April 2004 - Test - lists.nanog.org

Re: curious
by John Neiberger 12 Apr '04

12 Apr '04

>> "John Neiberger" <john.neiberger(a)efirstbank.com> 4/12/04 8:51:58 AM >>> > >>>> Scott Stursa <stursa(a)acns.fsu.edu> 4/12/04 8:26:15 AM >>> >> >>Two (possibly related?) phenomena: >> >>1. Nothing from NANOG since yesterday. >> >>2. .org TLD names not resolving > >That's interesting. I hadn't noticed that it was all .org TLD names >that weren't resolving. I was considering posting a question regarding a >problem I had just started to troubleshoot for a coworker where a .org >address wasn't resolving, but the .co.us address that it redirects to >would resolve correctly. Quick followup to my own post. I shouldn't have said that all .org names won't resolve because that doesn't appear to be the case, but it does appear that some are not resolving. Anyone know what's going on? John --

3 2

Re: curious
by John Neiberger 12 Apr '04

12 Apr '04

>>> Tim Wilde <twilde(a)dyndns.org> 4/12/04 9:00:11 AM >>> >On Mon, 12 Apr 2004, John Neiberger wrote: > >> Quick followup to my own post. I shouldn't have said that all .org >> names won't resolve because that doesn't appear to be the case, but it >> does appear that some are not resolving. >> >> Anyone know what's going on? > >Examples would help... a quick sampling of .orgs seems to show them all >resolving just fine from my perspective on things. Hmm...I'm beginning to wonder if I've jumped the gun a little bit. I saw someone else's post about .org names not resolving and I assumed that there was a greater issue at hand. However, so far the only .org I can't get to resolve is www.boulderprf.org; everything else I've tried so far this morning is actually working. I'll step back under my rock until I get a better idea of what's happening. I haven't had enough caffeine to be very good at troubleshooting on a Monday. :-) Regards, John --

1 0

Re: curious
by John Neiberger 12 Apr '04

12 Apr '04

>>> Scott Stursa <stursa(a)acns.fsu.edu> 4/12/04 8:26:15 AM >>> > >Two (possibly related?) phenomena: > >1. Nothing from NANOG since yesterday. > >2. .org TLD names not resolving That's interesting. I hadn't noticed that it was all .org TLD names that weren't resolving. I was considering posting a question regarding a problem I had just started to troubleshoot for a coworker where a .org address wasn't resolving, but the .co.us address that it redirects to would resolve correctly. John --

1 0

Re: TTY phone fraud and abuse
by Stewart, William C (Bill), RTSLS 12 Apr '04

12 Apr '04

Not a new problem. I got my first Nigerian Scam Deaf Relay Call last May, on my cell phone. I had to listen to them for a minute or two to make sure it wasn't one of my European customers having a network problem, but it was somebody who said they wanted to discuss a business opportunity - on Sunday night of Memorial Day Weekend, so they weren't thinking about the fact that they were calling America. Unfortunately, there didn't seem to be procedures for asking the operator to trace the call once it became clear that it really was a Nigerian scammer finding a new and creative way to abuse somebody's resources. [This email is my personal opinion, not AT&T's, but it was really annoying to have them abusing my company's service this way and interfering with legitimate users.] Bill Stewart

1 0

Re: Lazy network operators
by George William Herbert 10 Apr '04

10 Apr '04

Suresh writes: Chris Boyd writes: >> NTL World no longer accepts abuse@ email. You have to go to a web form >> that requires javascript be enabled and enter all of the information >> for them. I guess that they got tired of processing the the abuse@ >> mail load and just bit bucketed it. > >NTL peers at Linx, right? I'm sure somebody's mentioned >http://www.linx.net/noncore/bcp/ube-bcp.html to them? None of the surrounding docs or linx membership agreement make compliance with linx BCPs mandatory. However, it is socially odorous at least. They're not the first ISP to do that, and won't be the last, but I don't do business with (and often, blackhole) those that do. -george william herbert gherbert(a)retro.com

1 0

Worm Triggers Attacks on File-Trading Services
by Sean Donelan 10 Apr '04

10 Apr '04

Why do people have the irresitable urge to click on things? Click here to find out: http://www.washingtonpost.com/wp-dyn/articles/A349-2004Apr9.html The experts advised people not to click on strange attachments in e-mail, which can activate the worm, and to update their antivirus software frequently to ward off new threats.

