- NANOG - lists.nanog.org

comparison of hijack alert systems [was]: prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

On Mon, 22 Sep 2008, Scott Weeks wrote: > > I am hoping to confirm a short-duration prefix hijack <snip> --- hank(a)efes.iucc.ac.il wrote: From: Hank Nussbacher <hank(a)efes.iucc.ac.il> I too spotted this via PHAS for a large number of prefixes, but have not received alerts from IAR, Watchmy.Net nor does RIPE RIS show this hijack: http://www.ris.ripe.net/perl-risapp/risearch.html I would have expected with so many RRC boxes that RIPE RIS would have caught it. I had thought it was a false positive from PHAS but now that you and others have seen it - I guess it is for real. ---------------------------------------- It'd be very interesting to compare said systems using this event. I have not subscribed to MyASN or watchmy.net yet, so I can't do that. I do note, however, that PHAS took 4 hours and 20 minutes to email me, which is within the specs noted on their site. scott

1 0

duplicate packet
by chloe K 23 Sep '08

23 Sep '08

Hi all When I ping the ip, I get the duplicate I check the ip is just one. Why it happens? Thank you 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!) 64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.296 ms 64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.328 ms (DUP!) 64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.291 ms 64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.316 ms (DUP!) 64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.279 ms 64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.309 ms (DUP!) 64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.271 ms 64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.299 ms (DUP!) --------------------------------- Yahoo! Canada Toolbar : Search from anywhere on the web and bookmark your favourite sites. Download it now!

10 10

Re: prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

----------Scott Weeks <surfer(a)mauigateway.com> wrote: ------- > I am hoping to confirm a short-duration prefix hijack <snip> ------------------------------------- --- christian(a)broknrobot.com wrote: ------- From: "Christian Koch" <christian(a)broknrobot.com> I couldn't find any relevant data confirming the announcement of one of my /19 blocks, until a few minutes ago when i checked the route views bgplay (ripe bgplay turns up nothing) and can now see 8997 announcing and quickly withdrawing my prefix ------------------------------------- At what time did you see it? scott

2 1

XO Outage
by Justin Sharp 22 Sep '08

22 Sep '08

We are seeing some issues w/ XO/Savvis peering.. Trace from XO to Savvis IP space (64.75.10.151) Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. scrubbed 0.0% 6 0.6 0.5 0.4 0.6 0.1 2. ip65-44-114-97.z114-44-65.customer.algx.net 0.0% 6 1.3 1.3 1.2 1.4 0.1 3. ??? Trace from Savvis to XO IP space (65.44.114.97) 1. scrubbed 0.0% 38 0.4 0.4 0.3 0.5 0.1 2. 64.41.199.129 0.0% 37 1.0 24.0 0.6 330.2 80.4 3. hr1-ge-7-47.santaclarasc5.savvis.net 0.0% 37 0.7 1.4 0.6 27.3 4.4 4. er1-te-1-0-0.sanjose3equinix.savvis.net 0.0% 37 0.7 5.2 0.6 140.3 23.2 5. cr1-tenge-0-7-5-0.sanfrancisco.savvis.net 2.7% 37 2.9 4.0 2.6 16.6 2.5 6. cr2-pos-0-0-3-3.dallas.savvis.net 0.0% 37 42.6 43.1 42.3 51.4 1.4 7. dpr1-ge-4-0-0.dallasequinix.savvis.net 0.0% 37 43.1 44.8 42.9 76.9 6.7 8. er1-te-2-1.dallasequinix.savvis.net 0.0% 37 43.3 49.2 42.8 233.6 31.6 9. 208.175.175.90 0.0% 37 43.0 42.8 42.6 43.6 0.2 10. 65.106.1.102 75.0% 37 43.5 46.5 43.4 62.9 6.3 11. 65.106.1.101 0.0% 37 43.4 47.8 43.2 112.3 12.5 12. 65.106.0.41 0.0% 37 57.5 65.1 57.1 177.3 21.0 13. 65.106.1.73 0.0% 37 57.4 66.5 57.1 162.1 24.2 14. ??? Trying to call into XO and they aren't even taking calls, they mention something about network issues in Spokane. Any ideas as to what is going on/ETA to fix? --Justin

4 4

favourite XFP supplier?
by Joe Abley 22 Sep '08

22 Sep '08

Hi all, Anybody have a preferred supplier for 10GE XFPs, multimode and singlemode? These are to be installed in Force10 and Juniper hardware in Toronto, so a Canadian supplier would be fabulous although I won't hold my breath. Joe

