- NANOG - lists.nanog.org

Some abuse detection hacks...
by Avi Freedman 26 Feb '98

26 Feb '98

I was trying to track down some extra traffic we were seeing across a FDDI XP. Downgrading to 11.1.?? or whatever that supports cflowd with the right flow-export verion wasn't a quick option. So I wrote a little program... But first, an even quicker hack: Step (1) grab 'sho ip cache flow' output on the router to a file. Then: % grep "^Fd4/1/0" flow | grep " Fd4/1/0 " | more Will show you all flows (w/ source and dest IP, of course) which came in and went out your FDDI. If someone's defaulting to you, this should actually catch it. But to be more thorough, also grab your transit routes (for us it's 'sho ip bgp community-list 4') to a file. Then run the following little perl program. It'll spit out lines of flows that came in your Fddi interface destined to IPs that you're not transitting. Also, set the $srcif variable below to the appropriate value for your router. If I feel frisky I'll spend a few minutes and integrate chat2.pl stuff so you don't have to grab the data by hand - or someone else is welcome to... Avi --------------------- #!/usr/local/bin/perl # By Avi Freedman/Net Access (freedman(a)netaxs.com) 2/26/98 # Do with as you will. # Expand $cidrtable if you announce routes < /16. # Don't run with routes < /13 unless you have lots of time and swap space. # Put your transit routes in ./routes. # Put your 'sho ip cache flow' output in ./flow. # Set $srcif - it must be the EXACT way it's represented in the flow output. $srcif = "Fd4/1/0"; $cidrtable{16} = 256; $cidrtable{17} = 128; $cidrtable{18} = 64; $cidrtable{19} = 32; $cidrtable{20} = 16; $cidrtable{21} = 8; $cidrtable{22} = 4; $cidrtable{23} = 2; open(IN, "routes"); while (<IN>) { $new = substr($_, 3, 100); if ($new =~ /\//) { # set cidr routes if ($new =~ /^(\d*)\.(\d*)\.(\d*)\.0\/(\d*)/) { for ($i = $3; $i < $3 + $cidrtable{$4}; $i++) { $ok{"$1.$2.$i"} = 1; } } } else { if ($new =~ /^(\d*)\.(\d*)\.(\d*)\.0/) { # set an individual /24 unless it ends in ".0.0" - we should do better if ($3 != 0) { $ok{"$1.$2.$3"} = 1; } else { for ($i = 0 ; $i < 256 ; $i++) { $ok{"$1.$2.$i"} = 1; } } } } } close(IN); open(IN, "flow"); while (<IN>) { ($src, $srcip, $dst, $dstip) = split(' ', $_); if ($src eq $srcif && $dstip =~ /^(\d*)\.(\d*)\.(\d*)\.(\d*)$/) { if (!$ok{"$1.$2.$3"}) { print $_; } } }

1 0

Managing allocatiions out of a CIDR block
by Mark Prior 26 Feb '98

26 Feb '98

I am trying to rewrite the system that we use to allocate blocks from our provider blocks to customers. Previously the smallest block we allocated was a class C and so this process was pretty easy but now I want to be able to optimally use our allocations and allocate blocks down to a /30. Does anyone have any ideas, or code, that will manage multiple CIDR blocks and keep track of the currently unused parts of the block and given a requirement find an appropriate allocation (while not fragmenting it like crazy). It would be also useful if it could collect together POP specific blocks so that, for example, two parts of the same class C were at the same POP. Ideas, suggestions? Thanks, Mark.

