- NANOG - lists.nanog.org

Re: MTU path discovery and IPSec
by Michael.Dillon＠radianz.com 05 Dec '03

05 Dec '03

>Is there any discussion on better alternatives to PMTUD such as leaving >off DF and a new ICMP subtype, rate limited, to inform senders that >they've been fragged and at what (call it reverse PMTUD?) ? There is a better alternative that is already used in production. When a router receives packets too big for an outgoing link, it fragments the packets. On the other side of the small MTU link, the receiving router reassembles the packets which are always in the correct order. All you need to do to enable this functionality is to turn on IPv6. Or perhaps you would like to keep on reinventing the same wheel over and over again? >Does IP6 really do away with fragmenting? Is there any current >discussion on all this? What!? Are there still people who haven't at least read one or two IPv6 books? Try Huitema, "IPv6 The New Internet Protocol" or Loshin, "IPv6 Clearly Explained" >I see I have to go do some research. Yes. This http://www.ipv6forum.com/ is the best website to use to find resources. The best slideware I've ever seen on IPv6 comes from the folks at the Technical University of Madrid who presented at the 2002 IPv6 summit. You can get their slides from the agenda page here http://www.ipv6-es.com/02/in/i-agenda.htm --Michael Dillon

1 0

The Cidr Report
by cidr-report＠potaroo.net 05 Dec '03

05 Dec '03

This report has been generated at Fri Dec 5 21:47:15 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 28-11-03 128347 90330 29-11-03 128360 90279 30-11-03 128411 90309 01-12-03 128392 90290 02-12-03 128418 90292 03-12-03 128561 90308 04-12-03 128539 90397 05-12-03 128663 90435 AS Summary 16204 Number of ASes in routing system 6463 Number of ASes announcing only one prefix 1406 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73591040 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 05Dec03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 128617 90395 38222 29.7% All ASes AS6197 764 265 499 65.3% BATI-ATL BellSouth Network Solutions, Inc AS4323 678 206 472 69.6% TW-COMM Time Warner Communications, Inc. AS701 1406 972 434 30.9% ALTERNET-AS UUNET Technologies, Inc. AS7018 1387 962 425 30.6% ATT-INTERNET4 AT&T WorldNet Services AS7843 524 122 402 76.7% ADELPHIA-AS Adelphia Corp. AS4134 502 123 379 75.5% CHINANET-BACKBONE No.31,Jin-rong Street AS6198 610 254 356 58.4% BATI-MIA BellSouth Network Solutions, Inc AS209 859 535 324 37.7% ASN-QWEST Qwest AS22909 317 12 305 96.2% DNEO-OSP1 Comcast Cable Communications, Inc. AS1239 953 669 284 29.8% SPRINTLINK Sprint AS22773 315 31 284 90.2% CCINET-2 Cox Communications Inc. Atlanta AS4355 383 101 282 73.6% ERMS-EARTHLNK EARTHLINK, INC AS27364 354 73 281 79.4% ACS-INTERNET Armstrong Cable Services AS1221 954 677 277 29.0% ASN-TELSTRA Telstra Pty Ltd AS6347 331 85 246 74.3% DIAMOND SAVVIS Communications Corporation AS17676 283 39 244 86.2% GIGAINFRA Softbank BB Corp. AS25844 243 17 226 93.0% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS6140 346 130 216 62.4% IMPSAT-USA ImpSat AS14654 206 2 204 99.0% WAYPORT Wayport AS11305 230 37 193 83.9% INTERLAND-NET1 Interland Incorporated AS2386 402 218 184 45.8% INS-AS AT&T Data Communications Services AS4519 194 13 181 93.3% MAAS Maas Communications AS6327 204 28 176 86.3% SHAW Shaw Communications Inc. AS9583 228 58 170 74.6% SATYAMNET-AS Satyam Infoway Ltd., AS9929 197 27 170 86.3% CNCNET-CN China Netcom Corp. AS20115 581 413 168 28.9% CHARTER-NET-HKY-NC Charter Communications AS2048 251 85 166 66.1% LANET-1 State of Louisiana AS15270 203 41 162 79.8% AS-PAETEC-NET PaeTec.net -a division of PaeTecCommunications, Inc. AS6478 193 41 152 78.8% ATT-INTERNET3 AT&T WorldNet Services AS6517 237 87 150 63.3% YIPESCOM Yipes Communications, Inc. Total 14335 6323 8012 55.9% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI Andara High Speed Internet c/o Halifax Cable Ltd. 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.62.64.0/24 AS3549 GBLX Global Crossing 64.62.126.0/23 AS25700 SWIFTDESK SWIFTDESK VENTURE 66.41.192.0/18 AS13367 CCCH-AS3 Comcast Cable Communications Holdings, Inc 69.8.128.0/17 AS7260 NORLIGHT Norlight Telecommunications 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.143.2.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 ALTERNET-AS UUNET Technologies, Inc. 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 AS719 LANLINK autonomous system 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.98.8.0/21 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.79.32.0/20 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.136.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.154.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.114.156.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.160.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 202.0.180.0/24 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.4.252.0/22 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.72.112.0/22 AS22351 INTELSAT-1 INTELSAT 202.74.32.0/19 AS9315 CWN-AS-AP Chomanan WorldNet Co., Ltd. 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.165.0.0/19 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.165.0.0/20 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.165.16.0/20 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.179.64.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.65.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.66.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.67.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.68.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 203.29.222.0/24 AS22934 EBROADBANDNOW E Broadband Now Inc. 203.32.4.0/23 AS7617 APNIC-AS-2-BLOCK Asia Pacific Network Information Centre 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.86.2.0/23 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 203.132.95.0/24 AS9787 CONCEPT-AU-AP Concept Networks 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.102.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.103.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.106.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.109.0/24 AS10141 CALOUNDRA-AS-AP Caloundra.net 203.132.110.0/24 AS7598 ALPHALINK-AS-AP Alphalink Pty Limited - Melbourne, Australia 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.112.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.89.225.0/24 AS2495 KANREN Kansas Research and Education Network 204.154.125.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.194.110.0/23 AS10588 ICSNET Intelligent Computer Solutions, Inc 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.82.64.0/18 AS7029 ALLTELNET Alltel Information Services, Inc. 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 208.104.103.0/24 AS1239 SPRINTLINK Sprint 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 TELEGLOBE-AS Teleglobe Inc 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.36.46.0/24 AS7176 GENUITY-AS7176 Genuity 216.36.47.0/24 AS7176 GENUITY-AS7176 Genuity 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 218.211.0.0/16 AS4788 TMNET-AS-AP TMnet, Telekom Malaysia Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Cisco MGX and Cisco CSG issues
by John Bittenbender 05 Dec '03

