August 2000 - Test - lists.nanog.org

Re: Rise in intrusion attempts from *.jp
by Jeremy T. Bouse 15 Aug '00

15 Aug '00

John Allspaw was said to been seen saying: > > yes, i have seen a large number of port scans on both work networks and > home network space. nothing more crazy then your standard sequential port > scan for open 53, 1, 8, etc. > What I'm talking about are not so obvious as a sequential port scan, but rather attempts directed at ports with known exploits against either a IP range or directed at a particular host. Also those hosts being directly targeted are not servers publically known (ie - Domain name servers, mail servers, etc) but those behind the scenes machines that help keep things flowing. Also the fact that even if the ports were open the sites making the attempts would have had no reason to make the connections in the first place. Granted the hardest part is getting any action taken. The times I do find action is taken it seems 9 out of 10 times it's a server which was inappropriately configured and thus compromised and used as a staging area for further attacks. Some of my more enjoyable attempts have been with UUnet whom I'd get a live body on the phone while it's occurring or shortly thereafter and I'm told to send the email with the logs. I send the logs get their lovely automated message then 48 hours later a message stating "we couldn't see anyone on that IP at that time, please check your servers for accurate time". Which I find humorous at the steps I take to ensure my logs are acurate and untampered. To give this more operational purpose. Has anyone found or aware of any good sites with accurate Abuse/Security contact info? I've found a lot of the companies still have telephone numbers listed with the various NICs that are answered by a fax machine or email addresses that bounce. IIRC abuse.net had one for spam contacts but I realize some organizations have two seperate departments to handle spam and network threats. Respectfully, Jeremy T. Bouse UnderGrid Network Services, LLC -- ,-----------------------------------------------------------------------------, | Jeremy T. Bouse - UnderGrid Network Services, LLC - www.UnderGrid.net | | All messages from this address should be atleast PGP/GPG signed | | Public PGP/GPG fingerprint and location in headers of message | | If received unsigned (without requesting as such) DO NOT trust it! | | undrgrid(a)UnderGrid.net - NIC Whois: JB5713 - Jeremy.Bouse(a)UnderGrid.net | `-----------------------------------------------------------------------------'

1 0

Rise in intrusion attempts from *.jp
by Jeremy T. Bouse 14 Aug '00

14 Aug '00

I'm curious to try and find out if any other networks have seen a rise in sites from within Japan being the source of intrusion attempts. For the past couple days we've seen a rise in the number of sites from within Japan making very questionable port attempts which systematically sweep our entire IP space. Fortunately the ports are blocked because of known exploits and the fact they are not used on our network. Respectfully, Jeremy T. Bouse UnderGrid Network Services, LLC -- ,-----------------------------------------------------------------------------, | Jeremy T. Bouse - UnderGrid Network Services, LLC - www.UnderGrid.net | | All messages from this address should be atleast PGP/GPG signed | | Public PGP/GPG fingerprint and location in headers of message | | If received unsigned (without requesting as such) DO NOT trust it! | | Jeremy.Bouse(a)UnderGrid.net - NIC Whois: JB5713 - undrgrid(a)UnderGrid.net | `-----------------------------------------------------------------------------'

1 0

Re: One Wilshire Building and the DNC
by Sean Donelan 14 Aug '00

14 Aug '00

It appears the City of Los Angeles has expanded the "traffic impact area" for several blocks around Pershing Square Park for this afternoon and evening. One Wilshire is about 1 block from the park, and is now completely within the traffic impact zone. Additional street closings, detours, and other disruptions may occur with little advance notice. Other than some traffic jams, things seem relatively calm. On Sat, 12 August 2000, Sean Donelan wrote: > For real-time information on the traffic situtation in the surrounding > area see http://trafficinfo.lacity.org/html/conv_staples.html

1 0

Data Center
by HANSEN CHAN 14 Aug '00

14 Aug '00

Dear all, I am trying to understand more on the technical as well as operational aspect of Data Center. Can someone point me to some useful URLs or whitepaper? I only know of those on Exodus website. Many thanks. Cheers, Hansen

3 2

Whitehouse mail server down
by Roy 14 Aug '00

14 Aug '00

Looks like the whitehouse mail sever has been down for more than three days! Aug 13 20:12:16 winery sendmail[31174]: e7A3Hn849780: to=president@whitehouse.gov,vice.president@whitehouse.gov, ctladdr=xxxx (299/200), delay=3+23:54:27, xdelay=00:00:00, mailer=esmtp, pri=24460443, relay=whc.eop.gov., dsn=4.0.0, stat=Deferred: Connection reset by whc.eop.gov. president@whitehouse.gov,vice.president@whitehouse.gov... Connecting to whc.eop.gov. via esmtp... 421 Service unavailable now code 6 (RTv2.2c/jms/990501) >>> QUIT

