January 2006 - Test - lists.nanog.org

Re: [Fwd: Re: sober.z to hit tomorrow]
by Wil Schultz 06 Jan '06

06 Jan '06

And here i was expecting .ZIP file from the FBI and CIA telling me that I need to full out a "survey" :) -Wil Martin Hannigan wrote: >>Here is some more interesting information. I'm not positive this is >>Sober.Z related but it's walking like and talking like a duck. >> >>First I see the below DNS requests, shortly after I see many SMTP >>packets hitting Hotmail, AOL, Yahoo.com, Yahoo.co.uk, Progegy, etc.... >>Looks like it's... Sending SPAM?!?! >> >> > >No! Not that! > > > >>This I didn't expect at all, here is a trace from one of the known >>infected users: >> >> > > >This is how these folks make money. > > > >

1 0

LACNIC ranges being filtered
by Ricardo Patara 06 Jan '06

06 Jan '06

Hello, In june 2005 LACNIC received two new IP block from IANA (189/8 and 190/8). And before starting to make allocation in it, we conducted some reachability tests with valuable help from this community. Those test showed that great majority of transit providers were not block those network ranges. But unfortunately turned out that there are now some end nodes networks which are still blocking them. Contact have been tried from LANCIC members being affected, their upstream and also from LACNIC itself since end of November 2005 with not much success so far. So we kindly ask you all to revise your filters and if some of the following networks/address range administrator could contact us offline we would appreciate: American Express Oracle Wikipedia HostDime.com, Inc American Airlines Inc. Gannett Co Adslzone.net 82.223.64.0/18 Thanks Ricardo Patara RSG Manager -- | LACNIC | http://LACNIC.NET

