- NANOG - lists.nanog.org

Re: Recent DNS attacks from China?
by Hal Murray 30 Nov '11

30 Nov '11

> I am wondering if anyone else is seeing a sudden increase in DNS attacks > emanating from chinese IP addresses? Over the past 24 hours we've seen a > sudden rash of chinese IPs attacking our DNS servers in the order of 5 to 10 > million PPS for periods of 5 to 10 mins, repeated every 20 to 30 minutes. > This anomalous traffic started roughly 24 hours ago, and while we've had > occasions of anomalous chinese traffic, never anything of this type. I don't know if it's related, but at about the same time USNO reported an attack on their NTP servers. I could easily imagine a piece of malware with a bug that does massive retransmits on both DNS and NTP. ----------- From: Rich <schmidt.rich(a)gmail.com> Newsgroups: comp.protocols.time.ntp Subject: NTP Denial of Service attack 29 November 2011 Date: Tue, 29 Nov 2011 12:44:44 -0800 (PST) Organization: http://groups.google.com NNTP-Posting-Host: 199.211.133.254 USNO is seeing an apparent coordinated denial of service attack on NTP originating with the following IPs: 220.117.53.67; 218.92.115.152; 114.40.28.224; 218.201.21.194. ---------- At 11 pm EST 29 Nov 2011 the Navy Cyber Defense Operations Command ordered USNO to take NTP servers in Washington, DC offline, and USNO complied. USNO serves more than 3 million clients. This is the first time in 17 years that we have ceased NTP operations. ---- NTP Service from USNO Washington was restored at 30.56 November 2011 UTC. No further information is available for dissemination at this time. -- These are my opinions, not necessarily my employer's. I hate spam.

2 1

IPv6 NPT and NAT for Linux
by Ray Soucy 30 Nov '11

30 Nov '11

For those who missed it, Linux is adding NAT for IPv6 to netfilter: http://www.spinics.net/lists/netfilter-devel/msg19979.html Along with tradition SNAT, and DNAT targets most of us are familiar with, a new NETMAP target is included that implements NPT (network prefix translation). I for one am happy to see this; despite not wanting to see people NAT IPv6 as the norm, having the NETMAP target will largely replace the use of SNAT and MASQUERADE for many deployments, while keeping those tools for the times when traditional NAT is desirable. -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-3526 Networkmaine, a Unit of the University of Maine System http://www.networkmaine.net/

3 2

Re: Looking for a Tier 1 ISP Mentor for career advice.
by joshua sahala 30 Nov '11

30 Nov '11

tyler, some additional "soft" skills that will help you distinguish yourself from others: - learn to write well: take some creative writing classes in addition to technical writing. being able to efficiently write clear, concise, and effective documentation is a skill that is necessary, and i daresay, required, especially for senior-level staff. - learn how to present/speak: join the local toastermasters. grok tufte's 'visual display of quantitative information' (or something similar -- this goes back to writing effective and concise documentation) - in addition to business and finance, learn negotiation techniques. 'getting to yes' is a good book; there are many others - learn time/task/project management: you should be able to accurately guage how long things take, task interdepence, and how to structure a (simple) project. try a few different methods to find one that works for you, and then build and rebuild your home lab using your project plan. this is also a good time to practise documentation ;) - get involved: join/start local users groups, go to a conference or two, subscribe to/read mailing lists on topics which interest you, or which are relevant to something you are studying/playing with - to reiterate what others have said: learn to troubleshoot. learn to troubleshoot. learn to troubleshoot. - develop an efficient, comprehensive methodology, and stick to it (a checklist can be helpful) - learn to take notes as you work through your procedure (what you did, what was the result: this will aid in writing both root-cause reports and operational procedures -- more documentation practise) - as you gain experience, re-evaluate and optimise, but be consistent in your approach - be able to explain and justify your procedure(s); teaching and learning from others makes you both better. mentoring will be an extremely valuable skill to your hiring manager/team (and will better position you for leadership roles) - learn how to use $favourite_search_engine in order to find answers you might also consider getting a juniper j-series box (or running bird on a *nix box, or three). a ccnp will teach you cisco's way, but most provider networks are heterogenous, and the ability to understand a non-cisco device (and moreover, a non-cisco-style cli/config), will benefit you long-term (imho). above all, have fun with what you are doing. this industry can be a lot of fun, but it is also stressful, and if you aren't enjoying what you are learning/doing, it might be time to re-evaluate your focus/priorities. hth /joshua

