- NANOG - lists.nanog.org

New IANA allocations to RIPE NCC
by John L Crain 08 May '04

08 May '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, This is to inform you that the IANA has allocated the following sixteen (16) IPv6 /23 blocks to RIPE NCC: 2001:1C00::/23 RIPE NCC 2001:1E00::/23 RIPE NCC 2001:2000::/23 RIPE NCC 2001:2200::/23 RIPE NCC 2001:2400::/23 RIPE NCC 2001:2600::/23 RIPE NCC 2001:2800::/23 RIPE NCC 2001:2A00::/23 RIPE NCC 2001:2C00::/23 RIPE NCC 2001:2E00::/23 RIPE NCC 2001:3000::/23 RIPE NCC 2001:3200::/23 RIPE NCC 2001:3400::/23 RIPE NCC 2001:3600::/23 RIPE NCC 2001:3800::/23 RIPE NCC 2001:3A00::/23 RIPE NCC For a full list of IANA IPv6 allocations please see: <http://www.iana.org/assignments/ipv6-tla-assignments> Thanks, John L Crain IANA ================================================================== -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 - not licensed for commercial use: www.pgp.com iQA/AwUBQJvtIdGxp5XUiliSEQLaagCg0Y/pRQcTAnlsRjzfQU2fKzNSW9oAn37X UGz4VQHBrGD23aFqYYyXo7JX =2oTv -----END PGP SIGNATURE-----

10 14

German police arrest Sasser worm suspect
by Sean Donelan 08 May '04

08 May '04

An 18-year-old high school student has been arrested in Germany on suspicion of creating the Sasser internet worm, police say. Police say the man was arrested in the northern German town of Rotenburg. http://news.bbc.co.uk/1/hi/world/europe/3695857.stm

1 0

Provisioning backbone network for NGP with QoS enabled
by jshen＠spymac.com 08 May '04

08 May '04

1 0

Corporations becoming a LIR
by Drumm, Dan 08 May '04

08 May '04

Nanog: I work as the Network Architect for a multinational corporation, Ball Corporation (http://www.ball.com) Currently, we hold a Class B network, 162.18.0.0/16 and have been multi-homed in the past, and will be multi-homed in the future, and have our own AS. The network is very large, as we've used this addressing internally for our facilities in North America and Canada. We've allocated over 220 subnets. We now have a European division, Ball-Europe (http://www.ball-europe.com <http://www.ball-europe.com/> ). They have RFC 1918 addressing internally, and have the usual problems with NAT and overload addressing. I'm starting the process of filling out an application to register the company, based in Ratingen, DE with RIPE as a Local Internet Registry (LIR) so that we can request a /18 (or /17 if we can get one) for the 40 some production facilities of Ball-Europe, each of which will come across a VPN network and be presented in one block to the ISP uplinks. I was wondering, basically, if I have any chance at this? While RIPE clearly states the admission policy is open to any organization, in order to get PIR (Provider Independent routing) being a RIPE NCC is required, and I don't know if a corporation would have a shot. Currently, we are not an ARIN member, but hold the Class B. The corporation exists in 6 EU nations, and I can demonstrate the requirement for >2048 individual IP addresses. I realize this the NORTH AMERICAN Network operator group, and most of you deal with ARIN, but I thought some members might have experience in this area as well. Thanks in advance.

6 5

Why don't X care more about Y?
by Sean Donelan 07 May '04

07 May '04

Dave Farber's interesting people list has a post by a former bank credit card officer explaining why banks don't get as excited about fraud as customers do. http://www.interesting-people.org/archives/interesting-people/200405/msg000… Many of the statements apply to anyone who deals with malicious behavior on a regular basis. The police officer may not appear to care as much about your car being stolen as you do, the ISP abuse department may not appear to care as much about the port scan as you do, the bank may not appear to care as much about the merchant who doesn't check the card signature as you do, etc. But he is correct; banks, as well as police, ISPs or any other fraud investigation group, do care about fraud and abuse; just not as much about the scam du jour.

