August 2001 - Test - lists.nanog.org

nanog mail not getting here
by Lou Katz 06 Aug '01

06 Aug '01

Due to the CRII load, apparently I cannot properly do a lookup on trapdoor.merit.edu, so nanog mail is bouncing with a temporary error 451 "Sender domain must resolve". If anyone knows how to jigger my sendmail to let this through without opening the floodgates, please contact me offlist. Thanks. -=[Lou Katz]=-

1 0

Re: The Death of TCP/IP
by smoot＠tic.com 06 Aug '01

06 Aug '01

> Owen DeLong <owen(a)delong.sj.ca.us> said: > Most of those 400 varieties interoperate with current IP. If you look > at the > history of VINES IP, as in his example, I think you will find that his > concerns > are not as far off as you would hope. I doubt if MS is deliberately trying to get rid of TCP/IP at this point in time. They did try to build their own proprietary network a few years ago and it failed because of the existense of the Internet. Also MS has a major problem in trying to close a network protocol around their OS and it is not technical. It is the finding they are a monopoly and monopolies have to be very careful about their business practices. Closing off generic use of TCP/IP from their OS would be seen as very anti-competitive. -- Smoot Carl-Mitchell Consultant

1 0

RE: CodeRed: New Variant?
by Seth M. Kusiak 06 Aug '01

06 Aug '01

Perhaps I should explain a bit more: This is a known exploit (http://www.microsoft.com/technet/security/bulletin/ms01-023.asp) however I saw many requests from multiple IP's. I thought that this was odd to see so many in such a short time. I thought that maybe another worm was on the loose. ~Seth Seth M. Kusiak writes: > > I'm seeing this. Anyone else? > > -------------------------------------------------------------------------- > 2001-08-05 22:11:37 <Client IP> - <Server IP> 80 GET /NULL.printer - 302 0 > 315 2365 0 > > > > > > > > 3À°Ø@`3Û³$Ãÿàë¹1j - - - > --------------------------------------------------------------------------

2 1

Earthlink NOC contact needed
by jlewis＠lewis.org 06 Aug '01

06 Aug '01

I sent this out last week, but the list server seems to have intercepted and tossed the message. It seems that some of our customer IP blocks are in whatever Earthlink uses for spam blacklisting on their incoming mail gateways. Emails to OpenRelay(a)Corp.EarthLink.Net have not generated any response, and calls to 1-800-EARTHLINK result in lots of time spent on hold and not much else. If anyone in a capacity to do anything about this at Earthlink sees this, could you please contact me off-list? 550-EarthLink's inbound mail servers do not allow mail from your site. 550-Please contact your ISP to find out how to send e-mail using a 550-proper mail server. If you are an EarthLink customer, and need 550-assistance configuring your e-mail software, please contact 550-EarthLink's technical support department at 1-800-EARTHLINK. 550-Server administrators that feel they are being blocked in error 550 may send e-mail to OpenRelay(a)Corp.EarthLink.Net for assistance. -- ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

