- Test - lists.nanog.org

Constant low-level attack
by Lou Katz 29 Jun '12

29 Jun '12

The other day, I looked carefully at my auth.log (Xubuntu 11.04) and discovered many lines of the form: Jun 28 13:13:54 localhost sshd[12654]: Bad protocol version identification '\200F\001\003\001' from 94.252.177.159 In the past day, I have recorded about 20,000 unique IP addresses used for this type of probe. I doubt if this is a surprise to anyone - my question is twofold: 1. Does anyone want this evergrowing list of, I assume, compromised machines? 2. Is there anything useful to do with this info other than put the IP addresses into a firewall reject table? I have done that and do see a certain amount of repeat hits. -=[L]=- --

5 4

IPV6 ACL command to block ICMPv6 Type and code
by Roman 29 Jun '12

29 Jun '12

Hi, I am looking for Cisco IOS command to block specific ICMPv6 message type and code. For example how to block only code 1 (communication with destination administratively prohibited) of message type 1 (destination unreachable). All other code will be permited. deny icmp any any type 1 code 1 In my router I can see these: Router(config-ipv6-acl)#deny icmp any any destination-unreachable ? auth Match on authentication header dest-option Destination Option header (all types) dest-option-type Destination Option header with type dscp Match packets with given dscp value flow-label Flow label log Log matches against this entry log-input Log matches against this entry, including input mobility Mobility header (all types) mobility-type Mobility header with type routing Routing header (all types) routing-type Routing header with type sequence Sequence number for this entry time-range Specify a time-range <cr> My IOS is c2800nm-ipvoicek9-mz.124-24.T2 Regards Rom

2 1

Peeringdb down?
by Vinny_Abello＠Dell.com 29 Jun '12

29 Jun '12

I already sent an email to support(a)peeringdb.com<mailto:support@peeringdb.com> about this, but I'm uncertain they are receiving email properly, so I'll mention it here as well. I hadn't seen mention of it already anywhere. I'm seeing MySQL errors when attempting to query peeringdb.com this morning. I'm assuming the admins or friends of admins lurk here. :) IE: Database error: Invalid SQL: .....<edited> MySQL Error: 1030 (Got error 28 from storage engine) Session halted. -Vinny

5 5

Question about Martians on Vyatta
by Eric Germann 28 Jun '12

28 Jun '12

All, I'm trying to understand why a Vyatta 6.4 collection of routers is carping about the following as martian routes: 113.107.174.14 27.73.1.159 94.248.215.60 95.26.105.161 They don't look like they fall in the traditional martian space. I also wondered if they were addresses without a reverse route, but they have reverse paths in our routing tables (full routes from AS 10796 and 11530). Any thoughts? EKG

2 3

charter communications
by jamie rishaw 28 Jun '12

28 Jun '12

wow, the sh*t is really hitting the fan over there.. /this/ has got to be a record - I've never seen this before.. yikes. -snip- 20115 Origin IGP, localpref 100, external, atomic-aggregate ... Dampinfo: penalty 10766, flapped 99 times in 03:14:17, reuse in 00:03:03 ... (suppressed due to dampening) (history entry) -/snip- 99 flaps, 10K penalty.. ehhhhh. looks to be nationwide.. or multistate at the least. (Noc only confirms 'a few areas'). anyone w/411 on this? offlist replies well be kept off list.. -j

1 0

Looking for Geoff
by Hank Nussbacher 28 Jun '12

28 Jun '12

I am urgently trying to find Geoff but it appears he has left Telstra: <gih(a)telstra.net>: host pit-mail.telstra.net[203.50.40.14] said: 550 5.1.1 <gih(a)telstra.net>... User unknown (in reply to RCPT TO command) Sorry for using the list but I don't know how else to find him. Please reply directly to me and not to the list. Thanks, Hank

2 1

[NANOG-announce] Announcing a Monday to Wednesday NANOG Program Starting at NANOG 57 (Feb 2013)
by Sylvie LaPerriere 27 Jun '12

27 Jun '12

Colleagues, At our NANOG 55 Community meeting Dave Temkin presented the PC proposal to move our Conference Program to a Monday-to-Wednesday format. Originating from the community, this proposal was developed and refined in the last year using the conference surveys. We surveyed you one last time at NANOG 55. The majority spoke in favour and the Board approved this change on June 22. I am pleased to announce that starting in February 2013, at NANOG 57 Orlando, the NANOG Conference program will : - start Monday morning with Tutorials; - have the Keynote kick off the Plenary after Monday's lunch; - add a standing Policy Track programmed by ARIN; - move the Peering Track to Wednesday afternoon. The net result will provide a Conference Program with 10% more content: +15 min of General Session and +90 min of Unique Track. On behalf of the Board, I would like to thank Nate Davis and John Curran (ARIN partners), Betty Burke (Executive Director), Dave Temkin (PC Chair), Greg Dendy (PC VIce-Chair) and each and every PC member (Nina, Jim, Tom, Ryan, Kevin, Igor, Greg H, Manish, Mohit, David, Dani, Tom, Michael, Tony) for the careful thought and consideration they afforded this proposal over the past 9 months. Have a great Summer and see you all next October for NANOG 56 in Dallas. Regards, Sylvie -- Sylvie LaPerriere NANOG Chair - www.nanog.org _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: DNS poisoning at Google?
by Grant Ridder 27 Jun '12

