- Test - lists.nanog.org

Targeted Phishing Attack
by J.D. Falk 29 Nov '10

29 Nov '10

Last week, the security team at Return Path discovered that we were the source of a list of addresses used in a targeted phishing attack against a number of ESPs. We're sharing the results of our investigation with the larger community, in order to help others avoid similar attacks. I'm including NANOG in this distribution because, even though this particular attack was focused on mail operators, the same tactics could work equally well on network operators. http://www.returnpath.net/blog/received/2010/11/phishing-attack-an-open-let… -- J.D. Falk Internet Standards & Governance Return Path

1 0

Re: Cacti Bandwidth Monitoring
by jkrejci＠usinternet.com 29 Nov '10

29 Nov '10

Might also look into the fix64bit plugin for cacti to modify your existing 32bit graphs so you don't have recreate them and all the extra changes you may need such as adding to graph trees, updating reports, thresholds, etc. ------Original Message------ From: Peter Rudasingwa To: Bill Blackford To: nanog(a)nanog.org Subject: Re: Cacti Bandwidth Monitoring Sent: Nov 29, 2010 9:50 AM Thanks to all. I used the 64 bit template and it's now working fine. Peter R. Bill Blackford wrote: > Sounds like you need to use the 64 bit templates as your data may be > "rolling over". > -b > -- Best Regards, Peter Rudasingwa *ALTECH STREAM RWANDA Ltd* ICT Park Boulevard de L'Umuganda P.O.Box 6098 Kigali, Rwanda Telephone: (+250) 580532/5 Mobile: (+250) 0788406685 ------------------------------------ *Affordable Broadband Solutions* Sent via BlackBerry from T-Mobile

2 1

Facebook and Yahoo contact
by Roman 29 Nov '10

29 Nov '10

Hi, Is there anyone from Facebook and Yahoo dealing with hosting their mirror site in IX. Please contact off list. Thanks Rom

1 0

Network Planning Tool
by William Jobs 29 Nov '10

29 Nov '10

In terms of network planning tools three names appear to be at the top of the list namely: - Cariden MATE - Opnet SP Guru Network Planner - WANDL IP/MPLS View We are currently considering all of them and I would appreciate any feedback from those who have experience with any/all of them (whether on or off-list). Thanks.

1 0

Re: wikileaks unreachable
by andrew.wallace 29 Nov '10

29 Nov '10

Hi Nanog, Some more information here - http://www.reddit.com/r/netsec/comments/ecwnn/wikileaks_hacked_ahead_of_sec… The hacker has featured previously in a news article on his attack platform - https://www.infosecisland.com/blogview/3258-Hacker-Releases-Second-Video-of… Regards, Andrew ----- Original Message ----- From:Joel Esler <joel.esler(a)me.com> To:Marshall Eubanks <tme(a)americafree.tv> Cc:North American Network Operators Group <nanog(a)nanog.org> Sent:Monday, 29 November 2010, 1:56:34 Subject:Re: wikileaks unreachable I've heard it's a DOS (not DDOS) according to twitter. Allegedly according to the person doing the DOS: Just so we are all straight and clear - wikileaks hit is not a 'Distributed' DoS, its a simple DoS - I dont use intermediaries or botnets. Sun Nov 16 - 15:28 EST http://twitter.com/th3j35t3r Joel On Nov 28, 2010, at 6:42 PM, Marshall Eubanks wrote: > > On Nov 28, 2010, at 5:19 PM, Wil Schultz wrote: > >> DOS is probably because they released some more stuff. >> >> "Secret US Embassy Cables" >> http://cablegate.wikileaks.org/ >> > > DDOS according to this > > http://www.securityweek.com/wikileaks-under-denial-service-attack-ddos > > Regards > Marshall > >> -wil >> >> On Nov 28, 2010, at 1:38 PM, James Downs wrote: >> >>> >>> On Nov 28, 2010, at 1:34 PM, Randy Bush wrote: >>> >>>> anyone know why https://www.wikileaks.org/ is not reachable? nations >>>> state level censors trying to close the barn door after the horse has >>> >>> Reported they were under attack: http://bgg.lv/h2pmsd >>> >>> >> >> >> > >

