August 2003 - Test - lists.nanog.org

RE: Server Redundancy
by Austad, Jay 07 Aug '03

07 Aug '03

If the servers are in two separate locations, like two datacenters on either side of the country, you are stuck with DNS-based load balancing. Like others have mentioned, Cisco, F5 and others have products which will handle this for you and take into account some other factors when directing traffic. DNS load balancing works quite well, I've used the F5 BigIP and 3dns extensively, and the Foundry ServerIron (which is fairly cheap). A little more detail into what you are trying to do would help. The most common setup with this is to have multiple datacenters, and each datacenter has a cluster of identical servers behind something like a BigIP. The traffic is load balanced at that level, but your Global load balancer which hands out DNS communicates with the local guy to figure out what the current traffic ratio is and modifys its dns replys accordingly. There used to be a free one for linux called Eddie, which looked quite robust. I think it was eddieware.org or eddieware.com. There is also the linux virtual server project, but I don't believe it has support for Global load balancing, only local. As a side note, I've used Cisco's CSS, F5's stuff, Alteon, and Foundry. Out of all of them that I've used, the Foundry had the least problems and had a nicely structured config. I would recommend the CSS, but it seems to have quite a few bugs in the code that still need to be worked out, but the support for SSL acceleration is nice. F5... I used to really like F5. In fact, I was one of their beta sites back in 1999 and 2000. After some problems with code that "broke" things, we discontinued the beta program with them. Shortly after, their new releases were getting worse and worse, their support seemed unwilling to help (for almost $100k a year in support, you'd think they would care), so I switched to Foundry. An insider over at F5 told me that most of the people who had written the original code back in 1999/2000 were all gone, and most of the problems were a result of the new people not yet wrapping their heads around the code. This was about 2 years ago, so it's possible they've figured out how everything is put together and it's better now. For awhile though, it was quite bad. Feature-wise, F5 has more features than any of the other ones, Cisco CSS comes in a somewhat distant second place. For most people, any of the above will suffice and most of the features available in F5 and Cisco are just nice-to-have's and not a requirement. -jay > -----Original Message----- > From: Gerald [mailto:gcoon@inch.com] > Sent: Wednesday, August 06, 2003 1:12 PM > To: Jason Greenberg > Cc: nanog(a)merit.edu > Subject: Re: Server Redundancy > > > > On Wed, 6 Aug 2003, Jason Greenberg wrote: > > > > > Can I have some suggestions on how to load balance servers > that are on > > seperate IP blocks? Is there any way to perform translation at this > > level? Exclude DNS based balancing please... > > vrrp on FreeBSD is supposed to be a free solution to allow machines to > watch each other and take over IP addressing if connectivity is lost. > Depending on how remote your IP blocks are and how much > control you have > over the routing equipment in between, your only choice may be a > commercial solution. > > http://www.bsdshell.net/hut_vrrpimpl.html > > I've not used it, and the documentation is currently in French. > > The HUT project also has FreeBSD load balancing software for > free that is > supposed to function like F5/Alteon/Cisco LB. > > I've maintained the Cisco CS 1100 (when it was Arrowpoint) in > production. > You could VLAN remote machines into what you want to do on > that. I think > that equipment has changed quite a bit though since Cisco > bought them and > my experience is over a year old. > > G >

5 4

New Trojan
by netadm 07 Aug '03

07 Aug '03

Anyone having any fallout from: http://www.eweek.com/article2/0,3959,1130765,00.asp <http://www.eweek.com/article2/0,3959,1130765,00.asp>

7 6

RE: Server Redundancy
by Austad, Jay 07 Aug '03

07 Aug '03

> I've used them all fairly heavily, except the Foundry gear. > Alteon's my > personal fave. Biggest problem with the F5: hard drive. In my book, > that means you instantly need two, doubling the price. Same thing with the Cisco CSS. Even without a hard drive, you should have 2 of them anyway. How do you plan to do software upgrades or other certain types of maintenance without an outage if you don't have a second one? I've seen them flake out too, either by not passing traffic or by load balancing getting messed up somehow. In most of these situations, a failover to the standby unit fixed the problem (this was with F5 gear). -jay

