- Test - lists.nanog.org

DSL Network Design Question
by surfer＠mauigateway.com 15 Aug '05

15 Aug '05

I am going to be cutting over about 75,000 DSL lines from one core network to another. Does anyone have recommendations on subnet and DHCP scope size? If I make them /23s I have to do about 145 subents. If I make them /22s I only have to do about 73. Being mainly an always on eyeball network I don't see any problems with making big subnets (/22). <flameproof undies == on> suggestions, recommendations, advice? scott

7 11

MS05-039 Worm in the wild
by Fergie (Paul Ferguson) 14 Aug '05

14 Aug '05

>From the SANS Internet Storm Center: [snip] Starting around 11:30 UTC, we've received several reports on a new worm variant that makes use of MS05-039 to spread. If you're not patched yet, this is your last call. F-Secure named the critter "Zotob.A",http://www.f-secure.com/weblog/ We've also received a submission of a binary called "pnpsrv.exe", which is recognized by ClamAV as Trojan.Spybot-123. Another reader has contributed evidence that a successful exploit by Zotob.A (or variant) The worm will download the main payload from the infecting machine. Once a machine is infected, it will become an ftp server itself. It will scan for open port 445/tcp. Once it finds a system with port 445 listening, it will try to use the PnP exploit to download and execute the main payload via ftp. Important facts so far: - Patch MS05-039 will protect you - Windows XP SP2 and Windows 2003 can not be exploited by this worm, as the worm does not use a valid logon. - Blocking port 445 will protect you (but watch for internal infected systems) - The FTP server does not run on port 21. It appears to pick a random high port. [snip] http://isc.sans.org/diary.php?date=2005-08-14 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

con ed manhole issue
by Wallace Keith 13 Aug '05

13 Aug '05

is anyone aware of a possible Con Ed manhole fire in NY that may be affecting fiber connectivity? Seems to have started early am Saturday. looking for details as to Where/when? . Keith Wallace kwallace(a)pcconnection.com

1 0

speaking of lynn...
by Gadi Evron 13 Aug '05

13 Aug '05

Cisco flaw presentation spreads across the Web FBI Investigation... New copies of Michael Lynn's presentation on the Cisco router operating system flaw are springing up faster than the lawyers can take them down Cisco's lawyers are sending out cease-and-desist notices to Web sites that have published a controversial presentation by ex-Internet Security Systems (ISS) employee Michael Lynn that exposes the potential dangers of a flaw in the network giant's router operating system.The presentation, which was due to be given by Lynn at the Defcon conference in Las Vegas last week, was cancelled after legal threats from Cisco and ISS. The parties resolved the matter on Thursday last week. -- I guess that answers the question of the lgality of the matter? Gadi.

