May 2004 - Test - lists.nanog.org

Why don't X care more about Y?
by Sean Donelan 07 May '04

07 May '04

Dave Farber's interesting people list has a post by a former bank credit card officer explaining why banks don't get as excited about fraud as customers do. http://www.interesting-people.org/archives/interesting-people/200405/msg000… Many of the statements apply to anyone who deals with malicious behavior on a regular basis. The police officer may not appear to care as much about your car being stolen as you do, the ISP abuse department may not appear to care as much about the port scan as you do, the bank may not appear to care as much about the merchant who doesn't check the card signature as you do, etc. But he is correct; banks, as well as police, ISPs or any other fraud investigation group, do care about fraud and abuse; just not as much about the scam du jour.

1 0

RE: FW: Worms versus Bots
by Smith, Donald 07 May '04

07 May '04

If you follow these steps outlined by SANS you should be able to successfully update and NOT get infected. This is short, easy, fully documented (with pictures :) http://www.sans.org/rr/papers/index.php?id=1298 Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Henry Linneweh > Sent: Tuesday, May 04, 2004 2:19 AM > To: Eric Krichbaum; nanog(a)merit.edu > Subject: Re: FW: Worms versus Bots > > > > It is amazingly simply to pull an ethernet cable out > of the back of your box to update a box from a CD.... > especially in a suspect environment where you have had many problems. > > I have had the displeasure of having had to go from > box to box and clean each individually and while many > problems were stopped by Netscreen at the door, we > still had to run enterprise protection per machine as > a second line of defense and separate domains in the > company for greater protection between the groups. > > -Henry > > > --- Eric Krichbaum <eric.krichbaum(a)citynet.net> wrote: > > > > I see times more typically in the 5 - 10 second > > range to infection. As > > a test, I unprotected a machine this morning on a > > single T1 to get a > > sample. 8 seconds. If you can get in 20 minutes of > downloads you're > > luckier than most. > > > > Eric > > > > > > -----Original Message----- > > From: owner-nanog(a)merit.edu > > [mailto:owner-nanog@merit.edu] On Behalf Of william(at)elan.net > > Sent: Monday, May 03, 2004 11:49 PM > > To: Sean Donelan > > Cc: Rob Thomas; NANOG > > Subject: Re: Worms versus Bots > > > > > > On Mon, 3 May 2004, Sean Donelan wrote: > > > > > On Mon, 3 May 2004, Rob Thomas wrote: > > > > ] Just because a machine has a bot/worm/virus > > that didn't come with > > > > a ] rootkit, doesn't mean that someone else > > hasn't had their way > > with it. > > > > > > > > Agreed. > > > > > > Won't help. What's the first thing people do > > after re-installing the > > > operating system (still have all the original CDs > > and keys and product > > > > > activation codes and and and)? Connect to the > > Internet to download the > > > > > patches. Time to download patches 60+ minutes. > > > Time to infection 5 minutes. > > > > Its possible its a problem on dialup, but in our ISP > > office I setup new > > win2000 servers and first thing I do is download all > > the patches. I've > > yet to see the server get infected in the 20-30 > > minutes it takes to > > finish it > > (Note: I also disable IIS just in case until > > everything is patched..). > > > > Similarly when settting up computers for several of > > my relatives (all > > have dsl) I've yet to see any infection before all > > updates are > > installed. > > > > Additional to that many users have dsl router or > > similar device and many > > such beasts will provide NATed ip block and act like > > a firewall not > > allowing outside servers to actually connect to your > > home computer. > > On this point it would be really interested to see > > what percentage of > > users actually have these routers and if decreasing > > speed of infections > > by new virus (is there real numbers to show it > > decreased?) have anything > > to do with this rather then people being more > > carefull and using > > antivirus. > > > > Another option if you're really afraid of infection > > is to setup proxy > > that only allows access to microsoft ip block that > > contains windows > > update servers > > > > And of course, there is an even BETTER OPTION then > > all the above - STOP > > USING WINDOWS and switch to Linux or Free(Mac)BSD ! > > :) > > > > > Patches are Microsoft's > > > intellectual property and can not be distributed > > by anyone without > > > Microsoft's permission. > > I don't think this is quite true. Microsoft makes > > available all patches > > as indidual .exe files. There are quite many of > > these updates and its > > really a pain to actually get all of them and > > install updates manually. > > But I've never seen written anywhere that I can not > > download these .exe > > files and distribute it inside your company or to > > your friends as needed > > to fix the problems these patches are designed for. > > > > > The problem with Bots is they aren't always > > active. That makes them > > > difficult to find until they do something. > > As opposed to what, viruses? > > Not at all! Many viruses have period wjhen they are > > active and > > afterwards they go into "sleep" mode and will not > > active until some > > other date! > > > > Additionally bot that does not immediatly become > > active is good thing > > because of you do weekly or monthly audits (any many > > do it like that) > > you may well find it this way and deal with it at > > your own time, rather > > then all over a sudden being awaken 3am and having > > to clean up infected > > system. > > > > -- > > William Leibzon > > Elan Networks > > william(a)elan.net > > > >

