December 2004 - Test - lists.nanog.org

Lycos pulls anti-spam screensaver from site
by Fergie (Paul Ferguson) 03 Dec '04

03 Dec '04

"Lycos Europe appeared to have pulled a controversial anti-spam screensaver program from its site on Friday, after coming under fire from both security experts and the spammers themselves." http://www.infoworld.com/article/04/12/03/HNlycospullsscreensaver_1.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

RE: Load balancing outgoing connections automatically.
by kwallace＠pcconnection.com 03 Dec '04

03 Dec '04

Internap's (Sockeye/netVmg's) "FCP" Flow Contorl Platform might do the trick for you- Keith Wallace _____ From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] Sent: Friday, December 03, 2004 9:53 AM To: nanog(a)merit.edu Subject: Load balancing outgoing connections automatically. Howdy. We're looking at upgrading our border router(s) from 7500s to (something) yet undetermined. What we would like to do is perhaps find a platform that is smart enough to not route more outgoing traffic across a circuit than it can handle. We have 4 outgoing links to the net at the moment. They all have the same amount of bandwidth, BGP tends to want to send all of the traffic out to the same two, so usually those two will carry 80-90% of our traffic while the other two will carry like 20-30% combined. So if the first two connections burst up a little bit, sometimes it can cause congestion its fairly rare; but any congestion is unacceptable as you all know. I know the way BGP works, it will use it rules to determine the way traffic will go. I was wondering if anyone has heard of any good ways to handle this becoming more well known within the last year or so I researched this last year and found that prepending and doing things manually is pretty much the only way to load balance it. (i.e. manually setting routes based on the best paths through our upstreams for each connected network) I really just want to tell my router to load balance it; since that is kind of what I'm paying $100,000 for in the first place, no? I've also heard of gear from companies like route science that could possibly achieve the same thing. But I've heard that it runs like $300,000 for a box, is there anything a bit smaller for companies within the oc-3 range? That could accompany my router? Any advice is greatly appreciated. Thanks, -Drew

1 0

VeriSign Releases Domain Name Data
by Fergie (Paul Ferguson) 03 Dec '04

03 Dec '04

December 1, 2004 -- (WEB HOST INDUSTRY REVIEW) -- Internet security company and domain registry operator VeriSign Inc. (verisign.com) announced on Wednesday tiat it has released the Domain Name Industry Brief for the third quarter of 2004, noting the registration of 5.1 million new domain names during the quarter, the highest quarterly growth in Internet history. http://thewhir.com/marketwatch/ver120104.cfm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

Any additional info. on BT DDoS?
by Fergie (Paul Ferguson) 03 Dec '04

03 Dec '04

It would be interesting to know if anyone has any additional information (other than what was reported on CNet) on the reported DDoS on the BitTorrent servers on Wednesday.... http://news.com.com/BitTorrent+servers+under+attack/2100-7349_3-5473754.htm… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Chad Skidmore 03 Dec '04

