- NANOG - lists.nanog.org

Re: Tool for automatically educating smurf amplifiers ...
by Richard Thomas 07 Jul '98

07 Jul '98

-----Original Message----- From: Doug McLaren <dougmc(a)feeding.frenzy.com> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Monday, July 06, 1998 3:06 PM Subject: Tool for automatically educating smurf amplifiers ... >Lately one of our machines has been the target of several smurf >attacks (no idea why, probably some user kicked off an IRCer from >their channel or something equally silly) and so I set out to email >each of the sites used as smurf amplifiers ... > >I couldn't find any sort of tool to do this for me, so I wrote one. > >It's certainly still needs some work, but I think it'll be useful in >it's current condition to anybody else who's tried to do this. > >If we can notify the smurf amplifiers that they're being abused and >let them know what they need to do to fix it, maybe we can make smurf >attacks a thing of the past (or at least less effective, as the >smurfers will have to look harder to find good amplifiers.) > >In any event, you can get my program at : > > http://www.frenzy.com/~dougmc/smurf-complain.pl > >There's lots of room for improvements, so if you have some changes, by >all means send them to me. > >It uses `ipw' to get contact information. If you don't have `ipw', >get it from : > > http://www.e-scrub.com/ipw > >Also, while you may wish to use `tcpdump' or look at your router's >logs to see where the ICMP echo reply packets were coming from, I was >using icmpinfo, which you can get from : > > http://hplyot.obspm.fr/~dl/icmpinfo.html > >So far, after running the program once and sending out about 50 >emails, I've gotten about 17 bounces and about 15 emails saying >they'll fix or have fixed their routers, and two or three emails >asking for details or a more clear explanation ... fairly promising. Not to toot my own horn but you might wanna try using a little proggy I wrote called SmurfLog, available at http://www.sy.net/security. It only records echo replies from unique /24's, preventing the few gig logfiles that you can get from icmpinfo.

1 0

Tool for automatically educating smurf amplifiers ...
by Doug McLaren 06 Jul '98

06 Jul '98

Lately one of our machines has been the target of several smurf attacks (no idea why, probably some user kicked off an IRCer from their channel or something equally silly) and so I set out to email each of the sites used as smurf amplifiers ... I couldn't find any sort of tool to do this for me, so I wrote one. It's certainly still needs some work, but I think it'll be useful in it's current condition to anybody else who's tried to do this. If we can notify the smurf amplifiers that they're being abused and let them know what they need to do to fix it, maybe we can make smurf attacks a thing of the past (or at least less effective, as the smurfers will have to look harder to find good amplifiers.) In any event, you can get my program at : http://www.frenzy.com/~dougmc/smurf-complain.pl There's lots of room for improvements, so if you have some changes, by all means send them to me. It uses `ipw' to get contact information. If you don't have `ipw', get it from : http://www.e-scrub.com/ipw Also, while you may wish to use `tcpdump' or look at your router's logs to see where the ICMP echo reply packets were coming from, I was using icmpinfo, which you can get from : http://hplyot.obspm.fr/~dl/icmpinfo.html So far, after running the program once and sending out about 50 emails, I've gotten about 17 bounces and about 15 emails saying they'll fix or have fixed their routers, and two or three emails asking for details or a more clear explanation ... fairly promising. -- Doug McLaren, dougmc(a)frenzy.com Unsolicited email of a commercial or advertising nature is not welcomed.

1 0

Re: MTU problems with GRE tunnels (fwd)
by brandon＠rd.bbc.co.uk 06 Jul '98

06 Jul '98

> # it seems that there is a small but significant > # amount of application traffic out there that has problems when traversing a > # GRE tunnel with MTU < 1500. We've seen two problems: > # > # - 1500 byte packets with DF set. This is either application traffic, or MTU > # path discovery is broken, because the same packets get sent repeatedly We see the same effect, if anyone wants a site to test against try one of ours - news.bbc.co.uk (193.130.149.130) This is a set of NT servers behind an RND Director, and we've found you never get past MTU discovery (though oddly if you go straight to an individual machine address, e.g. 193.130.149.131 it does work. The only client verified is IE4 on Win95. We were working on the NT stack as the probable cause (MTU black hole discovery defaults to off) Brandon

