January 2002 - Test - lists.nanog.org

Global Crossing files for Chap. 11
by Brian Coyle 28 Jan '02

28 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://biz.yahoo.com/rb/020128/business_telecoms_globalcrossing_dc_1.html Mon 8:09pm ET Global Crossing Ltd. on Monday said it filed for bankruptcy protection as two of its Asian business partners agreed to pay $750 million to assume control of the high-speed communications services company as it reorganizes in the fourth-largest insolvency in U.S. history. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8VhEnER3MuHUncBsRAvZxAJ4hbScE+7b3ERRpY7AoAA4t1fpolQCbBY37 BXbdPrtPy42C7PF+rkQUx1c= =DgET -----END PGP SIGNATURE-----

1 0

formmail.pl - What hack is this?
by John Palmer (NANOG Acct) 27 Jan '02

27 Jan '02

Anyone hear of some sort of a cracking method that uses cgi-bin/formmail? I've seen alot of these in my httpd/access_log files lately. I don't have formmail.pl anywhere on my system - I flushed all of the cgi-bin stuff that came with apache a long time ago. John

4 3

Re: formmail.pl - What hack is this?
by Steven M. Bellovin 27 Jan '02

27 Jan '02

In message <011601c1a7a7$22eae140$c89d05c7@TAKA>, "John Palmer (NANOG Acct)" wr ites: > >Anyone hear of some sort of a cracking method that uses cgi-bin/formmail? >I've seen alot of these in my httpd/access_log files >lately. I don't have formmail.pl anywhere on my system - I flushed all of >the cgi-bin stuff that came with apache a long time ago. > Spammers are actively looking for such scripts to abuse to send junk mail. See, for example, http://securitytracker.com/alerts/2001/Mar/1001108.html --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

1 0

"Tier 1 Backbones" which don't filter IP packets?
by Ehud Gavron 27 Jan '02

27 Jan '02

While developing yet another revision to the NANOG Traceroute (ftp://ftp.login.com/pub/software/traceroute) I noticed that one of our new DS3 providers administratively prohibits all LSRR and SSRR packets. Are there any other "Tier-1" providers who either a. Claim to filter these packets b. Don't claim to but do filter them c. Don't filter them Please respond privately; if there's interest (privately expressed) I'll summarize to the list. If you also have other unofficial filters you're aware of that nationwide backbones impose on DS3 and higher customers... I'll be happy to summarize that as well. Ehud

1 0

traffic filtering
by Stephen Griffin 27 Jan '02

27 Jan '02

Hello, I'm curious about how many networks completely filter all traffic to any ip address ending in either ".0" or ".255". I'm curious because any network /0-/23,/31,/32 can legitimately have ip addresses in-use which end as such. /32's can obviously have (most) any ip address, since there is no notion of a network or broadcast address. /31 doesn't have a directed broadcast. For /0-/23 only the first ".0" and the last ".255" correspond to reserved addresses. All of the intervening addresses are legal. Is this type of filtering common? What alternate solutions are available to mitigate (I'm assuming) concerns about smurf amplifiers, that still allow traffic to/from legitimate addresses. What rationale is used to filter all traffic to network/broadcast addresses of /24 networks while ignoring network/broadcast of /25-/30? For that matter, what percentage of smurf amplifiers land on /24 boundaries? Thanks, Stephen

12 16

RE: Routing through non-addressable space???
by Simon Higgs 26 Jan '02

26 Jan '02

At 09:35 PM 1/25/02 -0600, you wrote: Mmmmmm... this trace is from an @Work/Excite circuit that is about to go dark. The "cable modem" is (as far as I can tell) the Cisco 2600 at the customer site. Either that or @Work's customer gateway address. >Cable modems actually "have" two IP's: one rfc1918 that they use for >provisioning purposes and in the actual IP of the cable modem device, >one real IP that they pass on to the end-user's device. Many of the >newer cable modems are now showing the private IP in traces where >previously they'd pass and not respond to ICMP. As for why, who knows? >My best guess is to ease tracking down offending IP's vs. users. > >Michael Graham > >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >Turpin, Mark >Sent: Friday, January 25, 2002 8:43 PM >To: 'Simon Higgs'; 'nanog(a)merit.edu' >Subject: RE: Routing through non-addressable space??? > > >Routing through a cable interface that has a 10.x address as its primary >ip >address would be my first guess, esp. due to the 24.x address. > >! >int cable3/0 >ip address 10.x.x.x. x.x.x.x.x >ip address public.for.cpe.equip mask.mask.mask.mask secondary > >cheers, > >Mark Turpin >Charter NOC >mturpin(a)chartercom.com > >-----Original Message----- >From: Simon Higgs [mailto:simon@higgs.com] >Sent: Friday, January 25, 2002 8:47 PM >To: nanog(a)merit.edu >Subject: Routing through non-addressable space??? > > >Can someone explain this trace to me. How on earth did the 10.0.0.0 >network >get inserted into the last hop? > ># IP address Host name Round >trip >time > >4 24.130.2.243 GSR1-SRP4-0.lsanhe4.we.mediaone.net 64 ms >5 24.130.2.242 GSR2-SRP4-0.lsanhe3.we.mediaone.net 71 ms >6 12.125.98.13 Unavailable 79 ms >7 12.123.28.94 gbr2-p100.la2ca.ip.att.net 94 ms >8 No response >9 12.122.11.226 ggr1-p340.la2ca.ip.att.net 110 ms >10 192.205.32.246 att-gw.la.home.net 112 ms >11 24.7.74.182 wbb1-pos2-0.pop1.ca.home.net 120 ms >12 10.252.25.118 Unavailable 134 ms >13 209.125.128.80 Unavailable 141 ms Best Regards, Simon -- ###