4 4

Data Collect Request
by pdmcdan＠eecs.umich.edu 25 Feb '98

25 Feb '98

To whom it may concern, Dr. Sugih Jamin and myself (Patrick McDaniel) of the University of Michigan are currently studying the load characteristics of a potential Internet sized key distribution system. Because of the limited amount of these kinds of systems, we are using DNS traffic to model the expected usage. To continue this study, we are in need of DNS traffic traces collected from a wide range of networks. The purpose of this post is to ask for your assistance in this effort. We provide a script for collecting this data. This script will: 1) Automatically collect traces from the named process over a 24 hour period. 2) "Anonymize" all the data collected. No domain or host names will appear in the traces after they have been filtered by the downloaded script. At your request, we will not divulge the source of the trace in any resulting publications. We have submitted a initial version of the study to SIGCOMM 98'. The submission paper is available in at: http://www.eecs.umich.edu/~pdmcdan/docs/keyhier.ps.gz The script used for collecting the data is available at: http://www.eecs.umich.edu/~pdmcdan/automated-dns Instructions for script usage: 0. Login to the authoritative domain name server for your network. (note that you will need to perform this as root) 1. Copy the downloaded automated-dns script to the /var/tmp directory. 2. CD to /var/tmp 3. Run the script with the following arguments: automated-dns <boot file> <named pid> <output-file> Where: boot file : is boot file for DNS server named pid : process ID of named output file : file to output trace information eg. % automated-dns 517 ./dns-trace 4. The script will ask you to confirm the PID of the named process. 5. The script will ask for the signal numbers of the SIGUSER1 and SIGUSER2 signals for your system. This information should be available on the man page for signal (section 7 on Linux, section 5 on SunOS 5.5.1, signals 16 and 17 are most likely correct) 6. The script should execute for 24 hours, then "anonymize" the trace and write results to the output file. 7. Email the output file or contact me to exchange the data. Please include as much information as you can about the size and type of network on which the traces were collected. My email address is: pdmcdan(a)eecs.umich.edu Thanks for your time. If you have any questions, please feel free to contact me through email. If you run into any problems, I will be more than happy to help. Thanks, Patrick McDaniel ---- Patrick McDaniel University of Michigan Office : 3115 EECS Building [ \/ ] Office Phone : (313) 647-3780 ][\/][ Email : pdmcdan(a)eecs.umich.edu [__][__]

1 0

Internic busted
by William Allen Simpson 25 Feb '98

25 Feb '98

If you are happy with the proposal that NSI continue to be the monopoly registrar, for an extra 2 years, then do nothing. Otherwise, perhaps you would be willing to send _your_ anecdotal experience to someone that could do something about it: your government minister, your US Congressional Representative or Senator, or the persons that schedule hearings on these matters. If a US person or company, you might want to send a short note ASKING for the House Science committee (probably the technology sub-committee) to meet to review the NSF/NSI imbroglio, or ASKING for the House Commerce committee to review the Magaziner proposed Rule. Here are the general contacts: James Sensenbrenner Science Committee 2320 Rayburn Washington DC 20515 Connie Morella Science Technology sub-committee 2319 Rayburn Washington DC 20515 Thomas Blyley Commerce Committee 2125 Rayburn Washington DC 20515 John Dingell Commerce Committee 2125 Rayburn Washington DC 20515 WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

2 1

Re: circuits in WVA?
by William Allen Simpson 25 Feb '98

25 Feb '98

> From: Jeremiah Kristal <jeremiah(a)fs.IConNet.NET> > Has anyone had any recent luck provisioning circuits into West Virginia? > I have been trying to order two DS-3s and haven't been able to find any > IXCs that can do it. Is there really no capacity whatsoever into WVA or > am I just not talking to the correct people? Have had similar problems into another rural state (Mississippi). But the problem is not limited to rural, I heard that Merit could not get another DS3 up to Ann Arbor Michigan for over 9 months last year. I found that the problem is not actually lack of capacity, but rather that they want to sell you their enhanced services instead of raw bandwidth. And it has gotten worse (at least in MS) with the merger of LDDS and WilTel and MCI and their grandmother. Nowhere left to turn. We've been looking into leasing microwave, or leasing tower space and putting in spread spectrum, and maybe filing as a CLEC. All much harder than we'd like.... WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

1 0

Spam which is designed to crash POP and many mail readers...
by Barry Shein 24 Feb '98

24 Feb '98

[More proof that these "spammers" aren't selling anything, they're just garden-variety petit criminals trying to disrupt the internet...] Anyhow, has anyone else seen this recent spate of spam which is basically designed to crash POP and Netscape and other programs in the past few days? It's not you, they've found "from" addresses which cause problems, the usual first symptom is a bunch of people complaining about "stuck" POP locks or problems with Netscape, elm and other mail readers. [Oh yeah I'm suuuurrrre these are just "honest" business people, who just don't want anyone to be able to read their ads...] BTW, they really do look mostly like legitimate ads, albeit for your typically questionable products (stop smoking herbs or something like that.) These so-called spammers are laughing their asses off at us. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.std.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo*

