January 2006 - Test - lists.nanog.org

WMF patch
by Eric Frazier 04 Jan '06

04 Jan '06

Hi, I finally decided this was serious enough to do something about it sooner than the MS patch, but while this seems to be the official link to the SANS patch http://isc1.sans.org/diary.php?storyid=1010 it also is timing out. I have seen a couple of other links from googling to people who have "repackaged" this, but I really don't want to download something that doesn't match the SANS MD5.. Any links or suggestions? Thanks, Eric

3 2

Contact at Broadwing?
by Tony Varriale 04 Jan '06

04 Jan '06

Would a contact from Broadwing contact me offlist? I would like assistance with a chronic problem with packet loss through our California BW ethernet feed to another California non-BW location. Thanks! tv

1 0

Re: Sober Z virus
by Fergie 04 Jan '06

04 Jan '06

See: http://www.f-secure.com/weblog/archives/archive-122005.html#00000729 - ferg -- Elijah Savage <esavage(a)digitalrage.org> wrote: Can anyone confirm this I got this from a security partner of ours. The source code for the Sober.Z worm, which began infecting computers worldwide on Nov. 21, indicates that the author(s) are planning to launch another attack on Thursday, Jan. 5 and Friday 6, to coincide with the 87th anniversary of the founding of the Nazi Party. On these dates, PCs infected with Sober.Z will be instructed to connect to numerous servers to download malicious code that will likely send out German and English language email hate messages. Uknown Company (my edit)encourages network administrators to protect themselves by blocking domains believed to host the malicious code. These domains are: http://people.freenet.de/ http://scifi.pages.at/ http://home.pages.at/ http://free.pages.at/ http://home.arcor.de/ -- http://www.digitalrage.org/ The Information Technology News Center -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 3

Sprint routing issue
by Joseph W. Breu 03 Jan '06

03 Jan '06

Can someone from Sprint NOC contact me offlist regarding a routing issue? -- Thanks, --------------------------------------------------------- Joseph W. Breu, CCNA phone : +1.319.268.5228 Senior Network Administrator fax : +1.319.266.8158 Cedar Falls Utilities cell : +1.319.493.1686 support: +1.319.268.5221 url : http://www.cfu.net

2 2

Re: live chat with other nanog'ers
by MARLON BORBA 03 Jan '06

03 Jan '06

IMHO the best place to chat with other NANOGers would be... this mailing-list. Moderated, scriptkiddie-less, no would-be-hackers, mostly on-topic subjects. IRC has become a place for children and teenagers willing to raise their egos' stamina. Abraços, Marlon Borba, CISSP. -- Se você acha que a criptografia pode resolver todos os seus problemas de segurança, então você não conhece os seus problemas e nem a criptografia. (Bruce Schneier) -- >>> Albert Meyer <from_nanog(a)corenap.com> 29/12/2005 23:32:01 >>> I briefly contacted the previous maintainer of #nanog on freenode but he seems to have dropped out of sight again. We can talk in the channel now but nobody [...]

6 5

Sober Z virus
by Elijah Savage 03 Jan '06

03 Jan '06

Can anyone confirm this I got this from a security partner of ours. The source code for the Sober.Z worm, which began infecting computers worldwide on Nov. 21, indicates that the author(s) are planning to launch another attack on Thursday, Jan. 5 and Friday 6, to coincide with the 87th anniversary of the founding of the Nazi Party. On these dates, PCs infected with Sober.Z will be instructed to connect to numerous servers to download malicious code that will likely send out German and English language email hate messages. Uknown Company (my edit)encourages network administrators to protect themselves by blocking domains believed to host the malicious code. These domains are: http://people.freenet.de/ http://scifi.pages.at/ http://home.pages.at/ http://free.pages.at/ http://home.arcor.de/ -- http://www.digitalrage.org/ The Information Technology News Center

2 1

Announce: BGP-Inspect sites for non-routeviews data...
by Manish Karir 03 Jan '06

03 Jan '06

All, I wanted to drop a quick note to let people know about the availability of additional BGP-Inspect sites based on data other than the routeviews data which we have been supporting till now. This should provide much better visibility than before. The new sites are: - BGP-Inspect-RIPE(http://bgpinspect.merit.edu:9090): RIPE BGP update data, Data from Dec 8 2005 onwards - BGP-Inspect-Merit(http://bgpinspect.merit.edu:8080): Merit BGP update data, Data from Nov 11 2005 onwards They can also be reached from the "about" page in the main site: http://bgpinspect.merit.edu Also, a new feature that we wanted to announce that has not seen a lot of use is the ability to select multiple "peers" in a single query. This allows you to query for a prefix/AS across multiple peers with a single query. Just hold down the ctrl key to select the peers you wish to query. Comments are welcome (offlist please). thanks manish

1 0

Leap second reminder
by Kevin Day 02 Jan '06

02 Jan '06

Just a reminder, at midnight UTC there's a leap second added to most time systems. Some time systems will stop the clock at 23:59:59.999999 for 1 second, some will display 23:59:60 for a second. Since the last leap second (1998), "leap second aware" time keeping systems(NTP, GPS, etc) have become much more prevalent, so it's much more likely this time that applications and NTP sync'ed devices will see a leap second happen(rather than have them manually corrected later, or not corrected at all). But, I'm not too sure how well everyone has tested applications and devices for how they handle the clock stopping for a second OR an "invalid" time of 23:59:60. If anyone sees anything die at 00:00:00UTC I'd be interested to know. -- Kevin