10 10

orkut dns?
by Randy Bush 07 May '04

07 May '04

am i wrong or is there a problem (which is a dozen hours old)? roam.psg.com:/usr/home/randy> dig +norec @a.gtld-servers.net. orkut.com. ns ; <<>> DiG 9.3.0s20021217 <<>> +norec @a.gtld-servers.net. orkut.com. ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61385 ;; flags: qr; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2 ;; QUESTION SECTION: ;orkut.com. IN NS ;; ANSWER SECTION: orkut.com. 172800 IN NS ns11.worldnic.com. orkut.com. 172800 IN NS ns12.worldnic.com. ;; ADDITIONAL SECTION: ns11.worldnic.com. 172800 IN A 216.168.225.141 ns12.worldnic.com. 172800 IN A 216.168.225.142 ;; Query time: 101 msec ;; SERVER: 192.5.6.30#53(a.gtld-servers.net.) ;; WHEN: Thu May 6 17:42:09 2004 ;; MSG SIZE rcvd: 106 roam.psg.com:/usr/home/randy> dig +norec @ns11.worldnic.com. orkut.com. ns ; <<>> DiG 9.3.0s20021217 <<>> +norec @ns11.worldnic.com. orkut.com. ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36354 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0 ;; QUESTION SECTION: ;orkut.com. IN NS ;; AUTHORITY SECTION: . 3600000 IN NS M.ROOT-SERVERS.NET. . 3600000 IN NS A.ROOT-SERVERS.NET. . 3600000 IN NS B.ROOT-SERVERS.NET. . 3600000 IN NS C.ROOT-SERVERS.NET. . 3600000 IN NS D.ROOT-SERVERS.NET. . 3600000 IN NS E.ROOT-SERVERS.NET. . 3600000 IN NS F.ROOT-SERVERS.NET. . 3600000 IN NS G.ROOT-SERVERS.NET. . 3600000 IN NS H.ROOT-SERVERS.NET. . 3600000 IN NS I.ROOT-SERVERS.NET. . 3600000 IN NS J.ROOT-SERVERS.NET. . 3600000 IN NS K.ROOT-SERVERS.NET. . 3600000 IN NS L.ROOT-SERVERS.NET. ;; Query time: 91 msec ;; SERVER: 216.168.225.141#53(ns11.worldnic.com.) ;; WHEN: Thu May 6 17:42:26 2004 ;; MSG SIZE rcvd: 238 roam.psg.com:/usr/home/randy> dig +norec @ns12.worldnic.com. orkut.com. ns ; <<>> DiG 9.3.0s20021217 <<>> +norec @ns12.worldnic.com. orkut.com. ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38052 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0 ;; QUESTION SECTION: ;orkut.com. IN NS ;; AUTHORITY SECTION: . 3600000 IN NS F.ROOT-SERVERS.NET. . 3600000 IN NS G.ROOT-SERVERS.NET. . 3600000 IN NS H.ROOT-SERVERS.NET. . 3600000 IN NS I.ROOT-SERVERS.NET. . 3600000 IN NS J.ROOT-SERVERS.NET. . 3600000 IN NS K.ROOT-SERVERS.NET. . 3600000 IN NS L.ROOT-SERVERS.NET. . 3600000 IN NS M.ROOT-SERVERS.NET. . 3600000 IN NS A.ROOT-SERVERS.NET. . 3600000 IN NS B.ROOT-SERVERS.NET. . 3600000 IN NS C.ROOT-SERVERS.NET. . 3600000 IN NS D.ROOT-SERVERS.NET. . 3600000 IN NS E.ROOT-SERVERS.NET. ;; Query time: 91 msec ;; SERVER: 216.168.225.142#53(ns12.worldnic.com.) ;; WHEN: Thu May 6 17:43:03 2004 ;; MSG SIZE rcvd: 238 and Domain Name: ORKUT.COM Registrar: EMARKMONITOR INC. DBA MARKMONITOR Whois Server: whois.markmonitor.com Referral URL: http://www.markmonitor.com Name Server: NS11.WORLDNIC.COM Name Server: NS12.WORLDNIC.COM Status: ACTIVE Updated Date: 05-may-2004 <<<=== Creation Date: 08-dec-2002 Expiration Date: 08-dec-2007 hmmm randy

