- NANOG - lists.nanog.org

Re: 69.0.0.0/8 - Please update your filters
by Geoff Huston 26 Feb '03

26 Feb '03

In return, would Covad please consider performing some meaningful form of route aggregation or other measures to reduce the amount of noise that is being passed across the global routing tables that originates from Covad? http://www.cidr-report.org/cgi-bin/as-report?as=AS18566&view=4637 suggests that Covad could withdraw some 483 BGP routing table entries, reducing the total number of entires originated by Covad from 490 to an equivalent set of 8 aggregate routes. Perhaps use of NO EXPORT when announcing the more specifics to your upstream transit providers would be a globally helpful action to consider. regards, Geoff Huston At 02:09 PM 2/25/2003 -0800, Hsu, Vicky wrote: -----Original Message----- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has recently come to our attention that many Internet routers are still filtering out IP addresses in the 69.0.0.0/8 range. If YOU are still filtering this block in your router, please modify your filters accordingly. Thank You IANA IPv4 Allocation List - <http://www.iana.org/assignments/ipv4-address-space> Bogon List - <http://www.cymru.com/Documents/bogon-list.html> Secure IOS Template - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Sincerely, Ka Lun Chan (KC) Security Operation Center COVAD Communication SOC#: 866-722-2602 Dir #: 408-434-4919 Fax #: 408-434-2191 Easy to do Business with

2 1

Comcast contacts?
by Temkin, David 26 Feb '03

26 Feb '03

Does anyone have any contacts at Comcast that I might speak to RE: an issue that multiple users from my network are having with their comcast.net email via the web. Basically, starting last week, numerous users have reported that they get 'session timed out' messages as soon as they open their mailbox via the comcast.net webpage. I have no other issues with any other services. Thanks, -Dave IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

1 0

69.0.0.0/8 - Please update your filters
by Hsu, Vicky 26 Feb '03

26 Feb '03

-----Original Message----- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has recently come to our attention that many Internet routers are still filtering out IP addresses in the 69.0.0.0/8 range. If YOU are still filtering this block in your router, please modify your filters accordingly. Thank You IANA IPv4 Allocation List - <http://www.iana.org/assignments/ipv4-address-space> Bogon List - <http://www.cymru.com/Documents/bogon-list.html> Secure IOS Template - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Sincerely, Ka Lun Chan (KC) Security Operation Center COVAD Communication SOC#: 866-722-2602 Dir #: 408-434-4919 Fax #: 408-434-2191 Easy to do Business with

6 8

Re: 69.0.0.0/8 - Please update your filters
by Stephen Gill 26 Feb '03

26 Feb '03

As a brief reminder and in addition to the URLs below folks are also welcome to peer with the Team-Cymru's bogon route server which will automatically and securely update your bogon filters for you. Instructions are available at: http://www.cymru.com/Bogons/index.html Cheers, -- steve team-cymru(a)cymru.com -----Original Message----- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has recently come to our attention that many Internet routers are still filtering out IP addresses in the 69.0.0.0/8 range. If YOU are still filtering this block in your router, please modify your filters accordingly. Thank You IANA IPv4 Allocation List - <http://www.iana.org/assignments/ipv4-address-space> Bogon List - <http://www.cymru.com/Documents/bogon-list.html> Secure IOS Template - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Sincerely, Ka Lun Chan (KC) Security Operation Center COVAD Communication SOC#: 866-722-2602 Dir #: 408-434-4919 Fax #: 408-434-2191 Easy to do Business with

1 0

untied
by Randy Bush 25 Feb '03

25 Feb '03

could someone else please check the dns for www.united.com? the servers for united.com seem to delegate www.united.com, but the delegatee seems not to return an soa. i get very confusing results. randy, feeling stoopid

