- NANOG - lists.nanog.org

Geo location to IP mapping
by Ashe Canvar 17 May '06

17 May '06

Hi all, Can any of you please recommend some IP-to-geo mapping database / web service ? I would like to get resolution down to city if possible. Thanks and Regards, -ashe

17 27

Proxad? (Was: Drone Armies)
by Michael Loftis 16 May '06

16 May '06

--On May 16, 2006 7:47:43 AM -0500 c2report(a)isotf.org wrote: <...> > Top 20 ASNes by number of active suspect C&Cs. These counts are > determined by the number of suspect domains or IPs located within > the ASN completed a connection request. > Percent_ > ASN Responsible Party Total Open Resolved <...> > 12322 PROXAD AS for Proxad ISP 7 7 0 Now this is interesting to me, because proxad has been at least as big a pain in my side as far as drones and SPAM sources. Right behind Comcast in no1 and RoadRunner in no2, but I'd never heard of them until they started showing up on my lists a while back...maybe a year or so ago. Anyone else seeing the same amount of problems with these guys? It's just interesting to me that whoever they are, as far as volume of problems from *my* perspective they're as bad as comcast and rr.... -- "Genius might be described as a supreme capacity for getting its possessors into trouble of all kinds." -- Samuel Butler

2 1

Re: Geo location to IP mapping
by Martin Hannigan 16 May '06

16 May '06

At 03:56 PM 5/15/2006, Alexander Harrowell wrote: >This is a frequent source of silly news stories - viz. the recent >one, based on Google Trends, that Birmingham (UK) is the "top city" >for porn searches and Brentford (UK) in the top five despite being a >small suburb of London. Reason: both are the location of big isp NOCs. Since you completely ignored the security aspect, I'll address your reference to Google Trends. This is what you are probably talking about: http://www.google.com/trends?q=porn If what you are saying is true, that's some pretty bad geo-location and YMMV, but what source are you using to discount Googles numbers? Are you saying that everyone on all 3 shifts in those "two large NOC's" are searching for Porn on Google? Or are you saying that all their netblocks are in whois and have roles that state their blocks are located at those NOC's? If it's the latter, that would support either you being innacurtae in your assumption about the Trend, or google being wrong. I'd need more proof that Google is that far off and that it would "appear" as though they are simply using whois registrations for geo locating in their Trends product. I'd tend to doubt it. Anything is possible, I suppose. -M< >On 5/15/06, Martin Hannigan ><<mailto:hannigan@renesys.com>hannigan(a)renesys.com> wrote: > >At 01:56 PM 5/15/2006, ><mailto:Valdis.Kletnieks@vt.edu>Valdis.Kletnieks(a)vt.edu wrote: > > > >On Mon, 15 May 2006 13:14:41 EDT, Bill Nash said: > > > It works for spammers. > > > >Certainly explains all the Turkish spam I get, what with me being > >just outside Ankara and all. > > >That's likely because they are attempting to do some sort >of location analysis themselves and have limited data to >work with. Spammers are generally not stupid. They are cheap >since their ability o generate revenue is randomized based on >the exploit of the day, so to speak. Targeting you with Turkish >ads is probably a combination of being cheap and someone possibly >stupid. Anyhow...before this thread turns into the debacle of >incorrect information that the NTP one did -- > >Typically, an ip address is analyzed by using multiple sources of data. >An attempt is made at a "triangulation" of sorts with both >good and bad bits compared. As the good bits build the confidence >factor in the triangulation rises. So you could have 2 pieces of >info that do correlate, bring in the whois record, no correlation >with that, and then toss it and bring something else in. Whois >accuracy is not a factor here. > >Geo location isn't perfect, but it's not "bad". I've heard of >accuracy levels as high as 90% and I don't think that's too far >fetched. With HostIP reporting 50% on the user survey and them being >what I can demonstrate as "bad", 90% isn't a stretch at all. > >Look at a geo use case. If there were a cyber threat level, >a defcon so to speak, and the highest level is 5 and we reach this >level someday, it could be prudent to build filter lists based on geo >located routing table data and begin to block and log certain sources >based on the threat level alone. Good geo data makes this entirely feasible. > >Applying this type of thinking to Internet doomsday scenarios >will be key in survivability, IMHO. If you want every solution >to be 100%, we're likely to be down for some factor longer than >we need to be. > >Anyhow, back to your regularly scheduled show. :-) > >-M< > > > > > >-- >Martin Hannigan (c) 617-388-2663 >Renesys Corporation (w) 617-395-8574 >Member of Technical Staff Network Operations > ><mailto:hannigan@renesys.com>hannigan(a)renesys.com > -- Martin Hannigan (c) 617-388-2663 Renesys Corporation (w) 617-395-8574 Member of Technical Staff Network Operations hannigan(a)renesys.com

