September 2001 - Test - lists.nanog.org

anybody know what's going on with att cable modems in MA?
by Miles Fidelman 14 Sep '01

14 Sep '01

A whole slew of ATT Broadband cable modems in the Greater Boston area have been off the air since midnight Tues. The folks at ATT have been less than useless in giving out any information. Does anybody know what's going on? Thanks much, Miles Fidelman ************************************************************************** The Center for Civic Networking PO Box 600618 Miles R. Fidelman, President & Newtonville, MA 02460-0006 Director, Municipal Telecommunications Strategies Program 617-558-3698 fax: 617-630-8946 mfidelman(a)civicnet.org http://civic.net/ccn.html Information Infrastructure: Public Spaces for the 21st Century Let's Start With: Internet Wall-Plugs Everywhere Say It Often, Say It Loud: "I Want My Internet!" **************************************************************************

1 0

[OT] NTK now, 2001-09-14 (excerpt)
by J.D. Falk 14 Sep '01

14 Sep '01

http://www.ntk.net In these terrible times, it's good to watch the tech community put its problems aside, and supply what we were all so desperately short of: plenty of wild unsolicited opinions. After those first few hours of awful shocked silence - what a relief to be interrupted by the CEO of CoffeeCup Software, producers of an innocuous Windows HTML editor, e-mailing his 1.2 million customer base to "call for [the responsible] country's complete destruction and annihilation". And at the end of that fateful day, noted hacker Eric S. Raymond rained his thoughts like fresh water, revealing that those who "disarmed all the non-terrorists on those airplanes ... bear some moral responsibility". Thanks too to BYTE's Jerry Pournelle, who slowly toughened his demands from an early request that /usr/bin/laden be handed over "bound and chained", to Thursday's demand that Nablus, Gaza, Baghdad *and* Damascus be razed to the ground; to the Evening Standard infowar expert who warned that "inflamed young men" could escalate the conflict by releasing "cyber viruses, crashing our computers ... from council houses in Bradford"; and kindly John Keegan in the Telegraph, who wrote that ISPs should ban encryption among their users, and those who refused must be "destroyed with cruise missiles". And on through the lonely nights, as net.folk on chat traded credulous rumours and confused geopolitics, and Nostradamus buffs mulled seriously over a quatrain that, sadly, was probably invented by a skeptic to show how *any* random phrase could end up a doomladen prophecy. But be assured that the crisis is not yet over. Please help: opinions are still desperately needed - and bloggers, columnists and sleep-deprived newsreaders are running short of ideas. So: do you have some minority you'd like to haphazardly blame? Some half-arsed genocidal theory you'd like to insist become global policy? Some simplistic demonisation of a country's recent history that needs to be waved in the faces of everyone you know? Mail it to our hotline on devnull(a)spesh.com, and we'll pass it on to those who must fill the useless silence which would otherwise be wasted on slow, methodical grief. http://www.coffeecup.com/attack/ - "many e-mails thanking me for removing the word 'annihilation'" http://www.adequacy.org/?op=displaystory;sid=2001/9/12/102423/271 - Why the Bombings Mean That We Must Support My Politics http://www.jerrypournelle.com/war/whattodo.html - "There may be other places." http://www.dailytelegraph.co.uk/dt?pg=/01/9/14/do01.html - also, if their contention ratio goes above twenty, nuke 'em http://www.thisislondon.co.uk/dynamic/news/top_story.html?in_review_id=4569… - no hidden meaning in using Bradford as an example http://www.google.com/search?q=cache:www.ed.brocku.ca/~nmarshal/nostradamus… - search for "abstract" ----- End forwarded message ----- And, for the record, I agree that political stuff should be moved off of NANOG -- though I greatly appreciate the efforts of Sean Donelan and others to keep us all informed on how the disaster affects the Internet. -- J.D. Falk all good dreams return in time <jdfalk(a)cybernothing.org>

