- Test - lists.nanog.org

apops sep 4-8 kaohsiung, taiwan
by Randy Bush 31 May '06

31 May '06

apops and apnic will meet 2006.09.04-08 in kaohsiung, taiwan, see <http://www.apnic.net/meetings/22/index.html> the technical-but-not-policy content that used to be in the apnic sigs is being moved to the apops part of the meeting. this should make for a more ops/research-fun nanog-like event. any ops or research folk who are going, or might be, and would be willing to present, it would be much appreciated. randy

1 0

Re: Black Frog - the botnets keep coming
by Fergie 30 May '06

30 May '06

Sorry, this is not acceptable, regardless of national boundaries. And it will be fought against, regardless of where it originates, or resides. Always. I do not condone collateral damage strategies in this regard, but suggesting that a "wild, wild west" Internet is something that will be a contimuum -- it cannot be, and will not be. As such, I also do not condone such activities as Blue/Black Frog suggest, as it is completely contrary to established practices of mitigation (and removal). - ferg p.s. Now if we could only get the registries onboard... -- "Alexei Roudnev" <alex(a)relcom.net> wrote: Internet IS a wild west. You should live with it. It will never be _quet, dead american's residential area, where dogs do not bark and kids do not play themself on streets in age of 8 (normal dogs bark, and normal kids often play themself when they are 8)_. It is the whole WORLD, not one country. So, we must live with it, and do not hope, that it will have numerous _speed tickets_ and _police officers_ (as 90% of the people live every day, making their own decisions and protecting themselves. It is, in fact, a very effectiv way to stop spammers. But it definitely became a dangerous DDOS service. So - learn how to live with it, it's the only choice. (Make sure, that no single protocol or botnet can kill the whole network or deplete all resources, for example). [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Fwd: 41/8 announcement
by Richard Mikisa 30 May '06

30 May '06

This came in from someone in Italy.. ---------- Forwarded message ---------- From: ***** Date: May 24, 2006 11:15 AM Subject: Re: 41/8 announcement To: rmikisa(a)gmail.com > >Turns out the folks at fastweb (Italy) NAT there adsl clients but > >instead of using the rfc1918 space like most people, they use > >unassigned > >global /8s. Well 41/8 is one of there NATted allocations for Turin. No > >amount of emails will get them to respond, calling isn't any better > >as I > >get only Italian speaking people at the other end. Any ideas out > >there? Yes: you lose, sorry. :-) Many of their networking people are less than clueful, and I fear that they are not going to renumber a whole city just to let their customers communicate with a few African networks... Let me know if you need more information. (Feel free to repost this if needed, but please remove my name.) -- ciao, ******* -- cheers Richard

11 13

Are botnets relevant to NANOG?
by Michael.Dillon＠btradianz.com 30 May '06

30 May '06

In recent discussions about botnets, some people maintained that botnets (and viruses and worms) are really not a relevant topic for NANOG discussion and are not something that we should be worried about. I think that the CSI and FBI would disagree with that. In a press release announcing the last CSI/FBI survey http://www.gocsi.com/press/20050714.jhtml the following statement appears: Highlights of the 2005 Computer Crime and Security Survey include: - The total dollar amount of financial losses resulting from security breaches is decreasing, with an average loss of $204,000 per respondent-down 61 percent from last year's average loss of $526,000. - Virus attacks continue as the source of the greatest financial losses, accounting for 32 percent of the overall losses reported. - Unauthorized access showed a dramatic increase and replaced denial of service as the second most significant contributor to computer crime losses, accounting for 24 percent of overall reported losses, and showing a significant increase in average dollar loss. So where do botnets come in? First of all, botnets are used to distribute viruses, the largest source of financial losses. Second, botnets are built on what the CSI calls "unauthorised access", the second largest source of loss. And denial of service, which used to be the 2nd largest, is also something that botnets do. Now NANOG members cannot change OS security, they can't change corporate security practices, but they can have an impact on botnets because this is where the nefarious activity meets the network. Therefore, I conclude that discussions of botnets do belong on the NANOG list as long as the NANOG list is not used as a primary venue for discussing them. One thing that surveys, such as the CSI/FBI Security Survey, cannot do well is to measure the impact of botnet researchers and the people who attempt to shut down botnets. It's similar to the fight against terrorism. I know that there have been 2 terrorist attacks on London since 9/11 but I don't know HOW MANY ATTACKS HAVE BEEN THWARTED. At least two have been publicised but there could be dozens more. Cleaning up botnets is rather like fighting terrorism. At the end, you have nothing to show for it. No news coverage, no big heaps of praise. Most people aren't sure there was ever a problem to begin with. That doesn't mean that the work should stop or that network providers should withold their support for cleaning up the botnet problem. ------------------------------------------------------- Michael Dillon Capacity Management, 66 Prescot St., London, E1 8HG, UK Mobile: +44 7900 823 672 Internet: michael.dillon(a)btradianz.com Phone: +44 20 7650 9493 Fax: +44 20 7650 9030 http://www.btradianz.com One Community One Connection One Focus

