- NANOG - lists.nanog.org

Re: NANOG List Server on several BlockLists
by Matthew Sullivan 27 Jul '05

27 Jul '05

Mikael Abrahamsson wrote: > On Wed, 27 Jul 2005, Matthew Sullivan wrote: > >> John Palmer wrote: >> >>> FYI: The IP address of the mail server that sends out NANOG list >>> messages >>> (198.108.1.26) is once again on most of the major RBLs. >> >> >> Was a mistake and was removed promptly as soon as we were notified. > > > What was the mistake? Would be informational to know how this happened > (again) and how it's not going to happen again in the future? I'm not going to give the gory details, but part of it was a mistake with a mouse click that I personally made. Ironically the main part of the reason it happened was because I was modifying the scripts to help prevent this sort of thing occuring in the future. Regards, Mat

1 0

NANOG List Server on several BlockLists
by John Palmer 27 Jul '05

27 Jul '05

FYI: The IP address of the mail server that sends out NANOG list messages (198.108.1.26) is once again on most of the major RBLs.

9 10

Internet phone providers given more time on 911
by Fergie (Paul Ferguson) 27 Jul '05

27 Jul '05

Wow, a whole month! A Reuters newswire article by Jeremy Pelofsky, via Yahoo! News, reports: [snip] Internet telephone service providers are getting a month longer to get their customers to acknowledge they know about the limitations of dialing 911 for help, U.S. communications regulators said on Tuesday. [snip] http://news.yahoo.com/news?tmpl=story&u=/nm/20050726/wr_nm/telecoms_voip_fc… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

6to4 routes disappeared from most of North America?
by Todd Vierling 27 Jul '05

27 Jul '05

Maybe I missed it, but was there some concerted effort to remove or block access to the 2002::/16 route on the v6 backbone in North America recently? Connectivity to/from 6to4-only hosts seems sketchy at best. Of the US hosts I've tried, only ISC has responded at all to a 6to4 packet -- and they're routing 2002::/16 through WIDE in Japan from what I can tell. >From about half the US IPv6 looking glasses I've tried, the route is missing entirely. By contrast, I can see it everywhere, typically from multiple upstreams, in JP (no surprise there), CH, DE, and FR that I've tried so far. I haven't been using 6to4 for almost 6 months now, but this seems like a really alarming step backwards as far as v6 adoptability goes in dynamic v4-pool environments. Yes, I'm aware of the security implications of 6to4 -- but if the RFC-suggested header address checks are properly performed at the ingress 6to4 gateway, the burden of security falls on the 6to4 user alone, which is (IMHO) an acceptable situation. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

2 2

open source tools help (contract) in DC area?
by Howard C. Berkowitz 26 Jul '05

26 Jul '05

I need to get some short-term contract help on setting up a lab dealing with SP security issues, in the Washington DC area. Please contact me offline if interested. I am the technoid and will pass you on for the mercenary aspects. ccitraining.net is developing a complex set of network security lab exercises involving Cisco routers and switches, Slackware 10.0 LINUX servers and workstations, and Windows workstations, the latter to be infected with worms as part of running the lab. We need a *NIX administrator to help us get the appropriate, primarily open-source tools installed, running, and documented. Since we do not intend to teach the full tool command set, we will need shell scripts and/or command files to be piped to a telnet/SSH client to let the students access useful tool functions without being fully trained in the device. For that reason, we expect the primary interface to the tools will be command line, so that the tool control can be scripted. Students will use GUI functions only to display output from tools, or to access graphic functions in the tools. Since there are multiple people working on the project in a virtual team, at different locations, it is absolutely essential that documentation be generated at the start of working with a tool, and then to be polished with final parameterization and use documentation. Documentation can be at the level of a couple of man pages, but it is essential that other team members can quickly find out how to parameterize and invoke the tools. Project managers also need to be able to track the status of tool implementation -- we do not consider an undocumented tool as installed. Identified tools include: syslogd RRD (successor to MRTG) MIB objects to be accessed Flowscan/Flowtools (successors to cflowd) Ethereal In addition, we will need a number of scripting tools to make incremental changes to router, switch and host configurations, as well as loading complete executables and images. We will also need Windows control to infect hosts with specific viruses and possibly bots, and to restore infected hosts to a stable environment. Understanding, from the Windows and protocol standpoint, of worms, other DDoS, and BOTNETs will be very helpful. Knowledge of packet crafting tools for *NIX, which let us build arbitrary protocol packets to be used in attacking hosts and routers, will also be a big help.

3 4

Completewhois New Utility - Traceroute
by william(at)elan.net 26 Jul '05

26 Jul '05

This post is a lot lot smaller as is traceroute utility interface at: http://www.completewhois.com/traceroute.htm Basicly this not some new utility but interface to public traceroute utilities of several ISPs all over the world (tried at least two per continent) from one common interface. You can choose traceroute server from the list and then query is redirected and output comes directly from the remote traceroute system. This can be quite usefull as way to diagnose problems from one place rather then going through long list at traceroute.org. Enjoy :) BTW - If you run public traceroute server with CGI that accepts GET parameters (such as nph-trace) then I can add your server to our list, let me know if you're interested. -- William Leibzon Elan Networks william(a)elan.net

1 0

Completewhois New Features - RBL Lookup and Search Utilities
by william(at)elan.net 26 Jul '05

