- NANOG - lists.nanog.org

RE: networks with many issues
by Kuhtz, Christian 21 Jul '05

21 Jul '05

Rick, Similar to what I expressed already in email directly to you, data without timestamp of when a specific IP address was found to be an offender is nearly worthless for action, and only interesting as statistical chatter.. Except where you perhaps have business customers (and the occasional residential customer) with static address assignments. Even still, acting on such 3rd party derived data for things like AUP enforcement is probably still more problematic... I understand the difficulty of coming up with a valid timestamp, but the other part of this is operational realities that IP addresses temporary assignments for a lot of broadband subs. So, I guess, I wonder -- with the deficiencies indicated above -- what operational use such a list would really have in the end. ;-) Other than yet another interesting metric of just how bad things are out there(TM). Regards, Christian > > I've come across a few requests for reports with over 10,000 > issues. for > the net ops folks that might have huge blocks with many > issues -- what > is the most relivant information? Also, how does one go about > solving a > large set of issues across a huge address space? > > Basickly I'm wondering if I can't build some tools to make > life easyer > and use the reports as an input to the tools. > > Also I'd be interested in how large reports should be broken down. I > have the issue, address, reverse dns, source and timestamp. > would it be > best to group the report by issue type. > > The issues I am track are > Open Proxy (http, socks, other) > Website with vunerabilities > Spam source( spammed honney pot, spamtrap) > Open Relay (smtp) > > Understand the timestamp is the time I saw the issue from the RBL. I > import data at best hourly and the DNSRBLs don't all have > timestamps for > their data. > > I am generaly interested in understanding how to produce > information and > tools that the large operaters can utilize effectively. > > I'd appreciate any thoughts and ideas on how to hande these problems. > > > -rick > > > ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." 118

1 0

compromized host list available
by Rick Wesson 21 Jul '05

21 Jul '05

Folks, I've developed a tool to pull together a bunch of information from DNSRBLs and mix it with a BGP feed, the result is that upon request I can generate a report of all the compromised hosts on your network as seen by various DNSRBLs. reports are available daily in pdf, text, csv, and excel. they are all a bit chunky but should be helpful. contact me off list, if you would like to get a daily report for your ASN. You will be required to prove you are associated with and responsible for the ASN you want a report for. The report are free so this isn't a commercial =) honestly I hope the stuff helps. -rick

7 9

RE: compromized host list available
by Hannigan, Martin 21 Jul '05

21 Jul '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Rick Wesson > Sent: Wednesday, July 20, 2005 7:32 PM > To: nanog(a)merit.edu > Subject: compromized host list available > > > > Folks, > > I've developed a tool to pull together a bunch of information from > DNSRBLs and mix it with a BGP feed, the result is that upon request I > can generate a report of all the compromised hosts on your network as > seen by various DNSRBLs. > > reports are available daily in pdf, text, csv, and excel. > they are all a > bit chunky but should be helpful. > > contact me off list, if you would like to get a daily report for your > ASN. You will be required to prove you are associated with and > responsible for the ASN you want a report for. > > The report are free so this isn't a commercial =) honestly I hope the > stuff helps. What about collateral damage? -M<

3 2

networks with many issues
by Rick Wesson 21 Jul '05

21 Jul '05

I've come across a few requests for reports with over 10,000 issues. for the net ops folks that might have huge blocks with many issues -- what is the most relivant information? Also, how does one go about solving a large set of issues across a huge address space? Basickly I'm wondering if I can't build some tools to make life easyer and use the reports as an input to the tools. Also I'd be interested in how large reports should be broken down. I have the issue, address, reverse dns, source and timestamp. would it be best to group the report by issue type. The issues I am track are Open Proxy (http, socks, other) Website with vunerabilities Spam source( spammed honney pot, spamtrap) Open Relay (smtp) Understand the timestamp is the time I saw the issue from the RBL. I import data at best hourly and the DNSRBLs don't all have timestamps for their data. I am generaly interested in understanding how to produce information and tools that the large operaters can utilize effectively. I'd appreciate any thoughts and ideas on how to hande these problems. -rick

