September 2003 - Test - lists.nanog.org

Automatic shutdown of infected network connections
by Sean Donelan 03 Sep '03

03 Sep '03

Some universities such as Vanderbilt University are automatically shutting down network ports when they detected signature worm traffic. Almost 25% of the students' computers were detected as infected when they connected to the university network. http://www.vanderbilthustler.com/vnews/display.v/ART/2003/08/29/3f4eb4b3537… How many ISPs disconnect infected computers from the network? Do you leave them connected because they are paying customers, and how else could they download the patch from microsoft?

9 12

Re: Automatic shutdown of infected network connections
by Omachonu Ogali 03 Sep '03

03 Sep '03

On Wed, Sep 03, 2003 at 10:55:47AM -0400, bscott(a)ntisys.com wrote: > On Wed, 3 Sep 2003, at 10:41am, nanog(a)missnglnk.com wrote: > > And if you just bought a new system, it should have the big update (SP2) > > installed on the machine already ... > > Service Pack 2 for Windows XP has not been released yet. Weird, when I go to Add/Remove programs, I see "(SP2)" next to the hotfixes I applied, from that I assumed SP2 was out or something. > As of 1 Sep 2003, there are 21 post-SP1 security-related hotfixes posted > for Windows XP. The total download size is quite large, if you are on a 56 > kilobit modem. Most of my updates were done on this same modem, and if I recall correctly, most of them varied in size from 300KB to 2MB. Then again, I haven't done a fresh XP install ever since I installed it on this laptop so I don't know how big the initial lump is right now. > > ... unless you're dealing with an incompetent PC > > manufacturer/reseller/whatever that likes to cut corners ... > > Like, say, most of them? Eek. :( Hate to rehash the responsibility debate...but shouldn't the manufacturers/whatever slap the latest service packs on their products that they're selling? If GM puts out a recall on their vehicles for a GE lamp. Yeah, I'm sure GE takes the blame and a hit to their stock, but the dealers go to GM (the aggregator) for the replacement and fix the vehicles they have on the lot before another one gets sold, right? Subtract one level of hierarchy (the dealer, or you could leave it in, since most system builders are rolling out their own stores...Apple, Dell, Gateway, etc.) and you have the common relationship of Microsoft-OEM-End User. Shouldn't the OEM be responsible for any product coming off their shelf that's been "recalled" up until the point of the "recall"?

3 2

NANOG 29 (Chicago) Meeting Information
by Carol Wadsworth 03 Sep '03

03 Sep '03

Registration is now open for NANOG 29, October 19-21, in Chicago. The meeting will be hosted by Server Central. Call for Presentations (submit by September 8): http://www.nanog.org/mtg-0310/call29.html Additional meeting information: http://www.nanog.org Of special note, vendor sponsors can now display equipment during the continental breakfasts and afternoon breaks. Vendor sponsor information: http://www.nanog.org/vendor.html See you there!

1 0

RE: bgp as-path info
by Ejay Hire 03 Sep '03

03 Sep '03

IIRC, They will advertise your specifics if you attach a community of 7018:20 to the route as you send it to them. Otherwise they aggregate all of the routes in the 12/8. -Ejay -----Original Message----- From: Austad, Jay [mailto:JAustad@temgweb.com] Sent: Tuesday, September 02, 2003 1:19 PM To: 'Jack Bates'; Austad, Jay Cc: nanog(a)merit.edu Subject: RE: bgp as-path info Actually, it looks like this is what they are doing. I've already put a call in with them. > -----Original Message----- > From: Jack Bates [mailto:jbates@brightok.net] > Sent: Tuesday, September 02, 2003 1:17 PM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: Re: bgp as-path info > > > If you look closely, they are probably not just stripping > your AS. They > are probably aggregating your network. One provider that I am > aware of > that does this is AT&T. Since your advertisements out the > other network > will be more specific, traffic will only come through them. If the > networks are the same size, then traffic will most likely > come through > your first provider due to AS path counts. > > Usually, you have to request that your more specific routes > be allowed > out due to multi-homing. In the case of AT&T, they have a > community that > you must send with the route to have it sent beyond their > local network. > It's really just a matter of default preference on the part of your > provider. Some default to advertise more specific while > others default > to advertising their aggregates. The latter is used most > commonly when a > provider does a lot of BGP peering that is not multi-homed. > It's not a > bad policy when it comes to looking at the BGP tables. > > -Jack > > Austad, Jay wrote: > > > I just brought up a BGP session with one of my providers, > they are stripping > > our AS as it leaves their network, so it looks like the > route is originating > > from their network. I have another provider that I will be > bringing up BGP > > with later this week. Once I bring up the other provider, I will be > > advertising several networks out both of them. > > > > Is this as-path stripping going to cause issues? Does it > matter either way? > > > > -jay > > >

