- NANOG - lists.nanog.org

updating bogon filters for 83/8 and 84/8
by Frans ter Borg 11 Jan '04

11 Jan '04

hello, On November 15th 2003, IANA allocated 83/8 and 84/8 to RIPE. RIPE has started allocating prefixes from these blocks to LIRs around Europe. We received 83.116.0.0/14 and have started connecting domestic users with these IP addresses. Unfortunately, quite a few ISPs and corporates out there, have not yet updated their bogon filters to allow for these ranges to pass. These are including sites like cnn.com, yahoo.com and excite.com. I'd like to ask everyone to doublecheck whether you are currently allowing these addresses to pass your prefix filters and that you're no longer nullrouting them... Many thanks, Frans -- Quanza Engineering B.V. Elandsstraat 44 Frans ter Borg 1016 SG Amsterdam E: frans(a)quanza.net www.quanza.net

3 2

RE: updating bogon filters for 83/8 and 84/8
by Michel Py 10 Jan '04

10 Jan '04

> Frans ter Borg wrote: > On November 15th 2003, IANA allocated 83/8 and > 84/8 to RIPE. Unfortunately, quite a few ISPs > and corporates out there, have not yet updated > their bogon filters to allow for these ranges > to pass. The inconvenience of this would be greatly lessened if more people used automated ways to propagate bogon filters. The authors welcome comments on the work currently underway to facilitate automation. If you find this of interest, please help with lobbying your router vendor to implement the very small changes required. http://arneill-py.sacramento.ca.us/draft-py-idr-redisfilter-01.txt Michel.

1 0

Rogers Cable Contact
by manolo＠dialtone.com 10 Jan '04

10 Jan '04

Could someone from Rogers Internet contact me offlist? Thanks,

1 0

RE: interesting new virus, maybe???
by Hank Nussbacher 10 Jan '04

10 Jan '04

At 11:16 AM 09-01-04 -0800, Brennan_Murphy(a)NAI.com wrote: >Send it in to AVERT. It's free analysis and will give you >recommendations for how to deal with it: > >https://www.webimmune.net/default.asp > >...does require registration but again, it's free. > >or email it in per instructions here: > >http://vil.nai.com/vil/submit-sample.asp > >other vendors may have similar mechanisms. If you get a new virus here are some addresses: Command Software <virus(a)commandcom.com> Computer Associates (US) <virus(a)ca.com> Computer Associates (Vet/EZ) <ipevirus(a)vet.com.au> DialogueScience (Dr. Web) <Antivir(a)dials.ru> Eset (NOD32) <sample(a)nod32.com> F-Secure Corp. <samples(a)f-secure.com> Frisk Software (F-PROT) <viruslab(a)f-prot.com> Grisoft (AVG) <virus(a)grisoft.cz> H+BEDV (AntiVir): <virus(a)antivir.de> Kaspersky Labs <newvirus(a)kaspersky.com> Network Associates (McAfee) <virus_research(a)avertlabs.com> Norman (NVC) <analysis(a)norman.no> Sophos Plc. <support(a)sophos.com> Symantec (Norton) <avsubmit(a)symantec.com> Trend Micro (PC-cillin) <virus_doctor(a)trendmicro.com> -Hank >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >Scott Granados >Sent: Friday, January 09, 2004 12:43 PM >To: nanog(a)merit.edu >Subject: interesting new virus, maybe??? > > > >I'm not sure if anyone has seen this or if its just to early but. > >While opening mail, <not with a microsoft outlook product> I found >something which looked different. The message was from pgp-public-key >and >said "Here is my key". When you look at the attachment its called >youremail.doc.com obviously something meant to be executed. What struck > >me as different from the top was it wasn't from a support@microsoft or >some such address it specifically mentioned pgp_public_key. Also, I >obviously didn't try to run the code or do anything with it, it is 76 K >in >size and again called youremail.doc.com. > >I haven't tried a virus scanner against it yet but will later. > >Thanks > >Scott

1 0

Looking for Abovenet/NetAccess contact
by Dick Cocks 10 Jan '04

10 Jan '04

3 2

Looking for a FiberNet Contact (ftgx.com)
by Fisher, Shawn 10 Jan '04

10 Jan '04

Could someone from FiberNet contact me offlist? TIA

1 0

Budget price for OC3 p-p or MPLS?
by Steve Francis 10 Jan '04

10 Jan '04

Just looking for budgetary figures (not looking for a sales pitch at this point.) How much is a dedicated OC3 from SJC to NYC? How much is the same service delivered via MPLS? TIA

1 0

New IPv6 Allocation
by Steve Conte 10 Jan '04

10 Jan '04

Greetings, This is to inform you that the IANA has allocated 2001:1A00::/23 to the RIPE NCC. For a full list of IANA IPv6 allocations please see: <http://www.iana.org/assignments/ipv6-tla-assignments>. Thanks, Steve --------------- Steve Conte - IANA conte(a)iana.org PGP KeyID: 0x0972C473

1 0

Lucent APX / Data Filter Question
by Claydon, Tom 09 Jan '04

09 Jan '04

Hello, Would someone familiar with the Lucent APX and filtering contact me off-list? Thanks, = TC -- Tom Claydon, IT/ATM Network Engineer Dobson Telephone Company phone: (405) 391-8201 cell: (405) 834-0341

1 0

RE: interesting new virus, maybe???
by Brennan_Murphy＠NAI.com 09 Jan '04

09 Jan '04

Send it in to AVERT. It's free analysis and will give you recommendations for how to deal with it: https://www.webimmune.net/default.asp ...does require registration but again, it's free. or email it in per instructions here: http://vil.nai.com/vil/submit-sample.asp other vendors may have similar mechanisms. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Scott Granados Sent: Friday, January 09, 2004 12:43 PM To: nanog(a)merit.edu Subject: interesting new virus, maybe??? I'm not sure if anyone has seen this or if its just to early but. While opening mail, <not with a microsoft outlook product> I found something which looked different. The message was from pgp-public-key and said "Here is my key". When you look at the attachment its called youremail.doc.com obviously something meant to be executed. What struck me as different from the top was it wasn't from a support@microsoft or some such address it specifically mentioned pgp_public_key. Also, I obviously didn't try to run the code or do anything with it, it is 76 K in size and again called youremail.doc.com. I haven't tried a virus scanner against it yet but will later. Thanks Scott

1 0