1 0

The Cidr Report
by CIDR Report 26 Jan '02

26 Jan '02

This is an auto-generated mail on Fri Jan 25 23:00:00 PST 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 25Jan02 0) General Status Table History ------------- Date Prefixes 180102 104688 190102 104682 200102 104656 210102 104633 220102 104637 230102 104624 240102 104664 250102 104855 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 12293 Number of ASes announcing only one prefix: 7436 (4212 cidr, 3224 classful) Largest number of cidr routes: 716 announced by AS701 Largest number of classful routes: 1364 announced by AS701 1) Gains by aggregating at the origin AS level --- 25Jan02 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1172 901 271 23.1% Telstra Pty Ltd AS701 1364 1130 234 17.2% UUNET Technologies, Inc. AS4151 288 156 132 45.8% USDA AS577 320 196 124 38.8% Bell Advanced Communications Inc. AS16473 198 77 121 61.1% Bell South AS7018 815 697 118 14.5% AT&T AS6595 172 61 111 64.5% DoD Education Activity Network As AS705 288 184 104 36.1% UUNET Technologies, Inc. AS852 383 286 97 25.3% Telus Advanced Communications AS17557 184 87 97 52.7% Pakistan Telecom AS7046 313 227 86 27.5% UUNET Technologies, Inc. AS19632 95 13 82 86.3% Metropolis Intercom S.A. AS2048 185 105 80 43.2% State of Louisiana AS12302 111 32 79 71.2% MobiFon S.A. AS1239 469 391 78 16.6% Sprint AS4755 223 151 72 32.3% Videsh Sanchar Nigam Ltd. Autonom AS703 275 213 62 22.5% UUNET Technologies, Inc. AS3464 159 97 62 39.0% Alabama SuperComputer Network AS724 214 155 59 27.6% DLA Systems Automation Center AS226 146 89 57 39.0% Los Nettos AS16758 63 6 57 90.5% IKON Office Solutions AS702 657 601 56 8.5% UUNET Technologies, Inc. AS7303 107 52 55 51.4% Telecom Argentina Stet-France Tel AS4323 383 328 55 14.4% Time Warner Communications, Inc. AS3908 320 265 55 17.2% Supernet, Inc. AS19834 63 8 55 87.3% NetForce, Inc. AS4200 104 50 54 51.9% Apex Global Information Services, AS2149 313 260 53 16.9% Performance Systems, Inc. AS13999 66 14 52 78.8% Mega Cable S.A. de C.V. AS1 492 440 52 10.6% BBN Planet Total 53762 42007 11755 21.9% For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: uunet outage?
by Daniel Lark 26 Jan '02

26 Jan '02

I have been noticing several UUNet problems recently. My Oakland office (connected via UUNet) and my company's service bureau, run by a contractor company (also UUNet) had problems seeing my main corp. web server colo'd at Hurricane Electric, yesterday. Turns out there was a DoS attack ran against a router on above.net (which provides the peering between UUNet and HE). However, I have also seen problems with customers being unable to see my contractor's machines. Supposedly, there are some rather strategic DoS attacks going on. Can anyone confirm this? Regards, Dan Lark ELM Resources, Inc.

2 1

Routing through non-addressable space???
by Simon Higgs 25 Jan '02

25 Jan '02

Can someone explain this trace to me. How on earth did the 10.0.0.0 network get inserted into the last hop? # IP address Host name Round trip time 4 24.130.2.243 GSR1-SRP4-0.lsanhe4.we.mediaone.net 64 ms 5 24.130.2.242 GSR2-SRP4-0.lsanhe3.we.mediaone.net 71 ms 6 12.125.98.13 Unavailable 79 ms 7 12.123.28.94 gbr2-p100.la2ca.ip.att.net 94 ms 8 No response 9 12.122.11.226 ggr1-p340.la2ca.ip.att.net 110 ms 10 192.205.32.246 att-gw.la.home.net 112 ms 11 24.7.74.182 wbb1-pos2-0.pop1.ca.home.net 120 ms 12 10.252.25.118 Unavailable 134 ms 13 209.125.128.80 Unavailable 141 ms Best Regards, Simon -- ###

2 1

RE: Routing through non-addressable space???
by Turpin, Mark 25 Jan '02

25 Jan '02

Routing through a cable interface that has a 10.x address as its primary ip address would be my first guess, esp. due to the 24.x address. ! int cable3/0 ip address 10.x.x.x. x.x.x.x.x ip address public.for.cpe.equip mask.mask.mask.mask secondary cheers, Mark Turpin Charter NOC mturpin(a)chartercom.com -----Original Message----- From: Simon Higgs [mailto:simon@higgs.com] Sent: Friday, January 25, 2002 8:47 PM To: nanog(a)merit.edu Subject: Routing through non-addressable space??? Can someone explain this trace to me. How on earth did the 10.0.0.0 network get inserted into the last hop? # IP address Host name Round trip time 4 24.130.2.243 GSR1-SRP4-0.lsanhe4.we.mediaone.net 64 ms 5 24.130.2.242 GSR2-SRP4-0.lsanhe3.we.mediaone.net 71 ms 6 12.125.98.13 Unavailable 79 ms 7 12.123.28.94 gbr2-p100.la2ca.ip.att.net 94 ms 8 No response 9 12.122.11.226 ggr1-p340.la2ca.ip.att.net 110 ms 10 192.205.32.246 att-gw.la.home.net 112 ms 11 24.7.74.182 wbb1-pos2-0.pop1.ca.home.net 120 ms 12 10.252.25.118 Unavailable 134 ms 13 209.125.128.80 Unavailable 141 ms Best Regards, Simon -- ### "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers."

1 0