- Test - lists.nanog.org

New botnet launch?
by Drew Weaver 19 Feb '10

19 Feb '10

All, We noticed at around midnight for a brief period of time and around 6AM EST for an extended period that several hosted customer servers (4 completely different customers) launched quite a campaign doing 100Mbps during these times (on 100Mbps ports). The thing I find 'suspicious' is that all of the machines connected Interfaces said they were sending out 200Mbps (on 100Mbps links) and that they all had the same exact traffic profile (MRTG, etc). 5 minute input rate 213353000 bits/sec, 18516 packets/sec 5 minute output rate 583000 bits/sec, 855 packets/sec Anyone else see this or am I just very lucky? thanks, -Drew

2 2

AS33259 leaking
by Matsuzaki Yoshinobu 19 Feb '10

19 Feb '10

Hi, Does anyone know a contact for AS33259? It seems the AS33259 is leaking a bunch of prefixes in error, and this caused reachability problems. ----- Matsuzaki Yoshinobu <maz(a)iij.ad.jp> - IIJ/AS2497 INOC-DBA: 2497*629

3 3

multicast beacon group seeing extremely high traffic
by Antonio Querubin 19 Feb '10

19 Feb '10

Any multicast networks seeing a large amount of traffic for the beacon group 233.4.200.18? Starting approximately 0730 GMT, we started receiving more than 12 Mbps for that group which normally is far less. Group: 233.4.200.18, (?) Source: 64.251.63.189 (mcast.cen.ct.gov) Rate: 1095 pps/606 kbps(1sec), 567 kbps(last 30 secs), 631 kbps(life avg) Source: 128.105.40.15 (mbone-test.cs.wisc.edu) Rate: 1020 pps/553 kbps(1sec), 405 kbps(last 40 secs), 450 kbps(life avg) Source: 128.109.1.249 (ws-beacon.ncren.net) Rate: 846 pps/364 kbps(1sec), 349 kbps(last 40 secs), 384 kbps(life avg) Source: 128.109.3.228 (wil-beacon.ncren.net) Rate: 786 pps/339 kbps(1sec), 203 kbps(last 40 secs), 241 kbps(life avg) Source: 128.109.16.117 (gb-beacon.ncren.net) Rate: 758 pps/326 kbps(1sec), 306 kbps(last 40 secs), 328 kbps(life avg) Source: 128.109.58.21 (ecu-beacon.ncren.net) Rate: 509 pps/221 kbps(1sec), 297 kbps(last 40 secs), 331 kbps(life avg) Source: 128.135.122.108 (g217display.bsd.uchicago.edu) Rate: 840 pps/495 kbps(1sec), 376 kbps(last 40 secs), 442 kbps(life avg) Source: 128.182.160.60 (arsenal.psc.edu) Rate: 1084 pps/595 kbps(1sec), 280 kbps(last 40 secs), 366 kbps(life avg) Source: 129.78.221.17 (crayon.ucc.usyd.edu.au) Rate: 9 pps/4 kbps(1sec), 4 kbps(last 40 secs), 5 kbps(life avg) Source: 129.96.120.11 (?) Rate: 9 pps/4 kbps(1sec), 3 kbps(last 40 secs), 4 kbps(life avg) Source: 129.127.96.120 (beacon.sapac.edu.au) Rate: 10 pps/5 kbps(1sec), 5 kbps(last 40 secs), 5 kbps(life avg) Source: 130.102.78.179 (vv2.vislab.uq.edu.au) Rate: 10 pps/5 kbps(1sec), 6 kbps(last 40 secs), 6 kbps(life avg) Source: 130.207.166.66 (pulsar.noc.gatech.edu) Rate: 843 pps/364 kbps(1sec), 346 kbps(last 40 secs), 360 kbps(life avg) Source: 130.220.64.249 (dawn.ml.unisa.edu.au) Rate: 8 pps/4 kbps(1sec), 4 kbps(last 50 secs), 5 kbps(life avg) Source: 134.129.95.122 (netmenderx.cc.ndsu.NoDak.edu) Rate: 1094 pps/608 kbps(1sec), 314 kbps(last 50 secs), 342 kbps(life avg) Source: 138.23.2.53 (kaon.ucr.edu) Rate: 20 pps/13 kbps(1sec), 10 kbps(last 50 secs), 10 kbps(life avg) Source: 139.86.2.226 (?) Rate: 11 pps/7 kbps(1sec), 5 kbps(last 50 secs), 6 kbps(life avg) Source: 141.142.2.55 (jhereg.ncsa.uiuc.edu) Rate: 999 pps/670 kbps(1sec), 360 kbps(last 50 secs), 400 kbps(life avg) Source: 144.174.29.10 (accessgrid.sc.fsu.edu) Rate: 1158 pps/730 kbps(1sec), 531 kbps(last 50 secs), 553 kbps(life avg) Source: 144.174.29.11 (ag1.sc.fsu.edu) Rate: 878 pps/637 kbps(1sec), 487 kbps(last 50 secs), 532 kbps(life avg) Source: 144.174.29.12 (ag2.sc.fsu.edu) Rate: 232 pps/102 kbps(1sec), 411 kbps(last 50 secs), 428 kbps(life avg) Source: 152.2.255.225 (beacon.net.unc.edu) Rate: 853 pps/619 kbps(1sec), 413 kbps(last 50 secs), 459 kbps(life avg) Source: 155.98.194.254 (ebc.mc-beacon.utah.edu) Rate: 1074 pps/658 kbps(1sec), 447 kbps(last 50 secs), 447 kbps(life avg) Source: 155.101.3.100 (multicast.chpc.utah.edu) Rate: 476 pps/333 kbps(1sec), 339 kbps(last 50 secs), 388 kbps(life avg) Source: 161.45.190.10 (ns-beacon.mtsu.edu) Rate: 947 pps/534 kbps(1sec), 474 kbps(last 50 secs), 439 kbps(life avg) Source: 192.17.24.169 (faranth.ci.uiuc.edu) Rate: 939 pps/591 kbps(1sec), 426 kbps(last 50 secs), 442 kbps(life avg) Source: 192.43.244.8 (npad.ucar.edu) Rate: 1157 pps/716 kbps(1sec), 574 kbps(last 50 secs), 612 kbps(life avg) Source: 192.65.130.134 (black.ivec.org) Rate: 11 pps/7 kbps(1sec), 7 kbps(last 0 secs), 5 kbps(life avg) Source: 192.88.114.244 (nic.3rox.net) Rate: 962 pps/548 kbps(1sec), 548 kbps(last 0 secs), 453 kbps(life avg) Source: 205.127.87.150 (zoot.uen.net) Rate: 1100 pps/611 kbps(1sec), 611 kbps(last 0 secs), 512 kbps(life avg) Antonio Querubin 808-545-5282 x3003 e-mail/xmpp: tony(a)lava.net

