- Test - lists.nanog.org

Re: Recent DNS attacks from China?
by Rob.Vercouteren＠kpn.com 30 Nov '11

30 Nov '11

Hello Leland, Yes we do see the same behavior! regards, Rob Vercouteren

3 3

Used your smartphone to log into your network?
by Rich Kulawiec 30 Nov '11

30 Nov '11

If so, this might be a good time to change passwords, and to review what other information has transited your phone. (Note: androidsecuritytest.com appears to be slashdotted at the moment.) November 16: initial reports of Carrier IQ spyware surface: CarrierIQ: Most Phones Ship With "Rootkit" http://yro.slashdot.org/story/11/11/16/1517248/carrieriq-most-phones-ship-w… The Rookit of All Evil http://www.xda-developers.com/android/the-rootkit-of-all-evil-ciq/ More on CarrierIQ http://www.xda-developers.com/android/more-on-carrier-iq/ all of which reference the research presented here: Carrier IQ http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ November 22: Carrier IQ threatens security researcher Trevor Eckhart: CarrierIQ Tries To Silence Security Researcher http://mobile.slashdot.org/story/11/11/23/0032233/carrieriq-tries-to-silenc… Mobile Rootkit Maker Tries to Silence Critical Android Dev http://www.wired.com/threatlevel/2011/11/rootkit-brouhaha/ November 24: Carrier IQ backs off its threats, says that it doesn't track Android users Carrier IQ Relents, Apologizes http://yro.slashdot.org/story/11/11/24/1852213/carrier-iq-relents-apologizes Carrier IQ retracts cease and desist letter sent to security researcher, says it doesn't track Android users http://www.theverge.com/2011/11/23/2583862/carrier-iq-retracts-cease-and-de… November 29: Further research by Trevor Eckhart shows Carrier IQ spyware logs ALL keystrokes Android Dev Demonstrates CarrierIQ Phone Logging Software On Video http://yro.slashdot.org/story/11/11/30/0423256/android-dev-demonstrates-car… Researcher's Video Shows Secret Software on Millions of Phones Logging Everything http://www.wired.com/threatlevel/2011/11/secret-software-logging-video The Storm Is Not Over Yet -- Lets Talk About #CIQ http://www.xda-developers.com/android/the-storm-is-not-over-yet-lets-talk-a… all of which reference this research: Carrier IQ Part 2 http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq… ---rsk

1 0

RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 30 Nov '11

30 Nov '11

Well, sometime yesterday www.centurylink.com removed it AAAA record(s). www.qwest.com still has them. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Monday, October 24, 2011 1:47 PM To: 'nanog(a)nanog.org' Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days Good news: access to the v6 version of www.qwest.com came up at 12:30 pm today -- it redirects to www.centurylink.com, but at least it's working. Only www.savvis.com remains in my list of service provider websites that have non-working IPv6. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Thursday, August 18, 2011 12:35 AM To: nanog(a)nanog.org Subject: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days The IPv6 version of www.qwest.com has been down for 10 days. Wget shows a 301 to www.centurylink.com, but that also fails. Emails to the nocs at both companies have gone unanswered. Unless HE is deployed in a web browser, this behavior leads to a bad end-user experience. If anyone can prod either of these two companies that would be much appreciated. Frank nagios:/home/fbulk# wget -6 www.qwest.com --2011-08-18 00:32:40-- http://www.qwest.com/ Resolving www.qwest.com... 2001:428:b21:1::20 Connecting to www.qwest.com|2001:428:b21:1::20|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: http://www.centurylink.com/ [following] --2011-08-18 00:32:40-- http://www.centurylink.com/ Resolving www.centurylink.com... 2001:428:b21:1::22 Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:02-- (try: 2) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:25-- (try: 3) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:49-- (try: 4) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. Etc...

