- NANOG - lists.nanog.org

RE: whois
by Karyn Ulriksen 25 Oct '00

25 Oct '00

You're kidding, right? -K > -----Original Message----- > From: bmanning(a)vacation.karoshi.com > [mailto:bmanning@vacation.karoshi.com] > Sent: Tuesday, October 24, 2000 7:23 AM > To: tme(a)21rst-century.com > Cc: nanog(a)nanog.org > Subject: Re: whois > > > > Yow! A chance to play devils advocate... Cool :) > > If you told me a dialup user on my network did anything, I'd doubt > your veracity. How do you know I have dialup services in my network? > The accuracy of your clock and the recorded IP address > are suspect since I have zero visability into your network structure > or administrative practice... and you don't have that visability into > mine. Your clock is hacked and you are forging IP addresses > in an attempt > to distract me from providing services. Tell me why this is > not a simple > case of harassment? Full and public disclosure of the attack > profile would > help build your credibility. And yes, if I have no business > relationship > to you and I've never had a relationship with you and you are making > assertions about my infrastructure and clients, I will prolly want > some incentive to cover the costs of investigating your outragous > claims. > > > > Are you really saying that if I tell you that a dial-up > user on your network > > hacked into my system at some precise time, from a precise > IP address > > (so that you could probably tell easily which user did it), > and did so > > in a fashion > > which suggested an automated "script kiddie" effort, I should only > > expect a response from you if I PAY for it ?!? > > > > This seems pretty close to the "protection" money that I > hear people with > > POP's in Moscow have to pay :) > > > > (BTW, I said nothing about timeliness > > or 24x7 availability - a note a week or two later would > have sufficed.) > > > > > > > > > > > > The key to an anti-hacker ISP association would be > > > > > a very special ip address / contact person lookup database. > > > > > ie: who/how to contact for the 'SWAT' response for a > particular IP > > > > > address. > > > > > > > > > > --Mike-- > > > > > > > > Hello; > > > > > > > > When we have had attacks such as root exploits, we have > notified the > > > > source (at least, > > > > the ISP hosting the immediate source) as to the date, > time, IP address, etc. > > > > (In one case, the attack appeared to come from a > dial-up address in Germany, > > > > so I thought we had them.) We have NEVER received a > response. From > > > > conversations at meetings, etc., I understand that this > is typical - almost > > > > universal - and that it would be naive to expect other > ISPs to actually > > > > do anything > > > > about being a source for attacks. > > > > > > > > Maybe a start would be to a BCP for some level of > minimal response if > > > > you source > > > > an attack, and a "web site of shame" listing those > domains that source > > > > attacks and do nothing about it when notified. > > > > > > > > > > -- > > > > > > Regards > > Marshall Eubanks > > > > > > Multicast Technologies, Inc. > > 10301 Democracy Lane, Suite 201 > > Fairfax, Virginia 22030 > > Phone : 703-293-9624 Fax : 703-293-9609 > > e-mail : tme(a)on-the-i.com http://www.on-the-i.com > > > >

2 1

Re: whois breakage
by Joshua Goodall 24 Oct '00

24 Oct '00

Spoof, noun, A humorous parody. I wasn't referring to spoofing (generically, forging data) Perhaps I should try to end this thread, having (hopefully) made my point, which is presumably the same point that "terrorists.net" wanted to make, about how the registry search should and should not behave. J On Tue, 24 Oct 2000, Matthew S. Hallacy wrote: > It's not a 'spoofed' entry, it's a nameserver entry. > > > -poptix > > On Tue, 24 Oct 2000, Joshua Goodall wrote: > > > > > > > I would contend that it *is* broken, because it doesn't DWIM (I can see > > people pouting already), and that there should be an implied $ on the end > > of any search-string, since dns become more specific to the left. > > > > I don't see an argument in favour of free-form searches in this database. > > Spoof entries like these, however, are an argument against them. > > > > J > > >