6 8

RE: About Cisco NM-2FE2W-v2
by Carl Kloppenborg 16 May '06

16 May '06

Correct, the NM-2FE2W-v2 is not supported by 2800 series routers. See http://www.cisco.com/en/US/products/hw/routers/ps259/products_data_sheet 09186a00801aa71c.html under Orderability, Availability, Compatability, Minimum Software, and Memory Requirements. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Andrew D Kirch Sent: Tuesday, May 16, 2006 8:40 AM To: nanog(a)merit.edu Subject: Re: About Cisco NM-2FE2W-v2 Md. kamal Hossain wrote: > Hi all > > I purchase a Cisco-2851 and NM-2FE2W-v2 module because i need 4 > Fastethernet interface but when i plug the module IOS don't detect the > module.Is there any specific IOS for the NM-2FE2W-v2 module?.now IOS > version is 12.3.If any one have any idea pls reply me. > > Wow, where to start on this one. I didn't realize this was Cisco's post-sales support line. Further, I don't think a Cisco 2851 exactly constitutes core network operations. In the future you would probably be better off with a cisco-related IRC channel, or web board. That being said, I'll see if I can't field this real quick. The 2851 is not powerful enough to route 1 port of 100bT Ethernet let alone 4. What feature set is your IOS revision? Without knowing that I doubt anyone could even begin to troubleshoot this issue. Have you checked to make sure the NM-2FE-2W is compatible with your router AT ALL? After reading the "Relevant Interfaces and Modules" documentation at cisco.com I do not see this module being used with 2800 series routers, or it's predecessor, 2600 series routers for that matter. This is of course all publicly available documentation. Everything I've seen points to them working only with 3600, 3700, and possibly 3800 series chassis. My best suggestion would be to pack up your router, and the network module and send them to a good home with a caring network admin to tend to them. If you would like, please contact me off-list as I've been known to provide shelter to abused and mistreated routing gear. > thanks > > Kamal > > -- > This message has been scanned for viruses and > dangerous content and is believed to be clean.

1 0

About Cisco NM-2FE2W-v2
by Md. kamal Hossain 16 May '06

16 May '06

Hi all I purchase a Cisco-2851 and NM-2FE2W-v2 module because i need 4 Fastethernet interface but when i plug the module IOS don't detect the module.Is there any specific IOS for the NM-2FE2W-v2 module?.now IOS version is 12.3.If any one have any idea pls reply me. thanks Kamal -- This message has been scanned for viruses and dangerous content, and is believed to be clean.

2 1

Re: Geo location to IP mapping
by Daniel Senie 16 May '06

16 May '06

At 10:39 AM 5/16/2006, Tao Wan wrote: >Here is a tech report with a survey on geolocation and evasion techniques: > >http://www.scs.carleton.ca/~jamuir/papers/TR-06-05.pdf This document seems to miss one other fairly common way in which geolocation fails: VPN. Whether a single user VPN session in which the user's laptop obtains an IP address from the VPN gateway, or a subnet extended out across a VPN to a remote office, the user(s) will appear to be at the location of the VPN concentrator. While ping latency, if even transported over the VPN, may show a greater distance than other IP addresses in teh neighborhood, there is no clear way to know why that latency is higher. It's odd this was omitted.