9 11

[ISN] SIP weakness could expose VoIP gear to attacks
by Bram Shirani 25 Feb '03

25 Feb '03

(forwarded from ISN) http://www.nwfusion.com/news/2003/0224sip.html By Phil Hochmuth Network World Fusion 02/24/03 A glitch in some vendors' Session Initiation Protocol (SIP) software could leave SIP-enabled devices - such as IP phones, IP PBXs and instant messaging clients - vulnerable to denial-of-service attacks, the CERT Coordination Center said last week. The Oulu University Secure Programming Group (OUSPG) discovered that when a certain SIP test suite (PROTOS c07-sip) is applied to SIP clients devices or proxy servers, it caused "impacts ranging from unexpected system behavior and denial of services to remote code execution," according to the CERT warning. The vulnerably relates to the "invite" messages SIP devices send to each other to initiate sessions such as VoIP calls, text chat or video. SIP is an emerging VoIP protocol used to establish sessions among SIP "agents," such as IP phones, softphones, text chat clients, and video applications. Industry observers have called text-based SIP the successor to the H.323 protocol, used widely in IP-based telephony and videoconferencing equipment. Vendors with IP PBX and phone products that use SIP include Alcatel, Avaya, Cisco, Mitel, Nortel, Pingtel, Ploycom, and Siemens. Microsoft Windows Messenger - a Web telephony, chat and video client included in Windows XP - also uses SIP. According to CERT and Cisco's Web site, Cisco's 7940 and 7960 models of IP phones running SIP images prior to version 4.2 are vulnerable, as well as Cisco routers running Cisco IOS 12.2T and 12.2X. PIX firewalls running software versions with SIP support - beginning with version 5.2(1) and up to, but not including versions 6.2(2), 6.1(4), 6.0(4) and 5.2(9) - are also affected, Cisco says. Fixes to these products are available from Cisco's Web site. Microsoft says its SIP-based software is not affected by the vulnerability. Nortel says its Succession Communication Server 2000 and Succession Communication Server 2000 - Compact are affected by the vulnerability only when SIP-T has been enabled on the IP PBX products. Patches for these products are available at Nortel's Web site. Other vendors with SIP-based products have not posted comments on the CERT Coordination Center Web site. - ISN is currently hosted by Attrition.org

1 0

Thanks for the heads-up.
by tbolling＠vger.com 25 Feb '03

25 Feb '03

>> Voyager IP http://www.vger.com/products.shtml#v_ip >Where did you see a demo? Any idea what it costs? I just sent them an >email. Not much info on their web site, and their contact submission form >is broken. Sorry about the broken link, should be fixed now. Your e-mail should get a reply shortly if you haven't gotten one already.

1 0

Web Caches..
by Mark Segal 25 Feb '03

25 Feb '03

I'm wondering if anybody has had RECENT experience with web caches. If so, what is your favourites? why? Two stipulations: 1) I want one that doesn't require a department to maintain a list of uncachable objects. 2) It must support wccp. Off list replies are welcomed. Mark -- Mark Segal Director, Data Services Futureway Communications Inc. Tel: (905)326-1570

1 0

IP Management tool for service providers
by Daniel Abbey 25 Feb '03

25 Feb '03

I am looking for an IP management which has flexible management capabilities. I need it for managing my customers IP assignments, and keeping stock of my IP pool. Do you have any suggestions?

6 5

Symantec detected Slammer worm "hours" before
by Sean Donelan 25 Feb '03

25 Feb '03

Wow, Symantec is making an amazing claim. They were able to detect the slammer worm "hours" before. Did anyone receive early alerts from Symantec about the SQL slammer worm hours earlier? Academics have estimated the worm spread world-wide, and reached its maximum scanning rate in less than 10 minutes. I assume Symantec has some data to back up their claim. http://enterprisesecurity.symantec.com/content.cfm?articleid=1985&EID=0 "For example, the DeepSight Threat Management System discovered the Slammer worm hours before it began rapidly propagating. Symantec's DeepSight Threat Management System then delivered timely alerts and procedures, enabling administrators to protect against the attack before their environment was compromised."

17 20