- NANOG - lists.nanog.org

Re: GoDaddy.com shuts down entire data center?
by Martin Hannigan 16 Jan '06

16 Jan '06

Here's the story on the big outage. http://marc.perkel.com/index.html Here's another recorded conversation. (Can you do this in NJ?) http://marc.perkel.com/audio/godaddy2.mp3 The GoDaddy folks are well trained. Kudos. -M<

5 5

Odd policy question.
by Drew Weaver 16 Jan '06

16 Jan '06

Maybe not such an odd question; Anywhoo, we have quite a few people who register our IP addresses as nameservers, and then never delete the records. I don't suppose there is any way that we can delete these old records, we have appealed to multiple registrars such as godaddy, enom, and the like to remove these bogus NS records from our IP space which keep our new customers from using these IP addresses for hosting but they claim that we have no grounds even though we are the legitimate 'keepers' of said IP space. This is mainly a problem for customers who use software such as cPanel which likes to always make NS records automatically, and customers almost never remove these at their registrar. Any thoughts? -Drew

6 7

Re: GoDaddy.com shuts down entire data center?
by Alexander Harrowell 16 Jan '06

16 Jan '06

I'm astonished GoDaddy pulled anyone for spamming. Isn't spamming the whole point of GoDaddy, what with its content-free WHOIS records, integrated no-name domain registry and hosting division? In fact, I would go so far as to say taking out entire GoDaddy would probably be a small increase in the amount of useful information on the Net..

1 0

Re: GoDaddy.com shuts down entire data center?
by Martin Hannigan 16 Jan '06

16 Jan '06

> > > > > The way a policy is enforced - how, in what situations etc - is what > > matters. Most if not all ISP AUPs say basically the same mom and > > apple pie thing (no net abuse or we'll shut you down) > > > > If what this guy says is right, his domain was taken down just because > > one of his servers was broken into and spammed through. I havent > > heard godaddy's side of the story yet - might be better to reserve > > judgement till they comment. > > > > Godaddy (from what I can gather) generates a surprising number of these > shut downs on weekends. The fact that their enforcement and > reinstatement rules are not publicly available on their website > (anywhere) and have no guarantees or assurances on time-to-respond > smacks of something that could get very nasty and seems highly > reactionary.... Would they suspend comcast.com or mcdonalds.com or > ge.com if _one_ of their servers or services was hijacked? Highly doubtful. > > In the long run, if this is a trend, those big enough will just become > registrars themselves -- even if its just for their own operations. Its > a silly thing for a domain registrar to take on enforcement operations > that network operators aren't. Abusers don't care about domains, or > domain names. Most abuse (spam aside) can operate perfectly well with > just an IP address. By the time the DNS system pulls a domain the damage > has already been done and the potential for high collateral damage is > significant. Restoration time for good-eggs (say those who fix the > problem once properly alerted) is several days in the best of cases with > the bad result of acrimony and huge financial/reputation impact.... > > The only medium term impact is that Godaddy will lose the bad business > and some good business and create some more competitors. The only point I am trying to make is operational WRT the command structure of a NOC. Several of us here have built many of the large NOC's in operation of the Internet today and if you put us all in the same room we'd all agree that we already know how to build NOC's that respond and get the job done for the most part. It ain't that hard anymore. Question: Do people really think waking up Bob Parsons at 0400 is a good idea for a $9.00 domain only account? He already got a roughly ~$50.00 response with all the time he had GoDaddy on the phone and the out supervisor call. I think if Parkel does, he needs to sign up with VeriSign, UltraDNS, or anyone else who is running DNS assurance products. Note: Please refrain from inferring an endorsement for DNS assurance products. -M<

1 0

RE: Problems connectivity GE on Foundry BigIron to Cisco 2950T
by Farrell,Bob 16 Jan '06

16 Jan '06

Possibly a bad cable ? Cisco commands- speed 1000 duplex full to set back to auto speed auto duplex auto -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Randy Bush Sent: Sunday, January 15, 2006 4:10 PM To: David Hubbard Cc: Sam Stickland; nanog(a)nanog.org Subject: RE: Problems connectivity GE on Foundry BigIron to Cisco 2950T > You are using a crossover cable right? >> I'm having a right mare trying to get a Foundry BigIron to >> connect up to a cisco 2950T, via Gigabit copper. i was under the impression that gige spec handled crossover automagically randy

6 10

Problems connectivity GE on Foundry BigIron to Cisco 2950T
by Sam Stickland 15 Jan '06

15 Jan '06

Hi, I'm having a right mare trying to get a Foundry BigIron to connect up to a cisco 2950T, via Gigabit copper. The Foundry BigIron is using a cisco RJ45/copper GBIC that was pulled from a live cisco 6500, where it was working fine. The cisco 2950T has two fixed 10/100/1000 RJ45 ports. The cables between the equipment have been tested and are fine. The Foundry has three different types of the gigabit negiation modes: auto-gig Autonegotiation neg-full-auto Autonegotiation first, if failed try non-autonegotiation neg-off Non-autonegotiation I've tried all three, complete with all the other possibilities with the cisco 2950T (which has fixed full duplex operation, but can be set to 'speed auto' or 'speed 1000'). None of these combinations bring up the link. The cisco 2950 never gets a link light. The Foundry gets a link light regardless when it's mode is set to 'gig-default neg-off'. I'm at a bit of a loss to explain this. Does anyone know of any configuration issues that can explain this, or is it time to start swapping out hardware components? Sam