2 1

RE: hat tip to .gov hostmasters
by Robert Bonomi 22 Sep '08

22 Sep '08

> Subject: RE: hat tip to .gov hostmasters > Date: Mon, 22 Sep 2008 11:49:50 -0400 > From: "Keith Medcalf" <kmedcalf(a)dessus.com> > > If I cannot authenticate the data myself, then it is simply untrusted and u= > ntrustworthy -- exactly the same as it is now. "Speak for yourself, John" applies. In the real world, there are cases where data that one is unable to authenticate by ones self *is* treated as fully trusted. Because someone with the authority to declare it to be that, by fiat, has done so. There may be a common "chain of command", and someone higher in the chain has declared that various inferiors "shall"(i.e. 'must') trust the work of other inferiors within the organization, for example. Or, it may be a contractually-delegated trust. Or, any of a number of other possibilities. Admittedly, in any of those scenarios, the 'strength' of trust is somewhat weaker than if it was self-verified, but it _is_ "far above" your claim of 'untrusted and untrustworthy'. > The end-stage is secure only if at that stage you also set all DNS infrastr= > ucture to refuse to talk to any DNS client/server/resolver that DOES NOT va= > lidate and enforce DNSSEC. Up until that point in time, there is NO CHANGE= > in the security posture from what we have today with no DNSSEC whatsoever. FALSE TO FACT. One does not have a _guarantee_ of 'accurate' data without end-to-end enforcement, this is true. Even _with_ end-to-end DNSSEC enforcement, one does not have such a guarantee. All it accomplishes is to make the insertion of bogus data harder. Not 'impossible', just 'harder'. If a local non-DNSSEC resolver consults _only_ a DNSSEC-aware server on an immediately adjacent network, it takes only a moderate 'extension of trust' to (a) the local network operator, (b) the adjacent network operator, and (c) the DNSSEC-aware server operator, to have a "reasonable degree" of trust in the accuracy of the data the local reslover has. This 'trust' involves the physical integrity of the networks -- that a host on -those- networks will not be allowed to spoof a source address of the DNSSEC-aware server; and the use of ingress-filtering on _source_ addresses -- to prevent any 'external' network/machine from spoofing it either. Beyond that, it is just a matter of 'trusting' a proper implementation on the server itself. _IF_ the anti-spoofing provisions are in place, and 'downstream' (non-aware) DNS resolvers (which consult -only- the 'aware' server) are under the same administrative control as the DNSSEC-aware one, *THEN* there is zero effective difference in the trust level for an answer obtained from the 'non-aware' system as one obtained from the 'aware' one. > To hold forth otherwise is to participate in deliberate fraud and misrepres= > entation of material facts. This really sounds like someone who has a financial interest in promulgating FUD. <grin>

1 0

Re: Atrivo/Intercage: NO Upstream depeer
by Emil Kacperski 22 Sep '08

22 Sep '08

Hello, It's true that David from PIE disconnected our link approx 9pm or so yesterday. Things were going perfect, no complaints for a few weeks now. The only thing I believe is that NTT gave lots of pressure to PIE. For some unknown reason when I tried to reach out to the security guy at NTT he basically said our contract is with PIE. So in a time like this you really get to know who your friends are and who should be avoided. Onward and upward! What doesn't kill you only makes you stronger ;-). Just feel bad for the customers for which I am truly sorry for right now ;-(. Thanks! Contact: Emil Kacperski Company: Intercage Inc. - Atrivo Dedicated Servers San Francisco Datacenter E-Mail: emil(a)intercage.com Phone: 925-550-3947 ICQ: 23531098

4 3

Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 21 Sep '08

21 Sep '08

Matt: I've already put this offer up. I'll be more then happy to meet up at our datacenter and take you through our space. What I find funny is, your the first one whom participated in the recent reports to actually take up and respond to us. I've emailed Garth and Jart, and both of them refused to respond. I emailed both of them requesting the same information they gave to Directi. If they were able to provide Directi with a list of 20,000+ domains from their control that were abusive, why can't they provide US directly with a single 1? Then, release a joint-statement talking about how the companies need to come together to combat the abusive activities across the net, yet when we extend our hand and open up our network, we don't even get a response! Directi went from being a "partner in crime" with us to being a great anti-abuse supporting company.. How can YOU claim that WE don't do anything, if you won't report your findings in the first place? Got recent stuff? Why are you willing to give it now that we're OFFLINE? What can we do about it NOW at this very minute? You tell me when your going to be in San Francisco, and I'll make myself available. Thank you for your time. Have a great day. --- Russell Mitchell InterCage, Inc. P.S. I just realized all my responses to earlier people like Gadi and them were direct and not cc to NANOG. Will "Reply to all" now :) ----- Original Message ---- From: Matt Jonkman <jonkman(a)jonkmans.com> To: Russell Mitchell <russm2k8(a)yahoo.com> Cc: nanog(a)nanog.org Sent: Sunday, September 21, 2008 4:02:15 PM Subject: Re: Atrivo/Intercage: NO Upstream depeer Russell Mitchell wrote: > ----- > > Matt: > It's very sad that your PROUD of you contribution to the supposed "white paper" on our company. I'd like to know, was any of your "contribution" to the report altered, or mis-represented, or are you truly unaware of how false the information you provided was? > Care to have verified it? or are you a Spamhaus admin like John Reid who has that magic stick to make a claim and attack anyone who objects to it with the truth? I'd love to, but nanog isn't the place. I'll be in san fran in the near future. Lets sit down over a beer, I'll bring the research and you can look it over yourself. That would be far more productive than this. I think a few other folks would love to meet up with you as well. Maybe Emil can join us too? It's easy to insinuate from behind a keyboard. Lets get down to facts. But take this off nanog. This is NOT the place for it. Let me know when you'l be in town, I'll schedule my travel in that direction to meet up soon. Matt -- -------------------------------------------- Matthew Jonkman Emerging Threats Phone 765-429-0398 Fax 312-264-0205 http://www.emergingthreats.net -------------------------------------------- PGP: http://www.jonkmans.com/mattjonkman.asc