05 Dec '03

Greetings NANOG, If anyone has experience with Sonet OC3 between a Cisco MGX and a Lucent 5ESS (preferably with APS configured) can you please contact me off-list. I am also interested in anyone having problems with Cisco CSG (Content Services Gateway) and the units hanging all of the active sessions (may have to do with L2TP Tunneling). Thanks, John Bittenbender

1 0

popupad spam wrapup.
by Johannes B. Ullrich 05 Dec '03

05 Dec '03

Thanks everyone here on this list who helped track down this! We just published a (hopefully more or less final) "Diary" on this topic at http://isc.sans.org/diary.html (see below for text). As it turns out, at least one particular version of the software distributed by PopAdStop.com did include a Trojan component sending out popup spam. ------------- For over a week, we had been tracking an increase in port 1026-1031 UDP traffic. More detailed investigation revealed a component in this traffic with the following characteristics: (*) The payload consisted of two zero bytes (*) A large number of sources participated in these scans (*) the scans came from valid IPs, and the source port did not appear to be crafted. This is different from most popup spam sent to this port. Most popup spam is sent by only a small number of sources. And usually uses a fixed source port. While popup spam in itself is not any more dangerous then e-mail spam, and more of an annoyance, the large number of sources hinted to the fact that it is likely sent from unsuspecting exploited systems ("Zombies"). The connection with popup spam was made later, by allowing a honeypot to respond to the two byte probe. The result was an ad sent by the probing host. PACKET DUMP (IP Addresses are obfuscated) 11:57:11.361783 IP w.x.y.z.1974 > a.b.c.d.1030: udp 2 0x0000 4500 001e c33d 0000 6a11 8094 wwxx yyzz E....=..j...R#@3 0x0010 aabb ccdd 07b6 0406 000a e720 0000 0000 ................ 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:57:11.363913 IP 129.170.248.252.1030 > w.x.y.z.1974: udp 84 0x0000 4500 0070 0169 0000 8011 2c17 aabb ccdd E..p.i....,..... 0x0010 wwxx yyzz 0406 07b6 005c aa23 0406 0000 R#@3.....\.#.... 0x0020 1000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0050 0000 0000 52f7 c93f 0000 0000 0000 0000 ....R..?........ 0x0060 0000 0000 0000 0400 0000 0000 0800 001c ................ 11:57:11.477413 IP w.x.y.z.1975 > 129.170.248.252.1026: udp 519 0x0000 4500 0223 c350 0000 6a11 7e7c wwxx yyzz E..#.P..j.~|R#@3 0x0010 aabb ccdd 07b7 0402 020f 43b2 0400 0800 ..........C..... 0x0020 1000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0030 0000 0000 f891 7b5a 00ff d011 a9b2 00c0 ......{Z........ 0x0040 4fb6 e6fc 82f5 b0ec e32c 41ec 173c 5a07 O........,A..<Z. 0x0050 dee7 8629 0000 0000 0100 0000 0000 0000 ...)............ 0x0060 0000 ffff ffff b701 0000 0000 1400 0000 ................ 