RE: The Death of TCP/IP
by Roeland Meyer 06 Aug '01

06 Aug '01

> From: Wojtek Zlobicki [mailto:wojtekz@idirect.com] > Sent: Sunday, August 05, 2001 3:09 PM > > <RANT> > > Nothing other than anti-Microsoft propaganda. You cannot > blame Microsoft > for high market share. But you can blame them for making Vbasic available to every email message that wants to rape your system. Boy, what a brain-fart that was. It still stinks. Repeat after me; nothing in an email message should be executable without express and very deliberate operator intervention. > The main reason that *Nix hosts are generally more > resilient to these type of worms is that it is less likely for a non > informed administrator to administer a *Nix sever. False. A very large portion of the *nux machines are in this sad condition. > If everyone that had a > IIS box available on the big I, installed all related > patches, worms like Code Red would never propagate very far. Sure they would, you'd just never notice it. A *real* programmer would have started CodeRed out at the current Level III version. > Raw socket support in NOT a bad thing. I wonder if Robert > Cringely and Steve Gibson are friends. Now here, we agree. > "Say goodbye to TCP/IP and to anonymous connections of any > kind. Hello to > Hailstorm, tracking everything down to the last mile, and a more > business-friendly Internet with prioritized packet-handling. " I've just been looking at Hailstorm, it sucks. Think "totalitarianism". Think, re-enforcment of monopoly position. > </RANT> > > I really encourage anyone with a tough skin, and looking for > a good laugh to > read this article. > > > ----- Original Message ----- > From: "Robert Hough" <rch(a)acidpit.org> > To: <nanog(a)merit.edu> > Sent: Sunday, August 05, 2001 12:23 AM > Subject: The Death of TCP/IP > > > > > > Felt like sharing this most amusing article that I discovered in my > > Inbox this morning: > > > > http://www.pbs.org/cringely/pulpit/pulpit20010802.html > > > > -- > > Robert Hough (rch(a)acidpit.org) > >

5 4

IP address blocks for out-of-band inter-provider links
by Sean Donelan 06 Aug '01

06 Aug '01

While working on how to set up an out-of-band communication network between several providers, a question about whose IP addresses to use came up. The intent is to provide an out-of-band management network allowing member providers to exchange management information and alerts even if the main Internet is severely congested by malicious traffic. Because this isn't supposed to be connected to the Internet, its not necessary to use IANA/ARIN/RIPE/APNIC assigned IP address blocks. Several providers use private addresses on their out-of-band management networks. I would prefer to use globally unique IP addresses between providers to avoid conflicts with the RFC1918 private addresses already in use in provider's networks, and if the addresses accidently leak. Other than exchange points, are there any other cases of unique IP addresses being allocated for multi-provider purposes?

4 3

RE: The Death of TCP/IP
by Roeland Meyer 06 Aug '01

06 Aug '01

> From: Wojtek Zlobicki [mailto:wojtekz@idirect.com] > Sent: Sunday, August 05, 2001 7:26 PM > > From: "Roeland Meyer" <rmeyer(a)mhsc.com> > To: "'Wojtek Zlobicki'" <wojtekz(a)idirect.com>; <nanog(a)merit.edu> > > > > From: Wojtek Zlobicki [mailto:wojtekz@idirect.com] > > > Sent: Sunday, August 05, 2001 3:09 PM > > > > > > <RANT> > > > > > > Nothing other than anti-Microsoft propaganda. You cannot > > > blame Microsoft > > > for high market share. > > > > But you can blame them for making Vbasic available to every > email message > > that wants to rape your system. Boy, what a brain-fart that > was. It still > > stinks. Repeat after me; nothing in an email message should > be executable > > without express and very deliberate operator intervention. > > Agreed, BUT .... as stated by Cringley himself, Microsoft > tailors their software to the populus. Aside from that fact that I think Cringley's still living in the haze-daze, I think that you've been sucking down that MS Kool-Aid too hard. What MSFT says and what MSFT does are two very different things. They're very good at stroking you so that you don't notice it when they cut your throat, until the cutting's done. Then it's too late. MSFT learned triple-level agendii from the best in the business ... IBM. If you don't read at least three levels of meaning into every MSFT press release then you're being very nieve. Every word in those things is manacured to perfection. You can bet that they are the absolute truth, that they are absolutely accurate, and absolutely incomplete. But, incomplete in such a way that you will not notice. It's the goals and agendii that are very well hidden. > Wow a software company listening to its users, what a travesty. What's a travesty is that they don't have the user's primary best interest at heart at all. Users may benefit, and probably will, but MSFT will benefit even more. Options that do not include a MSFT benefit are not even considered. > > > The main reason that *Nix hosts are generally more > > > resilient to these type of worms is that it is less > likely for a non > > > informed administrator to administer a *Nix sever. > > > > False. A very large portion of the *nux machines are in this sad > condition. > > False, many popular exploits (such as those with BIND) are > fixed/patched much faster. Uh huh, wu-ftp ... anyone? It's been *years* already. How about PINE? Let us not forget qpopper. I *do* hope that you're not mounting your PDC's NTDS files on anything less than a hardware RAID1 array. If that file evaporates, you will have to re-install *every* DC in the house. > Now a really scarry worm would be one that exploits Apache. why? What about the new Oracle 9i application server? I'm just looking at that now, I'm sure that there are some issues there. BTW, the first-ever worm was created in a *nix box and infested other *nix boxen, via uucp. In the same time-period, FidoNet was worm-proof. > I used *NIX and not Linux for a reason. Many UNIX boxes are much better secured. > Joe Sixpack that installs his favourite distro of Linux is just as vulnerable as a > windows users. I will give you > the fact that there are still many unsecure/unpatched boxes > in both worlds. It all comes > down to the poor management of Internet connected devices. I think that I made that point. It is even more true today. *nix boxen cost sufficiently much that you generally find them only in professionally-run shops. *nux boxen are found everywhere else. But, also in professionally run shops... right next to the *nix boxen. Latest pricing, of OpenUnix, is right at $1K. *nux is generally around fifty bucks. Guess which one Joe home-user will buy? Guess which one Joe Corp-user will buy? There's lots behind that, which I won't go into here. No, it isn't that clean a cut. This is basic marketing, folks. > I am really encouraged > by the new option of auto installing updates in Windows XP. That doesn't scare you? If someone figures out a way to tap into that update channel then they *own* your WinXP box. Especially since, there isn't a human in that loop. Like no one has ever stolen a MSFT cert before? One bogus update and put a fork in you .. you're done. You only *thought* that CodeRed spread fast. BTW, look at Caldera's Volution sometime.

