September 2003 - Test - lists.nanog.org

Costs of not testing an implementation
by Chan, Chung Ming 19 Sep '03

19 Sep '03

Hi, I'm trying to gather some data to justify the needs of getting protocol conformance testing tools for testing out the products before deployment. Especially if there is any study on what is the cost of not doing enough testing before deployment and that cost comparing to the cost of getting the tools. If any of you can point me to any useful link, it will be great! Thanks in advance!

1 0

RE: Where to get an ASN certificate?
by Nine, Jason 19 Sep '03

19 Sep '03

Thanks all for the info! -----Original Message----- From: Clinton Work [mailto:clinton@scripty.com] Sent: Friday, September 19, 2003 10:35 AM To: Nine, Jason Subject: Re: Where to get an ASN certificate? You have to apply to ARIN to get a AS number. www.arin.net ===================================== Clinton Work clinton(a)scripty.com Airdrie, AB ----- Original Message ----- From: "Nine, Jason" <Jason.Nine(a)hdrinc.com> To: <nanog(a)merit.edu> Sent: 19 September, 2003 9:02 AM Subject: FW: Where to get an ASN certificate? We will need to run BGP here in the next few weeks, does anyone know where you apply for an ASN certificate? Thanks

1 0

RE: Interesting interaction between Blaster worm variants and Verisign DNS change
by Jeremy_Powell＠sbcss.k12.ca.us 19 Sep '03

19 Sep '03

Not possible is a strong statement since it has happened twice so far. The assumption you are making is the assumption that I made, which is that the resolver would first try to lookup exactly what was requested, but that is not what it does for example, with the machines domain set to clementnt.com and the default Append Primary DNS suffix to lookups checked under thae advanced TCP/IP properties the result of an nslookup from the machine for www.apple.com is to lookup www.apple.com.clementnt.com which returns 64.94.110.11 because it does not exist. It does this before actually looking up what was typed. When I say it has happened twice, I mean that I have had 2 Blaster infected machines sending spoofed IP address request to 64.94.110.11 tcp port 80 containing the windowsupdate.com in the host portion of the html header. Removing blaster using virus tools eliminated this behavior. Jeremy Powell > -----Original Message----- > From: Florian Weimer [mailto:fw@deneb.enyo.de] > Sent: Friday, September 19, 2003 4:44 AM > To: Jeremy Powell > Cc: nanog(a)merit.edu > Subject: Re: Interesting interaction between Blaster worm variants and > Verisign DNS change > > > <Jeremy_Powell(a)sbcss.k12.ca.us> writes: > > > I think that an interesting interaction involving: > > > > 1) Blaster worm DDoS attack against windows update. > > 2) The default action of Windows 2000 and XP computers > > to automatically append the domain name under "Network > > Identification" or the suffix search list to DNS lookups. > > 3) The number of non-existent domains that exist in the > > above settings. > > 4) The change that Verisign made so that all non-existent > > domains resolve to 64.94.110.11 > > > > is the cause of the DDoS attack that Verisign is experiencing. > > This is not possible. There's a NS entry for windowsupdate.com, which > overrides the wildcard A record (in standard zone files, wildcard > records are suppressed as soon as an RR for the domain exists, even if > the types don't match). > _________________________________________________________________________________ Statement of Confidentiality: The contents of this e-mail message and any attachments are intended solely for the addressee. The information may also be confidential and/or legally privileged. This transmission is sent for the sole purpose of delivery to the intended recipient. If you have received this transmission in error, any use, reproduction, or dissemination of this transmission is strictly prohibited. If you are not the intended recipient, please immediately notify the sender by reply e-mail, send a copy to postmaster(a)sbcss.k12.ca.us and delete this message and its attachments, if any. E-mail is covered by the Electronic Communications Privacy Act, 18 USC SS 2510-2521 and is legally privileged. Date Sent (d/m/yy): 19/9/2003 - Sender: Jeremy_Powell(a)sbcss.k12.ca.us

1 0

FW: Where to get an ASN certificate?
by Nine, Jason 19 Sep '03

19 Sep '03

We will need to run BGP here in the next few weeks, does anyone know where you apply for an ASN certificate? Thanks