03 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Justin Ryburn [mailto:justin@ryburn.org] > Sent: Thursday, December 02, 2004 4:18 PM > To: Chad Skidmore; nanog(a)merit.edu > Subject: Re: How many backbones here are filtering the > makelovenotspam scr eensaver site? > > This is what scares me. Who determines the "bad guys?" I > don't know anyone over at Lycos so I have no trust (or lack > there of) in Lycos. Who is to say that Lycos won't decide > next month that Yahoo, Google, MSN, _insert your own network > here_ are "bad guys" and point the screen saver at them. Are > they likely to do it? Probably not; it would be a PR > nightmare for them. But who is to stop them? What if they > don't go so extreme and just point the screen saver at "gray > hat" hosts who are open relays or something? I agree 100%. I believe that I get to decide what is or is not "ok" traffic on my network. I define that in my AUP and customers agree to and understand that when they buy service from me. > My opinion (not that anyone asked) is retaliation is childish > and unprofessional. I remember the Internet before Spam, Also agree 100%. If there is traffic hitting my network that I don't believe is "ok" then I can choose not to carry that traffic on my network. It doesn't give me the right to attack the originator of that traffic or the person that I "believe" to be the originator of that traffic. That's why I am a very firm believer in the power of "ip route x.x.x.x y.y.y.y null0" command. :) Makes the problem go away for me (for the most part) and doesn't cause anyone else any pain as a result except my customers, who agreed to let me use that power when they purchased service from me. > botnets, DDOS, etc. > and dream of a day when these are "under control" again just > as much as the next geek. However, stooping to the level of > the miscreant is not the answer to the problem in my opinion. > > Justin Ryburn > justin(a)ryburn.org > > "Dance like nobody's watching; love like you've never been > hurt. Sing like nobody's listening; live like it's heaven on > earth." > -- Mark Twain - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQa+yXU2RUJ5udBnvEQLX1gCglUjYXtQXyrSMFdfsQeZg9beq/xsAoI/C jOJ77EI+PIQs01sPNEnBphWK =ZScz -----END PGP SIGNATURE-----

