- NANOG - lists.nanog.org

FYI: U.S. cybersecurity chief resigns
by Fergie (Paul Ferguson) 01 Oct '04

01 Oct '04

U.S. cybersecurity chief resigns Amit Yoran cited frustrations in private 10/01/04 11:51 AM, EDT CNN The government's cybersecurity chief has resigned after one year with the Department of Homeland Security, confiding to industry colleagues his frustration over what he considers a lack of attention paid to computer security issues within the agency. http://www.cnn.com/2004/US/10/01/cyber.chief.ap/index.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: Internet Connectivity
by Fergie (Paul Ferguson) 01 Oct '04

01 Oct '04

Also see the DShield "Are you cracked?" frob: http://www.dshield.org/warning_explanation.php - ferg -- "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> wrote: ahh then you have one of the new wormy things that scans aggressively for easy accounts on ssh. find src host and disinfect. Steve On Fri, 1 Oct 2004, Jack Vizelter wrote: > > Investigation is still ongoing, but from what they can tell, majority of > the attempted connections have been going over TCP port 22. > > -jack > -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: Internet Connectivity
by Jack Vizelter 01 Oct '04

01 Oct '04

Investigation is still ongoing, but from what they can tell, majority of the attempted connections have been going over TCP port 22. -jack -----Original Message----- From: Josh Duffek [mailto:consultantjd16@ridemetro.org] Sent: Friday, October 01, 2004 11:05 AM To: Jack Vizelter; nanog(a)merit.edu Subject: RE: Internet Connectivity Did you run a sniffer to get an idea of what all the traffic is? Curious what, if any, port(s) are being flooded. J -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Jack Vizelter Sent: Friday, October 01, 2004 9:56 AM To: nanog(a)merit.edu Subject: Internet Connectivity We had several machines start spewing huge amounts of data causing our pipe to the public Internet to stop. We had no traffic coming in or out of the campus. We're unsure of whether it's virus related, but wanted to inquire if anyone else has heard of or came across something similar. It appears to be an DDOS attack, but, originating from the inside. This started last night at about 10pm EST. Thanks, -jack

3 2

nanog list
by Randy Bush 01 Oct '04

01 Oct '04

was this list broken for about 12 hours and just recently recovered? postings from others and from me were not (yet) received, and are not in the archive at <http://www.merit.edu/mail.archives/nanog/> randy

1 0

RE: Internet Connectivity
by Josh Duffek 01 Oct '04

01 Oct '04

Did you run a sniffer to get an idea of what all the traffic is? Curious what, if any, port(s) are being flooded. J -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Jack Vizelter Sent: Friday, October 01, 2004 9:56 AM To: nanog(a)merit.edu Subject: Internet Connectivity We had several machines start spewing huge amounts of data causing our pipe to the public Internet to stop. We had no traffic coming in or out of the campus. We're unsure of whether it's virus related, but wanted to inquire if anyone else has heard of or came across something similar. It appears to be an DDOS attack, but, originating from the inside. This started last night at about 10pm EST. Thanks, -jack

1 0

Internet Connectivity
by Jack Vizelter 01 Oct '04

01 Oct '04

We had several machines start spewing huge amounts of data causing our pipe to the public Internet to stop. We had no traffic coming in or out of the campus. We're unsure of whether it's virus related, but wanted to inquire if anyone else has heard of or came across something similar. It appears to be an DDOS attack, but, originating from the inside. This started last night at about 10pm EST. Thanks, -jack

