August 2002 - Test - lists.nanog.org

cw
by Scott Granados 02 Aug '02

02 Aug '02

I'm here on cw out of SF and it seems ok.

1 0

ATT Fire in Philly?
by blitz 02 Aug '02

02 Aug '02

A guy on another list asked me about this, anyone else hear of it? It was supposedly a "switching station"..not much more info...some 1-800 service affected... Sounds like it might of been the POTS network, any outages noted here?

1 0

Is the PAIX Palo Alto taking a dump?
by Herb Leong 01 Aug '02

01 Aug '02

All my sessions at the PAIX are active--anybody else seeing this? /herb

6 6

Pacific Bell Frame Cloud problem in the San Francisco Area
by Ulf Zimmermann 01 Aug '02

01 Aug '02

Pacific Bell seems to have a larger Frame Relay cloud problem in the San Francisco Bay Area. Many dedicated PBI customers are affected by it. Outage started around 11:15am PDT and as of 1:50PM PDT they have no ETR. -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204 You can find my resume at: http://seven.Alameda.net/~ulf/resume.html

1 1

OpenSSH Trojan..
by Len Rose 01 Aug '02

01 Aug '02

According to what was posted here, you may wish to start scrubbing. http://docs.freebsd.org/cgi/getmsg.cgi?fetch=394609+0+current/freebsd-secur…

9 9

RE: Bonding ATM circuits for DSL
by Martin, Christian 01 Aug '02

01 Aug '02

The question is whether IMA exists on DS3 interfaces. I would suspect that the cell rate may be kind of high to support even load-balancing/splitting. Kinda like doing MLPPP on a pair of OC-12s. However, this is generally not needed unless your VC(P) needs to run at greater than the theoretical peak cell rate of the interface. If you have small DSL PVCs, you can just round-robin them via static PVC provisioning, or PNNI load-sharing of soft vcs. HTH -chris >-----Original Message----- >From: Christopher J. Wolff [mailto:chris@bblabs.com] >Sent: Thursday, August 01, 2002 4:51 PM >To: nanog(a)merit.edu >Subject: RE: Bonding ATM circuits for DSL > > > >I may have answered my own question. Create an IMA group interface. > >Regards, >Christopher J. Wolff, CIO >Broadband Laboratories, Inc. >http://www.bblabs.com > >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On >Behalf Of Christopher J. Wolff >Sent: Thursday, August 01, 2002 1:46 PM >To: nanog(a)merit.edu >Subject: Bonding ATM circuits for DSL > > > >Greetings. > >Has anyone experienced adding additional ATM DS3's and bonding >those together to form a single "fat pipe". For example if >you had a Qwest megacentral DSL DS3 loop and wanted to add >another one to make 90 megs instead of 45 megs is that done on >the ISP side or the Telco side or both? Thank you all so much >for your wisdom. > >Regards, >Christopher J. Wolff, CIO >Broadband Laboratories, Inc. >http://www.bblabs.com >

1 0

Bonding ATM circuits for DSL
by Christopher J. Wolff 01 Aug '02

01 Aug '02

Greetings. Has anyone experienced adding additional ATM DS3's and bonding those together to form a single "fat pipe". For example if you had a Qwest megacentral DSL DS3 loop and wanted to add another one to make 90 megs instead of 45 megs is that done on the ISP side or the Telco side or both? Thank you all so much for your wisdom. Regards, Christopher J. Wolff, CIO Broadband Laboratories, Inc. http://www.bblabs.com

1 1

Re: Is the PAIX Palo Alto taking a dump?
by Herb Leong 01 Aug '02

01 Aug '02

Ryuichi TAKASHIMA wrote: > In article <20020801.094033.65032074.takasima(a)ttnet.ad.jp> > Ryuichi TAKASHIMA <takasima(a)pwd.ad.jp> wrote: > > In article <20020801002457.31718.qmail(a)tomobiki.urusei.net> > > "Herb Leong" <herb(a)tomobiki.urusei.net> wrote: > > > > > All my sessions at the PAIX are active--anybody else seeing this? > > > > > > /herb > > > > Hi, > > All our sessions are "Active" too, from 00:20 GMT. > > > > Are there any scheduled maintenance or else? > > At 00:40 GMT, our sessions turned up. hmm.... I guess they plugged the switch back in... =) /herb

2 1

Identifying DoS sources quickly (was: Bogon list or Dshield.org type list)
by michael.dillon＠radianz.com 01 Aug '02