4 3

botnet reporting by AS - what about you?
by Gadi Evron 13 Aug '05

13 Aug '05

Hello. The drone armies research and mitigation mailing list is moving its reporting mechanism to the next level. If you have updated contact information for any of the below AS owners, please contact me _off-list_. Thanks, Gadi. 3MENATWORK - 3menatwork.com AAPT AAPT Limited ABACUS-NET-AS - Abacus America ACTCOM ACTCOM - Active Communi ADELPHIA-AS2 - Adelphia AFFINITY-FTL - Affinity Intern AFRINIC African Network Inform AIRBAND-PHOENIX - airBand Comm AITNET - Advanced Internet Tec Albacom Autonomous System Alestra ALICE Alice Networks ALLHOSTSHOP - ALLHOSTSHOP.COM ALTERNET-AS - UUNET Technologi AMEN AMEN Network AMIS-NET AMIS.NET Autonomous S AMNET-AU-AP Amnet IT Services AOL-ATDN - AOL Transit Data Ne APOL-AS Asia Pacific On-line S ARAGON DE CABLE ARUBA-ASN Aruba.it Network AS R Cable y Telecomunicacione AS12593 ISP UkrCom AS13680 Hostway Corporation Ta AS15440 MicroLink Lietuva Auto AS15589 Eutelia S.p.A. Backbon AS31400 AS31400.NET BACKBONE AS3215 France Telecom Transpac AS702 MCI EMEA - Commercial IP ASGARR GARR Italian academic a ASKONKUK KONKUK UNIVERSITY AS-LLIX - Liberty Lake Interne ASN852 - Telus Advanced Commun ASN-ATLANET Atlanet Autonomous ASN-BDDSL Bulldog Communicatio ASN-BNS Blixernetservices S.r. ASN-CARRIER66 carrier66.net Ne ASN-CATCHCOM Catch Communicati ASN-FOUR-U 4u-Networks Limited ASN-HKNET-AP HKNet Co. Ltd ASN-IBSNAZ TELECOM ITALIA ASN-INFOSTRADA Infostrada S.p. ASN-INNERHOST - Interland AS-NLAYER - nLayer Communicati ASN-LOUDPACKET - LoudPacket In ASN-NA-MSG-01 - Managed Soluti ASN-NERIM Nerim -- xDSL Intern ASN-NETHOLDING Autonomous Syst ASN-PACIFIC-INTERNET-IX Pacifi ASN-QWEST - Qwest ASN-TELENERGO EXATEL S.A. Auto ASN-TELSTRA Telstra Pty Ltd ASN-THEPLANET - ThePlanet.com ASVT-NETWORK RusSDO Autonomous Athens University of Economics ATHOME-BENELUX-BV AtHome Benel ATL-CBEYOND - CBEYOND COMMUNIC ATMAN ATMAN Autonomous System ATMLINK - ATMLINK ATRIVO-AS - Atrivo ATT-INTERNET3 - AT&T WorldNet ATT-INTERNET4 - AT&T WorldNet AUGUST-ASN - August Associates AUNA_TELECOM-AS AUNA Autonomou B2 B2 Bredband AB (publ) BACOM - Bell Advanced Communic BAKINTER-AS Bakinternet ISP A BANETELE-NORWAY BaneTele AS (f BATI-ATL - BellSouth Network S BATI-MIA - BellSouth Network S BELLSOUTH-NET-BLK - BellSouth. BELLSOUTH-NET-BLK2 - Bellsouth BENESOL-AS Belgian Network Sol BEN-LOMAND-TEL - Ben Lomand Te BESTWEB - BestWeb Corporation BEZEQ-INTERNATIONAL-AS Bezeqin BJGY srit corp. beijing. BSOCOM BSO Communication Netwo BTN-ASN - Beyond The Network A BT-UK-AS BTnet UK Regional net BURSTFIRE-EU Burstfire Network CABLECOM Cablecom GmbH CABLEINET Telewest Broadband CABLE-NET-1 - Cablevision Syst CABLEVISION S.A. CAIRNSNET-AS-AP CairnsNet Pty CARI - California Regional Int CARNET-AS Croatian Academic an CARPATHIA-HOSTING - Carpathia CASEMAISP-AS N.V. Casema CBCZ CZECHBONE AS CCCH-AS2 - Comcast Cable Commu CCCH-AS4 - Comcast Cable Commu CCINET-2 - Cox Communications CESNET2 Czech National Researc CHARTER-16787 - Charter Commun CHARTER-NET-HKY-NC - Charter C CHARTER-STL - CHARTER COMMUNIC CHINA169-BACKBONE CNCGROUP Chi CHINANET-BACKBONE No.31 Jin-ro CHOICEONECOM - Choice One Comm CHONBUK-AS Chonbuk National Un CIT-FOONET - CREATIVE INTERNET CLAREMONT - The Claremont Coll CMNET-GD Guangdong Mobile Comm CNUNET-AS-KR Chungnam National COGENT Cogent/PSI COLT COLT Telecommunications COMCOR-AS AS for Moscow Teleco Compania de Telecomunicaciones Computer Service Teleinformáti CONNECTPLUS-AP Singapore Telec COULOMB-AS AS for Coulomb CRNC - CRNC CRNET CHINA RAILWAY Internet(C CRONON-AS Cronon AG CTIHK-AS-AP City Telecom (H.K. CWRU-AS-1 - Case Western Reser CYBERCITY Cybercity A/S DACOM-PUBNETPLUS-AS-KR DACOM P DADA S.p.a. DALNET - DALnet DATA393 - Data393 Inc. DATAPIPE - DataPipe DATATELECOM Data Telecom Auton DCI-AS DCI Autonomous System DEMON-NL Demon Netherlands Th DFN-IP service G-WiN DGCSYSTEMS DGC Systems AB Auto DIALOG-AS DIALOG-NET Autonomuo DIGITAL-FOREST-NW - digital.fo DINET-AS Digital Network JSC DION KDDI CORPORATION DISNW1 - State Of Arkansas De DKOM Telekom Austria Applicati DLA-ASNBLOCK-AS - DoD Network DLS-LITH - DLS Computer Servic DNEO-OSP1 - Comcast Cable Comm DNEO-OSP4 - Comcast Cable Comm DNEO-OSP7 - Comcast Cable Comm DOCKNET - dock.net DOMENESHOP Domeneshop AS DONOBI - Donobi Inc. DREAMNET-C-S-I - DreamNet Comm DTAG Deutsche Telekom AG DXTNET Beijing Dian-Xin-Tong N EASEFUL-HK Easeful Strategic L EASYNET Easynet Group Plc EASYNEWS - Easynews Inc. EDELTACOM-SUW-300 - e^deltacom ELENDER-AS ELENDER-AS ELITE-NET - Elite.Net ELIX - Electric Lightwave Inc ELNK-CHARTER-CONN - Earthlink Embratel ENERGIS-AS Energis UK ENERGIT-AS ENERG.IT SpA Enertel N.V. ENTERNET-LIBERCOM-AS Enternet EPLANET-AS ePLANET SPA ERMS-EARTHLNK - EARTHLINK INC ERX-DACOMNET DACOM Corporation ERX-JARING Malaysian institute ERX-SINET-AS National Center f ERX-SINGNET SingNet ERX-TANET-ASN1 Tiawan Academic ESPIRECOMM - e.spire Communica ETHRN - Ethr.Net LLC EUNETFI EUnet Finland EUROCONNEX-AS Euroconnex Netwo Euronet Digital Communications EURONET Wanadoo Nederland BV G EUROWAN-ASN OVANET - EuroWan d EVERYONES-INTERNET - Everyones EVERYONES-INTERNET2 - Everyone EZZI-101-BGP - EZZI.net FASTIT-AS fast IT GmbH Duesse FASTSERVERS - FastServers In FASTWEB Fastweb Autonomous Sys FDCSERVERS - FDCservers.net LL FDNCOM - FDN.com FHNET Beijing Feihua Communica FIVE-COLLEGES-AS - Five Colleg FORTISUSA - Fortis Communicati FORTIX-WEST - FORTIX LLC FREEDOMTOSURF Freedom To Surf FRONTIER-AND-CITIZENS - Electr FR-RENATER Reseau National de FR-U-STRASBOURG FR FUSE-NET - Cincinnati Bell Tel GCI - GCI Communications Inc. GEORGIA-TECH - Georgia Institu GLOBEINTERNET Teleglobe Americ Globix Corporation GNAPS - Global NAPs Networks GNS Grapes Network Services Goldenlines main autonomous sy GOTANET Gotanet-Leissner Swed GROUPTLCOM - GT Group Telecom GVTCINTERNET - Guadalupe Valle HANARO-AS HANARO Telecom HANINTERNET-AS HaninterNetwork HBONE-AS HUNGARNET HCCNET HCCnet Autonomous Syste HINET Data Communication Busin HKTIMS-AP PCCW Limited