October 2008 - Test - lists.nanog.org

question on BGP aggregation
by Kai Chen 23 Oct '08

23 Oct '08

Hi, I observe some BGP AS paths collected from Routeview having the AS-set in the last hop. According to my understanding, this is BGP route aggregation. However, my question is as follows: Suppose, there is a path AS1 AS2 AS3 {AS4 AS5 AS6}, how AS4 AS5 AS6 connect to AS3? Does it necessarily mean that AS4 AS5 AS6 are direct neighbors of AS4, and AS4 aggregate the routes from AS4 AS5 AS6 then exporting outside. or, it could be other cases such as AS4 aggregate AS5 AS6 first, and then AS3 aggregate AS4? Thanks in advance,

2 2

What's with all the long aspaths?
by Jon Lewis 23 Oct '08

23 Oct '08

Is there something silly going around? I doubt I'm the only one noticing these being triggered by our generous maxas-limit setting. Oct 9 23:01:46: %BGP-6-ASPATH: ... 27754 27754 27754 ... Oct 17 11:10:40: %BGP-6-ASPATH: ... 43413 43413 43413 ... Oct 22 06:34:09: %BGP-6-ASPATH: ... 38230 38230 38230 ... Anyone have theories as to what these networks are trying to accomplish? ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

3 2

Long haul Ethernet providers around?
by Konstantin Bezruchenko 23 Oct '08

23 Oct '08

Hi, If there are any long haul Ethernet providers on the list, can you contact me offlist? I'm looking for 10GE from Dallas to Ashburn. Thanks. -Konstantin

1 0

Kaminsky redux - libspf2 dns parsing bug
by Suresh Ramasubramanian 23 Oct '08

23 Oct '08

For the "mailops is not operational" folks.. it involves parsing dns txt records, so .. well, please grit your teeth and read on, this gets interesting Well, we discarded spf back in 2005 so we arent in any particular danger, but for those few of y'all still deploying and checking spf .. please upgrade asap. srs http://www.doxpara.com/?p=1263 I really need to learn to leave DNS alone :) DNS TXT Record Parsing Bug in LibSPF2 A relatively common bug parsing TXT records delivered over DNS, dating at least back to 2002 in Sendmail 8.2.0 and almost certainly much earlier, has been found in LibSPF2, a library frequently used to retrieve SPF (Sender Policy Framework) records and apply policy according to those records. This implementation flaw allows for relatively flexible memory corruption, and should thus be treated as a path to anonymous remote code execution. Of particular note is that the remote code execution would occur on servers specifically designed to receive E-Mail from the Internet, and that these systems may in fact be high volume mail exchangers. This creates privacy implications. It is also the case that a corrupted email server is a useful "jumping off" point for attackers to corrupt desktop machines, since attachments can be corrupted with malware while the containing message stays intact. So there are internal security implications as well, above and beyond corruption of the mail server on the DMZ. Apparently LibSPF2 is actually used to secure quite a bit of mail traffic – there's a lot of SPAM out there. Fix is out, see http://www.libspf2.org/index.html or your friendly neighborhood distro. Thanks to Shevek, CERT (VU#183657), Ken Simpson of MailChannels, Andre Engel, Scott Kitterman, and Hannah Schroeter for their help with this.

2 1

RE: What's with all the long aspaths?
by Jon Lewis 23 Oct '08

23 Oct '08

Yeah...prepending isn't a big deal...but when someone prepends their own AS 70+ times, I wonder WTF they're thinking. On Thu, 23 Oct 2008, James Baker wrote: > bgp path prepend? > > -----Original Message----- > From: Jon Lewis [mailto:jlewis@lewis.org] > Sent: Thursday, 23 October 2008 3:40 p.m. > To: nanog(a)nanog.org > Subject: What's with all the long aspaths? > > Is there something silly going around? I doubt I'm the only one > noticing > these being triggered by our generous maxas-limit setting. > > Oct 9 23:01:46: %BGP-6-ASPATH: ... 27754 27754 27754 ... > Oct 17 11:10:40: %BGP-6-ASPATH: ... 43413 43413 43413 ... > Oct 22 06:34:09: %BGP-6-ASPATH: ... 38230 38230 38230 ... > > Anyone have theories as to what these networks are trying to accomplish? > > ---------------------------------------------------------------------- > Jon Lewis | I route > Senior Network Engineer | therefore you are > Atlantic Net | > _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ > > ---------- > > The information contained in this e-mail and any attachments is confidential > and is intended for the attention and use of the named addressee(s) only. > Any views expressed in this message are those of the individual sender and > may not necessarily reflect the views of Chelmer Limited. > > ##################################################################################### > This e-mail message has been scanned for Viruses and Content and cleared > by NetIQ MailMarshal > ##################################################################################### > ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

