November 2003 - Test - lists.nanog.org

Abovenet
by Nakul Malik 04 Nov '03

04 Nov '03

Anyone know if abovenet had a major router crash in or near Seattle or some location that feeds it?? Thanks -Nakul

3 2

Re: Hijacked IP space
by Stewart, William C (Bill), RTSLS 04 Nov '03

04 Nov '03

Chuck Goolsbee wrote that one of his clients was having problems because miscreants have hijacked IP space that they own but haven't actively used in a while. While it's definitely worth submitting it to completewhois and developing whatever paper trail it takes to give it back to the registrars if they don't want to keep it, another obvious stopgap would be to advertise the space, including their /21 and any /24s they see route advertisements for. Either point it to some spare PC with a web server handing out "Forgers hijacked our address space" pages, or null route it. Also check the reverse DNS listings, if there are any, and have them advertise a pointer to a subdomain like weve-been-hijacked.theirdomain.com with an appropriate web page.

2 1

Content filter (was - Re: [arin-announce] IPv4 Address Space)
by william＠elan.net 04 Nov '03

04 Nov '03

> Leave content filtering to the ES, and *force* ES to filter the content. And just to make sure we know what content filter is, this is what I received immedialy following my previous post to nanog. Whoever you are, that did not see my post, please at least configure your content filter to reject email and specify your own mail server name there (and preferably specifying what original rcpt to as well), putting my own server name in "from" is just not very polite, nor is it according to standards (you have no idea if "Administrator" account exist on my machine, in fact for most it would not). ---------- Forwarded message ---------- Date: Wed, 29 Oct 2003 19:22:54 -0500 From: Administrator(a)sokol.elan.net To: william(a)elan.net Subject: [MailServer Notification]To sender: Message matched eManager setting and action was taken. **************** eManager Notification ***************** The following mail was blocked since it contains sensitive content. Source mailbox: william(a)elan.net Destination mailbox(es): nanog(a)merit.edu Rule/Policy: Profanity Action: Quarantine to D:\Logs\Trend\SMCF\Quarantine\2003-10-29\19\22\DFImessagebody3fa059de2479.tmp Content filter has detected a sensitive e-mail. ******************* End of message *********************

11 18

Re: Hijacked IP space.
by Andrew - Supernews 04 Nov '03

04 Nov '03

>>>>> "chuck" == chuck goolsbee <chucklist(a)forest.net> writes: chuck> Of course I have no hard data, other than my client's phone chuck> call about another phone call, so I can't query based on a chuck> timestamp to see where this was being announced from. It chuck> appears to vanished, and has remained so according to my chuck> casual glances here and there. chuck> The netblock in question is: chuck> 204.89.0.0/21 No announcement for that block has been visible here at any time in the past couple of weeks (specifically, since Oct 13). We might have missed it if it was never announced for more than a few minutes at a time, but it's _much_ more likely that the block was never announced and was merely forged into headers of a spam. -- Andrew, Supernews

10 15

Re: Sabotage investigation of fiber cuts in Northwest
by Gregory Hicks 04 Nov '03

04 Nov '03

> From: Valdis.Kletnieks(a)vt.edu > Date: Sun, 02 Nov 2003 22:12:20 -0500 > > On Sun, 02 Nov 2003 21:37:30 EST, "Robert M. Enger" <enger(a)comcast.net> said: > > > You'd think after three previous disruptions, that Qwest would > > have enabled some form of redundancy. > > Redundancy hell. How about a *PADLOCK*? You mean that these places aren't even locked? Who has (had) the key? That'd be the first place I looked. Oh well... Back to lurk mode. --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com Never attribute to malice that which is adequately explained by ignorance or stupidity. Asking the wrong questions is the leading cause of wrong answers "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

17 22

RE: Harassment (was Re: ELAN.NET ...)
by Jeffrey Wheat 04 Nov '03

04 Nov '03

Enough with this thread already. > -----Original Message----- > From: Eric Brunner-Williams in Portland Maine > [mailto:brunner@nic-naa.net] > Sent: Tuesday, November 04, 2003 9:29 AM > To: Suresh Ramasubramanian > Cc: Eric Brunner-Williams in Portland Maine; > william(a)elan.net; nanog(a)merit.edu; Booth, Michael (ENG); > brunner(a)nic-naa.net > Subject: Re: Harassment (was Re: ELAN.NET ...) > > > > Again, without comment on any other issue ... > > <hat = registrar> > > Siegfried Langenbach's execution of some registrar-basics > causes many registrars puzzlement and/or concern. I don't > know of any registrants who actually transfered successfully > _from_ joker/csl to a compeating registrar, but I do know > many registrars who've complained that they have been > unsuceessful in obtaining registrant-authorized transfers > from joker/csl. > > I don't have any direct customer experience, that's just > "registrars at the table/bar" talk, 2nd hand. > > </hat> > > Eric > > --- > Incoming mail is certified Virus Free. > Checked by AVG anti-virus system (http://www.grisoft.com) > Version: 6.0.536 / Virus Database: 331 - Release Date: 11/3/2003 > > --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.536 / Virus Database: 331 - Release Date: 11/3/2003

