December 2003 - Test - lists.nanog.org

Stopping ip range scans
by william＠elan.net 05 Jan '04

05 Jan '04

Recently (this year...) I've noticed increasing number of ip range scans of various types that envolve one or more ports being probed for our entire ip blocks sequentially. At first I attributed all this to various windows viruses, but I did some logging with callbacks soon after to origin machine on ports 22 and 25) and substantial number of these scans are coming from unix boxes. I'm willing to tolerate some random traffic like dns (although why would anybody send dns requests to ips that never ever had any servers on them?), but scans on random port of all my ips - that I consider to be a serious security issue and I'm getting tired of it to say the least (not to mention that its drain on resources as for example routers have to answer and try to route all the requests or answer back that they could not). So I'm wondering what are others doing on this regard? Is there any router configuration or possibly intrusion detection software for linux based firewall that can be used to notice as soon as this random scan starts and block the ip on temporary basis? Best would be some kind of way to immediatly detect the scan on the router and block it right there... Any people or networks tracking this down to perhaps alert each other? -- William Leibzon Elan Networks william(a)elan.net

8 8

Re: any bellsouth admins around?
by mduckett＠bellsouth.net 31 Dec '03

31 Dec '03

Working to get you a contact. Stand by. > > From: Mark Jeftovic <markjr(a)easydns.com> > Date: 2003/12/31 Wed PM 07:37:59 GMT > To: nanog(a)merit.edu > Subject: any bellsouth admins around? > > > > Any bellsouth admins around? > > This would suck if it kept up over the holiday... > > -mark > > -- > Mark Jeftovic <markjr(a)easydns.com> > Co-founder, easyDNS Technologies Inc. > ph. +1-(416)-535-8672 ext 225 > fx. +1-(416)-535-0237 > > ---------- Forwarded message ---------- > Date: Wed, 31 Dec 2003 14:19:24 -0500 (EST) > From: Simon Carr <scarr(a)easydns.com> > To: abuse(a)bellsouth.net > Subject: Abuse: Getting hammered with forged addresses. > > Hey there, > > We seem to be getting hammered with forged addresses from several > bellsouth IPs on the 205.152.59.0/24 netblock. Please try to take action > agains this immediately as it is causing severe load on our SMTP cluster. > > Dec 31 13:27:25 10.0.2.44 postfix/smtpd[4221]: 13EEC4F3B3: > client=imf16aec.mail.bellsouth.net[205.152.59.64] > Dec 31 13:27:39 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 > <federicohooperfk(a)syselog.fr>: Sender address rejected: Domain not found; > from=<federicohooperfk(a)syselog.fr> to=<dmeans(a)the-means.net> > Dec 31 13:28:15 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <sritteron(a)ipcc.ch>: > Sender address rejected: Domain not found; from=<sritteron(a)ipcc.ch> > to=<dmeans(a)the-means.net> > Dec 31 13:28:23 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <deghejmfp(a)genie.com>: > Sender address rejected: Domain not found; from=<deghejmfp(a)genie.com> > to=<dmeans(a)the-means.net> > Dec 31 13:28:35 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <jim223bfovl(a)home.com>: > Sender address rejected: Domain not found; from=<jim223bfovl(a)home.com> > to=<dmeans(a)the-means.net> > Dec 31 13:28:41 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 > <K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net>: Sender address rejected: > Domain not found; from=<K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net> > to=<dmeans(a)the-means.net> > Dec 31 13:28:49 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <MGgcVpy(a)home.com>: Sender > address rejected: Domain not found; from=<MGgcVpy(a)home.com> > to=<dmeans(a)the-means.net> > Dec 31 13:29:36 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <w9hsxyu(a)wonderful.com>: > Sender address rejected: Domain not found; from=<w9hsxyu(a)wonderful.com> > to=<dmeans(a)the-means.net> > Dec 31 13:30:18 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <d.carrillo_lr(a)reg.fi>: > Sender address rejected: Domain not found; from=<d.carrillo_lr(a)reg.fi> > to=<dmeans(a)the-means.net> > Dec 31 13:31:22 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <lhancock_nh(a)ipcc.ch>: > Sender address rejected: Domain not found; from=<lhancock_nh(a)ipcc.ch> > to=<dmeans(a)the-means.net> > > > -- > Simon Carr, > easyDNS Technologies, Inc. > http://www.easydns.com > >

