- NANOG - lists.nanog.org

known networks for broadcast ping attacks
by Edward Henigin 12 Aug '97

12 Aug '97

Here's a list of KNOWN NETWORKS that are being used to ping flood other networks. If one of your networks is in here, FILTER BROADCAST PINGS NOW FROM ENTERING YOUR NETWORK. YOUR NETWORK IS BEING USED TO ATTACK OTHER NETWORKS. In my original e-mail, I noted that I suspected that there was a list of known networks that could be used to attack other networks. It appears my suspicion has been validated. This is from source code for 'smurf.c', which is used to generate the ICMP broadcast pings, as I described in an earlier e-mail to this mailing list. -----Forwarded message----- /* * * smurf.c by TFreak [21:52 - 07/28/97] * * spoofs icmp packets from a host to various broadcast addresses resulting * in multiple replies to that host from a single packet. * * mad head to: * nyt, soldier, autopsy, legendnet, #c0de, irq for being my guinea pig, * MissSatan for swallowing, napster for pimping my sister, the guy that * invented vaseline, fyber for trying, knowy, old school #havok, kain * cos he rox my sox, zuez, toxik, robocod, Bug_Lord, and everyone else * that i might have missed (you know who you are). * * mad anal to: * #madcrew/#conflict for not cashing in their cluepons, EFnet IRCOps * because they plain suck, Rolex for being a twit, everyone that * trades warez, Caren for being a lesbian hoe, AcidKill for being her * partner, #cha0s, sedriss for having an ego in inverse proportion to * his penis and anyone that can't pee standing up. * * disclaimer: * I cannot and will not be held responsible nor legally bound for the * malicious activities of individuals who come into possession of this * program and refuse to provide help or support of any kind and do NOT * condone use of this program to deny service to anyone or any machine. * This is for educational use only. Please Don't abuse this. * */ [.. code deleted... EJH ] /* add your own broadcast ips, just make sure to end with NULL */ char *bcastaddr[] = { "206.154.141.255", "165.154.1.255", "205.139.4.255", "198.3.101.255", "204.71.177.255", "255.255.255.255", "207.137.200.255", "192.41.177.255", "206.13.28.255", "144.228.20.255", "206.137.184.255", "192.41.177.255", "206.154.141.255", "165.154.1.255", "206.13.28.255", "129.16.1.0", "198.32.186.255", "205.206.120.255", "206.186.21.255", "204.212.36.255" "149.142.13.255", "208.132.231.255", "129.82.103.255", "130.63.236.255" "130.113.64.255", "198.53.145.255", "205.211.8.255", "204.186.99.255", "208.131.162.255", "130.132.143.255", "128.135.181.255", "204.162.96.0", "205.180.58.255", "206.86.0.255", "128.2.72.255", "199.227.0.255", "199.103.128.255", "208.218.130.255", "208.150.60.255", "206.26.128.255", "199.0.65.255", "207.69.200.255", "207.228.64.255", "204.247.0.255", NULL }; [.. code deleted... EJH ] -----End of forwarded message-----

16 26

Re: Packet size data
by brett watson 11 Aug '97

11 Aug '97

> Hi, > Does anyone have any /recent/ information on the breakdown of packet sizes > crossing the net right now? I have seen some of the older data, but am > interested in whether or not the percentages are changing over time, and if > so, how. I.e. I could see people moving from interactive services such as > telnet for reading mail and news to going to a client based system would up > the packet sizes. Likewise, the use of some of the streaming video and > audio applications out there might lower it again. In my mind, recent is > anything that has been done in the last 6 months or so. i can't give you historical data but here's current netflow data from our mae-west (san jose, not nasa/ames) and mae-east peer routers: peer1.sjc1#sh ip ca fl IP packet size distribution (9577M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .001 .500 .032 .013 .016 .009 .009 .009 .020 .017 .006 .009 .009 .007 .003 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .008 .004 .088 .042 .188 .000 .000 .000 .000 .000 .000 peer1.wdc1#sh ip ca flow IP packet size distribution (12535M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .000 .646 .045 .010 .010 .005 .006 .005 .015 .013 .015 .009 .005 .005 .003 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .003 .006 .095 .014 .078 .000 .000 .000 .000 .000 .000 i guess everyone is pinging these days :) -brett

