- NANOG - lists.nanog.org

[OT] question on NANOG meetings
by William Caban 27 Sep '03

27 Sep '03

Are NANOG meetings webcasted? More specifically, Is NANOG29 going to be webcasted/multicasted/netcasted? Thanks, William -- William Caban <william(a)hpcf.upr.edu>

6 6

Re: Average case performance vs. Worst-case guarantee
by sthaug＠nethelp.no 26 Sep '03

26 Sep '03

> When an ISP buys a router does it want a worst-case guarantee about the > router's capabilities? Or will it buy a router which can give better > performance in the average case (it may drop some packets if the traffic > pattern changes suddenly)? Assuming both cost the same. Worst case guarantee is necessary in many cases. Easy example: A router that can handle an STM-1 of regular Internet traffic is worthless to us if it dies in the face of an STM-1 with minimum sized attack traffic. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1

Submit your comments on Verisign's SiteFinder service to ICANN
by Craig A. Huegen 26 Sep '03

26 Sep '03

Hi all, I strongly recommend that if you have an opinion on the Verisign SiteFinder service, that you visit http://www.icann.org/general/wildcard-history.htm and submit your comments appropriately ahead of the October 7 meeting of the SSAC. /cah

1 0

Re: FW: e-bay
by Mike Tancsa 26 Sep '03

26 Sep '03

Its sad how many people get taken in by obvious and less obvious scams like this.... But I guess this is as old as the "knock knock: Wallet inspector."... There was a similar paypal scam that had "click here to go to www.paypal.com" which looked and displayed nice and legit in the email, but the href really sent you to a site in Korea that looked exactly like the paypal login screen.... "Thank you for verifying your information".... Indeed! ---Mike At 12:25 PM 26/09/2003, Mike Tomasura wrote: > > I guess e-bay had some problems? A few users got this message from them. > > > > Dear eBay user! > > > > At 09.24.2003 our company has lost a number > > of accounts in the system during the database > > maintenance. If you have an active account, please > > click on the link below to update your credit card > > information. If you have problems with your account, please let us know > > at email support(a)ebay.com <mailto:support@ebay.com> > > > > https://cgi.ebay.com/saw-cgi/eBayISAPI.dll?UpdateInformation > > <https://e%31bay.com/saw-cgi/?UpdateInformation> > > > > > > > >

4 5

European and Far East Connectivity in the US
by Timothy Brown 26 Sep '03

26 Sep '03

I'm looking for recommendations for providers who provide excellent European and/or Far East transit from multiple points in the southeastern United States. Specifically, i'm looking for people who have strong connectivity to Chinalink and DTAG. Sales droids need not reply. Send replies off-list, i'll summarize. Thanks, Tim

1 0

Re: Increase in tcp traffic from spoofed source to bogon?
by Pekka Savola 26 Sep '03

26 Sep '03

On Thu, 25 Sep 2003, Mike Tancsa wrote: > Is it all to 135 ? I drop lots of that at my border. Each time I traced > it back to the customer, it was some infected machine that was not being > natted for various reasons. > > e.g. > > Deny TCP 172.16.4.1:4616 192.100.103.4:135 > > We also see the odd ntp request. Is it bogon as in RFC 1918 or bogon as in > not yet allocated / routed ? We are seeing some amount of traffic to the SMTP port of 127.0.0.2 (!!!). I haven't bothered to check this out at the moment. One would suppose the routers would blackhole the loopback traffic (or have a route to 127.0.0.1), but no... :-) > At 05:26 PM 25/09/2003, Mark Segal wrote: > > >While cleaning the narchi virus icmp traffic.. I noticed a lot of tcp > >traffic (it seems to be increasing) from spoofed address to bogon space? > >Any ideas on what virus or worm this is? Is it new? > > > >Regards, > >Mark > > > >-- > >Mark Segal > >Director, Network Planning > >FCI Broadband > >Tel: 905-284-4070 > >Fax: 416-987-4701 > >http://www.fcibroadband.com > > > >Futureway Communications Inc. is now FCI Broadband > -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

