- NANOG - lists.nanog.org

RE: some wide-scale airline reservations issue
by Mark Segal 19 Aug '03

19 Aug '03

I heard.. (via CBC I think).. That their computer system in Toronto crashed during the power outage.. My guess is they have some serious problem with their DB. I just booked a ticket.. Hopefully I am going somewhere. :) Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Joe Abley [mailto:jabley@isc.org] Sent: August 19, 2003 3:40 PM To: nanog(a)nanog.org Subject: some wide-scale airline reservations issue I'm sitting on the tarmac on AC63 from YVR to ICN which was due to take off about half an hour ago. So far they have about a quarter of the plane loaded. The problem I am hearing is that there's a system-wide network issue with Air Canada, and other airlines as well: "apparently everybody" is the uninformed opinion here in the J class cabin. Fingers are vaguely being pointed at "Bell" and "Telus" (depending on which coast people are from). Since all computer systems are unavailable, all passengers and all bags are having to be checked by hand. They just gave up trying to allocate seats, and are about to start "open boarding". Excuse me while I hold on to my seat. The consistent component of the ongoing rumour mill is that this is due to "some computer virus". Anyway, irritating vague rumours aside, here's some operational content: if you're waiting for parts, spares or staff to arrive by plane from somewhere, and especially if the flight is not direct, be prepared for delays. Joe

2 1

Fwd: Re: Virus emails from nanog mail list
by David Diaz 19 Aug '03

19 Aug '03

Forwarding this for Mark, he deserved some credit for verifying the IP but did not want his other addy harvested. It's like you need a wing man now for posting to mail lists! Cougar >Subject: Re: Virus emails from nanog mail list >From: "Mark J. Scheller" >To: David Diaz <techlist(a)smoton.net> >Date: Tue, 19 Aug 2003 13:21:55 -0400 >X-MailScanner-Information: Please contact the ISP for more information >X-MailScanner: Found to be clean > >On Tue, 2003-08-19 at 12:42, David Diaz wrote: >> Spam may be off topic but in this case relevant. Has anyone else >> noticed bounced emails that appear to have origionated from their >> nanog email boxes and contain viruses? >> >> Obviously some bot has gone threw the nanog list and is now forging >> headers such that they appear to come from those addresses, and they >> are attaching viruses. >> >> The IP address (which may or may not be accurate) appears to be >> [195.157.87.253]. >> >> Has anyone else noticed this recently? > >Earlier today I received 2 bounce messages from AOL stating they were >not delivered due to a virus and originated from that very IP! So >you're not alone and/or imagining things.... thanks for mentioning its >harvesting source. > >mS (mjs(a)yoink.net) >

1 0

RE: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?)
by Mark Segal 19 Aug '03

19 Aug '03

<Snip> UPDATED: The Nachi worm will infect vulnerable Windows XP and 2000 machines using the same exploit used by the MS Blast worm family. The main difference between Nachi and MS Blast, is that Nachi will remove and disable MS Blast infections that it encounters, and download and install the correct MSRPC DCOM patch from Microsoft. This action will permanently close the MSRPC DCOM vulnerability. The Nachi worm will not patch the WebDAV vulnerability on Windows 2000 Servers. </snip> Patches DCOM and removes MBLAST.. Why doesn't Microsoft release this, or did they? :). mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Ingevaldson, Dan (ISS Atlanta) [mailto:dsi@iss.net] Sent: August 19, 2003 12:30 PM To: Paul Jasa; nanog(a)merit.edu Subject: RE: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?) The "Nachi" worm propagates via MSRPC DCOM and the IIS WebDAV bug. It may be causing this storm because it runs 300 scanning threads, and it pings each IP first. http://xforce.iss.net/xforce/alerts/id/150 MS Blast wasn't multithreaded. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Paul Jasa [mailto:pjasa@univision.net] Sent: Tuesday, August 19, 2003 12:19 PM To: nanog(a)merit.edu Subject: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?) A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking ICMP in order to deal with an undefined emergency. Nothing posted on their site, nor any other info is available. If anyone has info related to this "icmp outage", please advise. Thanks! pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Sean Crandall [mailto:sean@megapath.net] Sent: Tuesday, August 19, 2003 02:12 AM To: Paul Jasa; nanog(a)merit.edu Subject: RE: AT&T US Network Slowdown? Importance: High > > Dear Nanogers, > Is anyone aware of a "slowdown" issue throughout the US AT&T network > since 8/18 at around 4pm which is causing a lot of internet circuits > (including DSL) to be inaccessible and/or appear down from the outside > world? AT&T says this has been escalated to "Level 4" with no ETA and > affecting the whole country. I am seeing this problem in the San > Francisco area. Just wondering if anyone else is experiencing > anything that would confirm AT&T's claim, and fishing for more info > about the possible cause and ETA. Thanks! We are currently seeing the slowdown on our network in San Jose. Started about exactly the time frame that you mentioned. The rest of the country (oddly) seems unaffected by this at the moment, but San Jose is getting hammered by something. Still trying to sort out exactly where it is coming from. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA 94588 (925) 201-2530