0x0070 0000 0000 1400 0000 5757 572e 504f 5041 ........WWW.POPA 0x0080 4453 544f 502e 434f 4d00 0000 1400 0000 DSTOP.COM....... 0x0090 0000 0000 1400 0000 554e 5345 4355 5245 ........UNSECURE 0x00a0 4420 434f 4d50 5554 4552 0000 6b01 0000 D.COMPUTER..k... 0x00b0 0000 0000 6b01 0000 5055 424c 4943 2053 ....k...PUBLIC.S 0x00c0 4552 5649 4345 2041 4e4e 4f55 4e43 454d ERVICE.ANNOUNCEM 0x00d0 454e 543a 0d0a 0d0a 0d0a 594f 5552 2043 ENT:......YOUR.C 0x00e0 4f4d 5055 5445 5220 4953 204e 4f54 2053 OMPUTER.IS.NOT.S 0x00f0 4543 5552 4544 2041 4741 494e 5354 2050 ECURED.AGAINST.P 0x0100 4f50 2d55 5053 2121 210d 0a0d 0a0d 0a44 OP-UPS!!!......D 0x0110 4f4e 2754 2053 5045 4e44 2041 4e59 204d ON'T.SPEND.ANY.M 0x0120 4f4e 4559 2046 4f52 2041 4e59 2050 4f50 ONEY.FOR.ANY.POP 0x0130 2d55 5020 424c 4f43 4b45 5221 0d0a 0d0a -UP.BLOCKER!.... 0x0140 4765 7420 6f75 7273 2066 6f72 2046 5245 Get.ours.for.FRE 0x0150 4521 2121 0d0a 0d0a 5965 7320 7468 6174 E!!!....Yes.that 0x0160 2773 2072 6967 6874 2c20 5354 4f50 2050 's.right,.STOP.P 0x0170 6f70 2d55 7020 6164 7320 666f 7220 4652 op-Up.ads.for.FR 0x0180 4545 2121 210d 0a0d 0a0d 0a0d 0a20 2020 EE!!!........... 0x0190 2020 2020 2020 2020 2020 2a20 2a20 2a20 ..........*.*.*. 0x01a0 2020 2020 444f 204e 4f54 2043 4c49 434b ....DO.NOT.CLICK 0x01b0 2022 4f4b 2220 4245 464f 5245 2047 4f49 ."OK".BEFORE.GOI 0x01c0 4e47 2054 4f20 4f55 5220 5745 4253 4954 NG.TO.OUR.WEBSIT 0x01d0 4520 2020 2020 2a20 2a20 2a0d 0a0d 0a4f E.....*.*.*....O 0x01e0 6e20 796f 7572 2077 6562 2062 726f 7773 n.your.web.brows 0x01f0 6572 2773 2061 6464 7265 7373 2062 6172 er's.address.bar 0x0200 2c20 5459 5045 2049 4e3a 2020 2020 2077 ,.TYPE.IN:.....w 0x0210 7777 2e50 6f70 4164 5374 6f70 2e63 6f6d ww.PopAdStop.com 0x0220 0d0a 00 ... The advertised site, "www.popadstop.com", does offer a program for download, which promises to stop future popup spam. We downloaded the application, and installed it in an isolated lab network. During install, the application checks for updates by requesting: http://www.neweststuff.com/versinfo.dat . Recent version of the application do not show any further outbound traffic. However, earlier version of the application did start to send the typical two zero bytes and popup spam. We have been made available the following trace from an infected system: 1. connection to popadstop.com, port 80 (http) e.f.g.h 066.225.219.162 6 1485 80 88472 4249 17:27:21.5791 e.f.g.h 066.225.219.162 6 1486 80 15401 1203 17:27:27.9025 e.f.g.h 066.225.219.162 6 1489 80 4802 1159 17:28:16.9154 e.f.g.h 066.225.219.162 6 1490 80 1331056 25025 17:28:41.2205 e.f.g.h 066.225.219.162 6 1491 80 824 408 17:29:20.3522 2. connection to neweststuff.com, port 80 (http) e.f.g.h 216.058.174.211 6 1492 80 746 410 17:29:20.4347 (snip one min) 3. scanning for port 1026-1030 e.f.g.h x.x.x.x 17 1528 1026 0 44 17:30:20.0967 e.f.g.h x.x.x.x 17 1529 1030 0 44 17:30:20.0979 e.f.g.h y.y.y.y 17 1528 1026 0 44 17:30:20.1787 e.f.g.h y.y.y.y 17 1529 1030 0 44 17:30:20.1790 Summary ------- An earlier version of the software distributed by PopAdStuff did actively scan and send popup spam from unsuspecting user's system. -- CTO SANS Internet Storm Center http://isc.sans.org phone: (617) 786 1563 fax: (617) 786 1550 jullrich(a)sans.org

