December 1998 - Test - lists.nanog.org

Paul Vixie..famous Internet personality!
by Dean Robb 17 Dec '98

17 Dec '98

http://www.nytimes.com/library/tech/98/12/biztech/articles/14spam.html Precis on our own Paul Vixie. Includes quotes from a spammer and Earthlink. Spammers should be investigated by Ken Starr! Dean Robb PC-EASY computer services (757) 495-EASY [3279]

1 0

Re: 'best'
by Jay R. Ashworth 16 Dec '98

16 Dec '98

On Tue, Dec 15, 1998 at 07:22:14PM -0600, foo, whomever, the hell _that_ is, wrote: > Received: from squig.sfx.com (NOBODY(a)squig.sfx.com [169.207.160.17]) by scfn.thpl.lib.fl.us (8.8.5/8.6.5) with ESMTP id UAA12434 for <jra(a)scfn.thpl.lib.fl.us>; Tue, 15 Dec 1998 20:11:20 -0500 (EST) > several hundred busy people just received that message. > > was it worth it? > > think before you post. > > -foo > > Jay R. Ashworth wrote: > > On Tue, Dec 15, 1998 at 12:20:14PM -0500, Bill Becker wrote: > > > On Tue, 25 Apr 1972, David Diaz wrote: > > > > _No one's_ gonna comment on that? > > > > :-) > > > > Cheers, > > -- jr 'as close to the epoch as _I've_ seen...' a I did. And I _signed_ my post, rather than forging it. _My_, but the outpatients are out in force lately. Cheers, -- jra -- Jay R. Ashworth jra(a)baylink.com Member of the Technical Staff Buy copies of The New Hackers Dictionary. The Suncoast Freenet Give them to all your friends. Tampa Bay, Florida http://www.ccil.org/jargon/ +1 813 790 7592

1 0

System and Network Monitoring
by Derek Balling 16 Dec '98

16 Dec '98

OK, I'm looking for "real world" data and not sales/marketing hype. I'm looking for a package to do network and system monitoring. It's a heterogenous environment consisting of all manner of routers, at least 700 servers (Mostly FreeBSD, but also Solaris and Network Appliance boxen). Requirements: 1.) Must support FreeBSD (obviously, its the platform of probably about 98% of the servers) 2.) Must scale well. Today we have (at best guess given by management) "somewhere between 500 and 1000 servers", but that number grows daily. Operations adds about 4-5 servers a week at the present time. 3.) Must support the ability to provide checks on custom situations (e.g., an external program which checks the output from an e-commerce server to check that the pricing/qty/etc. is accurate and not stale or outdated) 4.) Must provide a flexible escalation method including e-mail and paging. 5.) Provide a nice interface to quickly find and troubleshoot problems. Preferably this would be X based, so that the server itself could reside in our server rooms, exporting the display to whomever had a need to watch the network/servers, or troubleshoot their particular corner of the world. I know this product has to exist, but I've only so far found one product that claims to be able to do all of that (HP OpenView). I'm not against HP, but I'd like to have some more options than what I currently have available to me. Replies probably should be made off-list (and if anyone wants me to, I'll happily summarize to the list what I get). Thanks in advance. ====================================================================== Derek J. Balling | "Bill Gates is a monocle and a white dredd(a)megacity.org | fluffy cat from being a villain in the http://www.megacity.org/ | next Bond film." - Dennis Miller ======================================================================

3 2

Re: System and Network Monitoring
by Dean Anderson 16 Dec '98

16 Dec '98

I use OpenView 4 now have for several years (since Openview 3). It was the best thing going for a while anyway. The best/worst thing about OpenView is using vendor equipment management modules that only work with openview. Or HP LanProbes and such. These tend to be huge worksavers, if you can somehow accomodate the security limitations (or use oob sets, etc) At least, they used to be. Now, I'm not so sure. Instead of using snmp to actually change configuration, I am now mostly using it to monitor what's going on, and react to snmp traps when they are sent. Frankly, I don't think snmp monitoring is all that hard. OpenView is still incredibly expensive, and very difficult to buy. I think the freeware alternatives are just as good, and possibly better in some cases. But it depends though on what you are going to do. I'd check into mrtg and scotty first, and then look at OpenView. They also work on freebsd... --Dean At 02:52 PM 12/16/1998 -0600, Tim Salo wrote: >> Date: Tue, 15 Dec 1998 16:48:06 -0800 (PST) >> From: Derek Balling <dredd(a)megacity.org> >> To: nanog(a)merit.edu >> Subject: System and Network Monitoring >> >> OK, I'm looking for "real world" data and not sales/marketing hype. >> >> I'm looking for a package to do network and system monitoring. It's a >> heterogenous environment consisting of all manner of routers, at least 700 >> servers (Mostly FreeBSD, but also Solaris and Network Appliance boxen). >> [...] > >I would be interested to hear about your comparison of a commercial >package such as HP OpenView with free alternatives. > >My inclination is towards a commercial package. I even suspect that it >would be less expensive in the long run, plus it seems likely to free >up your technical talent for revenue-producing activities. > >-tjs > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