6 6

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 03 Dec '04

03 Dec '04

> -----Original Message----- > From: Lionel [mailto:nop@alt.net] > Sent: Thursday, December 02, 2004 8:40 AM > To: Hannigan, Martin > Cc: nanog list > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > On Thu, 2 Dec 2004 08:27:38 -0500 , "Hannigan, Martin" > <hannigan(a)verisign.com> wrote: > > >> > Hosted on a cablemodem? Tch, tch, how the mighty have fallen > > > > > >The blocks are widespread. > > > >The reports of hackers are incorrect. The blackholes are > what is stopping > >them. > > What amazing efficiency. I can't help but wonder if these > same providers > are as quick at blackholing spamsite hosts, or blocking the zombies on > their user networks from spewing spam on port 25? If you tied all the spammers into a few controllers, you see it happen immediately. I've been following the news reports on this. Here's a quick summary of "what I know" without making any judgement or opinion: - The lycos screensaver campaign activated Tuesday - Major networks began activating blocks - When the controllers can't be reached, the clients die off - If screensaver is active when controllers die, it runs off the current target list. - If screensaver deactivates, then activates, it can't contact the servers and tells the user it's "off the internet" (I can't verify the veracity of the update process i.e. if it will die while active) - Blocks started going up early Wednesday morning - The press began reporting hackers due to an apparentdefacement being seen by many users. What they actually saw was the banner of an ISP that had blackholed the traffic and redirected port 80 to a notice. - Lycos moved their application to a hosting facility with bigger pipes - Target sites began using redirects sending the traffic back to Lycos - Press reports are coming out today regarding the blackholes - SpamCop is the source of the target list via a page that is public off of the SpamCop site (SpamCop is does not appear to have complicity) - The effectiveness of the blackholes is rising - There are a reported 100K clients downloaded. Less than you would expect due to the voluminous press coverage. Probably a result of the blackhole activity as well. I'm really not sure if Lycos knows about the blackholes at this point as the press has been reporting "hackers" all the while. If you think it's hacked, check the route. Here's some operational data captured via ethereal The target list generated by the botnet controller: GET /xml/69426058014054/94772079193788/35264029467456/12122010129438/CONFIG_2865 2023942308.xml HTTP/1.1 Referer: http://backend.makelovenotspam.com/xml/69426058014054/94772079193788/3526402 9467456/12122010129438/CONFIG_28652023942308.xml x-flash-version: 7,0,19,0 User-Agent: Shockwave Flash Host: backend.makelovenotspam.com Cache-Control: no-cache HTTP/1.1 200 OK Server: Resin/2.1.14 Content-Type: text/xml; charset=UTF-8 Content-Length: 2889 Connection: close Date: Thu, 02 Dec 2004 15:22:00 GMT <?xml version="1.0" encoding="UTF-8"?> <mlns><targets location="US"><target id="TVRBd01EQXdOVGt5" domain="myshopinternetcompany.com" url="http://myshopinternetcompany.com/?e=aa5100" bytes="357460680" hits="2572309" percentage="100" responsetime01="498" responsetime02="0" location="BR" /><target id="TVRBd01EQXdOVEk0" domain="grlswaiting4u.com" url="http://grlswaiting4u.com/" bytes="206765667" hits="1488797" percentage="100" responsetime01="11866" responsetime02="0" location="US" /><target id="TVRBd01EQXdOVGc0" domain="1stwebsitetheyourshop.com" url="http://1stwebsitetheyourshop.com/?e=aa5100" bytes="317867325" hits="2288427" percentage="100" responsetime01="507" responsetime02="0" location="BR" /><target id="TVRBd01EQXdOVGcx" domain="cheap-r-x.com" url="http://cheap-r-x.com/" bytes="355920802" hits="2565612" percentage="100" responsetime01="787" responsetime02="0" location="CN" /><target id="TVRBd01EQXdOVGcz" domain="www.hlplmanhds.biz" url="http://www.hlplmanhds.biz/" bytes="317590861" hits="2269503" percentage="100" responsetime01="785" responsetime02="0" location="CN" /><target id="TVRBd01EQXdOVEkz" domain="r.vtm.homewo.com" url="http://r.vtm.homewo.com/" bytes="367630639" hits="2248424" percentage="100" responsetime01="5542" responsetime02="0" location="CN" /><target id="TVRBd01EQXdOVE0w" domain="www.incentiverewardcenter.com" url="http://www.incentiverewardcenter.com/xg_reg.htm?SID=ab9ee352c3402bdc858 e5540b887d28a--landing_page=1--show=zip--=--p=92375--c=5411-toys250_720_emc- -catalog_id=14--a=--affil=5408--subid=1" bytes="1028999994" hits="6992693" percentage="-144200" responsetime01="1442" responsetime02="-1" location="US" /><target id="TVRBd01EQXdOVEk1" domain="www.macromed.ws" url="http://www.macromed.ws/" bytes="742958780" hits="5063804" percentage="100" responsetime01="1212" responsetime02="0" location="RU" /><target id="TVRBd01EQXdOVEEz" domain="www.curdom.com" url="http://www.curdom.com/" bytes="734756904" hits="4831221" percentage="46" responsetime01="2134" responsetime02="4541" location="CN" /><target id="TVRBd01EQXdOVGt4" domain="www.bacbwefds.info" url="http://www.bacbwefds.info/" bytes="422036604" hits="2463679" percentage="100" responsetime01="3375" responsetime02="0" location="CN" /></targets><conf><key name="source-xml" value="http://backend.makelovenotspam.com/xml" /><key name="interval-diagram" value="10000" /><key name="interval-hit" value="10000" /><key name="post-data-length" value="5" /><key name="refresh-xml" value="1200000" /><key name="current-version" value="1.0" /><key name="spray-filter-count" value="39" /><key name="url-report" value="http://backend.makelovenotspam.com/report" /></conf><stats><key name="average-percentage" value="100.0" /><key name="bytes" value="143003829363" /><key name="hits" value="859880020" /><key name="downloads" value="103803" /><key name="target-count" value="69" /></stats></mlns> Here's what they appear to receiving a lot as a result: <makeLOVEnotSPAM>IN`TS</makeLOVEnotSPAM> .<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>501 Method Not Implemented</title> </head><body> <h1>Method Not Implemented</h1> <p><makeLOVEnotSPAM>IN`TS</makeLOVEnotSPAM> to /index.html not supported.<br /> </p> </body></html>

