September 2000 - Test - lists.nanog.org

RE: Disabling QAZ (was Re: Port 139 scans)
by Roeland M.J. Meyer 29 Sep '00

29 Sep '00

I never argued that. > -----Original Message----- > From: Dana Hudes [mailto:dhudes@hudes.org] > Sent: Friday, September 29, 2000 2:43 PM > To: Roeland M.J. Meyer > Cc: Dan Hollis; nanog(a)merit.edu > Subject: RE: Disabling QAZ (was Re: Port 139 scans) > > > that does not give me authority to connect to stranger's PCs > > On Fri, 29 Sep 2000, Roeland M.J. Meyer wrote: > > > Just like they probably don't know that they're infected, > they probably > > won't know that they've been disinfected. At least the first time. > > > > > -----Original Message----- > > > From: Dana Hudes [mailto:dhudes@hudes.org] > > > Sent: Friday, September 29, 2000 2:03 PM > > > To: Dan Hollis; nanog(a)merit.edu > > > Subject: Re: Disabling QAZ (was Re: Port 139 scans) > > > > > > > > > > > > I am willing to scrap together a script to shutdown the virus > > > on an infected machine and put it in a CGI web page. > > > I'm not sure about volume but initially I think I can host > > > it. In the event my 1Mbit connection is overwhelmed I'll need > > > another place.... > > > What stops me at the moment is that I have no authorization > > > to test against any infected machine. > > > I need a target. > > > I'm willing to also try for making the connection to the > > > share and removing the infection but I'm not sure I can get > > > it in time. > > > At least a shutdown page would do something. > > > I will start writing my code and await direct e-mail with > > > authorization and a target IP address to test against. > > > Note that I have plenty of potential test targets in my Samba > > > logs :-( but no legal authority to connect to those machines. > > > > > > ----- Original Message ----- > > > From: "Dan Hollis" <goemon(a)sasami.anime.net> > > > To: <nanog(a)merit.edu> > > > Sent: Friday, September 29, 2000 4:42 PM > > > Subject: Re: Disabling QAZ (was Re: Port 139 scans) > > > > > > > > > > > > > > On Fri, 29 Sep 2000, John Fraizer wrote: > > > > > On Fri, 29 Sep 2000, Dan Hollis wrote: > > > > > > It would be cool if someone would make a tool that > > > would auto-disinfect > > > > > > users... > > > > > Yep. The problem with that is that current laws on the > > > books (in the US > > > > > at least) make this an illegal solution. If memory > > > serves me correctly, > > > > > the one I'm thinking about is worded something like: > > > > > "...any person who without authorization, accesses, > > > modifies, deletes or > > > > > destroys..." > > > > > > > > A web page that users themselves must click "OK, disinfect > > > me"? Seems > > > > authorization enough to me... > > > > > > > > > The penalties are pretty stiff too. The best of > > > intentions don't negate > > > > > the fact that it's illegal. > > > > > > > > When the user initiates the disinfection themselves? > > > > > > > > -Dan > > > > > > > > > > > > >

