- NANOG - lists.nanog.org

Cisco IOS Failure due to Virus
by Richard J.Sears 12 Sep '03

12 Sep '03

Hey Everyone - We have two 7507 routers configured with dual RSP4s w/256MB RAM, VIP2-50s with 128/8MB RAM, Gig, POSIP OC3 and Fast Ethernet interfaces. These routers have run flawlessly for over two years now. But about two weeks ago, all of a sudden we started having serious crashing problems with these two routers. The routers will lose bgp connectivity (one at a time) to our upstreams (configured on each router). First, we would see a keepalive not sent message, then a bgp hold timer expire, then the bgp peering session would go down. OSPF would start crashing, then we would see the memory error messages, then all interfaces would blink off-line. (Note - we are running the max memory we can on both the RSPs and the VIPs). Within 1 minute, the exact same thing would happen to the other router. Often times we would have to reboot the router to get it to come back online. We would see the following errors and have to reboot multiple times to get the router back: %SYS-2-MALLOCFAIL: Memory allocation of 704 bytes failed from 0x60329F00, alignment 0 Pool: Processor Free: 92744 Cause: Memory fragmentation Alternate Pool: None Free: 0 Cause: No Alternate pool -Process= "Pool Manager", ipl= 0, pid= 6 -Traceback= 6038049C 60382200 60329F08 6038DEDC %TCP-6-NOBUFF: TTY0, no buffer available -Process= "BGP Router", ipl= 0, pid= 132 %% Low on memory; try again later GigabitEthernet1/1/0: keepalive not sent We are running the latest S train IOS patched for the IPV4 issue - however downgrading to the code we had run for the previous year did not solve the problem, nor did replacing the RSPs, VIPs and interfaces with new cards. In addition, we have complied with the Cisco recommendations for mitigating the effects of the Nachi Worm. http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note0918… We also shut down one of the routers totally and the other router still experienced the same issue. None of these updates or fixes have solved the problem. I am thinking it may have something to do with all the virus stuff running around (same thing was crashing my Lucent TNT's), but I cannot seem to get an answer from Cisco, nor can I find anyone seeing the same issues. Hopefully someone here can shed some light on this problem. Thanks in Advance Richard I fly because it releases my mind from the tyranny of petty things . .