1 0

any bellsouth admins around?
by Mark Jeftovic 31 Dec '03

31 Dec '03

Any bellsouth admins around? This would suck if it kept up over the holiday... -mark -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237 ---------- Forwarded message ---------- Date: Wed, 31 Dec 2003 14:19:24 -0500 (EST) From: Simon Carr <scarr(a)easydns.com> To: abuse(a)bellsouth.net Subject: Abuse: Getting hammered with forged addresses. Hey there, We seem to be getting hammered with forged addresses from several bellsouth IPs on the 205.152.59.0/24 netblock. Please try to take action agains this immediately as it is causing severe load on our SMTP cluster. Dec 31 13:27:25 10.0.2.44 postfix/smtpd[4221]: 13EEC4F3B3: client=imf16aec.mail.bellsouth.net[205.152.59.64] Dec 31 13:27:39 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <federicohooperfk(a)syselog.fr>: Sender address rejected: Domain not found; from=<federicohooperfk(a)syselog.fr> to=<dmeans(a)the-means.net> Dec 31 13:28:15 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <sritteron(a)ipcc.ch>: Sender address rejected: Domain not found; from=<sritteron(a)ipcc.ch> to=<dmeans(a)the-means.net> Dec 31 13:28:23 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <deghejmfp(a)genie.com>: Sender address rejected: Domain not found; from=<deghejmfp(a)genie.com> to=<dmeans(a)the-means.net> Dec 31 13:28:35 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <jim223bfovl(a)home.com>: Sender address rejected: Domain not found; from=<jim223bfovl(a)home.com> to=<dmeans(a)the-means.net> Dec 31 13:28:41 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net>: Sender address rejected: Domain not found; from=<K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net> to=<dmeans(a)the-means.net> Dec 31 13:28:49 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <MGgcVpy(a)home.com>: Sender address rejected: Domain not found; from=<MGgcVpy(a)home.com> to=<dmeans(a)the-means.net> Dec 31 13:29:36 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <w9hsxyu(a)wonderful.com>: Sender address rejected: Domain not found; from=<w9hsxyu(a)wonderful.com> to=<dmeans(a)the-means.net> Dec 31 13:30:18 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <d.carrillo_lr(a)reg.fi>: Sender address rejected: Domain not found; from=<d.carrillo_lr(a)reg.fi> to=<dmeans(a)the-means.net> Dec 31 13:31:22 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <lhancock_nh(a)ipcc.ch>: Sender address rejected: Domain not found; from=<lhancock_nh(a)ipcc.ch> to=<dmeans(a)the-means.net> -- Simon Carr, easyDNS Technologies, Inc. http://www.easydns.com

1 0

Internet law
by John Obi 31 Dec '03

31 Dec '03

Hello, when will we see the FBI, and other local police in the other countries send the script kiddies to the JAILL so we can use the internet without too much pain? Thanks, -J __________________________________ Do you Yahoo!? Find out what made the Top Yahoo! Searches of 2003 http://search.yahoo.com/top2003

9 9

RE: High volumes of UDP traffic
by Drew Weaver 31 Dec '03

31 Dec '03

We've seen similar instances of these types of things usually precipitated by a customer angering someone on IRC that they shouldn't have. Its just a targeted DDoS either by someone who has owned a large number of boxen on your network, or by someone who doesn't like people who owned a large number of boxen on your network. -Drew -----Original Message----- From: Anderson, Ian [mailto:i.anderson@lancaster.ac.uk] Sent: Wednesday, December 31, 2003 12:31 PM To: nanog(a)merit.edu Subject: High volumes of UDP traffic A heads-up Since yesterday afternoon we saw a large increase in offsite traffic circa 80,000pps directed at host deals.in.crackcocaine.us 17:02:52.527762 148.88.156.86.2571 > 69.50.162.82.7854: udp 1 17:02:52.527876 148.88.156.86.2571 > 69.50.162.82.3002: udp 1 17:02:52.527877 148.88.156.86.2571 > 69.50.162.82.37525: udp 1 17:02:52.527996 148.88.156.86.2571 > 69.50.162.82.6170: udp 1 17:02:52.527997 148.88.156.86.2571 > 69.50.162.82.39709: udp 1 17:02:52.528113 148.88.156.86.2571 > 69.50.162.82.9818: udp 1 17:02:52.528114 148.88.156.86.2571 > 69.50.162.82.57395: udp 1 17:02:52.528115 148.88.156.86.2571 > 69.50.162.82.18194: udp 1 17:02:52.528230 148.88.156.86.2571 > 69.50.162.82.55981: udp 1 17:02:52.528231 148.88.156.86.2571 > 69.50.162.82.42256: udp 1 17:02:52.528350 148.88.156.86.2571 > 69.50.162.82.41441: udp 1 These seem to be from various windows boxen on our network, due to our campus being locked down we've not been able to examine closely the machines and find out exactly what's going on, we've just disconnected them as an interim measure. Anyone else seen similar strangeness? Is it coincidence or is it another l33t haxor trying the old "no one's working on new years eve"?? Anyway a happy new year to all - I'm off to enjoy the party... Ian -- Ian Anderson Network Support Lancaster University, Lancaster, LA1 4YW t: 01524 593019 ~ ip: 01524 510101 ~ f: 01524 844011 i.anderson(a)lancs.ac.uk

