September 2000 - Test - lists.nanog.org

RE: Port 139 scans
by Roeland M.J. Meyer 28 Sep '00

28 Sep '00

> >> a large number of random hosts scanning through their > >> address space using TCP > >> on port 139? > > We have been seeing this for about 3 weeks now. > > s/weeks/years/ Yes, but definitely a recent upsurge in this activity. I have three clients reporting same. Storm's a brewin'.

1 0

Re: OSPF VS. IS-IS
by Marshall Eubanks 27 Sep '00

27 Sep '00

Troy Davis wrote: > > my email client is not a web browser.. > > seriously, the vast majority of nanog subscribers can't read HTML > "enhanced" messages. > > On Wed, 27 Sep 2000, Marshall Eubanks <tme(a)21rst-century.com> wrote: You are absolutely correct and I apologize - I have changed my preferences so that this will not happen again. In some ways, this has been superceded, but FWIW here is the original -------- Original Message -------- Subject: Re: OSPF VS. IS-IS Date: Wed, 27 Sep 2000 19:27:41 -0400 From: Marshall Eubanks <tme(a)21rst-century.com> Reply-To: tme(a)21rst-century.com Organization: Multicast Technologies To: Leo Nelson <lnelson(a)axient.com> CC: "'nanog(a)merit.edu'" <nanog(a)merit.edu> References: <2A2BBEF175D5AC4F9796F03C98F08C1F7817A7(a)ax000002.phx.axient.com> Leo Nelson wrote: > > > Hello I am in search of any articles that reflect the differences > between OSPF and IS-IS. I am particularly interested in papers that > highlight design, implementation, bandwidth usage, and scalability > concerns for large internetworks. > > Also if anyone could give some statistics on the how much IS-IS is > being used in large scale ISP, ASP, and NAPs > > Thank You > Leo Nelson CCNA > Axient Communications > 602.850.3083 Have you read Radia Perlman;'s book ? She was a creator of IS-IS, and goes into some detail. I would start there... >From Amazon : Interconnections, Second Edition : Bridges, Routers, Switches, and Internetworking Protocols (Addison Wesley Professional Computing Series) by Radia Perlman Our Price: $59.95 Availability: Usually ships within 24 hours. See larger photo Hardcover - 560 pages 2 edition (October 1999) Addison-Wesley Pub Co; ISBN: 0201634481 ; Dimensions (in inches): 1.28 x 9.55 x 7.65 -- Regards Marshall Eubanks T.M. Eubanks Multicast Technologies, Inc. 10301 Democracy Lane, Suite 410 Fairfax, Virginia 22030 Phone : 703-293-9624 Fax : 703-293-9609

1 0

OSPF VS. IS-IS
by Leo Nelson 27 Sep '00

27 Sep '00

Hello I am in search of any articles that reflect the differences between OSPF and IS-IS. I am particularly interested in papers that highlight design, implementation, bandwidth usage, and scalability concerns for large internetworks. Also if anyone could give some statistics on the how much IS-IS is being used in large scale ISP, ASP, and NAPs Thank You Leo Nelson CCNA Axient Communications 602.850.3083

3 2

RE: OSPF VS. IS-IS
by Leo Nelson 27 Sep '00

27 Sep '00

Way cool thank you very much Ping -----Original Message----- From: Ping Pan [mailto:pingpan@research.bell-labs.com] Sent: Wednesday, September 27, 2000 3:21 PM To: Leo Nelson Cc: 'nanog(a)merit.edu' Subject: Re: OSPF VS. IS-IS Some have brought up this question before. Please take a look at http://www.nanog.org/mtg-0006/katz.html - Ping > Leo Nelson wrote: > > Hello I am in search of any articles that reflect the differences > between OSPF and IS-IS. I am particularly interested in papers that > highlight design, implementation, bandwidth usage, and scalability > concerns for large internetworks. > > Also if anyone could give some statistics on the how much IS-IS is > being used in large scale ISP, ASP, and NAPs > > Thank You > Leo Nelson CCNA > Axient Communications > 602.850.3083

1 0

RE: Port 139 scans
by Roeland M.J. Meyer 27 Sep '00

27 Sep '00

> From: John Fraizer [mailto:nanog@EnterZone.Net] > Sent: Wednesday, September 27, 2000 11:26 AM > > On Wed, 27 Sep 2000, Bill Becker wrote: > > > Speaking of the internet and the way it operates, is anyone > else seeing a > > large number of random hosts scanning through their address > space using TCP > > on port 139? > > > > Bill > > We have been seeing this for about 3 weeks now. I have too, it looks like they're looking for Windoze and Samba boxen. That's one of the netbios ports.