1 0

RE: FW: Worms versus Bots
by Smith, Donald 07 May '04

07 May '04

If you follow these steps outlined by SANS you should be able to successfully update and NOT get infected. This is short, easy, fully documented (with pictures :) http://www.sans.org/rr/papers/index.php?id=1298 Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Henry Linneweh > Sent: Tuesday, May 04, 2004 2:19 AM > To: Eric Krichbaum; nanog(a)merit.edu > Subject: Re: FW: Worms versus Bots > > > > It is amazingly simply to pull an ethernet cable out > of the back of your box to update a box from a CD.... > especially in a suspect environment where you have had many problems. > > I have had the displeasure of having had to go from > box to box and clean each individually and while many > problems were stopped by Netscreen at the door, we > still had to run enterprise protection per machine as > a second line of defense and separate domains in the > company for greater protection between the groups. > > -Henry > > > --- Eric Krichbaum <eric.krichbaum(a)citynet.net> wrote: > > > > I see times more typically in the 5 - 10 second > > range to infection. As > > a test, I unprotected a machine this morning on a > > single T1 to get a > > sample. 8 seconds. If you can get in 20 minutes of > downloads you're > > luckier than most. > > > > Eric > > > > > > -----Original Message----- > > From: owner-nanog(a)merit.edu > > [mailto:owner-nanog@merit.edu] On Behalf Of william(at)elan.net > > Sent: Monday, May 03, 2004 11:49 PM > > To: Sean Donelan > > Cc: Rob Thomas; NANOG > > Subject: Re: Worms versus Bots > > > > > > On Mon, 3 May 2004, Sean Donelan wrote: > > > > > On Mon, 3 May 2004, Rob Thomas wrote: > > > > ] Just because a machine has a bot/worm/virus > > that didn't come with > > > > a ] rootkit, doesn't mean that someone else > > hasn't had their way > > with it. > > > > > > > > Agreed. > > > > > > Won't help. What's the first thing people do > > after re-installing the > > > operating system (still have all the original CDs > > and keys and product > > > > > activation codes and and and)? Connect to the > > Internet to download the > > > > > patches. Time to download patches 60+ minutes. > > > Time to infection 5 minutes. > > > > Its possible its a problem on dialup, but in our ISP > > office I setup new > > win2000 servers and first thing I do is download all > > the patches. I've > > yet to see the server get infected in the 20-30 > > minutes it takes to > > finish it > > (Note: I also disable IIS just in case until > > everything is patched..). > > > > Similarly when settting up computers for several of > > my relatives (all > > have dsl) I've yet to see any infection before all > > updates are > > installed. > > > > Additional to that many users have dsl router or > > similar device and many > > such beasts will provide NATed ip block and act like > > a firewall not > > allowing outside servers to actually connect to your > > home computer. > > On this point it would be really interested to see > > what percentage of > > users actually have these routers and if decreasing > > speed of infections > > by new virus (is there real numbers to show it > > decreased?) have anything > > to do with this rather then people being more > > carefull and using > > antivirus. > > > > Another option if you're really afraid of infection > > is to setup proxy > > that only allows access to microsoft ip block that > > contains windows > > update servers > > > > And of course, there is an even BETTER OPTION then > > all the above - STOP > > USING WINDOWS and switch to Linux or Free(Mac)BSD ! > > :) > > > > > Patches are Microsoft's > > > intellectual property and can not be distributed > > by anyone without > > > Microsoft's permission. > > I don't think this is quite true. Microsoft makes > > available all patches > > as indidual .exe files. There are quite many of > > these updates and its > > really a pain to actually get all of them and > > install updates manually. > > But I've never seen written anywhere that I can not > > download these .exe > > files and distribute it inside your company or to > > your friends as needed > > to fix the problems these patches are designed for. > > > > > The problem with Bots is they aren't always > > active. That makes them > > > difficult to find until they do something. > > As opposed to what, viruses? > > Not at all! Many viruses have period wjhen they are > > active and > > afterwards they go into "sleep" mode and will not > > active until some > > other date! > > > > Additionally bot that does not immediatly become > > active is good thing > > because of you do weekly or monthly audits (any many > > do it like that) > > you may well find it this way and deal with it at > > your own time, rather > > then all over a sudden being awaken 3am and having > > to clean up infected > > system. > > > > -- > > William Leibzon > > Elan Networks > > william(a)elan.net > > > >