1 0

Thanks to all re: cflowd and IOS stuff
by John M. Brown 05 Jul '98

05 Jul '98

Looks like I got it to finally work! :) Just for the record. 11.1(19) CC1 Enterprise is what is needed if you want ISL, BGP, IP, and working flow-export stuff. lets hope that cisco will get this into a IP only release someday. I really hate wasting memory on SNA kaka I don't need. jmbrown

1 0

Follow-on ?? to Cisco IOS ver and clfowd
by John M. Brown 05 Jul '98

05 Jul '98

Ok, I am blue in the face now... Is there a cisco release naming / feature expert in the house ??:) What version of IOS properly supports IP, BGP, NAT, ISL and NetFlow where ALL of this stuff works. I tried 11.1(18)CC it has the Netflow stuff but ISL is broken arggggg jmbrown(a)ihighway.net

3 2

AS 7777 Flapping, any one know why
by John M. Brown 05 Jul '98

05 Jul '98

My BGP alarms have been going of all nite long. AS 7777 is going up and down like crazy. Other peering sessions are stable with us. jmbrown(a)ihighway.net

1 0

cflowd / IOS ver question
by John M. Brown 05 Jul '98

05 Jul '98

Ok so we just got a new 7206 to play with and I want to try out the cflowd stuff. The problem I have is that the version of IOS 11.2(12)p doesn't have the ip flow-export {various commands} command. It only has the ip flow-export A.B.C.D udp-port command So did we get the right version, is there something missing that I need to get??? Any help would be great.... Even when I just use this version of the command I don't get any packets on the udp-port / host that I specify. Mr. Sniffer doesn't show anything at all......... jmbrown(a)ihighway.net

6 5

AS3447 flapping?
by Jon Lewis 04 Jul '98

04 Jul '98

Is it my imagination, or is AS 3447 flapping lots of its routes this evening? Anyone know what's up? ------------------------------------------------------------------ Jon Lewis <jlewis(a)fdt.net> | Spammers will be winnuked or Network Administrator | drawn and quartered...whichever Florida Digital Turnpike | is more convenient. ______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key____

2 1

The Cidr Report
by Tony Bates 03 Jul '98

03 Jul '98

This is an auto-generated mail on Fri Jul 3 12:00:00 PDT 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 03Jul98 0) General Status Table History ------------- Date Prefixes 190698 51379 200698 51329 210698 51500 220698 51541 230698 51362 240698 51537 250698 51460 260698 51523 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 2703 Number of ASes announcing only one prefix: 828 (0 cidr, 828 classful) Largest number of cidr routes: 0 announced by Largest number of classful routes: 1145 announced by AS701 1) Gains by aggregating at the origin AS level --- 03Jul98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS4293 452 247 205 45.4% IMCI AS2493 488 283 205 42.0% iSTAR Internet, Inc. AS3602 511 313 198 38.7% Sprint Canada Inc. AS701 1145 950 195 17.0% Alternet AS271 336 145 191 56.8% BCnet Backbone AS3749 218 70 148 67.9% TECNET AS174 725 587 138 19.0% Performance Systems International AS4755 106 32 74 69.8% Videsh Sanchar Nigam Ltd. India AS3218 78 7 71 91.0% AS-RSSI AS7046 218 148 70 32.1% UUNET-CUSTOMER AS3221 112 42 70 62.5% EENet Autonomous System AS6227 96 28 68 70.8% !nteract AS10928 107 42 65 60.7% UNKNOWN AS5668 116 54 62 53.4% Century Telephone Inc. AS3804 208 146 62 29.8% Bell Solutions AS4740 382 328 54 14.1% ASN-OZEMAIL (Ozemail Pty Ltd) AS3403 180 127 53 29.4% TIAC AS2685 133 83 50 37.6% IBM Global Network - US AS549 194 145 49 25.3% ONet Backbone AS8517 120 72 48 40.0% ULAKNET-ASN AS72 85 37 48 56.5% Schlumberger Information Network AS6335 68 20 48 70.6% NTRNET AS4539 73 25 48 65.8% NETROPOLIS AS4200 145 97 48 33.1% AGIS (Apex Global Information Ser AS1239 543 496 47 8.7% SprintLink Backbone AS719 449 405 44 9.8% LANLINK autonomous system AS852 158 116 42 26.6% AGT Advance Communication AS762 118 80 38 32.2% WELLFLEET-AS AS6181 65 28 37 56.9% FUSE-NET AS4763 109 72 37 33.9% Telstra New Zealand For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Fwd: SBN Wire: Security Bulletin (WAS: Re: Aside: ability to view ASP/ColdFusion code )
by Eric Germann 03 Jul '98

