- NANOG - lists.nanog.org

165 Halsey Newark 3rd Floor *explosion* ?
by Eric Kagan 28 Feb '07

28 Feb '07

We lost a bunch of MCI circuits at 8am EST this morning and the colo provider informed us there was some kind of explosion on the 3rd floor. Anyone have additional info or details ? Not sure how serious - our power is still on and our XO and ATT circuits are still up as well as bandwidth. Thanks Eric Eric Kagan

3 2

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]
by michael.dillon＠bt.com 28 Feb '07

28 Feb '07

> But suppose you put such a firewall in place. You'll need to > configure the firewall properly -- paying as much attention to > outbound rules as inbound. Sounds like a good thing to document in a best practices document that can be used to certify firewall implementations. When trying to solve a social problem, techniques like the Good Housekeeping seal of approval are quite effective. As recommended by the editors of... > You'll need to add anti-virus software. And anti-spyware software. > Then you need to make sure the "signature" databases for both of those > are updated early and often, What if the guidelines state that subscription and database oriented techniques for virus detection are not adequate and therefore not compliant. Only heuristic, capability-based systems are acceptable. > And you'll need to de-install IE and Outlook, Thus ensuring that Firefox/Thunderbird will be the main target of the malware people. Is this necessarily any better? Note that Windows provides an extensive series of hooks which can be used by an application which wishes to subvert the normal operation of the OS. That subversive application could be the security monitor which is required by the ISP for Internet access because it is recommended in your guidelines. > Something which requires this much work just to make it through its > first day online, while being used by J. Random Person, is hopelessly > inadequate. Which is why systems like this are routinely > compromised in > huge numbers. Which is why we have a large-scale problem on > our hands. We live in a complex world. Computers are more complex than they were. OSes are more complex. Apps are more complex. Networks are more complex. And SOLUTIONS are more complex. But if the designers of computers, OSes, apps and networks can deal with the complexity, why can't security folks do likewise? > This left me with >1.5M observed hosts seen in a month. > They're all sending > spam. (How do I know? Because 100% of the mail traffic sent to that > server is spam.) What you did sounds dumb except that you said this is an experiment. Unfortunately, real live email servers do exactly the same, i.e. talk to all comers, because the email architecture is flat like a pancake. Some people consider this to be a Windows malware problem. I consider it to be an email architecture problem. We all know that you need hierarchy to scale networks and I submit that any email architecture without hierarchy is broken by design and no amount of ill-thought-out bandaids will fix it. > Pop quiz, bonus round: how much does it cost Comcast to defend its > mail servers from Verizon's spam, and vice versa? Heck, how much > does it cost Comcast to defend its mail servers from its own spam? That actually sounds like an answerable question, if a company took it seriously enough. If the senders and receiver are both on your network, your finance department should be able to come up with some cost figures. --Michael Dillon

7 8

Re: 96.2.0.0/16 Bogons
by Fergie 28 Feb '07

28 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Randy Bush <randy(a)psg.com> wrote: >> your interpersonal skills are improving. > >well, at least i am actually doing research instead of doing nothing but >blindly whining abour anything by others that moves. Regardless of your slides, some people are still questioning that particular issue. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFF5SYhq1pz9mNUZTMRAtzJAJsGIl8mAadGTt7n/YTO08+PHpJHGgCePOCX C0DuVsTnXcSsQ+5Ph2ephXw= =wOuc -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Chicago Sprint - Global Crossing
by Mike Hammett 27 Feb '07

27 Feb '07

Does anyone else notice any issues? [root@ds00209 mhammett]# tcptraceroute 63.175.151.3 5060 Selected device eth0, address 205.218.65.34, port 51739 for outgoing packets Tracing the path to 63.175.151.3 on TCP port 5060, 30 hops max 1 205.138.198.193 2.686 ms 0.404 ms 1.042 ms 2 ge5-1.br03.chc01.pccwbtn.net (63.218.5.97) 0.444 ms 0.504 ms 0.411 ms 3 * * * 4 ge0-2-0-1000M.ar1.CHI2.gblx.net (67.17.107.193) 0.885 ms 0.531 ms 0.464 ms 5 sprint-1.ar1.CHI2.gblx.net (64.212.107.82) 26.533 ms 9.346 ms 54.376 ms 6 sl-bb22-chi-5-0.sprintlink.net (144.232.20.90) 112.045 ms 209.869 ms 202.905 ms 7 sl-bb20-roa-8-0-0.sprintlink.net (144.232.18.37) 15.198 ms 13.906 ms 32.054 ms 8 sl-gw20-roa-10-0.sprintlink.net (144.232.17.190) 104.213 ms 36.510 ms 34.817 ms 9 sl-essex-6-0.sprintlink.net (144.223.151.22) 53.096 ms 75.561 ms 51.180 ms 10 * * * 11 voip.essex1.com (63.175.151.3) [closed] 35.588 ms 69.591 ms * This is normally a < 5 ms traceroute.