1 0

Re: Backup Power Schemes
by Tony Li 11 Aug '97

11 Aug '97

> That takes us back to UPSi on equipment, and generators. Technologies > available are: > .... Don't forget cogeneration equipment. One would think that local power, UPS, and one flavor of generator should suffice. For the "reasonable". ;-) Tony

3 2

Packet size data
by Justin W. Newton 11 Aug '97

11 Aug '97

Hi, Does anyone have any /recent/ information on the breakdown of packet sizes crossing the net right now? I have seen some of the older data, but am interested in whether or not the percentages are changing over time, and if so, how. I.e. I could see people moving from interactive services such as telnet for reading mail and news to going to a client based system would up the packet sizes. Likewise, the use of some of the streaming video and audio applications out there might lower it again. In my mind, recent is anything that has been done in the last 6 months or so. ************************************************************** Justin W. Newton voice: +1-415-482-2840 Senior Network Architect fax: +1-415-482-2844 PRIORI NETWORKS, INC. http://www.priori.net Legislative and Policy Director, ISP/C http://www.ispc.org "The People You Know. The People You Trust." **************************************************************

1 0

Inverse Networks releases new ISP performance results
by Hank Nussbacher 11 Aug '97

11 Aug '97

http://www.inverse.net/news/pr_07-22-97.html -Hank

2 1

ARIN now accepting applications for membership
by Kim Hubbard 11 Aug '97

11 Aug '97

The American Registry for Internet Numbers (ARIN) is now accepting applications for membership. ARIN is a membership-based organization that will help determine IP allocation policy now and in the future. Be part of this process by becoming a member today. Take advantage of this opportunity to participate. ARIN is open to new members now! Join at http://www.arin.net/members/appform.html. ARIN is also asking for recommendations for the initial Advisory Council. All recommendations received by September 5, 1997 will be considered. If interested, please complete the AC form located at http://www.arin.net/members/adform.html. Kim

1 0

DoS
by Alex Rubenstein 11 Aug '97

11 Aug '97

A downstream customer of ours is under a systemic DoS attack. Spoofed ICMP is headed for 207.99.73.206 at this time. If any of your Northern American Network Operators (read, NSPs) could possibly do whatever it is you do to attempt to track this down, NAC would be most appreciative. NAC Office: 973.366.3000 Alex @ home : 973.366.9001 Thanks.

1 0

New Equipment - Anybody try'em?
by Douglas Jardine 10 Aug '97

10 Aug '97

Hi, Are there Net operators of large corporations or ISPs who have had a chance to evaluate new network equipment released over the last year? I know from previous postings that ISPs have started using the GRF with reasonable success. Anybody out these using Ipsilons IP switches? The way I understand these, they have (fast)ethernet and ATM (at OC-3 rates) ports available and can do RIP and OSPF making them suitable for Interior Routing. I am not sure if they support BGP or for that matter if the IP switch concept would scale (in terns of VCIs needed) to full fledged ISP load. Also is anybody out there trying to build backbones out of all the new Gigabit ethernet gear being announced? At first glance, it seems to me that these layer 2/3 products are capable of Interior routing, besides switching at mosnstrous speed. Would greatly appreciate any first hand experience. TIA. -dj ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

3 2

Backup Power Schemes
by Eric Osborne 09 Aug '97

09 Aug '97

OK, let's see if we can turn this thread from BBN-bashing into something a bit more constructive. I've seen several posts in the past few days concerning optimal power backup strategies, both short and long term (battery, diesel, and/or nuclear). Anybody out there care to share your strategies? eric

3 3

RE: Nuclear power for POPs
by Rodney Joffe 09 Aug '97

09 Aug '97

H'mmmm I wonder if we might bid on the construction portion... we have a little experience :-) Rodney Joffe Genuity Inc., a Bechtel company http://www.genuity.net > -----Original Message----- > From: John Curran [SMTP:jcurran@bbnplanet.com] > Sent: Friday, August 08, 1997 1:09 PM > To: William Duncanson > Cc: nanog(a)merit.edu > Subject: Nuclear power for POPs > >Sign me up! I want one of these in my back yard. I figure I could > >probably run the whole block off of one of these. > > It may soon be necessary to include one of these in each POP, > given notable vendors increasing power demands... > > Chris, can you do 23" open rack designs? > > ;-) > /John > >

2 1