4 5

Fiber Still in Baltimore Tunnels?
by David Kennedy CISSP 07 May '04

07 May '04

Ordnance Find Closes Baltimore Tunnel ............ BALTIMORE (AP) -- The Baltimore Harbor Tunnel has been closed indefinitely after a worker at a nearby construction site discovered military ordnance. Nine munitions, ranging in size from 500 to 4,000 pounds, had been found since early Wednesday. The construction site, less than a half-mile from the tunnel, was once used by the Navy to assemble and disassemble ships. Disposal teams were working to determine the status of the munitions, said Col. Tim Madere, of the Aberdeen Proving Ground. Military investigators are trying to determine exactly where the ordnance came from, said Cpl. Greg Prioleau, a spokesman for the Maryland Transportation Authority. The closing was ordered by Gov. Robert Ehrlich on the recommendations of ordnance disposal teams from the U.S. Army, Baltimore City, the FBI and the Maryland State Fire Marshal. Adjacent portions of I-895 also were closed. -- Regards, /"\ David Kennedy CISSP \ / ASCII Ribbon Campaign Protect what you connect; X Against HTML Mail Look both ways before crossing the Net. / \

1 0

RE: FW: Worms versus Bots
by Michel Py 07 May '04

07 May '04

>> The problem is that Joe User (or his kid) wants to run >> some random P2P program without having to reconfigure >> NAT port mappings, so they have all inbound connections >> mapped to a static internal IP. > If Joe (L)User or his kid sets up his NAT that way... > well, quite honestly he gets what he deserves. Protecting > against active, deliberate stupidty is probably more than > my job description coveres. I would be a little more tolerant, as they don't even know they're being stupid. That being said, the only thing that will teach them is to get nailed. It's like backups: only after one has lost a bunch of data and spent long nights rebuilding it does one pay religious attention to make sure that the backup is running every night. No matter what we say about it before they actually lose the data and are unable to restore because the last time someone put a tape in the drive was a month ago. So, Joe (l)user or his kid will continue to configure DMZ hosts in their Linksys, they will get hit and pay $500 to have their PC reloaded or buy a new one, and they won't do it again. I'm not saying I like it, but it's just the way it is. Michel.

1 0

MD5 proliferation statistics
by Steve Gibbard 07 May '04

07 May '04

Packet Clearing House has routers at a several exchange points, which we use to collect local snapshots of the routes available at the exchanges. To do this, we peer with as many of the participants at each exchange as possible. We're mainly just collecting data, so route flaps aren't a huge problem for us. We haven't been tracking down existing peers and asking them to configure MD5 passwords on the sessions. We have been configuring MD5 passwords on sessions when asked, so we've got MD5 configured with peers who have asked for it, but not with peers who haven't. As of Tuesday night, we had 244 peering sessions, of which 24 had MD5 configured. We configured MD5 on four more sessions yesterday, bringing the total to 28, and have one request that hasn't been completed yet, for a total of 29. 29 out of 244 is roughly 12%. I'm going to make two broad assumptions here: that those peers who have configured MD5 with us have configured MD5 with all their peers, and that those who haven't configured MD5 with us have been asked to by 12% of their peers. I'm further going to assume that peers consistently configure MD5 when asked to, although I suspect that's a really bad assumption. Therefore, we can assume that 12% of ISPs have all their peers configured with MD5, and that the remaining 88% have 12% of their peers configured with MD5, for a total of 22% of peering sessions having MD5 passwords. I strongly suspect my assumption about the responsiveness of peers is wrong, and that the real number is somewhere between 12% and 22%. It's also possible that my sample isn't representative enough, which would lead to further problems with accuracy. I'm curious as to what sorts of response rates those who have been actively contacting peers to ask for MD5 configuration have been getting, as well as whether other networks that have not been being proactive about this have been seeing contact rates similar to ours. -Steve Gibbard Packet Clearing House