10 10

orkut dns?
by Randy Bush 07 May '04

07 May '04

am i wrong or is there a problem (which is a dozen hours old)? roam.psg.com:/usr/home/randy> dig +norec @a.gtld-servers.net. orkut.com. ns ; <<>> DiG 9.3.0s20021217 <<>> +norec @a.gtld-servers.net. orkut.com. ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61385 ;; flags: qr; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2 ;; QUESTION SECTION: ;orkut.com. IN NS ;; ANSWER SECTION: orkut.com. 172800 IN NS ns11.worldnic.com. orkut.com. 172800 IN NS ns12.worldnic.com. ;; ADDITIONAL SECTION: ns11.worldnic.com. 172800 IN A 216.168.225.141 ns12.worldnic.com. 172800 IN A 216.168.225.142 ;; Query time: 101 msec ;; SERVER: 192.5.6.30#53(a.gtld-servers.net.) ;; WHEN: Thu May 6 17:42:09 2004 ;; MSG SIZE rcvd: 106 roam.psg.com:/usr/home/randy> dig +norec @ns11.worldnic.com. orkut.com. ns ; <<>> DiG 9.3.0s20021217 <<>> +norec @ns11.worldnic.com. orkut.com. ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36354 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0 ;; QUESTION SECTION: ;orkut.com. IN NS ;; AUTHORITY SECTION: . 3600000 IN NS M.ROOT-SERVERS.NET. . 3600000 IN NS A.ROOT-SERVERS.NET. . 3600000 IN NS B.ROOT-SERVERS.NET. . 3600000 IN NS C.ROOT-SERVERS.NET. . 3600000 IN NS D.ROOT-SERVERS.NET. . 3600000 IN NS E.ROOT-SERVERS.NET. . 3600000 IN NS F.ROOT-SERVERS.NET. . 3600000 IN NS G.ROOT-SERVERS.NET. . 3600000 IN NS H.ROOT-SERVERS.NET. . 3600000 IN NS I.ROOT-SERVERS.NET. . 3600000 IN NS J.ROOT-SERVERS.NET. . 3600000 IN NS K.ROOT-SERVERS.NET. . 3600000 IN NS L.ROOT-SERVERS.NET. ;; Query time: 91 msec ;; SERVER: 216.168.225.141#53(ns11.worldnic.com.) ;; WHEN: Thu May 6 17:42:26 2004 ;; MSG SIZE rcvd: 238 roam.psg.com:/usr/home/randy> dig +norec @ns12.worldnic.com. orkut.com. ns ; <<>> DiG 9.3.0s20021217 <<>> +norec @ns12.worldnic.com. orkut.com. ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38052 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0 ;; QUESTION SECTION: ;orkut.com. IN NS ;; AUTHORITY SECTION: . 3600000 IN NS F.ROOT-SERVERS.NET. . 3600000 IN NS G.ROOT-SERVERS.NET. . 3600000 IN NS H.ROOT-SERVERS.NET. . 3600000 IN NS I.ROOT-SERVERS.NET. . 3600000 IN NS J.ROOT-SERVERS.NET. . 3600000 IN NS K.ROOT-SERVERS.NET. . 3600000 IN NS L.ROOT-SERVERS.NET. . 3600000 IN NS M.ROOT-SERVERS.NET. . 3600000 IN NS A.ROOT-SERVERS.NET. . 3600000 IN NS B.ROOT-SERVERS.NET. . 3600000 IN NS C.ROOT-SERVERS.NET. . 3600000 IN NS D.ROOT-SERVERS.NET. . 3600000 IN NS E.ROOT-SERVERS.NET. ;; Query time: 91 msec ;; SERVER: 216.168.225.142#53(ns12.worldnic.com.) ;; WHEN: Thu May 6 17:43:03 2004 ;; MSG SIZE rcvd: 238 and Domain Name: ORKUT.COM Registrar: EMARKMONITOR INC. DBA MARKMONITOR Whois Server: whois.markmonitor.com Referral URL: http://www.markmonitor.com Name Server: NS11.WORLDNIC.COM Name Server: NS12.WORLDNIC.COM Status: ACTIVE Updated Date: 05-may-2004 <<<=== Creation Date: 08-dec-2002 Expiration Date: 08-dec-2007 hmmm randy

