February 2003 - Test - lists.nanog.org

Trends in network operator security
by Sean Donelan 30 Dec '03

30 Dec '03

Its 2003 and everyone is making their predictions. What trends are network operators seeing for Internet security? Old favorites Buffer overflows Distributed Denial of Service Poor passwords (cisco/sanfran) Poorly coded systems Blame the user for not protecting poorly coded systems Trends Attack the network (why? because we can) Proxy relay hiding (its not just for SMTP anymore) Combo Bot/Trojan/Worms Embedded software "upgrades" Any other trends network operators are seeing?

2 2

AT&T NYC
by Bryan Heitman 03 Sep '03

03 Sep '03

Anyone seeing any problems with ATT in new york? Best regards, Bryan Heitman Interland, Inc.

10 11

Re: billing systems
by Richard Welty 06 Mar '03

06 Mar '03

Richard A Steenbergen <ras(a)e-gerbil.net> wrote: >I prefer to pick a random number, then consult my Magic 8-Ball with the >question "Is this customer paying enough money?". If the answer is no, I >raise their bill by 10Mbit and try again. >Sometimes the billing department gets a little backed up when the results >are hazy, but other than that it's a great system. ISPs using a magic 8-ball based billing system may find that customizing the 8-ball is not only feasible but may make for better profit margins when the 8-ball is properly tuned: http://8ball.ofb.net/howto.html i might be persuaded to make a presentation on this at the next nanog meeting. cheers, richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Unix, Linux, IP Network Engineering, Security

10 11

BGP to doom us all
by Jim Deleskie 04 Mar '03

04 Mar '03

http://news.com.com/2100-1009-990608.html?tag=fd_lede1_hed Seems the BGP will be the down fall of the internet, the sky is falling the sky is falling

18 27

RIPE Down or DOSed ?
by Marshall Eubanks 01 Mar '03

01 Mar '03

Can anyone else get to ripe.net ? I cannot seem to access the whois or any other service (my ripe traffic goes through Sprint). When I ping peach.ripe.net, I get 90%+ missing packets + "destination host unreachable" from inside Sprint. Regards Marshall Eubanks

26 42

Re: anti-spam vs network abuse
by Roger Marquis 28 Feb '03

28 Feb '03

> As a result the ISP must either A) purchase more RAM, faster CPUs, > and additional servers, or B) run the risk of complaints and lost > customer goodwill. All of this costs time and money. Looks like both a netscan and a portscan, and clearly not designed to limit damages to innocent third parties. Come on njabl.org, this isn't rocket science. Turn down that scan rate by a factor of at least 50, please. -- Roger Marquis Roble Systems Consulting http://www.roble.com/ 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55571 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55572 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55573 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55575 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55574 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55576 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55577 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55578 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55579 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55580 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55581 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55583 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55584 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:55585 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:55586 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:55587 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:55588 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:55589 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:55590 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55591 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55592 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55594 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55593 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55595 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55596 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55597 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55599 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:55601 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55600 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55571 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55572 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55573 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55574 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55575 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55576 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55579 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55581 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55577 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55578 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55580 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55584 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:55585 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55583 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:55586 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:55587 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:55590 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:55588 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:55589 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55591 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55593 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55592 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55594 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55595 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55597 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55596 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55599 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55600 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:55601 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55571 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55573 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55572 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55575 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55574 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55576 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55577 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55579 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55578 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55580 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55581 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55583 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55584 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:55587 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:55585 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:55586 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:55589 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55591 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:55588 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55593 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55592 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:55590 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55595 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55596 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55594 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55597 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55600 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:55601 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55599 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55571 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55572 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55573 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55574 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55575 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55576 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55577 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55578 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55579 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55580 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55581 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55583 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55584 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:55585 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:55586 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:55587 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:55588 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:55589 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:55590 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55591 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55594 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55592 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55593 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55595 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55596 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55597 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55599 15:16:43 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55600 15:16:43 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:55601 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57092 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57091 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57093 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57096 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57095 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57094 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57097 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57098 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57099 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57100 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57101 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57103 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57104 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:57105 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:57106 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:57107 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:57108 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:57109 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:57110 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57111 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57112 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57113 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57114 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57115 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57116 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57117 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57119 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57120 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:57121 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57091 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57092 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57093 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57094 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57096 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57095 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57097 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57099 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57100 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57101 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57098 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57103 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57104 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:57105 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:57106 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:57107 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:57108 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:57109 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57111 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:57110 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57112 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57113 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57114 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57115 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57116 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57117 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57120 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57119 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:57121 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57091 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57092 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57094 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57093 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57095 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57096 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57097 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57098 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57099 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57100 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57101 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57103 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:57105 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57104 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:57106 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:57107 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:57108 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:57109 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:57110 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57111 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57113 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57112 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57114 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57115 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57117 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57116 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57120 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57119 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:57121 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57091 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57092 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57093 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57095 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57094 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57096 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57097 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57098 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57099 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57100 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57101 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57103 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57104 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:57105 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:57106 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:57107 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:57108 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:57110 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:57109 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57111 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57112 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57115 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57113 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57114 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57116 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57117 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57119 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57120 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:57121 15:17:40 PST Connection attempt to TCP IP.IP.IP.IP:25 from 209.208.0.15:57753 15:16:51 PST postfix/smtpd[94021]: connect from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:51 PST postfix/smtpd[94021]: lost connection after CONNECT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:51 PST postfix/smtpd[94021]: disconnect from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:51 PST postfix/smtpd[94026]: connect from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:51 PST postfix/smtpd[94026]: E3914DAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:52 PST postfix/smtpd[94026]: E3914DAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<relaytestsend(a)rt.njabl.org> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:53 PST postfix/smtpd[94026]: 71C6ADAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:53 PST postfix/smtpd[94026]: 71C6ADAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<relaytestsend(a)victim.com> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:54 PST postfix/smtpd[94026]: B4DD5DAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:54 PST postfix/smtpd[94026]: B4DD5DAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<relaytestsend@rt.njabl.org@victim.com> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:56 PST postfix/smtpd[94026]: 0492BDAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:56 PST postfix/smtpd[94026]: 0492BDAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 504 <relaytestsend>: Sender address rejected: need fully-qualified address; from=<relaytestsend> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:57 PST postfix/smtpd[94026]: 47B66DAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:57 PST postfix/smtpd[94026]: 47B66DAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 450 <relaytestsend@localhost>: Sender address rejected: Domain not found; from=<relaytestsend@localhost> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:58 PST postfix/smtpd[94026]: 8B9C9DAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:58 PST postfix/smtpd[94026]: 8B9C9DAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:59 PST postfix/smtpd[94026]: CDA4EDAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:59 PST postfix/smtpd[94026]: CDA4EDAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<relaytestsend(a)[IP.IP.IP.IP]> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:17:09 PST postfix/smtpd[94026]: too many errors after RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:17:09 PST postfix/smtpd[94026]: disconnect from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] ...