1 0

Re: Cheapest ethernet switch with monitor/mirror port?
by Henry Yen 24 Oct '00

24 Oct '00

On Mon, Oct 23, 2000 at 10:25:26AM -0400, Stewart MacLund wrote: > > www.datacommwarehouse.com lists the 3548 with enterprise s/w at $3,630US. > > a 16-port 460t lists for $830US. a 24-port 460t lists for $1110US. > > cheaper out of the box as well as cheaper per port, or did i miss something? > My apologies. I was actually looking at an Intel 510T switch, not the 460T. > The 510T is a stackable switch. The 3548 ran me 5385cdn, and the 510T was 2276. > Since the 3548 is 48 ports, it's 111.63cdn a port. The 510T was 94.83 a port. > Oh. Hm. Odd. Why the hell did i go with the Cisco? Oh, i remember. The Intel > was a 4 week delivery thing, whilst the 3548 was immediate. And i'm Cisco biased. > :) and the 460t/16 would be about 77cdn per port. i tend to be cisco-biased when it comed to routers (or, perhaps it's more accurate to say i'm biased _against_ most of cisco's router competitors...). on the other hand, when we're talking LAN instead of WAN (for small stuff, anyway), i'm of the opinion that the cisco line-up is much too expensive (and i don't need that much handholding for a lan switch, and i've already got cco for my router contracts anyway), and a bunch of it is getting long in the tooth. > Looking at my competetive price quote, i was also looking at Nortel Baystack > 450-24T ENET Switch for 2618cdn, a 3COM Superstack II Switch 3900 - 36 Port for > 4429cdn, and some variations for ports on the cisco and 3com products. we've had bad experiences with baytel lan stuff, and who knows what direction 3com is going in now-a-days (mid-range LAN doesn't seem to be it, though). > > it appears allied telesyn has a 24-port fully managed switch for $740 > > (AT-8126XL-10), as well as a 16-port model (AT-8118), and although > > i'd be surprised if port monitoring weren't a feature, the a-t website > > doesn't seem to specifically mention it. > Hm. Buyer beware. Check to make sure. Frankly, i have nothing but good > things to say abou the 3548. It's very robust, stacks well, and monitoring is a > snap. Mine run CiscoIOS 12.0, which has every feature i'd ever want. You could > check to see what the non-enterprise-load-of-the-software version runs for. I'm > sure it's cheaper. There was a specific reason i wanted the enterprise load on > mine, but being monday morning, my brain is not quite in gear yet. (Hence the > train of thought being typed in earlier) ios12 is a good thing for cisco routers, agreed. they finally folded in nat without requiring the firewall or enterprise feature set. but the original poster seemed to be looking for a cheapie (although reliable, i assume, or why post the question on nanog, after all...) switch that he could snarf a monitor port from, and not a general recommendation for that capability for a mid-range or high-end switch. i think once you get down to the $800 or so range (1200cdn), there's not going to be much difference in what you get. -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

5 6

Re: What TO DO and what NOT TO DO [Re: DOS Attacks - Almost Caught One!]
by Quark Physics 24 Oct '00

24 Oct '00

> Btw - I am thinking it will end in some kind of _anty hacker_ ISP assotiation which wove to prosecute any attempt to hack every > if it is harmless itself. Just again, it's the only way. Do you remember why in ansient culture any attempt to forbid the rules > was prosecuted - not because it was very important, but to stop another ones from going this way. > > Technically, it's not big deal to found the hacker - but it's a big work. The hard part is not the technology, it's the customer(s) They want their box back operational ASAP, yet complain when you tell them the must use SSH (putty.exe rocks!) and such. I have gotten less than no help when I find the persons box they hacked to get to the box I found. The key to an anti-hacker ISP association would be a very special ip address / contact person lookup database. ie: who/how to contact for the 'SWAT' response for a particular IP address. --Mike--

