- NANOG - lists.nanog.org

Re: RIP in Operation
by sthaug＠nethelp.no 16 Sep '04

16 Sep '04

> We use RIP extensively on the edges of our network to build a Layer3 > routed overlay between 3550/3750 switches and our 6500-based core. At > $2k/list for the EMI license PER SWITCH ($4k for 3750s), it just wasn't > feasible for us to use EMI just for OSPF when all we were really > announcing was a loopback and a /30 connected network. > > We route filter and tune the RIP times down quite a bit. Meets our needs > on the edges. I assume you mean RIPv2, ie. classless. With that caveat, I can certainly see why RIP would be used. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

3 2

RIP in Operation
by Abhishek Verma 16 Sep '04

16 Sep '04

Hi, I am sure that there would be very few people running RIP in their networks, but since the IETF RIP mailing list is dead, and also because its more of an operational question, the Nanog list felt most appropriate to me for the following post. Why would you, as an operator, recieve RIPv2 Request messages? The only reason that comes to my mind is when a remote RIPv2 router has just come up. That time its going to multicast this message on all its interfaces configured to run RIP. This is the *only* reason that comes to my mind. However, there is text in the RFC 2453 that states that RIP can use this message to request specific networks also. It also states that such a request can only be made by a diagonistic software and cannot be used for routing. My doubt is, how can a diagnostic software, use the services of RIP for doing that? I assume (please correct me if i am wrong) that the RIP requests are only then, used for requesting the entire routing tables, and nothing else. The 'diagnostics' story sounds too far fetched to me! Thanks, Abhishek V. P.S. I tried googling but nothing came up. -- Class of 2004 Institue Of Technology, BHU Varanasi - India

7 6

Lucent/Ascend/Cascade B-STDX images
by Brian Wallingford 16 Sep '04

16 Sep '04

I've exhausted all my resources, and have not found a definitive method for upgrading a production switch from cp40 to cp50. Is it as simple as hot-swapping the standby, ignoring the capability mismatch, changing the active cp, then doing the same for the master cp? Also, curious if the images for these blades are interchangeable. Any input would be most appreciated. cheers, brian

1 0

largescale internet blackout in indian broadband services
by Suresh Ramasubramanian 16 Sep '04

16 Sep '04

These people provide DSL, leased lines as well as last mile connectivity for a whole lot of Indian broadband providers, and they also run a rather popular cdma wireless phone and gsm cellphone service. srs ------------- http://www.hindu.com/2004/09/16/stories/2004091611870300.htm Airtel and Touchtel services were shut down in Chennai at about 8.45pm IST last night due to a fire in their NOC. [...]

1 0

European Nanog?
by Ken Gilmour 16 Sep '04

16 Sep '04

Hey there! Does anyone know of a list like nanog for Europe? I would be interested in subscribing... I've learned a lot from this list but would like to find a closer one as well :-) Thanks for your help Ken -- "Microsoft isn't evil, they just make really crappy operating systems." -- Linus Torvalds

19 38

Excessive Internet Traffic
by Robert Scott 16 Sep '04

16 Sep '04

The University of Central Florida has seen a sudden jump in tcp 445 denies. It began a little after 9:00 AM EDST. New Worm? I am denying about 32 thousand packets per second. IP Cache flow show them well spread over a wide range of addresses, targeted at what apeears to be a random sample of my class B. The ACL on our border router is taking 21 million denies every 10 minutes. 60 deny tcp any any eq 445 (346740094 matches) The packets are small, since I am seeing a large nuber of packets, but the bit count is low. 30 second input rate 72679000 bits/sec, 41033 packets/sec 30 second output rate 29208000 bits/sec, 7687 packets/sec Input bits per second are a little above normal, but the packet count would normally be under 10000 not 41000. Ideas? TIA AppleBees says "No Anheuser" Robert Scott says "NO APPLEBEES!" Join The Boycott! Robert D. Scott Associate Director Computer Services and Telecommunications Network Operations University of Central Florida Robert(a)mail.ucf.edu CSB-310 407-823-0662 Voice 407-823-5476 FAX 345-0662 Sun-Com 877-549-5390 Pager

