- NANOG - lists.nanog.org

RE: OSPF VS. IS-IS
by Leo Nelson 27 Sep '00

27 Sep '00

Way cool thank you very much Ping -----Original Message----- From: Ping Pan [mailto:pingpan@research.bell-labs.com] Sent: Wednesday, September 27, 2000 3:21 PM To: Leo Nelson Cc: 'nanog(a)merit.edu' Subject: Re: OSPF VS. IS-IS Some have brought up this question before. Please take a look at http://www.nanog.org/mtg-0006/katz.html - Ping > Leo Nelson wrote: > > Hello I am in search of any articles that reflect the differences > between OSPF and IS-IS. I am particularly interested in papers that > highlight design, implementation, bandwidth usage, and scalability > concerns for large internetworks. > > Also if anyone could give some statistics on the how much IS-IS is > being used in large scale ISP, ASP, and NAPs > > Thank You > Leo Nelson CCNA > Axient Communications > 602.850.3083

1 0

RE: Port 139 scans
by Roeland M.J. Meyer 27 Sep '00

27 Sep '00

> From: John Fraizer [mailto:nanog@EnterZone.Net] > Sent: Wednesday, September 27, 2000 11:26 AM > > On Wed, 27 Sep 2000, Bill Becker wrote: > > > Speaking of the internet and the way it operates, is anyone > else seeing a > > large number of random hosts scanning through their address > space using TCP > > on port 139? > > > > Bill > > We have been seeing this for about 3 weeks now. I have too, it looks like they're looking for Windoze and Samba boxen. That's one of the netbios ports.

2 1

RE: Inventor of the Internet Technology / Father of Modern Day Ne tworking
by Michael Medwid 27 Sep '00

27 Sep '00

No - Al Gore invented the Internet. (Sorry list - I couldn't resist.) -----Original Message----- From: Ehud Gavron [mailto:GAVRON@ACES.COM] Sent: Wednesday, September 27, 2000 9:28 AM To: nanog(a)merit.edu Cc: GAVRON(a)ACES.COM Subject: Inventor of the Internet Technology / Father of Modern Day Networking My apologies for this non-op note. I was hoping to tap the wisdom of the collective. http://www.lk.cs.ucla.edu/ http://www.lk.cs.ucla.edu/LK/Inet/keys.html Is there a person who invented the Internet, and is this person him? Cheers, Ehud

4 3

Re: netscan.org update
by Patrick W. Gilmore 27 Sep '00

27 Sep '00

At 12:36 AM 9/27/2000 -0400, John Fraizer wrote: >I do understand where you may draw that conclusion however. Testing >for the presence of gas (smurf amplifiers) with a sniffer (single ICMP >echo-request scan) is NOT the same as simply throwing a match at the gas >main (waiting for an attack). > >So, the simple answer to your question is no. Especially since the source address is not spoofed. >John Fraizer TTFN, patrick

1 0

AS-Path analysis tool?
by Dan Hollis 27 Sep '00

27 Sep '00

Anyone know of good AS-Path analysis tools? I'd like to do some AS-Path statistical analysis in order to do some BGP tuning. -Dan

1 0

Re: Port 139 scans
by Ben Browning 27 Sep '00

27 Sep '00

At 01:14 PM 9/27/00 -0400, Bill Becker wrote: >Speaking of the internet and the way it operates, is anyone >else seeing a large number of random hosts scanning through >their address space using TCP on port 139? I get about 4 or 5 of these a day on my home boxen and I receive 5-10 times that many abuse complaints regarding this activity. My current suspicion is that a backdoor trojan (pause here to decline the port 139 attempt that just zipped by me) is on the loose and being propagated like mad. This would certainly fit with the rumour of a huge DDoS attack in the works, as m@d l33t h@x0rs get as many machines as possible compromised and ready to help the attack. I have noticed that the large majority of these scans from my address space (216.39.128.0 - 216.39.192.255) are targeted at others in the 216.39.* and 216.40.* blocks. Also, all of the computers in question seem to be Win9x boxes. Coincidence? I think not. Perhaps this is a new virus afoot that replicates itself by hunting through an IP block and the ones above and below it for an open Windows share. That would make sense, given the data I have thus far. CERT has an advisory up (http://www.cert.org/vul_notes/VN-2000-03.html) about NetBIOS DoS attacks, but these don't seem to be hosing networks, just kind of feeling around. If anyone else has more info, please share it! --- Ben Browning <benb(a)oz.net> oz.net Network Operations Tel (206) 443-8000 Fax (206) 443-0500 http://www.oz.net/

5 4

Re: Port 139 scans
by ken lindahl 27 Sep '00

27 Sep '00

On Wed, 27 Sep 2000, Bill Becker wrote: > Speaking of the internet and the way it operates, is anyone else seeing a > large number of random hosts scanning through their address space using TCP > on port 139? > > Bill we've seen similar scans here at UCB, and have traced a number of them to a win32 trojan variously named {note.com,Qaz.Trojan,QAZ.worm,TROJ_QAZ.A, Trojan/Notepad,W32.HLLW.Qaz.A}. if you're so inclined, you can test for this by telnetting to port 7597 on the machine that scanned you. http://vil.nai.com/villib/dispVirus.asp?virus_k=98775 for details. ken

1 0

Re: NANOG 20 River Rafting *unofficial* Trip
by Nanog20＠aol.com 27 Sep '00

27 Sep '00

In a message dated 9/27/00 12:08:55 AM Eastern Daylight Time, aaronm(a)toothpick.net writes: > Ron, > > What time is this event? Itinerary is availabe at Keyword...err... I mean from the main rafting info URL. :-) <A HREF="http://nanog.aol.com/nanog-raft.htm">WHITEWATER RAFTING TRIP</A> <A HREF="http://nanog.aol.com/raft-itin.htm">ITINERARY FOR SATURDAY 21ST OCTOBER</A> cheers! -ron

1 0

Re: NANOG 20 River Rafting *unofficial* Trip
by Sean Donelan 27 Sep '00

27 Sep '00

> http://nanog.aol.com/nanog-raft.htm Wow, this is awesome. Not even AOL's strategic partners have a subdomain under AOL.COM. Or even AOL wasn't brave enough to say "AOL Keyword: NANOG" :-) The rafting trip looks cool too.

3 2

Re: netscan.org update
by John Fraizer 27 Sep '00

27 Sep '00

On Tue, 26 Sep 2000, Todd Lyons wrote: > John Fraizer wrote: > > > Liken it to the Gas company driving up and down your street with a sniffer > > looking for leaks (SMURF amps) and someone walking up to every house in > > But do you not consider this the equivalent of using a lighter as the > sniffer? > -- > Blue skies... Cannonball http://www.mrball.net > * People are more violently opposed to fur than leather because * > * it's safer to harrass rich women than motorcycle gangs. * > "Well M'am... It looks like your new stove is all set. Just one more check. [click] [click] <BOOM!> OOPS... Sorry bout that. We forgot to set the 'no LP directed-explosion' command on your stove. We'll get that fixed right up." Sorry... I couldn't resist. I do understand where you may draw that conclusion however. Testing for the presence of gas (smurf amplifiers) with a sniffer (single ICMP echo-request scan) is NOT the same as simply throwing a match at the gas main (waiting for an attack). So, the simple answer to your question is no. --- John Fraizer EnterZone, Inc

1 0