5 4

The Cidr Report
by cidr-report＠potaroo.net 07 May '04

07 May '04

This report has been generated at Fri May 7 21:43:29 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 30-04-04 134095 94127 01-05-04 134113 94087 02-05-04 134248 94105 03-05-04 134191 94094 04-05-04 134105 94226 05-05-04 134298 94295 06-05-04 134223 94305 07-05-04 134302 94283 AS Summary 17091 Number of ASes in routing system 6904 Number of ASes announcing only one prefix 1439 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 73602816 Largest address span announced by an AS (/32s) AS568 : DISOUN DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 07May04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 134447 94377 40070 29.8% All ASes AS4134 750 152 598 79.7% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 715 200 515 72.0% TWTC Time Warner Telecom AS7018 1439 997 442 30.7% ATTW AT&T WorldNet Services AS7843 502 114 388 77.3% ADELPH-13 Adelphia Corp. AS6197 693 309 384 55.4% BNS-14 BellSouth Network Solutions, Inc AS701 1297 932 365 28.1% UU UUNET Technologies, Inc. AS9583 463 101 362 78.2% SATYAMNET-AS Satyam Infoway Ltd., AS22909 390 34 356 91.3% CMCS Comcast Cable Communications, Inc. AS6198 565 231 334 59.1% BNS-14 BellSouth Network Solutions, Inc AS27364 363 40 323 89.0% ARMC Armstrong Cable Services AS22773 370 49 321 86.8% CXAB Cox Communications Inc. Atlanta AS9929 335 31 304 90.7% CNCNET-CN China Netcom Corp. AS17676 339 37 302 89.1% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS1239 939 638 301 32.1% SPRN Sprint AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS6140 382 103 279 73.0% IMPSA ImpSat AS6478 304 49 255 83.9% ATTW AT&T WorldNet Services AS209 740 503 237 32.0% QWEST-4 Qwest AS1221 855 621 234 27.4% ASN-TELSTRA Telstra Pty Ltd AS25844 243 16 227 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS14654 228 4 224 98.2% WAYPOR-3 Wayport AS4766 469 259 210 44.8% KIX Korea Internet Exchange for "96 World Internet Exposition AS3356 897 689 208 23.2% LEVEL3 Level 3 Communications AS11305 240 41 199 82.9% INTERL-80 Interland Incorporated AS2386 424 240 184 43.4% ADCS-1 AT&T Data Communications Services AS5668 380 199 181 47.6% CIH-12 CenturyTel Internet Holdings, Inc. AS6327 208 28 180 86.5% SHAWC-2 Shaw Communications Inc. AS19262 267 89 178 66.7% VGN-2 Verizon Global Networks AS6347 401 227 174 43.4% SAVV SAVVIS Communications Corporation AS14824 275 108 167 60.7% NCC-105 NewSouth Communications Corp. Total 15854 7140 8714 55.0% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.160.0.0/11 AS20115 CC04 Charter Communications 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 60.254.0.0/20 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.6.224.0/19 AS32392 HOSTI-3 Hosting-Network GmbH 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS568 DISOUN DISO-UNRRA 137.0.0.0/13 AS568 DISOUN DISO-UNRRA 138.136.0.0/13 AS568 DISOUN DISO-UNRRA 158.0.0.0/13 AS568 DISOUN DISO-UNRRA 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 DISOUN DISO-UNRRA 192.172.0.0/19 AS568 DISOUN DISO-UNRRA 192.188.208.0/20 AS568 DISOUN DISO-UNRRA 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS568 DISOUN DISO-UNRRA 198.97.80.0/20 AS568 DISOUN DISO-UNRRA 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.192.0/20 AS568 DISOUN DISO-UNRRA 198.97.240.0/20 AS568 DISOUN DISO-UNRRA 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS568 DISOUN DISO-UNRRA 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS568 DISOUN DISO-UNRRA 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.84.0.0/16 AS701 UU UUNET Technologies, Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS568 DISOUN DISO-UNRRA 199.114.128.0/18 AS568 DISOUN DISO-UNRRA 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 DISOUN DISO-UNRRA 199.123.0.0/18 AS568 DISOUN DISO-UNRRA 199.123.16.0/20 AS568 DISOUN DISO-UNRRA 199.123.80.0/21 AS568 DISOUN DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.2.64.0/20 AS9729 IS-AP iAdvantage Limited 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.142.0/24 AS30362 HAWAI-1 Hawaii-Pacific Teleport 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.123.96.0/20 AS9288 COMCEN-AS-AP Com-Cen Pty Ltd 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.155.243.0/24 AS4795 INDOSAT2-ID INDOSATNET-ASN 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 204.69.144.0/22 AS5668 CIH-12 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.41.32.0/19 AS14824 NCC-105 NewSouth Communications Corp. 206.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.169.219.0/24 AS189 GNTY Genuity 209.169.223.0/24 AS189 GNTY Genuity 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.191.81.0/24 AS6347 SAVV SAVVIS Communications Corporation 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL-33 Telesat International Ltd. 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 210.213.0.0/19 AS6453 GLOBEINTERNET Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.133.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.135.0/24 AS11937 TRXI TRX Inc. 216.145.152.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

