- NANOG - lists.nanog.org

Trojaned versions of Makelovenotspam doing the rounds ...
by suresh＠outblaze.com 07 Dec '04

07 Dec '04

What a surprise (or not!) http://www.theregister.co.uk/2004/12/07/fake_lycos_screensaver_trojan/ > Virus writers have begun distributing their wares in emails that pose as > Lycos's abandoned "Make love not spam" screensaver. > > The fake screensaver emails contain an attachment with a RAR SFX archive that > has embedded key logger Trojan inside, antivirus firm Sophos warns. Infected > emails come in emails with subject lines such as "Be the first to fight spam > with Lycos screen" and an attachment called "Lycos screensaver to fight > spam.zip". > > Upon successful installation, the key logging Trojan (Mdropper-IT) sends a > message to an Indonesian email address confirming its status. The screensaver > file, rather than displaying the Lycos screensaver, displays a blank screen. [snip]

1 0

Remote sites, aggregates and more-specific routes
by Sam Stickland 07 Dec '04

07 Dec '04

Hi, We currently announce our entire range as the largest possible aggregates. We are about to add the first site that's a sizable distance away. The link to the remote site is relatively expensive, so we don't want to have to backhaul traffic between the sites if we can help it. We seem to have the following options available: 1) Announce the greater aggregate at both ends, and risk having to haul traffic between the sites ourselves. 2) Deaggregate our ranges completely. I don't particulary want to do this, since the predicted 80/20 split in IP address usage across the sites will create a quite a few new routes in the ever growing table. 3) Only announce more-specifics at the remote site, and tag the more specific routes NO-EXPORT if we peer with the AS in both locations. Am I right in thinking that #3 seems is the best option? AFAICS it adds no new unnecessary routes to the global table (outside of our immediate peers and transit providers) and still keeps unneccessary traffic off of the intersite link. Are there any options I missed? Sam

1 0

RE: Unflattering comments about ISPs and DDOS
by J. Oquendo 07 Dec '04

07 Dec '04

> "reconfigure their mail programs to point at Comcast's > servers, and each phone call to the help desk costs $9." And they couldn't spend say: $1.00 per CD with a vb script or instructions on doing this $100.00 (far fetched price) to have an interactive step-by-step flash video created to show their customers $1000.00 (far fetched price) to set up some VXML based number with a "Press 1 to RTFM... Press 2 to RTFM again" Even at an uber high charge (800/866 toll) of say $4.00 per call, they could still implement the changes save tons of money, and tons of aspirin when their headaches go away. Maybe someone here can draft up a $10,000,000.00 pitch it to them become an instant millionaire and save Comcast some money at the same time. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

4 3

using sniffer on high-bandwidth pipes
by todd romero 07 Dec '04

07 Dec '04

does anyone have expirience using a sniffer on a hi-capacity network segment, that might know if there are limitations I need to worry about? example: customers doing EMC database replication across a mpls link, and when the capacity reaches aprox. 250 Mbp/s packets are arriving out of sequence etc. So we need to put sniffers on both sides to capture some data to see whats happeneing when the capacity reaches 250mbps. what kind of system requirements would be needed to be able to be able to capture that amount of data. For some reason, I dont think that the Dolch Pac 65 sniffers we have (running nt4 and sniffer pro2) would be able to handle that kind of data? If they cant, we can probbaly use a sun box. what kind of specs would the box need? tia, tr

8 7

Neutral Colo - Las Vegas, NV
by Charlie Khanna - NextWeb 07 Dec '04

07 Dec '04

Hi, Can anyone tell me if there are any carrier neutral data centers in Las Vegas, NV? Thanks. -Charlie

1 0

Unflattering comments about ISPs and DDOS
by Michael.Dillon＠radianz.com 07 Dec '04

07 Dec '04

This article in ZDNET UK entitled "WIth ISPs like this, who needs enemies?" http://comment.zdnet.co.uk/andrewdonoghue/0,39027004,39175983,00.htm contains some rather unflattering comments about ISPs who don't help customers deal with DDOS attacks. The head of security technology for a major ISP named in the article said: "Why should ISPs do something? It's very much as if people want something for nothing. This noise is superfluous and silly." The thinking is this. There are two operational problems here, one big and one small. The big one is when your customer is the target of DDoS. The small one is when your customers originate the DDoS. I think the writer is telling us to treat these as two sides of the same problem. If management buys into this view then it would make the business case for the operational effort needed to clean up botnets. And if enough people clean up the bots on their network, then a case can be made for depeering (or severely damping) networks that don't clean up their act. --Michael Dillon

6 5

LG close to MCI Japan anyone?
by Elmar K. Bins 07 Dec '04

07 Dec '04

Hi there, I'm currently searching for a looking glass close to AS703 in Japan. Unfortunately, JPIX doesn't offer one (would have been to easy anyway). Any pointers? Yours, Elmar. PS: Whoever maintains traceroute.org and is on the list: Very many of the listed RS and LGs are offline and some have been for quite a while.

3 2

RE: Bangladesh gets itself an IXP
by Majid Farid 07 Dec '04

07 Dec '04

Also http://www.pie.net.pk/ for Pakistan. -- Majid. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Suresh Ramasubramanian Sent: Monday, December 06, 2004 8:56 AM To: nanog(a)nanog.org Subject: Bangladesh gets itself an IXP http://www.bdix.net looks quite good to me. Open peering, with over 10 local ISPs peering there. What a change from the joke that is NIXI (www.nixi.org) in India .. srs (depressed)

2 1

Sprint security contact
by Erond 06 Dec '04

06 Dec '04

One of our customers is currently undergoing a ~30Mbs DDoS to a single IP. We've BGP blackholed them within our network, but they are still beating up on our upstream links. UUNET has blocked them internally, but I'm getting bounced around within Sprint to have their NOC/security group work on it. I started with our contact information and also the puck.nether.net info. If there is a Sprint security person on list, please contact me. If somebody has a direct Sprint NOC/Security contact, please pass it along. Thanks, Rick

2 1

Blocking worms/ddos for customer for free?
by Kim Onnel 06 Dec '04

06 Dec '04

Hello, Currently, on our ingress, we block spoofed packets, common worms/trojans ports. We do that for all of our customers(residential DSL, Dial-up, Corporate DSL, and the data center hosted websites/servers), however, For me there are 2 ways to look at it, if i leave these worms to come in, they would consume our bandwidth and CPU, and on the other hand, it looks like we're giving a free service, which in a way uses up our resources, Its the same for DDoS, if i stop it for a customer, i'm giving him a free a service, if i dont, its gonna wreck my network. Personally, i block the illegitimate packets out of my network(egress) but thats because i owe this to the internet community, even if i am not getting paid for it. I would like to know other providers policy about this?

2 1