10 11

2005 IPv4 Address Use Report
by Iljitsch van Beijnum 01 Jan '06

01 Jan '06

According to AfriNIC, APNIC, ARIN, LACNIC and RIPE NCC statistics as published on their respective FTP servers, they gave out 165.45 million IPv4 addresses in 2005. Out of 3706.65 million usable IPv4 addresses, 1468.61 million are still available as of januari 1, 2006. Breakdown by Regional Internet Registry over the past few years: 2000 2001 2002 2003 2004 2005 AfriNIC 0.56 0.38 0.25 0.21 0.51 1.89 APNIC 21.08 28.84 27.08 33.08 42.92 53.97 ARIN 30.96 32.76 21.02 22.14 33.51 36.30 LACNIC 0.88 1.57 0.65 2.62 3.77 11.04 RIPE NCC 24.88 25.39 19.94 29.72 47.75 62.25 Total 78.35 88.95 68.93 87.77 128.45 165.45 AfriNIC gives out address space in Africa, APNIC in the Asia-Pacific region, ARIN in North America, LACNIC in Latin American and the Caribbean and the RIPE NCC in Europe, the former Soviet Union and the Middle East. Note that the RIRs tend to change their records retroactively from time to time. For instance, the januari 1, 2005 records show that only 117.3 million addresses were given out in 2004. Also, reclaimed address space isn't listed explicitly. From the fact that the 1-1-2005 records show 1939 million addresses given out before 2004 but the 1-1-2006 records show 1928.48 million addresses for the same period, we can conclude that 11.15 million addresses given out before 2004 have been reclaimed in 2005. The Internet Assigned Numbers Authority (IANA, part of ICANN) keeps an overview of the IPv4 address space at http://www.iana.org/ assignments/ipv4-address-space. The list consists of 256 blocks of 16.78 million addresses. Breakdown: Delegated to Blocks Addresses (millions) AfriNIC 1 16.78 APNIC 16 268.44 ARIN 23 385.88 LACNIC 4 67.11 RIPE NCC 19 318.77 Various 50 838.86 End-user 43 721.42 Available 65 1090.52 Of the 1895.83 million addresses delegated to the five Regional Internet Registries, 1517.74 million have been delegated to end-users or ISPs by the RIRs, and 378.09 million are still available. Along with the 1090.52 million addresses still available in the IANA global pool this makes the total number of available addresses 1468.61 million. The size of address blocks given follows an interesting trend. The table below shows the number of requests for a certain range of block sizes (equal or higher than the first, lower than the second value). 2000 2001 2002 2003 2004 2005 < 1000 326 474 547 745 1022 1309 1000 - 8000 652 1176 897 1009 1516 1891 8000 - 64k 1440 868 822 1014 1100 1039 64k - 500k 354 262 163 215 404 309 500k - 2M 19 39 29 46 61 60 > 2M 3 5 5 6 7 18 The number of blocks in the two smallest categories have increased rapidly, but not as fast as the number of blocks in the largest category, in relative numbers at least. However, the increase in large blocks has a very dramatic effect while the small blocks are insignificant, when looking at the millions of addresses involved: 2000 2001 2002 2003 2004 2005 < 1000 0.10 0.16 0.18 0.25 0.35 0.44 1000 - 8000 2.42 4.47 3.23 3.45 4.49 5.07 8000 - 64k 18.79 12.81 11.35 14.00 15.99 15.46 64k - 500k 35.98 32.19 20.28 25.51 42.01 34.23 500k - 2M 12.68 24.64 21.30 31.98 44.63 41.63 > 2M 8.39 14.68 12.58 12.58 20.97 68.62 The medium-sized blocks seem most affected by the burst of the internet bubble. Another way to look at the same data: Year Blocks Addresses (M) Average block size 2000 2794 78.35 28043 2001 2824 88.95 31497 2002 2463 68.93 27985 2003 3035 87.77 28921 2004 4110 128.45 31252 2005 4626 165.45 35765 The 2222.38 million addresses currently in use aren't very evenly distributed over the countries in the world. The current top 15 is: Country Addresses US 1324.93 M United States JP 143.00 M Japan EU 113.87 M Multi-country in Europe CN 74.39 M China CA 67.43 M Canada DE 51.13 M Germany FR 45.16 M France KR 41.91 M Korea UK 40.18 M United Kingdom GB 33.63 M Great Britain AU 26.87 M Australia IT 18.39 M Italy BR 17.17 M Brazil NL 16.40 M Netherlands ES 16.29 M Spain The US holds 60% of the IPv4 address space. The other countries in the list together hold another 32%. A copy of this information and a tool to perform queries on the base data is available at http://www.bgpexpert.com/addrspace2005.php

1 0

Gmail Contact and Gmail bugs
by Joe Shen 01 Jan '06

01 Jan '06

Hi, Is there way to contact Gmail? Message in my gmail account could not be access for three days. When I tried to click on any message ( or search, move to othe folder .. ) it always pop up with " Ooops, the system was unable to perform your operation.Please try again in a few seconds". Joe __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 1GB free storage! http://sg.whatsnew.mail.yahoo.com

2 1