1 0

Code Red Hammering Away
by Lou Katz 06 Aug '01

06 Aug '01

My little Class C seems to be getting 3-6 attempts per second to connect to Port 80 on various IPs at the present time. Is this about average? -=[L]=-

11 15

Re: nanog 23
by Marshall Eubanks 05 Aug '01

05 Aug '01

I am very sorry, that message was not intended for you. (I am in London for the IETF and am running on little sleep). Again, my apologies Marshall Eubanks >****** Forwarded Message Follows ******* > > >On Fri, 3 Aug 2001, Carol Wadsworth wrote: > >> Hotel Information URL: >> >> http://www.nanog.org/mtg-0110/hotel.html > >For those of you in uncertain financial situations (and I know there are >several of you out there) and are looking to save the extra buck, the >Washington Inn, just down the street from the Mariott is offering a >corporate rate of $128. Their number is 510-452-1776. > >-- >Brandon Ross 404-522-5400 >EVP Engineering, NetRail http://www.netrail.net >AIM: BrandonNR ICQ: 2269442 >Read RFC 2644! > Marshall Eubanks tme(a)21rst-century.com

2 1

Re: nanog 23
by Marshall Eubanks 05 Aug '01

05 Aug '01

Also, I have meetings in San Jose Augsut 16 and in LA August 17. Please get me a flight for this (leaving on the 15th and returning redeye on the 17th). Please send me an email tomorrow with options etc. Marshall >I will speak there. Please register Art Trudel and >get us a room together. > >Marshall >****** Forwarded Message Follows ******* > > >On Fri, 3 Aug 2001, Carol Wadsworth wrote: > >> Hotel Information URL: >> >> http://www.nanog.org/mtg-0110/hotel.html > >For those of you in uncertain financial situations (and I know there are >several of you out there) and are looking to save the extra buck, the >Washington Inn, just down the street from the Mariott is offering a >corporate rate of $128. Their number is 510-452-1776. > >-- >Brandon Ross 404-522-5400 >EVP Engineering, NetRail http://www.netrail.net >AIM: BrandonNR ICQ: 2269442 >Read RFC 2644! > Marshall Eubanks tme(a)21rst-century.com

1 0