February 2003 - Test - lists.nanog.org

Re: [Re: M$SQL cleanup incentives]
by Joshua Smith 21 Feb '03

21 Feb '03

Iljitsch van Beijnum <iljitsch(a)muada.com> wrote: > > On Thu, 20 Feb 2003, William Allen Simpson wrote: > > > Worse, it only takes 1 infected host to re-infect the entire net in > > about 10 minutes. So, the entire 'net has to cooperate, or we'll see > > continual re-infection. > > Only if people didn't fix their servers. And if they didn't, this > "reverse" denial of service attack is a good reminder. what was that one worm from a year or two ago that was eliminated from the net, oh yeah, code red......if they didn't fix themselves the first round, what makes you think they will fix it the second time, or the third... > > > Unfortunately, this is a cost that prevents pain to others, rather > > than self-inflicted pain. Another pollution of the commons issue. > > Seems to me that filtering is no longer necessary unless you have reason > to believe your customers are going to install new vulnerable boxes or > vulnerable software on existing boxes AND their pipe to you is so big > the excess traffic is going to hurt you more than them. > the reason is that ms sql and msde are vulnerable out of the box, and since ms is such a popular o/s, you can be reasonably certain that new vulnerable boxes are installed everyday. and while a vulnerable box on a small pipe may slow the initial growth, how long would it take to find another vulnerable box on a big pipe? i still get 8K plus hits against my acls per day for udp/1434...(75 in the time it took to write this email) joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

3 2

Re: scripts to map IP to AS?
by Stephen Gill 21 Feb '03

21 Feb '03

Hi Johannes, ] > Anybody have a pointer to scripts to map IP to AS? ] Grab a routing table snapshot from the routeviews archive and run it ] through parse_bgp_dump from CAIDA's CoralReef package. Then use ] CAIDA::ASFinder or Net::Patricia to do the lookups. In fact I have 2 scripts to do just this. - Script #1 uses a route-server for a smallish list of IPs. - Script #2 uses the method listed above and pipes IPs into the CAIDA lookup tree of a BGP table offline. Once you've installed CoralReef it's really not much more work to get the customization you need for lookups. Contact me off-list if you're interested in either one. Cheers, -- steve

1 0

Homeland Security Alert System
by Martin Hannigan 21 Feb '03

21 Feb '03

Is anyone running an automated Terror Alert system that's real time with the DHS? -M

2 1

Blocked by msn.com MX, contact for MSN.COM postmaster ?
by Miquel van Smoorenburg 20 Feb '03

20 Feb '03

I found out that our outgoing SMTP servers have been blocked by the msn.com MXes. In a nasty way, too -- no SMTP error, the TCP connection is simply closed by them immidiately after establishing it. We're not listed on any RBL/DNSBL and have an active abuse desk. I mailed postmaster(a)msn.com, msnhst(a)msn.com, noc(a)microsoft.com, but didn't get a reply from any of them. Does anyone here know who to talk to ? Thanks, Mike. -- Anyone who is capable of getting themselves made President should on no account be allowed to do the job -- Douglas Adams.

5 4

AT&T seems to have lost Houston
by Hermey, Steve 20 Feb '03

20 Feb '03

2 1

AT&T seems to have lost Houston
by Owen DeLong 20 Feb '03

20 Feb '03

Don't know if anyone else is seeing this, but We're having trouble getting to/from AT&T datacenter in Phoenix from several locations. It looks like traffic from Mountain View is getting dropped at AT&T in LA. However, looking at AT&T network stats, they seem to have virtually no connectivity working in Houston. They claim LAX<-->PHX is good, but our traceroutes are falling on the floor after LAX. Anyone else have any better data? (We have a ticket open with AT&T, but they haven't come up with anything yet. Outage seems to have started just before midnight Pacific Time). Owen DeLong Tellme

1 0

WHOIS archive
by John Ferriby 19 Feb '03

19 Feb '03

Does anyone know of a WHOIS archive? Netsol/SRS/Arin? Or for that matter, any coordinated efforts to capture this information? -- John Ferriby - PGP Key: www.ferriby.com/pgpkey Fingerprint: 3B78 10AF A1B2 20D0 A5D9 983F 96FF D5BB CF11 BA97 If you see a smime.p7s attachment it is only a digital signature.

3 2

mfnx
by scott＠wworks.net 19 Feb '03

19 Feb '03

Anyone from mfn around can you contact me off list? Thanks! Scott

10 12

mid-atlantic group for Internet craft
by Andrew Newton 19 Feb '03

19 Feb '03

After running into each other in airports and congregating in hotels and conference centers across this planet, some of us in the mid-Atlantic area of the US have decided that it is not only possible but likely even useful to meet locally from time to time. The purpose would be to swap technical opinions and engage in networking (the social kind). If you are interested, we have a webpage with more details: http://ecotroph.net/magic/ -andy

1 0

Experience w/ QoS/app performance monitors
by Pete Kruckenberg 19 Feb '03

19 Feb '03

Would anyone who is running QoS/SLA/application performance monitors (ie BRIX Networks) be willing to share (on the list or privately) what their experience has been with those products and how they are used/useful in actual experience to engineer and operate networks. Pete.

1 0