1 0

Re: Firewall stateful handling of ICMP packets
by Jamie Reid 04 Dec '03

04 Dec '03

Personal view: This was a problem when filtering Nachi while it pinged networks to their knees. Sometimes I wonder if there is any legitimate reason to allow pings from users at all. If the user really needed to use ping, that is, if they were in a position to do anything about the results of the ping tests, then they would know enough to use traceroute in UDP mode or some other tool. There are lots of other useful ICMP types to handle all the other ICMP needs, but ping seems to be something that was created for the convenience of a kind of user that is effectively extinct in todays Internet. ICMP echo is unique among ICMP types in that it is the only one that elicits it's own response. What I mean by this is that source-quench, <foo>-unreachables, and others are all generated by hosts and routers in response to relatively stateful traffic. There is nothing that echos do that SNMP (I know, I know) and traceroute don't accomplish in a more controlled fashion, no? It would kill alot of DDoS attacks and render their zombie networks useless, retire legacy backdoors and viruses, up the ante for network management tools, and slow down some virus propagation substantially. ICMP echos are a bit of a hack and, quite literally, noise, and I wonder if it may be time to consider unofficially retiring them using filters. -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "Sean Donelan" <sean(a)donelan.com> 12/03/03 05:12pm >>> You could drop ICMP packets at your firewall if the firewalls properly implemented stateful inspection of ICMP packets. The problem is few firewalls include ICMP responses in their statefull analysis. So you are left with two bad choices, permit "all" ICMP packets or deny "all" ICMP packets.

9 10

Re: new nasty email virus trick to bypass scanners
by Mike Tancsa 04 Dec '03

04 Dec '03

At 09:53 PM 03/12/2003, Jamie Reid wrote: >If an attacker can convince a user to do anything, all bets >are off. > >It is conceptually similar to using SSL to evade a network IDS. > >This is also an intrusion test trick. As system owners, there >is only so much we can do to prevent and detect compromises. >What matters is how we respond. True enough. However, we also have to protect naive and vulnerable users to some degree. Think about elderly folk. They are not necessarily as quick to spot the scam. The ability to stop the virus before it gets to them is important. The other thing that worries me is that those who rely on their ISP to scan for viruses, a false sense of security can come into play. In the case of these types of email viruses, the user might think the file is OK because it was scanned. ---Mike

6 5

Re: AOL rejecting mail from IP's w/o reverse DNS ?
by Michael.Dillon＠radianz.com 04 Dec '03