1 0

RE: bgp as-path info
by Truman, Michelle, RTSLS 03 Sep '03

03 Sep '03

Jay, Customer care should be able to help you. If you have any trouble let me know. I can tell you the community you need to use to get your more specific route out. Michelle Michelle Truman CCIE # 8098 Principal Technical Consultant AT&T Solutions Center mailto:mtruman@att.com Work: 651-998-0949 -----Original Message----- From: Austad, Jay [mailto:JAustad@temgweb.com] Sent: Tuesday, September 02, 2003 1:19 PM To: 'Jack Bates'; Austad, Jay Cc: nanog(a)merit.edu Subject: RE: bgp as-path info Actually, it looks like this is what they are doing. I've already put a call in with them. > -----Original Message----- > From: Jack Bates [mailto:jbates@brightok.net] > Sent: Tuesday, September 02, 2003 1:17 PM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: Re: bgp as-path info > > > If you look closely, they are probably not just stripping > your AS. They > are probably aggregating your network. One provider that I am > aware of > that does this is AT&T. Since your advertisements out the > other network > will be more specific, traffic will only come through them. If the > networks are the same size, then traffic will most likely > come through > your first provider due to AS path counts. > > Usually, you have to request that your more specific routes > be allowed > out due to multi-homing. In the case of AT&T, they have a > community that > you must send with the route to have it sent beyond their > local network. > It's really just a matter of default preference on the part of your > provider. Some default to advertise more specific while > others default > to advertising their aggregates. The latter is used most > commonly when a > provider does a lot of BGP peering that is not multi-homed. > It's not a > bad policy when it comes to looking at the BGP tables. > > -Jack > > Austad, Jay wrote: > > > I just brought up a BGP session with one of my providers, > they are stripping > > our AS as it leaves their network, so it looks like the > route is originating > > from their network. I have another provider that I will be > bringing up BGP > > with later this week. Once I bring up the other provider, I will be > > advertising several networks out both of them. > > > > Is this as-path stripping going to cause issues? Does it > matter either way? > > > > -jay > > >

1 0

Re: Automatic shutdown of infected network connections
by Nathan E Norman 03 Sep '03

03 Sep '03

On Wed, Sep 03, 2003 at 10:49:24AM -0400, George Capehart wrote: > On Wednesday 03 September 2003 08:20 am, Nathan E Norman wrote: > > On Wed, Sep 03, 2003 at 07:39:17AM -0500, Matthew S. Hallacy wrote: > > <snip> > > > > Besides, have you ever tried updating an XP system at 56k? It could > > > literally take days. > > > > You may have a point there. > > More to the point, why would one subscribe to a cable service to get > only 56k when they could get better rates from another cable provider > or DSL? Defeats the purpose of subscribing to a broadband service. > Your customers who want high speed service would most likely change > providers . . . > > My $0.02. I *like* my 250k connection . . . ;-) Perhaps you missed the part where Jonathan said this is a config for customers whose machine has been infected by the virus du jour. The conscientious customer gets something quite a bit better than 56k :-) -- Nathan Norman - Incanus Networking mailto:nnorman@incanus.net A booming voice says, "Wrong, cretin!", and you notice that you have turned into a pile of dust.