1 0

Huricane Electric having problems in Chicago?
by Brandon Galbraith 27 Feb '07

27 Feb '07

Anyone having problems with Hurricane Electric in Chicago? I'm seeing all my packets through them dropped at gsr12012.chi.he.net [ 206.223.138.5]. Just wanted to see if I'm the only one. We're utilizing Hurricane Electric via the Equinix Direct service. -brandon

2 1

RBL for bots?
by Drew Weaver 27 Feb '07

27 Feb '07

Has anyone created an RBL, much like (possibly) the BOGON list which includes the IP addresses of hosts which seem to be "infected" and are attempting to brute-force SSH/HTTP, etc? It would be fairly easy to setup a dozen or more honeypots and examine the logs in order to create an initial list. Anyone know of anything like this? -Drew

13 24

L3 outage
by David Lesher 27 Feb '07

27 Feb '07

I'm told {by atlantech.net} that L3 is wounded in the east-central region; i.e. DC-NYC at least... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Looking for someone clueful from NetNation
by David Temkin 24 Feb '07

24 Feb '07

Please contact me off-list about an abuse concern involving one of your customers. Thanks, -Dave

1 0

Fwd: Impending publication: draft-iab-iwout-report-03.txt
by Fergie 24 Feb '07

24 Feb '07

I thought that many of you on the list might actually be interested in this... FYI. - ferg [snip] To: IETF Announcement list <ietf-announce(a)ietf.org> From: Leslie Daigle <leslie(a)thinkingcat.com> Date: Fri, 23 Feb 2007 14:56:39 -0500 Cc: iab(a)ietf.org Subject: Impending publication: draft-iab-iwout-report-03.txt The IAB is ready to ask the RFC-Editor to publish Report from the IAB workshop on Unwanted Traffic March 9-10, 2006 <draft-iab-iwout-report-03.txt> as an Informational RFC. This document is a report from an invitational workshop convened by the IAB. As such, it represents the opinions of the attendees expressed at the time of the workshop. Please direct any comments to improve the clarity of the report to the IAB (iab(a)iab.org) by March 23, 2007. The document can be found at http://www.ietf.org/internet-drafts/draft-iab-iwout-report-03.txt From the Abstract: This document reports the outcome of a workshop held by the Internet Architecture Board (IAB) on Unwanted Internet Traffic. The workshop was held on March 9-10, 2006 at USC/ISI in Marina del Rey, CA, USA. The primary goal of the workshop was to foster interchange between the operator, standards, and research communities on the topic of unwanted traffic, as manifested in, for example, Distributed Denial of Service (DDoS) attacks, spam, and phishing, to gain understandings on the ultimate sources of these unwanted traffic, and to assess their impact and the effectiveness of existing solutions. It was also a goal of the workshop to identify engineering and research topics that could be undertaken by the IAB, the IETF, the IRTF, and the network research and development community at large to develop effective countermeasures against the unwanted traffic. Leslie Daigle, For the IAB. _______________________________________________ IETF-Announce mailing list IETF-Announce(a)ietf.org https://www1.ietf.org/mailman/listinfo/ietf-announce [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Possible Level3 Fibre Cut
by John van Oppen 24 Feb '07

24 Feb '07

Cogent's network is built mostly on wiltel fiber. For those who don't recall, wiltel was bought by level 3. I bet that is what he was referring to. John :) -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of virendra rode // Sent: Thursday, February 22, 2007 6:49 AM To: Rob Baxter Cc: nanog(a)merit.edu Subject: Re: Possible Level3 Fibre Cut -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Rob Baxter wrote: > I mean exactly what I said. I grabbed that info from > http://status.cogentco.com/ after seeing a few complaints from users. > > Rob - ------------------------ Sorry I meant your subject? regards, /virendra > > virendra rode // wrote: > Rob Baxter wrote: >>>> ** Cogent Network Status Report Last Updated Wed Feb 21 16:35:00 2007 ** >>>> >>>> Cogent Network Status/DNS Server Status Description: >>>> We currently have a possible fiber cut between Stamford, CT and New York >>>> City, NY. This may cause some latency for some of our customers between >>>> Boston and New York. We are working to correct the situation and >>>> currently do not have an ETA. Thank you. >>>> >>>> >>>> Rob Baxter > ----------------------- > You mean cogent, correct? I'm not seeing anything on level3 side. I know > there's level3 maintenance scheduled to occur within 36 hours. > > > regards, > /virendra > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF3a1gpbZvCIJx1bcRAm9TAKC2Qcvo64irbLU9sznkOv6YslAjRQCeLWRJ zZhUdN4mM/W6i0j11Kqmp14= =J0dD -----END PGP SIGNATURE-----

2 1