1 0

Tahiti's OPT ASN?
by Scott Weeks 19 Feb '10

19 Feb '10

Anyone got the ASN of Office des Postes et Télécommunications in French Polynesia? I'm having a heck of a time looking for it in APNIC. scott

2 1

Re: several messages
by Michelle Sullivan 19 Feb '10

19 Feb '10

Dean Anderson wrote: > [Damn. spit out my coffee on keyboard.] > > Levine and Vixie are partners in Whitehat. Whitehat is a commercial bulk > mailer that offers listwashing services (removing spam-traps). MAPS > employees were involved in listwashing. MAPS, Spamhaus, SORBS do not > block Whitehat, suggesting that the spamtraps removed come from > MAPS/Spamhaus/SORBS > LOL Dean's really lost it finally (if he hadn't before.) SORBS does not 'not block' anyone (many on here will attest to that) no one is to big or too small to get listed in SORBS. ..but more importantly, and almost on topic unlike Dean's entire post... I thought Dean was banned for his off continual off topic posts and all the attacks on other people and organisations? Michelle

4 4

Re: Spamhaus and Barracuda Networks BRBL
by Joel M Snyder 19 Feb '10

19 Feb '10

Dean Drako wrote: >We make no claims about it being better >or worse than any other RBL. I have some objective data based on our testing here. Over the past 18 months, Barracuda's block rate is 81.9%, while Spamhaus' is 83.3%. For whatever measurement error you want to include, that says that they are roughly equivalent. Over the past 6 months, BRBL is actually getting better: their block rate is 87%, while Spamhaus is 82%. There is, of course, a catch. BRBL gets a higher rate, but at a substantially higher false positive (FP) rate. We normalize FPs per 10,000 messages our measurements. Over the last 18 months, BRBL was 4.1 FP/10K messages; Spamhaus 0.2 FP/10K messages. Again, BRBL is getting better: over the past 6 months, BRBL went down to 1.6 FP/10K messages, while Spamhaus is about the same at 0.3 FP/10K messages. So, depending on your definition of "better," you could either say "BRBL is better" or "BRBL is worse." It would generally depend on your sensitivity to FPs. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

2 1

dns interceptors
by Randy Bush 18 Feb '10

18 Feb '10

i just lost ten minutes debugging what i thought was a server problem which turned out to be a dns trapper on the wireless in the changi sats lounge. this is not the first time i have been caught by this. what are other roaming folk doing about this? randy

21 27

Please Ignore Re: Tahiti's OPT ASN?
by Scott Weeks 18 Feb '10

18 Feb '10

--- surfer(a)mauigateway.com wrote: ------ Anyone got the ASN of Office des Postes et Télécommunications in French Polynesia? I'm having a heck of a time looking for it in APNIC. ------------------------------------------- Apologies for the noise. I found it at http://multicasttech.com/status/asn_expand.txt just after sending this: 9471 scott

1 0

Latest Cisco for small dual homed ASN
by James Smallacombe 18 Feb '10

18 Feb '10

I have a customer that is looking at using BGP for their network; one connection over a few bonded T1s, the other over a Comcast Enterprise connection (which supposedly will do BGP now). When I was dual homed a few years ago, a 7204VXR with 256MB was more than adequate. With routing tables growing the way they are, what's a good Cisco based solution on the lower end of the price spectrum that should handle this fine for a few years? Somebody else is suggesting a Vyatta (Linux based) solution, which makes me a little nervous. Then again, Linux has improved dramatically from a security and stability P.O.V, so maybe it's worth a look if there's no hard drive involved. TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

6 5

Austin
by Larry Sheldon 18 Feb '10

18 Feb '10

Any of the Austin contingent near the IRS office? Everybody OK? -- "Government big enough to supply everything you need is big enough to take everything you have." Remember: The Ark was built by amateurs, the Titanic by professionals. Requiescas in pace o email Ex turpi causa non oritur actio Eppure si rinfresca ICBM Targeting Information: http://tinyurl.com/4sqczs http://tinyurl.com/7tp8ml

1 0