- NANOG - lists.nanog.org

Re: TAT 14 failure
by garrett.allen＠comcast.net 02 Dec '03

02 Dec '03

still seeing decent ping times. anyone detect an actual outage or issue? thanks. > > I saw that link when I googled for TAT-14. I was looking more for a "see, I > told you so" link that I can forward to management that provides proof that > this is why our UK office is down...if you know what I mean. > > Here's an interesting explanation of undersea cabling: > http://davidw.home.cern.ch/davidw/public/SubCables.html > > > -Jack > > > --- Jared Mauch <jared(a)puck.nether.net> wrote: > > > > This is a basic map of the fiber path for those > > that haven't found one yet. > > > > http://www.kddiscs.co.jp/e/business/02_15.html > > > > - jared > > > > On Tue, Nov 25, 2003 at 10:32:16AM -0800, Jack McCarthy wrote: > > > > > > Anyone have additional info regarding this outage? Links? Besides > > tat-14.com > > > - it seems to be down or just flooded with requests. > > > > > > > > > -Jack > > > > > > > > > --- jmalcolm(a)uraeus.com wrote: > > > > > > > > The northern leg of TAT14 seems to have just taken an outage about an > > > > hour ago. As the southern leg was already down due to other faults, > > > > this will probably be an exciting time for many providers. > > > > > > > > > > > > > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > > > > > >

7 6

port 1026-1031 traffic
by Johannes B. Ullrich 02 Dec '03

02 Dec '03

Well, for the last week there has been an odd increase in port 1026-1031 traffic. While everything points to popup spam, there are a few issues that are 'odd': - increase in sources that cause this traffic. - "natural" source ports vs. crafted source port which is typical for popup spam - 2-byte '00 00' payload (more details: http://isc.sans.org/diary.html ) As it very much looks like that the origin are compromised Windows systems (some appear to be behind NAT routers), I posted a list with IPs at http://feeds.dshield.org/port1026.dat The list is sorted by IP. If any of these systems live on your network, your help in tracking down the root cause of all this traffic is appreciated. Its (not yet) a big deal. But maybe its one of the few times we can stay ahead of the problem. Also, at this point it shouldn't be too hard to track these systems (its only about 5,000 unique sources) the columns of the data file: - ip address - first time seen on this day (GMT) - last time seen on this day (GMT) - number of packets detected - date The filter applied to the list: - the hosts sent traffic to port 1026-1031 - the source port was not 666 or 4177 - it happened today or yesterday (today: Dec. 2nd). -- CTO SANS Internet Storm Center http://isc.sans.org phone: (617) 786 1563 fax: (617) 786 1550 jullrich(a)sans.org

1 0

TAT 14 failure
by jmalcolm＠uraeus.com 02 Dec '03

02 Dec '03

The northern leg of TAT14 seems to have just taken an outage about an hour ago. As the southern leg was already down due to other faults, this will probably be an exciting time for many providers.

5 5

Google-jacking?
by Dave Temkin 01 Dec '03

01 Dec '03

Has anyone seen a situation on their internal networks where going to a (non-Google) page "Hijacks" them and they end up with either the Google front page or a broken link page? This happens on machines both with the toolbar and without, and we've seen it on machines on different networks/running different OS's. Just curious. Thanks, -Dave

2 2

Quarantaine network for infected hosts?
by Adi Linden 01 Dec '03

01 Dec '03

Reading about the various ways universities deal with ill behaved client PCs, is there documentation on how to quarantaine devices on a network? Adi

3 2

Anyone from Cogent that can look at "show log" and not get confused?
by Alex Yuriev 01 Dec '03

01 Dec '03

Hello, If there is possibly maybe a person from Cogent that does not get severely confused and say "Oh, it is just the way the routers work" or "Oh it just takes a long time for routes to be sent to you" after being shown synch errors, garbage in AS_PATH that cogent is sending, I would greatly appreciate hearing from you since your lead tech thinks that it is normal for a GSR to take 30 minutes to receive entire 576 routes. Thanks, Alex

