- NANOG - lists.nanog.org

BGP and GLB.
by Robert Sherrard 02 Aug '06

02 Aug '06

Does anyone know of some good writeup that details using BGP as a form of global load balancing, between multiple sites. Rob

1 0

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 01 Aug '06

01 Aug '06

----- Original Message Follows ----- From: Paul Vixie <vixie(a)vix.com> > > Today it has become (close to) completely useless. ... > > i wish that the value of this activity were zero. instead > , it's negative. see <http://fm.vix.com/internet/security/superbugs.html> > for details. -- That's all fine and dandy until you consider the international base of these things. I'd like to see "...jackbooted [US is implied in the text] government thugs...kicking in a door somewhere and confiscating every powered device and every living person in the building" in China, an African country, Russia, or <insert country of choice here>. These things span continents and countries and every time you cutoff the current head, it immediately spawns another and not always in a country that cares. scott

4 3

None
by Dr. Mosh 01 Aug '06

01 Aug '06

unsubscribe -- -------------- http://www.zeromemory.com - metal for your ears.

1 0

AOL Email Contact me offline please
by Elijah Savage 01 Aug '06

01 Aug '06

It is not about spam or being blocked I actually would like to speak with someone about services provided. This is very important as I can not find my answers on the postmasters website. Thank you

1 0

Drone Armies C&C Report - 01 Aug 2006
by c2report＠isotf.org 01 Aug '06

01 Aug '06

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 3639 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 10895 reported C&Cs. Of the suspect C&Cs surveyed, 658 reported as Open, 932 reported as closed, and 570 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 4818 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 19318 NJIIX-AS-1 - NEW JERSEY INTERN 71 16 77 13301 UNITEDCOLO-AS Autonomous System of 63 29 54 4766 KIXS-AS-KR 41 12 71 23522 CIT-FOONET 39 14 64 4134 CHINANET-BACKBONE 32 15 53 9318 HANARO-AS 27 8 70 8560 SCHLUND-AS 27 6 78 16265 LEASEWEB AS 27 19 30 4837 CHINA169-Backbone 25 11 56 3561 Savvis 25 4 84 12832 Lycos Europe 25 5 80 33597 InfoRelay Online Systems, Inc. 24 0 100 174 Cogent Communications 23 16 30 7132 SBC Internet Services 23 5 78 30315 Everyones Internet 22 8 64 19166 Alpha Red, INC 22 10 55 4314 IIS-64 I-55 INTERNET SERVICES 21 2 90 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 20 0 100 30058 FDCSE FDCservers.net LLC 19 6 68 13749 EVRY Everyones Internet 19 1 95 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 63 29 54 16265 LEASEWEB AS 27 19 30 174 Cogent Communications 23 16 30 19318 NJIIX-AS-1 - NEW JERSEY INTERN 71 16 77 4134 CHINANET-BACKBONE 32 15 53 30407 Velcom.com 16 15 6 23522 CIT-FOONET 39 14 64 9316 DACOM-PUBNETPLUS-AS-KR 14 13 7 35908 Krypt Technologies Inc. 17 13 24 4766 KIXS-AS-KR 41 12 71 4837 CHINA169-Backbone 25 11 56 19166 Alpha Red, INC 22 10 55 1659 ERX-TANET-ASN1 16 9 44 18942 WEBHO-3 WebHostPlus Inc 13 9 31 9318 HANARO-AS 27 8 70 30315 Everyones Internet 22 8 64 25761 STAMIN-2 Staminus Communications 14 8 43 31312 VNL Video Networks Limited 8 7 13 8560 SCHLUND-AS 27 6 78 9911 CONNECTPLUS-AP Singapore Telecom 9 6 33 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

ISP/Satellite access in Fiji
by Mike Donahue 01 Aug '06

01 Aug '06

Hello all, apologies in advance if this is too OT. Am seeking experiences/recommendations for connectivity options in Fiji. Any input appreciated. Replies off-list, please. Thanks in advance, Michael Donahue

1 0

Panama NAP/PNAP
by Paul English 31 Jul '06

31 Jul '06

Hi, Can someone tell me where the Panama NAP/PNAP is located (ie: what building?). I have looked at the archives and most of the information available online is in Spanish and/or quite outdated, and unfortunately I don't speak Spanish. Thanks, Paul

2 2

IETF Last Call on draft-ietf-opsec-current-practices-06
by Ross Callon 31 Jul '06

31 Jul '06

The IETF is currently last calling the document "Operational Security Current Practices". Given the obvious relevance to service providers, and as discussed at the recent Nanog meeting in San Jose, we would also like to solicit comments from the Nanog community. Comments can be sent to the Nanog email list. The document is at: http://www.ietf.org/internet-drafts/draft-ietf-opsec-current-practices-06.t… In order to provide time to review the document, we will extend the last call for a week, until Tuesday August 15th. Thanks, Ross >Date: Mon, 24 Jul 2006 17:01:58 -0400 >To: opsec(a)ops.ietf.org >From: Ross Callon <rcallon(a)juniper.net> >Subject: Begin Last Call on draft-ietf-opsec-current-practices-06 > >This begins working group last call on draft-ietf-opsec-current-practices-06 >"Operational Security Current Practices". The last call will terminate two >weeks from tomorrow (Tuesday August 8th). > >Comments to the list please. > >thanks, Ross

1 0

Re: AW: mitigating botnet C&Cs has become useless
by Gadi Evron 31 Jul '06

31 Jul '06

On Mon, 31 Jul 2006, Dean Anderson wrote: > You are approaching the problem the wrong way. Many failover systems > work very well when the primary fails entirely--when the salesman pulls > the plug. Few work well when the primary doesn't entirely fail, but > just doesn't work correctly, as is usually the case in the real world. Such as? How does it apply to the network world? > Try that approach on the C&Cs: infiltrate and use the C&C to the > botnets' disadvantage. Probably, you can cause an "upgrade" to be > distributed to the infected hosts that doesn't have a secondary control > channel, but that doesn't overly alert the human bot operators until its > too late. Infiltration is intelligence, not network.. uploading a file is illegal and unethical... Good solid ideas, but unfortunately failed in the past. > > Of course, Nanog seems not to appreciate my contributions, so I won't be > sharing anything else I know about the problem. Good luck. > > --Dean > > On Mon, 31 Jul 2006, Gadi Evron wrote: > > > > > On Sun, 30 Jul 2006, Gunther Stammwitz wrote: > > > The really interesting question is when botnets are going to use > > > p2p-technologies since one wouldn't know how to stop them then. > > > Please let that never happen.... > > > > > > > I am not sayin gyou are wrong, or that dynamic channels won't happen far > > more widely. Currently they are not widely used as they are not > > needed. Web, IRC, etc. are quite efficient. > > > > That said, there is one problem to solve with every evolved C&C, the more > > complex it is the easier it is to follow. > > > > Gadi. > > > > > > > > -- > Av8 Internet Prepared to pay a premium for better service? > www.av8.net faster, more reliable, better service > 617 344 9000 > >

2 1

anyone from Yahoo here?
by Robert E.Seastrom 30 Jul '06

30 Jul '06

This is kind of a disgrace. Hopefully public mention of it will cause repairs to happen. ---Rob

1 0