- NANOG - lists.nanog.org

URGENT NEED HELP: DOS Currently underway via our C&W transit link
by John M. Brown 23 Jan '00

23 Jan '00

We have a DOS attach currently underway via our C&W transit link. This is consuming all bandwidth on the C&W link. This is NOT transiting our other backbone links Source IP's are random Dest IP is 206.29.129.98 which is a Co-Lo server using 206.29.129.96 /27 Certainly would be nice if people would filter on there edges. If anyone can lend help in finding this nice person doing this, there will be a reward at NANOG San Jose! :) Here is a snip from CFLOW mm/dd/yy hh:mm:ss ii oi srcAS src_address mk port next_hop_addr dstAS dst_address mk port pr tos flgs packets bytes -------- -------- -- -- ----- --------------- -- ----- --------------- ----- --------------- -- ----- -- --- ---- ---------- ---------- 01/22/100 23:54:30 2 1 0 168.87.199.44 00 23098 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 195.64.161.18 00 28986 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 159.225.88.89 00 31034 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 51.173.107.119 00 34874 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 72.228.241.56 00 39226 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 114.152.168.77 00 45114 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 6.198.65.52 00 49210 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 218.86.51.65 00 55610 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 148.224.190.10 00 61242 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 38.123.67.54 00 59 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 178.119.185.125 00 1851 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 119.254.14.35 00 8507 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 5.4.243.62 00 14139 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 57.135.125.85 00 16187 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 56.100.199.112 00 20795 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 35.18.98.42 00 27451 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 129.177.110.76 00 30523 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 166.57.114.31 00 33083 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 88.123.137.92 00 37435 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 170.35.224.39 00 43579 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 59.166.68.52 00 48955 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 167.153.104.107 00 53051 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 179.106.107.86 00 55611 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 88.195.189.97 00 59963 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 250.102.51.105 00 64827 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 211.55.122.90 00 4924 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 149.44.239.105 00 6716 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40

1 0

Re: New form of packet attack named Stream
by Vadim Antonov 23 Jan '00

23 Jan '00

Jamie Rishaw <jamie(a)dilbert.exodus.net> wrote: > Unless you are > Vixie > Hubbard > Cerf > Donelan > Manning > Bush > Jesus Christ (Randy, you _do_ look like a biblical personage :) > A major s/w key figure > or comparable entity > .. or someone that knows me IRL, and has for some time .. please do not > e-mail me asking for the code. Actually, you provided enough details, so any unix guy who knows his sockets can write the program in fifteen minutes. This type of attack was known for a long time (and there are even nastier variations using TCP header bits and fragments), and, unfortunately, there's no good defense against it. The core routers are indeed vulnerable; is there any router which has an access list for restricting packet flow to the routing processor? (My knowledge of latest-and-greatest features from OFRV is somewhat outdated). A toyed with the idea of reverse-path verification coupled with some kind of super-squelch message; but so far all such schemes have holes in them. DoS attacks are a real scourge. --vadim

7 7

Re: Wireless cards for NANOG18
by Shawn McMahon 21 Jan '00

21 Jan '00

At 01:28 PM 1/21/2000 -0500, you wrote: >Greetings everyone - we wanted to let you know that Merit is looking for >wireless sponsors for the upcoming meeting in San Jose. We've been >offered the loan of several dozen cards, but if possible, we'd like to >have even more available for the mobile among you. Our preferred formats >are: > > - 802.11 compliant, Direct Sequence Spread 2.4 GHz (DS) > 2 Mb/s, 11 Mb/s > - 802.11 Compliant, Frequency Hopping 2.4 GHz (FH) Frequency Hopping. Dang, we're gonna miss you, Hedy. Best lookin' geek I ever saw.