1 0

High volumes of UDP traffic
by Anderson, Ian 31 Dec '03

31 Dec '03

A heads-up Since yesterday afternoon we saw a large increase in offsite traffic circa 80,000pps directed at host deals.in.crackcocaine.us 17:02:52.527762 148.88.156.86.2571 > 69.50.162.82.7854: udp 1 17:02:52.527876 148.88.156.86.2571 > 69.50.162.82.3002: udp 1 17:02:52.527877 148.88.156.86.2571 > 69.50.162.82.37525: udp 1 17:02:52.527996 148.88.156.86.2571 > 69.50.162.82.6170: udp 1 17:02:52.527997 148.88.156.86.2571 > 69.50.162.82.39709: udp 1 17:02:52.528113 148.88.156.86.2571 > 69.50.162.82.9818: udp 1 17:02:52.528114 148.88.156.86.2571 > 69.50.162.82.57395: udp 1 17:02:52.528115 148.88.156.86.2571 > 69.50.162.82.18194: udp 1 17:02:52.528230 148.88.156.86.2571 > 69.50.162.82.55981: udp 1 17:02:52.528231 148.88.156.86.2571 > 69.50.162.82.42256: udp 1 17:02:52.528350 148.88.156.86.2571 > 69.50.162.82.41441: udp 1 These seem to be from various windows boxen on our network, due to our campus being locked down we've not been able to examine closely the machines and find out exactly what's going on, we've just disconnected them as an interim measure. Anyone else seen similar strangeness? Is it coincidence or is it another l33t haxor trying the old "no one's working on new years eve"?? Anyway a happy new year to all - I'm off to enjoy the party... Ian -- Ian Anderson Network Support Lancaster University, Lancaster, LA1 4YW t: 01524 593019 ~ ip: 01524 510101 ~ f: 01524 844011 i.anderson(a)lancs.ac.uk

1 0

Waaaay off topic, but: the next IETF is in Seoul...
by Bill Woodcock 31 Dec '03

31 Dec '03

...and United and Lufthansa are have fare sales to Seoul if you buy the ticket by January 16. $478 round-trip from San Francisco, for instance. It would normally cost between $900-$1100 most of the time. http://www.united.com/page/article/0,1360,50105,00.html?code=&jumpLink=%2Fn… Sorry for the off-topic post, but I figured it might let a few more ops folks get to the meeting than might otherwise feel like they could afford an overseas IETF. -Bill

2 1

Out of office/vacation messages
by Mark Prior 31 Dec '03

31 Dec '03

Why do so many supposedly clueful people have their vacation message system respond to mailing list email? Now I'll get to see who also doesn't keep a list of addresses that have already been sent the out of office message :-) Mark.

11 16

AT&T Abuse / RBL contact.
by Ejay Hire 31 Dec '03

31 Dec '03

Hello all. Can an AT&T Abuse/RBL person please contact me off-list. We are getting 550-207.65.4.2 blocked by blacklist.mail.ops.worldnet.att.net. bounces and my emails to abuse_rbl(a)att.net haven't generated a response. Thanks, Ejay Hire ISDN-Net Network Engineer 615-324-3851 615-207-6140

1 0

RE: 2004 network predictions.
by Alon Tirosh 30 Dec '03

30 Dec '03

-----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of batz Sent: Tuesday, December 30, 2003 6:25 AM To: nanog(a)merit.edu Subject: 2004 network predictions. >>Here are some dire predictions for 2004. >> >>While it would be easy to say that the world will end, I think these are all things that reasonably >>could happen, and we could act pre-emptively to mitigate their effects. >> >><snip> >> >>- ISP's use managed anti-virus/security to sell new managed services >> to users. Birth of the fully provider managed home PC? >> >></snip> I wanted to point out that this one is already happening. AOL is working hard on this '9.0 Optimized' with some ancillary teen-market driven service, and is marketing itself as a service that can magically fix your pc without you having to do anything (see TV spot of troubled parents watching toddler bang on mouse with sound hammer, then 'Computer Fixed' prompt appears on screen). Granted, they're capitalizing on what I like to call 'Market Stupidity' and positioning themselves to become the truly idiot-proof provider, but it may actually work. While im hesitant to leave such a large proportion of End-User security in the hands of AOL, it IS a start. It's not ideal, but this might be the first step in the direction of 'enforced measures' to help mitigate malware that works on the basic assumption that nobody patches their machines... Note: I don't completely agree with this approach, but its getting to the point where something has to be done.

1 0