August 2005 - Test - lists.nanog.org

New N.Y. Law Targets Hidden Net LD Tolls
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Must be fun days in NY State with Eliot Spitzer as AG. Lots of "(mumble) war on cyber (mumble) crime (mumble) national security (mumble)".... :-) Actually, I kind of like the guy for taking some disreputable companies to task An AP newswire article by Michael Gormley, via Yahoo! News, reveals that: [snip] A new law that's apparently the first in the nation threatens to penalize Internet service providers that fail to warn users that some dial-up numbers can ring up enormous long-distance phone bills even though they appear local. A long distance call even within the same area code can cost 8 to 12 cents a minute, adding up to hundreds, even thousands of dollars a month. Companies face fines of up to $500 for each offense, and consumers could pursue civil action claiming an unfair business practice. The National Conference of State Legislatures said it knows of no similar law elsewhere. [snip] http://news.yahoo.com/news?tmpl=story&u=/ap/20050818/ap_on_hi_te/techbits_i… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Re: What application runs on port 8094?
by Joe Shen 18 Aug '05

18 Aug '05

The situation here is, traffic on the two ports exists continuously. The total load on our egree link sums up to around 3Gbps (max) and 1.6Gbps(min). If both of the traffic is from P2P application, what is it? rebust file transmission over UDP? thanks --- Vulnerability Management <vulnerability(a)messagelabs.com> wrote: > Hi Joe, > > Joe Shen wrote: > > Hi, > > > > Using netflow based monitor tool, I noticed there > is a > > lot of traffic on 8094/UDP and 4662/TCP( both > exceed > > 1Gbps, and exist all the time) > > > > > > What application use that port? Is there any P2P > > application use UDP as transportation protocol? > > > > > Yes - eDonkey - it's listed on Dshield's "most > scanned ports": > > http://dshield.org/port_report.php?port=4662 > > Nothing listed for 8094 > > http://dshield.org/port_report.php?port=8094 > > but they do show a big spike in scans of this port a > couple of days ago. > Perhaps one of the recent MS worms calls home on > this port? UDP, > though... odd! > > \a > > Andrew Simmons > Messagelabs Security > > > > > > thanks in advance. > > > > Joe > > > > -- > "Only the paranoid survive." - Andy Grove (Intel) > > ______________________________________________________________________ > This email has been scanned by the MessageLabs Email > Security System. > For more information please visit > http://www.messagelabs.com/email > ______________________________________________________________________ > __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

1 0

Re: Blocking certain terrorism/porn sites and DNS
by Jonathan M. Slivko 18 Aug '05

18 Aug '05

> Yeps, a sys admin could do that. Sure. But we dont want others also to > see that website. Is it possible by deleting that entery from the > whois database is my question. No - not without some high level intervention at the registry and seeing as they are in the US under US law, it's not very likely to happen (freedom of speech/press, etc.). You could also set the firewall policy company wide at the network distribution point (where the Internet comes into the facility from the outside). But, that's censorship which I don't support except in rare cases. -- Jonathan

1 0

Re: zotob - blocking tcp/445
by Fergie (Paul Ferguson) 17 Aug '05

17 Aug '05

Oh,no -- not the "Where will it end?" defense. I should just go ahead and invoke Godwin's Law now and put us all out of thread misery... - ferg -- routerg <routerg(a)gmail.com> wrote: Where will the filtering end? Is your NSP/ISP responsible for filtering virii, spam, phishing? I'm not saying it wouldn't be nice, but considering the types of attacks we see coupled with the fact that many enterprise customers are service providers themselves, providing service to yet other service providers, it is very difficult to take their decission making power away. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Microsoft Ships Zotob Worm Removal Tool
by Fergie (Paul Ferguson) 17 Aug '05

17 Aug '05

Ryan Naraine writes in eWeek: [snip] Microsoft Corp. late Wednesday shipped an update to its malware removal tool to detect and delete the fast-spreading "Zotob" worm family. Microsoft typically updates the free utility once a monthon Patch Tuesdaybut with at least a dozen "Zotob" variants squirming through unpatched Windows 2000 systems, the company added detections for 10 mutants to help with the cleanup process. The new version of the Malicious Software Removal Tool will now zap the following worms: Zotob.A, Zotob.B, Zotob.C, Zotob.D, Zotob.E, Bobax.O, Esbot.A, Rbot.MA, Rbot.MB and Rbot.MC. [snip] Article: http://www.eweek.com/article2/0,1759,1849456,00.asp Updated Malicious Software Removal Tool: http://www.microsoft.com/security/malwareremove/default.mspx - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

OT? Device to limit simultaneous connections per host?
by David Hubbard 17 Aug '05

