- NANOG - lists.nanog.org

Internet law
by John Obi 31 Dec '03

31 Dec '03

Hello, when will we see the FBI, and other local police in the other countries send the script kiddies to the JAILL so we can use the internet without too much pain? Thanks, -J __________________________________ Do you Yahoo!? Find out what made the Top Yahoo! Searches of 2003 http://search.yahoo.com/top2003

9 9

RE: High volumes of UDP traffic
by Drew Weaver 31 Dec '03

31 Dec '03

We've seen similar instances of these types of things usually precipitated by a customer angering someone on IRC that they shouldn't have. Its just a targeted DDoS either by someone who has owned a large number of boxen on your network, or by someone who doesn't like people who owned a large number of boxen on your network. -Drew -----Original Message----- From: Anderson, Ian [mailto:i.anderson@lancaster.ac.uk] Sent: Wednesday, December 31, 2003 12:31 PM To: nanog(a)merit.edu Subject: High volumes of UDP traffic A heads-up Since yesterday afternoon we saw a large increase in offsite traffic circa 80,000pps directed at host deals.in.crackcocaine.us 17:02:52.527762 148.88.156.86.2571 > 69.50.162.82.7854: udp 1 17:02:52.527876 148.88.156.86.2571 > 69.50.162.82.3002: udp 1 17:02:52.527877 148.88.156.86.2571 > 69.50.162.82.37525: udp 1 17:02:52.527996 148.88.156.86.2571 > 69.50.162.82.6170: udp 1 17:02:52.527997 148.88.156.86.2571 > 69.50.162.82.39709: udp 1 17:02:52.528113 148.88.156.86.2571 > 69.50.162.82.9818: udp 1 17:02:52.528114 148.88.156.86.2571 > 69.50.162.82.57395: udp 1 17:02:52.528115 148.88.156.86.2571 > 69.50.162.82.18194: udp 1 17:02:52.528230 148.88.156.86.2571 > 69.50.162.82.55981: udp 1 17:02:52.528231 148.88.156.86.2571 > 69.50.162.82.42256: udp 1 17:02:52.528350 148.88.156.86.2571 > 69.50.162.82.41441: udp 1 These seem to be from various windows boxen on our network, due to our campus being locked down we've not been able to examine closely the machines and find out exactly what's going on, we've just disconnected them as an interim measure. Anyone else seen similar strangeness? Is it coincidence or is it another l33t haxor trying the old "no one's working on new years eve"?? Anyway a happy new year to all - I'm off to enjoy the party... Ian -- Ian Anderson Network Support Lancaster University, Lancaster, LA1 4YW t: 01524 593019 ~ ip: 01524 510101 ~ f: 01524 844011 i.anderson(a)lancs.ac.uk

1 0

High volumes of UDP traffic
by Anderson, Ian 31 Dec '03

31 Dec '03

A heads-up Since yesterday afternoon we saw a large increase in offsite traffic circa 80,000pps directed at host deals.in.crackcocaine.us 17:02:52.527762 148.88.156.86.2571 > 69.50.162.82.7854: udp 1 17:02:52.527876 148.88.156.86.2571 > 69.50.162.82.3002: udp 1 17:02:52.527877 148.88.156.86.2571 > 69.50.162.82.37525: udp 1 17:02:52.527996 148.88.156.86.2571 > 69.50.162.82.6170: udp 1 17:02:52.527997 148.88.156.86.2571 > 69.50.162.82.39709: udp 1 17:02:52.528113 148.88.156.86.2571 > 69.50.162.82.9818: udp 1 17:02:52.528114 148.88.156.86.2571 > 69.50.162.82.57395: udp 1 17:02:52.528115 148.88.156.86.2571 > 69.50.162.82.18194: udp 1 17:02:52.528230 148.88.156.86.2571 > 69.50.162.82.55981: udp 1 17:02:52.528231 148.88.156.86.2571 > 69.50.162.82.42256: udp 1 17:02:52.528350 148.88.156.86.2571 > 69.50.162.82.41441: udp 1 These seem to be from various windows boxen on our network, due to our campus being locked down we've not been able to examine closely the machines and find out exactly what's going on, we've just disconnected them as an interim measure. Anyone else seen similar strangeness? Is it coincidence or is it another l33t haxor trying the old "no one's working on new years eve"?? Anyway a happy new year to all - I'm off to enjoy the party... Ian -- Ian Anderson Network Support Lancaster University, Lancaster, LA1 4YW t: 01524 593019 ~ ip: 01524 510101 ~ f: 01524 844011 i.anderson(a)lancs.ac.uk

1 0

Waaaay off topic, but: the next IETF is in Seoul...
by Bill Woodcock 31 Dec '03

31 Dec '03

...and United and Lufthansa are have fare sales to Seoul if you buy the ticket by January 16. $478 round-trip from San Francisco, for instance. It would normally cost between $900-$1100 most of the time. http://www.united.com/page/article/0,1360,50105,00.html?code=&jumpLink=%2Fn… Sorry for the off-topic post, but I figured it might let a few more ops folks get to the meeting than might otherwise feel like they could afford an overseas IETF. -Bill

2 1

Out of office/vacation messages
by Mark Prior 31 Dec '03

31 Dec '03

Why do so many supposedly clueful people have their vacation message system respond to mailing list email? Now I'll get to see who also doesn't keep a list of addresses that have already been sent the out of office message :-) Mark.

