February 2000 - Test - lists.nanog.org

Is there a PSI.NET person in the house?
by Roeland M.J. Meyer 11 Apr '00

11 Apr '00

I just got half a hundred of these (and 123 of these last Friday) and all e-mail, to the usual locations, bounces or gets ignored. I am livid, I am pissed, I am *really* wanting to SMURF PSI.NET because they have been a spam-harbor for *years*! PSI.NET should have made it into the RBL a long time ago. >Return-Path: <admin1(a)fnmail.com> >Received: from beta.pragmatix.com (epsilon.pragmatix.com [205.166.32.6] (may >be forged)) > by condor.lvrmr.mhsc.com (8.9.1/8.9.1) with ESMTP id FAA18857 > for <rmeyer(a)mhsc.com>; Mon, 1 Mar 1999 05:04:57 -0800 >Date: Mon, 1 Mar 1999 05:04:57 -0800 >From: admin1(a)fnmail.com >Message-Id: <199903011304.FAA18857(a)condor.lvrmr.mhsc.com> >Received: from jgroves (ip33.phoenix8.az.pub-ip.psi.net [38.29.61.33]) by >beta.pragmatix.com with SMTP (Microsoft Exchange Internet Mail Service >Version 5.5.1960.3) > id FS46B0Z3; Sun, 28 Feb 1999 18:33:11 -0500 >To: travelers(a)ibm.net >Subject: Make $$, Travel and Have Fun! >X-UIDL: 2ddab26e92763572b29a9545c30b592f ___________________________________________________ Roeland M.J. Meyer - e-mail: mailto:rmeyer@mhsc.com Internet phone: hawk.lvrmr.mhsc.com Personal web pages: http://staff.mhsc.com/~rmeyer Company web-site: http://www.mhsc.com ___________________________________________________ KISS ... gotta love it!

3 3

government eavesdropping
by Jeff Ogden 02 Mar '00

02 Mar '00

So what is the real story here? Is all, most, some of our international Internet traffic being intercepted by various governments? Is it only international traffic that is at issue or is domestic traffic within the US subject to routine eavesdropping without a court order? For years I've been telling people that while there was some risk that traffic on the Internet could be intercepted, that the risk was greatest at the ends of a connection and that as long as they were working with a reputable ISP that there was almost no risk that anyone was eavesdropping on the traffic from the more central networks. I've also been telling people that data "at rest" on disks or stored in servers is much more at risk than data "in motion" as it moves across the Internet. Have I been misleading people? -Jeff Ogden Merit >From http://dailynews.yahoo.com/h/ap/20000223/wl/eu_espionage_1.html > >Wednesday February 23 9:50 AM ET > >Report Details Vast Spy Network > >By CONSTANT BRAND Associated Press Writer > >BRUSSELS, Belgium (AP) - A U.S.-led communications >monitoring network is intercepting ``billions of messages per >hour'' including telephone calls, fax transmissions and private >e-mails, according to a European Parliament report made public >Wednesday. > >``We are not talking about a trivial thing here ... we cannot stop >them, they will continue,'' said Ducan Campbell, author of the >special parliament-commissioned report on the Echelon >spy-network. > >Campbell said that the intelligence network monitors and >intercepts sensitive European-wide commercial communications. >``The level of use is getting out of control,'' he told a packed >hearing of the Parliament's Committee for Justice and Home >Affairs. > >He said Canada, Britain, Australia and New Zealand are also >involved in Echelon. Other nations including France and Germany >also participate in a lower level in the spy-network which dates >back 50 years to the beginning of the Cold War. > >``The capacity of the filtering systems is enormous,'' Campbell >said. He added that most international internet communications >are being routed through the United States and through nine known >U.S. National Security Agency interception sites. > >Intelligence facilities located in the five countries can intercept fax, >e-mail or telephone communications easily he said. Campbell >urged the European Union to take action to protect against >unwanted interception of communications, which he said were >violations of human rights. > >Committee chairman Graham Watson said he wanted to be sure >the international surveillance system was not abusing its powers. > >Campbell said Microsoft, IBM, and a certain ``large American >microchip maker'' were providing certain product features which >allow the interception of information flow. > >Campbell said he did not know whether the U.S. corporations were >benefitting from the information gathering but said previous >commercial espionage resulted in the collapse of several European >contracts in the airline industry - both military and commercial.

13 13

show interface switch
by ww 01 Mar '00

01 Mar '00

There used to be an undocumented command in Cisco IOS that would provide statistics about how packets were being dealt with -- namely 'show interface switch'. A sample output of the command: Ethernet1/1 Throttle count: 0 Protocol Path Pkts In Chars In Pkts Out Chars Out Other Process 451 54909 24890 1493400 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 IP Process 17354 2180875 123854 12437965 Cache misses 18678 Fast 13066464 788505528 11642545 4290345939 Auton/SSE 0 0 0 0 Trans. Bridge Process 0 0 104 6240 Cache misses 0 Fast 549 38962 63 8268 Auton/SSE 0 0 0 0 DEC MOP Process 0 0 414 31878 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 Spanning Tree Process 0 0 584 35040 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 ARP Process 75404 4531576 149 8940 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 CDP Process 35 10885 533 168537 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 For certain this command exists in versions of 11.X vintage, although it seems to have disappeared in 12.X. Does anyone know why it has been abandoned? These are usefull statistics from a debugging perspective (i.e. why is this router crumbling under high traffic load? because it's process switching all of its packets) and I don't think that it's possible to garner them from netflow. Has it been replaced by another undocumented command? Cheers, Will Waites ww(a)pandora.styx.org