6 6

Telstra NOC
by Charles Wyble 22 Oct '08

22 Oct '08

http://www.telstra.com.au/abouttelstra/images/media/photos/73764g2_hires.jpg

11 10

Re: UDRP and ICANN / Input Requested
by Scott Weeks 22 Oct '08

22 Oct '08

Fire, meet gasoline. >;-) If allowed to ignite, this will be an explosive discussion. scott --- ernesto(a)cs.fiu.edu wrote: From: Ernie Rubi <ernesto(a)cs.fiu.edu> So I'm a network engineer and a law student and have decided to write a short note for one of our International Law classes based on UDRP and ICANN issues. I'd like to request input from the community as to what they see as the advantages and disadvantages for the UDRP process the way ICANN has it structured now. Any comments on how to improve the system are greatly appreciated. You can contact post to the list or contact me off list, either way my information is below.

2 1

In Memoriam: Abha Ahuja
by Paul Ferguson 20 Oct '08

20 Oct '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On October 20, 2001, we lost a dear friend and colleague. We miss you, Abha. http://fergdawg.blogspot.com/2008/10/in-memoriam-abha-ahuja.html And of course: http://www.nanog.org/scholarships/abha.php - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFI/C1Qq1pz9mNUZTMRAucmAJ9SltkxADgCmC3fu9vTatb7QqeZNgCgiLPw 9oIJ6crCAXiJ1WGtUB9SKmQ= =FCpY -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

1 0

virbl.bit.nl, A list of virussending IP's
by Mark Schouten 20 Oct '08

20 Oct '08

Hi All, Some of you might have heard about or suffered a listing on virbl.bit.nl. Virbl is a dns-list with IP's of which we (BIT) or one of the contributors [1] have received a email with a virus. We will list an IP after it has sent two virus-emails to one of our sources. We will remember that you sent those emails for seven days. IP's will only be listed as long as the last time we 'saw' the IP sending virusses is less than 24 hours and the total sent emails is greater than two, in the last seven days. The goal is to stop infected machines from sending virusses, and stop relaying-servers from forwarding, bouncing and otherwise deliver virusses. It does definitely help in preventing the use of useless cou cycles for scanning mail in your mailsetup. AS Administrators can login at [2]. A password will be emailed to a address you select. We look for addresses in the whois-info for your AS. You can see evidence, suspend hosts from the list and see stats about your AS. We are working on notifications, which will also be configurable in the login-interface. We currently use dnswl and the nlwhitelist (a list with the relay-servers for Dutch ISP's) as a exclude list. If anyone knows another trustworthy whitelist with relayservers from ISP's, please let me know so we can think about using that too. Also, if you're interested in contributing to Virbl, please email me off list. We prefer consumer ISP's, with some million messages per day. If you're using MailScanner or Amavisd-new, that would be great. Offcourse, the use of Virbl is free. See [3] on howto use it. Thanks, Links to http://virbl.bit.nl/ [1] http://virbl.bit.nl/contributors.php [2] https://virbl.bit.nl/login/ [3] http://virbl.bit.nl/usage.php -- Mark Schouten, Unix/NOC-engineer BIT BV | info(a)bit.nl | +31 318 648688 MS8714-RIPE | B1FD 8E60 A184 F89A 450D A128 049B 1B19 9AD6 177FF

1 1

the attack continues..
by Beavis 18 Oct '08

18 Oct '08

Hello Lists, I'm still getting attacked and most of the IP's i got have been reported. and just this morning it looks as if someone is testing my network. and sending out short TCP_SESSION requests. now i may be paranoid but this past few days have been hell.. just want to know if the folks from these ip's can help me out. Attacker IP,Attacker Port,Victim IP,Victim Port,Attack Type,Start Time,Extra Info 205.188.116.7,47198,200.0.179.73,80,TCP_SESSION,2008-10-18 14:20:48,Filtered IP: Dropped packets: 3 Dropped bytes: 156 205.188.117.134,45379,200.0.179.73,80,TCP_SESSION,2008-10-18 14:20:48,Filtered IP: Dropped packets: 0 Dropped bytes: 0 205.188.117.137,42257,200.0.179.73,80,TCP_SESSION,2008-10-18 14:20:48,Filtered IP: Dropped packets: 0 Dropped bytes: 0 75.105.128.38,4092,200.0.179.73,80,TCP_SESSION,2008-10-18 14:20:48,Filtered IP: Dropped packets: 0 Dropped bytes: 0 First 3 IP's come from AOL, I'll try to see if I can get their attention. Last IP is from a Wildblue Communications WBC-39. I wanted to see if it's possible to get a sample of the "bots" that their using against me. I know... it's a long shot but any help will be greatly appreciated. thanks, John Lopez

6 7