6 11

Re: Are botnets relevant to NANOG?
by Fergie 30 May '06

30 May '06

Not effective against botnets. Think of it this way, thousands of compromised hosts (zombies), distributed to the four corners of the Internet, hundreds (if not thousands) of AS's -- all recieving their instructions via IRC from a C&C server somewhere, that probably also may change due to dynamic DNS, or pump-and-dump domain registrations, or any other various ways to continually move the C&C. Simply going after (what may _seem_to_be_) the last-hop router is like swinging a stick after a piñata that you can't actually reach when you are blind-folded. :-) - ferg -- Peter Dambier <peter(a)peter-dambier.de> wrote: Just an afterthought, traceroute and take the final router. I guess for aDSL home users you will find some 8 or 11 routers in germany. My final router never changes. Of course there can hide more than one bad guy behind that router. [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 7

in.dnsbl.org must not be used for mail filtering
by Mark Jeftovic 29 May '06

29 May '06

in.dnsbl.org was created several years ago for commercial DNS providers to share information about problem domains and to offer a mechanism to prevent abusers from hopping from DNS provider to provider. Under no circumstances should it be used by any MTA for mail filtering in any capacity whatsoever. Absolutely no vetting goes into in.dnsbl.org listing and domains can get listed for internal reasons which are purely meaningless in an email context. Over the years some big name domains have wound up in the in.dnsbl.org zone for reasons which have absolutely nothing to do with email and simply for inter-provider communications between the DNSBL.org members. In short, using in.dnsbl.org on any MTA is an act of mind-numbing recklessness. Don't do it. Thank you for your time. -mark -- Mark Jeftovic <markjr(a)easydns.com> Founder & President, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(866) 273-2892

1 0

PSTN Breakout/Breakin hosting service
by shashi.pkumar＠wipro.com 29 May '06

29 May '06

Hi, Service providers who host PSTN break-out/Break-in services i.e., service providers who accepts SIP traffic from another hosted/Private network and provide PSTN breakout functionality and visa versa, please contact me offline. Thanks Shashi The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Re: Botnet List Discussed on NANOG
by Peter Dambier 29 May '06