1 0

Re: Recent DNS attacks from China?
by Rob.Vercouteren＠kpn.com 30 Nov '11

30 Nov '11

Hello Leland, Yes we do see the same behavior! regards, Rob Vercouteren

3 3

Used your smartphone to log into your network?
by Rich Kulawiec 30 Nov '11

30 Nov '11

If so, this might be a good time to change passwords, and to review what other information has transited your phone. (Note: androidsecuritytest.com appears to be slashdotted at the moment.) November 16: initial reports of Carrier IQ spyware surface: CarrierIQ: Most Phones Ship With "Rootkit" http://yro.slashdot.org/story/11/11/16/1517248/carrieriq-most-phones-ship-w… The Rookit of All Evil http://www.xda-developers.com/android/the-rootkit-of-all-evil-ciq/ More on CarrierIQ http://www.xda-developers.com/android/more-on-carrier-iq/ all of which reference the research presented here: Carrier IQ http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ November 22: Carrier IQ threatens security researcher Trevor Eckhart: CarrierIQ Tries To Silence Security Researcher http://mobile.slashdot.org/story/11/11/23/0032233/carrieriq-tries-to-silenc… Mobile Rootkit Maker Tries to Silence Critical Android Dev http://www.wired.com/threatlevel/2011/11/rootkit-brouhaha/ November 24: Carrier IQ backs off its threats, says that it doesn't track Android users Carrier IQ Relents, Apologizes http://yro.slashdot.org/story/11/11/24/1852213/carrier-iq-relents-apologizes Carrier IQ retracts cease and desist letter sent to security researcher, says it doesn't track Android users http://www.theverge.com/2011/11/23/2583862/carrier-iq-retracts-cease-and-de… November 29: Further research by Trevor Eckhart shows Carrier IQ spyware logs ALL keystrokes Android Dev Demonstrates CarrierIQ Phone Logging Software On Video http://yro.slashdot.org/story/11/11/30/0423256/android-dev-demonstrates-car… Researcher's Video Shows Secret Software on Millions of Phones Logging Everything http://www.wired.com/threatlevel/2011/11/secret-software-logging-video The Storm Is Not Over Yet -- Lets Talk About #CIQ http://www.xda-developers.com/android/the-storm-is-not-over-yet-lets-talk-a… all of which reference this research: Carrier IQ Part 2 http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq… ---rsk

1 0

RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 30 Nov '11

30 Nov '11

Well, sometime yesterday www.centurylink.com removed it AAAA record(s). www.qwest.com still has them. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Monday, October 24, 2011 1:47 PM To: 'nanog(a)nanog.org' Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days Good news: access to the v6 version of www.qwest.com came up at 12:30 pm today -- it redirects to www.centurylink.com, but at least it's working. Only www.savvis.com remains in my list of service provider websites that have non-working IPv6. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Thursday, August 18, 2011 12:35 AM To: nanog(a)nanog.org Subject: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days The IPv6 version of www.qwest.com has been down for 10 days. Wget shows a 301 to www.centurylink.com, but that also fails. Emails to the nocs at both companies have gone unanswered. Unless HE is deployed in a web browser, this behavior leads to a bad end-user experience. If anyone can prod either of these two companies that would be much appreciated. Frank nagios:/home/fbulk# wget -6 www.qwest.com --2011-08-18 00:32:40-- http://www.qwest.com/ Resolving www.qwest.com... 2001:428:b21:1::20 Connecting to www.qwest.com|2001:428:b21:1::20|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: http://www.centurylink.com/ [following] --2011-08-18 00:32:40-- http://www.centurylink.com/ Resolving www.centurylink.com... 2001:428:b21:1::22 Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:02-- (try: 2) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:25-- (try: 3) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:49-- (try: 4) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. Etc...

1 0

Bandwidth prediction tool?
by Luis Palma 30 Nov '11

30 Nov '11

Hi, Does anyone know a good Bandwidth Prediction tool?. We have a DPI solution based on SCE8000 + SM/CM from Cisco and we are looking a tool that can take a data from Collector Manager Database and make traffic Bandwidth prediction and customer behavior prediction. Any idea will be welcome. Regards,

2 1

Equinix
by Keegan Holley 29 Nov '11

29 Nov '11

Assuming it's not owned by the NSA does anyone know the address of the equnix colo in the Denver area? I'm working on pricing access circuits into it. A contact from equinix would be helpful as well. We haven't gotten a response to our queries. Regards, Keegan

3 2

Computer Networks Special Issue on Botnets: Deadline Extended to Dec. 19
by Guofei Gu 29 Nov '11