01 Aug '02

>As far as tracking DoS, I've read some good papers on the subject and it >always boils down to tracking MAC addresses and going interface by >interface to the source, demanding inter-ISP cooperation, and finally >legal assistance. This has been tried during a few severe instances with >poor results. That's the obvious solution to the problem if the problem is how to track down the source(s) of a DoS attack. However, in any DoS attack, there is always a victim and one or more devices sending attack traffic to the victim. The owners of the attacking devices are accessories to the crime although I'm sure they could plead ignorance and avoid any liability. But what if they could not plead ignorance? What if we could identify some of the attacking devices, and what if the victim sent a legal "cease and desist" letter to the owners of the attacking devices? Now, the victim is in a position to sue the owners of these attacking devices if they don't fix the problem by securing their machines. And once this happens and gets some press coverage, a whole bunch of other machine owners will wake up and realize that they could be stuck with big legal bills if they don't secure their machines. So, to restate the problem, how do we identify some of the sources of a DoS attack quickly, maybe even while the attack is still in progress? >Bots/Zombies are traded openly on IRC and there is no >accountability for personal security. ISPs won't shut someone down >because they've been "hacked", merely send them a warning Email or >call--a process that takes days in my experience. How many ISPs would identify the user of an IP address for the purposes of sending a "cease and desist" letter when contacted by a lawyer? Considering that failure to provide the identity would result in the ISP themselves getting sued by the DoS victim? As long as *SOME* ISPs would cooperate with a DoS victim, there is enough to get the legal ball rolling. The alternative is to painfully backtrack until you find an uncooperative ISP and then sure them. As I said before, if there was a central registry something like dshield.org that collected data on the destination IP addresses of DoS attacks along with estimated magnitude based on analysing the traffic from random source addresses blocked by ingress filters, then we have something an ISP can use to analyze their outgoing traffic. If you are an ISP and you have netflow data that contains destination addresses which also occur in the DoS victim registry then you should be willing to act on that data. Of course, it's up to you what you do with it. You may offer the DoS victim the identity of the source provided that they serve you with the right legal documents. Or you might go to the owner of the machine yourself with the evidence and warn them that they are aiding and abetting cyber terrorists and could suffer the legal consequences if they don't secure their machines. It's certainly not perfect but it's worth a try. --Michael Dillon

8 10

Re: OpenSSH Trojan=tisk tisk
by Gerardo A. Gregory 01 Aug '02

01 Aug '02

The lack of humor of some NANOG list members is also admirable..... ----- Original Message ----- From: "Steve Mickeler" <steve(a)neptune.ca> To: "Gerardo A. Gregory" <ggregory(a)affinitas.net> Cc: "jnull" <jnull(a)truerouting.com>; "'Len Rose'" <len(a)netsys.com>; <nanog(a)nanog.org> Sent: Thursday, August 01, 2002 10:40 AM Subject: Re: OpenSSH Trojan=tisk tisk > > The lack of clue demonstrated by some nanog list members never ceases to > amaze me. > > I'm guessing those bashing SunOS on the server wouldnt be able to hax0r it > if their life depended on it. > > Whats the point in starting an OS war ? > > <sigh> > > On Thu, 1 Aug 2002, Gerardo A. Gregory wrote: > > > > > Might as well have a windows 2000 server doing it!!!!!!!!! > > > > Gerardo A. Gregory > > Manager Network Administration and Security > > 402-970-1463 (Direct) > > 402-850-4008 (Cell) > > Affinitas - Latin for "Relationship" > > Helping Businesses Acquire, Retain, and Cultivate Customers > > Visit us at http://www.affinitas.net > > ------------------------------------------------------------------ > > 1015 N. 98th Suite 100 > > Omaha, NE 68114 > > ------------------------------------------------------------------ > > > > > > ----- Original Message ----- > > From: "jnull" <jnull(a)truerouting.com> > > To: "'Len Rose'" <len(a)netsys.com>; <nanog(a)nanog.org> > > Sent: Thursday, August 01, 2002 10:24 AM > > Subject: RE: OpenSSH Trojan=tisk tisk > > > > > > > > > > > > > A chain is only as strong as its weakest link: > > > Connected to openbsd.sunsite.ualberta.ca. > > > 220- > > > 220- Welcome to SunSITE Alberta > > > 220- > > > 220- at the University of Alberta, in Edmonton, Alberta, Canada > > > 220- > > > 220- All connections to and transfers from this server are logged. If > > > 220- you do not like this policy, please disconnect now. > > > 220- > > > 220- You may want to grab the index file called "ls-lR.gz" in /pub. It > > > is > > > 220- updated nightly with the contents of the ftp tree. > > > 220- > > > 220- If you have any questions, hints, or requests, please email > > > 220- > > > 220- sunsite(a)sunsite.ualberta.ca > > > 220- > > > 220 merlin FTP server (SunOS 4.1) ready. > > > > > > A Sun server as a host for a OpenBSD source is like writing combinations > > > to a bank vault on the back of your hand. > > > > > > jnull > > > PGP: 0x54B1A25C > > > "!!!!!" It's the little things .... > > > > > > > > > -----Original Message----- > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > > > Len Rose > > > Sent: Thursday, August 01, 2002 3:14 AM > > > To: nanog(a)nanog.org > > > Subject: OpenSSH Trojan.. > > > > > > > > > > > > > > > According to what was posted here, you may wish to start scrubbing. > > > > > > http://docs.freebsd.org/cgi/getmsg.cgi?fetch=394609+0+current/freebsd-se > > > curity > > > > > > > > > --- > > > Incoming mail is certified Virus Free. > > > Checked by AVG anti-virus system (http://www.grisoft.com) > > > Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 > > > > > > > > > --- > > > Outgoing mail is certified Virus Free. > > > Checked by AVG anti-virus system (http://www.grisoft.com) > > > Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 > > > > > > > > > > > > [-] Steve Mickeler [ steve(a)neptune.ca ] > > [|] Todays root password is brought to you by /dev/random > > [+] 1024D/ACB58D4F = 0227 164B D680 9E13 9168 AE28 843F 57D7 ACB5 8D4F >

2 1