November 2002 - Test - lists.nanog.org

RE: Even the New York Times withholds the address
by Jurbala, Daryl 19 Nov '02

19 Nov '02

The page loaded pretty slow. Must be cloudy today. Daryl G. Jurbala Sr. Network Engineer WorldNet Technology Consultants, Inc. Tel: +1.610.288.6200 FAX: +1.508.526.8500 http://www.wtci.net

1 0

Re: Bin Laden Associate Warns of Cyberattack
by sgorman1＠gmu.edu 19 Nov '02

19 Nov '02

It is a great example of how well Al-Quedah manipulates the media. There are more ways to wreak havoc than script kiddies and DOS attacks. ----- Original Message ----- From: "David Howe" <DaveHowe(a)gmx.co.uk> Date: Tuesday, November 19, 2002 1:58 pm Subject: Re: Bin Laden Associate Warns of Cyberattack > > at Tuesday, November 19, 2002 12:00 AM, Dan Hollis <goemon(a)anime.net> > was seen to say: > > "There are millions of Muslims around the world involved in hacking > > the Pentagon and Israeli government sites," said Bakri." > I wonder how they could tell amongst all the millions of script > kiddieztrying the same thing? > > > > >

2 1

Re: CogentCo
by Mike (meuon) Harrison 19 Nov '02

19 Nov '02

> >It also appears to block Gnutella and similar protocols. > > You should never sign an IP access agreement that doesn't give you access to > the filtering rules that affect your traffic. Ideally, you should strongly We have not signed a thing. If I even attempted to explain the complex political fiasco that got us here, even Nanog members would be shocked. And as interested parties are on this list (I got a call already) and monitoring this discussion, I'll refrain. Theoretically, the other end of this 100mbps connection is Gig-E and is costing $20-30g/month.. we are testing it for suitability for our purposes... so far it is not making the grade. We've been spoiled by a UUnet and AT&T connection. :) For those that wanted the bad (140 lines of perl) speed check CGI, it's: http://speedy.higherbandwidth.net/speed.zip No, it's not secure or very bright.. It's a quick idiot check and is very useful, especially when it can use an suid'd MTR. And lastly, THANK YOU for all the testing, the marvelous traceroutes and data collected and the personal (mostly off-list) e-mails regarding Cogent. --Mike-- alpha/beta-testing metronetchattanooga.com

2 3

Bin Laden Associate Warns of Cyberattack
by sgorman1＠gmu.edu 19 Nov '02

19 Nov '02

Might be of interest: http://www.computerworld.com/securitytopics/security/story/0,10801,76000,00…

5 4

Re: PAIX
by Jere Retzer 19 Nov '02

19 Nov '02

Stephen Sprunk wrote: >>>Any point in the US is within 25ms RTT (or less) of a major exchange; eliminating this 25ms of latency will have no effect on VoIP unless you're already near the 250ms RTT limit for other reasons.<<< 25 MS is assuming that the only delay is due to the speed of light. Add equipment, especially routers or other gear that requires manipulating packets and the delays add up quickly. I once read that the most people wil tolerate on a regular basis is around 150-180 ms. I think that is much too high for regular use

7 7

some of these are worse than others
by Paul Vixie 18 Nov '02

18 Nov '02

in the last few months since i most recently cleared out the database, my test network (a defunct /16) has received 3.8M http transactions containing 460K distinct worm bodies sent from 137K source addresses. the top 8, by quantity, are: srcaddr | count | first | last -----------------+--------+---------------------+--------------------- 61.137.107.137 | 300772 | 2002-11-05 13:29:26 | 2002-11-14 03:19:42 210.82.7.205 | 72755 | 2002-11-13 14:12:00 | 2002-11-14 11:23:07 210.12.30.12 | 32450 | 2002-11-01 08:34:09 | 2002-11-01 09:04:10 24.193.82.174 | 31996 | 2002-10-30 11:56:58 | 2002-10-30 13:07:11 131.204.108.181 | 22524 | 2002-11-18 17:33:04 | 2002-11-18 18:05:13 24.76.78.204 | 22305 | 2002-10-30 12:13:39 | 2002-10-30 13:26:52 80.11.57.19 | 11379 | 2002-11-01 09:34:01 | 2002-11-01 10:49:20 63.142.226.235 | 10178 | 2002-11-08 12:51:44 | 2002-11-08 13:42:06 if you see one of your own up there, please put your hands on some lineman's shears and Do The Right Thing.