1 0

Re: anti-spam vs network abuse
by Richard Irving 28 Feb '03

28 Feb '03

Joe St Sauver wrote: > There is NO legal advice in this post. Really! > In Oregon, see ORS 164.377(4): > > "Any person who knowingly and without authorization uses, accesses or > attempts to access any computer, computer system, computer network, or any > computer software, program, documentation or data contained in such computer, > computer system or computer network, commits computer crime." Define "without authorization", and also "knowingly". Was the port open to the public internet ? If so, it sounds pretty "authorized" to me, therefore undermining "knowingly", afaict. Or, otherwise, with a few exceptions, almost every web site I have ever surfed has been "without authorization". Like I said, "intention" has to come into the picture.... in this case, it is in the form of "knowingly". Do you open your "unauthorized" ports to the public internet ? "Unauthorized" on wide open internet usually infers that there is an access scheme in place to -prevent- "unauthorized access", and activity that attempts to undermine that security scheme -then- becomes illegal, AFAIK. The absence of such an access scheme, on open internet, would infer an "implied authorization"... as in the case of the millions of WWW pages we all access daily. After all, protocol ports do not publish themselves..... Now, to add a twist, did I probe you from "authorized" space, and gain "illegal access", undermining your (inadequate) security scheme ? Well, then I must have been "authorized", or you wouldn't have allowed me in from this "auhtorized" space, eh ? Oh, I was in "authorized space", but "I" wasn't authorized, and I didn't know ? Oh, well there goes the "knowing" thing again. .JMHO. .Richard. ============== While some of this information could be considered legally valid coming from a "technical expert", it isn't to be construed as "legal advice". Get a lawyer for actual legal advice. > > http://www.leg.state.or.us/ors/164.html > > Regards, > > Joe

1 0

Sabotage cuts power to 18 million people
by Sean Donelan 28 Feb '03

28 Feb '03

ILIGAN, Mindanao - Muslim separatist rebels blacked out the southern third of the Philippines in overnight sabotage attacks, leaving about 18 million people in the dark for hours, officials said Thursday. Electricity supply was restored to most of Mindanao island by Thursday as the government fired up emergency generating stations to temporarily replace baseload plants disabled by the toppling of transmission pylons overnight Wednesday, they said. Moro Islamic Liberation Front (MILF) guerrillas blew up at least five steel transmission towers before midnight using improvised explosives from mortar shells on Wednesday, knocking out from the grid the key Agus hydro-electric power complex outside this city. [...] Repairs to restore the transmission lines to Agus were expected to take a week. http://www.malaysiakini.com/foreignnews/200302280111046662857.php

5 4

apologia to jlewis
by Paul Vixie 28 Feb '03

28 Feb '03

i realize now that i may have misread my IDS reports from the scanning i received from jon's blackhole list a few months ago, and that i have no basis for my claim that he scanned "every address i own." --paul

1 0

Re: anti-spam vs network abuse
by Roger Marquis 28 Feb '03

28 Feb '03

Richard Irving wrote >Jack Bates wrote:(SNIPO) >> > Should we outlaw a potentially beneficial practice due to its abuse by >> > criminals? >> > >> Okay. What happens if you make a mistake and overload one of my devices >> costing my company money. > > That is usually a civil issue, not criminal. Legal considerations aside it is not good practice to scan a subnet/server hosting dozens of websites. Typical symptoms are slow connections to all the sites, increased memory utilization, and error logs like the following: [Wed Feb 26 02:14:57 2003] [info] server seems busy, (you may need to increase StartServers, or Min/MaxSpareServers), spawning 26 children, there are 60 idle, and 88 total children As a result the ISP must either A) purchase more RAM, faster CPUs, and additional servers, or B) run the risk of complaints and lost customer goodwill. All of this costs time and money. The best mitigation is to set a _slow_ scan rate but even that can still get you blacklisted by a well designed NIDS. Given the potential cost to third parties it's difficult to see any case for netscanning, regardless of the scanner's rational. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0