2 1

RE: Yes it's off topic but who cares right now.
by Greg Mirsky 14 Sep '01

14 Sep '01

RE: celebrations BACKGROUND ---------- According to the AP, the Palestinians have been threatening news organizations and their workers in an effort to stop the broadcast of video and the publishing of photographs showing large crowds of Palestinians in Nablus and Ramallah joyfully celebrating the deadly terrorist attacks against Americans. Photographers and stringers (mostly Palestinians themselves) were forced by Palestinian gunmen to stop filming the celebrations (see the Agence France Press report below), and they were threatened with death if their video were broadcast. The news organizations they work for were told that everyone from their news organization would lose their access to PA officials and be unable to cover events in PA territory if they broadcast any video or photos of the large celebrations. (See reports below for more details). An AP photographer was specifically threatened with death if his photos were published. Here is the real news: THE AP HAS PUBLISHED A REPORT OF THE THREAT BUT HAS CAVED IN TO THE PA'S REQUEST not to publish these photos. So far we have only seen videos and photos of small crowds celebrating in eastern Jerusalem and Lebanon. At this moment, it looks like the Palestinian intimidation tactics are working to keep the most damning scenes from Ramallah and Nablus off American (and worldwide) television screens and out of the newspapers. Please urge AP and other news organizations to broadcast any video and/or photos they have of celebrations by Palestinian crowds in Nablus and Ramallah. Only by exposing and standing up to intimidation can it be stopped. Thank AP for publishing the story about the death threat to their videographer, but urge them to publish the photos. By appeasing those who threaten them, they are only encouraging further censorship and violence against their staff. * PA NEWSPAPER PRAISES SUICIDE BOMBERS: On a similar note, it is odd indeed that when Arafat's words of condolence were so widely broadcast by many in the media, so few in the press made note that on the very day of the attacks, the PA-controlled daily newspaper published an article praising suicide bombers as "the engines of history... the most honorable among us." See below for articles from AP, Agence France Press, IMRA, the Jerusalem Post, and PMW.

2 1

RE: Yes it's off topic but who cares right now.
by Greg Mirsky 14 Sep '01

14 Sep '01

This is a LIE!!! I''ll forward pictures that are not from that tape. -----Original Message----- From: Patrick Greenwell [mailto:patrick@cybernothing.org] Sent: Friday, September 14, 2001 1:23 PM To: Borchers, Mark Cc: 'Los, Ralph'; 'Dmitri Krioukov'; 'Arman Khalili'; 'nanog(a)merit.edu' Subject: RE: Yes it's off topic but who cares right now. On Fri, 14 Sep 2001, Borchers, Mark wrote: > doing. I do not think the people we saw dancing in the streets > on the news were typical Arab citizens. You might find this very interesting: From: "Marcio A. V. de Carvalho" <marcio.carv(a)UOL.COM.BR> Subject: Fourth Power All around the world we are subjected to 3 or 4 huge news distributors, and one of them - as you well know - is CNN. Very well, I guess all of you have been seeing (just as I've been) images from this company. In particular, one set of images called my attencion: the Palestinians celebrating the bombing, out on the streets, eating some cake and making funny faces for the camera. Well, THOSE IMAGES WERE SHOT BACK IN 1991!!! Those are images of Palestinians celebrating the invasion of Kuwait! It's simply unacceptable that a super-power of cumminications as CNN uses images which do not correspond to the reality in talking about so serious an issue. A teacher of mine, here in Brazil, has videotapes recorded in 1991, with the very same images; he's been sending emails to CNN, Globo (the major TV network in Brazil) and newspapers, denouncing what I myself classify as a crime against the public opinion. If anyone of you has access to this kind of files, search for it. In the meanwhile, I'll try to 'put my hands' on a copy of this tape. But now, think for a moment about the impact of such images. Your people is hurt, emotionally fragile, and this kind broadcast have very high possibility of causing waves of anger and rage against Palestinians. It's simply irresponsible to show images such as those. ____________ ------- End of forwarded message ------- De Balie Kleine gartmanplantsoen 10 1017 RR Amsterdam t 020 55 35 151 f 020 55 35 155 e lucas.evers(a)balie.nl ______________________________________________________ * Verspreid via nettime-nl. Commercieel gebruik niet * toegestaan zonder toestemming. <nettime-nl> is een * open en ongemodereerde mailinglist over net-kritiek. * Meer info, archief & anderstalige edities: * http://www.nettime.org/. * Contact: Menno Grootveld (rabotnik(a)xs4all.nl) ==============End of original message text===========

2 1

new mailing list: nanog-offtopic
by Nathan J . Mehl 14 Sep '01

14 Sep '01

I have created a mailing list, nanog-offtopic(a)lists.blank.org. It's only natural that, as a community of people as well as a gathering of professional peers, we would feel the need to discuss the non-operational aspects of events like the WTC bombing (and even ones of far lesser magnitude) with the same people who's opinions we value on technical topics. Unfortunatly, there's no escaping that it swamps the signal-to-noise ratio on the main list. I would like to extend an invitation to any and all nanog(a)merit.edu members to subscribe, and continue the various fascinating (seriously) side-discussions we've been having there. Agreement with my personal views is not a criterion for membership -- I expect to be as largely an invisible administrator there as Susan is here. To subscribe, send email to nanog-offtopic-subscribe(a)lists.blank.org from the account you wish to receive the mail at. My thanks to you all, -Nathan J. Mehl p.s. my apologies if this has already been done elsewhere; a cursory seach of my own nanog archives did not turn it up. ------------------------------------------------------------<memory(a)blank.org> "The beauty you like is precisely that which escapes you." (--Issey Miyake) <http://blank.org/memory/>----------------------------------------------------