6 10

Re: whois breakage
by Joshua Goodall 24 Oct '00

24 Oct '00

I would contend that it *is* broken, because it doesn't DWIM (I can see people pouting already), and that there should be an implied $ on the end of any search-string, since dns become more specific to the left. I don't see an argument in favour of free-form searches in this database. Spoof entries like these, however, are an argument against them. J On Tue, 24 Oct 2000, Timothy Hunt wrote: > That's not broken. One is a host record for a terrorists.net host. > And it's NOT "enough said". > > The response also says: > To single out one record, look it up with "xxx", where xxx is one of the > of the records displayed above. If the records are the same, look them up > with "=xxx" to receive a full display for each record. > > So, if you do whois -h whois.internic.net =microsoft.com > you get the respose you expected. > > regards, > > Timothy Hunt > XO Communications > > > > > > $ whois -h whois.internic.net microsoft.com > > > > Whois Server Version 1.3 > > > > Domain names in the .com, .net, and .org domains can now be registered > > with many different competing registrars. Go to http://www.internic.net > > for detailed information. > > > > MICROSOFT.COM.IS.SECRETLY.RUN.BY.ILLUMINATI.TERRORISTS.NET > > MICROSOFT.COM > > > > > > Enough said. Similar for apple.com. The web-based whois client at > > nsiregistry.com is giving correct results, as are the gtld-servers, as > > does -h networksolutions.com > > > > FreeBSD and at least one release of Linux I've tested query > > whois.internic.net by default. If anyone is using automated whois in > > production (very likely), check your results! > > > > J > > > > > > > >

1 0

Re: whois breakage
by Omachonu Ogali 24 Oct '00

24 Oct '00

Not necessarily breakage, but I would assume it's a problem (or feature) in someone's regular expression matching patterns, since it looks for any entry that contains the specified string if it doesn't end in '.anything', in other words, "it's the result of a 'loose grep'". And if you're using anything automated based off of results from whois.internic.net, then you should be checking for multiple entries, i.e. domains that use their domain name as a nameserver resulting in 2 entries, (example: netsys.com) if you're heavily affected by this, then it's time to take a closer look at your code. Joshua Goodall wrote: > $ whois -h whois.internic.net microsoft.com > > Whois Server Version 1.3 > > Domain names in the .com, .net, and .org domains can now be registered > with many different competing registrars. Go to http://www.internic.net > for detailed information. > > MICROSOFT.COM.IS.SECRETLY.RUN.BY.ILLUMINATI.TERRORISTS.NET > MICROSOFT.COM > > Enough said. Similar for apple.com. The web-based whois client at > nsiregistry.com is giving correct results, as are the gtld-servers, as > does -h networksolutions.com > > FreeBSD and at least one release of Linux I've tested query > whois.internic.net by default. If anyone is using automated whois in > production (very likely), check your results! > > J -- Virtual Development Incorporated http://www.vdi.net Omachonu Ogali missnglnk(a)vdi.net Network Engineer (973) 815-2799

1 0

Incident response (was Re: whois ) (fwd)
by multics＠ruserved.com 24 Oct '00

24 Oct '00

If I'm researching an intrusion incident the things that are important to me are: 1) The organization I'm contacting can at least confirm that they have records that are useful in tracking down the hacker. 2) There is someone there who can look at their records since if I'm tracking down a hacker, it has often been a case that the source I've tracked things to has also been hacked. 3) The organization contacted takes the incident serious and will at least make sure they preserve any evidence/logs/records/etc that may be of use in further tracking of the culprit. 4) I can get enough information, even if its a yes or no, to determine if its worth filing a police report. Forwarded message: > On Tue, 24 Oct 2000 Valdis.Kletnieks(a)vt.edu wrote: > > :Umm... would you be satisfied with a "We've referred it to the appropriate > :people" response? > : > :At least here, and probably many other universities, we're stuck not being > :able to say much more than that due to student confidentiality rules... > :Yes, we take action. No, we usually can't say what we did. > > A general incident response capability would be usefull, but unfortunately > this requires more cooperation than most companies are willing to give. > > Would it be worthwhile to include security incident handling policies > and procedures in peering agreements? i.e a peering agreement also > includes a testable disaster recovery plan, and a security incident > response plan. > > It is fairly obvious by now that a peering agreement is more than simply > an agreement on a router configuration. > > I'm wondering if anyone would consider something like this a little more > robust than the centralized CIRTs and industry associations, as it would > be relative to local policy, and the participants have a direct existing > relationship with each other. This, as opposed to dependance on a neutral > co-ordinating centre which may be dealing with other problems. > > > -- > batz > Reluctant Ninja > Defective Technologies > > > -- Richard Shetron multics(a)ruserved.com multics(a)acm.rpi.edu NO UCE What is the Meaning of Life? There is no meaning, It's just a consequence of complex carbon based chemistry; don't worry about it The Super 76, "Free Aspirin and Tender Sympathy", Las Vegas Strip.