RE: BGP Exploit
by Smith, Donald 07 May '04

07 May '04

No. The router stays up. The tool I use is very fast. It floods the GIGE to the point that that interface is basically unusable but the router itself stays up only the session is torn down. I did preformed these tests in a lab and did not have full bgp routing tables etc ... so your mileage may vary. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] > Sent: Wednesday, May 05, 2004 10:16 AM > To: Smith, Donald > Cc: Steven M. Bellovin; Kurt Erik Lindqvist; > kwallace(a)pcconnection.com; nanog(a)merit.edu > Subject: RE: BGP Exploit > > > Of more interest.. does the router die (cpu load) before you > brute force the > sessions down > > Steve > > On Tue, 4 May 2004, Smith, Donald wrote: > > > > > I have seen 3 pubic ally available tools that ALL work. > > I have seen 2 privately tools that work. > > A traffic generator can be configured to successfully tear down bgp > > sessions. > > > > Given src/dst ip and ports : > > I tested with a cross platform EBGP peering with md5 using > several of > > the tools I could not tear down the sessions. I tested both > Cisco and > > juniper BGP peering after code upgrades without md5 I > could not tear > > down the sessions. > > > > > > Donald.Smith(a)qwest.com GCIA > > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC > > pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 > AF00 EDCC kill > > -13 111.2 > > > > > -----Original Message----- > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > > Behalf Of Steven M. Bellovin > > > Sent: Tuesday, May 04, 2004 11:54 AM > > > To: Kurt Erik Lindqvist > > > Cc: kwallace(a)pcconnection.com; nanog(a)merit.edu > > > Subject: Re: BGP Exploit > > > > > > > > > > > > > > > In message > > > <C4E8C22A-9DA6-11D8-B28B-000A95928574(a)kurtis.pp.se>, Kurt > > > Erik Lindq vist writes: > > > > > > >> > > > >> Now that the firestorm over implementing Md5 has quieted > > > down a bit, > > > >> is anybody aware of whether the exploit has been used? > > > Feel free to > > > >> reply off list. > > > > > > > >Even more interesting, did anyone manage to reproduce it? > > > > > > > > > > I don't know if it's being used; I know that reimplementations of > > > the > > > idea are out there. > > > > > > > > > --Steve Bellovin, http://www.research.att.com/~smb > > > > > > > > > > > > >

4 5

RE: What percentage of the Internet Traffic is junk?
by Mike Damm 06 May '04

06 May '04

Very very very near to, but not quite 100%. Since almost all of the traffic on the Internet isn't sourced by or destined for me, I consider it junk. Also remember that to a packet kid, that insane flood of packets destined for his target is the most important traffic in the world. And to a spammer, the very mailings that are making him millions are more important than pictures of someone's grandkids. I guess my point is junk is a very relative term. A study would need to first be done to identify what junk actually is, then measuring it is trivial. -Mike -----Original Message----- From: William B. Norton [mailto:wbn@equinix.com] Sent: Wednesday, May 05, 2004 11:21 AM To: nanog(a)merit.edu Subject: What percentage of the Internet Traffic is junk? With all the spam, infected e-mails, DOS attacks, ultimately blackholed traffic, etc. I wonder if there has been a study that quantifies What percentage of the Internet traffic is junk? Bill