1 0

RE: Virus emails from nanog mail list
by Dan Lockwood 19 Aug '03

19 Aug '03

I have not seen the NANOG email problem, but have received several tens of thousans of SPAM messages that claim to be from 'webmaster(a)apnic.net'. The originating address in the messages is 66.218.66.70. As David pointed out, this may or may not be correct. Dan -----Original Message----- From: David Diaz [mailto:techlist@smoton.net] Sent: Tuesday, August 19, 2003 9:43 To: nanog(a)merit.edu Subject: Virus emails from nanog mail list Spam may be off topic but in this case relevant. Has anyone else noticed bounced emails that appear to have origionated from their nanog email boxes and contain viruses? Obviously some bot has gone threw the nanog list and is now forging headers such that they appear to come from those addresses, and they are attaching viruses. The IP address (which may or may not be accurate) appears to be [195.157.87.253]. Has anyone else noticed this recently? Dave -- David Diaz dave(a)smoton.net [Email] pagedave(a)smoton.net [Pager] www.smoton.net Smotons (Smart Photons) trump dumb photons

1 0

Re: Details
by CERT(R) Coordination Center 19 Aug '03

19 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- *************************************************************************** [NOTE -- THIS IS AN AUTOMATED RESPONSE] Thank you for contacting the CERT(R) Coordination Center. We appreciate your contacting us and consider your communications with us to be very important. Because we focus our response efforts to have the greatest impact on the Internet community, we may be unable to provide you with a personal response to your message. Please review the pointers contained in this message for information which may be of immediate use to you. Section A - CERT/CC Current Activity Section B - Incident Reporting Information Section C - Vulnerability Reporting Information If you need additional information from the CERT/CC, we encourage you to begin by looking at our list of CERT/CC Frequently Asked Questions: http://www.cert.org/faq/cert_faq.html ====================================================================== Section A - CERT/CC Current Activity The CERT/CC Current Activity web page provides a summary list of the most frequent types of incident and vulnerability activity currently being reported to the CERT/CC. Please refer to this regularly updated page to obtain immediate assistance in response to frequently reported activity: http://www.cert.org/current/current_activity.html In addition, the latest CERT/CC documents can be found at: * CERT Advisories - http://www.cert.org/advisories/ * CERT Incident Notes - http://www.cert.org/incident_notes/ * CERT Vulnerability Notes - http://www.kb.cert.org/vuls/ * CERT Summaries - http://www.cert.org/summaries/ * CERT Tech Tips - http://www.cert.org/tech_tips/ * What's New - http://www.cert.org/nav/whatsnew.html * CERT/CC Web Site - http://www.cert.org/ For pointers to information about computer viruses and hoaxes, please see: * http://www.cert.org/other_sources/viruses.html ====================================================================== Section B - Incident Reporting Information We appreciate receiving incident reports because it helps us to gain a better understanding of ongoing intruder activities and attack profiles. From the information we receive, we are able to identify and address critical security issues within the Internet community. Because we prioritize our response efforts to have the greatest impact on the Internet community, we are not be able to provide everyone with a personal response. For general information about reporting incidents to the CERT/CC, please see our Incident Reporting Guidelines at: http://www.cert.org/tech_tips/incident_reporting.html To report incidents to the CERT/CC, please send information about the incident in plain text format to cert(a)cert.org. You may wish to use our Incident Reporting Form, located at: http://www.cert.org/reporting/incident_form.txt The CERT/CC considers the following types of incidents to be emergencies: * possible life-threatening activity * attacks on the Internet infrastructure, such as: - root name servers - domain name servers - major archive sites - network access points (NAPs) * widespread automated attacks against Internet sites * new types of attacks or new vulnerabilities If you are reporting such an emergency outside our operational hours - business days between 08:00-17:00 EST/EDT (GMT-5/GMT-4) and require immediate assistance, then please call the CERT hotline: +1 412 268 7090 If you believe the intruder activity is a threat to people's lives or to the Internet infrastructure, please contact us immediately. ====================================================================== Section C - Vulnerability Reporting Information If you would like to report a new type of vulnerability or tool being used by the intruder community, we would be interested in any details that you may have. If you are able, please include any or all of source code, log files of execution, and descriptions of operating dependencies. Please feel free to submit these details in ASCII format files (where possible) of your own design, or if you prefer to use a form, please see the file: http://www.cert.org/reporting/vulnerability_form.txt Please also encrypt the report using PGP if you are able to do so. Instructions are given at the top of the reporting form. Our vulnerability disclosure policy is available at http://www.kb.cert.org/vuls/html/disclosure ====================================================================== CERT(R) Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA USA 15213-3890 Internet e-mail: cert(a)cert.org (monitored during business hours) Telephone: +1-412-268-7090 24-hour hotline CERT Coordination Center personnel answer business days 08:00-17:00 EST/EDT (GMT-5)/(GMT-4), on call for emergencies during other hours. Fax: +1-412-268-6989 CERT and CERT Coordination Center are registered in U.S. Patent and Trademark Office. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8 iQCVAwUBPj72n2jtSoHZUTs5AQH8ogQAnuO94fFwfsCRDZ3Ug5G9jB53pLcMW6GW p0m1kgZfCvcKNze3De3d3VLPw9SwRdOkexg9mPuql7WRM78ySNYtqyN9G2vQjtmz EoOhSrPFmKpFI5+wrf5NzQzGre3x7Tk68UVKI3SpCDf0yLlc71urQ0f5QNeRRRrM ClWhCKv5uuA= =8mpq -----END PGP SIGNATURE-----