26 Jul '05

Hello everyone, Over the past month several new features and utilities have been added that are likely to be of interest here. In this post I'll focus on RBL lookup related utilities which have to do with rbl data from about 30 lists (with one or two exceptions, pretty much covers 25 most used free lists) that we're collecting and aggregating in the database (updates once per day) for analysis and allow users to check on based on individual queries and ip ranges. I. First of there is now direct whois lookup facility to check if ip address or domain is in one of those lists - you can simply do whois -h rbl.completewhois.com ip-address/domain OR (to show all lists that were checked) whois -h rbl.completewhois.com RBL_INCLUDENOMATCH=ON ip-address/domain OR (to include RBL data with normal whois lookup) whois -h whois.completewhois.com RBL ip-address/domain The queries are completed in average 1/2 second, so results are always fast. Note that no ip ranges are accepted (or going to be) on the whois interface. II. The web interface and light documentation for RBL Lookup (individual queries interface to our system) is available at http://www.completewhois.com/rbl_lookup.htm The website utility has two types of output display - one user-friendly (now default) table showing lists that matched and did not as red and green and including links to the list pages (good for less RBL-familiar users who want to know what to do) and simple format based on whois (can be easy to cut-paste from) and which is used when you want to also combine query with whois and dns data. The website lookup CGI can also be refernced directly (already is and used quite heavily) from other places and applications, do it as in this example: http://www.completewhois.com/cgi-bin/rbl_lookup.cgi?query=62.139.100.213 There is also real-time RBL check utility for 200 lists (not using our database and so quite slow) available on the bottom of the page and you even have a choice there to use several dns libraries (ADNS, FireDNS, BIND resolver) and compare how fast/slow they work... III. Another utility on the website allows to do IP range searches and is intended to be used primarily by ISPs and network operators to check on the listings that cover their own ip blocks (this is to help make operators aware of the extent of possible abuse coming from their network). The interface to this is available at: http://www.completewhois.com/rbl_search.htm The search utility is restricted to maximum /24 range as allowing more then that could in my opinion (and others I consulted) facilitate abuse rather then help stop it. To be able to do more then /24 lookup on your ip block(s), you will need to register and get username and password in our system (its still all free - registration is just making sure only ISP who is assigned the ip block can do query on entire block). Also note that use of this utility is covered by separate AUP. The results from ip range search also come in several formats, including simple list on the website, comprehensive webtable format as well as an option to produce CSV file for export to spreadsheet. The queries and searches are typically done in 1-2 seconds for /24 and about 4-8 seconds for /16 (with 1000 matches from various RBLs).Webtable adds additional couple seconds for large (500+) matches. In the future if there is an interest, further work will be done on the search interface ISP features to allow not only one-time lookups but reports that can be generated and sent automatically. Options will also include ability to do query based on specified time range (i.e. only new RBL entries that appeared in last 7 days). You will need to tell me what you want and how its to be presented, if you expect new features and note that any further work on this will be done end August or later when I come back from IETF conference. P.S. For those who like statistics, there are currently 1.8 million individual RBL entries which as an aggregate cover about 2 /8s (not all fair comparison because spews level2 covers large ip ranges where as many other lists are more specific). About 100 thousand (varies, very low on weekend but can be lot more some days) get updated every day and most active as far as updates is Spamhaus XBL. --- William Leibzon Elan Networks william(a)elan.net

1 0

Another article on stealing your CC data from stores with wireless..
by Nicole 26 Jul '05

26 Jul '05

Main Street in the Cross Hairs By ERIC DASH The nation's 5 million retail stores are proving to be an easy target for data thieves. full text at http://www.nytimes.com/2005/07/26/business/26card.html?th&emc=th Along a crowded stretch of highway just south of Miami's downtown is a shopping area that might be called the data theft capital of the United States. In the wireless hacker equivalent of a drive-by shooting wave, criminals obtained the cardholder information of tens of thousands of customers at four major stores there, including a DSW Shoes retail outlet that appears to have been the initial source of a chainwide data breach. Recent investigations reveal that the thieves singled out stores with strong wireless signals and weakly protected data. While their exact methods are not known, they could have parked a car outside a store or set up in the local Starbucks , using a laptop computer outfitted with an off-the-shelf wireless receiver. They may have even received help from Web sites listing the geographic coordinates of easy-to-target stores. >From there, it would be easy to pick up signals being broadcast around the store and use them to gain access to its computer systems. For more than a month, the hackers "robbed" the same shops again and again of premium card account numbers stored in their databases...... ....

1 0

NANOG 2005 Elections Complete
by Betty Burke 26 Jul '05

26 Jul '05

All: The 2005 NANOG Steering Committee Elections are now complete. The election results are posted at: http://www.nanog.org/results05.html The NANOG-Elections and NANOG-Trouble email lists have also been removed. Thank you to all the candidates, voters, and those who have supported the NANOG Evolution process! Sincerely, Merit Network Inc.

1 0

RE: Switch advice please -Folowup- posting responses
by Nicole 26 Jul '05

26 Jul '05

Hi All Some people wanted to know about the responses to my request for advice on switches.. so I collected them all and put them into a basic web page.. They are at http://www.webweaver.net/temp/ There are no names, so I hope its ok that I posted these. If anyone wants theirs removed, please let me know. Nicole

1 0