea, though it could be several iterations to narrow down the culprit. -----Original Message----- From: Ronald Cotoni [mailto:setient@gmail.com] Sent: Tuesday, February ...

1 0

Re: Email Portability Approved by Knesset Committee
by Johnny Eriksson 23 Feb '10

23 Feb '10

Robert Bonomi wrote: > Quick! Somebody propose a snail-mail portability bill. When a renter > changes to a different landlord, his snail-mail address will be optionally > his to take along, "just like" what is proposed for ISP clients. No, a complete street address portability system. Assuming that I live on 1337 Main Street, I should be able to keep that address even if I move to a different part of town, and I should be able to use it for all purposes, including when I give my home address to a cab driver, and it should just work. Why can't we get some reasonable legislation like that enacted? --Johnny

5 4