August 2003 - Test - lists.nanog.org

DDOS/DOS IP Abuse from Qwest, looking for QWEST Clue
by John Brown 26 Aug '03

26 Aug '03

Before anyone decides to say that NANOG isn't the place, allow me to say that 1. We have emailed them. 2. We have been on the phone with their people, and they seem to be void of clue. 3. We have tried several other more appro lists, but there seems to be an email issue with those lists. 4. Don't waste more bandwidth saying this isn't the place. 5. This ** IS ** operational If you are from Qwest and have enable, please contact me Off List. Thank you.

1 0

FW: Qwest Dial Access Network Labor Day Week Schedule
by Christopher J. Wolff 26 Aug '03

26 Aug '03

Fun rant from a qwest dial up reseller.... Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com -----Original Message----- From: Matt [mailto:qmail2@chilitech.com] Sent: Tuesday, August 26, 2003 1:45 PM To: Cho, Mary M Cc: 'webman(a)mounet.com'; 'mbreslin(a)covad.com'; Delgado, Jose; 'mduncan(a)winterlink.net'; 'nick(a)shadowlink.net'; 'mbelmon(a)qwest.com'; 'crungruang(a)corp.untd.com'; Zach, Ronald M; 'franklin(a)lh.net'; Casher, Mark; Marcum, Gina K; 'andy(a)sowhatsoftware.com'; Vinnola, Kristen; 'eric.flagel(a)a-c-t-i.com'; 'phourani(a)seniorexplorer.com'; 'blane(a)mounet.com'; 'tolzak(a)cisp.cc'; Jimenez, Dave; 'jwmorga(a)qwest.com'; 'benner(a)theglobalroad.com'; Bloom jr, Nile S; 's.belizaire(a)americatel.net'; 'jengels(a)qwest.com'; 'brandon(a)dialupusa.net'; 'detling(a)us-south.net'; 'mmolina(a)americatel.net'; 'mhaught(a)qwest.com'; 'kazmier(a)sofast.net'; 'mark(a)bblabs.com'; 'glenn.hiles(a)cwusa.com'; 'frank_demasi(a)apsnet.com'; 'wstephen(a)sowhatsoftware.com'; 'elena.choperena(a)qwest.com'; 'monty(a)kans.com'; 'mark.woolworth(a)gd-decisionsystems.c'; 'jdonato(a)qwest.com'; Robertson, Bruce M; 'eli(a)firstlink.com'; 'mkiessling(a)chilitech.net'; 'tfischer(a)hypervine.net'; 'gmaxwell(a)isiservices.com'; 'rbeltz(a)qwest.com'; Wright, Shelestine L.; 'whzhao(a)microsoft.com'; 'greg(a)chilitech.net'; 'cetch(a)seniorexplorer.com'; 'smathews(a)integrity.com'; 'jamal.coleman(a)qwest.com'; 'dbartram(a)microsoft.com'; 'andrew(a)chilitech.net'; Allred, Terri; 'matt(a)tgrsolution.net'; 'jeffl(a)firstlink.com'; 'hbloom(a)peoplepchq.com'; 'mike(a)uron.cc'; 'jeff(a)secureinteriors.com'; 'dwhitefoot(a)clara.net'; 'brian.blasius(a)us-south.net'; 'rpopper(a)exchange.pngcom.com'; Rodrigues, Al; 'karmat(a)secureinteriors.com'; Morgan, Amy; 'LYWeymer(a)ISIServices.com'; 'nocops(a)epoch.net'; 'support(a)firstlink.com'; 'dorcas.scott(a)gd-decisionsystems.com'; 'jasong(a)pngcom.com'; Peterson, Deborah A; 'admin(a)burgoyne.com'; 'jwwycher(a)nuskin.com'; 'calec(a)microsoft.com'; 'support(a)netrack.net'; Liberato, Karen; 'jay.larson(a)gd-decisionsystems.com'; 'karen.rohrbacker(a)qwest.com'; 'kgutier(a)qwest.com'; Johnson, Tyler; 'spemmar(a)qwest.com'; Schmidt, Thomas; Bornstein, Ronald J; Brosek, Wayne; 'balaji(a)lacuracao.com'; 'ron_conyers(a)apsnet.com'; Ozga, Mary; 'ggopal(a)epoch.net'; Rummler, Natalie; 'john(a)pacemso.com'; 'dslattery(a)isiservices.com'; 