1 0

RE: New Worm
by Roeland Meyer 14 Sep '01

14 Sep '01

Strange that this one resurfaces just after we discussed Win shares t'other day. -----Original Message----- From: Hire, Ejay [mailto:Ejay.Hire@Broadslate.net] Sent: Friday, September 14, 2001 8:25 AM To: nanog(a)merit.edu Subject: RE: New Worm I was in error. This is not a new worm. Just an old one that won't die. http://www.Symantec.com/avcenter/venc/data/w32.hllw.bymer.html Apologies. -----Original Message----- From: Ejay Hire [mailto:Ejay.hire@broadslate.net] Sent: Friday, September 14, 2001 12:04 PM To: nanog(a)merit.edu Subject: New Worm My Honeypot was infected with a new self-replicating worm yesterday. It appears to check for open win95/98/me netbios shares with read/write permission and installs wininit.exe (the scanner/infector) and the distributed.net client (In quiet Mode). Upon reboot, the scanner will start and search for infectable hosts during periods of inactivity. The windows 2000 pro pc seems unaffected. I will make the files available for dis-assembly if anyone is interested. To check for infection, look for the following files in c:/windows/system wininit.exe --Application wininit.log --Apparent Log file info.dll --Apparent Log file dnetc.exe -- Distributed.net client dnetc.ini -- Distributed.net config Buff-in.* -- Distributed.net work units ms216.exe -- Unknown, but the timestamp matched the other files...

1 0

FW: We'll go forward from this moment
by Stafford, Todd 14 Sep '01

14 Sep '01

> -----Original Message----- > > It's my job to have something to say. > > They pay me to provide words that help make sense of that which > troubles the American soul. But in this moment of airless shock when > hot tears sting disbelieving eyes, the only thing I can find to say, > the only words that seem to fit, must be addressed to the unknown > author of this suffering. > > You monster. You beast. You unspeakable bastard. > > What lesson did you hope to teach us by your coward's attack on our > World Trade Center, our Pentagon, us? What was it you hoped we would > learn? Whatever it was, please know that you failed. > > Did you want us to respect your cause? You just damned your cause. > > Did you want to make us fear? You just steeled our resolve. > > Did you want to tear us apart? You just brought us together. > > Let me tell you about my people. We are a vast and quarrelsome > family, a family rent by racial, social, political and class > division, but a family nonetheless. We're frivolous, yes, capable of > expending tremendous emotional energy on pop cultural minutiae -- a > singer's revealing dress, a ball team's misfortune, a cartoon mouse. > We're wealthy, too, spoiled by the ready availability of trinkets > and material goods, and maybe because of that, we walk through life > with a certain sense of blithe entitlement. We are fundamentally > decent, though -- peace-loving and compassionate. We struggle to > know the right thing and to do it. And we are, the overwhelming > majority of us, people of faith, believers in a just and loving God. > > Some people -- you, perhaps -- think that any or all of this makes > us weak. You're mistaken. We are not weak. Indeed, we are strong in > ways that cannot be measured by arsenals. > > IN PAIN > > Yes, we're in pain now. We are in mourning and we are in shock. > We're still grappling with the unreality of the awful thing you did, > still working to make ourselves understand that this isn't a special > effect from some Hollywood blockbuster, isn't the plot development > from a Tom Clancy novel. Both in terms of the awful scope of their > ambition and the probable final death toll, your attacks are likely > to go down as the worst acts of terrorism in the history of the > United States and, probably, the history of the world. You've > bloodied us as we have never been bloodied before. > > But there's a gulf of difference between making us bloody and making > us fall. This is the lesson Japan was taught to its bitter sorrow > the last time anyone hit us this hard, the last time anyone brought > us such abrupt and monumental pain. When roused, we are righteous in > our outrage, terrible in our force. When provoked by this level of > barbarism, we will bear any suffering, pay any cost, go to any > length, in the pursuit of justice. > > I tell you this without fear of contradiction. I know my people, as > you, I think, do not. What I know reassures me. It also causes me to > tremble with dread of the future. > > In the days to come, there will be recrimination and accusation, > fingers pointing to determine whose failure allowed this to happen > and what can be done to prevent it from happening again. There will > be heightened security, misguided talk of revoking basic freedoms. > We'll go forward from this moment sobered, chastened, sad. But > determined, too. Unimaginably determined. > > THE STEEL IN US > > You see, the steel in us is not always readily apparent. That aspect > of our character is seldom understood by people who don't know us > well. On this day, the family's bickering is put on hold. > > As Americans we will weep, as Americans we will mourn, and as > Americans, we will rise in defense of all that we cherish. > > So I ask again: What was it you hoped to teach us? It occurs to me > that maybe you just wanted us to know the depths of your hatred. If > that's the case, consider the message received. And take this > message in exchange: You don't know my people. You don't know what > we're capable of. You don't know what you just started. > > But you're about to learn. >

