April 1998 - Test - lists.nanog.org

Spoofed Packets
by Gary R. Mensenares 20 Apr '98

20 Apr '98

Aaaarrrggghhh! I have been under attack since 2:30AM HKT and it only stopped just now. I am quite familiar with smurfs. As a matter of fact, I have turned off directed broadcast on every Cisco router I have. Constantly I am reminding my clients to do the same thing. It is sad that some people out there arent doing their part. But what bothers me the most is this most recent attack. Smurfs are ICMPs right? Well based on the logs I got, I was receiving all sorts of packets from "non-routable" addresses. This floored my International Private Line to MCI. I dont think they are smurfs because they do not belong to the same network. The protocols vary too, udp, icmp and tcp. Even the ports change. In other words, nothing is common except that they all pass thru the same gateway to our network. Being an ISP outside the US, bandwidth is very scarce and thus expensive from where I come from. I am filtering these packets so they never reach my clients. But still, the evil payload is dropped on my doorstep and it still consumes my precious bandwidth. Shouldnt MCI, or any other provider be filtering this on their borders? And if they are, there shouldn't be any packets of this variety running around their links, right? So how do these little blasted packets end up running around the internet? I am going to be very grateful if some kind souls can help point me to documentation on how to track these down and possible effectively prevent it from eating my line. Thanks! --- Gary Mensenares IPhil Communications Network Incorporated

3 2

Re: ARIN Services
by Scott Bradner 18 Apr '98

18 Apr '98

Dean sez: All the questions can probably be answered by noting that ARIN is a non-profit arm of NSI. this is not true Scott

4 3

Re: ARIN Services
by Scott Bradner 18 Apr '98

18 Apr '98

--- "17. What are the roles of Network Solutions and the InterNIC? NSI^Rs role is to sponsor ARIN, providing assistance to its establishment and providing initial support of ARIN until ARIN is self-funding. Once this is achieved, there will be no ties--financial, management or other--between the two organizations. ARIN will be an independent, non-profit organization responding to its membership. " Since it is not yet self-funding, what, exactly, part is untrue of my statement? -- none - since ARIN is self suporting ARIN is an an independent, non-profit organization responding to its membership. Scott .

1 0

Re: ARIN Services
by Dean Robb 18 Apr '98

18 Apr '98

At 11:52 4/15/98 -0700, you wrote: > > >People in the Americas seem to be less important to the American Registry >for Internet Numbers than our counter parts in China. All the questions can probably be answered by noting that ARIN is a non-profit arm of NSI. You don't see InterNIC without the backups (although at last report, even they weren't offsite) because they made $45 million dollars profit last year. Make no money = spend no money. Make obscene profits = spend as little money as humanly possible. Mr. Spammer, meet Mr. Mallet... Dean Robb PC-Easy On-site computer services (757) 495-EASY [3279]

3 2

3620 Field Notice (fwd)
by Al Reuben 18 Apr '98

18 Apr '98

I don't know if anyone cares, but those who have an older (5 month +) 3620 may be interested in reading this; it caused me to be up till 3:30 am and leave a good TGIF's dinner early. ---------- Forwarded message ---------- Date: Sat, 18 Apr 1998 17:18:31 +1000 (EST) From: William Roy <wroy(a)cisco.com> To: network(a)nac.net Subject: 3620 Field Notice Cisco 3620 OIR Interrupts, Power Problems Field Notice FN-1997-335-1 RCN R97-3714, R97-3757 Products Affected CISCO3620, CISCO3620-CH, CISCO3620-DC, CISCO3620-RPS, PWR-3620-AC=, PWR-3620-DC=, ACS-3620RPS= Problem Description The power supply connector in the CISCO3620 sometimes does not make good contact with the motherboard power connector. This leads to low voltage on the motherboard. Because of this, the voltage on a network module may be too low for the network module to operate. The network module "drops out" of the system, which looks to the router like the network module has been removed. The most common symptom of this problem is an OIR (On-line Insertion and Removal) interrupt message on the console followed by a router halt. The console error message is of the form: %OIRINT: OIR Event has occurred oir_ctrl 10 oir_stat CFCC Note: The IOS does not support On-line Insertion and Removal on the Cisco 3600 Series. Solution The root cause of the problem was traced to the power supply vendor who was using a power connector that was different than the connector Cisco specified. All CISCO3620s manufactured after November 26, 1997 have the correct power supply connector. Any CISCO3620 exhibiting these symptoms should have the power supply replaced, or be replaced with a CISCO3620 unit with the correct power supply connector. As an interim measure, you may be able to remove the power connector from the motherboard, clean the motherboard contacts and replace the power connector. Instructions can be found in the Cisco 3600 Series Power Supply Configuration Note. This is a temporary measure and the power supply or CISCO3620 chassis should still be replaced. A

1 0

Hot boxes
by dnewman＠data.com 18 Apr '98

18 Apr '98

Something tells me this is *not* off-topic for this list. . . Can anyone recommend a source of switches or hubs rated for operation at temperatures above 40 C? Most gear is rated only that high, and for some installations the top end is closer to 50 C. Thanks in advance David Newman

1 0

Re: ARIN Services
by Anne Louise Gockel 18 Apr '98

18 Apr '98

Due to the concern expressed by our network community, we have reviewed our maintenance procedures. The ARIN external services *will* be available this weekend. We will use alternate methods for routine updates that will minimize the impact on our external services. Please send questions or comments to <noc(a)arin.net>. Thank you. -Anne Louise Gockel ARIN Technical Support -- Anne Louise Gockel American Registry for Internet Numbers Internet: agockel(a)arin.net On Wed, 15 Apr 1998, Kim Hubbard wrote: > > ARIN's external services will be unavailable due to routine maintenance on > Sunday April 19, 1998 from 12 noon through 4pm US/EDT. This means there > will be no access to > ftp.arin.net > www.arin.net > whois.arin.net > during this time frame. All services will be restored as early as > possible. Questions or concerns should be addressed to <noc(a)arin.net>.