3 2

diversion...
by bmanning＠karoshi.com 19 Sep '03

19 Sep '03

for the third time in nine years an ISP ran into some misconceptions wrt some address blocks that I've been piloting. Third times the charm. For ISPs that might want to know the "policy" in play for those blocks: www.ep.net/policy.html --bill

1 0

RE: Kill Verisign Routes :: A Dynamic BGP solution
by Eric Germann 19 Sep '03

19 Sep '03

I guess we don't really need to discuss the political ramifications, because I don't really care about VS. Our internal policy is to kill the route to the host. I'm offering up a tool to implement a technical solution to killing the route. Nothing more, nothing less. It only affects our internal network, so we don't really have a global impact, unlike some folks in Virgina. If people want it, its here. If not, they're free to delete this. Key is, they have choice. Eric > -----Original Message----- > From: David Schwartz [mailto:davids@webmaster.com] > Sent: Friday, September 19, 2003 4:04 AM > To: J.A. Terranson > Cc: ekgermann(a)cctec.com > Subject: RE: Kill Verisign Routes :: A Dynamic BGP solution > > > > > On Thu, 18 Sep 2003, David Schwartz wrote: > > > > I think the whole idea of getting into an escalating > > > technical war with > > > Verisign is extremely bad. Your suggestion only makes sense if > > > you expect > > > Verisign to make changes to evade technical solutions. Each > > > such change by > > > Verisign will cause more breakage. Verisign will either > provide a way to > > > definitively, quickly, and easily tell that a domain is not > > > registered or > > > Verisign will badly break COM and NET. > > > > DS > > > With all due respect, this line of logic is the same one used > in the US to > > prevent people from defending themselves from other types of > > crime, and it's totally bogus. > > Really? I've never seen anyone attempt such an argument, > but it would be > rather amusing to see. Which part would you use? > > Would you argue that criminals aren't likely to take steps > that obviously > are attempts to reduce the effectiveness of guns? And if they do, > they will > have to deal with the likely PR and government pressure that would result. > > The whole point here is that it's not clear to everyone > that Verisign is > analogous to the criminal. The point is to make it clear that they are and > that won't happen if you look very much like them. > > > We have been, in a literal sense, attacked by Verislime, any and > > all defenses > > are appropriate. > > No. The defenses have to be reasonable and have to avoid > collateral damage > to innocent parties. If not, Verisign will have a reasonable argument that > we are the bad guys. They caused some breakage? So what, so did we. They > distorted the true data that should have been in the zone? So what, so did > we. > > You are welcome to see this as an attack, but the response > should not be > out of proportion. If a measured response leads to an escalation, then you > can consider "any and all defenses". > > DS > > >

