August 2003 - Test - lists.nanog.org

Re: TNTs Rebooting, was RE: Weird network problems
by Geo. 21 Aug '03

21 Aug '03

> > "...an intermittent problem that has been discovered to be affecting a > > specific type of network card used by some of the NAS devices that > > populate our network. The problem is exacerbated by the blaster worm and > > has been replicated by Lucent, our vendor and others. In order to resolve > > the issue, we are working with Lucent to test and deploy an emergency > > updated version of software to the affected NAS devices." Has anyone gotten a patch from Lucent yet for the Max TNT's? I need something, I've got a bunch of these and when a customer on the TNT has the worm the ping packets coming from his dialup are causing the TNT to crash. Even a way to filter within the TNT would be useful if anyone has any ideas on that. I've already placed filters in my cisco routers for the 92 byte pings but that doesn't stop the ones that originate with the dialup user from crashing the TNT. Geo.

2 1

real _their own_ dark fiber into 401
by alex＠yuriev.com 21 Aug '03

21 Aug '03

Hello, If anyone knows of companies that have their own[1], real[2] dark fiber going into 401 North Broad in Philadephia, I would grealy appreciate hearing about it. Sales people from transport companies are welcome to do the same as long as they know the meaning [1] and [2] or can provide the path information. Thanks, Alex [1] Fiber that the company physically owns, not leases from another source, which happen to lease it from another source in exchange for some other fiber somewhere else where all the fiber in reality travels the same 4" pipe for 90% of the way. [2] Real fiber (as opposite to 'marketing' fiber) is the fiber that actually exists at the present time outside of the pretty fiber maps that the company's are touting, not the fiber that may or may not exist and may or may not be there in 90 days depending on the amount of money that the customer is willing to pay, or bankruptcy of the fiber provider.

1 0

Email virus protection
by Christopher J. Wolff 21 Aug '03

21 Aug '03

Hello, What is the most common method for providing virus protection for your hosted email customers? Thank you in advance. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

21 35

Sobig / MSBlast on Steroids
by J. Oquendo 21 Aug '03

21 Aug '03

I would post the entire write up but it's rather long. To sum it up though, I did a quick rant on what would or could happen should a virii author dig deep down and formulate a polymorphic virus/worm that attacked routers via BGP/OSPF/ICMP ... Just me mumbling on but someone on the list may find the write up infor- mative. http://www.politrix.org/rants.html ================================================= J. Oquendo rsvp: segment ... disgraced . org rsvp: segment ... antioffline . com PGP Fingerprint 39A7 24C6 A9A0 6C67 96CA 0302 F1D3 2420 851E E3D0 http://www.politrix.org http://www.antioffline.com ================================================= -- __________________________________________________________ Sign-up for your own personalized E-mail at Mail.com http://www.mail.com/?sr=signup CareerBuilder.com has over 400,000 jobs. Be smarter about your job search http://corp.mail.com/careers

1 0

RE: To send or not to send 'virus in email' notifications?
by Stewart, William C (Bill), RTSLS 21 Aug '03

21 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The right answer for the original question is probably "Buy an email server package with virus scanning hooks" or "Get a virus scanner with sendmail milter hooks" rather than specific details of how to set it... The suggestion to do virus filtering during the message transfer stage rather than the delivery stage is good. It looks like sendmail milters can be tweaked to do this, though unless they can recognize the virus from the mail headers, they have to wait until the end-of-message hook to do it, i.e. after the whole virus has been transferred but before the message acceptance codes get transferred. It's too bad that it's difficult to send a reject code and continue a teergrube at the same time. For virus scanners that run at other stages in the delivery process, the right decision about whether to do a notification or not is virus-dependent, if your anti-virus package supports it. Sobig almost always forges sender addresses, so it shouldn't get a reply, but some other viruses don't forge the sender, and should get the reply. Limiting the responses to once a week per sender or whatever may help, but only if the same sender gets forged a lot. Yet another reason to cryptographically sign your outgoing mail, not that I usually do so or that most people or mail clients check. Thanks; Bill Stewart -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> Comment: PGP Freeware 703 iQA/AwUBP0QHO7JBeu7P+eyUEQK4xACgwIEKFP47bIyOZ3ABzm5fxm8AsyQAoI8L mnmDP9h63r+REIlTzTBdltSM =8pMy -----END PGP SIGNATURE-----

