September 1997 - Test - lists.nanog.org

Re: *scream* Cannot contact AT&T WorldNet NOC
by Sean Donelan 29 Sep '97

29 Sep '97

>SprintLink is our upstream. After three hours they called back and >said that I "have to contact the Computer Crimes Division of the >FBI". Since the attempts stoped hours ago, I'm just going to pay >close attention to my logs and follow up if it happens again. I'm schocked! The catch-22 of Internet problem reporting, providers who don't accept trouble calls from non-customers and won't do trouble referrals between providers. I'm always amused when a provider with who we have no business relationship calls our NOC and expects help, yet when we call their NOC they refuse the call because we aren't a customer. Alternatives: - Call the FBI Computer Crime Squad (202) 324-9164, which will probally be very unsatisfying unless you can document a large dollar loss - Find a new upstream which will handle the problem referrals for you, if you find one, let me know - Form relationships yourself with other providers so you can do your own inter-provider problem referal In any case, release of customer information without the permission of the customer will require some type of legal order. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

Re: *scream* Cannot contact AT&T WorldNet NOC
by Jonathan Clark 29 Sep '97

29 Sep '97

To answer your question about #1, we backhaul our dial-in calls all over the place. The same user dialling back in to the same number could easily end up in one of three or four IP blocks which are in turn associated with different cities in the DNS. Jonathan -- Someone apparently from a WorldNet dial-up account, calling in via New Orleans and Dallas was sending large numbers of TCP connections to port 1080. That's of course the default Socks Port. We don't run socks. Never have. The connection attempts were blocked and logged. The reasons could be: 1) stupid user entered in the wrong address for a socks proxy 2) Denial of Service attack It if were #1, then why would it be coming from two different cities and why sooooo many connections. If it was #2, why am I not seeing more connections and why TCP? IT seems to me that it's kinda pointless to spoof the source address on a TCP connection unless you are *very* clever. Why only port 1080? --Eric -- Eric Wieling (eric(a)ccti.net) Corporate Communications Technology Sales: 504-585-7303 (sales(a)ccti.net) Support: 504-525-5449 (support(a)ccti.net) I don't bother to set my alarm clock anymore. Someone always pages me before I need to wake up anyway. >-- End of excerpt from Eric Wieling

1 0

RE: *scream* Cannot contact AT&T WorldNet NOC
by Peter Lothberg 28 Sep '97

28 Sep '97

> Eric, > > If you are a customer of AT&T WorldNet Managed Internet Services > (meaning, you have a dedicated connection to the Internet from AT&T > WorldNet), the Customer Care number, which is manned 24 X7, is > 800-411-6427. You can open a trouble ticket there for whatever problem > you're having. The Customer Care technician will troubleshoot it as far > as they can take it (they have a fair amount of testing capability; if > need be the NOC will get involved and work further to resolve the > trouble. > > If you are a customer of our WorldNet Dial service, the number to call > for support is 800-WORLDNET or 800-400-1447. You are right, you will > probably always get asked about your PC configuration because that's the= Christine, The scenario is that he is not a customer of yours, he's a customer of some other ISP. The problem is that one of your customers are sending traffic that causes problems. -Peter

1 0

RE: *scream* Cannot contact AT&T WorldNet NOC
by Sorenson_Christine_M＠bns.att.com 28 Sep '97

28 Sep '97

2 1

*scream* Cannot contact AT&T WorldNet NOC
by Eric Wieling 28 Sep '97

28 Sep '97

Does *anyone* have a contact number for someone that does not keep asking me if I'm running a Windows machine? Every number I have for them, connects me to some moron that has no clue when I say "It appears that someone from your network is attempting to flood our network". Asking to be connected to Security gets me an e-mail address and asking for a supervisor get me "He's not avainable" Whois on att.net get me a voice mailbox saying that they are closed on the weekends. --Eric -- Eric Wieling (eric(a)ccti.net) Corporate Communications Technology Sales: 504-585-7303 (sales(a)ccti.net) Support: 504-525-5449 (support(a)ccti.net) I don't bother to set my alarm clock anymore. Someone always pages me before I need to wake up anyway.

1 0

URL: Spammers Lose Access, IEMMC Collapses
by Paul Ferguson 28 Sep '97

28 Sep '97

See: http://www.zdnet.com/intweek/daily/970922e.html - paul

5 4

NANOG MEETING INFO
by Pam Ciesla 26 Sep '97

26 Sep '97

Lunches at the NANOG Meeting in Phoenix, AZ, October 27 & 28 will include vegan/vegetarian and/or meat. If you have any special request, such as kosher, please let me know ASAP. The room block at the Radisson Resort (602-991-3800) ends at midnight, Friday 9/26. If the hotel still has rooms available after this date you can still request the NANOG room rate. Check out the airline discount rates. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 313-936-0172 - phone Merit Network, Inc. 313-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

The Cidr Report
by Tony Bates 26 Sep '97

26 Sep '97

1 0

Re: Part of the state of Hawaii off-line
by Chris A. Icide 26 Sep '97

26 Sep '97

1 0

RE: not rewriting next-hop, pointing default, ...
by 水越一郎 26 Sep '97

26 Sep '97

Enke Chen [SMTP:enkechen@cisco.com] wrote on Saturday, September 13, 1997 2:29 AM Enke>For ISPs with a lot of direct (i.e., private) peers, on the public Enke>NAP routers you may want to consider not installing the routes from the Enke>private peers. This approach could reduce the damage to your private Enke>links by default-pointing attack. It may also make you less likely Enke>a target due to black-holing of certain traffic. And on the NAP router, adding the blackhole segment ( null 0 or dumb ether etc.) On cisco, null 0 is not recomended for its process switching set the default route to the blackhole segment check the packet in the segment. These packets are routed by default, so call the routing police :-) Enke>This approach is not applicable if transit service is provided at Enke>the public NAP. Peering in tunneling COULD work. ichiro(a)byd.ocn.ad.jp (AS4713<-AS2521<-AS2519)

1 0