2 1

RE: Inventor of the Internet Technology / Father of Modern Day Ne tworking
by Michael Medwid 27 Sep '00

27 Sep '00

No - Al Gore invented the Internet. (Sorry list - I couldn't resist.) -----Original Message----- From: Ehud Gavron [mailto:GAVRON@ACES.COM] Sent: Wednesday, September 27, 2000 9:28 AM To: nanog(a)merit.edu Cc: GAVRON(a)ACES.COM Subject: Inventor of the Internet Technology / Father of Modern Day Networking My apologies for this non-op note. I was hoping to tap the wisdom of the collective. http://www.lk.cs.ucla.edu/ http://www.lk.cs.ucla.edu/LK/Inet/keys.html Is there a person who invented the Internet, and is this person him? Cheers, Ehud

4 3

Re: netscan.org update
by Patrick W. Gilmore 27 Sep '00

27 Sep '00

At 12:36 AM 9/27/2000 -0400, John Fraizer wrote: >I do understand where you may draw that conclusion however. Testing >for the presence of gas (smurf amplifiers) with a sniffer (single ICMP >echo-request scan) is NOT the same as simply throwing a match at the gas >main (waiting for an attack). > >So, the simple answer to your question is no. Especially since the source address is not spoofed. >John Fraizer TTFN, patrick

1 0

AS-Path analysis tool?
by Dan Hollis 27 Sep '00

27 Sep '00

Anyone know of good AS-Path analysis tools? I'd like to do some AS-Path statistical analysis in order to do some BGP tuning. -Dan

1 0

Re: Port 139 scans
by Ben Browning 27 Sep '00

27 Sep '00

At 01:14 PM 9/27/00 -0400, Bill Becker wrote: >Speaking of the internet and the way it operates, is anyone >else seeing a large number of random hosts scanning through >their address space using TCP on port 139? I get about 4 or 5 of these a day on my home boxen and I receive 5-10 times that many abuse complaints regarding this activity. My current suspicion is that a backdoor trojan (pause here to decline the port 139 attempt that just zipped by me) is on the loose and being propagated like mad. This would certainly fit with the rumour of a huge DDoS attack in the works, as m@d l33t h@x0rs get as many machines as possible compromised and ready to help the attack. I have noticed that the large majority of these scans from my address space (216.39.128.0 - 216.39.192.255) are targeted at others in the 216.39.* and 216.40.* blocks. Also, all of the computers in question seem to be Win9x boxes. Coincidence? I think not. Perhaps this is a new virus afoot that replicates itself by hunting through an IP block and the ones above and below it for an open Windows share. That would make sense, given the data I have thus far. CERT has an advisory up (http://www.cert.org/vul_notes/VN-2000-03.html) about NetBIOS DoS attacks, but these don't seem to be hosing networks, just kind of feeling around. If anyone else has more info, please share it! --- Ben Browning <benb(a)oz.net> oz.net Network Operations Tel (206) 443-8000 Fax (206) 443-0500 http://www.oz.net/

5 4

Re: Port 139 scans
by ken lindahl 27 Sep '00

27 Sep '00

On Wed, 27 Sep 2000, Bill Becker wrote: > Speaking of the internet and the way it operates, is anyone else seeing a > large number of random hosts scanning through their address space using TCP > on port 139? > > Bill we've seen similar scans here at UCB, and have traced a number of them to a win32 trojan variously named {note.com,Qaz.Trojan,QAZ.worm,TROJ_QAZ.A, Trojan/Notepad,W32.HLLW.Qaz.A}. if you're so inclined, you can test for this by telnetting to port 7597 on the machine that scanned you. http://vil.nai.com/villib/dispVirus.asp?virus_k=98775 for details. ken

1 0