2 1

RE: AT&T Blocking ICMP
by Mike Tancsa 19 Aug '03

19 Aug '03

Are they blocking just icmp echo or everything ? ---Mike At 12:29 PM 19/08/2003 -0400, Ingevaldson, Dan (ISS Atlanta) wrote: >The "Nachi" worm propagates via MSRPC DCOM and the IIS WebDAV bug. It >may be causing this storm because it runs 300 scanning threads, and it >pings each IP first. > >http://xforce.iss.net/xforce/alerts/id/150 > >MS Blast wasn't multithreaded. > >Regards, >=============================== >Daniel Ingevaldson >Engineering Manager, X-Force R&D >dsi(a)iss.net >404-236-3160 > >Internet Security Systems, Inc. >The Power to Protect >http://www.iss.net >=============================== > > >-----Original Message----- >From: Paul Jasa [mailto:pjasa@univision.net] >Sent: Tuesday, August 19, 2003 12:19 PM >To: nanog(a)merit.edu >Subject: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?) > > > >A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking >ICMP in order to deal with an undefined emergency. Nothing posted on >their site, nor any other info is available. If anyone has info related >to this "icmp outage", please advise. Thanks! pj > >====================================== >Paul Jasa >Network Engineer >====================================== > > >-----Original Message----- >From: Sean Crandall [mailto:sean@megapath.net] >Sent: Tuesday, August 19, 2003 02:12 AM >To: Paul Jasa; nanog(a)merit.edu >Subject: RE: AT&T US Network Slowdown? >Importance: High > > > > > > Dear Nanogers, > > Is anyone aware of a "slowdown" issue throughout the US AT&T > > network since 8/18 at around 4pm which is causing a lot of > > internet circuits (including DSL) to be inaccessible and/or > > appear down from the outside world? AT&T says this has been > > escalated to "Level 4" with no ETA and affecting the whole > > country. I am seeing this problem in the San Francisco area. > > Just wondering if anyone else is experiencing anything that > > would confirm AT&T's claim, and fishing for more info about > > the possible cause and ETA. Thanks! > >We are currently seeing the slowdown on our network in San Jose. >Started about exactly the time frame that you mentioned. The rest of >the country >(oddly) seems unaffected by this at the moment, but San Jose is getting >hammered by something. > >Still trying to sort out exactly where it is coming from. > >-Sean > >Sean P. Crandall >VP Engineering Operations >MegaPath Networks Inc. >Pleasanton, CA 94588 >(925) 201-2530 >

