January 2004 - Test - lists.nanog.org

example.com/net/org DNS records
by Roger Marquis 06 Jan '04

06 Jan '04

Does anyone know why IANA has assigned NS and A records to the example.{com,org,net,...} domains? They even put up a website at the IP explaining RFC 2606. * Why did they assign NSs and a valid IP to these invalid domains? * Are they breaking the RFC by doing this? * Are they breaking anti-UCE filters by doing this? (yes) * Are they harvesting URLs and referrers? * Will they next advertise routes for RFC 1918 addresses? -- Roger Marquis Roble Systems Consulting http://www.roble.com/

14 22

Lucent APX1000
by Claydon, Tom 06 Jan '04

06 Jan '04

Does anyone here have experience with the APX1000? We just got one of these beasts (to replace two AS5300's), and I need some help on OSPF configurations (specifically, how to integrate it into our Cisco-based network). Thanks, = TC -- Tom Claydon, IT/ATM Network Engineer Dobson Telephone Company phone: (405) 391-8201 cell: (405) 834-0341

1 0

Topics for NANOG30
by Susan Harris 05 Jan '04

05 Jan '04

Hi everyone - here are the presentations we've planned so far for NANOG 30 in Miami, Feb. 8-10. The "**" talks are ones we've scheduled to CELEBRATE OUR 10th ANNIVERSARY (!) SUNDAY TUTORIALS ---------------- Customer-Triggered Real-Time Black Holes Level: Introductory Chris Morrow, UUNET, Tim Battle, AT&T Provider-Provisioned Virtual Private Networks Level: Introductory Ina Minei, Juniper MPLS Fast Reroute Level: Intermediate/Advanced Joe Soricelli, Juniper GENERAL SESSION (Monday - Tuesday) ** = 10th Anniversary Presentations ----------------------------------- ** "End-to-end, Spam, and DoS: Threats to the Model That Made the Internet Great" Phil Karn, QUALCOMM ** "10 Years of Corporate Change in the NANOG & IP Backbone Community" Martin Levy, moderator; John Curran, XO Communications; and Doug Humphrey ** "A Short History of the 'Net" Scott Bradner, Harvard ** "Where We've Been and Where We're Headed," a special panel moderated by Sue Hares with guests Van Jacobsen, Paul Francis, et al. ** "A Decade of Technology Pitfalls and Successes" Dino Farinacci, Procket ** "Where Did the NAPs Come From and When Did They Turn Into Exchange Points?" Steve Feldman, CNET "Internet Exchange Operator Panel" Celeste Anderson, USC LAAP, moderator "Making Sense of BGP" Tina Wong, Van Jacobson, Cengiz Alaettinoglu, Packet Design "Hot Potatoes Heat Up BGP Routing" Renata Teixeira, UCSD; Aman Shaikh, AT&T; Tim Griffin, Intel; Jennifer Rexford, AT&T "Root Cause Analysis of Internet Routing Dynamics" Matthew C. Caesar, L. Subramanian, and R.H. Katz, UC Berkeley "Listen and Whisper: Security Mechanisms for BGP" L. Subramanian, V. Roth, I. Stoica, S. Shenker, and R.H. Katz, UC Berkeley "Real-time Global Routing Metrics" Jim Cowie, Andy T. Ogielski, B.J. Premore, Eric A. Smith, & Todd Underwood, Renesys "Airborne Contagion: Effects of a Worm on Wireless Networking" Christopher Chin, UC Berkeley "How to Kill Worms and Viruses with Policy Pontifications" Scott Bradner, Harvard "Analysis of the DDoS Attack Against SCO" David Moore and Colleen Shannon, CAIDA "IAB Concerns About Permanent Deployment of Edge-Based Filtering" Itojun Hagino, IETF Internet Architecture Board "Roundup of Global RIR Statistics" Ray Plazk, ARIN "BGP Testing: Why Be so Negative?" Brent Imhoff, Wiltel; Scott Poretsky, Quarry RESEARCH FORUM "Achievable Comprehensive Delay Reporting from Routers" Darryl Veitch, Sprintlabs "Synchronising Software Clocks on the Internet" Darryl Veitch, Sprintlabs "A Distributed Control Plane Architecture to Support Millisecond Routing Convergence" Hormuzd Khosravi, Intel "Nemecis: A Tool to Analyze the IRR Registries" Georgos Siganos, UC Riverside MONDAY EVENING BOFs ISP Security and NSP-SEC BOF V Barry Raveendran Greene, Cisco, moderator Peering BOF VII Bill Norton, Equinix, moderator See you soon, and don't forget to register (and to join in the anniversary festivities, bring your old t-shirts, buttons, banners, and hats): https://www.merit.edu/nanog/registration.form.html