4 5

Fiber Still in Baltimore Tunnels?
by David Kennedy CISSP 07 May '04

07 May '04

Ordnance Find Closes Baltimore Tunnel ............ BALTIMORE (AP) -- The Baltimore Harbor Tunnel has been closed indefinitely after a worker at a nearby construction site discovered military ordnance. Nine munitions, ranging in size from 500 to 4,000 pounds, had been found since early Wednesday. The construction site, less than a half-mile from the tunnel, was once used by the Navy to assemble and disassemble ships. Disposal teams were working to determine the status of the munitions, said Col. Tim Madere, of the Aberdeen Proving Ground. Military investigators are trying to determine exactly where the ordnance came from, said Cpl. Greg Prioleau, a spokesman for the Maryland Transportation Authority. The closing was ordered by Gov. Robert Ehrlich on the recommendations of ordnance disposal teams from the U.S. Army, Baltimore City, the FBI and the Maryland State Fire Marshal. Adjacent portions of I-895 also were closed. -- Regards, /"\ David Kennedy CISSP \ / ASCII Ribbon Campaign Protect what you connect; X Against HTML Mail Look both ways before crossing the Net. / \

1 0

RE: FW: Worms versus Bots
by Michel Py 07 May '04

07 May '04

>> The problem is that Joe User (or his kid) wants to run >> some random P2P program without having to reconfigure >> NAT port mappings, so they have all inbound connections >> mapped to a static internal IP. > If Joe (L)User or his kid sets up his NAT that way... > well, quite honestly he gets what he deserves. Protecting > against active, deliberate stupidty is probably more than > my job description coveres. I would be a little more tolerant, as they don't even know they're being stupid. That being said, the only thing that will teach them is to get nailed. It's like backups: only after one has lost a bunch of data and spent long nights rebuilding it does one pay religious attention to make sure that the backup is running every night. No matter what we say about it before they actually lose the data and are unable to restore because the last time someone put a tape in the drive was a month ago. So, Joe (l)user or his kid will continue to configure DMZ hosts in their Linksys, they will get hit and pay $500 to have their PC reloaded or buy a new one, and they won't do it again. I'm not saying I like it, but it's just the way it is. Michel.

1 0

MD5 proliferation statistics
by Steve Gibbard 07 May '04

07 May '04

Packet Clearing House has routers at a several exchange points, which we use to collect local snapshots of the routes available at the exchanges. To do this, we peer with as many of the participants at each exchange as possible. We're mainly just collecting data, so route flaps aren't a huge problem for us. We haven't been tracking down existing peers and asking them to configure MD5 passwords on the sessions. We have been configuring MD5 passwords on sessions when asked, so we've got MD5 configured with peers who have asked for it, but not with peers who haven't. As of Tuesday night, we had 244 peering sessions, of which 24 had MD5 configured. We configured MD5 on four more sessions yesterday, bringing the total to 28, and have one request that hasn't been completed yet, for a total of 29. 29 out of 244 is roughly 12%. I'm going to make two broad assumptions here: that those peers who have configured MD5 with us have configured MD5 with all their peers, and that those who haven't configured MD5 with us have been asked to by 12% of their peers. I'm further going to assume that peers consistently configure MD5 when asked to, although I suspect that's a really bad assumption. Therefore, we can assume that 12% of ISPs have all their peers configured with MD5, and that the remaining 88% have 12% of their peers configured with MD5, for a total of 22% of peering sessions having MD5 passwords. I strongly suspect my assumption about the responsiveness of peers is wrong, and that the real number is somewhere between 12% and 22%. It's also possible that my sample isn't representative enough, which would lead to further problems with accuracy. I'm curious as to what sorts of response rates those who have been actively contacting peers to ask for MD5 configuration have been getting, as well as whether other networks that have not been being proactive about this have been seeing contact rates similar to ours. -Steve Gibbard Packet Clearing House

5 4