- Test - lists.nanog.org

Looking for TM.NET.MY Contact
by Jim Jagielski 17 Aug '05

17 Aug '05

Since they peer with others at Equinix, I am looking for someone from tm.net.my to contact me. They are advertising bogus routes for my ip space (209.133.192.0/19), causing traffic which passes through Equinix to (a lot of the time) get diverted to their network and drop and die when the packets hit their AT&T connection. EG: 8 a1-00-00-00.p0.lax91.adelphiacom.net (66.109.3.130) 58.736 ms 58.770 ms 58.804 ms 9 LAX-GE1.tm.net.my (206.223.123.94) 58.727 ms 58.603 ms 58.737 ms 10 219.93.168.233 (219.93.168.233) 283.962 ms 284.899 ms 284.316 ms 11 vlan550-brf-sw03.tm.net.my (219.93.151.209) 284.225 ms 284.144 ms 284.773 ms 12 219.93.174.145 (219.93.174.145) 284.491 ms 337.796 ms 378.834 ms 13 210.187.142.5 (210.187.142.5) 284.120 ms 219.93.151.97 (219.93.151.97) 285.450 ms 219.93.151.103 (219.93.151.103) 284.776 ms 14 210.187.15.254 (210.187.15.254) 285.943 ms 203.106.230.134 (203.106.230.134) 286.894 ms 210.187.15.254 (210.187.1 5.254) 288.102 ms 15 202.188.126.132 (202.188.126.132) 286.384 ms 286.476 ms 287.241 ms 16 219.93.173.37 (219.93.173.37) 277.918 ms 219.93.173.133 (219.93.173.133) 277.521 ms 219.93.173.37 (219.93.173.37) 277.503 ms 17 219.93.153.150 (219.93.153.150) 277.848 ms 277.295 ms 277.519 ms 18 12.119.139.37 (12.119.139.37) 276.814 ms !X * 276.567 ms !X When using http://www.myloca.net/cgi-bin/trace/index.pl, all AT&T traffic appears to be misdirected as well. -- ======================================================================= Jim Jagielski [|] jim(a)jaguNET.com [|] +1-410-420-0140 (Cell: +1-443-324-8390)

1 0

Re: Fixing .com DNS glue records - who to contact?
by Matthew Elvey 16 Aug '05

16 Aug '05

//Hi, William! william(at)elan.net wrote on Aug 16 : > ------------------------------------------------------------------------ > On Tue, 16 Aug 2005, Matthew Elvey wrote: > > > > A glue record for a .com domain (nextbus.com) is wrong, and I'm > running into a brick wall trying to get it fixed. > Do I need to switch to a more clueful registrar than GoDaddy**? > Contact Network Solutions? > Have I screwed up the domain's bind config? Everything looks right > when I _dig_ around the authoritative NS*.. > I futzed with the record (deleted and re-added ns.nextbus.com as > an authoritative NS (nameserver(s))), and the glue became correct > for several days (dnsreport.com even reported all was well) AND > THEN WENT BACK TO BEING BROKEN AGAIN. > <digs showing correct results from my server and the wrong results from a gTLD server snipped> Yup, just as I kept saying to GoDaddy: The glue in the parent servers is wrong. > > So the answer is that you need to make sure your own dns server "A" > record for "ns.nextbus.com" matches glue record entered with registrar. Right, but the registrar wasn't being cooperative. I've changed glue records with other registrars before (self-service - just fill in the IP next to the name). I even remember emailing changes to NSI, back when that was the procedure), but changing one with GoDaddy has proven, erm, difficult. > As far as what is going to be used by global dns, it would be glue > record that you set with registrar (ok - its supposed to, but its > not always true depending how caching dns server is written). > > BTW - when doing check make certain to use "+norecurse" Ok... I'd be surprised if a gTLD server did a recursive query if asked. > > I have tested your site and everything is resolving > properly. This error message you are getting is not on our > end. > > If the record you wanted for glue is 64.142.39.200 and godaddy did not > fix it, then I suggest you find more cluefull registrar support person. > Ok, third time is a charm, I hope. You'd think even the level 1 folks would be trained to use dnsreport.com or something like it. (Boy, thanks to the folks providing it!) Note that I did specifically ask: "Please have this issue reviewed by someone technical - someone who knows what DNS glue is" and even included links to a definition, dnsreport.com,... > > > Thank you for contacting customer support. I have looked into this > situation and found that the domain name in question is not hosted > with us. This being the case you may wish to speak with your > hosting provider regarding the "glue" situation. > > The above is a red flag that the godaddy's "customer service representative" > has no idea what "glue" means. Escalate to the real tech support. Yup. I did get a good laugh out of the comment. ======= Boy, the results, which Jim posted, of "host 64.164.28.194" sure are odd, though I get the same thing. (That IP is in space no longer ours.) 194.192.28.164.64.in-addr.arpa??? That's got 5 octets, not 4. Not that I care what SBC does with rDNS for our old IP space... But in general, I believe there's no need for a NS to have valid reverse DNS. (But it's still a good idea, and is usually needed for mail servers...) There's nothing keeping someone from setting up reverse DNS for any IP delegated to them to be, say www.whitehouse.gov...