1 0

The Cidr Report
by cidr-report＠potaroo.net 19 Sep '03

19 Sep '03

This report has been generated at Fri Sep 19 21:47:52 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 12-09-03 124543 88827 13-09-03 124711 88736 14-09-03 124535 88697 15-09-03 124444 88796 16-09-03 124819 88837 17-09-03 124894 88815 18-09-03 124780 88746 19-09-03 124625 88474 AS Summary 15713 Number of ASes in routing system 6223 Number of ASes announcing only one prefix 1454 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73351168 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 19Sep03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 124256 88463 35793 28.8% All ASes AS4323 662 194 468 70.7% TW-COMM Time Warner Communications, Inc. AS701 1454 1010 444 30.5% ALTERNET-AS UUNET Technologies, Inc. AS7018 1398 982 416 29.8% ATT-INTERNET4 AT&T WorldNet Services AS7843 518 138 380 73.4% ADELPHIA-AS Adelphia Corp. AS3908 909 536 373 41.0% SUPERNETASBLK SuperNet, Inc. AS6197 612 282 330 53.9% BATI-ATL BellSouth Network Solutions, Inc AS6198 493 207 286 58.0% BATI-MIA BellSouth Network Solutions, Inc AS4355 392 109 283 72.2% ERMS-EARTHLNK EARTHLINK, INC AS1221 977 695 282 28.9% ASN-TELSTRA Telstra Pty Ltd AS6347 350 92 258 73.7% DIAMOND SAVVIS Communications Corporation AS1239 901 650 251 27.9% SPRINTLINK Sprint AS27364 319 68 251 78.7% ACS-INTERNET Armstrong Cable Services AS22773 268 28 240 89.6% CCINET-2 Cox Communications Inc. Atlanta AS17676 262 30 232 88.5% GIGAINFRA Softbank BB Corp. AS25844 241 14 227 94.2% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS209 503 294 209 41.6% ASN-QWEST Qwest AS6140 343 135 208 60.6% IMPSAT-USA ImpSat AS4134 324 117 207 63.9% CHINANET-BACKBONE No.31,Jin-rong Street AS11305 230 38 192 83.5% INTERLAND-NET1 Interland Incorporated AS4519 180 4 176 97.8% MAAS Maas Communications AS6327 200 26 174 87.0% SHAW Shaw Communications Inc. AS2386 371 200 171 46.1% INS-AS AT&T Data Communications Services AS2048 256 87 169 66.0% LANET-1 State of Louisiana AS14654 170 2 168 98.8% WAYPORT Wayport AS9498 187 20 167 89.3% BBIL-AP BHARTI BT INTERNET LTD. AS705 415 252 163 39.3% ALTERNET-AS UUNET Technologies, Inc. AS17557 288 136 152 52.8% PKTELECOM-AS-AP Pakistan Telecom AS9800 203 52 151 74.4% UNICOM CHINA UNICOM AS19262 212 65 147 69.3% VZGNI-TRANSIT Verizon Global Networks AS3602 231 86 145 62.8% SPRINT-CA-AS Sprint Canada Inc. Total 13869 6549 7320 52.8% Top 30 total Possible Bogus Routes 24.119.0.0/16 AS11492 CABLEONE CABLE ONE 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.30.64.0/19 AS14900 USLEC-CORP-1 USLEC Corp. 66.41.192.0/18 AS13367 ATT-BBND-B AT&T Broadband 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.143.2.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 140.240.0.0/13 AS1 GNTY-1 Genuity 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 165.212.0.0/16 AS7424 USANET USA.Net 166.16.0.0/16 AS7132 SBIS-AS SBC Internet Services - Southwest 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 ALTERNET-AS UUNET Technologies, Inc. 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.88.99.0/24 AS8379 CYBERNET-AG Cybernet AG German-wide Network 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 AS719 LANLINK autonomous system 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.136.0/21 AS568 SUMNET-AS DISO-UNRRA 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.98.8.0/21 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.79.32.0/20 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.166.18.0/24 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 202.0.180.0/24 AS4058 APNIC-4058 Asia Pacific Network Information Centre 202.3.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.4.252.0/22 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.44.112.0/20 AS17458 CWNETDG-IO-AP Cable and Wireless 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.93.64.0/19 AS9425 I-NEXT-AS-AP Inter.net Philippines border AS 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.136.254.0/23 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.142.130.0/23 AS17820 DIL-AP DIRECT INTERNET LTD. 202.142.132.0/22 AS17820 DIL-AP DIRECT INTERNET LTD. 202.143.48.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.143.56.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.148.192.0/20 AS9942 COMINDICO-AP COMindico Australia 202.148.208.0/21 AS9942 COMINDICO-AP COMindico Australia 202.148.216.0/22 AS9942 COMINDICO-AP COMindico Australia 202.148.220.0/23 AS9942 COMINDICO-AP COMindico Australia 202.148.222.0/24 AS9942 COMINDICO-AP COMindico Australia 202.164.192.0/19 AS7599 IPXC-AS-AP IP Exchange 202.165.0.0/19 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.179.64.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.65.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.66.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.67.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.68.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.189.234.0/23 AS9658 ETPI-IDS-AS-AP Eastern Telecoms Phils., Inc. 203.10.17.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.18.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.19.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.20.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.21.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.22.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.23.0/24 AS9266 VIPER-AU-AP Vipernet 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.86.2.0/23 AS4058 APNIC-4058 Asia Pacific Network Information Centre 203.90.192.0/20 AS9658 ETPI-IDS-AS-AP Eastern Telecoms Phils., Inc. 203.129.126.0/24 AS7473 SINGTEL-AS-AP Singapore Telecom 203.129.127.0/24 AS7473 SINGTEL-AS-AP Singapore Telecom 203.132.95.0/24 AS9787 CONCEPT-AU-AP Concept Networks 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.99.0/24 AS7657 TIG-US-PAS-AP The Internet Group Limited 203.132.102.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.103.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.104.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.105.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.106.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.109.0/24 AS10141 CALOUNDRA-AS-AP Caloundra.net 203.132.110.0/24 AS7598 ALPHALINK-AS-AP Alphalink Pty Limited - Melbourne, Australia 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.112.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 203.135.224.0/19 AS4058 APNIC-4058 Asia Pacific Network Information Centre 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.29.189.0/24 AS3956 TX-METRO Texas Metronet 204.52.232.0/24 AS7177 DFWNET DFW Internet Services, Inc. 204.89.225.0/24 AS2495 KANREN Kansas Research and Education Network 204.194.110.0/23 AS10588 ICSNET Intelligent Computer Solutions, Inc 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.82.64.0/18 AS7029 ALLTELNET Alltel Information Services, Inc. 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.65.232.0/23 AS701 ALTERNET-AS UUNET Technologies, Inc. 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 208.104.103.0/24 AS1239 SPRINTLINK Sprint 209.139.192.0/19 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 209.139.224.0/19 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 209.139.252.0/23 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 209.151.128.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.160.0/19 AS4355 ERMS-EARTHLNK EARTHLINK, INC 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 TELEGLOBE-AS Teleglobe Inc 211.27.156.0/24 AS9768 PUBNET1-AS KT 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.47.32.0/19 AS11304 SPLUS Solutions Plus Inc. 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 216.226.108.0/22 AS3602 SPRINT-CA-AS Sprint Canada Inc. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

