- NANOG - lists.nanog.org

Re: distributed attack, high or not
by Joseph T. Klein 31 Jan '02

31 Jan '02

I define it as random because the traffic rise could be seen coming in from multiple providers and looked to be the same percent from all sources (separate routers with separate interfaces to separate ASNs in separate geographic locations). The traffic was inbound and not backsplash from randomized source addresses. It looks to me like a infection with someone turning a control knob. Is this common or a precusor of a bad thing? The anomaly was exactly one hour long. First I have seen of something like this in a relativly short time of gathering stats ... which I'm doing for another project. --On Thursday, 31 January 2002 02:09 +0000 Avleen Vig <lists-nanog(a)silverwraith.com> wrote: > On Thu, 31 Jan 2002, Joseph T. Klein wrote: > >> I saw what appears to be a distributed attack against a single IP >> address that reached nearly 500Mbs. I was thinking that this is >> high. Are people seeing any random attacks of this magnitude? > > Please define random :) > If you mean the source is random, then yes this attack is of a high > magnitude and I've seen one other this bad. > The addresses could be real, or spoofed - depending on the circumstance > and exact nature of the attack it'll vary. > > If you mean the target appears to be random, then you're probably just > very very unlucky :( > Attacks of this size are normally aimed at large IRC servers or large / > popular websites. > > -- > Avleen Vig > Network Security Officer > Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf -- Joseph T. Klein jtk(a)titania.net

1 0

RE: distributed attack, high or not
by LeBlanc, Jason 31 Jan '02

31 Jan '02

juno2? > -----Original Message----- > From: Joseph T. Klein [mailto:jtk@titania.net] > Sent: Wednesday, January 30, 2002 4:12 PM > To: nanog(a)merit.edu > Subject: distributed attack, high or not > > > > I saw what appears to be a distributed attack against a single IP > address that reached nearly 500Mbs. I was thinking that this is > high. Are people seeing any random attacks of this magnitude? > -- > Joseph T. Klein > jtk(a)titania.net >

1 0

OT: Wireless Billing Trivia Being Sought
by Leigh Anne Chisholm 30 Jan '02

30 Jan '02

Definitely off topic, but I thought there'd likely be someone out there that could answer this question for me. Last night a group of friends and myself were talking about using cellular telephones in light aircraft. The question that was posed is, what happens if the call is originated to a locally dialed number but transitions into the long-distance toll area? Conversely, what happens if a call originates in an area where long-distance charges apply but you transition into the local toll area? I know what I'd expect to happen--but does it actually work that way? Perhaps in an effort to keep this group "on-topic" - replies could be sent to me directly. If anyone else is interested in the answer, I'd be willing to forward them the information I get. Thanks... -- Leigh Anne -- Leigh Anne

1 0

RE: UUNet outage?
by LeBlanc, Jason 30 Jan '02

30 Jan '02

Was a maintenance window I think, though I missed the first part of this thread and don't know what times you folks had problems. During the Normal operations window on Jan 29, 2002 WorldCom will be performing the following scheduled maintenance activities. This activity is scheduled to take place from 3:00 a.m. to 6:00 a.m. (local hub time) in the contiguous US and elsewhere from 3:00 a.m. to 7:00 a.m. (local hub time) and may affect your connectivity. The following customer ID will be impacted: #####. If you have any questions, please contact our local Customer Network Support Center. Please reference the internal ticket number #####. Quality System Management-Global Maintenance Planning Worldcom (http://www.uu.net) 1(800) 900-0241 / +1(703) 206-5440 WorldCom United States 1-800-900-0241 (select the following options in order: 2, then 4, then 1) WorldCom Denmark (45) 80.30.50.50 WorldCom Italy (39) 02.3600.1887 WorldCom Sweden (46) 8.750.88.50 WorldCom Switzerland (41) 1.580.86.11 > -----Original Message----- > From: Vandy Hamidi [mailto:vhamidi@insweb.com] > Sent: Tuesday, January 29, 2002 7:06 PM > To: 'dlark(a)elmresources.com'; nanog(a)merit.edu > Subject: RE: UUNet outage? > > > > I noticed unavailability of some sites through our UUNet > connection as well. > Trace routes showed that the packets were being dropped after > it was passed > onto above.net but also before that. I assume not only was > above.net having > problems, but I screwed up UUNet's routes they received from them. > A call to UUNet didn't help. The tech, though nice, had no > idea what to > look for. I was sitting there giving him commands and asking > the result. > After I figured everything was ok between us, I figured it > was bigger than > just my connection and waited patiently. > All was good within 15 min or less. > > -=Vandy=- > > > -----Original Message----- > From: Daniel Lark [mailto:dlark@elmresources.com] > Sent: Friday, January 25, 2002 8:04 PM > To: nanog(a)merit.edu > Subject: Re: uunet outage? > > > > I have been noticing several UUNet problems recently. My > Oakland office > (connected via UUNet) and my company's service bureau, run by a > contractor company (also UUNet) had problems seeing my main corp. web > server colo'd at Hurricane Electric, yesterday. Turns out there was a > DoS attack ran against a router on above.net (which provides > the peering > between UUNet and HE). > > However, I have also seen problems with customers being > unable to see my > contractor's machines. Supposedly, there are some rather strategic DoS > attacks going on. Can anyone confirm this? > > Regards, > Dan Lark > ELM Resources, Inc. >