1 0

The Cidr Report
by cidr-report＠potaroo.net 01 Oct '04

01 Oct '04

This report has been generated at Fri Oct 1 21:49:32 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 24-09-04 144324 99990 25-09-04 145885 99946 26-09-04 145618 100026 27-09-04 145573 100092 28-09-04 145705 100057 29-09-04 145910 100061 30-09-04 145918 100047 01-10-04 145932 100217 AS Summary 18075 Number of ASes in routing system 7338 Number of ASes announcing only one prefix 1385 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 86715392 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 01Oct04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 146170 100217 45953 31.4% All ASes AS18566 743 7 736 99.1% CVAD Covad Communications AS4134 813 177 636 78.2% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 795 221 574 72.2% TWTC Time Warner Telecom AS7018 1385 964 421 30.4% ATTW AT&T WorldNet Services AS22773 402 21 381 94.8% CXA Cox Communications Inc. AS6197 774 411 363 46.9% BNS-14 BellSouth Network Solutions, Inc AS6467 391 30 361 92.3% ACSI e.spire Communications, Inc. AS27364 394 36 358 90.9% ARMC Armstrong Cable Services AS701 1253 905 348 27.8% UU UUNET Technologies, Inc. AS22909 381 42 339 89.0% CMCS Comcast Cable Communications, Inc. AS1239 952 636 316 33.2% SPRN Sprint AS17676 368 56 312 84.8% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS9929 334 33 301 90.1% CNCNET-CN China Netcom Corp. AS6478 370 74 296 80.0% ATTW AT&T WorldNet Services AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS21502 268 3 265 98.9% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS4766 529 266 263 49.7% KIXS-AS-KR Korea Telecom AS14654 260 6 254 97.7% WAYPOR-3 Wayport AS6140 368 115 253 68.8% IMPSA ImpSat AS9443 358 109 249 69.6% INTERNETPRIMUS-AS-AP Primus Telecommunications AS7843 489 251 238 48.7% ADELPH-13 Adelphia Corp. AS2386 840 611 229 27.3% ADCS-1 AT&T Data Communications Services AS1221 812 584 228 28.1% ASN-TELSTRA Telstra Pty Ltd AS25844 244 16 228 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS9583 530 308 222 41.9% SIFY-AS-IN Sify Limited AS6198 427 211 216 50.6% BNS-14 BellSouth Network Solutions, Inc AS15557 339 126 213 62.8% LDCOMNET LDCOM NETWORKS AS13083 217 8 209 96.3% Mannesmann Datenverarbeitung Autonomes System AS721 722 516 206 28.5% DNIC DoD Network Information Center AS6327 229 29 200 87.3% SHAWC-2 Shaw Communications Inc. Total 16368 6871 9497 58.0% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.83.96.0/19 AS26956 NETFR NetFree Communications 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 111.0.0.0/24 AS7563 KII-AS Korea Internet Infrastructure 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.80.64.0/19 AS1 LVLT Level 3 Communications, Inc. 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.107.144.0/22 AS1 LVLT Level 3 Communications, Inc. 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.138.208.0/20 AS1 LVLT Level 3 Communications, Inc. 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.190.16.0/21 AS1 LVLT Level 3 Communications, Inc. 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.81.96.0/19 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.81.109.0/24 AS7657 TIG-US-PAS-AP The Internet Group Limited 202.81.121.0/24 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.84.192.0/19 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.192.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.208.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 204.196.0.0/14 AS1 LVLT Level 3 Communications, Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.143.192.0/18 AS3561 CWU Cable & Wireless USA 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

RE: Blackhole Routes
by Matt Ryan 01 Oct '04

01 Oct '04

Something like http://www.cisco.com/en/US/products/ps5888/index.html? Matt. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Bill Stewart Sent: 01 October 2004 08:23 To: Eric Germann; nanog(a)merit.edu Subject: Re: Blackhole Routes On Thu, 30 Sep 2004 10:35:36 -0400, Eric Germann <ekgermann(a)cctec.com> wrote: > What I would to see (and have never researched in depth) is a way to apply > the blackhole routes on a community to port basis (i.e. we set up a specific > BGP community to filter mail, and that community goes to a route map that > kills only port 25, another community applies to a map that kills port 80, A not particularly scalable method of doing that, which should be ok for small data flows, is to set up routers port25killer.example.net, a port80killer.example.net, etc., with ACLs that block those ports regardless of address, use BGP or OSPF to advertise whichever IP address spaces should be routed there, and set up those machines in whatever sort of firewalling location makes sense. It's more of an enterprise solution than an ISP solution, but if you're a small ISP or dealing with a relatively specific set of problem sites you could probably do it. You may need to burn some CPE on GRE tunnels, depending on your topology, but if you're trying to solve a limited problem like letting your users access Korean web sites while blocking Korean email, it may work. ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

1 0

ddos attack advice
by adrian kok 30 Sep '04

30 Sep '04

Dear all I have ddos attack to our ip A.B.C.D yesterday. Someone suggest me to post it here and I might get advice from this newsgroup 1/ What's good methodology in blocking certain IP address? ACL or strictly filtering list, Which one is better? or some other effective ways also? 2/ We could act immediately to block the IP address at our firewall; but the load is still in our end (from the machine A.B.C.D trasnfered to our firewall) Then we also asked our uptream ISP to block it, the load should be at their end. How does ISP handle the sudden bandwidth resulted from a DDOS attack. Thank you

1 0

(OT): need QWEST NOC contact
by Rich Sena 30 Sep '04

30 Sep '04

Please contact me off-list -- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0