1 0

NANOG 18 Hotel Info
by Pam Ciesla 21 Jan '00

21 Jan '00

The Double Tree (408-453-4000) has rooms still available for Sunday and Monday. Other hotels in the area are: Courtyard San Jose 408-441-6111 Hyatt 408-993-1234 Hanford Hotel 408-453-3133 Pam Pam Ciesla Events Coordinator Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 - fax Bldg.I, Suite 2000 pam(a)merit.edu Ann Arbor, MI 48105

1 0

The Cidr Report
by Tony Bates 21 Jan '00

21 Jan '00

This is an auto-generated mail on Fri Jan 21 12:00:02 PST 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 21Jan00 0) General Status Table History ------------- Date Prefixes 140100 69862 150100 70956 160100 70982 170100 71135 180100 70228 190100 70246 200100 70143 210100 70096 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 219.91.160.0/22 from AS7742 *** Bogus 219.91.164.0/23 from AS7742 AS Summary ---------- Number of ASes in routing system: 6488 Number of ASes announcing only one prefix: 3493 (1893 cidr, 1600 classful) Largest number of cidr routes: 707 announced by AS701 Largest number of classful routes: 984 announced by AS701 1) Gains by aggregating at the origin AS level --- 21Jan00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 384 142 242 63.0% BCnet Backbone AS7046 410 267 143 34.9% UUNET-CUSTOMER AS9269 135 25 110 81.5% Hong Kong CTI AS2609 125 16 109 87.2% EUnet-TN AS1221 623 516 107 17.2% TELSTRA-AS AS7657 285 185 100 35.1% The Internet Group Limited AS7545 153 60 93 60.8% TPG Internet Pty Ltd AS6429 206 114 92 44.7% RDC-INTERNET AS4293 256 164 92 35.9% Internal ASN for C&W AS2715 156 65 91 58.3% REDERIO-AS AS174 563 479 84 14.9% Performance Systems International AS7496 119 39 80 67.2% Power Up AS705 270 193 77 28.5% ALTERNET-AS AS577 253 177 76 30.0% Bell Nexxia Backbone AS3749 135 61 74 54.8% TECNET AS9304 94 23 71 75.5% Hutchcity AS3602 315 249 66 21.0% Sprint Canada Inc. AS4200 170 105 65 38.2% AGIS (Apex Global Information Ser AS1727 138 76 62 44.9% MRMS-WEST AS816 244 185 59 24.2% UUNET Canada (ASN-UUNETCA-AS4) AS4740 343 285 58 16.9% Ozemail Pty Ltd (ASN-OZEMAIL) AS7260 103 46 57 55.3% NORLIGHT AS209 377 325 52 13.8% Qwest Communications AS4151 94 48 46 48.9% USDA Internet Access Network AS684 89 44 45 50.6% Manitoba Regional Network Backbon AS4755 120 77 43 35.8% Videsh Sanchar Nigam Ltd. India AS701 984 942 42 4.3% Alternet AS7568 56 16 40 71.4% C.S. Communications Co., Ltd. AS3549 154 115 39 25.3% Frontier GlobalCenter AS11127 124 85 39 31.5% UNKNOWN For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: Wireless cards for NANOG18
by Susan R. Harris 21 Jan '00

21 Jan '00

Now I see what you mean. Who did you mean to send this to. On Fri, 21 Jan 2000 robert(a)UU.NET wrote: > > Speaking of wireless cards, I was unable to get anyone here at UUNET > interested in the fact that my laptop was stolen. (Many things have changed > in the past few years. UUNET is not what it used to be.) I don't think we > even have insurance. > > If the offer to compensate John Brown <jmbrown(a)ihighway.net> is still good > please contact him as his business is still out 1 aironet card :( > >

1 0

Wireless cards for NANOG18
by Susan R. Harris 21 Jan '00

21 Jan '00

Greetings everyone - we wanted to let you know that Merit is looking for wireless sponsors for the upcoming meeting in San Jose. We've been offered the loan of several dozen cards, but if possible, we'd like to have even more available for the mobile among you. Our preferred formats are: - 802.11 compliant, Direct Sequence Spread 2.4 GHz (DS) 2 Mb/s, 11 Mb/s - 802.11 Compliant, Frequency Hopping 2.4 GHz (FH) - 2.4 GHz Non-802.11 (traditional WaveLAN, Roamabout, etc.) - 915 MHz Non-802.11 (Roamabout) Thanks in advance, and please contact us at nanog-support(a)merit.edu.