2 1

Re: wikileaks unreachable
by Joshua.Klubi＠gmail.com 28 Nov '10

28 Nov '10

better late than never -- Sent from my Nokia N900 using Nokia Messaging ----- Original message ----- > I'm surprised it took this long for the DDoS train to pull into the > station. > > Jeff > > On Sun, Nov 28, 2010 at 4:38 PM, James Downs <egon(a)egon.cc> wrote: > > > > On Nov 28, 2010, at 1:34 PM, Randy Bush wrote: > > > > > anyone know why https://www.wikileaks.org/ is not reachable? nations > > > state level censors trying to close the barn door after the horse has > > > > Reported they were under attack: http://bgg.lv/h2pmsd > > > > > > > > > > -- > Jeffrey Lyon, Leadership Team > jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net > Black Lotus Communications - AS32421 > First and Leading in DDoS Protection Solutions >

1 0

Switches Configuration
by sharon saadon 28 Nov '10

28 Nov '10

Hi, An online Config generator for juniper Nortel and Cisco Switches ( My Develop :) ) You can see it at - http://www.sharontools.com/tools/ConfigGenerator/ConfigGenerator.php Sharon

2 1

<Free Ping services that test your servers Availability from the Internet>
by Michael Ruiz 28 Nov '10

28 Nov '10

Hey folks, I had a situation recently that our network went down and our Network Monitoring software did not notify us that the network was down because the internet connection went down. We had a problem with our carrier where they messed up on our /23(where our Network Monitoring software resides), when they did a maintenance. What transpired is our /23 was no longer routing to us. Is there a free ping internet service, or something that we can pay a company that just sends a ping to devices? If they fail to respond, then an email is sent to us? Thank you folks. M.A.R Senior Network Engineer

7 6

Re: Re: Network management software with high detailed traffic report
by Ivan Brunello 27 Nov '10

27 Nov '10

Sure it upsets. We have a bunch of average-populated 6500s, using the default max age (which was, as far as I remember, 5) made the switches very slow in responding to SNMP queries. set them to 10, and, Gotcha! everything works very well. ivan > Date: Tue, 23 Nov 2010 14:25:25 +0200 > From: Tassos Chatzithomaoglou <achatz(a)forthnet.gr> > Subject: Re: Network management software with high detailed traffic > report > To: nanog(a)nanog.org > Message-ID: <4CEBB2B5.5090507(a)forthnet.gr> > Content-Type: text/plain; charset=UTF-8; format=flowed > > There is also CSCsg23226 which might be related. > > -- > Tassos > > > Nick Hilliard wrote on 23/11/2010 01:35: >> On 22/11/2010 22:56, Tassos Chatzithomaoglou wrote: >>> Does "service counters max age" help in any way?* >>> *According to Cisco, setting it too low might upset the snmp counters.* >> >>> https://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_r1.h… >>> >> >> The "Usage Guidelines" are instructive. :-) >> >> Although the update interval defaults to 5 seconds, it still appears >> to update every 9 seconds on my boxes. >> >> Nick >> >>

