September 2003 - Test - lists.nanog.org

dns.exe virus?
by Christopher J. Wolff 08 Sep '03

08 Sep '03

Greetings, After tracking down what I believed was an attempted DOS attack, it turns out that two Windows 2000 servers, fully updated, were spewing out hundreds of port 53 requests. Upon further investigation dns.exe was hogging 99% of the CPU. I haven't found any reference to this at CERT so I thought I would drop the occurrence into the nanog funnel to see what comes out. The attack started around 8AM MST. Thank you for your consideration. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

6 8

arin.net DNS problems
by Kai Schlichting 08 Sep '03

08 Sep '03

I had intermittent failures to resolve whois.arin.net today, and haven't bothered to investigate this until now: someone please forward this to an after-hours person at ARIN, hostmaster(a)arin.net will probably not be read for a while. Reason: BUCHU.arin.net. 3H IN A 192.100.59.110 arrowroot.arin.net. 3H IN A 198.133.199.110 are both not returning any A record for 'whois.arin.net' $ dig +norec @a.gtld-servers.net arin.net ns ;; ANSWER SECTION: arin.net. 2D IN NS l3.nstld.com. arin.net. 2D IN NS a3.nstld.com. arin.net. 2D IN NS c3.nstld.com. arin.net. 2D IN NS f3.nstld.com. arin.net. 2D IN NS g3.nstld.com. arin.net. 2D IN NS buchu.arin.net. arin.net. 2D IN NS arrowroot.arin.net. All *.nstld.com servers respond with: whois.arin.net. 3H IN A 192.149.252.43 The zone serials are consistent: ;; ANSWER SECTION: arin.net. 3H IN SOA arrowroot.arin.net. bind.arin.net. ( 2003061812 ; serial 3H ; refresh 10M ; retry 2W ; expiry 1H ) ; minimum However, buchu and arrowroot.arin.net BOTH answer very oddly when queried for an SOA: they are returning an A record for arin.net - not quite what was asked for! $ dig +norec @198.133.199.110 arin.net soa ; <<>> DiG 8.2 <<>> +norec @198.133.199.110 arin.net soa ; (1 server found) ;; res options: init defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1426 ;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 10, ADDITIONAL: 2 ;; QUERY SECTION: ;; arin.net, type = SOA, class = IN ;; ANSWER SECTION: arin.net. 3H IN A 192.149.252.17 ;; AUTHORITY SECTION: arin.net. 3H IN NS L3.NSTLD.COM. arin.net. 3H IN NS G3.NSTLD.COM. arin.net. 3H IN NS F3.NSTLD.COM. arin.net. 3H IN NS E3.NSTLD.COM. arin.net. 3H IN NS D3.NSTLD.COM. arin.net. 3H IN NS C3.NSTLD.COM. arin.net. 3H IN NS BUCHU.arin.net. arin.net. 3H IN NS B3.NSTLD.COM. arin.net. 3H IN NS arrowroot.arin.net. arin.net. 3H IN NS A3.NSTLD.COM. ;; ADDITIONAL SECTION: arrowroot.arin.net. 3H IN A 198.133.199.110 BUCHU.arin.net. 3H IN A 192.100.59.110 ;; Total query time: 17 msec ;; FROM: sonet.conti.nu to SERVER: 198.133.199.110 ;; WHEN: Mon Sep 8 18:34:11 2003 ;; MSG SIZE sent: 26 rcvd: 263 However, an 'any' query yields: $ dig +norec @198.133.199.110 arin.net any ; <<>> DiG 8.2 <<>> +norec @198.133.199.110 arin.net any ; (1 server found) ;; res options: init defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55882 ;; flags: qr aa; QUERY: 1, ANSWER: 16, AUTHORITY: 0, ADDITIONAL: 4 ;; QUERY SECTION: ;; arin.net, type = ANY, class = IN ;; ANSWER SECTION: arin.net. 3H IN SOA arrowroot.arin.net. bind.arin.net. ( 2003061812 ; serial 3H ; refresh 10M ; retry 2W ; expiry 1H ) ; minimum arin.net. 3H IN A 192.149.252.17 arin.net. 3H IN MX 10 smtp2.arin.net. arin.net. 3H IN MX 20 smtp1.arin.net. arin.net. 3H IN NS L3.NSTLD.COM. arin.net. 3H IN NS G3.NSTLD.COM. arin.net. 3H IN NS F3.NSTLD.COM. arin.net. 3H IN NS E3.NSTLD.COM. arin.net. 3H IN NS D3.NSTLD.COM. arin.net. 3H IN MX 40 cumin.apnic.net. arin.net. 3H IN NS C3.NSTLD.COM. arin.net. 3H IN NS BUCHU.arin.net. arin.net. 3H IN NS B3.NSTLD.COM. arin.net. 3H IN MX 30 aso.icann.org. arin.net. 3H IN NS arrowroot.arin.net. arin.net. 3H IN NS A3.NSTLD.COM. ;; ADDITIONAL SECTION: smtp2.arin.net. 3H IN A 192.149.252.32 smtp1.arin.net. 3H IN A 192.149.252.33 arrowroot.arin.net. 3H IN A 198.133.199.110 BUCHU.arin.net. 3H IN A 192.100.59.110 ;; Total query time: 117 msec ;; FROM: sonet.conti.nu to SERVER: 198.133.199.110 ;; WHEN: Mon Sep 8 18:36:01 2003 ;; MSG SIZE sent: 26 rcvd: 437 The *.nstld.com servers are answering to these queries in normal fashion. bye,Kai -- "Just say No" to Spam Kai Schlichting New York, Palo Alto, You name it Sophisticated Technical Peon Kai's SpamShield <tm> is FREE! http://www.SpamShield.org | | LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxes WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMath

1 0

Re: Cable & Wireless, Verio and/or Level 3 port blocking?
by Jared Mauch 08 Sep '03

08 Sep '03

On Mon, Sep 08, 2003 at 12:32:14PM -0700, Tom (UnitedLayer) wrote: > On Mon, 8 Sep 2003, Jared Mauch wrote: > > NTT/Verio is performing no network-wide port blocking > > of such services. > > Last time I asked, they were filtering to some degree. > I don't recall where they were filtering however. I know that there were some filters deployed initally but they were removed. Any filters that remain are one-off filters on individual customer connections. If you are a NTT/VERIO customer (is that better? ;-) ) and are experiencing problems you should obviously contact your relevant support teams. - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

RE: Don't forget about physical security - Australia
by St. Clair, James 08 Sep '03

08 Sep '03

My apologies to spamming Sean - here is the link to the tale: Personal Message: Brilliant display of chutzpah and social engineering. The brazen airport computer theft that has Australia's anti-terror fighters up in arms By Philip Cornford September 5, 2003 URL: http://www.smh.com.au/articles/2003/09/04/1062548967124.html -----Original Message----- From: Sean Donelan [mailto:sean@donelan.com] Sent: Saturday, September 06, 2003 2:13 AM To: nanog(a)merit.edu Subject: Don't forget about physical security - Australia Two people dressed as computer technicians entered Australia's mainframe data center for customs and intelligence centre at the Sydney International Airport. They impersonated EDS technicians hired to repair the mainframes. They spent two hours disconnecting the mainframe communications equipment. They then put the equipment on trolleys and pushed them out the front door past the guards.

1 0

Re: wire rate filtering and policy routing
by sthaug＠nethelp.no 08 Sep '03

08 Sep '03

> Aside from Juniper, what are the options for wire rate filtering and policy > routing (for at least 1Gbps and say 500+kpps)? > > As usual, private responses will result in a summary to the list. Cisco 6500 with Sup2/MSFC2/PFC2 or with Sup720. If you don't need a full routing table you might even be able to do it with a Cisco 3550. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

wire rate filtering and policy routing
by John Payne 08 Sep '03

08 Sep '03

Aside from Juniper, what are the options for wire rate filtering and policy routing (for at least 1Gbps and say 500+kpps)? As usual, private responses will result in a summary to the list. Thanks

1 0

Roll call, custom IPG support
by Adam Rothschild 08 Sep '03

08 Sep '03

Do any providers support non-standard inter-packet gap (IPG) configurations on transit customers' ethernet interfaces? Please respond privately, and I'll post a summary to the list. Thanks, -a

1 0

Weekly lamer report
by Rob Thomas 08 Sep '03

08 Sep '03

Hi, NANOGers. Don't forget to check for lame DNS delegations! There are 13066 entries in the lamer report for the week ending 07 SEP 2003. These entries are often indicators of greater problems with name server configurations. <http://www.cymru.com/DNS/lame.html> Thanks, Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

3 3

Qwest.Net/USWest.Net SWIP Contact for 63.224.0.0/13?
by Andy Ellifson 07 Sep '03

07 Sep '03

Can a Qwest.Net/USWest.Net person that can remove an ARIN SWIP within the IP Block of 63.224.0.0/13 please contact me off list? I'm having problems getting an entry removed since I no longer have those IP addresses and the related service. Thanks! Andy Ellifson

1 0

Re: BMITU
by Jim Shankland 07 Sep '03

07 Sep '03

> Qmail doesn't scale well with large injection rates. Qmail > scaling in that sort of manner is completely dependant upon > the filesystem. Now this may have changed, but not that long > back everything in submission was in one dir, processing in > another dir, just like sendmail (by default) does. This > caused the queue manager to stuff up something wicked at high > injection rates. Hans Reiser would argue that that reflects a limitation of the filesystem, rather than of qmail; and that apps should not have to code around such unreasonable filesystem limitations. And reiserfs goes to considerable effort to achieve good performance on directories containing thousands of small files. This would imply that if you're going to use qmail in a high-volume environment, you might consider using reiserfs, also. Jim Shankland

2 1