August 2000 - Test - lists.nanog.org

Re: Full disclosure
by John Fraizer 30 Aug '00

30 Aug '00

Connected to 62.153.217.141. Escape character is '^]'. 220 MERCUR SMTP-Server (v3.10.18 AS-0098304) for Windows NT ready at Wed, 30 Aug 2000 22:43:55 +0200 helo blah.com 250 kamen-ewr1 Hello 209.41.244.2 mail from: test(a)test.com 250 <test(a)test.com>, sender ok rcpt to: blah(a)blah.com 250 User not local; will forward to <blah(a)blah.com> A large percentage of the addresses listed are running this same mailserver software. You can't get much more SPAM friendly than that. --- John Fraizer EnterZone, Inc

1 0

Full disclosure
by John Fraizer 30 Aug '00

30 Aug '00

Over the past couple of days, some person or group has been sending out thousands of SPAMs through open relays using random @enterzone.net addresses as the FROM address. This is NOT happening through our mailservers, nor is it happening from any VALID enterzone.net account. Thus far, the following servers have been identified as having been used to relay the SPAM: dialupFF60.mpls.uswest.net (answers as mail.pmhadv.com on 25) 195.162.167.134 62.153.217.141 212.77.168.66 195.127.176.98 195.4.100.19 193.85.146.161 195.86.241.191 The list just keeps on growing. Logs from those who run these mailservers would be appreciated. We plan on pursuing this legally. We're not sure if this SPAM run is still underway but, I want to stress the fact that this is NOT originating from our mailservers, nor from any of our customers. Feel free to run our mailservers through whichever relay-tests you like to verify. We do so weekly. --- John Fraizer EnterZone, Inc

1 0

Re: USWest
by Kai Schlichting 30 Aug '00

30 Aug '00

At Wednesday 04:18 PM 8/30/00, John Fraizer wrote: >Will someone from USWest/Qwest please contact me! Your site does not list >any contact information for your abuse/NOC contacts. > >dialupFF60.mpls.uswest.net is currectly blasting out 1000's of SPAMs per >minute using random @enterzone.net addresses as the from address. While this doesn't resolve forwards for me right now: Nothing that a little hostile /24 BGP announcement couldn't fix until such security contact has been found. Which brings us back to the week-before-last week's NANOG discussion: An RBL list for DoS attacks.

2 1

USWest
by John Fraizer 30 Aug '00

30 Aug '00

Will someone from USWest/Qwest please contact me! Your site does not list any contact information for your abuse/NOC contacts. dialupFF60.mpls.uswest.net is currectly blasting out 1000's of SPAMs per minute using random @enterzone.net addresses as the from address. John Fraizer EnterZone, Inc

1 0

New mailing list - 111 8th Avenue
by Adam Rothschild 30 Aug '00

30 Aug '00

Thought this may be of interest to y'all. Sorry for the cross-posting... I've created a mailing list for any and all discussion pertaining to 111 8th Avenue (aka 76 9th Avenue), the New York City carrier hotel building. Everyone is welcome to subscribe, though we're especially trying to attract folks who have space there, be it several floors, or a small fraction of a rack somewhere. To subscribe, shoot a blank mail to <111-8th-subscribe(a)latency.net> from the address you wish to post from. Enjoy, -adam

1 0

Under DDoS attack; what do I do now?
by Chris Adams 30 Aug '00

30 Aug '00

We appear to be under a distributed denial of service attack. We are receiving 7.5+ megabits per second of ICMP traffic (it looks like a smurf attack) from all over to a single address (one that was in our dialup pool). We've taken the IP out of our pool and are routing it to a separate interface with a computer just setup to capture traffic. It isn't causing an immediate problem, since we've routed the traffic away, but what do we do next? We've been contacted by a couple of the people sending the ICMP replies complaining about us pinging them and told them about fixing distributed broadcast and they've said they'll look into it. What do we do to track this down? We've got four upstreams and the traffic appears to be coming in all four; do we need to call all of them? Is there any kind of organization that can help coordinate this? Thanks for any help you can give. -- Chris Adams <cmadams(a)hiwaay.net> Systems and Network Administrator - HiWAAY Information Services I don't speak for anybody but myself - that's enough trouble.