29 May '06

Hi Sat, your mailer does not like me. If it is interesting for you, please forward. Kind regards Peter and Karin Dambier <Bianca.Miller(a)telecom.co.nz>: 146.171.13.195_does_not_like_recipient. /Remote_host_said:_554_Service_unavailable; _Client_host_[213.165.64.20]_blocked_using_dnsbl.sorbs.net; _Spam_Received_See: _http://www.sorbs.net/lookup.shtml?213.165.64.20/Giving_up_on_146.171.13.19… Sat Mandri wrote: > > > Hi Rick & Peter > > > > We at Telecom NZ/Xtra are quite keen to learn from you guys how the > following Statistical Data on “Botnet” was gathered and what’s the > initiative driving it. > > > > We look forward to hearing from you guys on this matter. > > > > Kind Regards > > Sat Mandri > > > > ---------- Forwarded message ---------- > > Date: Fri, 26 May 2006 10:21:10 -0700 > > From: Rick Wesson <wessorh(a)ar.com> > > To: peter(a)peter-dambier.de > > Cc: nanog(a)merit.edu > > Subject: Re: Are botnets relevant to NANOG? > > > > > > > >> Some people need whatever bandwidth they can get for ranting. > >> Of course routing reports, virus reports and botnet bgp statistics > >> take away a lot of valuable bandwidth that could otherwise be used > >> for nagging. On the other hand without Gadi's howling for the > >> wolves those wolves might be lost species and without the wolves > >> all the nagging and ranting would make less fun. > > > > lets see, should we be concerned? here are a few interesting tables, the > > cnt column is new IP addresses we have seen in the last 5 days. The > > first table is Tier-2 ASNs as classified by Fontas's ASN Taxonomy paper > > [1] The second table is Universities. The ASN concerned are just in the > > announced by orgs in USA as to imply that they should be on NANOG. > > > > Let me say it again the counts are NEW observations in the last 5 days. > > also note I'm not Gati, and I've got much more data on everyones networks. > > > > -rick > > > > > > New compromised unique IP addresses (last 5 days) Tier-2 ASN > > +-------+------------------------------------+-------+ > > | asnum | asname | cnt | > > +-------+------------------------------------+-------+ > > | 19262 | Verizon Internet Services | 35790 | > > | 20115 | Charter Communications | 4453 | > > | 8584 | Barak AS | 3930 | > > | 5668 | CenturyTel Internet Holdings, Inc. | 2633 | > > | 12271 | Road Runner | 2485 | > > | 22291 | Charter Communications | 2039 | > > | 8113 | VRIS Verizon Internet Services | 1664 | > > | 6197 | BellSouth Network Solutions, Inc | 1634 | > > | 6198 | BellSouth Network Solutions, Inc | 1531 | > > | *9325 | XTRA-AS Telecom XTRA, Auckland | 1415* | > > | 11351 | Road Runner | 1415 | > > | 6140 | ImpSat | 1051 | > > | 7021 | Verizon Internet Services | 961 | > > | 6350 | Verizon Internet Services | 945 | > > | 19444 | CHARTER COMMUNICATIONS | 845 | > > +-------+------------------------------------+-------+ > > > > Universities, new unique ip last 5 days > > +-------+--------------------------------+-----+ > > | asnum | left(asname,30) | cnt | > > +-------+--------------------------------+-----+ > > | 14 | Columbia University | 93 | > > | 3 | MIT-2 Massachusetts Institute | 45 | > > | 73 | University of Washington | 25 | > > | 7925 | West Virginia Network for Educ | 24 | > > | 4385 | RIT-3 Rochester Institute of T | 20 | > > | 23369 | SCOE-5 Sonoma County Office of | 19 | > > | 5078 | Oklahoma Network for Education | 18 | > > | 3388 | UNM University of New Mexico | 18 | > > | 55 | University of Pennsylvania | 13 | > > | 159 | The Ohio State University | 12 | > > | 104 | University of Colorado at Boul | 12 | > > | 4265 | CERFN California Education and | 11 | > > | 693 | University of Notre Dame | 10 | > > | 2900 | Arizona Tri University Network | 9 | > > | 2637 | Georgia Institute of Technolog | 9 | > > +-------+--------------------------------+-----+ > > > > > > > > [1] http://www.ece.gatech.edu/research/labs/MANIACS/as_taxonomy/ > > > > > > > -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Graeffstrasse 14 D-64646 Heppenheim +49(6252)671-788 (Telekom) +49(179)108-3978 (O2 Genion) +49(6252)750-308 (VoIP: sipgate.de) mail: peter(a)peter-dambier.de mail: peter(a)echnaton.serveftp.com http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/