1 0

Bandwidth prediction tool?
by Luis Palma 30 Nov '11

30 Nov '11

Hi, Does anyone know a good Bandwidth Prediction tool?. We have a DPI solution based on SCE8000 + SM/CM from Cisco and we are looking a tool that can take a data from Collector Manager Database and make traffic Bandwidth prediction and customer behavior prediction. Any idea will be welcome. Regards,

2 1

Equinix
by Keegan Holley 29 Nov '11

29 Nov '11

Assuming it's not owned by the NSA does anyone know the address of the equnix colo in the Denver area? I'm working on pricing access circuits into it. A contact from equinix would be helpful as well. We haven't gotten a response to our queries. Regards, Keegan

3 2

Computer Networks Special Issue on Botnets: Deadline Extended to Dec. 19
by Guofei Gu 29 Nov '11

29 Nov '11

CFP: Special Issue of COMPUTER NETWORS (ELSEVIER) on "Botnet Activity: Analysis, Detection and Shutdown" Apologies for multiple copies of this announcement. ------------------------- Dear Colleagues, Please consider the following opportunity to submit and publish original scientific results to a SPECIAL ISSUE of COMPUTER NETWORKS (ELSEVIER journal) on "Botnet Activity: Analysis, Detection and Shutdown". The submission deadline is extended to December 19, 2011. http://ees.elsevier.com/comnet/ A pdf version of this CFP is available at http://faculty.cse.tamu.edu/guofei/CFP_COMNET-Botnets.pdf Please help distribute. Thanks! ------------------------- Large scale attacks and criminal activities experienced in recent years have exposed the Internet to serious security breaches, and alarmed the world regarding cyber crime. In the center of this problem are the so called botnets -- collections of infected zombie machines (bots) controlled by the botmaster to perpetrate malicious activities and massive attacks. Some recent botnets are composed of millions of infected machines, making use of this attack vector inevitably harmfully. Hence, it is paramount to detect, analyze and shutdown such overlay networks before they become active. Research on botnet activity is mostly related to detection and disruption. Detection of botnets has focused on monitoring bot activities, especially during the spread of malicious software to infect new hosts (initial infection phase) and the communication messages exchanged between bots and botmasters (rallying and updating phases). Some behavioral aspects are common: bots have to signal the botmaster informing they are alive, each time their hosts are started; bots send messages whenever connecting and joining with the botnet; the botmaster has to send commands to each zombie machine before initiating malicious activities. This special issue of Computer Networks is intended to foster the dissemination of high quality research in all aspects regarding botnet activity, detection and countermeasures. The objective of this special issue is to publish papers presenting detection algorithms, traffic monitoring and identification, protocols and architectures, as well as botnet modeling, behavior, simulation, statistics, dissemination, analysis, preventive procedures and possible countermeasures. Only technical papers describing previously unpublished, original, state-of-the-art research, and not currently under review by a conference or journal will be considered. We solicit papers in a variety of topics related to botnet research including, but not limited to: - Traffic Monitoring and Detection Algorithms - Data Collection, Statistics and Analysis - Modeling Behavior and Simulation - Protocols and Architectures (IRC, HTTP, P2P, etc) - Firewalls and IDS - Cyber Crime Case Studies - Reverse Engineering and Automated Analysis of Bots - Honeypots and Honeynets - New Platforms: Cellular and Wireless networks, Mobile devices, TV, etc. - Legal Issues and Countermeasures - Underground Markets, Vulnerability Markets and Zero-day Economics - Mini-Botnets Guest Editors Ronaldo Salles Military Institute of Engineering PraçGeneral Tibú 80, 22290-270, R.J. Brazil salles(a)ieee.org Guofei Gu Texas A&M University 3112 TAMU, HRBB College Station, TX 77843-3112 USA guofei(a)cse.tamu.edu Thorsten Holz Ruhr-University Bochum Universitatsstrasse 150, 44780 Bochum Germany thorsten.holz(a)rub.de Morton Swimmer Trend Micro Deutschland, GmbH Zeppelinstr. 1 85399 Hallbergmoos - Germany swimmer(a)acm.org Paper submission: 19th Dec 2011 Acceptance notification: 19th Mar 2012 Final papers: 19th May 2012 Submission format The submitted papers must be clearly written in excellent English and describe original research which is not published nor currently under review by other journals or conferences. Author guidelines for preparation of manuscript can be found at www.elsevier.com/locate/comnet/ Submission Guideline All manuscripts and any supplementary material should be submitted through the Elsevier Editorial System (EES). The authors must select "Special Issue: Botnets" when they reach the Article Type step in the submission process. The EES website is located at: http://ees.elsevier.com/comnet/ Guide for Authors This site will guide you stepwise through the creation and uploading of you article. The guide for Authors can be found on the journal homepage (www.elsevier.com/comnet/)