3 2

The Cidr Report
by cidr-report＠potaroo.net 03 Dec '04

03 Dec '04

This report has been generated at Fri Dec 3 21:40:03 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 26-11-04 149492 103159 27-11-04 149527 103159 28-11-04 672118764 103159 29-11-04 -1077937252 103159 30-11-04 -1077936760 103159 01-12-04 672037797 103159 02-12-04 -1077937324 103159 03-12-04 134555056 103159 AS Summary 0 Number of ASes in routing system 0 Number of ASes announcing only one prefix 1405 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 0 Largest address span announced by an AS (/32s) pÀ( : Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 03Dec04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 149527 103159 46368 31.0% All ASes AS18566 754 6 748 99.2% CVAD Covad Communications AS4134 831 179 652 78.5% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 807 228 579 71.7% TWTC Time Warner Telecom AS7018 1405 994 411 29.3% ATTW AT&T WorldNet Services AS27364 444 33 411 92.6% ARMC Armstrong Cable Services AS22773 405 20 385 95.1% CXA Cox Communications Inc. AS6197 806 429 377 46.8% BNS-14 BellSouth Network Solutions, Inc AS701 1226 881 345 28.1% UU UUNET Technologies, Inc. AS22909 415 87 328 79.0% CMCS Comcast Cable Communications, Inc. AS1239 934 623 311 33.3% SPRN Sprint AS9929 340 34 306 90.0% CNCNET-CN China Netcom Corp. AS17676 382 78 304 79.6% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS7843 478 177 301 63.0% ADELPH-13 Adelphia Corp. AS4355 384 99 285 74.2% ERSD EARTHLINK, INC AS6478 435 156 279 64.1% ATTW AT&T WorldNet Services AS21502 273 3 270 98.9% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS4766 531 268 263 49.5% KIXS-AS-KR Korea Telecom AS14654 262 6 256 97.7% WAYPOR-3 Wayport AS9443 362 113 249 68.8% INTERNETPRIMUS-AS-AP Primus Telecommunications AS15557 371 126 245 66.0% LDCOMNET LDCOM NETWORKS AS6140 373 131 242 64.9% IMPSA ImpSat AS721 1039 803 236 22.7% DNIC DoD Network Information Center AS25844 244 17 227 93.0% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS2386 847 622 225 26.6% ADCS-1 AT&T Data Communications Services AS1221 790 567 223 28.2% ASN-TELSTRA Telstra Pty Ltd AS6198 434 221 213 49.1% BNS-14 BellSouth Network Solutions, Inc AS4814 210 6 204 97.1% CHINA169-BBN CNCGROUP IP network¡ªChina169 Beijing Broadband Network AS5668 417 213 204 48.9% CIH-12 CenturyTel Internet Holdings, Inc. AS9583 554 358 196 35.4% SIFY-AS-IN Sify Limited AS15270 232 38 194 83.6% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. Total 16985 7516 9469 55.7% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.0.0/18 AS174 COGENT Cogent/PSI 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.72.68.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.69.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.70.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.71.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.72.0/21 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.72.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.73.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.75.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.76.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.78.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.79.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of Sky Internet - BAYANTEL Inc. - Philppines 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.29.168.0/21 AS10248 IPI Internet Partners, Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.253.190.0/23 AS8123 POLYBA Polybase 207.47.254.0/24 AS701 UU UUNET Technologies, Inc. 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.17.71.0/24 AS32272 CLEAR-17 ClearSkye Communications Inc 209.17.79.0/24 AS32272 CLEAR-17 ClearSkye Communications Inc 209.17.80.0/24 AS32272 CLEAR-17 ClearSkye Communications Inc 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.168.64.0/19 AS174 COGENT Cogent/PSI 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 03 Dec '04

03 Dec '04

> -----Original Message----- > From: Florian Weimer [mailto:fw@deneb.enyo.de] > Sent: Thursday, December 02, 2004 2:01 PM > To: Brett > Cc: Hannigan, Martin; nanog list > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > > I think Lycos did not think this through enough. Their response is > > HUGE. They've essentially launched a Denial of Service on > themselves. > > The site that is being blackholed isn't on their network, AFAICS. > > Actually, I think this is an ingenious PR campaign, but it probably > doesn't work the way it was conceived, though I blieve that the net > outcome for Lycos will be utterly positive. Possibly. What will happen if the Lycos botnet gets hijacked? The conversations between the clients and the servers don't appear to be keyed. If a million clients got owned, it would be the equivalent of an electronic Bubonic Plague with no antidote. -M<