27 Jun '12

It also redirects with facebook, youtube, and ebay but NOT amazon. -Grant On Wed, Jun 27, 2012 at 12:57 AM, Matthew Black <Matthew.Black(a)csulb.edu>wrote: > Our web lead was able to run curl. Thanks.**** > > ** ** > > matthew black**** > > information technology services**** > > california state university, long beach**** > > ** ** > > *From:* Grant Ridder [mailto:shortdudey123@gmail.com] > *Sent:* Tuesday, June 26, 2012 10:53 PM > *To:* Matthew Black > *Cc:* Landon Stewart; nanog(a)nanog.org; Jeremy Hanmer > > *Subject:* Re: DNS poisoning at Google?**** > > ** ** > > Matt, what happens you get on a subnet that can access the webservers > directly and bypass the load balancer. Try curl then and see if its > something w/ the webserver or load balancer.**** > > ** ** > > -Grant**** > > On Wed, Jun 27, 2012 at 12:40 AM, Matthew Black <Matthew.Black(a)csulb.edu> > wrote:**** > > Thanks again to everyone who helped. I didn't know what to enter with > curl, because Outlook clobbered the line breaks in Jeremy's original > message. > > Also, curl failed on our primary webserver because of firewall and load > balancer magic settings. The Telnet method worked better! > > Our team is now scouring for that hidden redirect to couchtarts.**** > > > matthew black > information technology services > california state university, long beach > > > **** > > From: Landon Stewart [mailto:lstewart@superb.net]**** > > Sent: Tuesday, June 26, 2012 10:37 PM > To: Matthew Black > Cc: Jeremy Hanmer; nanog(a)nanog.org**** > > Subject: Re: DNS poisoning at Google?**** > > There is definitely a 301 redirect. > > $ curl -I --referer http://www.google.com/ http://www.csulb.edu/ > HTTP/1.1 <http://www.csulb.edu/%0d%0aHTTP/1.1> 301 Moved Permanently > Date: Wed, 27 Jun 2012 05:36:31 GMT > Server: Apache/2.0.63 > Location: http://www.couchtarts.com/media.php > Connection: close > Content-Type: text/html; charset=iso-8859-1**** > > On 26 June 2012 22:05, Matthew Black <Matthew.Black(a)csulb.edu<mailto: > Matthew.Black(a)csulb.edu>> wrote: > Google Webtools reports a problem with our HOMEPAGE "/". That page is not > redirecting anywhere. > They also report problems with some 48 other primary sites, none of which > redirect to the offending couchtarts. > > matthew black > information technology services > california state university, long beach > > > > > -----Original Message-----**** > > From: Jeremy Hanmer [mailto:jeremy.hanmer@dreamhost.com<mailto: > jeremy.hanmer(a)dreamhost.com>] > Sent: Tuesday, June 26, 2012 9:58 PM > To: Matthew Black**** > > Cc: nanog(a)nanog.org<mailto:nanog@nanog.org> > Subject: Re: DNS poisoning at Google? > It's not DNS. If you're sure there's no htaccess files in place, check > your content (even that stored in a database) for anything that might be > altering data based on referrer. This simple test shows what I mean:**** > > Airy:~ user$ curl -e 'http://google.com' csulb.edu<http://csulb.edu> > <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head>**** > > <title>301 Moved Permanently</title> > </head><body> > <h1>Moved Permanently</h1> > <p>The document has moved <a href="http://www.couchtarts.com/media.php > ">here</a>.</p> > </body></html> > > Running curl without the -e argument gives the proper site contents.**** > > On Jun 26, 2012, at 9:24 PM, Matthew Black <Matthew.Black(a)csulb.edu > <mailto:Matthew.Black@csulb.edu>> wrote: > > > Running Apache on three Solaris webservers behind a load balancer. No MS > Windows! > > > > Not sure how malicious software could get between our load balancer and > Unix servers. Thanks for the tip! > > > > matthew black > > information technology services > > california state university, long beach > > > > > >**** > > > From: Landon Stewart [mailto:lstewart@superb.net<mailto: > lstewart(a)superb.net>]**** > > > Sent: Tuesday, June 26, 2012 9:07 PM > > To: Matthew Black**** > > > Cc: nanog(a)nanog.org<mailto:nanog@nanog.org>**** > > > Subject: Re: DNS poisoning at Google? > > > > Is it possible that some malicious software is listening and injecting a > redirect on the wire? We've seen this before with a Windows machine being > infected.**** > > > On 26 June 2012 20:53, Matthew Black <Matthew.Black(a)csulb.edu<mailto: > Matthew.Black(a)csulb.edu><mailto:Matthew.Black@csulb.edu<mailto: > Matthew.Black(a)csulb.edu>>> wrote: > > Google Safe Browsing and Firefox have marked our website as containing > malware. They claim our home page returns no results, but redirects users > to another compromised website couchtarts.com<http://couchtarts.com>< > http://couchtarts.com>.**** > > > > > We have thoroughly examined our root .htaccess and httpd.conf files and > are not redirecting to the problem target site. No recent changes either. > > > > We ran some NSLOOKUPs against various public DNS servers and > intermittently get results that are NOT our servers. > > > > We believe the DNS servers used by Google's crawler have been poisoned. > > > > Can anyone shed some light on this? > > > > matthew black > > information technology services > > california state university, long beach**** > > > www.csulb.edu<http://www.csulb.edu><http://www.csulb.edu>< > http://www.csulb.edu> > > > > > > > > -- > > Landon Stewart <LStewart(a)Superb.Net<mailto:LStewart@Superb.Net<mailto: > LStewart(a)Superb.Net>>> > > Sr. Administrator > > Systems Engineering > > Superb Internet Corp - 888-354-6128 x 4199<tel:888-354-6128%20x%204199> > Web hosting and more "Ahead**** > > > of the Rest": > > http://www.superbhosting.net<http://www.superbhosting.net/> > > > > > > > > > -- > Landon Stewart <LStewart(a)Superb.Net<mailto:LStewart@Superb.Net>> > Sr. Administrator > Systems Engineering > Superb Internet Corp - 888-354-6128 x 4199 > Web hosting and more "Ahead of the Rest": http://www.superbhosting.net< > http://www.superbhosting.net/>**** > > ** ** >

