- NANOG - lists.nanog.org

~ EveryBody Loves Chocolate! ~
by candyman＠pplmail.com 01 Mar '00

01 Mar '00

1 0

Retracing Sender's SMTP IP Address using MS Exchange 5.5
by Toplez Razer 29 Feb '00

29 Feb '00

Dear Folks, We receive an e-mail that we want to reply back, but the sender's SMTP is NOT registered in DNS. Let's say the sender is who(a)xyz.com. Let's assume xyz.com is being resolve with its ISP DNS 150.150.150.1. But there is no MX for xyz.com in this DNS. Our e-mail is MS Exchange 5.5. Can we trace the sender's SMTP IP address? Is there better way than to peel off the original header packet to see the sender IP? Thanks, Audie Onibala ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

3 2

RE: Need routing engineer from Verio
by Rizzo, Mark 29 Feb '00

29 Feb '00

Yes, I did send to peering and noc a few minutes later. I was not sure how quickly the peering email addressed was polled so I was looking for some help sooner from a clueful person on this list. (Which I have mostly received, minus the few requisite hate mails) Mark EA.COM -----Original Message----- From: TTSG [mailto:ttsg@ttsg.com] Sent: Sunday, February 27, 2000 2:53 PM To: rbush(a)bainbridge.verio.net Cc: MRizzo(a)eahq-exchange.ea.com; nanog(a)merit.edu Subject: Re: Need routing engineer from Verio > > > > Hello, I need to contact someone from Verio that can help me sort out a > > routing issue between Verio and my company. > > posted two minutes after mail sent to peering(a)verio.net and no mail sent to > noc(a)verio.net. brilliant. > Ya blame him? With the response times and cluelessness factor I've run into with various Verio departments, I'm suprised he bothered at all. Tuc/TTSG

12 13

RE: [long] Re: DDoS: CAR vs TCP-Intercept vs NetFlow
by Paul Ferguson 29 Feb '00

29 Feb '00

At 10:45 PM 02/28/2000 -0500, Vijay Gill wrote: >Routers from Cisco and other vendors have the ability to detect the >signature patterns of a denial-of-service attack, and the routers can >filter out that traffic, Farnsworth said. An unfortunate misquote. Add another scar to my cisco skin... - paul

2 1

DDoS: CAR vs TCP-Intercept vs NetFlow
by Rubens Kuhl Jr. 29 Feb '00

29 Feb '00

Have anyone performed an evalution of rate-limiting SYN packets (CAR) versus using TCP-Intercept ? What responds better to a DDoS attack (assume SYN-flooding only) ? What uses more router resources ? For better performance of CAR or TCP-Intercept, NetFlow switching (ip route-cache flow) should also be used, besides CEF ? Rubens Kuhl Jr.

4 7

To AOL engineers (icq services)
by Dmitry Safronov 28 Feb '00

28 Feb '00

Hello , Maybe some people from AOL routing engineers are reading this list... The following question for them... From adresses 195.161.0.0/16 and 213.24.0.0/16 we cannot connect to http port on your web sites: www.icq.com www.icq.net www.mirabilis.com and ICQ servers. But from my client's addresses (other blocks) we can. It seems like AOL filtered out our address blocks with port 80. Could anyone from AOL engineers help to solve the situation? Best regards, _____________________________________________________________________ Dmitry Safronov Rostelecom/Internet Centre Tel: +007 (095) 334-9983 Fax: +007 (095) 339-2415

1 0

Need routing engineer from Verio
by Rizzo, Mark 27 Feb '00

27 Feb '00

Hello, I need to contact someone from Verio that can help me sort out a routing issue between Verio and my company. Thanks, Mark Rizzo EA.COM

3 2

Fwd: [cfgeeks] TOOLS FOR VANDALS
by Shawn McMahon 26 Feb '00

26 Feb '00

I told you guys, but only some of you listened. It is not only possible to launch an attack like this from home user's PCs, "rewted" by amateurs, but it looks like a part of this was indeed done that way. This mess is gonna suck to clean up. Thanks, Microsoft, for all your help. Too bad you were helping the wrong effing side... >From: "Kevin P. Inscoe" <kevin(a)inscoe.org> >Reply-To: cfgeeks(a)onelist.com >Subject: [cfgeeks] TOOLS FOR VANDALS > >From: "Kevin P. Inscoe" <kevin(a)inscoe.org> > >TOOLS FOR VANDALS >San Jose, California-based Finjan software says that new hacker software >called Trinoo "zombie" can be run from ordinary PCs running Microsoft >Windows and will not require high-end Unix workstations of the sort that >have been involved in previous vandal attacks made through the Internet >against corporate and government computers. Vandals would be able to >launch >distributed denial-of-service attacks much more easily, preventing >people >from visiting the targeted sites. (Bloomberg News/New York Times 25 Feb >2000) >http://www.nytimes.com/library/tech/00/02/biztech/articles/25hack-pc.html > >~kevin >-- >Kevin P. Inscoe Unix System Engineer & Specialist >Deltona, FL Itinerary at http://www.inscoe.org/where >e-mail: kevin [at] inscoe [dot] org >http://www.inscoe.org 28.9492N 81.1955W >http://www.inscoe.org/comp http://www.inscoe.org/radio > >Where the Central Florida geeks hang out... >http://www.onelist.com/community/cfgeeks >Kevin Inscoe (kevin(a)inscoe.org) - Listmom

2 1

Congestion strikes British Telecom
by Sean Donelan 26 Feb '00

26 Feb '00

According to the BBC, two out of three main switches which handle 0800 and other national numbers crashed on Friday. This lead to congestion on numbers used for help lines and dialup lines for Internet service providers. Due to BT charges, most british ISPs use special numbers instead of local numbers. ISPs said they didn't get a lot of phone calls from customers complaining. But since ISP customer service numbers tend to be 0800 numbers (similar to 1-800 numbers in the states), more than likely even if customers wanted to complain, they couldn't reach the ISP. I couldn't find any information about the outage on the BT web site, but BBC has the story at http://news.bbc.co.uk/hi/english/uk/newsid_657000/657449.stm Yes, I know the telephone companies pride themselves on the unfailing nature of their networks. They never crash, just a bit of congestion. However, if you are using one of these new-fangle 800 services, I suggest you also have a regular international direct dial number for your customer service and network operations centers.

1 0

APC MasterSwitches, lock up on DOS attacks
by John M. Brown 26 Feb '00

26 Feb '00

According to APC Technical support (called them today), if you have a APC master switch and it see more that 200-300 packets per sec on its interface it will lock up the unit. The newer units will exhibit the same condition if you send more than around 2000 to 3000 packets per second. We saw this as our units would drop of the net from time to time. They (APC) have no fix for this issue, nor do they have an upgrade path, other than buying a newer unit, for the older systems. Units are not flashable as they use a 27xxx series EPROM on the micro controller card. YUK

3 2