'sabel(a)emsanet.com'; 'admin(a)mounet.com'; Doubet, Matt M; 'atanas(a)aplus.net'; 'bradvica(a)emsanet.com'; Valentine, James M; Dowell, Eric R; 'ljames(a)prohosting.com'; 'tpalmer(a)peoplepchq.com'; 'grkrueg(a)qwest.com'; 'ksc(a)wanetwork.net'; 'jmccabe(a)kans.com'; Reed, David (Wholesale); 'larry(a)aplus.net'; Bennett, Chris; 'lilian(a)aplus.net'; 'rickn(a)bigplanet.net'; 'dthomson(a)netacc.net'; 'sburt(a)kans.com'; Fizer, Mike X; 'davids(a)ssa1.com'; Quinzon, Cherie; 'micah(a)myvine.com'; 'eric.hworth(a)eztel.net'; 'nolson(a)lh.net'; 'awong(a)corp.untd.com'; 'amead(a)netacc.net'; 'Jrhowell(a)verinettech.com'; 'Aelmore(a)verinettech.com'; 'Bacollins(a)verinettech.com'; Wagner, Scott M; 'Lamont.brooks(a)qwest.com'; Wechsel, Tracy L.; 'Johnny(a)gazellevillage.com'; Hess, Patrick; 'merry.shepard(a)frontiercorp.com'; 'cavany(a)gazellevillage.com'; 'Pmw(a)meridian-prime.com'; 'Pschneck(a)networkip.net'; 'steve(a)networkip.net'; Beard, James K; Kean, Scott A; Mortensen, Cynthia; 'mardy.chaplin(a)ohdela.com'; 'corey.niceswanger(a)ohdela.com'; 'jean.harsh(a)whitehatmgmt.com'; Moore, Jeffrey G.; 'wesley.jensen(a)qwest.com'; Thompson, William P.; 'ja(a)epoch.net'; 'edgenet(a)epoch.net'; 'Piotr.artwich(a)dot.state.co.us'; 'Jamie.shoup(a)dot.state.co.us'; 'Kglose(a)qwest.com'; 'Rwhetse(a)qwest.com'; Greig Bellum; 'Eflagel(a)datapath.us'; Myruski, Melissa L; Boat, Dane W; 'reedjo(a)corp.earthlink.net'; 'brownc3(a)corp.earthlink.net'; 'mike(a)nvinet.com'; 'support(a)taloncc.com'; 'bryan_w(a)qostel.com'; Major, Clay D; 'daniel.flynn(a)qwest.com'; 'kriss(a)sterlink.net'; 'Debi.christopoulos(a)qwest.com'; 'Jamel.coleman(a)qwest.com'; 'wwalling(a)lh.net'; 'Paday2(a)qwest.com'; 'noc(a)virtela.net'; 'noc-escalate(a)corp.earthlink.net'; 'manderson(a)devonit.com'; 'kclous(a)devonit.com'; 'kcarter(a)devonit.com'; O'Hara, Tripp; 'eric.shippam(a)canetmail.com'; 'jimmy(a)gointernet-corp.net'; McGuirk, Patrick; Chandler, Shirley; 'ssmith(a)aleron.com'; 'helpdesk(a)covad.net'; 'cio(a)gointernet-corp.net'; 'frankm(a)gointernet-corp.net'; 'mxyamas(a)qwest.com'; Bullock, Brian; 'joe(a)config.com'; Kure, Anthony C; 'mark.wright(a)concert.com'; 'gary.hudson(a)concert.com'; 'scott.andrews(a)concert.com'; Logan, Mike; 'allan.rush(a)qwest.com'; 'NOCnodes(a)aol.com'; 'noel(a)velocitywest.com'; 'todd(a)velocitywest.com'; Mishreki, Rafik (Steve); 'chris(a)canetmail.com'; 'hester.bishop(a)communicationsadvantage.net'; 'pnoone(a)peoplepchq.com'; 'nancy_braen(a)apsnet.com'; 'jared.keisel(a)bigplanet.com'; 'cchriston(a)brannan1.com'; 'travis(a)bblabs.com'; 'Jay.Isaacs(a)cwusa.com'; 'noc(a)chilitech.net'; 'supportescalation(a)cisp.cc'; 'Dallas(a)dallastech.net'; 'jared(a)dialupusa.net'; 'network(a)frontier.net'; 'isisnoc(a)frontiernet.net'; 'Dettling(a)ussouth.net'; 'Dday(a)hypervine.net'; 'qwest_notifications(a)noc.untd.com'; 'noc(a)kitusa.net'; 'nocc(a)lh.net'; 'webmaster(a)mccooknet.com'; 'GSCESC(a)MICROSOFT.COM'; 'davenielsen(a)shadowlink.net'; 'btomhave(a)sofast.net'; 'benner(a)tgrsolution.net'; 'Nlonsinger(a)2by2.net'; 'jst(a)integrity.com'; 'lbroderi(a)nuskin.com'; Melara, Mel; 