1 0

Re: Sprint NOC? Are you awake now?
by neal rauhauser 03 Sep '03

03 Sep '03

I didn't know their NOC number, puck.nether.net is down, normal phone channels lead to voicemail jail. Sorry to disturb your morning but its much easier to complete by 0600 than to have five counties worth of users dialing a phone right next to where you're working. Simon Lockhart wrote: > > On Fri Aug 29, 2003 at 04:10:27AM -0500, neal rauhauser wrote: > > I've just upgraded a Cisco 7206 for a customer with a DS3 and we're > > now ready to take full routes. No one is answering at support, email has > > gone unanswered for thirty minutes - if someone at the Sprint NOC is > > awake please call Neal or Mike at 402-426-6136 - we'd really like to get > > this done before customers start waking up ... > > Since when was nanog a way to get in touch with NOCs? > > Simon > -- > Simon Lockhart | Tel: +44 (0)1628 407720 (x37720) | Si fractum > Technology Manager | Fax: +44 (0)1628 407701 (x37701) | non sit, noli > BBC Internet Operations | Email: Simon.Lockhart(a)bbc.co.uk | id reficere > BBC Technology, Maiden House, Vanwall Road, Maidenhead. SL6 4UB. UK -- mailto:neal@lists.rauhauser.net phone:402-301-9555 "After all that I've been through, you're the only one who matters, you never left me in the dark here on my own" - Widespread Panic

11 20

teleglobe planned outage - 2pm Pacific ?
by matthew zeier 02 Sep '03

02 Sep '03

My OC12 to Teleglobe in LA has been bouncing since 2pm Pacific and when I initially called in I was told their router had crashed and rebooted. Now I'm being told this was planned maintenance. I'm having a hard time believing that. Anyone else seeing issues with Teleglobe in LA? - mz -- matthew zeier - "Curiosity is a willing, a proud, an eager confession of ignorance." - Leonard Rubenstein

1 0

Hey, QWEST clean up your network
by John Brown 02 Sep '03

02 Sep '03

Seems like QWEST doesn't have any edge ACL's in place to deal with this lovely worm issue. Count Source Prexix, rounded up to a /16 144 208.46.0.0 199 65.114.0.0 347 208.45.0.0 462 65.118.0.0 486 65.119.0.0 702 208.44.0.0 ---- 2340 TOTAL Packets out of 2500 for 2 seconds This is ICMP and TCP MS bad traffic for a 2500 packet capture on a DS1 that is directly connected to Qwest. Ergo, Qwest is the transit provider. Capture period was about 2 seconds. ICK According to Qwest Tech/Noc people they can't leave filters up for more than 1 day. Given that this worm has lasted more than 1 day, I'd think its reasonable to leave filters up for say more than one day ???? The other thing I learned from QWEST IP-NOC was that it seems managment decided *NOT TO* filter packets related to this worm issue at the edge...... john brown AS 10480 and others

7 10

RE: bgp as-path info
by Austad, Jay 02 Sep '03

02 Sep '03

Actually, it looks like this is what they are doing. I've already put a call in with them. > -----Original Message----- > From: Jack Bates [mailto:jbates@brightok.net] > Sent: Tuesday, September 02, 2003 1:17 PM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: Re: bgp as-path info > > > If you look closely, they are probably not just stripping > your AS. They > are probably aggregating your network. One provider that I am > aware of > that does this is AT&T. Since your advertisements out the > other network > will be more specific, traffic will only come through them. If the > networks are the same size, then traffic will most likely > come through > your first provider due to AS path counts. > > Usually, you have to request that your more specific routes > be allowed > out due to multi-homing. In the case of AT&T, they have a > community that > you must send with the route to have it sent beyond their > local network. > It's really just a matter of default preference on the part of your > provider. Some default to advertise more specific while > others default > to advertising their aggregates. The latter is used most > commonly when a > provider does a lot of BGP peering that is not multi-homed. > It's not a > bad policy when it comes to looking at the BGP tables. > > -Jack > > Austad, Jay wrote: > > > I just brought up a BGP session with one of my providers, > they are stripping > > our AS as it leaves their network, so it looks like the > route is originating > > from their network. I have another provider that I will be > bringing up BGP > > with later this week. Once I bring up the other provider, I will be > > advertising several networks out both of them. > > > > Is this as-path stripping going to cause issues? Does it > matter either way? > > > > -jay > > >

1 0