October 1998 - Test - lists.nanog.org

Strange BGP announcement.
by Neil J. McRae 09 Nov '98

09 Nov '98

Aug 6 13:46:20 BGP RECV 207.45.199.225+179 -> 207.45.199.226+1935 Aug 6 13:46:20 BGP RECV message type 2 (Update) length 71 Aug 6 13:46:20 BGP RECV flags 0x40 code Origin(1): Incomplete Aug 6 13:46:20 BGP RECV flags 0x40 code ASPath(2): 6453 701 65525 ((65523)) 356 1 1691 Aug 6 13:46:20 BGP RECV flags 0x40 code NextHop(3): 207.45.199.225 Aug 6 13:46:20 BGP RECV 204.174.40/24, 204.239.26/24, 204.239.27/24, 204 .239.147/24 Aug 6 13:46:20 Aug 6 13:46:20 bnp_path_attr_eer: peer 207.45.199.225 (External AS 6453) bad up date send NOTIFY flag 0 type 0 err_subcode 11, data 0 Aug 6 13:46:20 NOTIFICATION sent to 207.45.199.225 (External AS 6453): code 3 ( Update Message Error) subcode 11 (AS path attribute problem) data Aug 6 13:46:20 Aug 6 13:46:20 BGP SEND 207.45.199.226+1935 -> 207.45.199.225+179 Aug 6 13:46:20 BGP SEND message type 3 (Notification) length 21 Aug 6 13:46:20 BGP SEND Notification code 3 (Update Message Error) subcode 11 ( AS path attribute problem) Aug 6 13:46:20 Regards, Neil. -- Neil J. McRae. Alive and Kicking. Domino: In the glow of the night neil(a)DOMINO.ORG NetBSD-1.3 released! ftp://ftp.uk.netbsd.org/pub/NetBSD Free the daemon in your <A HREF="http://www.NetBSD.ORG/">computer!</A>

10 14

Re: Linux router (don't laugh)
by shields＠crosslink.net 04 Nov '98

04 Nov '98

In article <Pine.BSF.4.05.9810271807300.215-100000(a)skipper.robotics.net>, Nathan Stratton <nathan(a)robotics.net> wrote: > I tried that several years ago and it blew up, I had to switch to FreeBSD. This says nothing about the ability or stability of today's Linux or FreeBSD. -- Shields, CrossLink.

5 7

Spam by one of Exodus Sales Person
by Exodus Abuse Investigations 03 Nov '98

03 Nov '98

Dear Mr. Rothschild and persons of NANOG, May I introduce myself, I am Janis Purl and I am the Abuse Manager at Exodus Communications, Inc.. I have been told that you and NANOG have been spammed by one of our new employees. This letter is meant as an apology to anyone having received that spam. Exodus has a policy strictly forbidding anyone on staff or connected with Exodus in anyway from spamming. My position here at Exodus is to enforce that policy and this is the first time I have had to enforce it to someone from within our staff. Any new hire at Exodus is given an orientation day which is when our policies on such things are presented by our Director of Security (Leroy Lacy). This is not possible for new hires at other sites around the country. For those new hires, are to receive printed copies of these policies. I don't know where the breakdown happened and have been told by the Director of Security that the procedure will be reviewed and changed to ensure that all new hires understand that spamming is not authorized in any circumstance here at Exodus. To ensure that this policy is clear to all present employees Mr. Lacy will be sending an email to all our current employees stating clearly spamming is NOT OK. I am truly sorry one of our employees punished you with a spam. Let me assure you that we are actively taking steps to assure that this never happens again. We are not advocators of spam and do our best to stop any spam related to us or our customers. Again let me say I am sorry that someone from Exodus bothered you in such a deplorable manner. Janis Purl Abuse Manager Exodus Communications, Inc. 1-888-2-EXODUS x 2574