1 0

PPPOE dialer issue on Cisco C2811
by Meftah Tayeb 29 Nov '11

29 Nov '11

Hey folks please can someone see this issue i'm veery stuck on that: i have a C2811 with ADSL line created a dialer interface assigned to a fast ethernet (fe0/0) connected sucsessfully nated my lan network (172.28.0.0/24) the dialer is outside and my fe0/1 is inside but i can access (ONLY) google services! i guess is that a MTU issue? if yes what should i use ? tried 1492 1480 1500 and 1504 same hell at all. here's my config: Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6671 (20111130) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

1 0

DNS 8.8.8.8 was down
by Denys Fedoryshchenko 29 Nov '11

29 Nov '11

Google DNS was down few minutes, at least for few European locations Here is sample traceroute: 4 213.242.116.25 (213.242.116.25) 39.692 ms 39.776 ms 39.774 ms 5 ae-7-7.ebr1.Paris1.Level3.net (4.69.143.238) 50.933 ms 50.792 ms 50.793 ms 6 ae-47-47.ebr1.London1.Level3.net (4.69.143.109) 57.353 ms ae-45-45.ebr1.London1.Level3.net (4.69.143.101) 57.580 ms ae-48-48.ebr1.London1.Level3.net (4.69.143.113) 57.582 ms 7 ae-57-112.csw1.London1.Level3.net (4.69.153.118) 57.577 ms ae-58-113.csw1.London1.Level3.net (4.69.153.122) 57.693 ms ae-57-112.csw1.London1.Level3.net (4.69.153.118) 57.817 ms 8 ae-1-51.edge3.London1.Level3.net (4.69.139.73) 57.654 ms 57.631 ms 57.768 ms 9 unknown.Level3.net (212.113.15.186) 57.958 ms 57.531 ms 57.643 ms 10 209.85.255.78 (209.85.255.78) 57.732 ms 57.598 ms 57.573 ms 11 209.85.253.92 (209.85.253.92) 58.300 ms 209.85.253.196 (209.85.253.196) 57.941 ms 209.85.253.94 (209.85.253.94) 58.002 ms 12 72.14.232.134 (72.14.232.134) 63.726 ms 66.249.95.173 (66.249.95.173) 63.614 ms 72.14.232.134 (72.14.232.134) 63.699 ms After this hop it was dead, now it is working, but seems still there is minor problems 14 216.239.46.117 (216.239.46.117) 64.171 ms * * 15 google-public-dns-a.google.com (8.8.8.8) 63.749 ms 63.729 ms 63.680 ms --- System administrator Denys Fedoryshchenko Virtual ISP S.A.L.

3 2

Network device command line interfaces
by Jonathon Exley 28 Nov '11

28 Nov '11

Does anyone else despair at the CLIs produced by networking vendors? Real routers use a CLI that is command based, like IOS, TiMOS or Junos. These interfaces work well over low bandwidth connections (unlike web interfaces), can work with config backup systems like RANCID, have a (mostly) consistent structure and good show commands. However vendors of low cost routers/switches/muxes seem to take a stab in the dark and produce some really nasty stuff. I have a personal hate of text based menus and binary config backup files. Doe this p*** off anyone else? The business part of the company says "This device is great! It's cheap and does everything." However the poor sap who is given the task to make it work has to wrestle with a badly designed user interface and illogical syntax. Maybe the vendors need some sort of best practices guide for what manageability features their kit needs to support to make them acceptable to the market. Does anyone know if there is anything along these lines? Jonathon. This email and attachments: are confidential; may be protected by privilege and copyright; if received in error may not be used, copied, or kept; are not guaranteed to be virus-free; may not express the views of Kordia(R); do not designate an information system; and do not give rise to any liability for Kordia(R).

18 23

Water Utility SCADA 'Attack': The, um, washout
by Jay Ashworth 28 Nov '11

28 Nov '11

Not an attack: an already failing pump, and an employee of a contractor to the utility who was ... wait for it ... traveling in Russia on personal business. WaPo via Lauren @ Privacy: http://j.mp/rrvMXR Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

10 14