1 0

RE: NANOG 24: NAP BoF
by James Smith 30 Jan '02

30 Jan '02

Marketecture. It looks better to call yourself a NAP than to call yourself an IX. The naming of the "type" of exchange is by custom, and not law, AFAIK. Thus, the marketing droids take over. Look at what they have done to "broadband"... Maybe if we classed them by aggregate provisioned bandwidth, with a secondary classification that ranks number of peers at the point... James H. Smith II NNCDS NNCSE Systems Engineer The Presidio Corporation I speak for myself, even when I shouldn't.

2 1

RE: NANOG 24: NAP BoF
by Peter Ford 30 Jan '02

30 Jan '02

Looks like all of you can use the scheduled time to establish a glossary so that you understand why you are at the NAP BoF. Or perhaps there needs to be a liaison established to an established Internet Etymology and Terminology Forum. Apologies in advance and in arrears, peter -----Original Message----- From: Randy Bush [mailto:randy@psg.com] Sent: Tuesday, January 29, 2002 10:40 PM To: Alan Hannan Cc: nanog(a)merit.edu Subject: Re: NANOG 24: NAP BoF > Something bothers me about this thread, and I think it is the > assertion that there is a proper definition for 'NAP' as > differentiated from 'IXP' or what not. yup. george santayana was right

1 0

RE: UUNet outage?
by Vandy Hamidi 30 Jan '02

30 Jan '02

I noticed unavailability of some sites through our UUNet connection as well. Trace routes showed that the packets were being dropped after it was passed onto above.net but also before that. I assume not only was above.net having problems, but I screwed up UUNet's routes they received from them. A call to UUNet didn't help. The tech, though nice, had no idea what to look for. I was sitting there giving him commands and asking the result. After I figured everything was ok between us, I figured it was bigger than just my connection and waited patiently. All was good within 15 min or less. -=Vandy=- -----Original Message----- From: Daniel Lark [mailto:dlark@elmresources.com] Sent: Friday, January 25, 2002 8:04 PM To: nanog(a)merit.edu Subject: Re: uunet outage? I have been noticing several UUNet problems recently. My Oakland office (connected via UUNet) and my company's service bureau, run by a contractor company (also UUNet) had problems seeing my main corp. web server colo'd at Hurricane Electric, yesterday. Turns out there was a DoS attack ran against a router on above.net (which provides the peering between UUNet and HE). However, I have also seen problems with customers being unable to see my contractor's machines. Supposedly, there are some rather strategic DoS attacks going on. Can anyone confirm this? Regards, Dan Lark ELM Resources, Inc.

1 0

Global Crossing files for Chap. 11
by Brian Coyle 29 Jan '02

29 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://biz.yahoo.com/rb/020128/business_telecoms_globalcrossing_dc_1.html Mon 8:09pm ET Global Crossing Ltd. on Monday said it filed for bankruptcy protection as two of its Asian business partners agreed to pay $750 million to assume control of the high-speed communications services company as it reorganizes in the fourth-largest insolvency in U.S. history. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8VhEnER3MuHUncBsRAvZxAJ4hbScE+7b3ERRpY7AoAA4t1fpolQCbBY37 BXbdPrtPy42C7PF+rkQUx1c= =DgET -----END PGP SIGNATURE-----

1 0

formmail.pl - What hack is this?
by John Palmer (NANOG Acct) 28 Jan '02

28 Jan '02

Anyone hear of some sort of a cracking method that uses cgi-bin/formmail? I've seen alot of these in my httpd/access_log files lately. I don't have formmail.pl anywhere on my system - I flushed all of the cgi-bin stuff that came with apache a long time ago. John

4 3

Re: formmail.pl - What hack is this?
by Steven M. Bellovin 28 Jan '02

28 Jan '02

In message <011601c1a7a7$22eae140$c89d05c7@TAKA>, "John Palmer (NANOG Acct)" wr ites: > >Anyone hear of some sort of a cracking method that uses cgi-bin/formmail? >I've seen alot of these in my httpd/access_log files >lately. I don't have formmail.pl anywhere on my system - I flushed all of >the cgi-bin stuff that came with apache a long time ago. > Spammers are actively looking for such scripts to abuse to send junk mail. See, for example, http://securitytracker.com/alerts/2001/Mar/1001108.html --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

1 0