2 1

Re: Atrivo/Intercage: NO Upstream depeer
by Andrew D Kirch 21 Sep '08

21 Sep '08

Russell Mitchell wrote: > Andrew: > If you have seen how Spamhaus handles our resolved SBL Listings, you > would know. > Those 6 listings have been resolved for a week now. John Reid and > his goons only provide swift LISTINGS, _NOT_ delistings. > Possibly why they're so widely used. > > In the past 12 months, I have received not 1 report of a botnet on our > network. Your e-mail is broken, or you're a liar, or both > Phishing pages are always nullrouted at the time of the report. The > "40 page report" you keep referring to is a complete farse. it's 'farce' but that couldn't matter less. > But, undoubtably, you truly believe that there is an "Atrivo" and > InterCage is a "partner in crime" to Atrivo huh? Results *1* - *10* of about *26,900* for atrivo. Results *1* - *10* of about *2,390* for *atrivo crime <http://www.google.com/url?q=http://www.answers.com/crime&r=67&sa=X&oi=dict&…>*. Results *1* - *10* of about *1,880* for *atrivo fraud <http://www.google.com/url?q=http://www.answers.com/fraud&r=67&sa=X&oi=dict&…>*. Results *1* - *10* of about *1,100* for *atrivo phish*. It seems that at least 26,900 people join me in the first fantasy, and 6000 or so join me in the second. Cult meetings are on Thrusday, we'll sacrifice a spammer. > Anything else you'd like to throw at me here on NANOG? Sure, but I havn't figured out how to hit someone with a two-by-four over the Internet. > I truly feel that there are very FEW in the anti-abuse community > that smelling fresh air. If you knew where you head was, and where it > should be, maybe this conversation and the happenings in the recent > week would have actually gave benefit to the internet in whole. Atrivo/Intercage is off the Internet. That sounds like Mission Accomplished to me. I'm done now, there's clearly nothing I can do to impart a clue here. Andrew

1 0

Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 21 Sep '08

21 Sep '08

William: To date, I have never heard of the "DroneBL". I have NEVER received any report from any entity referring to that. The last report for a bot on our network was an EggDrop bot a week or so ago. The report was from the IRC Network Operator, and asked to have it removed from his network because it seemed to be 'forgotten'. It was sitting in a dead channel that hasn't had any activity for months. He did NOT claim any abuse. I'll be more then happy to monitor DroneBL, or have digests or reports from them in regards to our network. ----- Matt: It's very sad that your PROUD of you contribution to the supposed "white paper" on our company. I'd like to know, was any of your "contribution" to the report altered, or mis-represented, or are you truly unaware of how false the information you provided was? Care to have verified it? or are you a Spamhaus admin like John Reid who has that magic stick to make a claim and attack anyone who objects to it with the truth? If you want to see REAL Cyber Crime, take a look at what you caused Matt. Take a good look at Spamhaus, and tell me that they're entirely legitimate with their business. Oh, I forgot, they're a "Not-for-profit organization" that DOESN'T do business in the USA, nor has any clientel in the USA. ----- There is absolutely no sense in arguing and biquering over all this crap that you guys have caused with your misinformation and false claims. I don't know how to make this any simpler: If you see abuse from our network, report it to US. If you report it to an upstream, they'll just drop it back down to us. Obviously, we can't do anything right now with our network being OFFLINE.. But I'm dying to see who comes up with some abuse that originated from our network in this downtime! Who will be first!? Spamhaus? Thanks again for all your time and comments. Hopefully, you all will straighten up your act, cause clearly and truthfully, we've been straight the entire time. --- Russell Mitchell InterCage, Inc.

2 1