1 0

Re: Geo location to IP mapping
by Tao Wan 16 May '06

16 May '06

Here is a tech report with a survey on geolocation and evasion techniques: http://www.scs.carleton.ca/~jamuir/papers/TR-06-05.pdf Thanks, Tao Wan http://www.scs.carleton.ca/~twan

1 0

Drone Armies C&C Report - 16 May 2006
by c2report＠isotf.org 16 May '06

16 May '06

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 3020 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 9826 reported C&Cs. Of the suspect C&Cs surveyed, 666 reported as Open, 734 reported as closed, and 587 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 4597 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 19318 AIC-81 Albany International Corp. 58 15 74 13301 UNITEDCOLO-AS Autonomous System of 54 37 31 30058 FDCSE FDCservers.net LLC 43 17 60 8972 INTERGENIA-ASN intergenia autonomou 40 23 43 3561 Savvis 34 5 85 4134 CHINANET-BACKBONE 32 13 59 30315 Everyones Internet 28 11 61 13749 EVRY Everyones Internet 28 8 71 23522 CIT-FOONET 27 14 48 4766 KIXS-AS-KR 26 4 85 30407 Velcom.com 24 20 17 33597 InfoRelay Online Systems, Inc. 23 0 100 8560 SCHLUND-AS 22 5 77 4314 IIS-64 I-55 INTERNET SERVICES 21 2 90 7132 SBC Internet Services 21 4 81 30083 Server4You Inc. 20 6 70 12832 Lycos Europe 20 0 100 174 Cogent Communications 20 14 30 27595 ATRIV Atrivo 19 2 89 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 19 0 100 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 54 37 31 8972 INTERGENIA-ASN intergenia autonomou 40 23 43 30407 Velcom.com 24 20 17 30058 FDCSE FDCservers.net LLC 43 17 60 19318 AIC-81 Albany International Corp. 58 15 74 174 Cogent Communications 20 14 30 23522 CIT-FOONET 27 14 48 4134 CHINANET-BACKBONE 32 13 59 29073 COLINKS-AS Colinks web and game hos 15 12 20 19166 Alpha Red, INC 16 12 25 30315 Everyones Internet 28 11 61 7018 AT&T WorldNet Services 14 9 36 4713 OCN NTT Communications Corporation 15 9 40 9911 CONNECTPLUS-AP Singapore Telecom 13 8 38 3462 HINET 19 8 58 9121 TTNet 10 8 20 13749 EVRY Everyones Internet 28 8 71 16265 LEASEWEB AS 13 7 46 32748 NOZON NoZone 13 7 46 12322 PROXAD AS for Proxad ISP 7 7 0 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

About Cisco NM-2FE2W-v2
by Md. kamal Hossain 16 May '06

16 May '06

Hi all I purchase a Cisco-2851 and NM-2FE2W-v2 module because i need 4 Fastethernet interface but when i plug the module IOS don't detect the module.Is there any specific IOS for the NM-2FE2W-v2 module?.now IOS version is 12.3.If any one have any idea pls reply me. thanks Kamal -- This message has been scanned for viruses and dangerous content, and is believed to be clean.

1 0

Re: Geo location to IP mapping
by Edward B. DREGER 16 May '06

16 May '06

AH> Date: Mon, 15 May 2006 23:24:13 +0100 AH> From: Alexander Harrowell AH> [W]hen the path is [...] it won't be quite that clear. Exactly. It's a bit different than triangulating cell towers based on signal strength. Since when does the NSA patent things, anyhow? I'd think they would keep secret anything that's actually effective. Eddy -- Everquick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita ________________________________________________________________________ DO NOT send mail to the following addresses: davidc(a)brics.com -*- jfconmaapaq(a)intc.net -*- sam(a)everquick.net Sending mail to spambait addresses is a great way to get blocked. Ditto for broken OOO autoresponders and foolish AV software backscatter.

2 1