8 9

RE: Server Redundancy
by Don Mills 07 Aug '03

07 Aug '03

We've been using the Linux Virtual Server project (which a previous poster mentioned) to do load balancing (locally) on web based apps, pop3, smtp and now iptable firewalls. It scales well, has multiple lb algorithms (wlc, rr, lc, wrr, etc.) and even multicasts out the connection info if you want so you can set up a bank of redundant lb's. It can work w/ NAT or ip tunneling or direct routing so it might be able to do global load balancing depending on the setup. We have a 10000+ user mail farm behind one and haven't seen a single hiccup... http://www.linuxvirtualserver.org/ -- Don Mills

1 0

WANTED: ISPs with DDoS defense solutions
by Lane Patterson 07 Aug '03

07 Aug '03

We have some DDoS-sensitive customers asking us to refer them to the best ISPs for "in-the-core" DDoS defense. Other than UUnet (hi Chris!) and MFN, I'm not aware of any ISPs in North America developing a reputation for consistent DDoS defense. Could folks contact me either off-list or on-list? It seems that large content providers and Tier2/3 bandwidth buyers would do well to collaborate on group RFP's for this type of thing to send the message to ISPs it is something to invest in (dare I say productize?). While UUnet's detection/blocking is great, it would be wonderful to see some more intelligent filtering of DDoS traffic ala RiverHead or similar approach that doesn't completely blackhole victim IPs. Cheers, -Lane Equinix

25 74

dcom worm released
by Len Rose 07 Aug '03

07 Aug '03

It seems to be true.. I haven't seen any code yet but-- http://lists.netsys.com/pipermail/full-disclosure/2003-August/007717.html

2 2

Re: When Security Guards Attack (was: clearblue part deux)
by Eric Brunner-Williams in Portland Maine 07 Aug '03

07 Aug '03

> ... tried to silence the door audible alarm Didn't it have battery backup? Inquiring minds want to know.

5 4

Verizon 140 West Street CO
by Mike Moglin 07 Aug '03

07 Aug '03

Anyone else hearing about a major outage at the Verizon 140 West Street CO caused by flooding or a major equipment failure? -Mike

1 0

WHO'S SPAMMING YOU? Top 60 Proxy-Hijacker-Friendly Nets 2003-08-06
by Ronald F. Guilmette 06 Aug '03