7 9

The Cidr Report
by cidr-report＠potaroo.net 12 Sep '03

12 Sep '03

This report has been generated at Fri Sep 12 21:48:00 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 05-09-03 124403 88573 06-09-03 124437 88448 07-09-03 124343 88533 08-09-03 124412 88539 09-09-03 124411 88684 10-09-03 124489 88653 11-09-03 124436 88752 12-09-03 124543 88716 AS Summary 15758 Number of ASes in routing system 6223 Number of ASes announcing only one prefix 1470 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73289728 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 12Sep03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 124557 88740 35817 28.8% All ASes AS4323 633 183 450 71.1% TW-COMM Time Warner Communications, Inc. AS701 1470 1026 444 30.2% ALTERNET-AS UUNET Technologies, Inc. AS7018 1390 979 411 29.6% ATT-INTERNET4 AT&T WorldNet Services AS7843 536 148 388 72.4% ADELPHIA-AS Adelphia Corp. AS3908 909 535 374 41.1% SUPERNETASBLK SuperNet, Inc. AS6197 613 283 330 53.8% BATI-ATL BellSouth Network Solutions, Inc AS6198 493 207 286 58.0% BATI-MIA BellSouth Network Solutions, Inc AS4355 392 109 283 72.2% ERMS-EARTHLNK EARTHLINK, INC AS1221 979 698 281 28.7% ASN-TELSTRA Telstra Pty Ltd AS6347 349 92 257 73.6% DIAMOND SAVVIS Communications Corporation AS1239 913 659 254 27.8% SPRINTLINK Sprint AS27364 318 68 250 78.6% ACS-INTERNET Armstrong Cable Services AS17676 259 28 231 89.2% GIGAINFRA Softbank BB Corp. AS22773 257 26 231 89.9% CCINET-2 Cox Communications Inc. Atlanta AS25844 241 14 227 94.2% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS209 509 296 213 41.8% ASN-QWEST Qwest AS6140 336 136 200 59.5% IMPSAT-USA ImpSat AS4134 317 119 198 62.5% CHINANET-BACKBONE No.31,Jin-rong Street AS11305 230 38 192 83.5% INTERLAND-NET1 Interland Incorporated AS4519 178 4 174 97.8% MAAS Maas Communications AS6327 200 26 174 87.0% SHAW Shaw Communications Inc. AS2386 374 202 172 46.0% INS-AS AT&T Data Communications Services AS2048 255 87 168 65.9% LANET-1 State of Louisiana AS17557 305 137 168 55.1% PKTELECOM-AS-AP Pakistan Telecom AS14654 167 2 165 98.8% WAYPORT Wayport AS705 416 253 163 39.2% ALTERNET-AS UUNET Technologies, Inc. AS5786 165 5 160 97.0% UPRENET University of Puerto Rico AS9800 202 51 151 74.8% UNICOM CHINA UNICOM AS3602 234 85 149 63.7% SPRINT-CA-AS Sprint Canada Inc. AS20115 484 336 148 30.6% CHARTER-NET-HKY-NC Charter Communications Total 14124 6832 7292 51.6% Top 30 total Possible Bogus Routes 24.119.0.0/16 AS11492 CABLEONE CABLE ONE 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.30.64.0/19 AS14900 USLEC-CORP-1 USLEC Corp. 66.41.192.0/18 AS13367 ATT-BBND-B AT&T Broadband 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.143.2.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 140.240.0.0/13 AS1 GNTY-1 Genuity 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 165.212.0.0/16 AS7424 USANET USA.Net 166.16.0.0/16 AS7132 SBIS-AS SBC Internet Services - Southwest 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 ALTERNET-AS UUNET Technologies, Inc. 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.88.99.0/24 AS3246 SONGNETWORKS Song Networks 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 AS719 LANLINK autonomous system 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.136.0/21 AS568 SUMNET-AS DISO-UNRRA 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.98.8.0/21 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.79.32.0/20 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.166.18.0/24 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 202.0.180.0/24 AS4058 APNIC-4058 Asia Pacific Network Information Centre 202.3.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.145.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.146.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.152.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.155.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.156.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.157.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.4.252.0/22 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.44.112.0/20 AS17458 CWNETDG-IO-AP Cable and Wireless 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.93.64.0/19 AS9425 I-NEXT-AS-AP Inter.net Philippines border AS 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.136.254.0/23 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.142.130.0/23 AS17820 DIL-AP DIRECT INTERNET LTD. 202.142.132.0/22 AS17820 DIL-AP DIRECT INTERNET LTD. 202.143.48.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.143.56.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.148.192.0/20 AS9942 COMINDICO-AP COMindico Australia 202.148.208.0/21 AS9942 COMINDICO-AP COMindico Australia 202.148.216.0/22 AS9942 COMINDICO-AP COMindico Australia 202.148.220.0/23 AS9942 COMINDICO-AP COMindico Australia 202.148.222.0/24 AS9942 COMINDICO-AP COMindico Australia 202.161.0.0/19 AS10097 FLOWCOM flow communications level 2 541 kent st sydney nsw 2000 202.161.8.0/21 AS4634 -No Whois Entry- 202.164.192.0/19 AS7599 IPXC-AS-AP IP Exchange 202.165.0.0/19 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.179.64.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.65.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.66.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.67.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.68.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.189.234.0/23 AS9658 ETPI-IDS-AS-AP Eastern Telecoms Phils., Inc. 203.10.17.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.18.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.19.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.20.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.21.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.22.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.23.0/24 AS9266 VIPER-AU-AP Vipernet 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.86.2.0/23 AS4058 APNIC-4058 Asia Pacific Network Information Centre 203.90.192.0/20 AS9658 ETPI-IDS-AS-AP Eastern Telecoms Phils., Inc. 203.129.126.0/24 AS7473 SINGTEL-AS-AP Singapore Telecom 203.129.127.0/24 AS7473 SINGTEL-AS-AP Singapore Telecom 203.132.95.0/24 AS9787 CONCEPT-AU-AP Concept Networks 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.99.0/24 AS7657 TIG-US-PAS-AP The Internet Group Limited 203.132.102.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.103.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.104.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.105.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.106.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.109.0/24 AS10141 CALOUNDRA-AS-AP Caloundra.net 203.132.110.0/24 AS7598 ALPHALINK-AS-AP Alphalink Pty Limited - Melbourne, Australia 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.112.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 203.135.224.0/19 AS4058 APNIC-4058 Asia Pacific Network Information Centre 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.29.189.0/24 AS3956 TX-METRO Texas Metronet 204.52.232.0/24 AS7177 DFWNET DFW Internet Services, Inc. 204.89.225.0/24 AS2495 KANREN Kansas Research and Education Network 204.194.110.0/23 AS10588 ICSNET Intelligent Computer Solutions, Inc 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.82.64.0/18 AS7029 ALLTELNET Alltel Information Services, Inc. 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.65.232.0/23 AS701 ALTERNET-AS UUNET Technologies, Inc. 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 208.104.103.0/24 AS1239 SPRINTLINK Sprint 209.139.192.0/19 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 209.139.224.0/19 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 209.139.252.0/23 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 209.151.128.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.160.0/19 AS4355 ERMS-EARTHLNK EARTHLINK, INC 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 TELEGLOBE-AS Teleglobe Inc 211.27.156.0/24 AS9768 PUBNET1-AS KT 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.47.32.0/19 AS11304 SPLUS Solutions Plus Inc. 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 216.153.0.0/17 AS6203 ISDN-NET ISDN-Net Inc. 216.226.108.0/22 AS3602 SPRINT-CA-AS Sprint Canada Inc. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