1 0

RE: Disabling QAZ (was Re: Port 139 scans)
by Carter, Gregory 29 Sep '00

29 Sep '00

-----BEGIN PGP SIGNED MESSAGE----- Greetings, The windows 2000 resource kit comes with a small tool that will add/remove/list shares on a machine. It is called share.vbs and works on other 2k boxes however I have not yet tried it on windows 9x platforms. It might be worth looking into however obviously the legalities of such actions still remain unfortunately. Cheers, Greg +(gcarter(a)infoDNS.com)-------------------------------------------------+ | infoDNS http://www.infodns.com/ | | Senior Network Administrator bits/keyID 1024/7DF9C285 | | Register your domain name today for only $15/yr. | +--------[ DC 50 57 59 C3 76 46 E8 EB 75 A8 94 FE 96 9E D3 ]----------+ - -----Original Message----- From: John Fraizer [mailto:nanog@EnterZone.Net] Sent: Friday, September 29, 2000 1:30 PM To: Dan Hollis Cc: Mike Lewinski; nanog(a)merit.edu Subject: Re: Disabling QAZ (was Re: Port 139 scans) On Fri, 29 Sep 2000, Dan Hollis wrote: > > On Fri, 29 Sep 2000, Mike Lewinski wrote: > > "exit" will close the connection but not the QAZ server, while "quit" does > > appear to shut it down. You can also "run x". Once QAZ has been shutdown, > > it's also possible to connect to the share and manually delete the infected > > notepad.exe, although I haven't yet figured out if there's a way to unshare > > someone's drives remotely via command line (if I did this, I wouldn't be > > able to get back in to clean the infection). > > It would be cool if someone would make a tool that would auto-disinfect > users... > > -Dan > > Yep. The problem with that is that current laws on the books (in the US at least) make this an illegal solution. If memory serves me correctly, the one I'm thinking about is worded something like: "...any person who without authorization, accesses, modifies, deletes or destroys..." The penalties are pretty stiff too. The best of intentions don't negate the fact that it's illegal. - --- John Fraizer EnterZone, Inc -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQCVAwUBOdT7PG2piax9+cKFAQFVcQQAnfq88CRumG9MBsxGJOYqLX7mdCGoFozj yIPTPohfwSu56Q0ekNecwaHNFKLqfwBZY6LkWZg12Mt5k+ozaPNBv5F4w2sRCEh7 2n1VIdrXqNfczTPpPSmJWFwsY4O7xFWV791oUYhLWTdML13WpErOoLArz1wqwAPa 5AuN1Lw/cNc= =EEXT -----END PGP SIGNATURE-----

1 0

RE: availability and resiliency
by Roeland M.J. Meyer 29 Sep '00

29 Sep '00

> From: Lionel Lauer [mailto:longword@newsguy.com] > Sent: Friday, September 29, 2000 10:54 AM > > On Fri, 29 Sep 2000 17:39:04 +0100, Andrew Bangs <andrewb(a)demon.net> > wrote: > > > > >On Thu, Sep 28, 2000 at 02:39:40PM -0600, Irwin Lazar wrote: > >> Hi all, > >> Does anyone know if a template exists for what it takes to > provide 5 9's of > >> availability, 4 9's etc.for Internet data centers? > Specifically I'm looking > >> for something that would say "if you want 5 9's of > availability, here's what > >> you need to do", and so on. > > > >For 5 9s you need: > > > >1) Lots of money > >2) Lots of clue > >3) Lots of luck > >4) Lots of balls > > > >You can do 4 9s with any 3 of the above. > > Too true. > > But you forgot to include 'halfway-clued management' - > without that you > haven't got a hope in hell of even getting three 9's. ;) Covered under 2 (above). You need clued mgmnt even to ask for it, let alone "pay" for it. Non-clued management gets ingress filtered at the initial cost estimate layer, for cost-estimate layers that are properly operational.

1 0

Re: Disabling QAZ (was Re: Port 139 scans)
by Dan Hollis 29 Sep '00

29 Sep '00

On Fri, 29 Sep 2000, Mike Lewinski wrote: > the e-mail or not. I believe that this SMTP isn't actually responsible for > _any_ legitimate mail, a check on MX records for yeah.net shows that it's > not listed there. Perhaps the attackers have modified the MTA itself now to > hide their tracks, making it look like that address has been disabled (the > virus doesn't know this, and will keep trying to send at every reboot, btw). How about asking the tier1's to null0 route that chinese MTA? We are blocking 139/tcp and 7597/tcp on our borders. -Dan

