- NANOG - lists.nanog.org

www.ebay.com down?
by Richard Gross 21 Aug '03

21 Aug '03

Have not been able to search for items on www.ebay.com since 8:55pm PDT 8/20/2003. Do you see the same thing? richg

4 3

[brian@linuxwidows.com: Re: HP Openview possibly affected by MSBlaster]
by Len Rose 21 Aug '03

21 Aug '03

----- Forwarded message from Brian Coyle <brian(a)linuxwidows.com> ----- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday 20 August 2003 20:03, Len Rose wrote: > http://hpat962.external.hp.com/blaster.jsp?print=1 We found blaster would tickle opcctla (listening on port 135) and trigger this Solaris rpcbind failure... http://www.sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50922&zone_32… The patch seems to have corrected the problem. [can you forward to nanog? I'm not sub'd to -post. THANX! ] - -- - -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GAT/CM$ d-@ s:++ a42 C+++$ ULSH++++$ P+>++ L++>+++ E- W++$ N+ w$ O- M- V Y+ PGP t@ 5+@ X+@ R- tv(-)@ b+++ DI++++ D+ e(+) h---- r+++ y++++ - -----END GEEK CODE BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) Comment: Brian Coyle, GCIA http://www.giac.org/GCIA.php iD8DBQE/RCHYER3MuHUncBsRAnRhAJ0emWoJk+3eQ3IiaC9+BuikJyx8fACeI5MR 3qx7yWJNRVhYm5d3WcPG8V4= =Srwc -----END PGP SIGNATURE----- ----- End forwarded message -----

1 0

Hijacked email
by Jack.W.Parks＠alltel.com 21 Aug '03

21 Aug '03

Anyone seeing hijacked email addresses with this Sobig-F worm? I did some research and I know I didn't send anything to Investec Bank of Johannesburg,ZA. On top of that, I definitely did not send a worm. Thoughts? Jack -----Original Message----- From: jlouw(a)investec.co.za [mailto:jlouw@investec.co.za] Sent: Wednesday, August 20, 2003 4:11 AM To: Parks, Jack W Cc: VMeetoo(a)investec.co.mu Subject: MailMarshal has detected a Virus in your message Investec content scanning has stopped the following message: Message: BB002e9963.00000001.mml From: Jack.W.Parks(a)alltel.com To: VMeetoo(a)investec.co.mu Subject: Thank you! Because it believes the message contains a virus. The virus scanning software used was: Sophos AntiVirus (SAVI2 Interface) Virus name: W32/Sobig-F Please clean the file and resend it. Rule: Inbound Messages : Block Virus

11 11

TNTs Rebooting, was RE: Weird network problems
by Ejay Hire 21 Aug '03

21 Aug '03

In a word, Yes. We've got two TNT's that have been rock-solid for over a year that have rebooted 6 times in two days. Any help at all would be most appreciated. Thanks in Advance, Ejay Hire -----Original Message----- From: Geo. [mailto:georger@getinfo.net] Sent: Wed 8/20/2003 3:45 PM To: nanog(a)merit.edu Cc: Subject: Weird network problems Is anyone out there tracking down some weird network behavior yesterday and today? I'm not talking about ping traffic from the worm or anything like that, I'm seeing TNT MAX boxes go unpingable, arp broadcast storms, one way traffic blocks on T1's between cisco routers, stuff that I have not been able to explain yet. Just wondering if it's only me seeing this or if others are working on the same sorts of issues. I heard a rumor that ICG was also experiencing some strange network problems so I figured it was time to post. Geo.

3 2

HP Openview possibly affected by MSBlaster
by Len Rose 21 Aug '03

21 Aug '03

http://hpat962.external.hp.com/blaster.jsp?print=1

1 0

Plano, TX Legacy: Fiber Provider or Wireless & Wireless question
by Brennan_Murphy＠NAI.com 20 Aug '03

20 Aug '03

Looking for any advice or pointers for obtaining multiple Gig links (last mile) in the Plano, TX area. The abundance of fiber options here seems to be decidedly underwhelming. Looking for suggestions including creative options such as wireless. I need to get from Plano to any closest better place for picking up multiple Gig Internet links. Wondering too what other large companies in this area have done for large internet links...any advice appreciated. Also, I'm reading now that more ISP's are using wireless for last mile provisioning on the new unlicensed frequencies. Was wondering if anyone had experience using Dragonwave or any similar wireless products in Texas. Do sandstorms and golf ball sized hail pose significant issues? Severe thunderstorms? Would like to chat with anyone with significant wireless experience in the Dallas area. WOuldnt mind speaking with an unfluffed sales person eitehr. :-)

3 2

RE: virus or hacked?
by Claire Kelly 20 Aug '03

20 Aug '03

How catty. We all start somewhere, or have you forgotten? Gruss + Cheers, Cade Kelly System/Network Administrator ECONnergy Co. Inc Spring Valley, NY -----Original Message----- From: Johannes Catterwell [mailto:johannes@catterwell.de] Sent: Wednesday, August 20, 2003 1:52 PM To: Chris Todd Cc: nanog(a)merit.edu Subject: Re: virus or hacked? Chris Todd schrieb: > > Thanks > Chris Todd > Computer Technician Computer Technician? you sure? -- Johannes Catterwell, | Did you ever wonder Darmstadt, Germany | ... why you have to click johannes at catterwell dot de | on "Start" to stop Windows?

8 7

RE: Navy Marine Corps Internet hit
by McBurnett, Jim 20 Aug '03

20 Aug '03

On Tue, 19 Aug 2003, Scott Weeks wrote: -> on the .pif, .scr, etc. attachments...) Maybe I was just lucky. Most -> likely, though, they did not create "security zones" to keep problems -> contained within certain network segments and not let them out to destroy -> other networks. -Luck is very important. -Like most other people I have no knowledge about how the Navy Marine -Internet works, but that won't stop me from commenting. -It sounds like a "turnkey" operation, with EDS managing everything. They -may have 100,000 users with identical configurations (software, patch -levels, etc) in one big flat network. A large homogeneous population is -vulnerable to a common infection. Nachia has a very effecient scanning -and infection process, particularly if your entire network uses RFC1918 -address space internally. As a former Marine, and IT support staff member.. The Military uses REAL WORLD IP's on ALL systems. I won't mention IP's. BUT they have all RW on every system. Not quite a flat net either... It is rather a unique system, to say the least..... J

2 1

Re: Navy Marine Corps Internet hit
by vern＠ee.lbl.gov 20 Aug '03

20 Aug '03

> Obviously they didn't filter 135, 137-139, 445, and 4444 inbound Not obvious. I know of several sites that were infected even though they had filters in place, due to infected laptops being brought on-site. Vern

4 4

OT but, OKc ISP?
by Scott Granados 20 Aug '03

20 Aug '03

Looking for someone who can provide dialup access while I'm traveling in OKC and the surrounding areas. Didn't want to end up with an AOL or something so if someone is providing services in the area and would contact me off list that would be great. Thanks!

1 0