4 6

Fw: [pignet]
by Michael Painter 03 Dec '04

03 Dec '04

----- Original Message ----- From: <andrew(a)ipasifika.net> To: "Pacific Internet Users Group Mailing List" <pignet(a)lyris.spc.int> Sent: Thursday, December 02, 2004 2:47 PM Subject: [pignet] The Politics are starting > I found this in the Washington Post - Interesting? > By Shaun Waterman > UNITED PRESS INTERNATIONAL > Published December 2, 2004 > > Former CIA Director George J. Tenet yesterday called for new security > measures to guard against attacks on the United States that use the > Internet, which he called "a potential Achilles' heel." > "I know that these actions will be controversial in this age when we still > think the Internet is a free and open society with no control or > accountability," he told an information-technology security conference in > Washington, "but ultimately the Wild West must give way to governance and > control." > The former CIA director said telecommunications -- and specifically the > Internet -- are a back door through which terrorists and other enemies of > the United States could attack the country, even though great strides have > been made in securing the physical infrastructure. > The Internet "represents a potential Achilles' heel for our financial > stability and physical security if the networks we are creating are not > protected," Mr. Tenet said. > He said known adversaries, including "intelligence services, military > organizations and non-state actors," are researching information attacks > against the United States. > Within the federal government, the Department of Homeland Security has the > lead role in protecting the Internet from terrorism. But the department's > head of cyber-security recently quit amid reports that he had clashed with > his superiors. > Mr. Tenet, who retired in July as director of the CIA after seven years, > warned that al Qaeda remains a sophisticated group, even though its > first-tier leadership largely has been destroyed. > It is "undoubtedly mapping vulnerabilities and weaknesses in our > telecommunications networks," he said. > Mr. Tenet pointed out that the modernization of key industries in the > United States is making them more vulnerable by connecting them with an > Internet that is open to attack. > The way the Internet was built might be part of the problem, he said. Its > open architecture allows Web surfing, but that openness makes the system > vulnerable, Mr. Tenet said. > Access to networks like the World Wide Web might need to be limited to > those who can show they take security seriously, he said. > Mr. Tenet called for industry to lead the way by "establishing and > enforcing" security standards. Products need to be delivered to government > and private-sector customers "with a new level of security and risk > management already built in." > The national press, including United Press International (UPI), were > excluded from yesterday's event, at Mr. Tenet's request, organizers said. > > > > > Copyright © 2004 News World Communications, Inc. All rights reserved. > Reagrds = Andrew > > *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=* > To unsubscribe send a blank email to : > unsubscribe-pignet(a)lyris.spc.int > *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=* > To be on this list you must be an ISOC member: > Register at www.isoc.org it is free. > Select the Pacific Islands Chapter. >

1 0

Banned on NANOG
by nanog gonan 02 Dec '04

02 Dec '04

: Susan Harris' supervisor at MERIT. Chances are, I : will be censored for this and banned almost This whole censorship thing has me wondering as to the continued viability of this list as a place where the clue-heavy hang out and speak freely. Paul Vixie has been warned, randy Bush has been banned. Who else has been banned that'd be considered a clue-heavy NANOG poster? Why are folks being banned? Last I heard, procmail still works. Folks are becoming afraid to post due to worries about being banned. S/N: Isn't the goal to increase S and reduce N? If you reduce both S and N, you don't get a better signal. With randy gone, the S has definitely decreased. Who else is gone that reduces S? __________________________________ Do you Yahoo!? Yahoo! Mail - You care about security. So do we. http://promotions.yahoo.com/new_mail

5 4