3 2

Re: Under DDoS attack; what do I do now?
by Jim Duncan 30 Aug '00

30 Aug '00

Chris Adams writes: > We appear to be under a distributed denial of service attack. We are > receiving 7.5+ megabits per second of ICMP traffic (it looks like a > smurf attack) from all over to a single address (one that was in our > dialup pool). We've taken the IP out of our pool and are routing it to > a separate interface with a computer just setup to capture traffic. > > It isn't causing an immediate problem, since we've routed the traffic > away, but what do we do next? We've been contacted by a couple of the > people sending the ICMP replies complaining about us pinging them and > told them about fixing distributed broadcast and they've said they'll > look into it. > > What do we do to track this down? We've got four upstreams and the > traffic appears to be coming in all four; do we need to call all of > them? Is there any kind of organization that can help coordinate this? > > Thanks for any help you can give. If Cisco equipment is involved, you can use the information at http://www.cisco.com/warp/public/707/22.html to characterize the attack and perhaps trace it. If you expect assistance from upstream, you'll have to characterize the attack as much as possible. Since the source addresses are usually spoofed, tracing the attack means that senior network engineers have to look at each link along the path, and it's going to be hard to get them interested if the traffic is not well defined. If you don't already know who to contact at each of your upstream providers, open a case with their support desk. Most major ISPs and NSPs have special teams that deal with attacks. If one of the upstreams (or other sources) is a member of the Forum of Incident Response and Security Teams (FIRST), you can look up the specific response team's contact info at http://www.first.org/. There's more info on mitigating DDoS attacks on the Cisco Security Advisories page, http://www.cisco.com/warp/public/707/advisory.html. If you need further help, you can contact the Cisco TAC. If it's a bona-fide emergency, you can engage our group, the Cisco Product Security Incident Response Team, to assist. Jim -- Jim Duncan, Product Security Incident Manager, Cisco Systems, Inc. <http://www.cisco.com/warp/public/707/sec_incident_response.shtml> E-mail: <jnduncan(a)cisco.com> Phone(Direct/FAX): +1 919 392 6209

1 0

B/W Utilization Programs
by Karyn Ulriksen 30 Aug '00

30 Aug '00

Hi All, It approaching my semi-annual review of b/w utilization monitor programs. I'm looking at both ATM and non-ATM solutions. Been using Netscout which works pretty good, but I would like to keep on top of whatever else is out there and have been to busy to look at any recent developments. What's everyone using out there these days to monitor their colos b/w utilization, etc.? --------------------------------------------------------------------- Best regards, Karyn Ulriksen Director of Network Operations PublicHost, A SiteStream Company 22 Mauchly, Suite 200 Irvine, California 92618 USA Phone: (949) 743-2000 email: kulriksen(a)publichost.com URL: http://www.publichost.com ===========================================

1 0

RE: ARIN Policy on IP-based Web Hosting (fwd)
by sigma＠pair.com 30 Aug '00

30 Aug '00

>No, but I've done due diligence to minimize the requirement and have created >an environment that is directed towards minimization. As far as the concern >regarding using a "premium", last I checked this is a commercial venture. Most of us are running commercial ventures. Consequently, we don't appreciate your interpretation of the policy to allow your business model but disallow others. The implication is that your model is more valid because you charge extra for something. ARIN policy has no place in deciding such matters. Your interpretation may be wrong, or it may not. There isn't enough information from the ARIN policy to determine those ramifications, just like they skipped over all of the other per-IP services that are commonly associated with Web hosting. >> By what justification does this poorly-thought-out policy >> interfere with >> business models or competitive advantages between hosts? > >Could you clarify what you are asking here? I'm rhetorically asking if it's acceptable for ARIN policies to identify one business model as preferable over another, and if so, why. I'll keep that question to the ARIN lists in the future, however, as it's not operational (only the impact of such policy is operational). >> Great for your customers, then. > >They butter my bread. Gotta keep them happy. Same here. >> Are you proposing to circumvent the policy? > >Uh... No. I just accept the challenge of doing more with less. I'm always >game for problem solving, that's why I do what I do. That's why they pay me >the big bucks. I was accused of proposing to circumvent the policy. I do not propose that, and I'm glad you don't either. Although your interpretation is your own. What I and many others would like to see is a more clear and reasonable policy from ARIN. We do provide anonymous FTP service with every per-IP domain. It's part of the service. It's not a premium. Many customers use it. Many customers use other virtualized services we provide by default as well. If that gets us an exception from ARIN, and I'm not at all certain it will, that's great for us, but it still isn't fair to other hosts. Kevin

1 0

RE: ARIN Policy on IP-based Web Hosting (fwd)
by Karyn Ulriksen 30 Aug '00

30 Aug '00

> >There is only a small number of services that currently > really require > >dedicated IPs. HTTPS and Anonymous FTP. Although, the > HTTPS is a concern - > >not that many customers actually use the Anonymous FTP > service. We ended up > >offering Anonymous FTP as a premium service (I like to think > that this cuts > >down on warez and script kiddie distribution). > > Aha, I was waiting for someone to say that. > > So it's going to be OK to use per-host IP addresses if it's sold as a > "premium" service? So that business model is OK, but not > another? What if > we say all of our services are "premium"? What if too many of your > customers start paying you for that "premium" service? Where's the > threshold? Are you more justified in your IP usage because > you charge your > customers more for it? No, but I've done due diligence to minimize the requirement and have created an environment that is directed towards minimization. As far as the concern regarding using a "premium", last I checked this is a commercial venture. > > By what justification does this poorly-thought-out policy > interfere with > business models or competitive advantages between hosts? Could you clarify what you are asking here? > > >A few customers will whine, but 98% don't know > >the difference, understand and accept the limititations, or > are just so damn > >happy it works that they don't mind. > > Great for your customers, then. They butter my bread. Gotta keep them happy. > > >Although I do agree that ARIN does tend to be anal, I > believe some system > >architects would have shot us all in the foot by now if they > hadn't put > >their foot down. We just have to be cleverer than them and > I think that > >shouldn't be too hard, right? > > Are you proposing to circumvent the policy? Uh... No. I just accept the challenge of doing more with less. I'm always game for problem solving, that's why I do what I do. That's why they pay me the big bucks.

1 0