1 0

Re: Internet assessment - September 13 2001
by Marshall Eubanks 14 Sep '01

14 Sep '01

> >On Fri, 14 September 2001, Leo Bicknell wrote: >> On Fri, Sep 14, 2001 at 01:10:55AM -0700, Sean Donelan wrote: >> > The Internet routed around much of the failure, but there seem to be >> > only a few individual networks which are unreachable. The generator >> >> I know that MFN/AboveNet is quite willing to provide temporary >> peering/transit services in the US and Europe for networks affected >> by this action. I suspect most other providers are offering similar >> help. I would hope that the Internet community could get these >> networks back online in fairly short order to help keep communications >> flowing. For those networks completely offline, can those with >> phone contacts pass this message along to them via voice lines? > > >I don't have a breakout of individual networks, so I can't give you >contact information for the networks offline. I've just been following >total networks, ASNs, etc. In particular Geoff's great graphs > >http://www.telstra.net/ops/bgp/bgp-active.html > >It appears a few hundred route announcements disappeared from the total >of 104,400 routes. In other words, less that 1% of the routes. > >Telstra may be located on the other side of the globe, but I'll take >data where I can find it. > >I can't tell how many are single-homed networks and servers located in >directly impacted area of New York, and how much is due to a combination >of failures in the area affecting both the primary, backup or alternate >facilities. Sean; Here is what we have from DC (times are EDT, from http://www.multicasttech.com/status/index.html ) Tueseday : 6:00 AM - we saw 11617 ASN & 103978 bgp routes Tueseday :12:00 AM - we saw 11597 ASN & 103697 bgp routes Tueseday : 6:00 PM - we saw 11583 ASN & 103548 bgp routes Wednesday : 6:00 AM - we saw 11566 ASN & 103321 bgp routes Thursday : 6:00 AM - we saw 11590 ASN & 103447 bgp routes Friday : 6:00 AM - we saw 11534 ASN & 103376 bgp routes This is all the granularity I have, alas. The Friday drop is due apparently to loosing 25 Broadway. The Tuesday drop is slower and more complicated - Verio dropped 12 ASN by noon. Renater (AS 2200) dropped 32 ASN between noon and 6 PM. Other interesting ones lost include AS 98 ROCKEFELLER-AS AS 4190 BINGHAMTON-U AS 11872 SYRACUSE-UNIVERSITY AS 13619 BASELINEFINANCIALWTC (a sad AS name now). AS 17087 NYSA AS 19072 OFFICEMAX AS 19073 DIGITRADE AS 19755 KIMBANET Some of these may have lost peering, some, such as AS 13619 and 17087, may have been taken out entirely. Regards Marshall Eubanks > > > Marshall Eubanks tme(a)21rst-century.com

2 1

New Worm
by Ejay Hire 14 Sep '01

14 Sep '01

My Honeypot was infected with a new self-replicating worm yesterday. It appears to check for open win95/98/me netbios shares with read/write permission and installs wininit.exe (the scanner/infector) and the distributed.net client (In quiet Mode). Upon reboot, the scanner will start and search for infectable hosts during periods of inactivity. The windows 2000 pro pc seems unaffected. I will make the files available for dis-assembly if anyone is interested. To check for infection, look for the following files in c:/windows/system wininit.exe --Application wininit.log --Apparent Log file info.dll --Apparent Log file dnetc.exe -- Distributed.net client dnetc.ini -- Distributed.net config Buff-in.* -- Distributed.net work units ms216.exe -- Unknown, but the timestamp matched the other files...

2 1

RE: New Worm
by Hire, Ejay 14 Sep '01

14 Sep '01

I was in error. This is not a new worm. Just an old one that won't die. http://www.Symantec.com/avcenter/venc/data/w32.hllw.bymer.html <http://www.Symantec.com/avcenter/venc/data/w32.hllw.bymer.html> Apologies. -----Original Message----- From: Ejay Hire [mailto:Ejay.hire@broadslate.net] Sent: Friday, September 14, 2001 12:04 PM To: nanog(a)merit.edu Subject: New Worm My Honeypot was infected with a new self-replicating worm yesterday. It appears to check for open win95/98/me netbios shares with read/write permission and installs wininit.exe (the scanner/infector) and the distributed.net client (In quiet Mode). Upon reboot, the scanner will start and search for infectable hosts during periods of inactivity. The windows 2000 pro pc seems unaffected. I will make the files available for dis-assembly if anyone is interested. To check for infection, look for the following files in c:/windows/system wininit.exe --Application wininit.log --Apparent Log file info.dll --Apparent Log file dnetc.exe -- Distributed.net client dnetc.ini -- Distributed.net config Buff-in.* -- Distributed.net work units ms216.exe -- Unknown, but the timestamp matched the other files...

1 0