13 16

what the .. constant connects from adelphia.net..
by Nicole 06 May '04

06 May '04

As shown below I keep getting these connects from various adelphia.net mta servers. No data is ever sent. Anyone know what they are up to? Nicole May 6 14:17:45 krell postfix/smtpd[90694]: connect from mta7.adelphia.net[68.168.78.193] May 6 14:17:45 krell postfix/smtpd[90694]: disconnect from mta7.adelphia.net[68.168.78.193] May 6 14:17:56 krell postfix/smtpd[90694]: connect from mta11.adelphia.net[68.168.78.205] May 6 14:17:56 krell postfix/smtpd[90694]: disconnect from mta11.adelphia.net[68.168.78.205] May 6 14:17:58 krell postfix/smtpd[90694]: connect from mta9.adelphia.net[68.168.78.199] May 6 14:17:58 krell postfix/smtpd[90694]: disconnect from mta9.adelphia.net[68.168.78.199] May 6 14:17:59 krell postfix/smtpd[90694]: connect from mta2.adelphia.net[68.168.78.178] May 6 14:18:00 krell postfix/smtpd[90694]: disconnect from mta2.adelphia.net[68.168.78.178] May 6 14:33:14 krell postfix/smtpd[91003]: connect from mta4.adelphia.net[68.168.78.184] May 6 14:33:14 krell postfix/smtpd[91003]: disconnect from mta4.adelphia.net[68.168.78.184] May 6 14:33:17 krell postfix/smtpd[91003]: connect from mta2.adelphia.net[68.168.78.178] May 6 14:33:17 krell postfix/smtpd[91003]: disconnect from mta2.adelphia.net[68.168.78.178] May 6 14:33:21 krell postfix/smtpd[91003]: connect from mta11.adelphia.net[68.168.78.205] May 6 14:33:22 krell postfix/smtpd[91003]: disconnect from mta11.adelphia.net[68.168.78.205] May 6 14:33:23 krell postfix/smtpd[91003]: connect from mta8.adelphia.net[68.168.78.196] May 6 14:33:23 krell postfix/smtpd[91003]: disconnect from mta8.adelphia.net[68.168.78.196] May 6 14:33:25 krell postfix/smtpd[91003]: connect from mta13.mail.adelphia.net[68.168.78.44] May 6 14:33:25 krell postfix/smtpd[91003]: disconnect from mta13.mail.adelphia.net[68.168.78.44] May 6 14:33:25 krell postfix/smtpd[91003]: connect from mta9.adelphia.net[68.168.78.199] May 6 14:33:26 krell postfix/smtpd[91003]: disconnect from mta9.adelphia.net[68.168.78.199] May 6 14:48:48 krell postfix/smtpd[91161]: connect from mta8.adelphia.net[68.168.78.196] May 6 14:48:49 krell postfix/smtpd[91161]: disconnect from mta8.adelphia.net[68.168.78.196] May 6 14:48:56 krell postfix/smtpd[91161]: connect from mta9.adelphia.net[68.168.78.199] May 6 14:48:57 krell postfix/smtpd[91161]: disconnect from mta9.adelphia.net[68.168.78.199] May 6 14:48:59 krell postfix/smtpd[91161]: connect from mta6.adelphia.net[68.168.78.190] May 6 14:49:00 krell postfix/smtpd[91161]: disconnect from mta6.adelphia.net[68.168.78.190] May 6 14:49:02 krell postfix/smtpd[91161]: connect from mta1.adelphia.net[68.168.78.175] May 6 14:49:02 krell postfix/smtpd[91161]: disconnect from mta1.adelphia.net[68.168.78.175] -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" -Politicaly Correct UNIX Page http://www.nonsenseband.com *** Spam Sucks and I get tons of it. So I have some tight spam filters. If any email to me bounces, please use your secret decoder ring and please send to blabgoo at yahoo dot com :)

3 2