1 0

Fwd: stream.c - new FreeBSD exploit?
by Allan Carscaddon 21 Jan '00

21 Jan '00

Fresh from BUGTRAQ: >Approved-By: aleph1(a)SECURITYFOCUS.COM >Delivered-To: bugtraq(a)lists.securityfocus.com >Delivered-To: bugtraq(a)securityfocus.com >Date: Tue, 18 Jan 2000 14:44:38 -0800 >Reply-To: The Tree of Life <ttol(a)JAMES.KALIFORNIA.COM> >Sender: Bugtraq List <BUGTRAQ(a)SECURITYFOCUS.COM> >From: The Tree of Life <ttol(a)JAMES.KALIFORNIA.COM> >Subject: stream.c - new FreeBSD exploit? >X-To: bugtraq(a)securityfocus.com >To: BUGTRAQ(a)SECURITYFOCUS.COM >X-Loop-Detect: 1 > >I've been informed today by an irc admin that a new exploit is circulating >around. It "sends tcp-established bitstream shit" and makes the "kernel >fuck up". > >It's called stream.c. > >The efnet ircadmin told me servers on Exodus (Exodus Communications) were >being >hit and they managed to get a hold of the guy. When asked what was going >on, he just said "stream.c". > >When I talked to another person to ask if he had 'acquired' the source, he >said he wasn't going to give it out. I asked him if he had a patch for it, >and he replied "the fbsd team is working on it. No patch is available right >now." > >What's the importance of this? Major companies such as Yahoo >(www.yahoo.com) and others run freebsd. > >According to the irc admin, a simple reboot fixes it. "Your box reboots or >dies." He also stated, when asked if anything noticeable happened, that >"nothing unusual [happened]". > >The only log that he could provide was this one: > >---snip--- > >syslog:Jan 18 12:30:36 x kernel: Kernel panic: Free list empty > >---snip--- > >One thing of note: he also stated this happened on non-freebsd systems, >which is contrary to what the other person said, who was "under the >impression it was freebsd specific." > >I have the source, which I'm not going to post for 2-3 days (give time for >fbsd to work on the fix). If it isn't out before the 21st, I'll post it up. > >---snip--- > >void usage(char *progname) >{ > fprintf(stderr, "Usage: %s <dstaddr> <dstport> <pktsize> <pps>\n", >progname); > fprintf(stderr, " dstaddr - the target we are trying to attack.\n"); > fprintf(stderr, " dstport - the port of the target, 0 = random.\n"); > fprintf(stderr, " pktsize - the extra size to use. 0 = normal >syn.\n"); > exit(1); >} > >---snip--- > >Thanks for listening to my ramblings, hope everything I said helps. > >- ttol >http://www.alladvantage.com/home.asp?refid=AME389 >Get Paid to Surf. It works actually, cause people get thousands of dollars >a month from it...it's neet :P My id is AME389 - use it! :)

3 2

New form of packet attack named Stream
by Henry R. Linneweh 20 Jan '00

20 Jan '00

anyone have a preventative method for this? -- Thank you; |--------------------------------------------| | Thinking is a learned process so is UNIX | |--------------------------------------------| Henry R. Linneweh

4 3

NON-OP: Paintball and BBQ Outing Sunday B4 NANOG 18
by William B. Norton 20 Jan '00

20 Jan '00

Hi all - I've reserved the WoodStalk paintball field down in Santa Cruz for folks who are interested playing paintball *Sunday* Feb 6th (before NANOG) If previous paintball outings are any indication, it should be a blast! I can only take about 20 or so people, so in fairness I'll take folks on a first-come first-serve basis. The Game: For those who haven't played before, the basic paintball game is Capture the Flag but with paint ball guns. Once shot you are out of that 20 minute game. Logistics: To avoid car issues I have reserved transportation that will pick us up at 10:30AM sharp on Sunday at the Doubletree and take us to the field, returning us to the Doubletree around 3:30 or so. We'll fire up a BBQ for hamburgers, hot dogs, etc. The cost is $30 per person and I'll need to get a check/credit card deposit to hold spaces (sorry, otherwise the cancellation issues creep in). First time players are welcome: see http://www.woodstalk.com for details (you should bring a headband, hat, change of clothes, towel, etc.) If you want to reserve a spot, send me private e-mail. Invite people you'd like to shoot ;-) We'll fire up the burgers when we arrive and start the games at high noon. Hope to see you there - Bill

1 0