GBLX contact?
by Ray Bellis 12 Sep '03

12 Sep '03

If there's anyone high level at GBLX on list at the moment could they please contact me urgently regarding a major security incident. thanks, Ray -- Ray Bellis, MA(Oxon) - Technical Director community internet plc - ts.com Ltd Windsor House, 12 High Street, Kidlington, Oxford, OX5 2PJ tel: +44 1865 856000 email: ray.bellis(a)community.net.uk fax: +44 1865 856001 web: http://www.community.net.uk/

1 1

mpls provisioning
by Scylla Malengase 12 Sep '03

12 Sep '03

hello, i am interested in peoples recommendations for mpls vpn and te provisioning tools. whatever it is it must support or be extendable to support cisco and juniper hardware and software. i'm particularly interested in home-grown and publicly available tools, especially open source. i'd be quietly keen on doing some tinkering of my own at some stage, but i'd rather work on an established project if one exists. scylla

1 0

RE: Alert to Phone/Pager System
by kwallace＠pcconnection.com 12 Sep '03

12 Sep '03

you may want to check out DPS's IAM product. We use it and it's been reliable. They have also been willing to customize things for us in the past- http://dpstele.com/ Regards, Keith -----Original Message----- From: Allan Liska [mailto:allan@allan.org] Sent: Thursday, September 11, 2003 5:46 PM To: nanog(a)merit.edu Subject: Alert to Phone/Pager System I am looking for a hardware/software solution to a problem and I am hoping someone has implemented something similar: A monitoring system notices an error and sends an alert to a system (the alert can be sent over POTS or SMTP). The system recevies the alert and sends out a message (Pager/POTS/SMTP/SMS) to a group of people in a pager rotation. The 1st person is paged, if no response is received the second person is paged and so on down the line until someone responds. I looked at the Dialogic's The Communicator: http://www.dccusa.com/products.html But, it is a little pricey. I also looked at VOCP System: http://www.vocpsystem.com/ But, the desision maker is a little skittish about open source projects. Does anyone know of a happy medium between these two systems that will fill the requirements outlined above? Thanks! allan -- Allan Liska allan(a)allan.org http://www.allan.org

1 0

RE: ISS X-Force MS03-039 Free Scanner
by Ingevaldson, Dan (ISS Atlanta) 11 Sep '03

11 Sep '03

We have just released a new version of the scanner that has addressed some reporting inaccuracies. We have also included a MD5 checksum. It is available here: http://www.iss.net/support/product_utilities/Xfrpcss.php Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Ingevaldson, Dan (ISS Atlanta) Sent: Thursday, September 11, 2003 7:54 AM To: first-teams(a)first.org; nanog(a)merit.edu Subject: ISS X-Force MS03-039 Free Scanner Please see our X-Force Alert for more information about the new set of MSRPC issues. We have published a free CLI tool to scan for computers vulnerable to MS03-039. X-Force Alert: http://xforce.iss.net/xforce/alerts/id/152 Free Scanner: http://www.iss.net/support/product_utilities/Xfrpcss.php Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+ This message was posted through the FIRST mailing list server. Contact your team's FIRST representative to (un)subscribe, DO NOT REDISTRIBUTE BEYOND MEMBERS OF FIRST TEAMS UNLESS THE AUTHOR OF THIS MESSAGE GRANTS EXPRESS PERMISSION TO REDISTRIBUTE -+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+