03 Jul '98

> >*** Microsoft (R) Site Builder Network *** > >This is special edition of the SBN Wire is to inform our >membership of a recent security issue that pertains to >Microsoft Internet Information Servers. Please see the >Security Bulletin below for details. > >The latest information on this matter can be found on >http://www.microsoft.com/security. > >The SBN Team > >------------------ > >MICROSOFT SECURITY BULLETIN (MS98-003) > >Hotfix available for the Microsoft Internet Information >Server file access issue >Last revision: July 2, 1998 > >SUMMARY >Recently Paul Ashton reported an issue on the NTBugtraq >mailing list (http://www.ntbugtraq.com) that affects >Microsoft Internet Information Servers (IIS). Web clients >that connect to IIS can read the contents of files to which >they have execute and read only permissions. These files >have to be in a web server v-root directory and on an NTFS >volume. > >The purpose of this bulletin is to inform Microsoft >customers of this issue, its applicability to Microsoft >products, and the availability of countermeasures Microsoft >has developed to further secure its customers. > >ISSUE >The native Windows NT file system, NTFS, supports multiple >data streams within a file. The main data stream, which >stores the primary content has an attribute called $DATA. >Accessing this NTFS stream via IIS from a browser may >display the script code for the file. > >The issue is a result of the way IIS parses filenames. The >fix involves IIS supporting NTFS alternate data streams by >asking Windows NT to canonicalize the filename. > >For the problem to occur the user must: > >1) Know the name of the file >2) The ACLs on the file must allow some access (i.e. read >and execute access) >3) The file must reside on an NTFS partition > >The user cannot view files on which the ACLs are set to >deny all access. > >For more information on NTFS Alternate Data Streams please >see Microsoft Knowledge Base article Q105763. > >AFFECTED SOFTWARE VERSIONS >Microsoft Internet Information Server version 3.0 and 4.0 > >MORE INFORMATION >Please see Microsoft Knowledge Base article Q188806 for >more information. > >WHAT MICROSOFT IS DOING >The Microsoft Product Security Response Team has produced a >hotfix for Microsoft Internet Information Server version >3.0. > >Microsoft is currently testing a hot fix for Internet >Information Server version 4.0 which will be posted later >today. > >WHAT CUSTOMERS SHOULD DO >Microsoft strongly recommends that customers using IIS >version 3 and 4 should apply the hotfix. > >IIS 3.0 (Intel x86) hotfix - >ftp://ftp.microsoft.com/bussys/IIS/iis- >public/fixes/usa/security/iis3-datafix/iis3fixi.exe > >IIS 3.0 (Alpha) hotfix - >ftp://ftp.microsoft.com/bussys/IIS/iis- >public/fixes/usa/security/iis3-datafix/iis3fixa.exe > >IIS 4.0 hotfix - This will be released later today > >More information on obtaining the hotfix can be found in >Microsoft Knowledge Base article Q188806 > >ADMINISTRATIVE WORKAROUND >Customers who cannot apply the hot fix can use the >following workaround to temporarily address this issue: > >Make the following additions to the Application Map in >IIS4: > >The steps to perform this are: >* Open the Microsoft Management Console >* Right click on the Virtual Server in question >* Select Properties >* Select the Home Directory tab >* Select Configuration > >Now add each of the entries noted below: > >.idc::$DATA >.stm::$DATA >.asp::$DATA >.asa::$DATA >.shtm::$DATA >.shtml::$DATA >.pl::$DATA > > >In addition, the following practices can help to further >improve security for your IIS servers: >* Periodically review the users and groups who have access >to the web server: Review the users and groups and their >permissions to ensure that only valid users have the >appropriate permissions. > >* Use auditing to detect for suspicious activity: Apply >auditing controls on sensitive files and review these logs >periodically to detect suspicious or unauthorized behavior. > > >REVISIONS >July 2, 1998: Bulletin Created > >For additional information on security issues at Microsoft, >please visit www.microsoft.com/security > >THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS >PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT >DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, >INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR >A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT >CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES >WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, >CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, >EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN >ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO >NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR >CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING >LIMITATION MAY NOT APPLY. > >Copyright 1998 Microsoft and/or its suppliers. All rights >reserved. For Terms of Use see: >http://support.microsoft.com/support/misc/cpyright.asp > ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert, OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

1 0