April 1997 - Test - lists.nanog.org

Re: SNMP probers
by Daniel McRobb 09 Apr '97

09 Apr '97

> Randy, > > >What do folk do about persistent SNMP probers? I.e. j random clueless sites > >which keep querying one's backbone router(s). E.g. this morning I get the > >NOC shift change report with the folk hammering on our routers as if we were > >stupid enough to use 'public' as the community string. > > The problem isn't so much stupid people as stupid default settings on some > network tools. A lot of software exists for the "enterprise" network > market. Apparently, the designers of this software don't realize that most > enterprise IP networks touch the larger, fully connected Internet. The > default settings on half a dozen products I've personally used default to > trying to discover the entire Internet on startup. > > I learned this the hard way a few years back. Every night before going > home, I'd re-boot a network monitoring station, which would crash during the > night. The station was crashing somewhere in the middle of the discovery of > net 18. After the third or fourth attempt at discovering net 18, I got a > phone call from MIT, and realized why my network monitoring station was > crashing. (whoops) > > Things got really interesting when I called up the manufacturer. I asked > them to please help me stop this software discovery process. Took me half > an hour of explaining to convince them that discovering the entire Internet > wasn't in the best interest of their customers. Took a new version to > really stop this "feature". > > >So every day some poor NOC person has to search these folk down with the > >great tools we have, send email, get told they're nazi idiots, ... > > > >So what do folk do about this? > > Educate, then assassinate. > > > Seriously, I think some education is needed for the proliferating > manufacturers of lower end IP management tools. All of a sudden, there are > a lot of IP monitoring products out there. Most all of our customers are > running some sort of tool to check the status of their LAN workstations, > etc. We've been having to educate almost every new customer lately. > > Maybe denying some TCP socket at the border router level would stop a lot of > this? > > Regards, > > Bill I wouldn't really blame this on the NMS vendors as much as the lack of standardized topology information in standard MIBs. The NMS products use the brute-force method for a reason... there's little else available (there's nothing available in many products; MIB-II is (unfortunately) often the only thing you can really count on across products. Its sort of like a discussion here a few months ago about how useless traceroute can be (though I really would not like to open up that discussion here again). I do agree that you can throttle it so it doesn't run amok, and users shouldn't need to run it often (unless their own network's topology is changing a lot). Daniel ~~~~~~

1 0

Re: Not to be alarmist...
by Jason Fesler 09 Apr '97

09 Apr '97

At 02:59 PM 4/9/97 -0400, Todd Graham Lewis wrote: >but has anyone else noticed that AOL's mail servers have been down for, >ohh, two days now? Does this count as a "severe outage"? I'm having to make special runs in order to get AOL delivered. I'm doing a sendmail -qRaol.com every 30 minutes right now. I'm still getting a handful of 4-hour warnings, but many are getting through. -- Jason Fesler jfesler(a)calweb.com 'whois jf319' | "Time is an illusion; Admin, CalWeb Internet Services www.calweb.com | lunchtime, doubly so." Junk email returned in bulk; 1 cc to your postmaster | -Ford Prefect in HHGTTG Junk mail probs? http://www.gigo.com/junkmail.htm | by Douglas Adams

1 0

Re: Not to be alarmist...
by Richard Colella 09 Apr '97

09 Apr '97

TOdd, Could you be more specific? I've been getting mail in and out of AOL just fine, both via aol.com and via aol.net. --Richard On Apr 9, 2:59pm, Todd Graham Lewis wrote: > Subject: Not to be alarmist... > but has anyone else noticed that AOL's mail servers have been down for, > ohh, two days now? Does this count as a "severe outage"? > > __ > Todd Graham Lewis MindSpring Enterprises tlewis(a)mindspring.com >-- End of excerpt from Todd Graham Lewis --

4 3

Re: Not to be alarmist...
by Len Rose 09 Apr '97

09 Apr '97

Some of their servers are working, though we still see tremendous backlogs.. This is what I heard from Michael Truman: # begin inclusion From: "Mike T." <pmd7(a)aol.net> Sender: pmd7(a)zipcode.atg.aol.com To: Len Rose <len(a)netsys.com> Subject: Re: Test On Tue, 8 Apr 1997, Len Rose wrote: > > What the hell happened to your mail servers? > Len, We were having some problems with them yesterday, but they're working today. Thanks fot taking the time to tell us about it. Thanks, Have a good one, ********************************************************************* *Michael Truman postmaster(a)aol.net *Assistant Postmaster pmd7(a)aol.net *America Online, Inc. *Postmaster Services--Internet Development and Outreach Technology ******************************************************************* # end included At 02:59 PM 4/9/97 -0400, Todd Graham Lewis wrote: >but has anyone else noticed that AOL's mail servers have been down for, >ohh, two days now? Does this count as a "severe outage"? > >__ >Todd Graham Lewis MindSpring Enterprises tlewis(a)mindspring.com > > len(a)netsys.com http://www.netsys.com

