- NANOG - lists.nanog.org

RE: 3+ hours into "Code Red" (BST)
by Joe Blanchard 20 Jul '01

20 Jul '01

Oddly, right around 5pm(PST) I noticed less and less traffic(scans at my firewall) looking for tcp port 80. At the height of today 50% of our traffic on one of our T1s was various foreign addresses looking for open http servers. This is much more then usual and at first thought to be a spoof attack, but the nodes being scanned were too random. Don't know, but most of the ips we logged turned out to be MS IIS none patched boxes. Wonder if these hits on valid http servers are counted as hits and charged to the advertisers? lol. Oh well. -Joe

1 0

3 hours into "Code Red" (BST)
by Av 20 Jul '01

20 Jul '01

No real increase in traffic at LINX in the UK. I'm wondering if the bug is designed to trigger at midnight on a different time zone (ie, not 'Midnight local time') ?? http://ochre.linx.net/cgi-pub/combined?log=combined.bits

2 1

Cogent Reviews?
by David E. Weekly 20 Jul '01

20 Jul '01

Hi, all. I'm looking to start a non-profit community colocation facility in Silicon Valley, and it seemed to me that Cogent Communications had the best deal on getting a big chunk of bandwidth ($1000/months for 100mbps). Are there comparable deals out there, or is Cogent the only one at this price point? Do they have good peering? What kind of latency/throughput does one get over their network? Do they have any customers? Any of you use Cogent? Thanks *so* much for any of your input; we're hoping to keep costs way down, any input on this would be much appreciated. Yours, -david

5 8

Re: Code Red -> Router Memory depletion?
by Steven M. Bellovin 20 Jul '01

20 Jul '01

A colleague of mine, Balachander Krishnamurthy, is looking for Web server logs from sites that have been attacked by Code Red. He's working on analysis techniques to detect flash crowds, DDoS attacks, etc. Please reply directly to him (bala(a)research.att.com) if you can supply any data. (You can see the kind of stuff he's been doing by looking at some of his recent papers, at www.research.att.com/~bala/papers)

1 0

Re: Apparent widespread Worldcom ATM failure
by Steve Bellovin 20 Jul '01

20 Jul '01

The mainstream media have noticed the effect of the derailment on the net. See http://www.nytimes.com/aponline/technology/AP-Train-Derailment-Communicatio… http://www.thewbalchannel.com/News/880504/index.html --Steve Bellovin, http://www.research.att.com/~smb

1 0

X-10 and like behaviour.
by George Michaelson 19 Jul '01

19 Jul '01

Its probably not a big deal, and if selling bits on the wire makes money "the more the merrier" might be a catch-cry but I wondered if there was a NANOG dimension to these bloody irritating X-10 popups that curse me more and more. Is there some well understood non-edge solution to this kind of crap or do we all wind up rolling our own? -George -- George Michaelson | APNIC Email: ggm(a)apnic.net | PO Box 2131 Milton QLD 4064 Phone: +61 7 3367 0490 | Australia Fax: +61 7 3367 0482 | http://www.apnic.net

9 10

Advanced Countermeasures to prevent a Ddos
by Scott E. MacKenzie 19 Jul '01

19 Jul '01

I was wondering if anyone on this list has considered the idea of trying to eliminate Ddos attacks while designing their Data Centre's network topology. If so, did you include server isolation and or distribution? Secondly, is it even possible to eliminate (or as close to elimination as one can have in the tech world) Ddos attacks with network design and server implementation. Does anyone have an advanced understanding of these issues and if so are you willing to exchange information off-line? Scott E. MacKenzie semackenzie(a)crop.attcanada.ca

1 0

Re: X-10 and like behaviour.
by Daniel Senie 19 Jul '01

19 Jul '01

At 08:26 AM 7/19/01, Frank Thomas wrote: > > > > > Its probably not a big deal, and if selling bits on the wire makes money > > > "the more the merrier" might be a catch-cry but I wondered if there was > > > a NANOG dimension to these bloody irritating X-10 popups that curse me > > > more and more. > > > > > > Is there some well understood non-edge solution to this kind of crap > > > or do we all wind up rolling our own? > > > > Reminds me a lot of the early days of fighting spam...though > > a ban on popups has already been mentioned in the US Congress. > > > >Yep, they even have an opt out page. Although I found this from >another source and no obvious way to this from the frontend of their site. >For what its worth the 'popunders' from x10 are cookie based. The url >below will opt you out for 10years (leap years figured also). The week >or so after they started these annoying things I noticed that x10 was one >of the highest traffic sites (I may be wrong) of the week... I will NEVER >buy anything from them... > >http://www.x10.com/home/optout.cgi?DAY=3652GE=http://www.x10.com/x10ads1.htm There's an ampersand missing between 3652 and GE in the above. Adding that made it work. For those who prefer less typing, I've added the corrected URL as a link on http://www.noads.org/. Unlike the link on the X10 page, this will set the cookie for, as Frank noted, 10 years. I expect in time they'll add additional advertisements, and use different cookies. I'll put new ones on the noads.org page as I learn of them. ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

2 2

Network Architecture Mission Statements & Organizational ideas
by Murphy, Brennan 19 Jul '01

19 Jul '01

Hello, I realize this topic may be one step outside the strict definition of a technical discussion but it is comparable to the well-received discussions of building a NOC. I'm part of a team that is assembling to act as a network architecture group for our company. We need a mission statement that in generic terms says we respond to business needs with architectural solutions, etc. We can read and write, yes, but it would be nice to see how some other similar groups have put together their mission statement. Additionally, I am interested in learning a bit more about the make-up of network architecture groups at other companies. Is membership on your architecture group confined to engineers/architects? Does it include security engineers? How do you make decisions as a group-- democracy/democracy with management veto, etc.? Any other related comments to this project are appreciated. I will likewise provide a summary of my findings. So, if you are interested in this topic, it may be best to simply contact me offline with either your interest in the results and/or your contributions to query. But of course, if others deem this discussion worthy of the mass mailing nature of nanog, I won't object. :-) Thanks, -BM

2 1

X-10 Opt Out
by Robert Cannon 19 Jul '01

19 Jul '01

The opt out link listed did not work for me. But I found opt out information at http://www.x10.com/x10ads.htm Looks like it lasts only 30 days but looks like you can change that. -B __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0