1 0

The Cidr Report
by Tony Bates 29 Sep '00

29 Sep '00

This is an auto-generated mail on Fri Sep 29 12:00:00 PDT 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 29Sep00 0) General Status Table History ------------- Date Prefixes 220900 87996 230900 87972 240900 88049 250900 88476 260900 88933 270900 88898 280900 88696 290900 88909 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 8613 Number of ASes announcing only one prefix: 4912 (2732 cidr, 2180 classful) Largest number of cidr routes: 895 announced by AS701 Largest number of classful routes: 1087 announced by AS701 1) Gains by aggregating at the origin AS level --- 29Sep00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 431 153 278 64.5% BCnet Backbone AS1785 623 377 246 39.5% AppliedTheory Communications AS1221 614 453 161 26.2% TELSTRA-AS AS816 581 437 144 24.8% UUNET Canada (ASN-UUNETCA-AS4) AS5696 421 285 136 32.3% WinStar AS AS9269 177 47 130 73.4% Hong Kong CTI AS2609 128 8 120 93.8% EUnet-TN AS7657 337 220 117 34.7% The Internet Group Limited AS7046 390 277 113 29.0% COQUI-NET PRTC Internet AS9304 124 17 107 86.3% Hutchcity AS7545 158 55 103 65.2% TPG Internet Pty Ltd AS4755 214 116 98 45.8% Videsh Sanchar Nigam Ltd. India AS705 354 258 96 27.1% ALTERNET-AS AS6429 210 114 96 45.7% FirstCom Internet AS9706 103 9 94 91.3% Pusan Metropolitan City Office of AS7496 125 34 91 72.8% Power Up AS8013 488 402 86 17.6% PSINET-CA AS174 538 452 86 16.0% Performance Systems International AS4293 338 255 83 24.6% Internal ASN for C&W AS6595 138 57 81 58.7% DODDSEUR AS13999 90 9 81 90.0% UNKNOWN AS3908 255 176 79 31.0% Supernet, Inc. AS1727 166 92 74 44.6% MRMS-WEST AS577 248 175 73 29.4% Bell Backbone AS701 1087 1018 69 6.3% Alternet AS7018 579 512 67 11.6% AT&T WorldNet Service Backbone AS724 227 161 66 29.1% DLA-ASNBLOCK-AS AS8895 102 37 65 63.7% Saudi Arabia AS AS5106 99 36 63 63.6% AADS-COLUMBUS AS3749 119 57 62 52.1% TECNET For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

availability and resiliency
by Irwin Lazar 29 Sep '00

29 Sep '00

Hi all, Does anyone know if a template exists for what it takes to provide 5 9's of availability, 4 9's etc.for Internet data centers? Specifically I'm looking for something that would say "if you want 5 9's of availability, here's what you need to do", and so on. Ideally, the template would define issues such as divergent fiber, redundant power, hot spares, etc. Thanks in advance, Irwin

3 2

Dark Fibre
by Alex 29 Sep '00

29 Sep '00

Warning: this email is not operational. Anyone got a lead on some dark fibre between telecity london/docklands, and telehouse london/docklands? Either 2 strands direct or 4 diverse.. Thanks.

2 1

RE: availability and resiliency
by Leo Nelson 29 Sep '00

29 Sep '00

Pardon my ignorance, but what the heck does a "9" refer too? Is it a UPS, rack, floor space, circuit... Thanks in advance -leo -----Original Message----- From: Lionel Lauer [mailto:longword@newsguy.com] Sent: Friday, September 29, 2000 10:54 AM To: Andrew Bangs Cc: nanog(a)merit.edu Subject: Re: availability and resiliency On Fri, 29 Sep 2000 17:39:04 +0100, Andrew Bangs <andrewb(a)demon.net> wrote: > >On Thu, Sep 28, 2000 at 02:39:40PM -0600, Irwin Lazar wrote: >> Hi all, >> Does anyone know if a template exists for what it takes to provide 5 9's of >> availability, 4 9's etc.for Internet data centers? Specifically I'm looking >> for something that would say "if you want 5 9's of availability, here's what >> you need to do", and so on. > >For 5 9s you need: > >1) Lots of money >2) Lots of clue >3) Lots of luck >4) Lots of balls > >You can do 4 9s with any 3 of the above. Too true. But you forgot to include 'halfway-clued management' - without that you haven't got a hope in hell of even getting three 9's. ;) -- W . | ,. w , "Some people are alive only because \|/ \|/ it is illegal to kill them." Perna condita delenda est ---^----^---------------------------------------------------------------

