- NANOG - lists.nanog.org

RE: Sobig.f surprise attack today
by Dr. Jeffrey Race 22 Aug '03

22 Aug '03

On Fri, 22 Aug 2003 14:13:27 -0400, Todd Mitchell - lists wrote: >See the following message sent out by X-Force a few hours ago.>Todd >Computers infected with the Sobig.F worm are programmed >to automatically download an executable of unknown function >from a hard-coded list of servers at 19:00 UTC (3:00pm EDT) >X-Force is recommending wholesale outbound filtering of >the following IP addresses: > >67.73.21.6 >68.38.159.161 >67.9.241.67 >66.131.207.81 >65.177.240.194 >65.93.81.59 >65.95.193.138 >65.92.186.145 >63.250.82.87 >65.92.80.218 >61.38.187.59 >24.210.182.156 >24.202.91.43 >24.206.75.137 >24.197.143.132 >12.158.102.205 >24.33.66.38 >218.147.164.29 >12.232.104.221 >68.50.208.96 Roadrunner IIII Comcast II Sprint I Dacom I Earthlink I Le Groupe Videotron II Bell Canada IIIII Net 66 II Charter I ATT Worldnet II

1 0

Barn fire leads to telephone disruption
by Sean Donelan 22 Aug '03

22 Aug '03

MADISONVILLE, Ky. (AP) -- Long-distance telephone service was knocked out for more than eight hours across parts of the region Wednesday after a barn fire burned a telephone cable. The barn 15 miles north of Madisonville caught fire about 4 a.m. CDT, and the flames severed a nearby cable owned by Kentucky Data Link that carries AT&T calls, said AT&T spokesman Dave Johnson of Bedminster, N.J.

1 0

Navy Marin Corps Intranet back online (EDS says it was never offline)
by Sean Donelan 22 Aug '03

22 Aug '03

Navy officials announced By this afternoon, Lt. Elissa Smith, a Navy spokeswoman, said, nearly all of "the network has been restored to full functionality. http://www.gcn.com/vol1_no1/daily-updates/23235-1.html On the other hand, Electronic Data Systems (EDS) yesterday said the NMCI network was never down. Kevin Clarke, a spokesman for Plano, Texas-based EDS, said early characterizations of the N/MCI "being down or broken [were] not accurate." http://www.computerworld.com/securitytopics/security/story/0,10801,84158,00…

1 0

SBC Internet ops?
by just me 22 Aug '03

22 Aug '03

If anyone from SBCi ops is on the list, please give me a call. I have a client that's been dead in the water for 24 hours, who desperately needs some ICMP dropped on your side. Matt Ghali (650) 704-2964 --mghali(a)snark.net------------------------------------------<darwin>< Flowers on the razor wire/I know you're here/We are few/And far between/I was thinking about her skin/Love is a many splintered thing/Don't be afraid now/Just walk on in. #include <disclaim.h>

1 1

Re: TNTs Rebooting, was RE: Weird network problems
by Geo. 22 Aug '03

22 Aug '03

> > "...an intermittent problem that has been discovered to be affecting a > > specific type of network card used by some of the NAS devices that > > populate our network. The problem is exacerbated by the blaster worm and > > has been replicated by Lucent, our vendor and others. In order to resolve > > the issue, we are working with Lucent to test and deploy an emergency > > updated version of software to the affected NAS devices." Has anyone gotten a patch from Lucent yet for the Max TNT's? I need something, I've got a bunch of these and when a customer on the TNT has the worm the ping packets coming from his dialup are causing the TNT to crash. Even a way to filter within the TNT would be useful if anyone has any ideas on that. I've already placed filters in my cisco routers for the 92 byte pings but that doesn't stop the ones that originate with the dialup user from crashing the TNT. Geo.