1 0

AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?)
by Paul Jasa 19 Aug '03

19 Aug '03

A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking ICMP in order to deal with an undefined emergency. Nothing posted on their site, nor any other info is available. If anyone has info related to this "icmp outage", please advise. Thanks! pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Sean Crandall [mailto:sean@megapath.net] Sent: Tuesday, August 19, 2003 02:12 AM To: Paul Jasa; nanog(a)merit.edu Subject: RE: AT&T US Network Slowdown? Importance: High > > Dear Nanogers, > Is anyone aware of a "slowdown" issue throughout the US AT&T > network since 8/18 at around 4pm which is causing a lot of > internet circuits (including DSL) to be inaccessible and/or > appear down from the outside world? AT&T says this has been > escalated to "Level 4" with no ETA and affecting the whole > country. I am seeing this problem in the San Francisco area. > Just wondering if anyone else is experiencing anything that > would confirm AT&T's claim, and fishing for more info about > the possible cause and ETA. Thanks! We are currently seeing the slowdown on our network in San Jose. Started about exactly the time frame that you mentioned. The rest of the country (oddly) seems unaffected by this at the moment, but San Jose is getting hammered by something. Still trying to sort out exactly where it is coming from. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA 94588 (925) 201-2530

2 1

RE: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?)
by Ingevaldson, Dan (ISS Atlanta) 19 Aug '03

19 Aug '03

The "Nachi" worm propagates via MSRPC DCOM and the IIS WebDAV bug. It may be causing this storm because it runs 300 scanning threads, and it pings each IP first. http://xforce.iss.net/xforce/alerts/id/150 MS Blast wasn't multithreaded. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Paul Jasa [mailto:pjasa@univision.net] Sent: Tuesday, August 19, 2003 12:19 PM To: nanog(a)merit.edu Subject: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?) A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking ICMP in order to deal with an undefined emergency. Nothing posted on their site, nor any other info is available. If anyone has info related to this "icmp outage", please advise. Thanks! pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Sean Crandall [mailto:sean@megapath.net] Sent: Tuesday, August 19, 2003 02:12 AM To: Paul Jasa; nanog(a)merit.edu Subject: RE: AT&T US Network Slowdown? Importance: High > > Dear Nanogers, > Is anyone aware of a "slowdown" issue throughout the US AT&T > network since 8/18 at around 4pm which is causing a lot of > internet circuits (including DSL) to be inaccessible and/or > appear down from the outside world? AT&T says this has been > escalated to "Level 4" with no ETA and affecting the whole > country. I am seeing this problem in the San Francisco area. > Just wondering if anyone else is experiencing anything that > would confirm AT&T's claim, and fishing for more info about > the possible cause and ETA. Thanks! We are currently seeing the slowdown on our network in San Jose. Started about exactly the time frame that you mentioned. The rest of the country (oddly) seems unaffected by this at the moment, but San Jose is getting hammered by something. Still trying to sort out exactly where it is coming from. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA 94588 (925) 201-2530

1 0

Worldnet People on list?
by Drew Weaver 19 Aug '03

19 Aug '03

Any worldnet people on the list? It looks like they blacklisted one of my email servers and the reason: is truncated and I have no idea why, I've tried sending a bunch of email to them from another domain but I've been summarily ignored. Thanks, -Drew

1 0

RE: Natural Gas Generator manufacturer opinions? (might be off topic?)
by Bender, Andrew 19 Aug '03

19 Aug '03

Capstone and Ingersoll-Rand NG turbines seem to be in favor these days among the paranoid. http://www.capstoneturbine.com/ http://www.irpowerworks.com/ These may be up to 2x the cost of a diesel, but they run forever, you can put them anywhere, they always start, and the fuel never gets fouled. For installations large enough to care about tank pressure, heaters are an option, but then there's the question of how you power the heater... :) Regards, Andrew Bender taqua.com -----Original Message----- From: Jeffrey Wheat [mailto:jeff@cetlink.net] Sent: Tuesday, August 19, 2003 9:47 AM To: Drew Weaver; nanog(a)merit.edu Subject: RE: Natural Gas Generator manufacturer opinions? (might be off topic?) I'd be interested in this information as well. Thanks, Jeff -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Monday, August 18, 2003 10:21 AM To: 'nanog(a)merit.edu' Subject: Natural Gas Generator manufacturer opinions? (might be off topic?) Hi, we're looking to purchase our 3rd natural gas generator and need some opinions about the different manufacturers, off-list is fine if you like. Thanks, -Drew --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.507 / Virus Database: 304 - Release Date: 8/4/2003 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.507 / Virus Database: 304 - Release Date: 8/4/2003

1 0