3 2

Re: PAIX
by Jere Retzer 18 Nov '02

18 Nov '02

Vadim Antonov wrote: >I definitely would NOT want to see my doctor over a video link when I need >him. The technology is simply not up to providing realistic telepresense, >and a lot of diagnostically relevant information is carried by things like >smell and touch, and little details. So telemedicine is a poor substitute >for having a doctor on site; and should be used only when it is >absolutely the only option (i.e. emergency on an airplane, etc). If you are really ill, this is true but there are always gray areas that go into the decision whether the 'illness' is worth a visit. Physicians often order things for patients they know based upon a phone call or even e-mail if they feel reasonably comfortable. I think that there are lots of situations that a physician would recommend "just keep Johnny home for a couple days, give him plenty of fluids and [fill in the blank] ― call me in two days if he isn't feeling better." Having live video of Johnny is a pretty good supplement to voice, or for that matter the receptionist could record the video call for the physician and he could play it back when he has a few minutes. It's potentially even more important with elderly shut-ins, because bringing them in can be difficult and expensive and their immune systems are typically weaker so you should try to minimize their exposure to people with contagious diseases. Jere

3 2

Preparing for the Big One
by Sean Donelan 18 Nov '02

18 Nov '02

ASIS San Francisco Bay Area Chapter Thursday, November 21st Meeting PREPARING FOR THE BIG ONE: ROAD CLOSURES & OTHER TRANSPORTATION CHALLENGES DUE TO BAY AREA EARTHQUAKES November's presentation will shake you up! Dr. Jeanne Perkins, Earthquake Program Director, Association of Bay Area Governments (ABAG), will provide an overview for 'Doing Business with Roads Closed After a Major Bay Area Earthquake.' She will discuss magnitude vs. intensity, direct and indirect causes for road closures, and ABAG's projection for road and airport closures. This is practical, scientific information you need to consider when writing disaster, emergency preparedness, and business continuity plans.

1 0

Re: [Re: Bin Laden Associate Warns of Cyberattack]
by Joshua Smith 18 Nov '02

18 Nov '02

and millions of others hacking at everything else.......sounds like fear mongering to me - guess we will probably be seeing a 'new' cyber security bill soon Dan Hollis <goemon(a)anime.net> wrote: > > On Mon, 18 Nov 2002 sgorman1(a)gmu.edu wrote: > > Might be of interest: > > http://www.computerworld.com/securitytopics/security/story/0,10801,76000,00… > > "There are millions of Muslims around the world involved in hacking the > Pentagon and Israeli government sites," said Bakri." > > Uh huh. > > -Dan > -- > [-] Omae no subete no kichi wa ore no mono da. [-] > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Re: some of these are worse than others
by Paul Vixie 18 Nov '02