'mgracia(a)covad.com'; 'Tylerw(a)attbi.com'; Hudson, Susan D; Skibicki, Gale A.; 'carman.wenkoff(a)ontain.com'; 'mark.thimmig(a)whitehatmgmt.com'; 'dlucente(a)qualguard.com'; 'johnc(a)qualguard.com'; 'xballarin(a)qualguard.com'; 'steve.smith(a)qwest.com'; 'tandersen(a)pathfire.com'; 'ahardman(a)pathfire.com'; Jencks, Nancy; Peters, Jeffery S.; 'erica.lybecker(a)atlasdmt.com'; 'daves(a)atlasdmt.com'; 'noc(a)atlasdmt.com'; 'jefff(a)atlasdmt.com'; 'hjsimps(a)qwest.com'; 'radius(a)cisp.cc'; 'kmuller(a)aleron.com'; 'b.douglas(a)eztel.net'; 'kreau(a)cisp.cc'; Ledwich, Michelle; 'MWMarien(a)rehabcare.com'; 'CLBartlow(a)rehabcare.com'; 'anthony.lagalante(a)qwest.com'; 'KGSkiles(a)rehabcare.com'; Feinbaum, Livius; 'larryw2549(a)sbcglobal.net'; 'nseramu(a)qwest.com'; 'jmmorro(a)qwest.com'; 'tingema(a)qwest.com'; 'sscoleri(a)covad.com'; 'Bret.hickenlooper(a)qwest.com'; 'kimmer(a)corp.earthlink.net'; 'maryay(a)corp.earthlink.net'; 'PLarkin(a)corp.EarthLink.NET'; Dobzynski, Fred M; Dillehay, Jim T; Maier, James R; 'sstrickland(a)aleron.com'; 'sshelton(a)aleron.com'; 'eric(a)dialupusa.net'; Smiley, Brian; Langley, Matt; 'dan(a)netrelated.com'; 'lisa.rogers(a)qwest.com'; Dahlen, Paul; Rhodes, Gregory J; 'john(a)ikano.com'; Heuser, Brent; 'trahm(a)qwest.com'; McKelvy, Alison N.; 'daboyer(a)qwest.com'; 'ifap(a)lists.corp.earthlink.net'; 'spud(a)reachone.com'; 'info(a)reachone.com'; 'tech(a)reachone.com'; 'awetmor(a)qwest.com'; 'mdelvag(a)qwest.com'; 'rick_bucchi(a)apsnet.com'; 'dduncan(a)cybrtyme.com'; 'john_lee(a)lst.com'; 'ben_campbell(a)lst.com'; Young, Richard S; 'john(a)bizoppmail.com'; 'ron.mosrie(a)qwest.com'; Hobbs, William C; 'bill(a)yournetplus.com'; 'bdouglas(a)eztel.net'; Harkins, Dustin; 'radius(a)ikano.com'; Heard, Leslie A; Moore, Chris; Bodman, Robert; Keyser, Scott R; 'jwhitney(a)corp.untd.com'; 'abuse(a)netacc.net'; 'Susan.levertt(a)qwest.com'; 'abuse(a)peoplepc.com'; 'chris(a)bblabs.com'; 'miko(a)yournetplus.com'; O'Brien, Harry L; 'nfe(a)americatel.net'; 'Nocops(a)netifice.com'; 'mhawoo(a)qwest.com'; 'morms(a)qwest.com'; 'network(a)frontier.net'; Dan-CPM Subject: Re: Qwest Dial Access Network Labor Day Week Schedule OH MY WORD! QWEST! You never fail to astound me! Once again our e-mail addresses have been sent out in plain text and I'm going to be bombarded by your less then upright resellers who are going to contact me to find out if I want to get dial-up service through them. I've about had it! Your techs are incompetant.... It takes days to fix problems.... I'm assured that e-mail will never be sent out like this again with all e-mail addresses naked and out in public, and still it happens again. Yes, I'm CCing the entire list... I'm very upset right now, and I've hit reply all because the option is there and provided for me. Get your act straightened out qwest.... I'm honestly suprised you haven't lost more customers... between the 10meg pipe we have through you and all the problems we've had with it, and then our dial-up contract, I honestly don't know how you people stay in business... Have a wonderful labor day, ~ Matt