1 0

Re[2]: Alert to Phone/Pager System
by Allan Liska 11 Sep '03

11 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 Hello Jeffrey, Thursday, September 11, 2003, 5:50:40 PM, you wrote: JM> I may be missing something, but don't monitoring systems (ie, Nagios) JM> have the built-in ability to send out pages w/ a locally attached modem, JM> or SMS (if you setup an email forwarder). In this case the monitoring system in place, which cannot be changed, can send out an alert, but only to a single source. The current system does not have the ability to handle the additional rotation capabilities needed for this project. Thanks for all the responses I have gotten so far. allan - -- Allan Liska allan(a)allan.org http://www.allan.org http://www.hosthideout.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUAP2D6Yikg6TAvIBeFAQEcxQP/SwPCAX9yeCWxUDml4si5CA4hR5SmDmMW 0w2x4GX20/Nh4Nc4rYJW1oqrWLw0Mw+fy5oPSht7IcJqzTPCJNKHvW72+Yx20nLt I10uGQ6iP/ldhdqV20vJ1d5XbU5n/3Iwq+OpaQPE8E6P8CPkFaMr79yk+vl/1TFO xn2tLDrEJ+M= =9V+V -----END PGP SIGNATURE-----

1 0

157.112.0.0/16 ARIN info updated, AT&T still announcing /16
by Kai Schlichting 11 Sep '03

11 Sep '03

>From the [Hijacked] list: > The ARIN information has been updated to have up-to-date contact info for > the original owner, the original owners' ISP is announcing 4 /18s but AT&T > is still announcing 157.112.0.0/16. Can whoever's been bugging AT&T to stop > announcing it to bug them some more? abuse(a)att.net seems to be a dead horse - demands from numerous parties, including the owner of this /16 (the true source of records is JPNIC: whois -h whois.nic.ad.jp "157.112.0.0 /e" , ARIN has not proceeded with 'early registration' transfer of this group of records to JPNIC, it seems) that have been mailed there and to various other @att.net addresses, including their so-called "legal demands center" (that is reportedly hard to reach via email) have been summarily ignored, and we mean "/dev/null'd". AT&T, for lack of presenting any TRO forcing them to keep routing this, appears to willingly conspire with the Empire Towers IP space hijackers while presented with overwhelming evidence that whatever forged documents Empire Towers and Thomas Cowles may have presented to them are indeed that - forged. ARIN zapping the legacy record for this block apparently isn't convincing enough for them to stop announcing this route. The ISP for Systems Clipper Inc. (AS 23720) had started announcing a competing /16 almost 2 weeks ago, but for reasons obvious to nearly all members of this list, that of course wasn't good enough: it's four /18's now, and AT&T should be seeing none of the traffic just about now. If you are peering with AS 7018, a nicely worded email to your peering contacts expressing your concern with AT&T's non-existent cooperation in IP space hijacking cases would be appreciated. Thank you. bye,Kai ps: and this says nothing about the amount and nature of actual abuse that's been reported from this /16 while it originated from AS 7018.

6 5

ISS X-Force MS03-039 Free Scanner
by Ingevaldson, Dan (ISS Atlanta) 11 Sep '03

11 Sep '03

Please see our X-Force Alert for more information about the new set of MSRPC issues. We have published a free CLI tool to scan for computers vulnerable to MS03-039. X-Force Alert: http://xforce.iss.net/xforce/alerts/id/152 Free Scanner: http://www.iss.net/support/product_utilities/Xfrpcss.php Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net ===============================

1 0

Migrating DSL Agg from Redback to Cisco
by Nick A Montante 11 Sep '03

11 Sep '03

Hello all- We are trying to move all of our DSL aggregation off of a Redback SMS1000 to a Cisco 7513. We are using the PA-A3-T3 card on the Cisco to talk to our DSL subscribers. We are currently running rfc1483 routed and bridged customers on the same ATM DS3 on the Redback. We're trying to figure out how to convert the config from the Redback to a Cisco config with no luck as of yet. Does anyone have a sample Cisco config for rfc1483 routed and bridged subs? TIA

1 0