2 2

Xedia vs Packeteer Comparsion
by Michael Gibson 03 Nov '98

03 Nov '98

I wonder if anybody one there has had experience with both xedia and packeteer and would let me know what the strengths and weaknesses was of each Michael Gibson Team Leader, Network Operations - Netcom Canada Telephone: 416-341-5751 Fax: 416-341-5725 magibson(a)netcom.ca

7 9

Re: Rootshell pages hacked
by Adam D. McKenna 02 Nov '98

02 Nov '98

They claim they were running only qmail, apache and ssh, but who knows if that's true. I have heard rumours about an ssh exploit but nothing concrete. --Adam -----Original Message----- From: Joe Shaw <jshaw(a)insync.net> To: JR Mayberry <rick(a)magpage.com> Cc: neil <neil(a)junior.uwc.ac.za>; Russ Haynal <russ(a)navigators.com>; nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, October 29, 1998 2:36 PM Subject: Re: Rootshell pages hacked I thought they were runnign qmail? Joe On Thu, 29 Oct 1998, JR Mayberry wrote: > Supposedly sendmail 8.9.1 is to blame, not ssh. > http://www.sendmail.com/sendmail.8.9.1a.html

9 8

Despamming wholesale dialup
by Harold Willison 02 Nov '98

02 Nov '98

Greetings, Let me explain the situation and see if I can get anyone to tell me how they are handling it. We are offering wholesale dialup ports. When a user connects he is authenticated and can do whatever it is he/she wants to do on the net. Unfortuantely some have decided that they will relay spam off of other servers. To address this i have proposed installing filters that will only allow these folks to connect to port 25 of the ISP that has bought the ports. This way they are not able to relay off of anyone elses machine that is using port 25 and the buyer of the ports should have the correct measures set up to prevent bulk mail from going out. Will this be sufficient, providing that the server they are allowed to connect to has set up his mail server to prevent massmailing..? Suggestions/comments? *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* | Harold Willison AGIS Network Engineering | * Senior Network Engineer 313-730-5151 * | noc(a)agis.net 313-730-1130 x-5649 | | harold(a)agis.net 24 hours a day, 7 days a week | | <bold><italic> <underline>http://www.agis.net</underline></italic></bold> |<bold><italic> </italic></bold>\*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*/

7 11

Re: Despamming wholesale dialup
by Scott Gifford 02 Nov '98

02 Nov '98

>> To address this i have proposed installing filters that will only allow >these >> folks to connect to >> port 25 of the ISP that has bought the ports. This way they are not able to >> relay off of anyone elses machine > > >The problem is for companies like ours that live by selling mail acounts to >users of other ISPs. They need POP and SMTP access to our mail servers, from >whereever they are calling. We are running sendmail v8.9.1 with all the >anti-relay stuff and RBL besides. The problem you have is the same one we have >for secured SMTP, maybe easier. How do you tell the site is secure? In this >case testing for open relays is well known. > >What I really suggest, and this takes some work on your part, is to contact >the >site's admin and inform them of their open-relay status. If they won't close >the relay, block them. Alternatively, you can assume that if they haven't >gotten their relays closed by now they are too clue-less to do so and block >them immediately, with notification. The problem is when the spam-bastard isn't relaying. We've been getting thousands of messages every week from spammers who buy dialup from various places, then connect directly to the destination mail server to deliver the mail. That's what this prevents. I don't know of any other method that does. An interesting answer to the problem you discussed above was suggested by somebody from the EFF at a spam BOF at USENIX this summer. He suggested that by default, you filter on port 25. But if somebody needs access for legitimate reasons, or even if they don't, have a letter they can fill out, sign, and send in which states that they will not send spam, subject to a $500/message penalty. Then if they do, just bill them. An alternative for you would be to run a mail server on a different port... -------Scott.