2 1

real _their own_ dark fiber into 401
by alex＠yuriev.com 21 Aug '03

21 Aug '03

Hello, If anyone knows of companies that have their own[1], real[2] dark fiber going into 401 North Broad in Philadephia, I would grealy appreciate hearing about it. Sales people from transport companies are welcome to do the same as long as they know the meaning [1] and [2] or can provide the path information. Thanks, Alex [1] Fiber that the company physically owns, not leases from another source, which happen to lease it from another source in exchange for some other fiber somewhere else where all the fiber in reality travels the same 4" pipe for 90% of the way. [2] Real fiber (as opposite to 'marketing' fiber) is the fiber that actually exists at the present time outside of the pretty fiber maps that the company's are touting, not the fiber that may or may not exist and may or may not be there in 90 days depending on the amount of money that the customer is willing to pay, or bankruptcy of the fiber provider.

1 0

Email virus protection
by Christopher J. Wolff 21 Aug '03

21 Aug '03

Hello, What is the most common method for providing virus protection for your hosted email customers? Thank you in advance. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

21 35

Sobig / MSBlast on Steroids
by J. Oquendo 21 Aug '03

21 Aug '03

I would post the entire write up but it's rather long. To sum it up though, I did a quick rant on what would or could happen should a virii author dig deep down and formulate a polymorphic virus/worm that attacked routers via BGP/OSPF/ICMP ... Just me mumbling on but someone on the list may find the write up infor- mative. http://www.politrix.org/rants.html ================================================= J. Oquendo rsvp: segment ... disgraced . org rsvp: segment ... antioffline . com PGP Fingerprint 39A7 24C6 A9A0 6C67 96CA 0302 F1D3 2420 851E E3D0 http://www.politrix.org http://www.antioffline.com ================================================= -- __________________________________________________________ Sign-up for your own personalized E-mail at Mail.com http://www.mail.com/?sr=signup CareerBuilder.com has over 400,000 jobs. Be smarter about your job search http://corp.mail.com/careers

1 0

RE: To send or not to send 'virus in email' notifications?
by Stewart, William C (Bill), RTSLS 21 Aug '03

21 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The right answer for the original question is probably "Buy an email server package with virus scanning hooks" or "Get a virus scanner with sendmail milter hooks" rather than specific details of how to set it... The suggestion to do virus filtering during the message transfer stage rather than the delivery stage is good. It looks like sendmail milters can be tweaked to do this, though unless they can recognize the virus from the mail headers, they have to wait until the end-of-message hook to do it, i.e. after the whole virus has been transferred but before the message acceptance codes get transferred. It's too bad that it's difficult to send a reject code and continue a teergrube at the same time. For virus scanners that run at other stages in the delivery process, the right decision about whether to do a notification or not is virus-dependent, if your anti-virus package supports it. Sobig almost always forges sender addresses, so it shouldn't get a reply, but some other viruses don't forge the sender, and should get the reply. Limiting the responses to once a week per sender or whatever may help, but only if the same sender gets forged a lot. Yet another reason to cryptographically sign your outgoing mail, not that I usually do so or that most people or mail clients check. Thanks; Bill Stewart -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> Comment: PGP Freeware 703 iQA/AwUBP0QHO7JBeu7P+eyUEQK4xACgwIEKFP47bIyOZ3ABzm5fxm8AsyQAoI8L mnmDP9h63r+REIlTzTBdltSM =8pMy -----END PGP SIGNATURE-----

5 4

Re: Weird network problems
by Andy Walden 21 Aug '03

21 Aug '03

> Is anyone out there tracking down some weird network behavior yesterday > and today? I'm not talking about ping traffic from the worm or anything > like that, I'm seeing TNT MAX boxes go unpingable, arp broadcast storms, > one way traffic blocks on T1's between cisco routers, stuff that I have > not been able to explain yet. I'm seeing the exact same issues with the TNTs and am in the process of trying to track down exactly what is causing it. So far no pattern has emerged. andy -- PGP Key Available at http://www.tigerteam.net/andy/pgp

2 1