- NANOG - lists.nanog.org

Monumentous task of making a list of all DDoS Zombies.
by Drew Weaver 10 Feb '04

10 Feb '04

Is there a list maintained anywhere of all hosts that have been identified as a DDoS zombie? Or attack box? We got hit with an attack from more than 60 IPs last night and I'd like to add them to any list that anyone has started. Thanks, -Drew

14 25

Microsoft Messenger sign-on issues
by Sean Donelan 10 Feb '04

10 Feb '04

I do not know why Messenger is having difficulties. But if you are looking for status updates to feed your front desk folks, the MSN network status web page for Messenger is http://support.msn.com/networkstatusresults.aspx?ProductNum=100&ProductName… Messenger Feature: Sign In The .NET Messenger Service is temporarily experiencing difficulty. You may be unable to sign in. Please try again later. Location: N/A Last Update: Monday, 09 February 2004 21:15:00 GMT Next Update: Monday, 09 February 2004 23:15:00 GMT

1 0

WG Last Call: draft-ietf-v6ops-isp-scenarios-analysis-01.txt (fwd)
by Pekka Savola 10 Feb '04

10 Feb '04

FYI, Feedback is welcome, either to the list (v6ops(a)ops.ietf.org) or to me and the document editor (in Cc:) directly. ---------- Forwarded message ---------- Date: Fri, 6 Feb 2004 07:58:44 +0200 (EET) From: Pekka Savola <pekkas(a)netcore.fi> To: v6ops(a)ops.ietf.org Cc: jonne.soininen(a)nokia.com, mikael.lind(a)teliasonera.com Subject: WG Last Call: draft-ietf-v6ops-isp-scenarios-analysis-01.txt Hi all, This is a WG Last Call for comments on sending draft-ietf-v6ops-isp-scenarios-analysis-01.txt, " Scenarios and Analysis for Introducing IPv6 into ISP Networks" to the IESG for consideration as BCP: http://www.ietf.org/internet-drafts/draft-ietf-v6ops-isp-scenarios-analysis… Please review these documents carefully, and send your feedback to the list. Please also indicate whether or not you believe that this document is ready to go to the IESG. There has been a lack of extensive reviews from the start, so reviewing this document would be especially welcome. The last call will end in about 2.5 weeks, on 24th February. Pekka & Jonne

1 0

Re: Where can I find a list of IPs and their regions.
by sgorman1＠gmu.edu 10 Feb '04

10 Feb '04

Best bet is probably to use CAIDA's Netgeo: http://www.caida.org/tools/utilities/netgeo/ It can give some squirely answers, and is not actively maintained, but good stuff for being free ----- Original Message ----- From: Arnold Nipper <arnold(a)nipper.de> Date: Monday, February 9, 2004 7:53 pm Subject: Re: Where can I find a list of IPs and their regions. > > On 10.02.2004 01:43 Matthew Crocker wrote: > > > > I've look at IANA but it doesn't give enough detailed > information. I > > would like to find a list of /8 or /16s and what geographic > region the > > exist in. I know it isn't an exact science but something close > would be > > nice. I know 210/8 & 211/8 are APNIC, I likes to know stuff > like > > 210.100/16 is Korea and 210.120/16 is China, etc. Does anyone > have a > > list I can pull from? > > Have a look at http://www.aso.icann.org/stats/index.html and > retrieve > up-to-date files from APNIC, ARIN, LACNIC and RIPE. > > > > -- Arnold > > >

1 0

Re: Network and security experts (was Re: Dumb users spread viruses)
by Kevin Oberman 10 Feb '04

10 Feb '04

> Date: Mon, 9 Feb 2004 12:41:26 -0500 (EST) > From: Sean Donelan <sean(a)donelan.com> > Sender: owner-nanog(a)merit.edu > > > On Mon, 9 Feb 2004, John Payne wrote: > > --On Sunday, February 8, 2004 10:46 PM +0000 Paul Vixie <vixie(a)vix.com> > > wrote: > > > There is nothing wrong with a user who thinks they should not have to know > > > how to protect their computer from virus infections. > > However, someone attending NANOG should at least have cleaned up slammer > > before connecting to the wireless... > > I have never seen any evidence that security experts or network operators > are any better at practicing security than any other user group. In every > forum I've been at, the infection rates have been similar regardless of > the attendees security experience. > > Sometimes the attendees know about the issue, but do not have the power > to fix it, e.g. corporate IT deparment controls the laptop they are > required to use. Other times, they are oblivious to the equipment being > infected. > > I wouldn't be surprised if I went to a meeting at the Department of > Homeland Security or NSA, their infection rates are similar. At a recent large (last 6 months) trade show, the show network saw a bunch infected systems pop up at once. The problem was tracked (fairly quickly) to machines brought up by a vendor in their booth that lacked a number of recent Microsoft Windows Critical Updates. I can't say who the vendor was, but they REALLY should have been the FIRST to install any patches. If this happens, what hope do we have for "normal" users. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