2 1

i hate nanog
by Sean M. Doran 17 Apr '98

17 Apr '98

NANOG must die because nobody seems to know how to remove the hundreds of quoted lines which follow their two lines of "original content". Sean.

3 2

Re: SMURF amplifier block list
by Hank Nussbacher 17 Apr '98

17 Apr '98

At 09:33 PM 4/13/98 -0700, Vadim Antonov wrote: >You're right, silly me. > >--vadim > > >Forrest W. Christian <forrestc(a)iMach.com> wrote: > >On Mon, 13 Apr 1998, Vadim Antonov wrote: > >> Uh. Just modify BGP routes from that feed to have a next hop pointing >> to a black hole. route-maps are sometimes useful. > >Could someone PLEASE explain to me how this is accomplished? > >Let's assume that you do use a route-map to set next hop to a null >interface or a black hole or something for a prefix. AND set local pref >appropriately so that route gets preferred. > >You now have a routing entry which essentially says: > > "forward packets DESTINED FOR the evil network to the black hole". > >What you really want is a routing entry which says: > > "forward packets FROM the evil network to the black hole". > >Now, if someone could enlighten me to a way which you can get BGP to make >a routing/filter entry to do this second one, I'd be most grateful. Why wouldn't this work (on IOS 11.3 at least): a) pick an unused interface (shutdown): inter s0/2 ip address 192.168.1.5 255.255.255.252 shutdown ip route 192.168.1.0 255.255.255.0 Null0 254 b) Say the spammer is 220.88.182.128/27: access-list 20 permit 220.88.182.128 0.0.0.31 route-map spam-filter permit 10 match ip address 20 set ip default next-hop 192.168.1.6 c) On your Fast Ethernet - or whatever interface you use to feed pkts to your outgoing lines: int fa1/0 ip policy route-map spam-filter All outgoing pkts to 220.88.192.128/27 now should go to Null0. I am sure one can improve on the logic even more. -Hank

4 3

Re: SMURF amplifier block list
by James R. Cutler 17 Apr '98

17 Apr '98

Jay, I now understand the confusion -- You are speaking of the dotted decimal representation of the 32 bit IP address without regard to masking. I am speaking of the masked address which results in a (mask length) network number part and a (32 - mask length) host number. This means you think of address components as octets (bytes) and I think of the effective network number and the effective host number, the sizes of which are determined only by the mask. Or another way to this is that the routers and hosts do not see the dotted notation except in the configuration dialogs. Internal to the routing processes the effective network number determines the routing between subnets and a broadcast address is any address where the host number is all ones. Another way to look at this is to say you are thinking about IP addressing in a "classful" manner whilst I am speaking in a "classless" manner. Believe me, the transition from classful to classless thinking in IP addressing is not an easy thing. None of the RFCs are simple to understand. So, I guess I'm not in trouble after all. Regards. JimC At 8:49 PM -0400 4/14/98, Jay R. Ashworth wrote: >On Tue, Apr 14, 1998 at 04:52:06PM -0400, James R. Cutler wrote: >> I have a B assignment. I have switched infrastructure segments >> with /22 masking. Do you mean to say that the host number >> range on each /22 masked segment is not continuous 1 through 1022, >> but has several holes instead.? The network seems to be working >> properly. I may be in big trouble! >> >> None of my TCP/IP courses or books or Cisco CDs have prepared me for >> such a surprise. Please point me to a text which will explain this. > >None of my study of TCP in the past 5 years has prepared me for the >idea that someone might think that any component of an IP address might >be greater than 255. They're decimal representations of _8 bit_ >numbers. > >No matter _where_ the net/subnet break is, you _still_ _write_ them as >AAA.BBB.CCC.DDD. > >Yes, conceptually, you might _read_ the addresses that way, but I'm >pretty sure that not one piece of equipment you own will let you >_write_ them that way, will they? > >Now, to get back to the conversation at hand: the proposition was that >blocking ingress to addresses ending in .255 makes it much more >difficult for your network to be used as a "smurf amplifier" (and if >you don't know what that is, you haven't been following the discussin >(and links) on this list in the last month or 3). > >Yes, if you have internal networks larger than a /24, then that means >you'll lose extra addresses if you do this. > >The point is that if you _don't_ avoid using host addresses that end in >.255 _whether that address is a broadcast address based on your netmask >or not_, then you're likely to find yourself with hosts that either can't >talk, or can't be talked _to_. > >Now have I made myself clear? > >Cheers, >-- jra >-- >Jay R. Ashworth jra(a)baylink.com >Member of the Technical Staff Unsolicited Commercial Emailers Sued >The Suncoast Freenet "Two words: Darth Doogie." -- Jason Colby, >Tampa Bay, Florida on alt.fan.heinlein +1 813 790 7592 > >Managing Editor, Top Of The Key sports e-zine ------------ http://www.totk.com - James R. Cutler EDS , 800 Tower Drive, Troy, MI 48098 Phone: +1 248 265 7514 FAX: +1 248 265 7514 EDS Internal Web: <http://www.iscg.eds.com/cutler/> World Wide Web: <http://www.ltu.edu/midecus/dechtm/cutler/cutler.htm>

3 2