1 0

Need contact information for ATDN
by J. Oquendo 01 Dec '03

01 Dec '03

//Second posting// Good evening all, anyone have a good contact for AOL (ATDN) engineers? Having a problem with users on a /17 getting mail there, checked for blackholes on my end, would like to know if my routes are being null0'd. TIA J. Oquendo =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How do you know where I'm at when you haven't been where I've been understand where I'm coming from" -- Cypress Hills

1 0

Re: [Re: Have worm? University upgrades network]
by joshua sahala 01 Dec '03

01 Dec '03

Sean Donelan <sean(a)donelan.com> wrote: > > Do people find "self-certification" by end-users actually fixes > anything? depends on how badly they want to get back on that interweb-thing...and how clueful they are (or can be made to be). if the penalties for not being clean are steep enough (no interweb privileges for a semester), then i think they will do it right. > Or do users keep on clicking on the "Yes, I'm Clean" button? > > In the meantime, you still have to carry the traffic from the infected > computer if only on your quarantine "network." Usually the quarantine > LAN is some type of virtual network, so the underlying bandwidth is > still consumed by the traffic. Its amazing what happens to a > registration server when an infected computer tries to register tens of > thousands of times a minute. Redirecting the user traffic to a > quarantine server, results in that server getting whalloped. > i would hope that you are filtering and rate-limiting upstream traffic, and that you have built the server with sufficient horsepower and self-preservation hooks that it would survive. ftp or http don't require too much upstream, and you probably don't need to allow much else from the users computers /joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

3 3

Re: Have worm? University upgrades network
by warner＠cats.ucsc.edu 01 Dec '03

01 Dec '03

Sean Donelan said > On the other hand, California State-Long Beach is planning to upgrade > its network to deal with the worms. > > > http://www.csulb.edu/~d49er/archives/2003/fall/news/volLIVno49-dorm.shtml While Sean's interpretation draws reasonable inference from the cited article, the particular upgrade we've been told about will use some L2 intercept boxes to scan user computers at the time they attempt to connect to the LB net. They seem to be referring to the installation of the authentication/scanning boxes as part of the network upgrade. The hope/plan is that web redirection for software fixits through an appropriate campus download page will preceed releasing full internet services to the users. I don't think that CSULB is going to add capacity to deal with the icmp scans. Rather they are hopeful that they can use this as a clean up strategy. What we (UC Santa Cruz) share with LB is the vendor that will be adding scanning to their net-auth box: Perfigo. We have heard of the LB plans indirectly through the vendor, but in the context of the article, it all fits. -jim warner, UC Santa Cruz ---

2 1

IRU Contracts?
by Deepak Jain 01 Dec '03

01 Dec '03

I am assuming this is on-topic, though the responses may not be. If there is interest, I will be glad to summarize the answers for the list. I have been testing a few aspects of the market for DF, and I am assuming that for those that are capable of paying for it (DF) to guys who can provide contracts that are enforceable beyond 90 days after signing, a lot more complexity can be cooked into agreements today (2003) than before (1999) -- moreover, a lot more is known about what can go wrong with IRUs now than when they were first being bought. However, I am not seeing a lot of the agreements themselves changing... So I was wondering... For my purposes, I am considering hundreds and thousands of thread-miles, but I am sure even for small intracity spans, some of these things matter. What terms do particular companies or does the community in general think need to be included above and beyond the standard IRU language most vendors are providing? Does anyone insist on fiber performance (beyond dB loss) for the entire life of the contract (if so, what other measures), maintenance/repair SLAs, mass-fusion performance on splices? Does anyone require lambda testing outside of 1550nm? Does anyone accept the payment terms proposed or do they take what they can get depending on the provider? I am guessing only about 3 people are going to want to hear the results of this, so private email responses may be best. Thanks in advance, DJ

2 1