1 0

UUNet contact for security spambot?
by Jay Hennigan 05 Jan '04

05 Jan '04

Some well-intentioned person at UUNet, in an effort to rid the Internet of worms, viruses, and evildoers, has written a script that sends email in response to network scans. Repeatedly. Mail comes from "secmbox3(a)uu.net" with a return path of "eagleeye(a)uu.net". We're getting complaints for an origin IP that neither originates on nor passes through our network. I'm not sure why UUNet or their robot assumes that we can help with the problem. Replies to the scripted mail appear to go to Dave Null. If a human at UU.Net could contact me off-list about this, it would be appreciated. -- Jay Hennigan - CCIE #7880 - Network Administration - jay(a)west.net WestNet: Connecting you to the planet. 805 884-6323 WB6RDV NetLojix Communications, Inc. - http://www.netlojix.com/

3 2

Grr. Two in a day is more than I can stand
by Suresh Ramasubramanian 05 Jan '04

05 Jan '04

People subscribed to nanog who mess up and gate all their email back to the list, and to all people cc'd on the email. Having that happen once in a day is bad enough, but two cases of this on the same day? :( Today's crop - > Return-Path: <steve(a)telecomplete.co.uk> > Received: from newman.ficomp.com (newman.ficomp.com [65.165.96.143]) > by corpmail.outblaze.com (Postfix) with ESMTP id C99E216DD83 > for <suresh(a)outblaze.com>; Mon, 5 Jan 2004 13:44:47 +0000 (GMT) > Received: from mail pickup service by newman.ficomp.com with Microsoft SMTPSVC; > Mon, 5 Jan 2004 08:45:58 -0500 > Received: from trapdoor.merit.edu ([198.108.1.26]) by newman.ficomp.com with Microsoft SMTPSVC(5.0.2195.5329); > Sun, 4 Jan 2004 22:03:45 -0500 and > Received: by brum.mine.nu (Postfix, from userid 1008) id: 14:40 +0100 > (CET) > Received: from localhost (localhost [127.0.0.1]) by brum.mine.nu > (Postfix) with ESMTP id E51497927 for: 14:25 +0100 (CET) > Received: from localhost [127.0.0.1] by localhost with POP3 > (fetchmail-5.9.11) for: 14:26 +0100 (CET) > Received: from xanadu.unit.liu.se (xanadu.unit.liu.se [130.236.230.147]) > by mu.unit.liu.se (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun > 23 2003)) with ESMTP id <0HQZ00FSBJS6UG(a)mu.unit.liu.se> for > eriso667(a)student.liu.se; Sun,: 00:06 +0100 (MET) > Received: by xanadu.unit.liu.se (Postfix, from userid 102) id > 317AE4D6FF; Sun, 04: 00:06 +0100 (MET) > Received: from mr.lindesign.se (mr.lindesign.se [195.22.95.33]) by > xanadu.unit.liu.se (Postfix) with ESMTP id A94624D64F for > <eriso667(a)student.liu.se>;: 00:04 +0100 (MET) > Received: from trapdoor.merit.edu ([198.108.1.26]) by mr.lindesign.se > with esmtp (Exim 4.30) id: 00:04 +0100 > Received: by trapdoor.merit.edu (Postfix) id B797691239; Sun, 04: 57:13 > -0500 (EST) -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

1 0

Stopping ip range scans
by william＠elan.net 04 Jan '04

04 Jan '04

Recently (this year...) I've noticed increasing number of ip range scans of various types that envolve one or more ports being probed for our entire ip blocks sequentially. At first I attributed all this to various windows viruses, but I did some logging with callbacks soon after to origin machine on ports 22 and 25) and substantial number of these scans are coming from unix boxes. I'm willing to tolerate some random traffic like dns (although why would anybody send dns requests to ips that never ever had any servers on them?), but scans on random port of all my ips - that I consider to be a serious security issue and I'm getting tired of it to say the least (not to mention that its drain on resources as for example routers have to answer and try to route all the requests or answer back that they could not). So I'm wondering what are others doing on this regard? Is there any router configuration or possibly intrusion detection software for linux based firewall that can be used to notice as soon as this random scan starts and block the ip on temporary basis? Best would be some kind of way to immediatly detect the scan on the router and block it right there... Any people or networks tracking this down to perhaps alert each other? -- William Leibzon Elan Networks william(a)elan.net

8 8

Re: Cable and Wireless Security Contact?
by Richard Cocks 04 Jan '04

04 Jan '04

Paul if you look closer you'll see they have pipes to not only CWUSA, but Abovenet and NetAccess. All of these providers are announcing the hijacked IP block. Richard ----- Original Message ----- From: "Paul" <paul(a)rusko.us> Date: Fri, 2 Jan 2004 10:55:29 -0500 To: "Daniel Roesen" <dr(a)cluenet.de>, <nanog(a)merit.edu> Subject: Re: Cable and Wireless Security Contact? > > daniel, > > they are a cw customer - http://www.fixedorbit.com/AS/20/AS20473.htm > some of their gear is in the cw dc in jersey city. > > paul > > ----- Original Message ----- > From: "Daniel Roesen" <dr(a)cluenet.de> > To: <nanog(a)merit.edu> > Sent: Friday, January 02, 2004 8:50 AM > Subject: Re: Cable and Wireless Security Contact? > > > > > > On Fri, Jan 02, 2004 at 02:41:17PM +0800, Hijacked L wrote: > > > Could a security contact from C&W PLEASE contact me off list? > > > This is very important! > > > One of your customers, Net Transactions LLC > > > > I don't see AS20473 being a C&W customer. Are you perhaps mixing > > up C&W and AboveNet? > > > > > > Regards, > > Daniel > -- ____________________________________________________ Get your own Hello Kitty email @ www.sanriotown.com Powered by Outblaze