1 0

*** NANOG election update ***
by Betty Burke 21 Jul '05

21 Jul '05

All: As of 9:14am today:> 191 people have voted 915 votes cast Voting is proceeding, but at a slow pace, getting just a trickle the past few days.< If you are eligible and have not voted, please take advantage of this opportunity. A reminder, voting ends at midnight EST on Monday, July 25. Refer to <http://nanog.org/elections.html> for instructions and updates:> All best. Betty Burke Project Manager Merit Network

1 0

More bombings in London....
by Fergie (Paul Ferguson) 21 Jul '05

21 Jul '05

http://www.msnbc.msn.com/id/8655541/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Is there a "alternative" way of doing kvm-over-IP
by Drew Weaver 21 Jul '05

21 Jul '05

Buying the hardware boxes sounds pretty attractive, but I wondered if any industrious open sourcers have come up with anything that any NANOG-ers have come across that would do something similar to what the Dell 2161DS box would do. I realize we would need a server with some cards in it to terminate the connections and then some cards to go in the boxes, we just need a bit more density than 16 ports. Tia -Drew

6 5

Re: Vonage Selects TCS For VoIP E911 Service
by Brad Knowles 21 Jul '05

21 Jul '05

At 10:32 AM +0100 2005-07-20, Michael.Dillon(a)btradianz.com wrote: >> While I agree that GPS is the likely answer, I wasn't expecting the >> ability to work inside computer rooms and basements. > > It doesn't need to work in basements, etc. It only needs to keep > a record of the last location it was at when the signal faded > away. The emergency service vehicles probably can't get any closer > than that anyway. I've been doing some reading on this subject. It seems that both GPS and tower triangulation methods suck. For GPS, the problems are signal acquisition and penetration in urban environments, especially with non-dedicated handheld devices. For tower triangulation, the problem appears to be areas with poor signal coverage where you might only be able to barely see one tower, and where TDoA, AoA, and EOTD aren't going to do you any good. In either case, simply keeping the last known signal lock may very well be one of the worst things you could do. It seems to me that we need to use both technologies in order to get any real hope of reasonably sustainable accuracy, either for E911 or any other location-aware technology. And I'm not convinced even that's enough. So, anyone want to place any bets on what's really going to happen? -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

5 5

OT: RIP, James Doohan...
by Fergie (Paul Ferguson) 20 Jul '05

20 Jul '05

I know this is off-topic, but the "engineer's engineer" died early today, ironically, on the 36th anniversaty of the Apollo 11 lunar landing (20 July, 1969). http://www.cnn.com/2005/SHOWBIZ/TV/07/20/obit.doohan.ap/index.html So long, Mr. Scott. You'll be missed. - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Bob Metcalf not taking his meds again....
by Fergie (Paul Ferguson) 20 Jul '05

20 Jul '05

I was delighted this afternoon to see post on on /. entitled "Bob Metcalfe on Open Source, IPv6, IETF": [snip] "The inventor of Ethernet Bob Metcalfe is interviewed by AlwaysOn on current issues. Metcalfe is known for challenging commonly accepted wisdom and this time he's quite confrontational. On open source and operating systems: "If you look at Windows and Linux, both are based on 25-year- old technology. Windows is sort of a GUI version of the Mac's operating system, and Linux is of course Unix, which stems from 1968. These are both old clunkers. So the question is, Where are the new operating systems likely to come from?" On IPv6 adoption and IETF: "Back when you attended the IETF, you all looked down your noses at the ITU (or I guess it was called CCITT at the time)--the entrenched, corporately manipulated, corrupt, competent standards being embodied in IT. We were the IETF--the swashbuckling, institution- oriented, open people, the rebels. That's changed now. The Internet has arrived, and all of those people are now just like ITU: IETF has become the ITU."" [snip] http://it.slashdot.org/it/05/07/20/1529242.shtml?tid=218 One of my favorite exchanges between Metcalf and AlwaysOn, from this article, is this one: [snip] AlwaysOn: Where to you think this ideology stems from? Metcalfe: The IETF, or maybe the IAB. They have beards and wear T-shirts with tie-dye on them, and they live in universities. AlwaysOn: And they know how slide-rules work. Metcalfe: Yes. Plus, they hate my guts; I used to flame them with my columns. They're sweet people underneath, but their ideology gets in the way. [snip] http://www.alwayson-network.com/comments.php?id=9712_0_3_0_C Right, Bob. Whatever. ;-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0