1 0

Re: Botnet List Discussed on NANOG
by Peter Dambier 29 May '06

29 May '06

Sat Mandri wrote: > > > Hi Rick & Peter > > > > We at Telecom NZ/Xtra are quite keen to learn from you guys how the > following Statistical Data on “Botnet” was gathered and what’s the > initiative driving it. > > > > We look forward to hearing from you guys on this matter. > > > > Kind Regards > > Sat Mandri Hi Sat, I built IASON to check and protect computer centres against attackers. The first thing IASON did was analyzing logs on routers, switches and everything. Next step might be tuning firewalls and switches, if need be, isolating devices from the net. http://iason.site.voila.fr/ http://www.kokoom.com/iason/ I still have a little trouble with https://sourceforge.net/projects/iason/ Taking parts of IASON you can adapt it to count anything, like: Whenever a firewall, an xinetd or or somebody else, sees activity on a port that is known to be notorious for a bot then count and remember that ip-address. That is a crude one but it gives you an overview. With tools like IASON, you could analyze your findings for repeating patterns. Now you can identify the bots even after they change ip-addresses. Why did I build IASON in the first place? Working for companies like GLC, Global Center and Exodus I got tired of watching people in the NOC doing the same thing again and again for hours. Their expertise was not knowledge but pure typing speed. IASON can type much faster and he even has time to read the logs. With the core of IASON programmed in prolog it might even get a clue :) Cheers Peter and Karin > > > > ---------- Forwarded message ---------- > > Date: Fri, 26 May 2006 10:21:10 -0700 > > From: Rick Wesson <wessorh(a)ar.com> > > To: peter(a)peter-dambier.de > > Cc: nanog(a)merit.edu > > Subject: Re: Are botnets relevant to NANOG? > > > > > > > >> Some people need whatever bandwidth they can get for ranting. > >> Of course routing reports, virus reports and botnet bgp statistics > >> take away a lot of valuable bandwidth that could otherwise be used > >> for nagging. On the other hand without Gadi's howling for the > >> wolves those wolves might be lost species and without the wolves > >> all the nagging and ranting would make less fun. > > > > lets see, should we be concerned? here are a few interesting tables, the > > cnt column is new IP addresses we have seen in the last 5 days. The > > first table is Tier-2 ASNs as classified by Fontas's ASN Taxonomy paper > > [1] The second table is Universities. The ASN concerned are just in the > > announced by orgs in USA as to imply that they should be on NANOG. > > > > Let me say it again the counts are NEW observations in the last 5 days. > > also note I'm not Gati, and I've got much more data on everyones networks. > > > > -rick > > > > > > New compromised unique IP addresses (last 5 days) Tier-2 ASN > > +-------+------------------------------------+-------+ > > | asnum | asname | cnt | > > +-------+------------------------------------+-------+ > > | 19262 | Verizon Internet Services | 35790 | > > | 20115 | Charter Communications | 4453 | > > | 8584 | Barak AS | 3930 | > > | 5668 | CenturyTel Internet Holdings, Inc. | 2633 | > > | 12271 | Road Runner | 2485 | > > | 22291 | Charter Communications | 2039 | > > | 8113 | VRIS Verizon Internet Services | 1664 | > > | 6197 | BellSouth Network Solutions, Inc | 1634 | > > | 6198 | BellSouth Network Solutions, Inc | 1531 | > > | *9325 | XTRA-AS Telecom XTRA, Auckland | 1415* | > > | 11351 | Road Runner | 1415 | > > | 6140 | ImpSat | 1051 | > > | 7021 | Verizon Internet Services | 961 | > > | 6350 | Verizon Internet Services | 945 | > > | 19444 | CHARTER COMMUNICATIONS | 845 | > > +-------+------------------------------------+-------+ > > > > Universities, new unique ip last 5 days > > +-------+--------------------------------+-----+ > > | asnum | left(asname,30) | cnt | > > +-------+--------------------------------+-----+ > > | 14 | Columbia University | 93 | > > | 3 | MIT-2 Massachusetts Institute | 45 | > > | 73 | University of Washington | 25 | > > | 7925 | West Virginia Network for Educ | 24 | > > | 4385 | RIT-3 Rochester Institute of T | 20 | > > | 23369 | SCOE-5 Sonoma County Office of | 19 | > > | 5078 | Oklahoma Network for Education | 18 | > > | 3388 | UNM University of New Mexico | 18 | > > | 55 | University of Pennsylvania | 13 | > > | 159 | The Ohio State University | 12 | > > | 104 | University of Colorado at Boul | 12 | > > | 4265 | CERFN California Education and | 11 | > > | 693 | University of Notre Dame | 10 | > > | 2900 | Arizona Tri University Network | 9 | > > | 2637 | Georgia Institute of Technolog | 9 | > > +-------+--------------------------------+-----+ > > > > > > > > [1] http://www.ece.gatech.edu/research/labs/MANIACS/as_taxonomy/ > > > > > > > -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Graeffstrasse 14 D-64646 Heppenheim +49(6252)671-788 (Telekom) +49(179)108-3978 (O2 Genion) +49(6252)750-308 (VoIP: sipgate.de) mail: peter(a)peter-dambier.de mail: peter(a)echnaton.serveftp.com http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/

1 0

Re: Fwd: 41/8 announcement
by hjan＠libero.it 27 May '06

27 May '06

> How was that achieved if their users still are within 41/8 >locally? Route filter and PBR. hjan

2 1