18 Nov '02

> Which signature database you use to match these or just log the 404's ? i wrote my own. since it's only 247 lines long, i'll include it here. /* httpk - killer of http requests * vixie 05aug01 [from netperf 14jan92 [original]] * * $Id: httpk.c,v 1.5 2002/11/18 21:33:33 vixie Exp $ */ #include <setjmp.h> #include <stdio.h> #include <stdlib.h> #include <signal.h> #include <sys/errno.h> #include <sys/fcntl.h> #include <sys/mman.h> #include <sys/stat.h> #include <sys/time.h> #include "inetlib.h" #include <arpa/inet.h> extern int optind, opterr; extern char *optarg; static char *host = "localhost"; static char *serv = "http"; jmp_buf timedout; static int timelim; struct { char *base; size_t size; } content; static int sndbuf = 16*1024; static void setcontent(const char *); static void httpk(const char *, const char *); static void timeout(int); #define outc(Ch) \ if (isascii(Ch) && (isprint(Ch) || Ch == '\n')) \ putchar(Ch); \ else \ printf("\\%03o", (u_char)Ch) static void usage(const char *msg) { fprintf(stderr, "usage error: %s\n", msg); fprintf(stderr, "usage:\thttpk\t[-h host] [-s serv] [-t timelim] [-f file] [-l]\n"); exit(1); } main(int argc, char **argv) { int c; while (EOF != (c = getopt(argc, argv, "h:s:t:f:l"))) { switch (c) { case 'h': host = optarg; break; case 's': serv = optarg; break; case 't': timelim = atoi(optarg); break; case 'f': setcontent(optarg); break; case 'l': setlinebuf(stdout); break; default: usage("unknown option"); } } httpk(host, serv); } static void setcontent(const char *filename) { struct stat sb; int fd; char *cp; if ((fd = open(filename, O_RDONLY)) < 0) { perror(filename); exit(1); } if (fstat(fd, &sb) < 0) { perror("fstat"); exit(1); } content.size = sb.st_size; content.base = mmap(NULL, content.size, PROT_READ, 0, fd, 0); if (content.base == NULL) { perror("mmap"); exit(1); } } static void httpk(const char *host, const char *serv) { void *sockaddr; int server, client, i, tsize, rsize; long rtt; struct sockaddr_in sa; socklen_t sa_len; struct timeval whenrcvd; struct pkt *rbuf, *tbuf; sockaddr = InetSockAddr(host, serv, "tcp"); if (!sockaddr) { perror("InetSockAddr"); exit(1); } server = TcpServer(sockaddr, 0); if (server < 0) { perror("TcpServer"); exit(1); } signal(SIGALRM, timeout); loop: sa_len = sizeof sa; client = accept(server, (struct sockaddr *)&sa, &sa_len); if (client < 0) { if (errno == ECONNABORTED) goto loop; } else { struct sockaddr_in me; socklen_t me_len; char ch, lch; time_t now; FILE *fp; int n, l; me_len = sizeof me; if (getsockname(client, (struct sockaddr *)&me, &me_len) < 0) { perror("getsockname"); exit(1); } now = time(0); printf("src [%s].%u; ", inet_ntoa(sa.sin_addr), ntohs(sa.sin_port)); printf("dst [%s].%u; ", inet_ntoa(me.sin_addr), ntohs(me.sin_port)); printf("%s", ctime(&now)); fp = fdopen(client, "r+"); if (!fp) { perror("fdopen"); close(client); exit(1); } if (setjmp(timedout) != 0) { printf("*TIMEOUT*\n\n"); } else { enum { out, in, num } state; int conlen_p = 0; u_long conlen; if (timelim != 0) alarm(timelim); while (ch = getc(fp), !feof(fp)) { n = 0; state = in; do { if (isascii(ch) && isupper(ch)) lch = tolower(ch); else lch = ch; if (state == in) if (lch=="content-length:"[n]){ if (lch == ':') { state = num; conlen = 0; conlen_p = 0; } } else state = out; else if (state == num) { if (!isascii(ch)) ; else if (!conlen_p && isspace(ch)) ; else if (isdigit(ch)) { conlen *= 10; conlen += (ch - '0'); conlen_p = 1; } else state = out; } if (ch == '\n') break; if (ch != '\r') { outc(ch); n++; } } while (ch = getc(fp), !feof(fp)); if (n == 0) break; putchar('\n'); } if (conlen_p) { putchar('+'); putchar('\n'); n = 0; while (n < conlen && (ch = getc(fp), !feof(fp))) { outc(ch); n++; } if (n > 0 && ch != '\n') putchar('\n'); } putchar('\n'); if (timelim != 0) alarm(0); } shutdown(client, SHUT_RD); setsockopt(client, 6, SO_SNDBUF, &sndbuf, sizeof sndbuf); fcntl(client, F_SETFL, fcntl(client, F_GETFL) | O_NONBLOCK); if (content.base != NULL && content.size != 0) { fprintf(fp, "HTTP/1.1 404 %s\r\n", "You are digging in the wrong place"); fprintf(fp, "Connection: close\r\n"); fprintf(fp, "Content-Length: %d\r\n", content.size); fprintf(fp, "Content-Type: text/html\r\n"); fputs("\r\n", fp); fflush(fp); writev(client, &content, 1); } else { fputs("HTTP/1.1 204 Zilch\r\n", fp); fputs("Connection: close\r\n", fp); fputs("Content-Length: 0\r\n", fp); fputs("\r\n", fp); } fclose(fp); goto loop; } perror("accept"); signal(SIGALRM, SIG_DFL); } static void timeout(int foo) { longjmp(timedout, 1); }

1 0