7 10

circuits in WVA?
by Jeremiah Kristal 24 Feb '98

24 Feb '98

Has anyone had any recent luck provisioning circuits into West Virginia? I have been trying to order two DS-3s and haven't been able to find any IXCs that can do it. Is there really no capacity whatsoever into WVA or am I just not talking to the correct people? I'm not looking for a cheap solution, or even an elegant solution at this time, I just need to get these circuits ordered. (Any telco vendors lurking, here's your chance.) Jeremiah Kristal Senior Network Engineer ICon CMT Corporation jeremiah(a)iconnet.net 201-319-5764 x284 internal

1 0

[ralphs@halcyon.com: Your e-mail re: ' Re: How to document threats from pro or anti spam terrorists? ']
by dirk＠power.net 24 Feb '98

24 Feb '98

This is not a bad idea at all. Dirk -----Forwarded message from Ralph Sims <ralphs(a)halcyon.com>----- Return-Path: <ralphs(a)mail1.halcyon.com> Delivered-To: dirk(a)hermosa.power.net Received: (qmail 21349 invoked from network); 24 Feb 1998 05:08:23 -0000 Received: from mail1.halcyon.com (206.63.63.40) by hermosa.power.net with SMTP; 24 Feb 1998 05:08:23 -0000 Received: (from ralphs@localhost) by mail1.halcyon.com (8.8.8/8.8.8) id VAA00061; Mon, 23 Feb 1998 21:08:15 -0800 (PST) Date: Mon, 23 Feb 1998 21:08:15 -0800 (PST) From: Ralph Sims <ralphs(a)halcyon.com> Message-Id: <199802240508.VAA00061(a)mail1.halcyon.com> To: dirk(a)hermosa.power.net References: <19980221151858.32518(a)hermosa.power.net> <Pine.GUL.3.96.980223125859.3575A-100000(a)nfs1.halcyon.com> <19980223210748.55151(a)hermosa.power.net> In-Reply-To: <19980223210748.55151(a)hermosa.power.net> Precedence: junk X-Loop: gzornanplatz(a)halcyon.com Subject: Your e-mail re: ' Re: How to document threats from pro or anti spam terrorists? ' This is to acknowledge I have received your message. If your e-mail is regarding Northwest Nexus operations or relates to company inquiries and might be better handled by someone else on our staff, I will forward it for you; please be assured that I do read all non-spam e-mail I receive. If you do not receive a timely response or a satisfactory resolution, please let me know. This message is returned to each address from which I receive e-mail only once during a one-month period beginning on the 27th of each month. Useful e-mail addresses to keep on file: support(a)nwnexus.com - for urgent issues, please phone billing(a)nwnexus.com - accounts receiveable and payable, etc. sales(a)nwnexus.com - information on our services abuse(a)nwnexus.com - system abuse, "SPAM", etc. by our customers security(a)nwnexus.com - system and network security issues postmaster(a)nwexus.com - e-mail delivery problems and related issues http://www.nwnexus.com - who we are and what we do http://webfaq.halcyon.com - our FAQ (Frequently Asked Questions) server ftp.halcyon.com - our public file server (via anonymous FTP or HTTP) Ralph Sims, Vice President (Research and Development) Northwest Nexus, Inc. 10800 NE 8th Street, Suite 802 Bellevue, WA 98004 425.455.3505 or +1.888.696.3987 (ext. 227); +1.425.455.4672 (FAX) -----End of forwarded message-----

1 0

Re: How to document threats from pro or anti spam terrorists?
by Sean Finn 23 Feb '98

23 Feb '98

At 12:57 PM 2/23/98 -0500, Barry Shein wrote: > > There really are two terrorist groups here. Spammers and > > nti-Spammers. > >That's like saying people defending their properties are as bad as >people they're defending against, that's moral confusion. When an 'anti-spammer' compromises net access for a group of people as a response to percieved "net abuse" on the part of a single member of that group, that's a denial of service. The phrase 'using violence to prevent violence' comes to mind. (I wouldn't say that my government uses 'moral confusion' to justify it's practices, but ... ;) ------ This *is* an important, and troubling subject ... ... but it's my intuition that nanog might not be the place for this particular debate. (suggestions for a more appropriate forum?) cheers -- Sean

3 2

Problems reaching Texas Higher Education (the.net)
by Larry Vaden 23 Feb '98

23 Feb '98

Can anyone else confirm difficulty reaching hosts on the.net, e.g., mims.utdallas.edu. Our customer reports a several day outage. Thanks, Larry

3 2