1 0

Goobers with Firewalls
by Jay Stewart 24 Oct '00

24 Oct '00

This was received by our support staff late last night. Apparently the guy thought 192.168.1.2 was "hacking him", 'nuff said. Jay Stewart Internet Network Engineer Olympia Networking Services - "The Northwest's Premier ISP" A wholly owned subsidiary of Advanced TelCom Group, Inc. ----- Original Message ----- From: "Identity Concealed to Protect the Clueless" To: <webmaster(a)olywa.net> Sent: Monday, October 23, 2000 9:39 PM Subject: Server USC in California hacking ports Whoops I forgot to add the security log in previous mail. I know that you share a DNS server 216.173.192.10) with Vircom.net. The website at USC is hacking the DNS servers and it is now hacking you server. I contacted the Web master at USC and states this is normal activity for his server and suggests I have something misconfigured on my network. I am using the assigned static IP's given to me by Vircom.net. I am running a NAT router and Firewall for security alerts. This hacking only started to happen in the past week. It only happens when running W2K and active directory. It does not happen with the same computer, router and firewall when Win98 or NT4 is run. Are you concerned about this hacking from USC upon your DNS server ? [concealed identity] Starting Sybergen Secure Desktop service... '10/23/2000 17:41:59' 'Initiate Service...' {347EA98F-5AB5-4E57-982C-B4A50CC35891} window value :0 {A15BD57F-A76E-413E-963C-06DC24111DD8} window value :0 Opening Local Area Connection:{A15BD57F-A76E-413E-963C-06DC24111DD8}...192.168.1.2 WS: WS 2.3.3113 opened, id = 1 '10/23/2000 17:43:50' 'Switch to network interface 'Local Area Connection'' '10/23/2000 17:43:50' 'Configuration has been changed' '10/23/2000 17:43:51' 'High security is active' '10/23/2000 17:43:53' 'Access pop3.vircom.net' '10/23/2000 17:45:06' 'Access windowsupdate.microsoft.com' '10/23/2000 17:45:48' 'Access 26.64.9.128.in-addr.arpa' '10/23/2000 17:45:49' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '216.173.200.126' '' 'Inbound' Successful to send email '10/23/2000 17:45:58' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '216.173.220.130' '' 'Inbound' Successful to send email '10/23/2000 17:46:07' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '216.173.201.241' '' 'Inbound' Successful to send email '10/23/2000 17:46:16' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '207.12.43.29' '' 'Inbound' Successful to send email '10/23/2000 17:46:20' 'Access 200.173.216.in-addr.arpa' '10/23/2000 17:46:20' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1444' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:46:22' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '207.12.43.29' '' 'Inbound' Successful to send email '10/23/2000 17:46:23' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1444' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:46:28' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '157.130.177.41' '' 'Inbound' Successful to send email '10/23/2000 17:46:29' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1444' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:46:31' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '157.130.177.41' '' 'Inbound' Successful to send email '10/23/2000 17:46:34' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '146.188.200.242' '' 'Inbound' Successful to send email '10/23/2000 17:46:41' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1470' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:47:02' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1497' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:47:24' 'Access blackhole.isi.edu' '10/23/2000 17:47:39' 'Access 168.192.in-addr.arpa' '10/23/2000 17:52:54' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '207.12.43.29' '' 'Inbound' Successful to send email '10/23/2000 17:53:19' 'ICMP Message Detected' '' '192.168.1.2' '' '128.9.64.26' '' 'Inbound' '10/23/2000 17:54:34' 'Access 29.43.12.207.in-addr.arpa' '10/23/2000 17:54:34' 'ICMP Message Detected' '' '192.168.1.2' '' '207.12.43.29' '' 'Inbound' '10/23/2000 17:57:23' 'Access 200.173.216.in-addr.arpa' '10/23/2000 17:57:23' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '2300' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:57:44' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '2327' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:58:05' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '2354' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:58:27' 'Access blackhole.isi.edu' '10/23/2000 17:58:42' 'Access 168.192.in-addr.arpa'