8 9

New I-D on SLAAC DNS configuration problems (Fwd: New Version Notification for draft-gont-6man-slaac-dns-config-issues-00.txt)
by Fernando Gont 27 Jun '12

27 Jun '12

Folks, We have published a new Internet-Draft entitled "Current issues with DNS Configuration Options for SLAAC". This draft if meant to address the SLAAC DNS configuration issues raised by Pavel on the 6man mailing-list, and also discusses other potential issues. The I-D is available at: <http://www.ietf.org/internet-drafts/draft-gont-6man-slaac-dns-config-issues…> The I-D is aimed at 6man, so please considering weighing in the corresponding mailing-list (that of the 6man wg). Any comments will be highly appreciated (including off-list and posts to the nanog list). Thanks! Best regards, Fernando -------- Original Message -------- Subject: New Version Notification for draft-gont-6man-slaac-dns-config-issues-00.txt Date: Thu, 14 Jun 2012 18:36:26 -0700 From: internet-drafts(a)ietf.org To: fgont(a)si6networks.com CC: pavlix(a)pavlix.net A new version of I-D, draft-gont-6man-slaac-dns-config-issues-00.txt has been successfully submitted by Fernando Gont and posted to the IETF repository. Filename: draft-gont-6man-slaac-dns-config-issues Revision: 00 Title: Current issues with DNS Configuration Options for SLAAC Creation date: 2012-06-15 WG ID: Individual Submission Number of pages: 14 URL: http://www.ietf.org/internet-drafts/draft-gont-6man-slaac-dns-config-issues… Status: http://datatracker.ietf.org/doc/draft-gont-6man-slaac-dns-config-issues Htmlized: http://tools.ietf.org/html/draft-gont-6man-slaac-dns-config-issues-00 Abstract: RFC 6106 specifies two Neighbor Discovery options that can be included in Router Advertisement messages to convey information about DNS recursive servers and DNS Search Lists. Small lifetime values for the aforementioned options have been found to cause interoperability problems in those network scenarios in which these options are used to convey DNS-related information. This document analyzes the aforementioned problem, and formally updates RFC 6106 such that these issues are mitigated. The IETF Secretariat -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

DDI (DNS+DHCP+IPAM) Solutions
by Eric Cables 27 Jun '12

27 Jun '12

I'm looking to consolidate DNS/DHCP/IPAM into a single tool. Today I use IPPlan for IPAM, and have been reasonably happy with it over the last 5+ years, but I'd like to leverage the benefits of integrating DNS and DHCP for real-time information, along with a more supportable solution for my staff. It seems that InfoBlox and BlueCat are the top players, but maybe I'm being fooled by the hype. Can anyone respond with their experience with DDI in an Enterprise environment? Have the tools been useful/reliable? What is the pricing model?Replies can be on, or off, list. -- Eric Cables

5 4