29 Nov '11

CFP: Special Issue of COMPUTER NETWORS (ELSEVIER) on "Botnet Activity: Analysis, Detection and Shutdown" Apologies for multiple copies of this announcement. ------------------------- Dear Colleagues, Please consider the following opportunity to submit and publish original scientific results to a SPECIAL ISSUE of COMPUTER NETWORKS (ELSEVIER journal) on "Botnet Activity: Analysis, Detection and Shutdown". The submission deadline is extended to December 19, 2011. http://ees.elsevier.com/comnet/ A pdf version of this CFP is available at http://faculty.cse.tamu.edu/guofei/CFP_COMNET-Botnets.pdf Please help distribute. Thanks! ------------------------- Large scale attacks and criminal activities experienced in recent years have exposed the Internet to serious security breaches, and alarmed the world regarding cyber crime. In the center of this problem are the so called botnets -- collections of infected zombie machines (bots) controlled by the botmaster to perpetrate malicious activities and massive attacks. Some recent botnets are composed of millions of infected machines, making use of this attack vector inevitably harmfully. Hence, it is paramount to detect, analyze and shutdown such overlay networks before they become active. Research on botnet activity is mostly related to detection and disruption. Detection of botnets has focused on monitoring bot activities, especially during the spread of malicious software to infect new hosts (initial infection phase) and the communication messages exchanged between bots and botmasters (rallying and updating phases). Some behavioral aspects are common: bots have to signal the botmaster informing they are alive, each time their hosts are started; bots send messages whenever connecting and joining with the botnet; the botmaster has to send commands to each zombie machine before initiating malicious activities. This special issue of Computer Networks is intended to foster the dissemination of high quality research in all aspects regarding botnet activity, detection and countermeasures. The objective of this special issue is to publish papers presenting detection algorithms, traffic monitoring and identification, protocols and architectures, as well as botnet modeling, behavior, simulation, statistics, dissemination, analysis, preventive procedures and possible countermeasures. Only technical papers describing previously unpublished, original, state-of-the-art research, and not currently under review by a conference or journal will be considered. We solicit papers in a variety of topics related to botnet research including, but not limited to: - Traffic Monitoring and Detection Algorithms - Data Collection, Statistics and Analysis - Modeling Behavior and Simulation - Protocols and Architectures (IRC, HTTP, P2P, etc) - Firewalls and IDS - Cyber Crime Case Studies - Reverse Engineering and Automated Analysis of Bots - Honeypots and Honeynets - New Platforms: Cellular and Wireless networks, Mobile devices, TV, etc. - Legal Issues and Countermeasures - Underground Markets, Vulnerability Markets and Zero-day Economics - Mini-Botnets Guest Editors Ronaldo Salles Military Institute of Engineering PraçGeneral Tibú 80, 22290-270, R.J. Brazil salles(a)ieee.org Guofei Gu Texas A&M University 3112 TAMU, HRBB College Station, TX 77843-3112 USA guofei(a)cse.tamu.edu Thorsten Holz Ruhr-University Bochum Universitatsstrasse 150, 44780 Bochum Germany thorsten.holz(a)rub.de Morton Swimmer Trend Micro Deutschland, GmbH Zeppelinstr. 1 85399 Hallbergmoos - Germany swimmer(a)acm.org Paper submission: 19th Dec 2011 Acceptance notification: 19th Mar 2012 Final papers: 19th May 2012 Submission format The submitted papers must be clearly written in excellent English and describe original research which is not published nor currently under review by other journals or conferences. Author guidelines for preparation of manuscript can be found at www.elsevier.com/locate/comnet/ Submission Guideline All manuscripts and any supplementary material should be submitted through the Elsevier Editorial System (EES). The authors must select "Special Issue: Botnets" when they reach the Article Type step in the submission process. The EES website is located at: http://ees.elsevier.com/comnet/ Guide for Authors This site will guide you stepwise through the creation and uploading of you article. The guide for Authors can be found on the journal homepage (www.elsevier.com/comnet/)

1 0

PPPOE dialer issue on Cisco C2811
by Meftah Tayeb 29 Nov '11

29 Nov '11

Hey folks please can someone see this issue i'm veery stuck on that: i have a C2811 with ADSL line created a dialer interface assigned to a fast ethernet (fe0/0) connected sucsessfully nated my lan network (172.28.0.0/24) the dialer is outside and my fe0/1 is inside but i can access (ONLY) google services! i guess is that a MTU issue? if yes what should i use ? tried 1492 1480 1500 and 1504 same hell at all. here's my config: Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6671 (20111130) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

1 0