2 1

Routing problem with 206.117.0.0/16
by Rodney Joffe 13 Aug '00

13 Aug '00

There is currently a routing problem with parts of 206.117.0.0/16 apparently as a result of a bad external announcement of some type. It is *not* apparently as a result of 206.117.0.0 or its direct upstreams. The source network of the bad announcement has been identified, and is attempting to fix it. This address space encompasses part of Los Nettos, (USC, ISI, Caltech, JPL, TRW, CenterGate Research etc.) and includes GeekTools superWhois, and SamSpade.org, which explains why many of you are getting failures in whois queries. -- Rodney Joffe CenterGate Research Group, LLC. http://www.centergate.com "Technology so advanced, even we don't understand it!"(SM)

4 4

american ISP association
by William Allen Simpson 12 Aug '00

12 Aug '00

-----BEGIN PGP SIGNED MESSAGE----- Anybody know anything about this? Should I have my political candidates fill out their questionaire? We are members of ISPC, but which has been fairly inactive lately. Do we really need more than one activist group? www.americanisps.org -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1 iQCVAwUBOZXjTdm/qMj6R+sxAQEZNwQAjB3+bzBo6DUbFgXDMU7vlIO2wzKhzeBa IGrk1vK9drCDu/guq0uW22AJBTeVPRf1WqZMJJH0doKgGEEZMHfSZBYGUUD6e9cN Q5KHNf4InGC//+JAtf5YoOw4XGdCSK9WEKNGCK1zkydY/yTH1LZ6a2UASLZNK0AD A0aQY9xAHy0= =JRTf -----END PGP SIGNATURE-----

1 0

One Wilshire Building and the DNC
by Sean Donelan 12 Aug '00

12 Aug '00

The Democrates are coming to town.... The Democratic National Convention is being held at the Staples Convention Center in Los Angeles next week (Aug 14-17). As usual, there will be various street closings, demostrations, and so forth. Currently it appears 1919 W 7TH Street is the principle organizing point for marches and protests. The One Wilshire Building, one of the principle "carrier hotels," is a few blocks away from the festivities. Although the main meet-me room building is outside the restricted area, there are a number of carrier facilities in the surrounding blocks. There has already been at least one unscheduled street closing while the police investigated a suspicious package in the area. For real-time information on the traffic situtation in the surrounding area see http://trafficinfo.lacity.org/html/conv_staples.html

1 0

California Power report
by Roy 11 Aug '00

11 Aug '00

A report on the power crisis in California and specifically addressing the intentional blackouts on June 14th is available on the CPUC web site at http://www.cpuc.ca.gov The basic conclusion: Under California's new system, California power purchasers so far this summer have paid much more for power than in the past and the system has been more vulnerable to supply shortages than ever before.

1 0

Interested in a DNSSEC workshop at/near NANOG 20?
by Edward Lewis 11 Aug '00

11 Aug '00

I have been asked whether there will be a DNSSEC (RFC 2535 & others) workshop held in North America. A brainstorming session came up with a suggestion to hold it the day after the Washington, D.C. meeting of NANOG (#20). It was pointed out to me that most of the NANOG attendees were routing folks, not DNS administraters/maintainers. So, I'm sending this mail for two reasons. 1) Would you plan to come to NANOG only if such a workshop were held? (I.e., you read the list, but have no reason to attend meetings primarily about routing.) (Please forgive me it I am making a false stereotypical claim that NANOG attendees are router folks...) 2) If you are interested in attending such a workshop, let me know in private email. I am not asking for registration, I need this to help us size the workshop. Here's a bit of what we have in mind for the workshop: One full day, the Wednesday following NANOG. Location will be in Northern Virginia - exactly where will depend on demand. There will be no cost to attendees but you will have to provide your own computer (laptop) running the latest version of BIND 9 (which is TBD), and other travel expenses. When (if) registration is opened, it'll be FCFS, and attendence will be limited. BTW - what's in the workshop for the hosts is: more testing of the BIND software, feedback on the (IETF) specifications, input to DNSSEC policy BCP's. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NAI Labs Phone: +1 443-259-2352 Email: lewis(a)tislabs.com "It takes years of training to know when to do nothing" - Dogbert Opinions expressed are property of my evil twin, not my employer. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NAI Labs Phone: +1 443-259-2352 Email: lewis(a)tislabs.com "It takes years of training to know when to do nothing" - Dogbert Opinions expressed are property of my evil twin, not my employer.

2 2