2 1

RE: FW: e-bay
by Mike Tomasura 26 Sep '03

26 Sep '03

Anyone that has a Spam filter should have "ebay" and "e-bay" in the list. That is how we caught it. -----Original Message----- From: Justin B. Newman [mailto:justin.newman@binhost.com] Sent: Friday, September 26, 2003 12:30 PM To: Mike Tomasura Subject: Re: FW: e-bay I presume you've figured out that the link goes to e1bay.com, not ebay. It's a fraud. -jbn On Friday, September 26, 2003, at 12:25 PM, Mike Tomasura wrote: > > >> I guess e-bay had some problems? A few users got this message from >> them. >> >> Dear eBay user! >> >> At 09.24.2003 our company has lost a number >> of accounts in the system during the database >> maintenance. If you have an active account, please >> click on the link below to update your credit card >> information. If you have problems with your account, please let us >> know >> at email support(a)ebay.com <mailto:support@ebay.com> >> >> https://cgi.ebay.com/saw-cgi/eBayISAPI.dll?UpdateInformation >> <https://e%31bay.com/saw-cgi/?UpdateInformation> >> >> >> >> > >

1 0

FW: e-bay
by Mike Tomasura 26 Sep '03

26 Sep '03

> I guess e-bay had some problems? A few users got this message from them. > > Dear eBay user! > > At 09.24.2003 our company has lost a number > of accounts in the system during the database > maintenance. If you have an active account, please > click on the link below to update your credit card > information. If you have problems with your account, please let us know > at email support(a)ebay.com <mailto:support@ebay.com> > > https://cgi.ebay.com/saw-cgi/eBayISAPI.dll?UpdateInformation > <https://e%31bay.com/saw-cgi/?UpdateInformation> > > > >

4 3

Re: FW: e-bay
by Gregory Hicks 26 Sep '03

26 Sep '03

> From: Mike Tomasura <MTomasura(a)BradleyCaldwell.com> > To: nanog(a)merit.edu > Subject: FW: e-bay > Date: Fri, 26 Sep 2003 12:25:52 -0400 > > > > > I guess e-bay had some problems? A few users got this message from them. > > > > Dear eBay user! > > > > At 09.24.2003 our company has lost a number > > of accounts in the system during the database > > maintenance. If you have an active account, please > > click on the link below to update your credit card > > information. If you have problems with your account, please let us know > > at email support(a)ebay.com <mailto:support@ebay.com> Nope! It is a 'credit card harvesting scam'... (Or whatever the term dujour is today...) Good for identity theft purposes and for stealing credit card numbers to run up someone else's bill... I mean... Look at it: Poor grammar, poor punctuation, ... > > > > https://cgi.ebay.com/saw-cgi/eBayISAPI.dll?UpdateInformation > > <https://e%31bay.com/saw-cgi/?UpdateInformation> Also, if this is for real, it looks like eBay has bigger problems: Connection refused to both of these URLs. Regards, Gregory Hicks ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. Just because "We've always done it that way" is not necessarily a good reason to continue to do so... Grace Hopper, Rear Admiral, United States Navy

1 0

Detecting a non-existent domain
by Kee Hinckley 26 Sep '03

26 Sep '03

Getting practical for a minute. What is the optimal way now to see if a given host truly exists? Assume that I can't control the DNS server--I need to have this code run in any (*ix) environment. Assume also that I don't want to run around specialcasing specific IP addresses or TLDs--this needs to work reliably no matter what the domain. User gives me a string, and I need to see if the given host is a real machine. An answer from Verisign would be most appropriate here, since they have done "extensive research" on the impact of their new service, so presumably they figured out the answer to this problem and have code samples available for distribution. However I get the feeling from their press releases that they've forgotten there is more to the internet than just the web. -- Kee Hinckley http://www.messagefire.com/ Next Generation Spam Defense http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's.

7 12