2 1

Re: question on ptr rr
by Michael.Dillon＠radianz.com 10 Feb '04

10 Feb '04

>buy a 1U, put it in a colo center (should cost you about $50/month) and >proxy all your outbound mail from there. stop thinking of broadband as >anything other than a lastmile protocol between your house and your own >piece of the internet core. This is darn good advice. And to expand on it further, it is time to stop thinking of Simple Mail Transport Protocol (SMTP) as the way for everybody to send email. For some strange reason we have managed to develop two protocols for end users to use in talking to their mail service provider (POP and IMAP) but neither of them allow the end user to send email. One would think that an authenticated session with an email service provider would be the natural protocol to use for injecting end user email into the system. Imagine a world in which only ISPs run SMTP servers which only talk directly to other servers with which they have an offline relationship. A world in which everybody hands over their email to an ISP for onward delivery in order to get it into the system. A world in which it is virtually impossible to send anonymous or forged email without the cooperation of an ISP. To get to this world we have to stop trying to fix the SPAM problem. Instead, we have to fix the email architecture problems which have created the environment in which SPAM can thrive. A new architecture might not prevent SPAM but if it makes spamming hard to do and has rate limits that make it very hard to do high volumes of unauthorized email then most people will not care about the small volume of SPAM. We need to start with an Email Service Consortium with a code of email server practices in which the larger ISPs agree to stop accepting SMTP connections from anyone who is not in the consortium or a customer. This will get everyone implementing a set of well-known and consistent controls. We need to add email sending capability to both POP and IMAP so that eventually we can all block port 25 entirely from broadband/dialup edges. And we need to reinstate the use of SMTP relays in order for smaller ISPs to have access to the core of the email system. --Michael Dillon

8 8

IPSEC server at NANOG30 (fwd)
by Susan Harris 09 Feb '04

09 Feb '04

Hi everyone - here's a note from Duane Wessels, who handles many of our critical services at NANOG meetings (DNS, DHCP, caching, etc.) If you're interested in beta testing and would like to talk FTF, he's wearing a really really bright orange T-shirt and sitting in the front of the ballroom. ---------- Forwarded message ---------- Date: Mon, 9 Feb 2004 14:52:00 -0700 (MST) From: Duane Wessels <wessels(a)packet-pushers.com> Hi, We are experimenting with an IPSEC service that NANOG attendees may be interested in using to encrypt and secure their wireless traffic during the meeting. We have an IPSEC server on the meeting network and are looking for a few beta testers to try it out. We can currently work only with Linux and *BSD systems. In order to use the IPSEC server with Linux, you must have FreeS/WAN and iptables installed. BSD users should have isakmpd installed. If you'd like to try it out, or have any qwestions, please send a message to Duane Wessels, wessels at packet-pushers.com.

1 0

Yahoo DNS issue
by bcm 09 Feb '04

09 Feb '04

I need to get into contact with someone from Yahoo with a DNS related issue affecting Yahoo mail users' ability to send to a domain I manage. Any contact info off-list would be greatly appreciated!

1 0

Dumb users spread viruses
by Sean Donelan 09 Feb '04

09 Feb '04

>The 'nothing to do with me' mob are the major offenders, making up 90 per >cent of the 1,000 UK employees surveyed. This vast majority believe that >they have no part to play in preventing the spread of viruses, and that >it is the responsibility of the IT department, Microsoft or the government. >almost two thirds (60 per cent) aren't aware of even the most basic >virus-protection methods and one third claims to be too busy to bother - >even if they knew how. http://www.silicon.com/software/security/0,39024655,39118228,00.htm

18 23

Hardening a control plane
by Frank P. Troy 09 Feb '04

09 Feb '04

Hey Folks, I'm looking for information on various core network architectures that could harden a control plane or prevent/isolate the propagation of say a malformed packet/control plane issue. I know that a part of the problem can be solved with edge filtering, ebgp, defense in depth and MD5 auth, but I am looking for a solution that might involve multi-level IS-IS. Any pointers would be a help. Thanks Frank -- ========================= Frank P. Troy frank(a)troy-networks.com =========================

1 0