04 Dec '03

>the whole blocking w/o IN PTR >records had come up, Interestingly, there was a time when access to FTP servers was considered important and many FTP servers blocked access if the IN PTR records did not match the IN A records. >with people saying they were on hosting where they >couldn't change PTR records, and the clients who couldn't get mail from >small offices with Exchange servers on DSL lines where the ISP hadn't >configured reverse DNS. Sometimes SMTP relaying is good. If your ISP has good reason to not configure matching IN PTR records for your mail server then ask them to relay all your outgoing SMTP. The end result is the same; you won't be able to set up a working SMTP server without your ISP's cooperation. > Then there was the comment on how reverse DNS was >meaningless, and did you still run identd ? It's not the reverse DNS itself that is meaningful. It is the fact that the SMTP server operator with proper IN PTR records probably has the cooperation of their ISP. Proper configuration of in-addr.arpa is a "good idea" TM. However, it isn't the right way for large mail server operators to go. Instead, they should start exchanging their SMTP sessions on a port other than 25, i.e. NIMTP (New Improved MTP). The NIMTP servers would not accept incoming connections from unknown servers. In order to join the club, you would have to certify that you will only send mail from known senders or relay mail from organizations which will make the same certification. In this way, we create an overlay mail transport network in which the members have some sort of one-to-one mail peering relationship that allows them to enforce an AUP on each other as well as maintain good contact info. Peering relationships work for BGP (lots of rules) and they worked for USENET (not many rules). Why can't the same principles be applied to email or IM services? --Michael Dillon

4 3

RE: MTU path discovery and IPSec
by Arjan Hulsebos 04 Dec '03

04 Dec '03

> On Wed, 03 Dec 2003 16:05:39 GMT, jgraun(a)comcast.net said: > > > 1) I assume MTU path discovery has to been in enabled on > each router in the path in order for it work correctly?! > > Actually, no. All that's required is that: You also need an OS that does not set the DF-bit on every packet it sends out. IIRC, out-of-the-box Solaris 8 is excellent at doing that. No matter how many icmp messages it gets, it happily ignores them by insisting on sending out frames of 1500 bytes with the DF-bit set. Makes trouble-shooting IPSec connections, uhm.... interesting. Cheers, Arjan H --- This message is confidential and may be privileged. Any review, retransmission, dissemination or other use of, or taking any action with reference to this information by persons other than the intended recipient is prohibited. If you received this message in error, please notify the sender by reply e-mail and delete this message from all computers. Please note that e-mails are susceptible to change. The sender will not accept liability for the improper or incomplete transmission of the information contained in this message.

1 0

Re: [Re: Firewall stateful handling of ICMP packets]
by joshua sahala 04 Dec '03

04 Dec '03

Sean Donelan <sean(a)donelan.com> wrote: > > Did news stories about this get other people in New Zealand to fix their > computers, apply patches, use anti-virus? Or were were lots of stories > about the "evil" telco ruining grandmothers and orphans? and the telco > eventually waived the charges? probably a little of each - and each will likely be temporary. users will keep updated for the near-term, and telcos/isps might waive charges. however, relying on either will lead to further problems (as we have seen, and will continue to see). > Toll charges do encourage PBX owners and cordless phone makers to > improve the security of their products? Most cordless phones (unlike > WiFi) now have automatic authentication between the handset and base > (not encryption, just authentication). Most PBX's block outside to > outside phone connections (the telephone version of proxy/relay) by > default now. enough pain will eventually cause a change (and/or a higher pain tolerance). so far, pain tolerance by most users is rising, but not much is changing. users are still ignorant as to what is wrong or how to fix it (as you have pointed out to me in previous emails), no matter how many news stories there are, or how many 'helpful' emails are sent by isps or manufacturers. > If ISPs charged customers $0.000001/email message, would it cure spam > or would the spammers just continue to use third-party victims to spam > and there would be lots of news stories about grandmothers and orphans > getting huge ISP bills? IANAL, but many spammers are already breaking > a law by using victim machines without authorization; but would law > enforcement be more likely to do something if the victims now had a > $50,000 bill from their ISP due to the unauthorized traffic? it still comes down to figuring out who is doing it, and then getting enough evidence to 'stop' them. even the ones we know are spammers have gotten pretty good at using fronts for their operations: and when you have tens-of-thousands of vulnerable computers with 'fast' connections, you don't have to try very hard. we keep beating this same horse from different angles and hoping for different results. unless someone out there has a crystal ball and can predict the next exploit (and then magically fix it), we will beat it again next week...so until then, i am off to remind my less clueful friends and family members, again, not to apply the 'newest security patch' email from foo(a)microsoft.com (not even worth $0.02 today) /joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Standard/recommended formats for network information
by Bruno Quoitin 04 Dec '03

04 Dec '03

Looking for advice. I would like to know if there are standard or widely used file formats to represent the following information: * intradomain topology (including IGP costs, bandwidths, delays, SRLG) * BGP peerings * traffic matrices Thanks in advance Bruno -- CSE Dept. UCL, Belgium - http://www.info.ucl.ac.be/~bqu

1 0