'best'
by Bill Becker 16 Dec '98

16 Dec '98

Is anyone else seeing this crap from best.com besides me? I complained to them last time and received no reply. So i decided to filter parts of them and it's looking like i did the right thing. Here are a few entries from 209K of ejectamenta. Someone checked through an entire /19 for a place to login. Dec 12 18:32:02 139o-4700 105: Dec 12 18:32:01: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4783) -> 207.171.128.1(23), 1 packet Dec 12 18:32:06 139o-4700 106: Dec 12 18:32:05: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4791) -> 207.171.128.9(23), 1 packet Dec 12 18:32:09 139o-4700 107: Dec 12 18:32:08: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4800) -> 207.171.128.18(23), 1 packet Dec 12 18:32:13 139o-4700 108: Dec 12 18:32:12: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4807) -> 207.171.128.25(23), 1 packet ...etc. Annoying. Bill

6 8

Re: System and Network Monitoring
by Tim Salo 16 Dec '98

16 Dec '98

> Date: Tue, 15 Dec 1998 16:48:06 -0800 (PST) > From: Derek Balling <dredd(a)megacity.org> > To: nanog(a)merit.edu > Subject: System and Network Monitoring > > OK, I'm looking for "real world" data and not sales/marketing hype. > > I'm looking for a package to do network and system monitoring. It's a > heterogenous environment consisting of all manner of routers, at least 700 > servers (Mostly FreeBSD, but also Solaris and Network Appliance boxen). > [...] I would be interested to hear about your comparison of a commercial package such as HP OpenView with free alternatives. My inclination is towards a commercial package. I even suspect that it would be less expensive in the long run, plus it seems likely to free up your technical talent for revenue-producing activities. -tjs

1 0

heads up ... another imapd attack source
by Phil Howard 16 Dec '98

16 Dec '98

Just a few minutes ago, another attempted IMAPD breakin. This one originated from rock.careers.csulb.edu [134.139.149.100]. It was logged at Dec 14 16:59:56 CST.

10 11

Re: heads up ... another imapd attack source
by Roeland M.J. Meyer 15 Dec '98

15 Dec '98

At 04:54 AM 12/15/98 , Dave Crocker wrote: >At 05:17 PM 12/14/98 -0800, Roeland M.J. Meyer wrote: >>FYI: Not that I sell shell accounts anyway, but I additionally block all >>non-http access, from *.EDU, with tcp_wrappers and my POP3 is wrapped up in >>SSH. IMAPD was shot and buried(deleted) a long time ago. > >this means that any user who is traveling, and happens to try to get their >mail while accessing from a .edu site won't be able to pick it up. Only if they are accessing mail on MHSC systems, from an *.EDU dial-up. There are other dial-up options and MHSC has direct dial-up ports available. Also, we do allow VPN tunnels from *.EDU, but only to directed hosts with no routing and on advanced arrangement. The user that does so, does it under our TOS and AUP. >since imap popularity is growing, lack of imap service is also problematic. It's balance of problems. We consider the rootkit risk more severe than the loss of business from *.EDU sites. We have secure POP3 and Web-based (SSL) mail, we are investigating POP3 over SSL. Those services are allowed to *.EDU, from MHSC. As has been shown by others, IMAPD attacks are on the rise. It would not do for a security advocate to get rootkit'd, just think of the publicity <grin>. It's one of the things that keep me up at night. Many of the vulnerable systems are in *.EDU, as has already been shown to my satisfaction. Granted, MHSC has always viewed *.EDU is a huge potential security risk. That is an unapologized bias on our part. It is the nature of the beast. When the reference code, for IMAPD, becomes better written, or we (MHSC) re-write it ourselves, we will reinstantiate the IMAPD service. Until then, it remains dead. A current example is a spammer that I've been tracing for weeks. They always come from a different host, but it's obviously the same guys, they are very good. Many of the relays they use have been root'd. The latest one I've found is at sun.soci.niu.edu. So a SAINT run against it yourself and see how vulnerable they are. If they aren't root'd now, they soon will be, IMHO. I am quickly gaining the unsupported suspicion that spammers may be behind many of the IMAPD attacks. They are looking for hosts to send their spew from. Note that this *is* an unsupported view/suspicion, I claim no solid evidence. _________________________________________________ Morgan Hill Software Company, Inc. Roeland M.J. Meyer, ISOC (RM993) President and CEO. e-mail: <mailto:rmeyer@mhsc.com>mailto:rmeyer@mhsc.com Web-pages: <http://www.mhsc.com/~rmeyer>http://www.mhsc.com/~rmeyer Web-site: <http://www.mhsc.com>http://www.mhsc.com Colorado Springs, CO - Livermore, CA - Morgan Hill, CA -----------------------------------------(legal notice)-------- Note: Statements made in this message do not necessarily reflect the position of MHSC. All forcasts and projections are to be considered as forward-looking and presume conditions which may not be referenced herein. -----------------------------------------(/legal notice)-------

2 1

NANOG 15 Hotel
by Pam Ciesla 15 Dec '98

15 Dec '98

Possible hotel shortage in Denver for NANOG 15. The hotel people informed me that they have several meetings going on at the same time as NANOG 15. If you are planning on attending the NANOG 15 Meeting in Denver book your hotel early. The room block for NANOG is available until January 8, after that it's on space available only. Hotel and other info can be found on the NANOG webpage http://www.nanog.org. Any questions please contact me. Thanks Pam Pam Ciesla Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 Bldg.I, Suite C pam(a)merit.edu Ann Arbor, MI 48107

1 0

Anyone on this list from Australia?
by Pete Kruckenberg 15 Dec '98

15 Dec '98

Or are you familiar with ISPs in Australia? If so, would you please contact me privately so I might ask you a few questions about ISPs there? Thanks. Pete.

1 0