9 16

BGP Update Report
by cidr-report＠potaroo.net 26 Nov '10

26 Nov '10

BGP Update Report Interval: 18-Nov-10 -to- 25-Nov-10 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS4795 43590 3.0% 180.1 -- INDOSATM2-ID INDOSATM2 ASN 2 - AS14420 37234 2.5% 64.1 -- CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP 3 - AS32528 22924 1.6% 7641.3 -- ABBOTT Abbot Labs 4 - AS8402 22634 1.5% 12.5 -- CORBINA-AS Corbina Telecom 5 - AS4761 18907 1.3% 187.2 -- INDOSAT-INP-AP INDOSAT Internet Network Provider 6 - AS35931 13901 0.9% 4633.7 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 7 - AS22767 13748 0.9% 3437.0 -- NASA-ESDIS-NET - National Aeronautics and Space Administration 8 - AS9498 13424 0.9% 39.5 -- BBIL-AP BHARTI Airtel Ltd. 9 - AS5800 11013 0.8% 50.5 -- DNIC-ASBLK-05800-06055 - DoD Network Information Center 10 - AS15978 10716 0.7% 3572.0 -- BOBST Group autonomous system 11 - AS9829 10594 0.7% 38.2 -- BSNL-NIB National Internet Backbone 12 - AS17974 10514 0.7% 13.4 -- TELKOMNET-AS2-AP PT Telekomunikasi Indonesia 13 - AS4771 10149 0.7% 29.2 -- NZTELECOM Netgate 14 - AS10094 9106 0.6% 350.2 -- BRUNET-AS BruNet ISP, Telekom Brunei Berhad 15 - AS14522 9026 0.6% 25.6 -- Satnet 16 - AS36992 8386 0.6% 13.4 -- ETISALAT-MISR 17 - AS9794 7070 0.5% 124.0 -- DNET-ID-AP PT. Core Mediatech (D-NET) 18 - AS9443 7049 0.5% 4.8 -- INTERNETPRIMUS-AS-AP Primus Telecommunications 19 - AS3816 7017 0.5% 86.6 -- COLOMBIA TELECOMUNICACIONES S.A. ESP 20 - AS6316 7015 0.5% 259.8 -- AS-PAETEC-NET - PaeTec Communications, Inc. TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS32528 22924 1.6% 7641.3 -- ABBOTT Abbot Labs 2 - AS48561 4710 0.3% 4710.0 -- AUTOMIR-AS NP Automir CJSC 3 - AS35931 13901 0.9% 4633.7 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 4 - AS15978 10716 0.7% 3572.0 -- BOBST Group autonomous system 5 - AS22767 13748 0.9% 3437.0 -- NASA-ESDIS-NET - National Aeronautics and Space Administration 6 - AS9476 6830 0.5% 3415.0 -- INTRAPOWER-AS-AP IntraPower Pty. Ltd. 7 - AS47919 3347 0.2% 3347.0 -- UKRGASBANK-AS UKRGASBANK AS 8 - AS36059 3080 0.2% 3080.0 -- MEDMANAGEMENT-LLC - MedManagement, LLC 9 - AS17904 2883 0.2% 2883.0 -- SLTASUL-LK Sri Lankan Airlines 10 - AS37045 2385 0.2% 2385.0 -- tznic 11 - AS49600 2297 0.2% 2297.0 -- LASEDA La Seda de Barcelona, S.A 12 - AS15984 2129 0.1% 2129.0 -- The Joint-Stock Commercial Bank CentroCredit. 13 - AS45293 3183 0.2% 1591.5 -- UT-AS-ID Universitas Terbuka 14 - AS34239 1424 0.1% 1424.0 -- INTERAMERICAN General Insurance Company 15 - AS28175 2617 0.2% 1308.5 -- 16 - AS43534 3482 0.2% 1160.7 -- CREDITCALL CreditCall Ltd 17 - AS26746 685 0.1% 685.0 -- HARVARD-PILGRIM-HEALTH-CARE - Harvard Community Health Plan 18 - AS9929 3298 0.2% 659.6 -- CNCNET-CN China Netcom Corp. 19 - AS36961 586 0.0% 586.0 -- ZIPNET 20 - AS39200 551 0.0% 551.0 -- IRNICANYCAST-AS .ir ccTLD of Iran TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 202.92.235.0/24 12488 0.8% AS9498 -- BBIL-AP BHARTI Airtel Ltd. 2 - 130.36.34.0/24 11462 0.7% AS32528 -- ABBOTT Abbot Labs 3 - 130.36.35.0/24 11461 0.7% AS32528 -- ABBOTT Abbot Labs 4 - 63.211.68.0/22 8833 0.6% AS35931 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 5 - 216.126.136.0/22 6937 0.4% AS6316 -- AS-PAETEC-NET - PaeTec Communications, Inc. 6 - 192.107.195.128/ 6879 0.4% AS22767 -- NASA-ESDIS-NET - National Aeronautics and Space Administration 7 - 169.154.197.128/ 6857 0.4% AS22767 -- NASA-ESDIS-NET - National Aeronautics and Space Administration 8 - 190.65.228.0/22 6231 0.4% AS3816 -- COLOMBIA TELECOMUNICACIONES S.A. ESP 9 - 195.2.198.0/23 4710 0.3% AS48561 -- AUTOMIR-AS NP Automir CJSC 10 - 198.140.43.0/24 4604 0.3% AS35931 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 11 - 195.141.217.0/24 3572 0.2% AS15978 -- BOBST Group autonomous system 12 - 195.95.141.0/24 3572 0.2% AS15978 -- BOBST Group autonomous system 13 - 195.189.204.0/23 3572 0.2% AS15978 -- BOBST Group autonomous system 15 - 206.184.16.0/24 3485 0.2% AS174 -- COGENT Cogent/PSI 16 - 91.197.95.0/24 3478 0.2% AS43534 -- CREDITCALL CreditCall Ltd 17 - 91.208.198.0/24 3347 0.2% AS47919 -- UKRGASBANK-AS UKRGASBANK AS 18 - 203.1.13.0/24 3264 0.2% AS9476 -- INTRAPOWER-AS-AP IntraPower Pty. Ltd. 19 - 203.153.49.0/24 3156 0.2% AS45293 -- UT-AS-ID Universitas Terbuka 20 - 12.107.148.0/24 3080 0.2% AS36059 -- MEDMANAGEMENT-LLC - MedManagement, LLC Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0