site finder performance
by Petri Helenius 19 Sep '03

19 Sep '03

The redirect port 80 server seems to gain on performance, I wonder if that´s due to Verisign fixing issues or enough people blocking it so the load lowers? We´ve gone from 22 seconds average transaction time yesterday, to about two seconds so far today. Minimum achieved is 239 milliseconds, which is also about the theoretical minimum from our neck of woods because of light speed limitations. Pete

1 0

RE: News of ISC Developing BIND Patch
by Adam Atkinson 19 Sep '03

19 Sep '03

> I would say _supposed_ to be unique. Surely some cheapo manufacturer > has recycled addresses from their old ISA card days. I've seen at least one manufacturer ship multiple cards with the same MAC address. One shop in Tottenham Court Road, London sold several people on the same LAN cards with identical MAC addresses.

1 0

Interesting interaction between Blaster worm variants and Verisign DNS change
by Jeremy_Powell＠sbcss.k12.ca.us 19 Sep '03

19 Sep '03

I think that an interesting interaction involving: 1) Blaster worm DDoS attack against windows update. 2) The default action of Windows 2000 and XP computers to automatically append the domain name under "Network Identification" or the suffix search list to DNS lookups. 3) The number of non-existent domains that exist in the above settings. 4) The change that Verisign made so that all non-existent domains resolve to 64.94.110.11 is the cause of the DDoS attack that Verisign is experiencing. It is simple to reproduce 2-4. Reconfigure any Windows 2000 computer or XP computer so that its domain name does not exist or so that the first domain name in its domain suffix search order does not exist and then do an nslookup. It will append the domain you added to your lookup and the result of the lookup will be 64.94.110.11 if the domain you added does not exist. All that is needed next is a machine satisfying this condition to have a variant of the Blaster worm that is performing its DDoS against windowsupdate.com. It will instead sends its traffic to 64.94.110.11. In a network of roughly 30,000 computers we have had 2 with this combination of troubles already. Jeremy Powell San Bernardino County Superintendent of Schools _________________________________________________________________________________ Statement of Confidentiality: The contents of this e-mail message and any attachments are intended solely for the addressee. The information may also be confidential and/or legally privileged. This transmission is sent for the sole purpose of delivery to the intended recipient. If you have received this transmission in error, any use, reproduction, or dissemination of this transmission is strictly prohibited. If you are not the intended recipient, please immediately notify the sender by reply e-mail, send a copy to postmaster(a)sbcss.k12.ca.us and delete this message and its attachments, if any. E-mail is covered by the Electronic Communications Privacy Act, 18 USC SS 2510-2521 and is legally privileged. Date Sent (d/m/yy): 18/9/2003 - Sender: Jeremy_Powell(a)sbcss.k12.ca.us

1 0