2 1

RE: availability and resiliency
by Leo Nelson 29 Sep '00

29 Sep '00

Thank all of you who responded. I appreciate it. -leo -----Original Message----- From: Chris Flores [mailto:chris.flores@onfiber.com] Sent: Friday, September 29, 2000 10:20 AM To: 'Leo Nelson'; 'nop(a)alt.net'; Andrew Bangs Cc: nanog(a)merit.edu Subject: RE: availability and resiliency Leo - The '9' refers to a specific SLA (service level agreement). 5 9's is the guaranteed amount of network uptime. Another way to state 5 9's is - 99.999% uptime. This of course yields the amount of time a customer's service is not available. 5 9's is equivalent to 315 un-available seconds per year or 5 minutes. Best regards. Chris -----Original Message----- From: Leo Nelson [mailto:lnelson@axient.com] Sent: Friday, September 29, 2000 12:08 PM To: 'nop(a)alt.net'; Andrew Bangs Cc: nanog(a)merit.edu Subject: RE: availability and resiliency Pardon my ignorance, but what the heck does a "9" refer too? Is it a UPS, rack, floor space, circuit... Thanks in advance -leo -----Original Message----- From: Lionel Lauer [ mailto:longword@newsguy.com <mailto:longword@newsguy.com> ] Sent: Friday, September 29, 2000 10:54 AM To: Andrew Bangs Cc: nanog(a)merit.edu Subject: Re: availability and resiliency On Fri, 29 Sep 2000 17:39:04 +0100, Andrew Bangs <andrewb(a)demon.net> wrote: > >On Thu, Sep 28, 2000 at 02:39:40PM -0600, Irwin Lazar wrote: >> Hi all, >> Does anyone know if a template exists for what it takes to provide 5 9's of >> availability, 4 9's etc.for Internet data centers? Specifically I'm looking >> for something that would say "if you want 5 9's of availability, here's what >> you need to do", and so on. > >For 5 9s you need: > >1) Lots of money >2) Lots of clue >3) Lots of luck >4) Lots of balls > >You can do 4 9s with any 3 of the above. Too true. But you forgot to include 'halfway-clued management' - without that you haven't got a hope in hell of even getting three 9's. ;) -- W . | ,. w , "Some people are alive only because \|/ \|/ it is illegal to kill them." Perna condita delenda est ---^----^---------------------------------------------------------------

1 0

RE: UUnet trouble ticket and response time
by Kevin Santamaria 29 Sep '00

29 Sep '00

It's possibly the MCI WorldCom operations syndrome: "Ignore the issue, then construct a plausible excuse if the issue does not go away!" Please wait for the excuse. Its coming. -;) Kevin -----Original Message----- From: Craig Holland [mailto:cholland@yahoo-inc.com] Sent: Friday, September 29, 2000 11:19 AM To: Hank Nussbacher; nanog(a)merit.edu Subject: RE: UUnet trouble ticket and response time Ya...I have many circuits w/ UUNet, and I've noticed a considerable drop in their 'help-desk' responce. Hell, I don't even get an email back anymore saying that they received my email. It seems I find routing issues before they do, and when I do, they don't even let me know if they are working on them or anything. craig > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Hank Nussbacher > Sent: Thursday, September 28, 2000 11:35 PM > To: nanog(a)merit.edu > Subject: UUnet trouble ticket and response time > > > > Apologies in advance: > > Uunet placed a route object in RADB with origin AS701, even > though the /24 > belonged to us and messed up certain routings in certain places. So we > sent them the problem and got issued a trouble ticket (UU2282116) on Sept > 9. Till today, even after repeated emails to them on this TT, we > received > not a single response over the course of 3 weeks. In the end, MERIT went > in and removed the brain-dead /24 route object. > > Is this how UUnet operates these days? > > -Hank > >

1 0