5 4

[Fwd: att.net Mail Admin Contact?]
by Mark Foster 04 Jan '04

04 Jan '04

Apologies for the inconvenice to others on NANOG for this post. I've tried repeatedly over the last 6 weeks or more to get in touch with someone within att.net's Abuse/Security/Mail administration. I'd appreciate it if someone in such a position could please contact me off list with urgency. Thanks, Mark.

1 0

Re: Out of office/vacation messages
by Stephen J. Wilcox 03 Jan '04

03 Jan '04

On Sat, 3 Jan 2004, Gregh wrote: > > >> - run on Windows, > > >> Oops, I see your problem. No self-respecting network operator runs and > > >> M$W boxen as an MTA, so Templin is an imposter/troll. > > > > > > This isnt true, the majority run Windows (at least thats what I see in > > > various meetings and from the user-agent headers) > > > > I'm not arguing with your conclusion, but your reasoning is a little broken. > > Only a small proportion of the nanog list membership attend meetings, and > > those that do don't necessarily provide a representative distribution (of > > any kind). > > > > Similarly, the user-agent headers you see are from people on nanog-post; I > > am told the nanog list is much bigger. > > You know, I wish I had Nanog posting rights. This whole thing is very SIMPLY > taken care of yet so many "professionals" are making a D in a B cup about > it! > > You can write/buy/install any flavour of OS you like with a very simple rule > in it to delete "out of office" messages from the server OR just blackban > that particular email address for "X" number of days. > > Why is the obvious always the thing most people argue about? That wont work - how do you sort the bad ooo's from the legitimate ones. The problem is on the sending side not the receiving and a quick hack isnt going to fix anything but you may annoy a few people on the false positives you drop.. And any half decent IT manager isnt going to allow a hack into a system, they are going to require a proper solution. Steve

1 0

Cable and Wireless Security Contact?
by Hijacked L 02 Jan '04

02 Jan '04

Could a security contact from C&W PLEASE contact me off list? This is very important! One of your customers, Net Transactions LLC (doing business under the name "Choopa"), is advertising 146.20.40.0/21. According to ARIN whois and www.completewhois.com, this IP block is illegally hijacked, and used without authorization from its original owners. I've tried contacting your NOC on several occasions via telephone and e-mail and have been unable to get this advertisement filtered. In addition, I've called Erie Forge and Steel, the rightful owners of this block, who've articulated they've gotten numerous complaints about port scanning and spam from this IP block. Route-server output enclosed. route-server.phx1>sh ip bgp 146.20.40.0 BGP routing table entry for 146.20.40.0/21, version 2398010279 Paths: (14 available, best #3) Not advertised to any peer 6461 20473 20473, (received & used) 203.192.129.42 (inaccessible) from 203.192.128.96 (203.192.128.96) Origin IGP, metric 50, localpref 200, valid, internal Community: 3549:2402 3549:32392 Originator: 203.192.129.16, Cluster list: 0.0.1.155 6461 20473 20473, (received & used) 203.192.129.42 (inaccessible) from 203.192.134.97 (203.192.134.97) Origin IGP, metric 50, localpref 200, valid, internal Community: 3549:2402 3549:32392 Originator: 203.192.129.16, Cluster list: 0.0.1.155 6461 20473 20473 206.132.117.1 from 67.17.81.117 (67.17.81.117) Origin IGP, metric 50, localpref 200, valid, internal, best Community: 3549:2082 3549:30840 Originator: 67.17.80.182, Cluster list: 0.0.0.81 6461 20473 20473, (received-only) 208.50.13.106 from 67.17.81.117 (67.17.81.117) Origin IGP, metric 50, localpref 200, valid, internal Community: 3549:2082 3549:30840 Originator: 67.17.80.182, Cluster list: 0.0.0.81 OrgName: Erie Forge and Steel OrgID: EFS Address: 1341 West 16th Street Address: P.O. Box 180 City: Erie StateProv: PA PostalCode: 16512 Country: US NetRange: 146.20.0.0 - 146.20.255.255 CIDR: 146.20.0.0/16 NetName: IWAVE NetHandle: NET-146-20-0-0-1 Parent: NET-146-0-0-0-0 NetType: Direct Allocation Comment: The information for this network has been reported to Comment: be invalid. ARIN has attempted to obtain updated data, but has Comment: been unsuccessful. To provide current contact information, Comment: please e-mail hostmaster(a)arin.net. RegDate: 1991-01-18 Updated: 2003-06-30 -- ____________________________________________________ Get your own Hello Kitty email @ www.sanriotown.com Powered by Outblaze

4 4