11 15

Linux router (don't laugh) WAS:Re: test
by John Fraizer 02 Nov '98

02 Nov '98

Routing 3 /24's and a /26 using 3 3c905's. eth0 goes to the cisco->world. eth1, eth1:0 and eth1:1 go to an ethernet switch that is serving machines from the three /24's. eth2 goes to a hub for one of our co-location clients. Attached is an mrtg graph from someone decided to throw about 8MB of garbage our way for a few hours. This little linux router just sat there and idled through it. [root@core0-eth0]:~ # /sbin/route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface Gateway-NET * 255.255.255.252 U 0 0 5 eth0 EZone-CoLo-2xx- * 255.255.255.192 U 0 0 97 eth2 2xx.xx.2xx.0 * 255.255.255.0 U 0 0 6189 eth1 xx6.28.xx.0 * 255.255.255.0 U 0 0 17 eth1:0 xx9.201.1x8.0 * 255.255.255.0 U 0 0 27 eth1:1 loopback * 255.0.0.0 U 0 0 0 lo default core1-eth0-Ente 0.0.0.0 UG 1 0 286496 eth0 [root@core0-eth0]:~ # /sbin/ifconfig lo Link encap:Local Loopback inet addr:127.0.0.1 Bcast:127.255.255.255 Mask:255.0.0.0 UP BROADCAST LOOPBACK RUNNING MTU:3584 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 coll:0 eth0 Link encap:Ethernet HWaddr 00:60:08:A2:XX:XX inet addr:2xx.1xx.xx7.xx Bcast:2xx.1xx.xx7.xx Mask:255.255.255.252 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:27965989 errors:0 dropped:0 overruns:0 frame:0 TX packets:60325424 errors:0 dropped:0 overruns:0 carrier:0 coll:81 Interrupt:11 Base address:0x6100 eth1 Link encap:Ethernet HWaddr 00:60:08:A2:XX:XX inet addr:2xx.4x.xx4.1 Bcast:2xx.4x.xx4.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:60459559 errors:0 dropped:0 overruns:0 frame:0 TX packets:28096141 errors:0 dropped:0 overruns:0 carrier:10 coll:26 Interrupt:10 Base address:0x6200 eth1:0 Link encap:Ethernet HWaddr 00:60:08:A2:XX:XX inet addr:2xx.x8.2x.1 Bcast:2xx.x8.2x.255 Mask:255.255.255.0 UP BROADCAST RUNNING MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 coll:0 eth1:1 Link encap:Ethernet HWaddr 00:60:08:A2:XX:XX inet addr:1x9.xx1.xx8.1 Bcast:1x9.xx1.xx8.255 Mask:255.255.255.0 UP BROADCAST RUNNING MTU:1500 Metric:1 RX packets:1 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 coll:0 eth2 Link encap:Ethernet HWaddr 00:60:08:A2:XX:XX inet addr:xx9.1x5.xx0.xx9 Bcast:xx9.1x5.xx0.191 Mask:255.255.255.192 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:135534 errors:0 dropped:0 overruns:0 frame:0 TX packets:62097 errors:0 dropped:0 overruns:0 carrier:0 coll:4 Interrupt:9 Base address:0x6300 At 11:24 AM 10/27/98 -0800, you wrote: >>>Other lessons learned, >>> Linux won't route between multiple NICs, using multiple aliases, >>> even with ip-forwarding enabled. >> >> >>Someone needs to tell one of our routers this. It has been routing between >>multiple NICs for well over a year without any problem. > >In that case, I would dearly love to hear how it was done. ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

15 17

2U chassis (was Linux Router Kit)
by Geoff White 31 Oct '98

31 Oct '98

We are trying to roll our own server/router/accounting box and have everything speced out but the chassis, we need to find a PC rack mount chassis that is no higher than 2U ( 3.5"). The co-los we use charge us not only by bandwidth but by real estate, we need to cram as many boxes as we can in the space. In fact if you know of a 1U (like the cobalt boxes) that would be even better. Any clues would be greatly appreciated. Geoff White GW Communications Inc.

7 7

Re: 2U chassis (was Linux Router Kit)
by brandon＠rd.bbc.co.uk 31 Oct '98

31 Oct '98

For embedded Linux systems we've used these 2U boxes. http://www.capax.co.uk/products/sys/rack/er2200/er2200.htm regards, brandon

1 0