3 2

Opinion on null0'ing entire 218.0.0.0?
by Drew Weaver 26 Aug '03

26 Aug '03

Is anyone getting hundreds of thousands of spasm a day from 218.0.0.0 like I am? Has anyone actually considered null routing the whole block? Is there actually any 'users' in APNIC space? Or is it all spam from korea? -Drew

5 4

Microsoft distributes free CDs in Japan to patch Windows
by Sean Donelan 26 Aug '03

26 Aug '03

As some of you know, the standard Microsoft OS distribution sold in stores on CD is a year or so old, and doesn't include any recent patches. You needed to download recent patches from Microsoft's web site. Unfortunately, with the latest round of worms, Windows doesn't survive on the net long enough to downdload patches. In Japan, Microsoft will be distributing "free" CD's with patches through its distribution channels, eletrical appliance and personal computer shops. The anti-virus vendors are apparently packaging their wares along with the Microsoft patches. Symantec and Trend will be the first. Symantec is distributing 15,000 CDs on Wednesday, and Trend Micro is distributing 10,000 CDs on Thursday. http://www.japantimes.co.jp/cgi-bin/getarticle.pl5?nn20030823b2.htm No word if Microsoft will be distributing any patch CDs in the USA. However, many universities have created their own CDs for students moving into dorms. It is the start of the school year in in North America, and high speed network connections and new unpatched Microsoft Windows on computers are a bad combination.

11 18

Worldnet-ATT on list?
by Drew Weaver 26 Aug '03

26 Aug '03

If any worldnet-att people are on list please contact me. Thanks, -Drew

1 0

Odd Default Gateway Address
by HongJin Choi 26 Aug '03

26 Aug '03

Hi!! I use CISCO Catalyst 6509. And, My PC use WinXP. Default Gateway Address is 172.16.4.200. But, in case that default gateway address chage 1.1.1.1, communication with other segment is O.K. I think that Communication can't establish to other segment. When i look at the ARP Table, the MAC address of 172.16.4.200 and 1.1.1.1 is same. How do i correct this problem?? Thanks in advance!! ---------------------------------------------------------------------------- ------- HongJin, Choi Manager, ITG Team/Infra Biz. Division, HANWHA S&C CO., LTD. HANWHA Bldg., 20F, #1, Janggyo-Dong, Jung-Gu, Seoul, 100-797, KOREA Email : dunkhong(a)hanbit.net Tel : +82-2-729-4828 Fax : +82-2-729-4680 Mobile : +82-11-9894-2358

2 1

Scitec SAT3000 DSU console pinout?
by Joe Abley 26 Aug '03

26 Aug '03

Hi, Does anybody happen to know the pinouts for the console port on a Scitec SAT3000 E1 DSU? (I am at a particularly remote site, and local information is hard to come by) Joe

