May 2003 - Test - lists.nanog.org

Trends in network operator security
by Sean Donelan 30 Dec '03

30 Dec '03

Its 2003 and everyone is making their predictions. What trends are network operators seeing for Internet security? Old favorites Buffer overflows Distributed Denial of Service Poor passwords (cisco/sanfran) Poorly coded systems Blame the user for not protecting poorly coded systems Trends Attack the network (why? because we can) Proxy relay hiding (its not just for SMTP anymore) Combo Bot/Trojan/Worms Embedded software "upgrades" Any other trends network operators are seeing?

2 2

AT&T NYC
by Bryan Heitman 04 Sep '03

04 Sep '03

Anyone seeing any problems with ATT in new york? Best regards, Bryan Heitman Interland, Inc.

10 11

chep snmp temperature sensors
by Alex Rubenstein 25 Jun '03

25 Jun '03

I've searched the archives, and didn't see anything current. I am looking for a small, cheap, simply device, that can measure temp and be polled via SNMP. POE would be a plus. Any pointers? -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

8 8

off-topic, contact needed at mac.com
by Eric Brunner-Williams in Portland Maine 11 Jun '03

11 Jun '03

If anyone has an operational contact at mac.com, please drop me a note off-list.

1 1

Pesky spammers are using my mailbox
by Stephen J. Wilcox 03 Jun '03

03 Jun '03

Hi, seems some spammers are using one of my personal domains as the from field in their emails, the local-part being random so I cant easily block it. Has anyone any advice on tracking them down and making them stop? All I get are the bounces, some include the original headers but that usually gives an open relay as the origin. I think I know the answer (you cant do anything) but I wanted to ask as its very annoying and I'm not happy! PS Anyone around at the Sheraton today.. I cant spot anyone looking nanogish! Steve

11 13

AS number consolidation
by Michael.Dillon＠radianz.com 02 Jun '03

02 Jun '03

Does anyone know of case studies of companies collapsing multiple ASes into one on their network? I have the Allegiance Telecom presentation from NANOG 27 but I would like to hear how other people have done it as well. --Michael Dillon

4 3

IANA reserved Address Space
by Brennan_Murphy＠NAI.com 01 Jun '03

01 Jun '03

I'm tasked with coming up with an IP plan for an very large lab network. I want to maximize route table manageability and router/firewall log readability. I was thinking of building this lab with the following address space: 1.0.0.0 /8 10.0.0.0 /8 100.0.0.0 /8 I need 3 distinct zones which is why I wanted to separate them out. In any case, I was wondering about the status of the 1 /8 and the 100 /8 networks. What does it mean that they are IANA reserved? Reserved for what? http://www.iana.org/assignments/ipv4-address-space Anyone else ever use IANA reserved address spacing for lab networks? Is there anything special I need to know? I'm under the impression that as long as I stay away from special use address space, I've got no worries. http://www.rfc-editor.org/rfc/rfc3330.txt Thanks, BM

13 17

ISP in Exodus Dulles (Sterling)?
by Leo Bicknell 31 May '03

31 May '03

Are you an ISP (in the sense of terminates leased line type things) in Exodus Dulles (aka Sterling)? If so, I'd like to ask you a few questions off list. Thanks. -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0

Re: Pesky spammers are using my mailbox
by Vinny Abello 31 May '03

31 May '03

At 02:39 PM 5/31/2003, you wrote: >On Sat, 31 May 2003, Stephen J. Wilcox wrote: > > > seems some spammers are using one of my personal domains as the from > > field in their emails, the local-part being random so I cant easily > > block it. > > > > Has anyone any advice on tracking them down and making them stop? > >Tactical baseball bat at close range? :) > >I and a number of coworkers are getting similar bounces, except the >spammers are actually using our full email addresses as the from address. >The first few cases of this, I wrote off to things like KLEZ...but >recently I've gotten actual spam bounces where my work email address was >the original from. > >I suppose it could possibly still be something like KLEZ and it's grabbing >a spam from their inbox and sending that out with a forged from. There are known spamming viruses making their rounds that I believe behave like klez and others that use known email addresses. A couple of our customers have been infected by them and have had their computers unknowingly sending out spam. Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN There are 10 kinds of people in the world. Those who understand binary and those that don't.

1 0

Re: dnsbl's? - an informal survey
by Crist J. Clark 31 May '03

31 May '03

Oh, the irony of this thread being initiated by someone with an @covad.com address. ;) I don't have an answer for the originator, but this reminded me of something about DNSBLs that I've been meaning to ask. Does anyone know of a black hole list of dynamic cable and DSL clients? What I really want is one that mimics AOLs block list of dynamic IPs. I HUGE portion of the spam we were (and still are) receiving came out of attbi.com, swbell.com, pacbell.com, covad.com, etc. DSL and cable customers, and almost no legitimate mail. Manangement resisted blocking those IPs until AOL lead the way. "If they can't send to AOL either, they can't complain that we're being unreasonable. They'll have to break down and fix their mail servers." However, trying to figure out which blocks of IPs these ISPs use for dynamic connections (which we want to block) versus static allocations (which we may not wish to) is non-trival. The few "dynamic" DNSBLs I've found haven't provided enough documentation about what they actually are trying to include. Plus, when I tested them, they didn't seem to block some of the most obvious culprits. (Before anyone starts arguing the merits of blocking dynamic addresses, you might as well try to tell me why you need to run an open relay and I shouldn't block it. I have a dynamic address at home, and I am blocked by my own filters at work. I figured out long ago that my home MTA needs to route outgoing email via my ISP's outgoing SMTP servers, and it has never caused me any problems.) -- Crist J. Clark | cjclark(a)alum.mit.edu | cjclark(a)jhu.edu http://people.freebsd.org/~cjc/ | cjc(a)freebsd.org

8 11