06 Aug '03

What follows below is a volume-ranked list of the most prolific /24 IP address blocks with respect to open proxy hijacking activity over the past 2 days. These ranking are based on data collected by my extensive open proxy honeypot network for the 48 hour period from 5 PM Pacific Daylight Time, August 4th, 2003 through 5 PM Pacific Daylight Time August 6th, 2003. Some brief commentary material follows the list. If you or someone you know owns or operates any of the networks listed below, please contact me off-list so that we may arange for the timely cremation of the relevant criminal spammers and open proxy hijackers, and the scattering of their ashes in some suitable garbage dump. (Note that mass open proxy hijacking of the kind being originated from all of the /24 blocks listed below is quite clearly a criminal act within these United States. The criminals doing this stuff are violating the federal Computer Fraud and Abuse Act in so many dif- ferent ways it isn't even funny.) ** NOTICE ** I will provide the specific IP addresses that are actually engaged in the proxy hijacking activities within each of these blocks upon request. What I positively WILL NOT DO is to provide detailed log files from my proxy honeypot machines to any party, PERIOD. (DON'T EVEN ASK unless you enjoy being verbally abused.) Doing so would only tend to give the spammers info that they could use to deduce the locations of my honeypot machines, which they would then carefully avoid.) I will provide date/time stamps to relevant network admini- strators, but ONLY in cases involving clearly dynamic IP addresses. 1. 38.112.197 cogentco.com - daicahosting.com/daica.com (Tampa, FL) 2. 66.44.228 savanti.net (Tucson, AZ) 3. 202.177.23 kdd.net.hk (Hong Kong) 4. 66.205.223 cetnetworks.com - smartmailhosting.com (New Orleans, LA) 5. 38.114.11 cogentco.com - tailoredservers.com (Frisco, TX) 6. 66.44.231 savanti.net (Tucson, AZ) 7. 209.50.253 servint.com (McLean, VA) 8. 66.111.39 unitedcolo.com aka sagonet.com (San Francisco, CA) 9. 38.114.3 cogentco.com - tailoredservers.com (Frisco, TX) 10. 66.250.125 cogentco.com - applicationx.net (Alpha, NJ) 11. 166.90.206 level3.com - ?Alan Ralsky? (Detroit area, MI) 12. 206.47.187 bell.ca - "Datatech Communications" (Windsor, ON, CA) 13. 38.112.199 cogentco.com - daicahosting.com/daica.com (Tampa, FL) 14. 38.118.143 cogentco.com - infinology.com (Goleta, CA) 15. 216.99.99 nutnbut.net (Hazelwood, MO) 16. 63.246.136 unitedcolo.com aka sagonet.com (San Francisco, CA) 17. 66.118.189 sagonet.com (Tampa, FL) 18. 64.5.51 theplanet.com (Dallas, TX) 19. 66.118.187 sagonet.com (Tampa, FL) 20. 69.33.1 megapath.net (Pleasanton, CA) 21. 62.219.50 bezeqint.net (Petach Tikva, Israel) 22. 146.82.135 gblx.net - archercomms.com (Minneapolis, MN) 23. 66.205.219 cetnetworks.com (Redwood City, CA) 24. 207.164.251 jet2.net (Windsor, ON, CA) 25. 63.246.135 unitedcolo.com aka sagonet.com (San Francisco, CA) 26. 216.81.218 lh.net (Des Moines, IA) 27. 66.118.142 sagonet.com - argobroadcast.com (Tampa, FL) 28. 64.180.125 telus.net - "Trinity Prof-Soho" (Vancouver, BC, CA) 29. 216.8.169 mnsi.net (Windsor, ON, CA) 30. 66.230.228 level3.com - city-guide.com/neucom.com/candidhosting.net (Tampa) 31. 64.228.134 bell.ca/sympatico.ca (Montreal, QB, CA) 32. 66.111.40 unitedcolo.com aka sagonet.com (San Francisco, CA) 33. 207.101.233 algx.net (Dallas, TX) 34. 216.54.223 twtelecom.net - ozline.net (Clearwater, FL) 35. 63.247.65 gnax.net/dv2.net - burtonhosting.com (North Yorkshire, GB) 36. 66.135.15 broadbandip.net (Baton Rouge, LA) 37. 67.8.179 cfl.rr.com (RR - Florida) 38. 38.117.14 cogentco.com - sagonet.com (Tampa, FL) 39. 64.23.55 affinity.com - skynetweb.com (Baltimore, MD) 40. 64.70.45 exodus.net - nrsoftware.com (Santa Monica, CA) 41. 64.159.76 level3.com - city-guide.com/neucom.com/candidhosting.net (Tampa) 42. 216.58.92 igs.net (Kanata, ON, CA) 43. 66.118.180 sagonet.com (Tampa, FL) 44. 63.246.131 unitedcolo.com aka sagonet.com (San Francisco, CA) 45. 69.0.240 dialtone.com/dialtoneinternet.net (Davie, FL) 46. 203.98.177 newworldtel.com (Hong Kong) 47. 203.98.164 newworldtel.com (Hong Kong) 48. 66.176.226 attbb.net (Chelmsford, MA) 49. 64.237.34 mfnx.net - netlabs.net - "AdultBouncer" (Hazlet, NJ) 50. 69.28.206 peer1.net (Vancouver, BC, CA) 51. 202.181.236 hkcix.com (Hong Kong) 52. 66.70.114 datapipe.com (Hoboken, NJ) 52. 216.128.72 band-x.com - sxpress.com (Hackensack, NJ) 53. 162.42.131 cybertrails.com - atjeu.com (Phoenix, AZ) 54. 216.67.251 pwebtech.com (Parsippany, NJ) 55. 207.180.3 ici.net (Tulsa, OK) 56. 216.232.165 telus.net - "Consumer ADSL" (New Westminster, BC, CA) 57. 66.36.98 burlee.com (Toronto, ON, CA) 58. 65.34.198 attbb.net (Chelmsford, MA) 59. 