1 0

MAx TNT Filter -- Actual FILTER
by Sean Watkins 25 Aug '03

25 Aug '03

TNT Users: Apologize: I know I am posting to multiple lists, but multiple lists with Ascend users.. none so far have posted and numerous are asking for it... Including myself! Hopefully recommendations will follow After several hours of trial and error - after I setup the recommended Cisco filters upstream from TNT equipment. I have been constantly watching log entries, to find people blasting away with ICMP/UDP Port 135/ TCP Port 137 the most. I have come up a filter, for the TNT: new FILTER set filter-name = pre-nachi2 set input-filters 1 valid-entry = yes set input-filters 1 Type = ip-filter set input-filters 1 ip-filter protocol = 6 set input-filters 1 ip-filter Dst-Port-Cmp = eql set input-filters 1 ip-filter dest-port = 135 set input-filters 2 valid-entry = yes set input-filters 2 Type = ip-filter set input-filters 2 ip-filter protocol = 17 set input-filters 2 ip-filter Dst-Port-Cmp = eql set input-filters 2 ip-filter dest-port = 137 set input-filters 3 valid-entry = yes set input-filters 3 forward = yes set input-filters 3 Type = ip-filter set input-filters 3 ip-filter protocol = 1 set input-filters 3 ip-filter dest-address-mask = 255.255.255.255 set input-filters 3 ip-filter dest-address = X.X.X.X set input-filters 4 valid-entry = yes set input-filters 4 Type = ip-filter set input-filters 4 ip-filter protocol = 1 set input-filters 5 valid-entry = yes set input-filters 5 forward = yes set input-filters 5 Type = ip-filter write -f ; This filter blocks UDP Port 135, tcp port 137, allows ICMP to X.X.X.X, drops all other ICMP, and then allows any other traffic out. Basically, X.X.X.X is a machine here we can use to have customers ping us/ we ping them. This filter seems to work for 90% of people, but for unknown reasons, ICMP still seems to leak in. Any ideas? I'm applying this filter to data under answer-defaults, session-info. I've set iproute-cache-enable = no, Disabled proxy arp... Everything. Still we are dropping packets at peak times left right and center for unknown reasons. show ip cache flow on upstream Cisco gear shows basically regular traffic. Ideas/comments etc? Sean > > > ----- Original Message ----- > From: "Dave Birkbeck" <dbirkbeck(a)ikano.com> > To: "'Tony Bunce'" <tonyb(a)go-concepts.com>; "'Sean Watkins > (northrock)'" > <sean(a)northrock.bm>; <radiator(a)open.com.au> > Sent: Monday, August 25, 2003 7:27 PM > Subject: RE: (RADIATOR) MAx TNT & MSBlast > > >> All, >> >> In addition to having the ACL's that Cisco recommends. Has anyone come >> up with a Radius ascend-data-filter that will slow down the spread of >> these crazy viruses? Or better yet, a filter that will block ICMP. >> >> Again, I know this is probably not the list for this discussion, but >> this topic is definitely for the greater good of the Internet. >> >> That being said does anyone know of a list that discusses various NAS >> topics?

1 0

RE: Virus
by Ingevaldson, Dan (ISS Atlanta) 25 Aug '03

25 Aug '03

Wesley- There is no evidence that the patch does not fix the vulnerability. You may be getting infected during the patching and cleaning process. Best bet is to patch, reboot, then clean. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Wesley Vaux [mailto:Wesley.Vaux@globalknowledge.com] Sent: Monday, August 25, 2003 11:25 AM To: nanog(a)merit.edu Subject: Virus Has anyone noticed that after patching and cleaning machines that they become infected again? Is this just me? What is your process for remove Nachi.worm. Sorry for bringing this back up. Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com

4 3

Re: Lazy Engineers and Viable Excuses
by Brian Dickson 25 Aug '03

25 Aug '03

Joe wrote: >>Haesu wrote: >> You ARE correct. If everyone employs IRR and put explicit filters everywhere, >> it'd be the perfect world.. > >... if everybody used the IRR to build explicit filters everywhere, if everybody kept their objects in the IRR up-to-date, and if there was some appropriate authorisation scheme in place to allow you to trust the data in the IRR implicitly, it'd be a perfect world. There is this widely percieved notion that the IRR is a single, unadministered database. This is incorrect. The "Source:" field tells the whole story - there are multiple databases, with varying degrees of trust-worthiness, varying content, and varying uses. > >The IRR is currently a reasonable tool to use to avoid listening to routes which are advertised by mistake from peers who populate the IRR accurately. It's not a reasonable tool for avoiding maliciously bogus routes, since sticking maliciously bogus information in the IRR is trivial. The IRR is the correct tool; what is missing is a little application of the available capabilities of the tool. Here's an example: You have a lot of address space to manage. Some BGP customers, some not. Some worthy of trust, some not. So, you operate your *own* routing registry, and tell the world about it. But, you, and only you, have update access. You mirror the routing registries of only the customers you trust. Your peers operate likewise. Your filter-building accesses the rr's of your peers, either directly, or via a reasonably well-located and well-trusted mirror. Or better yet, you mirror (possibly privately) them, yourself. Any problems with the content of any RR, you know who to contact (and blame). You also now have a mechanism to persuade your peers with, which is the peering agreement you both signed. Update it to include this, if you need to. No cruft, secure enough, no bogons, scalable. Technology that is already well understood, and for which tools have been built. Clear chain of trust, and straightforward means to sever problem servers. I don't see where (other than perhaps attitudes and erroneous assumptions) the problem is. And running a route-registry is *really* no more difficult than querying one, in most cases less so. Certainly less effort than even a small name server serving authoritative data... -- Brian Dickson Email: briand(a)cineclix.com http://www.cineclix.com Tel : +1 604 688 2339

1 0