1 0

The Cidr Report
by cidr-report＠potaroo.net 06 Jan '06

06 Jan '06

This report has been generated at Fri Jan 6 21:52:35 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 30-12-05 174422 116292 31-12-05 174512 116417 01-01-06 174547 116366 02-01-06 174524 116324 03-01-06 174473 116302 04-01-06 174604 116340 05-01-06 174699 116244 06-01-06 174675 116326 AS Summary 21209 Number of ASes in routing system 8802 Number of ASes announcing only one prefix 1434 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91312384 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 06Jan06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 174695 116276 58419 33.4% All ASes AS4323 1194 237 957 80.2% TWTC - Time Warner Telecom AS18566 888 8 880 99.1% COVAD - Covad Communications Co. AS4134 991 253 738 74.5% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1031 311 720 69.8% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 601 39 562 93.5% CCINET-2 - Cox Communications Inc. AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 562 65 497 88.4% CANET-ASN-4 - Canadian Research Network AS7018 1434 941 493 34.4% ATT-INTERNET4 - AT&T WorldNet Services AS3602 523 107 416 79.5% SPRINT-CA-AS - Sprint Canada Inc. AS6197 966 569 397 41.1% BATI-ATL - BellSouth Network Solutions, Inc AS11492 639 249 390 61.0% CABLEONE - CABLE ONE AS17676 478 103 375 78.5% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS17488 436 64 372 85.3% HATHWAY-NET-AP Hathway IP Over Cable Internet AS4766 666 301 365 54.8% KIXS-AS-KR Korea Telecom AS9583 832 467 365 43.9% SIFY-AS-IN Sify Limited AS812 370 27 343 92.7% ROGERS-CABLE - Rogers Cable Inc. AS6467 395 54 341 86.3% ESPIRECOMM - e.spire Communications, Inc. AS4755 617 291 326 52.8% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS15270 351 30 321 91.5% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS9498 399 93 306 76.7% BBIL-AP BHARTI BT INTERNET LTD. AS22047 380 88 292 76.8% VTR BANDA ANCHA S.A. AS14654 292 6 286 97.9% WAYPORT - Wayport AS5668 510 236 274 53.7% AS-5668 - CenturyTel Internet Holdings, Inc. AS18101 302 28 274 90.7% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS6167 330 65 265 80.3% CELLCO-PART - Cellco Partnership AS9929 320 57 263 82.2% CNCNET-CN China Netcom Corp. AS16814 293 41 252 86.0% NSS S.A. AS1239 843 602 241 28.6% SPRINTLINK - Sprint AS6517 357 118 239 66.9% YIPESCOM - Yipes Communications, Inc. AS6478 522 288 234 44.8% ATT-INTERNET3 - AT&T WorldNet Services Total 18085 5803 12282 67.9% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.78.0/24 AS25994 NPG-001 - NPG Cable, INC 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.25.224.0/20 AS12180 INTERNAP-2BLK - Internap Network Services 64.25.224.0/22 AS15083 INFOLINK-MIA-US - Infolink Information Services Inc. 64.38.96.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 64.127.128.0/17 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.224.0/20 AS3356 LEVEL3 Level 3 Communications 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.9.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.16.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.18.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.20.0/24 AS30085 NHI-COLOCATIONS - New Horizon Collocations 66.117.21.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.186.192.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.216.0.0/18 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 85.129.3.0/24 AS14585 CIFNET - CIFNet, Inc. 85.129.4.0/24 AS14585 CIFNET - CIFNet, Inc. 90.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 90.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.0.246.0/24 AS3303 SWISSCOM Swisscom Solutions Ltd 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.160.171.0/24 AS7046 UUNET-CUSTOMER - UUNET Technologies, Inc. 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET - NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.74.32.0/19 AS9315 CWN-AS-AP Chomanan WorldNet Co., Ltd. 202.80.224.0/19 AS7613 DATALINETHAI-AS-AP Data Line Thai Co., LTD. Internet Service Provider 202.80.231.0/24 AS4750 LOXLEY-TH Loxley Information Co., Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.133.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.138.0/24 AS9237 HUTCHCA-AS Corporate Access (HK) Ltd. 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.145.0/24 AS4637 REACH Reach Network Border AS 203.89.146.0/24 AS4637 REACH Reach Network Border AS 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.108.96.0/19 AS577 BACOM - Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.97.64.0/19 AS6132 INGRESSNET - Ingress Enterprises, Inc w/ Ingress Communications, Inc. 209.112.224.0/20 AS19817 DSLEXTREME - DSL Extreme 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 209.251.0.0/19 AS11036 SISCOM - SISCOM, Inc 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.82.160.0/20 AS20481 CALYX-NL Calyx Internet B.V. Netherlands 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

[Fwd: Re: sober.z to hit tomorrow]
by Wil Schultz 06 Jan '06

06 Jan '06

Here is some more interesting information. I'm not positive this is Sober.Z related but it's walking like and talking like a duck. First I see the below DNS requests, shortly after I see many SMTP packets hitting Hotmail, AOL, Yahoo.com, Yahoo.co.uk, Progegy, etc.... Looks like it's... Sending SPAM?!?! This I didn't expect at all, here is a trace from one of the known infected users: ############################################################### <snip, due to the postmasters request since it looks like SPAM> ############################################################### Wil Schultz wrote: > FYI: I've set some traps on our DNS servers, dunno exactally what this > means but I thought that I should share: > > Jan 5 18:41:09 myServer named[24490]: client X.X.X.X#1192: query: > arcor.de IN MX > Jan 5 18:45:48 myServer named[24490]: client X.X.X.X#1034: query: > freenet.de IN MX > > These are the only two logs I have at this point. And I don't recall > any other Sober searching for an email server. > > -Wil > > Wil Schultz wrote: > >> Wouldn't it be fun if it contained the WMF exploit in some form? >> So, I'm planning on using swatch to monitor DNS requests for the >> known affected domains. What is everyone else planning to do? >> >> -Wil >> >> > > >

1 0

sober.z to hit tomorrow
by Wil Schultz 06 Jan '06

06 Jan '06

Wouldn't it be fun if it contained the WMF exploit in some form? So, I'm planning on using swatch to monitor DNS requests for the known affected domains. What is everyone else planning to do? -Wil

3 4

Awful quiet?
by Jim Popovitch 05 Jan '06

05 Jan '06

I miss the endless debates. Is *everyone* Christmas shopping? Here's a thought to ponder.... With the thousands of datacenters that exist with IPv4 cores, what will it take to get them to move all of their infrastructure and customers to IPv6? Can it even be done or will they just run IPv6 to the core and proxy the rest? -Jim P.