1 0

Re: Hijacked IP space.
by Jamie Reid 04 Nov '03

04 Nov '03

I must have missed the thread on this, but is there a good summary available of exactly _how_ these netblocks are getting hijacked? Are they taking advantage of sloppy redistribution configurations, 0wning routers, spoofing OSPF updates, taking advantage of default static routes, or is there something more complicated at work? Are these attacks actually generating bogons, or are they isolated to ASN's they have at one point been legitimately announced by, and forgotten? I can think up many more interesting applications for these kind of ghost-nets than spamming, all of which are quite, if you'll pardon the pun, haunting. -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "chuck goolsbee" <chucklist(a)forest.net> 11/03/03 03:56pm >>> All, Sorry, to interrupt any off-topic rambles, but I had a client call last week who had just had some telephone abuse heaped on them, by somebody accusing them of spamming. It turns out our client had a netblock assigned to them back in the mid-90's. They used to put on networking trade shows, and used the space for making show networks. They haven't put on a networking trade show (with a public network) since about 1997. Of course to complicate the matter, the sole contact listed in whois no longer works there. I informed our client how to remove their name from the whois record and relinquish the netblock back to ARIN, which I hope they are doing now. I also have (at the suggestion of some research through the nanog archives) submitted the netblock to the completewhois site. [I have no interest in commenting on the current inane OT nanog thread about that subject, so don't even try me.] Mr. Thomas' cymru.com service was offline when I tried to contact it last week (he replied via email about an outage... sorry to hear... coffee will get there eventually. Order put to the roaster today. - hang in there.) Of course I have no hard data, other than my client's phone call about another phone call, so I can't query based on a timestamp to see where this was being announced from. It appears to vanished, and has remained so according to my casual glances here and there. The netblock in question is: 204.89.0.0/21 So, my question is: Other than the above, and mentioning it here, is there anything else *I* can do to assist my client? Especially since I am not at all directly related to this netblock in any way. Additionally, it would not hurt to know if anyone here *does* know when or where the announcement came from. The client in question are good folks, and I hate to see their reputation tainted by the actions of others. Thanks, --chuck goolsbee, digital.forest

2 1

OT: Need FSO link in Santa Clara & Sunnyvale
by Brennan_Murphy＠NAI.com 04 Nov '03

04 Nov '03

What are the top vendors these days for wireless FSO links? I need at least 100Mb link over a distance of about 1-2 miles. Seems like last time I looked at this though, the speeds were up to a Gig at pretty low cost. Any insights? Would also accept emails from sales persons if they can briefly (1paragraph) summarize what they've got and at what price. I'll contact the top 3 or 5 offers directly. Thanks, BM

2 1

Re: Sabotage investigation of fiber cuts in Northwest
by JC Dill 03 Nov '03

03 Nov '03

At 07:32 PM 11/3/2003, John Fraizer wrote: >On Mon, 3 Nov 2003, Owen DeLong wrote: > > > Maybe I'm missing something, but, if you have the bolt cutters, I don't > > see why you need the key to an adjacent lock or any of the locks. > >Um, cutting a lock out gets it out of the mix but, you still have to have >the key to one of the other locks to complete the chain again. Think >about it. A cut lock can be replaced with a similar replacement lock and usually no one will be the wiser. Look at the locks here: <http://www.qsl.net/kf4lhp/telweb/microwave/kiv70/padlocks.jpg> The lock marked ATC is between 2 other locks (that's a hasp to its left, with rusty chain further to the left). It could be cut and replaced with a similar lock linking the other two locks, without opening either of the other two locks. On gates with many locks (I've seen chains of 6 or more), there is rarely any interest given to the locks that are not one's own responsibility. jc p.s. please do not cc me on replies - post to me only or to the list only, as you prefer

2 1

Verizon Postmaster contact?
by Charles Sprickman 03 Nov '03

03 Nov '03

Hi, I see VZ was not kind enough to put any contact info in Jared's NOC list. They are currently blocking all mail from an ISP customer of mine (based on the envelope From, not IP), and I need to get someone on the phone to clear this up. Sorry for the OT. Charles -- Charles Sprickman spork(a)inch.com

6 9