4 3

Retracing Sender's SMTP IP Address using MS Exchange 5.5
by Toplez Razer 29 Feb '00

29 Feb '00

Dear Folks, We receive an e-mail that we want to reply back, but the sender's SMTP is NOT registered in DNS. Let's say the sender is who(a)xyz.com. Let's assume xyz.com is being resolve with its ISP DNS 150.150.150.1. But there is no MX for xyz.com in this DNS. Our e-mail is MS Exchange 5.5. Can we trace the sender's SMTP IP address? Is there better way than to peel off the original header packet to see the sender IP? Thanks, Audie Onibala ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

3 2

RE: Need routing engineer from Verio
by Rizzo, Mark 29 Feb '00

29 Feb '00

Yes, I did send to peering and noc a few minutes later. I was not sure how quickly the peering email addressed was polled so I was looking for some help sooner from a clueful person on this list. (Which I have mostly received, minus the few requisite hate mails) Mark EA.COM -----Original Message----- From: TTSG [mailto:ttsg@ttsg.com] Sent: Sunday, February 27, 2000 2:53 PM To: rbush(a)bainbridge.verio.net Cc: MRizzo(a)eahq-exchange.ea.com; nanog(a)merit.edu Subject: Re: Need routing engineer from Verio > > > > Hello, I need to contact someone from Verio that can help me sort out a > > routing issue between Verio and my company. > > posted two minutes after mail sent to peering(a)verio.net and no mail sent to > noc(a)verio.net. brilliant. > Ya blame him? With the response times and cluelessness factor I've run into with various Verio departments, I'm suprised he bothered at all. Tuc/TTSG

12 13

RE: [long] Re: DDoS: CAR vs TCP-Intercept vs NetFlow
by Paul Ferguson 29 Feb '00

29 Feb '00

At 10:45 PM 02/28/2000 -0500, Vijay Gill wrote: >Routers from Cisco and other vendors have the ability to detect the >signature patterns of a denial-of-service attack, and the routers can >filter out that traffic, Farnsworth said. An unfortunate misquote. Add another scar to my cisco skin... - paul

2 1

DDoS: CAR vs TCP-Intercept vs NetFlow
by Rubens Kuhl Jr. 29 Feb '00

29 Feb '00

Have anyone performed an evalution of rate-limiting SYN packets (CAR) versus using TCP-Intercept ? What responds better to a DDoS attack (assume SYN-flooding only) ? What uses more router resources ? For better performance of CAR or TCP-Intercept, NetFlow switching (ip route-cache flow) should also be used, besides CEF ? Rubens Kuhl Jr.

4 7

To AOL engineers (icq services)
by Dmitry Safronov 28 Feb '00

28 Feb '00

Hello , Maybe some people from AOL routing engineers are reading this list... The following question for them... From adresses 195.161.0.0/16 and 213.24.0.0/16 we cannot connect to http port on your web sites: www.icq.com www.icq.net www.mirabilis.com and ICQ servers. But from my client's addresses (other blocks) we can. It seems like AOL filtered out our address blocks with port 80. Could anyone from AOL engineers help to solve the situation? Best regards, _____________________________________________________________________ Dmitry Safronov Rostelecom/Internet Centre Tel: +007 (095) 334-9983 Fax: +007 (095) 339-2415

1 0

Need routing engineer from Verio
by Rizzo, Mark 27 Feb '00

27 Feb '00

Hello, I need to contact someone from Verio that can help me sort out a routing issue between Verio and my company. Thanks, Mark Rizzo EA.COM

3 2

Fwd: [cfgeeks] TOOLS FOR VANDALS
by Shawn McMahon 26 Feb '00

26 Feb '00

I told you guys, but only some of you listened. It is not only possible to launch an attack like this from home user's PCs, "rewted" by amateurs, but it looks like a part of this was indeed done that way. This mess is gonna suck to clean up. Thanks, Microsoft, for all your help. Too bad you were helping the wrong effing side... >From: "Kevin P. Inscoe" <kevin(a)inscoe.org> >Reply-To: cfgeeks(a)onelist.com >Subject: [cfgeeks] TOOLS FOR VANDALS > >From: "Kevin P. Inscoe" <kevin(a)inscoe.org> > >TOOLS FOR VANDALS >San Jose, California-based Finjan software says that new hacker software >called Trinoo "zombie" can be run from ordinary PCs running Microsoft >Windows and will not require high-end Unix workstations of the sort that >have been involved in previous vandal attacks made through the Internet >against corporate and government computers. Vandals would be able to >launch >distributed denial-of-service attacks much more easily, preventing >people >from visiting the targeted sites. (Bloomberg News/New York Times 25 Feb >2000) >http://www.nytimes.com/library/tech/00/02/biztech/articles/25hack-pc.html > >~kevin >-- >Kevin P. Inscoe Unix System Engineer & Specialist >Deltona, FL Itinerary at http://www.inscoe.org/where >e-mail: kevin [at] inscoe [dot] org >http://www.inscoe.org 28.9492N 81.1955W >http://www.inscoe.org/comp http://www.inscoe.org/radio > >Where the Central Florida geeks hang out... >http://www.onelist.com/community/cfgeeks >Kevin Inscoe (kevin(a)inscoe.org) - Listmom

2 1