5 4

Re: Weird network problems
by Andy Walden 21 Aug '03

21 Aug '03

> Is anyone out there tracking down some weird network behavior yesterday > and today? I'm not talking about ping traffic from the worm or anything > like that, I'm seeing TNT MAX boxes go unpingable, arp broadcast storms, > one way traffic blocks on T1's between cisco routers, stuff that I have > not been able to explain yet. I'm seeing the exact same issues with the TNTs and am in the process of trying to track down exactly what is causing it. So far no pattern has emerged. andy -- PGP Key Available at http://www.tigerteam.net/andy/pgp

2 1

www.ebay.com down?
by Richard Gross 21 Aug '03

21 Aug '03

Have not been able to search for items on www.ebay.com since 8:55pm PDT 8/20/2003. Do you see the same thing? richg

4 3

[brian@linuxwidows.com: Re: HP Openview possibly affected by MSBlaster]
by Len Rose 20 Aug '03

20 Aug '03

----- Forwarded message from Brian Coyle <brian(a)linuxwidows.com> ----- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday 20 August 2003 20:03, Len Rose wrote: > http://hpat962.external.hp.com/blaster.jsp?print=1 We found blaster would tickle opcctla (listening on port 135) and trigger this Solaris rpcbind failure... http://www.sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50922&zone_32… The patch seems to have corrected the problem. [can you forward to nanog? I'm not sub'd to -post. THANX! ] - -- - -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GAT/CM$ d-@ s:++ a42 C+++$ ULSH++++$ P+>++ L++>+++ E- W++$ N+ w$ O- M- V Y+ PGP t@ 5+@ X+@ R- tv(-)@ b+++ DI++++ D+ e(+) h---- r+++ y++++ - -----END GEEK CODE BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) Comment: Brian Coyle, GCIA http://www.giac.org/GCIA.php iD8DBQE/RCHYER3MuHUncBsRAnRhAJ0emWoJk+3eQ3IiaC9+BuikJyx8fACeI5MR 3qx7yWJNRVhYm5d3WcPG8V4= =Srwc -----END PGP SIGNATURE----- ----- End forwarded message -----

1 0

Hijacked email
by Jack.W.Parks＠alltel.com 20 Aug '03

20 Aug '03

Anyone seeing hijacked email addresses with this Sobig-F worm? I did some research and I know I didn't send anything to Investec Bank of Johannesburg,ZA. On top of that, I definitely did not send a worm. Thoughts? Jack -----Original Message----- From: jlouw(a)investec.co.za [mailto:jlouw@investec.co.za] Sent: Wednesday, August 20, 2003 4:11 AM To: Parks, Jack W Cc: VMeetoo(a)investec.co.mu Subject: MailMarshal has detected a Virus in your message Investec content scanning has stopped the following message: Message: BB002e9963.00000001.mml From: Jack.W.Parks(a)alltel.com To: VMeetoo(a)investec.co.mu Subject: Thank you! Because it believes the message contains a virus. The virus scanning software used was: Sophos AntiVirus (SAVI2 Interface) Virus name: W32/Sobig-F Please clean the file and resend it. Rule: Inbound Messages : Block Virus

11 11

TNTs Rebooting, was RE: Weird network problems
by Ejay Hire 20 Aug '03

20 Aug '03

In a word, Yes. We've got two TNT's that have been rock-solid for over a year that have rebooted 6 times in two days. Any help at all would be most appreciated. Thanks in Advance, Ejay Hire -----Original Message----- From: Geo. [mailto:georger@getinfo.net] Sent: Wed 8/20/2003 3:45 PM To: nanog(a)merit.edu Cc: Subject: Weird network problems Is anyone out there tracking down some weird network behavior yesterday and today? I'm not talking about ping traffic from the worm or anything like that, I'm seeing TNT MAX boxes go unpingable, arp broadcast storms, one way traffic blocks on T1's between cisco routers, stuff that I have not been able to explain yet. Just wondering if it's only me seeing this or if others are working on the same sorts of issues. I heard a rumor that ICG was also experiencing some strange network problems so I figured it was time to post. Geo.

3 2