2 1

Weird virus activity from AOL user(s)
by Stephen J. Wilcox 10 Apr '04

10 Apr '04

Hi, I'm getting lots of viruses (few hundred to my personal address today), the couple I checked appear to be the Sober-F virus based on the text.. the source IPs from the headers are all AOL. Strange thing is there is no virus, just the text and an attached file: $ more Norton\ AntiVirus\ gelï¿½scht1.txt Norton AntiVirus hat folgenden Anhang entfernt: corrected_text-file.pif. Der Anhang war mit dem Virus W32.Sober.F@mm infiziert. This is a bit annoying as our scanners fail to find a virus and allow these thro.. so.. I'm doubting this is anything AOL have done themselves, there appears to be too many and from too many different IPs for them to be from a single user (altho they are from similar IPs suggesting the same blocks). I note the attachment suggests Norton AV but surely any virus scanner isnt stupid enough to find a virus and then still send out the email? So whats going on then? :) Steve

1 0

Re: Anti-Spam Router -- opinions?
by Hank Nussbacher 10 Apr '04

10 Apr '04

>Has anyone had any experience with this device? Turntide.com. Looks like a >traffic-shaping device designed specifically for cutting down spammers >throughput to your inbound SMTP servers. My main concern is, how does it >make the distinction between legitimate mass-mailings (e.g.: mailing lists >such as this one), and spam? Interesting approach to killing spam though I >must say. SMTP is only about 40% of the spam these days. The rest is via HTTP and DAV (I have seen an upsurge of Hotmail DAV spam since March 18) as per http://www.unicom.com/chrome/a/000267.html) so you would need a solution that handles all formats. I would like to draw your attention to a company called Pineapp (www.pineapp.com) that has a product called Antiflood. It handles SMTP and HTTP. For HTTP it analyzes the headers and doesn't allow more than n number of recepients. It allows the admin to set the maximum posts per time frame, has URL blocking time, maximum outgoing recipients, safe URLs not to be time-blocked, etc. It is not really a router but rather an inline transparent proxy box. It is geared for Cybercafes where much spam still originates. -Hank Note: I do not work for Pineapp.

1 0

worm information
by Christopher J. Wolff 10 Apr '04

10 Apr '04

Hello, Over the last few days I've seen a number of hosts attempt to initiate TCP connections to the following ports in sequence. 80 139 445 6129 3127 1025 135 2745 ...repeat. At this moment I haven't seen a correlation between this activity and the port exploitation list on CERT. Any insight would be appreciated, thank you. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

5 7

IOS 12.3(x) Strange service ports open on router
by Robert Blayzor 09 Apr '04

09 Apr '04

I'm wondering if anyone that recently upgraded to IOS 12.3 on any access servers have run into this problem... We recently upgraded our AS5x00 access servers to the 12.3(x) main line. Upon doing so we started seeing some very strange RADIUS accounting records coming from IP addresses all over the Internet. Normally these boxes are ACL'd but upon scanning an IP address that the routers listen on nmap shows a slew of open TCP service ports which accept connections. Upon connecting to one of the ports we're prompted for username and password just as if we connected to the VTY management lines. If we try to log in, it queries the RADIUS server. The question is why suddenly are the routers answering on tons of ports, is there a way to turn these service ports off? Normally these routers only listen on port 22/23 and 514 at best. Upon nmapping the access servers now, we see something like the below. (TAC suggested an access-list; I know we can apply an access-list to block all this, but then that means we have to put ingress access-lists on every interface, including connected modem users, etc.) 2001/tcp open dc 2003/tcp open cfingerd 2005/tcp open deslogin 2007/tcp open dectalk 2008/tcp open conf 2009/tcp open news 2011/tcp open raid-cc 2012/tcp open ttyinfo 2013/tcp open raid-am 2014/tcp open troff 2015/tcp open cypress 2016/tcp open bootserver 2019/tcp open whosockami 2021/tcp open servexec 2022/tcp open down 2023/tcp open xinuexpansion3 2025/tcp open ellpack 2026/tcp open scrabble 2027/tcp open shadowserver 2028/tcp open submitserver 2030/tcp open device2 2034/tcp open scoremgr 2035/tcp open imsldoc 2041/tcp open interbase 2042/tcp open isis 2043/tcp open isis-bcast 2044/tcp open rimsl 2045/tcp open cdfunc 2046/tcp open sdfunc 2049/tcp open nfs 2064/tcp open dnet-keyproxy 2067/tcp open dlswpn 2105/tcp open eklogin 2106/tcp open ekshell 2108/tcp open rkinit 2112/tcp open kip 4008/tcp open netcheque 4045/tcp open lockd 4133/tcp open nuts_bootp 6001/tcp open X11:1 6003/tcp open X11:3 6005/tcp open X11:5 6007/tcp open X11:7 6008/tcp open X11:8 6009/tcp open X11:9 6101/tcp open VeritasBackupExec 6103/tcp open RETS-or-BackupExec 6105/tcp open isdninfo 6106/tcp open isdninfo 6110/tcp open softcm 6112/tcp open dtspc 6142/tcp open aspentec-lm 6143/tcp open watershed-lm 6145/tcp open statsci2-lm 6146/tcp open lonewolf-lm 6147/tcp open montage-lm 6148/tcp open ricardo-lm 9090/tcp open zeus-admin 9100/tcp open jetdirect 9152/tcp open ms-sql2000 -- Robert Blayzor, BOFH INOC, LLC rblayzor(a)inoc.net PGP: http://www.inoc.net/~dev/ Key fingerprint = 1E02 DABE F989 BC03 3DF5 0E93 8D02 9D0B CB1A A7B0 Years of development: We finally got one to work.

8 12