1 0

Re: SNMP probers
by Bill McCauley 09 Apr '97

09 Apr '97

Randy, >What do folk do about persistent SNMP probers? I.e. j random clueless sites >which keep querying one's backbone router(s). E.g. this morning I get the >NOC shift change report with the folk hammering on our routers as if we were >stupid enough to use 'public' as the community string. The problem isn't so much stupid people as stupid default settings on some network tools. A lot of software exists for the "enterprise" network market. Apparently, the designers of this software don't realize that most enterprise IP networks touch the larger, fully connected Internet. The default settings on half a dozen products I've personally used default to trying to discover the entire Internet on startup. I learned this the hard way a few years back. Every night before going home, I'd re-boot a network monitoring station, which would crash during the night. The station was crashing somewhere in the middle of the discovery of net 18. After the third or fourth attempt at discovering net 18, I got a phone call from MIT, and realized why my network monitoring station was crashing. (whoops) Things got really interesting when I called up the manufacturer. I asked them to please help me stop this software discovery process. Took me half an hour of explaining to convince them that discovering the entire Internet wasn't in the best interest of their customers. Took a new version to really stop this "feature". >So every day some poor NOC person has to search these folk down with the >great tools we have, send email, get told they're nazi idiots, ... > >So what do folk do about this? Educate, then assassinate. Seriously, I think some education is needed for the proliferating manufacturers of lower end IP management tools. All of a sudden, there are a lot of IP monitoring products out there. Most all of our customers are running some sort of tool to check the status of their LAN workstations, etc. We've been having to educate almost every new customer lately. Maybe denying some TCP socket at the border router level would stop a lot of this? Regards, Bill

1 0

NKN.EDU
by Aleph One 09 Apr '97

09 Apr '97

Well while emailing the admins of all domains involved in a SPAM from UMARK.COM I came across their ISP, NKN.NET. They also happen to have registered NKN.EDU. How did this one get past the InterNIC? Aleph One / aleph1(a)dfw.net http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01

1 0

RE: SNMP probers
by Dave O'Shea 09 Apr '97

09 Apr '97

I'd ignore it. Having leaked a few (less than a million, I'm sure) SNMP 'gets' because I fat-fingered a subnet mask, or let a traceroute-based discovery routine go awry, or was just plain curious... -----Original Message----- From: Randy Bush [SMTP:randy@psg.com] Sent: Wednesday, April 09, 1997 9:28 AM To: nanog(a)merit.edu Subject: SNMP probers What do folk do about persistent SNMP probers? I.e. j random clueless sites which keep querying one's backbone router(s). E.g. this morning I get the NOC shift change report with the folk hammering on our routers as if we were stupid enough to use 'public' as the community string. > mae-east Bad community string from 194.168.51.4 > mae-east Bad community string from 193.38.113.216 > mae-west Bad community string from 202.85.254.5 > mae-west Bad community string from 206.79.240.190 > mae-west Bad community string from 193.38.113.216 > pdx Bad community string from 204.119.24.200 > pen Bad community string from 164.117.144.245 > pen Bad community string from 193.38.113.216 > paix Bad community string from 204.79.240.190 So every day some poor NOC person has to search these folk down with the great tools we have, send email, get told they're nazi idiots, ... So what do folk do about this? randy

2 1

RE: SNMP probers
by Chris A. Icide 09 Apr '97

09 Apr '97

I would suspect a good portion of these are run-away enterprise autodiscover jobs. As for what to do? Obviously, education would help alot, but, we all know how successful that is in this industry with the number of new folks getting involved every day. If I remember right, Proteon routers allowed you to specify what interfaces would accept SNMP queries. You could do something of the same with an access-list on a cisco thats not heavily used. I also believe that the Cisco routers do allow you to apply an access list to your SNMP config, but this won't prevent your router from receiving the request and expending CPU trying to figure out what to do with it. What do we do about it? Grumble. Make a phone call here and there if it gets out of hand. Chris ---------- From: Randy Bush[SMTP:randy@psg.com] Sent: Wednesday, April 09, 1997 9:28 AM To: nanog(a)merit.edu Subject: SNMP probers What do folk do about persistent SNMP probers? I.e. j random clueless sites which keep querying one's backbone router(s). E.g. this morning I get the NOC shift change report with the folk hammering on our routers as if we were stupid enough to use 'public' as the community string. > mae-east Bad community string from 194.168.51.4 > mae-east Bad community string from 193.38.113.216 > mae-west Bad community string from 202.85.254.5 > mae-west Bad community string from 206.79.240.190 > mae-west Bad community string from 193.38.113.216 > pdx Bad community string from 204.119.24.200 > pen Bad community string from 164.117.144.245 > pen Bad community string from 193.38.113.216 > paix Bad community string from 204.79.240.190 So every day some poor NOC person has to search these folk down with the great tools we have, send email, get told they're nazi idiots, ... So what do folk do about this? randy

1 0

SNMP probers
by randy＠psg.com 09 Apr '97

09 Apr '97

What do folk do about persistent SNMP probers? I.e. j random clueless sites which keep querying one's backbone router(s). E.g. this morning I get the NOC shift change report with the folk hammering on our routers as if we were stupid enough to use 'public' as the community string. > mae-east Bad community string from 194.168.51.4 > mae-east Bad community string from 193.38.113.216 > mae-west Bad community string from 202.85.254.5 > mae-west Bad community string from 206.79.240.190 > mae-west Bad community string from 193.38.113.216 > pdx Bad community string from 204.119.24.200 > pen Bad community string from 164.117.144.245 > pen Bad community string from 193.38.113.216 > paix Bad community string from 204.79.240.190 So every day some poor NOC person has to search these folk down with the great tools we have, send email, get told they're nazi idiots, ... So what do folk do about this? randy

5 5

Re: floods
by Kevin Brick 08 Apr '97

08 Apr '97

At 08:25 PM 4/8/97 -0400, Hoisl(a)aol.com wrote: > I am doing a project for school and I was wondering if you could answer my >question. What can be done to reduce the amount of flood damage? Thanks. rain > /dev/null -- Kevin Brick kevin(a)alink.net A-Link Network Services, Inc http://www.alink.net 408 720-6161 ------------------------------------------------ "The abdomen, the chest, and the brain will forever be shut from the intrusion of the wise and humane surgeon". --Sir John Eric Ericksen, British surgeon, appointed Surgeon Extraordinary to Queen Victoria 1873.

1 0