3 2

Re: Problem with whois.ripe.net?
by Greg Schwimer 15 Sep '04

15 Sep '04

3 2

Problem with whois.ripe.net?
by Greg Schwimer 15 Sep '04

15 Sep '04

I'm seeing this from multiple locations. Anyone else? I get a similar response from their web whois as well. whois -h whois.ripe.net <any IP address, RIPE or otherwise> % This is the RIPE Whois secondary server. % The objects are in RPSL format. % % Rights restricted by copyright. % See http://www.ripe.net/db/copyright.html inetnum: 0.0.0.0 - 255.255.255.255 netname: IANA-BLK descr: The whole IPv4 address space country: EU # Country is really world wide org: ORG-IANA1-RIPE admin-c: IANA1-RIPE tech-c: IANA1-RIPE status: ALLOCATED UNSPECIFIED remarks: The country is really worldwide. remarks: This address space is assigned at various other places in remarks: the world and might therefore not be in the RIPE database. mnt-by: RIPE-NCC-HM-MNT mnt-lower: RIPE-NCC-HM-MNT mnt-routes: RIPE-NCC-RPSL-MNT changed: bitbucket(a)ripe.net 20010529 changed: bitbucket(a)ripe.net 20020625 changed: hostmaster(a)ripe.net 20031014 changed: bitbucket(a)ripe.net 20040422 changed: bitbucket(a)ripe.net 20040504 source: RIPE organisation: ORG-IANA1-RIPE org-name: Internet Assigned Numbers Authority org-type: IANA address: see http://www.iana.org remarks: The IANA allocates IP addresses and AS number blocks to RIRs remarks: see http://www.iana.org/ipaddress/ip-addresses.htm remarks: and http://www.iana.org/assignments/as-numbers e-mail: bitbucket(a)ripe.net admin-c: IANA1-RIPE tech-c: IANA1-RIPE mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT changed: bitbucket(a)ripe.net 20040417 source: RIPE role: Internet Assigned Numbers Authority address: see http://www.iana.org. e-mail: bitbucket(a)ripe.net admin-c: IANA1-RIPE tech-c: IANA1-RIPE nic-hdl: IANA1-RIPE remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: RIPE-NCC-MNT changed: bitbucket(a)ripe.net 20010411 source: RIPE

4 4

Re: Excessive Internet Traffic
by J. Oquendo 15 Sep '04

15 Sep '04

// The packets are small, since I am seeing a large nuber of packets, but // the bit count is low. // 30 second input rate 72679000 bits/sec, 41033 packets/sec // 30 second output rate 29208000 bits/sec, 7687 packets/sec // Input bits per second are a little above normal, but the packet count // would normally be under 10000 not 41000. // // Ideas? This is likely a variant of what I forsee to become the "next big pain", a variant of sdbot, of which McAfee claims there are 4000 variants. I've had to deal with quite a few (and climbing) numbers of infected users of this pain. We use a Packeteer and have listed comps sending outbound 445 garbage and I've found that almost all have been infected by one of the versions of this particular worm. Which of the 4000 versions it is eludes me. This is what I've seen so far. If you look at the machine sending the traffic out, you're likely going to see a smorgasbord of junk in c:\WINDOWS\system32 ... If you view the folder as a list, then sort by date, you're likely to find a huge amount of executables on the machine. As well as logs, TFTP information etc. You can try opening up task manager but it will be useless... So being I'm already getting more and more familiar with this pest, here is what it does: ///// Public Sub AVkiller() On Error Resume Next 'prefix Dim AVmonz As Variant ' varz: Dim Cur As String '---||--- Dim i '---||--- AVmonz = Array("", "AVP Monitor", _ "AntiVir", _ "Vshwin", _ "F-STOPW", _ "F-Secure", _ "vettray", _ "InoculateIT", _ "Norman Virus Control", _ "navpw32", _ "Norton AntiVirus", _ "Iomon98", _ "AVG", _ "NOD32", _ "Dr.Web", _ "Amon", _ "Trend PC-cillin", _ "File Monitor", _ "Registry Monitor", _ "Registry Editor", _ "Task Manager") 'Declaration of AV shitz For i = 1 To 20 'kill'em all... Cur = AVmonz(i) 'convert to string Call TerminateTask(Cur) 'terminate task ;) Next i End Sub ///// Nifty huh? The virus installs itself in the registry under odd names associated with Microsoft for example, so far I've seen it installed in a Run, Run Once folder called Windows Security, Windows Update, etc. There is no removal tool for this and being it renders many virus software useless, you can either have a user reinstall Windows, or you can search the machine for instances of things created on the same date as the serv32.exe program, or one of the other ones it installs. Now... The worm seems to perhaps download 4 other programs I've always seen running in conjuction with it. wupd.exe which masquerades as "Windows Update" ftpd.exe which opens up an ftp server on the infected machine and goes around re-downloaded various other viruses and worms on the infected machine, and one which I believe tries to infect other machines perhaps a-la Blaster worm. Another program opens seems to randomly name viruses and worms once downloaded so for example, wupd.exe will probably turn into something like A032424.exe the next time around, and so on and so forth. So far I've seen students where I am either getting this via file sharing, one program which has been sticking out like a sore thumb is something called ARES. It could be also spreading, again, through some of the katrillion MS vulnerabilies and perhaps even the newly discovered "Drag and Drop" vulnerability. Drag and Drop vulnerabilities http://secunia.com/advisories/12321/ So now there is also the "bling.exe" issue which is the worm that "sniffs out passwords" (http://isc.sans.org/diary.php?date=2004-09-12) this one opens up an irc connection to dump out data to some channel. I will eventually (when I have some time) hexedit some of these to see what it does and perhaps repost more information. For a full view of what the serv32.exe does, please check out the coding at http://www.infiltrated.net/wormcode.txt which list the original URL (site down so it's Google cached) =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

1 0

Re: Network Configuration Management Practices
by John Neiberger 15 Sep '04

15 Sep '04

>Currently we do something sort of halfway: archive the actual configs >and then run audit scripts against them, which parse the configs. Definitely >not ideal but it helps catch simpler errors. One of these days when I have >extra cycles.. (yeah, right) > > Austin There are a handful of good products on the market that do this for you, like True Control from Rendition and Device Authority from Alterpoint. We recently purchased Device Authority primarily for its auditing and compliance monitoring, but also for the ease with which we can push out mass changes to devices. It's honestly cooler than sliced bread. The downside to these applications is the price. Ouch. Regardless, now that I have Device Authority, I sure as heck would not give it back! John --

1 0