1 0

CNN: Worm strikes down Windows 2000 systems at multiple news organizat
by Fergie (Paul Ferguson) 16 Aug '05

16 Aug '05

Via CNN. [snip] A computer worm shut down computer systems running the Windows 2000 operating system across the United States on Tuesday, hitting computers at CNN, ABC and The New York Times. Around 5 p.m. computers began crashing at CNN facilities in New York and Atlanta. ABC said its problems began in New York about 1:30 p.m. The Caterpillar Co. in Peoria, Illinois also was reportedly affected. David Perry of Trend Micro said that the attack seems to have been triggered by a new worm, called worm--rbot.ebq. He said the symptoms -- computers repeatedly shutting down and rebooting -- was consistent with that virus. Johannes Ullrich, director of the Sans Institute, a network security firm in Jacksonville, Florida, said the outage also may have been caused by the Zotob worm, which was released last weekend. "It will connect to a control server to ask for instructions. It scans network neighborhoods and tries to infect them, as well," Ullrich said. Several versions of the worm have been released, some as late as Tuesday, he said. [snip] http://www.cnn.com/2005/TECH/internet/08/16/computer.worm/index.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

DACS Equipment
by sjk 16 Aug '05

16 Aug '05

I have a number of mux DS-3s coming in - right now they drop straight into aggregation routers. What I like to do is drop them into a local DACS and comb them out to DS-1s and then re-mux them back on to internal DS-3s. This will let me move circuits around digitally inside our equipment. Does anyone know what vendors I should speak to about such an application? Or maybe know of a cost-effective solution? TIA -- Steve

2 1

Open Proxy list / DR discussion list.
by Alice Stamping 16 Aug '05

16 Aug '05

Hey guys Either I'm clean out of google-foo, or there's little or nothing out there to be found, to help me with my current two projects. - Is anyone maintaing a real-time list of known open web-proxies? I run a small network hosting several forum sites, and I want to build something I can query regularly (say, hourly or daily) that will let me string something together in perl to build access-lists to throttle or block them altogether at our border. - Is there a good, practical discussion list for disaster recovery practicioners to discuss techniques, theory, news? Hoping someone can help, I remain obliged to you all, BR AS

2 1

Re: zotob - blocking tcp/445
by MARLON BORBA 16 Aug '05

16 Aug '05

Jiri, Rommon's site does not state clearly if the product is a network appliance (as it appears to be since its interface is web-based) or a software-only product. Abraços, Marlon Borba, CISSP. -- Nova campanha: Centro de Resposta a Incidentes de Segurança da Justiça Federal - Vamos criar! -- >>> "Sane Jiri" <Jiri.Sane(a)elisa.fi> 08/16/05 8:49 AM >>> [...] We have been using rommon for years now and are quite happy with it. It has radically decreased workload of our abuse-handling crew and zotob-infected customers for example got blocked with no extra configuration needed.

1 0

RE: drone armies C&C report - July/2005
by Hannigan, Martin 16 Aug '05

16 Aug '05

> > > > Wall of sheep certainly is humorous, but IL CERT using this > > data as a shaming mechanism is, well, a shame. > > Why you associate IL CERT with this is confusing to others. I am > confident that you know there is little or no connection. We all > have employers. You, me and Gadi included. ;-) I don't know that. I am not part of the project. It was sent from cert.gov.il and had a sig from the manager of the IL CERT. We can go around in circles all day on this, but it seems that the IL CERT was used to give the report credibility so it's fair to give feedback on it as official CERT policy, IMO. > nothing actionable Enough said. -M<

1 0

Re: zotob - blocking tcp/445
by Sane Jiri 16 Aug '05

16 Aug '05

Randy, > though http://www.rommon.com/sandbox.html looks to be a > commercial product (and hence the spawn of evil:-), has > anyone got success/failure stories? it looks to speak > directly to this issue. We have been using rommon for years now and are quite happy with it. It has radically decreased workload of our abuse-handling crew and zotob-infected customers for example got blocked with no extra configuration needed. -- Jiri Sane Elisa Oy (Ltd) Puh. 010 266 2012 jiri.sane(a)elisa.fi

1 0

RE: drone armies C&C report - July/2005
by Hank Nussbacher 16 Aug '05

16 Aug '05

At 05:05 PM 15-08-05 -0400, Hannigan, Martin wrote: >It was noted that IL CERT does a fantastic job seeing that >there are no IL networks listed. Or none that are easily >identifiable. It is not IL-CERT but rather peer pressure on an internal Israeli ISP mailing list. Incidentally, there are 2 Israeli ASNs mentioned in the list which are not easily identifiable as listed below. -Hank >YMMV. > >-M< > > > ASNs with 0ne or more open C&Cs: > > ASNumber Responsible Party > > 8551 BEZEQ-INTERNATIONAL-AS Bezeqin > > 9116 Goldenlines main autonomous sy

1 0

Re: botnet reporting by AS - what about you?
by Fergie (Paul Ferguson) 16 Aug '05

16 Aug '05

Good suggestions for Gadi. ,-) - ferg -- "Christopher L. Morrow" <christopher.morrow(a)mci.com> wrote: cool, among the 800k+ complaints we see a month (yes, 800k) there are quite a few completely useless ones :( Anything sent in as a complaint has to have complete and useful information, else it's hard/impossible to action properly. It'd help if the format it was sent in was also machine parseable :) With 800k+ complaints/month I'm not sure people want to spend time figuring each one out, a script/machine should be doing as much as possible. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2