17 Aug '05

Hello everyone, I'm curious if anyone knows of a device that can throttle or limit a remote host's simultaneous connections or requests per second for web traffic on a per-IP basis. So I don't want to say web server X can only have 100 simultaneous connections and 10 requests per second. I want to say that for any given IP connecting to web server X, any one IP can have no more than 5 open connections and should be throttled if it starts making more than ten requests per second. If it could even be url-aware in that it could only apply the rules to specific types of web requests, that would be even better. The motivation here is to find a piece of equipment that can protect compute-intensive, database-driven websites from overly aggressive proxies, firewalls, search engines, etc. which like to hammer a given site with 50+ simultaneous requests against pages that could potentially need a few seconds of processing time per request. I've looked at a Packeteer PacketShaper running in reverse of what it normally would, trying to throttle and shape requests against the server rather than optimizing traffic for a low speed link like it was designed, but that didn't really work out as it could not have the policies applied on a per remote IP basis. Thanks, David

3 2

Re: What application runs on port 8094?
by Fergie (Paul Ferguson) 17 Aug '05

17 Aug '05

Hi Joe, A quick Google search renders: Cisco SSG TCP Redirect http://www.cisco.com/en/US/products/hw/routers/ps133/products_configuration… ...but it apparently runs on tcp/8094, so no idea here. 4662 sounds like eDonkey2000, a P2P application, but... http://www.iana.org/assignments/port-numbers says: oms 4662/tcp OrbitNet Message Service oms 4662/udp OrbitNet Message Service # Roy Davies <rdavies(a)daq.net> August 2005 - ferg -- Joe Shen <joe_hznm(a)yahoo.com.sg> wrote: Hi, Using netflow based monitor tool, I noticed there is a lot of traffic on 8094/UDP and 4662/TCP( both exceed 1Gbps, and exist all the time) What application use that port? Is there any P2P application use UDP as transportation protocol? thanks in advance. Joe -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: OT? Device to limit simultaneous connections per host?
by Fergie (Paul Ferguson) 17 Aug '05

17 Aug '05

WFQ/wRED? :-) - ferg -- "David Hubbard" <dhubbard(a)dino.hostasaurus.com> wrote: Hello everyone, I'm curious if anyone knows of a device that can throttle or limit a remote host's simultaneous connections or requests per second for web traffic on a per-IP basis. So I don't want to say web server X can only have 100 simultaneous connections and 10 requests per second. I want to say that for any given IP connecting to web server X, any one IP can have no more than 5 open connections and should be throttled if it starts making more than ten requests per second. If it could even be url-aware in that it could only apply the rules to specific types of web requests, that would be even better. The motivation here is to find a piece of equipment that can protect compute-intensive, database-driven websites from overly aggressive proxies, firewalls, search engines, etc. which like to hammer a given site with 50+ simultaneous requests against pages that could potentially need a few seconds of processing time per request. I've looked at a Packeteer PacketShaper running in reverse of what it normally would, trying to throttle and shape requests against the server rather than optimizing traffic for a low speed link like it was designed, but that didn't really work out as it could not have the policies applied on a per remote IP basis. Thanks, David

1 0

recommendations for 3rd party web site monitoring
by Matt Bazan 17 Aug '05

17 Aug '05

In need of external 3rd party site monitoring solution. Nothing fancy. Need to be alerted if site (HTTP/S, SMTP, TCP connect based) goes down (email, pager). Off list fine, thanks. Matt

3 2

RE: zotob - blocking tcp/445
by Erik Amundson 17 Aug '05

17 Aug '05

I've always been kind of conflicted with this issue. I mean, providers blocking traffic at all. On the one hand, I'm a corporate customer, and if I'm being DOSed or infected, I would want to be able to call my ISP and have it blocked. On the other hand, I truly feel that I pay my ISPs to pass traffic, not block it. I guess it only bugs me when something is blocked and I didn't even ask for it to be blocked...and then other stupid things are seeping through, but are not blocked even when I ask! If ISPs really wanted to make the Internet better for Corporate America, I guess they'd unplug most of Asia...not block a port here and there (but that isn't exactly acceptable). Anways, like I said, I'm conflicted...I change my mind every now and then because both arguments make logical sense. - Erik -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gadi Evron Sent: Tuesday, August 16, 2005 12:58 AM To: Christopher L. Morrow Cc: nanog(a)merit.edu Subject: Re: zotob - blocking tcp/445 [snip arguments] > Do not become the internet firewall for your large customer base... > it's bad. > Okay, so please allow me to alter the argument a bit. Say we agreed on: 1. Security is THEIR (customers') problems, not yours. 2. You are not the Internet's firewall. That would mean you would still care about: 1. You being able to provide service. 2. Your own network being secure (?) In a big outbreak, not for the WHOLE Internet, I'd use whatever I can. It can easily become an issue of my network staying alive. Blocking that one port then might be a viable solution to get a handle on things and calm things down. Naturally though you are right again, it is a case-by-case issue and can not be discussed in generalities. Gadi.

7 6