11 16

AT&T Abuse / RBL contact.
by Ejay Hire 31 Dec '03

31 Dec '03

Hello all. Can an AT&T Abuse/RBL person please contact me off-list. We are getting 550-207.65.4.2 blocked by blacklist.mail.ops.worldnet.att.net. bounces and my emails to abuse_rbl(a)att.net haven't generated a response. Thanks, Ejay Hire ISDN-Net Network Engineer 615-324-3851 615-207-6140

1 0

RE: 2004 network predictions.
by Alon Tirosh 30 Dec '03

30 Dec '03

-----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of batz Sent: Tuesday, December 30, 2003 6:25 AM To: nanog(a)merit.edu Subject: 2004 network predictions. >>Here are some dire predictions for 2004. >> >>While it would be easy to say that the world will end, I think these are all things that reasonably >>could happen, and we could act pre-emptively to mitigate their effects. >> >><snip> >> >>- ISP's use managed anti-virus/security to sell new managed services >> to users. Birth of the fully provider managed home PC? >> >></snip> I wanted to point out that this one is already happening. AOL is working hard on this '9.0 Optimized' with some ancillary teen-market driven service, and is marketing itself as a service that can magically fix your pc without you having to do anything (see TV spot of troubled parents watching toddler bang on mouse with sound hammer, then 'Computer Fixed' prompt appears on screen). Granted, they're capitalizing on what I like to call 'Market Stupidity' and positioning themselves to become the truly idiot-proof provider, but it may actually work. While im hesitant to leave such a large proportion of End-User security in the hands of AOL, it IS a start. It's not ideal, but this might be the first step in the direction of 'enforced measures' to help mitigate malware that works on the basic assumption that nobody patches their machines... Note: I don't completely agree with this approach, but its getting to the point where something has to be done.

1 0

2004 network predictions.
by batz 30 Dec '03

30 Dec '03

Here are some dire predictions for 2004. While it would be easy to say that the world will end, I think these are all things that reasonably could happen, and we could act pre-emptively to mitigate their effects. - Virus infections of handhelds and mobile phones causing widespread problems for cell networks similar to worms that flood out IP networks. - Bonus points for a bluetooth infection vector. - Extra bonus points if it floods newly minted VoIP telecom networks. Grim. - E-mail whitelist technology gains mainstream acceptance as spam hits critical mass. Spam recieved by astronauts in space. - ISP's search for new business models realizing that wireless providers are making a mint charging by the kilobyte, and more users just surf at work. - Wireless network "terrorism" or "porn" incident galvanizes legislators to force hotspot operators to get ID or credit card numbers from customers. - Really Bad instant-messenger worm that we can't do anything about because it doesn't use consistant tcp/udp ports. - ISP's use managed anti-virus/security to sell new managed services to users. Birth of the fully provider managed home PC? - Affinity networks/six-degrees site privacy boondoggle. One is caught selling access data to airlines or transport security or something. Everyone feels sick as Friendster acquired by Equifax? - Private crypted networks used for P2P. Call them blacknets, darknets, or in true arrr-pirate fashion, booty-nets. yo-ho-ho. - Successful virtual worm network forged after a worm spreads its second phase and installs an onion routed virtual network. Maybe a new P2P network? - Linux kernel made illegal, somewhere, for a minute. Presidential candidate may admit to using it once, but didn't look at the source. RIAA/MPAA/DMCA a surprise US election issue. - LEA access to ISP's formalized, spearheaded by Cisco and its "lawful interception" capability. Court gag order placed on participating ISP's, disgruntled admin leaks details to Cryptome or Phrack. - More end-to-end control connections that identify/validate/authenticate end users. Eg, VPN's, SSL, PPP. An assault on anonymity and stateless protocols, or technologies that interrupt the statefulness of the connection between user and their primary providers. (eg, WiFi, P2P, UDP, VoIP). - P2P on the road to obselescence caused by higher metred bandwidth charges to home cable users in line with wireless costs. While there is a glut of bandwidth capacity available for transit, this is not the case for end-user consumption. Cable providers will lower bandwidth caps under the auspices of combatting piracy, enabling them to actually make money. Given these sort of predictions, I don't mind being wrong. Have a good year, I'll post again then. ;) -- batz

1 0

Trends in network operator security
by Sean Donelan 30 Dec '03

30 Dec '03

Its 2003 and everyone is making their predictions. What trends are network operators seeing for Internet security? Old favorites Buffer overflows Distributed Denial of Service Poor passwords (cisco/sanfran) Poorly coded systems Blame the user for not protecting poorly coded systems Trends Attack the network (why? because we can) Proxy relay hiding (its not just for SMTP anymore) Combo Bot/Trojan/Worms Embedded software "upgrades" Any other trends network operators are seeing?

2 2

Cachibility analysis software ?
by Yu Ning 30 Dec '03

30 Dec '03

Hi nanog, Can anyone tell me is there any tool to analysis if a web site is cachable ? Or now many content in a given site is cachable ? What's more, if router does not support WCCP, how can a cache work with him ? Any suggestion ? thanks ! Yu Ning ______________________________________ (Mr.) Yu Ning, Vice Director Networking & Engineering Dep. North Telecom BU, China Telecom Beijing, P.R.China +86-10-66002099 ______________________________________

4 3