38.114.4 cogentco.com - 800hosting.com (Dalas, TX) 60. 62.205.161 corbina.net (Moscow, RU) Before getting in to the commentary, I should perhaps mention that all of the above /24 blocks, as well as the companies that provide connectivity to them are now subject to the new listing criteria for the Monkeys.Com Unsecured Proxies List: http://www.monkeys.com/upl/listing-policy.html (Please see criteria #2, which was just recently added.) ** COMMENTARY FOLLOWS ** ** PERSONAL OPINIONS ONLY ** ** USE AT YOUR OWN RISC ** Note: I have already been posting `Top 40' lists of the worst and most proxy-hijacker friendly networks to news.admin.net-abuse.email and SPAM-L for about two weeks now. Some of you may have seen those prior lists and thus may be all too familiar with many of the networks listed above, especially in the topmost few positions. My comments about specific networks follow: cogentco.com: What can I say? The facts speak for themselves. This is now the #1 most criminal-friendly network on the Internet. They have been hosting the criminal open proxy hijackers that are attached to the net via the following downstream customers for a long while now, and they know exactly what's going on here, because I told them, several times. I can only infer that they prefer to keep on accepting money from criminals: daicahosting.com/daica.com (previously throw off 2 other networks) tailoredservers.com (totally unreachable & bullet-proof) applicationx.net (caught red-handed with a web page full of proxies) infinology.com sagonet.com (Has some blocks suspiciously SWIPed to Cogentco.) Cogent's `tailoredservers.com' customer is THE perfect false front for spamming activities. No phone numbers on the web site. False/disconnected phone number in their WHOIS, and no need for them to ever take any call from any disgruntled folks whose servers they (or their customers) have hijacked. Level3: These people have been hosting a ``mystery'' major-league criminal proxy hijacker in their 166.90.206/24 block for MONTHS, and if they don't know that then it is only because they don't want to know. (I've already told them myself, several times.) And they were informed that this criminal activity was going on from their network all the way back as far as March: http://news.spamcop.net/pipermail/spamcop-help/2003-March/028053.html Note that the criminal in question is located someplace in the Detroit area and has been rumored to most likely be none other than Alan Ralsky, known mega-spammer who bragged in this article: http://www.freep.com/money/tech/mwend22_20021122.htm that he's got 20 spam pumping machines in his basement going 24/7. And the evidence suggests that he does, and that they are all busy hijacking other people's poorly secured proxies, all courtesy of the kind folks at Level3. Note: The SpamHaus Project describes Ralsky as a "convicted fraudster" and has an extensive file on him: http://www.spamhaus.org/rokso/search.lasso?evidencefile=1290 Oh! And lest I forget, Level3 also continues to provide bandwidth to the criminal open proxy hijackers that are working out of the notorious spam-friendly outfit called `CandidHosting'. sagonet.com: Sagonet.com and its west coast subsidiary, unitedcolo, seem to have more criminal open proxy hijackers per square inch than any other network or company on the net. A few days ago, they had no fewer than 9 different /24s listed in my Top 60 list of open proxy hijacking origi- nation points. I've seen some signs in the past 24 hours that they may perhaps finally be getting their act together, but then again, maybe not. Time will tell. (I have been told that the owner is just plain greedy, and that he does really understand why spam is bad.) savanti.net: Finally got kicked off sterlingnetwork.net within the past 24 hours. Will be looking for a new home, I'm sure. BE ON THE LOOKOUT FOR THESE GUYS as they wander around, in search of new connectivity. (This is as least the second strike for them, or so I'm told. They were kicked off another network before sterlingnetwork.net.) kdd.net.hk: Seems to be approaching the density of lead. No response whatsoever to hijacking reports. The lights are on but nobody's home. Does anybody know anybody who can explain to these people what proxy hijacking is and why it's bad? servint.com: Sounds familiar. These guys have been in trouble before, haven't they? nutnbut.net: Could be renamed to Nothin' But /dev/null P.S. My special thanks to verio.net, rr.com, algx.net, and jet2.net, all of whom seem to be able to kill these blasted proxy hijackers just about as fast as I can report them.

1 0

Anyone from geocities or yahoo on the list?
by Drew Weaver 06 Aug '03

06 Aug '03

NT -Drew

1 0