1 0

Worm?
by Byrne, David 14 Jan '06

14 Jan '06

Anyone know about a new worm going around? Our IPS vendor says that they have a number of customers affected by traffic volume, but I don't know any details. Thanks, David Byrne Corporate IT Security EchoStar Satellite L.L.C. 720-514-5675 david.byrne(a)echostar.com

2 1

Re: AW: Odd policy question. (verification please)
by Martin Hannigan 14 Jan '06

14 Jan '06

> > Hello! This is kurt(a)cnw.com, > > I am taking a proactive approach to screening my emails so that I don't get junk mail. > > Please just click on the link below so I can get your message, and all your future messages. You only have to do this ONCE! Kurt, and our friends at CNW, you realize this is fairly bad for this list? Any chance you can whiteliet \nanog.org and ban from there down? Thanks! -M<

2 1

Re: Cisco, haven't we learned anything? (technician reset)
by Rob Thomas 14 Jan '06

14 Jan '06

Hi, Matthew. ] Cisco Router and Security Device Manager (SDM) is installed on this device. ] This feature requires the one-time use of the username "cisco" ] with the password "cisco". Interesting. Is it limited to one-time use? Are the network login services (SSH, telnet, et al.) prevented from using this login and password? Thanks! Rob. -- Rob Thomas Team Cymru http://www.cymru.com/ ASSERT(coffee != empty);

11 14

RE: Is my router owned? How would I know?
by Barry Greene (bgreene) 14 Jan '06

14 Jan '06

Here are some other new things (Cisco IOS specific): Login Security Enhancements. The Cisco IOS Login Enhancements feature allows users to better secure their Cisco IOS devices when creating a virtual connection, such as Telnet, secure shell (SSH), or HTTP. Thus, users can help slow down dictionary attacks and help protect their router from a possible denial-of-service (DoS) attack. http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_ guide09186a00801d1cb3.html Configuration Change Notification and Logging. Releases of Cisco IOS software prior to 12.3(4)T/12.2(25)S lack the ability to track the origin of changes to the running configuration. The only way to determine if a Cisco IOS software configuration has been changed is to pull the running and startup configurations offline and do a line-by-line comparison. This comparison will identify all the changes that have occurred between the two configurations, but it will not specify the sequence in which the changes occurred or the person responsible for the changes. The Configuration Change Notification and Logging (Configuration Logging) feature allows the tracking of configuration changes entered on a per-session and per-user basis by implementing a configuration log. The configuration log will track each configuration command that is applied, who applied the command, the parser return code for that command, and the time that the command was applied. This feature also adds a notification mechanism that sends asynchronous notifications to registered applications whenever the configuration log changes. http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_ guide09186a00801d1e81.html And then there is 'security passwords min-length'. If you set this to 6 more more, it would knock out 'cisco' as a possible password on the router. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Rob Thomas > Sent: Thursday, January 12, 2006 10:19 AM > To: NANOG > Subject: Is my router owned? How would I know? > > > Hi, NANOGers. > > You all know how I love a good segue... ;) > > How can you tell if your router has been owned? In general > the configuration will be modified. This is why we advocate > using rancid (or something akin to it) as both a > configuration backup tool AND an early warning tool. If you > have a router running BGP, it also pays to peer with it > externally. You can use a private ASN and rackspace with a > buddy. You can use this peering to detect announcements you > don't expect or necessarily condone. > > How else can you tell? Here are some tips: > > If there is a new user account, or if the enable and access > passwords have changed, look out! The miscreants love to > scan and find routers with "cisco" as the access and enable > passwords. They know that other miscreants are doing the > same thing. In fact this is even more widespread thanks to a > module found in rBot and rxBot. Yes, even bots are scanning > for routers now. > > If there are new or changed ACLs, look out! The miscreants > love to use routers as IRC bounces. To avoid detection by > IRC server proxy monitors, the miscreants will block access > to the router (generally all access, sometimes just TCP 23) > from those proxy monitors using ACLs. > > If there are new or changed SNMP RW community strings, look out! > One of the tricks they employ is to leave a SNMP RW community > backdoor. Is this to avoid the actions of we good folk? No, > it's usually employed in the case where a compromised router > is stolen from one miscreant by another. > > If the banner has changed, look out! As with the ACLs, this > is a method by which the miscreants attempt to fool any proxy > monitors. > The most common banner we see identifies the router as a FreeBSD box. > > If tunnels suddenly appear on the router, look out! Chaining > together lots of routers is also common now. This provides > obfuscation and sometimes encryption. > > Most of the changes are based on templates. Consider this > bundled clue, where the prowess of the template user isn't at > all a factor. > > Use the flows. :) > > Thanks, > Rob. > -- > Rob Thomas > Team Cymru > http://www.cymru.com/ > ASSERT(coffee != empty); >

4 3