1 0

FCC Rules (fwd)
by Alex 24 Oct '00

24 Oct '00

(relatively non-operational) Interesting ruling that hit my e-mail.. ---------- Forwarded message ---------- Yesterday, the FCC implemented measures to ensure that building owners do not unreasonably deny competing telecommunications service providers access to customers in residential and commercial buildings or other multiple tenant environments ("MTEs"). In a News Release, the FCC indicated it was taking the following actions: 1. The FCC forbade telecommunications carriers from entering into exclusive contracts, preferred provider agreements and similar arrangements that effectively prohibit property owners from permitting other providers to access their property. This does not appear to impact agreements previously executed. 2. The FCC established procedures to facilitate moving the demarcation point to the minimum point of entry ("MPOE") just inside the building at the building owner's request in order to reduce the competitive carriers' dependence on the incumbent local exchange carrier ("ILEC"), the local Baby Bell company, to gain access to wiring inside the building. Under current law, the demarcation point may be located at either the MPOE just inside the building or further inside the building. 3. The FCC determined that the Telecom Act of 1996 required that ILECs must afford telecommunications carriers and cable service providers reasonable and nondiscriminatory access to conduits and rights-of-way located in MTEs, to the extent such conduits and rights-of-way are owned or controlled by the ILEC. 4. The FCC prohibited restrictions that impair the installation, maintenance or use of certain video antennas on property within the exclusive use or control of the antenna user. In addition, the FCC requested, among other things, further comment on whether (1) today's prohibition on exclusive contracts in commercial buildings should be extended to residential buildings, and (2) it should proscribe carriers from entering into contracts that grant them preferences other than exclusive access, such as exclusive marketing to tenants or the payment of landlord bonuses. Although the FCC recognized that the real estate industry has taken "positive steps" to facilitate tenant choice of telecommunications providers by working toward the development of best practices and model agreements, it noted that the adopted measures may well be "insufficient" in themselves to secure a full measures of choice for customers located in MTEs. Accordingly, it stated that it will "closely monitor" industry actions to resolve access concerns. If such actions are not productive, the FCC is prepared to take further action, including rules that mandate access to MTEs. It appears that the only immediate impact of these measures on real estate owners is the prohibition on execution of exclusive and similar contracts; however, the complete text of the FCC's report and order has not yet been published. We will provide a more detailed report on this matter at that time.

1 0

Re: DOS Attacks and reliable network contact data.
by David Lesher 24 Oct '00

24 Oct '00

{...........} > Then, perform a specific query for that nic-handle 'YO020JP', ie: > $ whois -h whois.nic.ad.jp YO020JP/e > > a. [JPNIC Handle] YO020JP > c. [Last, First] Oishi, Yuichi > d. [E-Mail] oishi(a)allnet.ad.jp > g. [Organization] TITUS COMMUNICATIONS CORPORATION > > (etc). > > The RIPE-style databases (RIPE, APNIC etc) provide you with the referenced > nic-handles (if available) as part of the output, as seperate database > objects. It Sure Would be Nice iffen someone would script up this, and add it to Sam Spade..... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0