March 2003 - Test - lists.nanog.org

Re: how to get people to upgrade? (Re: The weak link? DNS)
by Dave Israel 26 Mar '03

26 Mar '03

On 3/26/2003 at 08:31:40 -0800, Bill Woodcock said: > > On 26 Mar 2003, Jeffrey C. Ollie wrote: > > What I would like to see is somewhat of the idea in > > reverse. The ISC would host a zone that would contain TXT records with > > security/bug advisories for every version: > > I really like this solution. It seems clean and unobjectionable, while > getting the job done. Plus, it is expandable to other common services that might want this service, like sendmail or OpenSSH.

1 0

opentrasit.net problem?
by Miguel Mata-Cardona 26 Mar '03

26 Mar '03

we are AS 16592 (168.243.224.0/20) and are having problem reaching 168.234.136.0/24 the problem is very erratic, sometime we can reach them sometimes not (for a 10-30 seconds period). problem arise from an opentransit.net hop as seen in the following trace: 1 <1 ms <1 ms <1 ms 205.235.28.65 2 <1 ms <1 ms <1 ms 205.235.28.34 3 1 ms 1 ms 1 ms 205.235.28.45 4 1 ms 1 ms 1 ms 168.243.227.165 5 3 ms 3 ms 3 ms 168.243.227.135 6 12 ms 6 ms 10 ms 200.12.61.193 7 195 ms 150 ms 90 ms 200.30.154.29 8 185 ms 186 ms 241 ms 200.30.154.41 9 291 ms 200 ms 109 ms 144.223.244.5 10 56 ms 54 ms 42 ms 144.232.20.17 11 125 ms 85 ms 82 ms 193.251.252.25 12 * * * Request timed out. 13 * * * Request timed out. 14 * * 146 ms 168.234.181.6 15 347 ms ^C hop 11 is So5-0-0.MIABB1.Miami.opentransit.net and hop 12 is TelecomElSalvador-OsiGuat.GW.opentransit.net is opentransit.net present on NANOG? please contact me off-list. -- Miguel Mata-Cardona Intercom El Salvador mmata(a)sv.intercomnet.net

1 0

Re: how to get people to upgrade? (Re: The weak link? DNS)
by Dave Israel 26 Mar '03

26 Mar '03

On 3/26/2003 at 15:24:18 +0000, Paul Vixie said: [snip] > so here's a proposal. we (speaking for ISC here) could add a config option > (default to OFF) to make bind send some kind of registration packet at boot > time, containing an e-mail address for a technical contact for that server, > and perhaps its hostname as well. the destination would be configurable, and > the format would be open, and we would include in the distribution a tool > capable of catching these. any campus/WAN admin who wanted to run their own > "BIND registration system" could do so. anyone who wanted to simply config > their server to send registration data to ISC could do so. for data received > at ISC, we'd (a) keep it completely private other than public statistics, > (b) clean it of obvious trash (some people will sent registration data for > president(a)whitehouse.gov just for fun; we know that), and (c) use the contact > information only in the event that a security defect discovered in that > version. remember, the default would be OFF. I'm not sure this helps. The people who don't subscribe or pay attention to CERT advisories are the same ones that won't turn this option on. It is like the cache option in Apache; the people who would get the most benefit, the ones with mainly static web pages, are the same ones who do not know to turn it on. -Dave

1 0

Syn Flood
by Christopher Bird 26 Mar '03

26 Mar '03

I have a problem on a home PC of all things. Every once in a while it bursts into life and syn floods an IP address on port 80. The IP addresses it chooses are random and varied. The network counters ratchet up alarmingly (as viewed in the connections window). I am running winXP Pro on this box. I have zone alarm, an SMC Barricade firewall, and Norton anti virus. I don't seem to be able to catch the computer at it, I just have the evidence after the event. I don't like the anti social behavior that this is exhibiting and am wondering if the collective wisdom of this group might have any ideas how to track the issue down. According to virus checkers, I am clean. Thanks in advance Chris Bird

6 5

clued-in AOL postmaster?
by william+nanog＠hq.dreamhost.com 25 Mar '03

25 Mar '03

[ Reply-To set to me ] Sorry to be That Guy, but I've tried the usual methods of contact, including the phone # for people who are blocked *by* AOL, without much success. I've sent logs to the various addresses at http://postmaster.info.aol.com/ and to the contacts for AS1668 with no response. Basically, one of our customers' domains is getting a LOT (probably about 30k a day) of bounces from AOL (due to a spammer forging non-existent addresses at their domain; the spammer apparently primarily targets AOL, and is spamming via open proxies). Does anyone have a contact # or email over there that might result in some sort of action? -- "Since when is skepticism un-American? Dissent's not treason but they talk like it's the same..." (Sleater-Kinney - "Combat Rock")

2 1

RE: Using Policy Routing to stop DoS attacks
by Jim Deleskie 25 Mar '03

25 Mar '03

>If you fooled the router into thinking that the reverse path for the >source is on another another interface and then used strict unicast RPF >checking, that may accomplish what you want without using ACLs. I don't >know what impact it would have on your CPU however, you'll have to >investigate or provide more details. However you'd also risk loosing any traffic that was asymmetric in nature. -Jim

2 1

ASN allocation update
by Rob Thomas 25 Mar '03

25 Mar '03

Hi, NANOGers. As of 24 March 2003 IANA has allocated a new block of ASNs to ARIN. The ASN range changes are: Was 29696 - 32767 Held by the IANA Now 29696 - 30719 Allocated by ARIN (March 2003) Now 30720 - 32767 Held by the IANA The bogus ASN monitoring has been updated to reflect this change. You should update any filters you have. The bogus ASN report, which shows ASNs leaking private, unallocated, and reserved ASNs, is located here: <http://www.cymru.com/BGP/asnbogusrep.html> Thanks, Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Gifts for a CTO who has everything ...
by Eric Brunner-Williams in Portland Maine 25 Mar '03

25 Mar '03

How does one convey to a CTO who has everything that nmap 10.0.0.0/8 has side effects? > Sorry - I didn't expect it to be running for such a long time. I apologize > for any consternation it may have caused. I ran it because I couldn't get > into the system "larceny" that night. I thought that a map of our network > might help me find it. > > After having run the nmap on a smaller subnet, I decided to re-run it on > the larger address space to provide documentation about our network. Seriously. Does life get any better than this? Eric

1 0

Anyone using Finisar OC-n GBICS?
by Alex Rubenstein 25 Mar '03

25 Mar '03

http://www.finisar.com/product/product.php?product_id=165&product_category_… CWDM GBIC OC48 Transceiver with APD Receiver (FTR-1621) Seems nifty. Anyone using this? Also, me making my once-a-year request; anyone know of GBICs based on ITU-Grid frequencies that would work with Cisco 15216, for example? Thanks.. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

1 0

Al Jazeera DOSed or just lots of traffic
by Sean Donelan 25 Mar '03

25 Mar '03

Al Jazeera's web site (www.aljazeera.net) has been intermittently unavailable today. Al Jazeera's spokesperson indicated it might be hackers, but it could have just been lots of people trying to reach the web site to see the pictures US television networks wouldn't broadcast, overloading their servers. That's the only "high visibility" problem I've heard of so far. There has been the normal background level of stuff on the net, cable cuts, web defacements, perpetual ddos attacks, etc.

4 6