17 28

RE: WMF Microsoft Patch is out
by Church, Chuck 05 Jan '06

05 Jan '06

So rather than finish the testing they wanted to do, they rushed it out? Hmmm. Sounds a little scary to me.... Chuck ________________________________ From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Jerry Dixon Sent: Thursday, January 05, 2006 3:37 PM To: nanog(a)nanog.org Subject: WMF Microsoft Patch is out FYI all, the Microsoft Official patch is out for WMF and available via Windows Update. Cheers, Jerry

4 3

WMF Microsoft Patch is out
by Jerry Dixon 05 Jan '06

05 Jan '06

FYI all, the Microsoft Official patch is out for WMF and available via Windows Update. Cheers, Jerry

2 1

Re: WMF patch
by Eric Frazier 05 Jan '06

05 Jan '06

At 01:40 AM 1/5/2006, Thomas Kuehling wrote: >Hi Eric > >Am Mittwoch, den 04.01.2006, 08:14 -0800 schrieb Eric Frazier: > > Hi, > > > > I finally decided this was serious enough to do something about it sooner > > than the MS patch, but while this seems to be the official link to the > SANS > > patch http://isc1.sans.org/diary.php?storyid=1010 > > it also is timing out. I have seen a couple of other links from > googling to > > people who have "repackaged" this, but I really don't want to download > > something that doesn't match the SANS MD5.. > > > > Any links or suggestions? > >perhaps it is outdated, but as a workaround, it would be enough to >unregister the DLL wich handles WMF: > >on the Start menu, choose Run, type "regsvr32 -u %windir%\system32 >\shimgvw.dll", and then click OK. > >For more details, visit this link: >http://www.frsirt.com/english/advisories/2005/3086 Thanks Thomas, something really useful. One thing I am still curious about, I read that there were other image formats can be used in an exploit, GIF, .BMP, .JPG, .TIF can also be used, according to F-Secure. I find this a little confusing, if that dll only deals with WMF file type then the exploit must not be directly connected with that dll Or does that dll handle all of those as well? But then I found this http://www.pcworld.com/howto/article/0,aid,119993,00.asp Which makes sense. The way a lot of things I have been seeing go on about this they act like WMF is the only format of issue and that obviously is not at all true. I would have more likely ignored this if it really was only WMF files and the MS patch a week or so away. Thanks, Eric >Mit freundlichen GrÃ¼Ãen >Thomas KÃ¼hling > >-- >Mapsolute Gmbh - Techn. Administration - TK2325-RIPE

2 1

RE: MPLS Providers
by Rump, Bryant 05 Jan '06

05 Jan '06

That's sort of a loaded question. Some provider's offerings are good for different reasons/have different strengths. Your best fit would depend on your individual needs. How many sites will you have, and what is your access method and speed preference? Do you need granular QoS from CPE to CPE or will queuing on the access loop suffice? Prefer or require layer 2 (Martini, Kompella/Lasserre, etc.) MPLS vs. layer 3 (2547)? Do you need the service to support multicast? Does your WAN require the service to support an IGP (OSPF, RIPv2, etc.)? Do you require internet access over the same access loop? Require the provider's network to be physically separate from the public internet? Plus many more... The answers to these questions should significantly narrow your choices. Bryant Rump -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Andrew Staples Sent: Thursday, January 05, 2006 12:36 PM To: nanog(a)merit.edu Subject: MPLS Providers We're looking at purchasing MPLS services for locations nationwide. Does anyone have personal experiences they'd care to share about providers...the good, the bad, the ugly? I'm not looking for public bashing, just data to differentiate one from another. Any comments or direction appreciated. Andrew

1 0