HOPONE-DCA - HopOne Internet C HP-DIGITAL-33 - Hewlett-Packar HUNGARNET-SZEGED Szeged Univer HURRICANE - Hurricane Electric HYUNDAI-KR Shinbiro I-55-INTERNET-SERVICES-INC - I IDAQ-AS iDAQ AS IEUNET Esat Net backbone AS Nu IFCI-US - InternetFCI LLC IGLOU - IgLou Internet Service IGS-GTA - Information Gateway IHETSDATANET - Indiana Higher IMPSAT-USA - ImpSat INCUBATEC-AS incubatec GmbH - INDEX Autonomous System INDRA - Indra's Net Inc. INET-AS I.NET S.p.A. INET-TH-AS Internet Thailand C INFOLINK-MIA-US - Infolink Inf INFORELAY - InfoRelay Online S INKTOMI-LAWSON - Inktomi Corpo INODE inode Telekommunikations INREACH-AS - InReach Internet INTERGENIA-ASN intergenia auto INTERLAND-NET1 - Interland Inc INTERNAP-BLK - Internap Networ INTERNAP-BLK3 - Internap Netwo INTERNAP-BLK5 - Internap Netwo INTERNAP-BLOCK-4 - Internap Ne INTERNET5-NET Internet5 AB INTERNET-CG Internet Crna Gora INTERNETPRIMUS-AS-AP Primus Te INTERNET-SOLUTIONS-GROUP - Int INTERSTARCOMM - InterStar Comm IPWORLDNET - IPWorld Networks IPX-SERVER IPX Server GmbH ISP4P ISP4P IT Services ISPRIME - ISPrime Inc. IT-PARTNERS - I. T. Partners ITSS-AS IT - SOLID SOLUTIONS JANET The JANET IP Service JINGXUN Beijing Jingxun Public JPNIC-ASBLOCK-AP JPNIC JPNIC-JP-ASN-BLOCK Japan Netwo JPNIC-NET-JP-AS-BLOCK Japan Ne JUMP Jump Networks Ltd. KAIST-DAEJEON-AS-KR Korea Adva KCSOS-NET - Kern County Superi KEWLIO-DOT-NET Kewlio.net Limi KEYWEB-AS Keyweb AG KINX-AS KINX Inc. KIXS-AS-KR Korea Telecom Knipp Medien und Kommunikation KNU-AS Kyungpook National Univ KOLNET-AS-KR Korea Telecom Hit KPN KPN Internet Backbone AS KRLINE-AS KrLine Internet Serv KRNIC-AS-KR Korea Network Info KW Gulfnet International LACOE - Los Angeles County Off LAMBDANET-AS European Backbone LAXIN-AS Laxin IT-Services Gmb LEASEWEB LEASEWEB AS LEHIGH - Lehigh University LENET "Lietuvos energija" JSC LEVEL3 Level 3 Communications LH - Lighthouse Communications LIDERO Lidero Network AB LIQUIDIX - LIQUID COMMUNICATIO LIQUID-WEB-INC - Liquid Web LLNW - Limelight Networks LLC LOMBARDIACOM Elitel Autonomous LYCOS-EUROPE Lycos Europe GmbH Manquehuenet MAXIM - Interland MEGAPATH-US - MegaPath Network MERIT-AS-14 - Merit Network In MFNX MFN - Metromedia Fiber Ne MISNET - Mikrotec Internet Ser MOG-NET - Michigan Online Grou MPX-AS Microplex PTY LTD MULTI-VISP Multi-vISP Network MZIMA - Mzima Networks Inc. NA NAMEI - Name Intelligence Inc NCIC-TW New Century InfoComm T NCTU-TW National Chiao Tung Un NCU-TW National Central Univer NDCHOST - Network Data Center NEBRIX-CA - Nebrix Communicati NERONET - Oregon Joint Graduat NET-ACCESS-CORP - Net Access C NETCATHOST-AS NetcatHosting NETDIRECT AS NETDIRECT Frankfu NETFIRE - NetFire.com NETNATION - NetNation Communic NETSCAPE-ASN - Netscape NETSENTRY - Net Sentry Corp NETSONIC NETTRANS - NetTransactions LL NetVision Ltd. NEWSKIES-NETWORKS - New Skies NILDRAM NILDRAM UK Peering NLB-ASN - Norwood Light Broadb NL-BIT BIT BV NL-IO Autonomous System for In No Whois Connection NOC - Network Operations Cente NONAME NordNet Autonomous System NSS S.A. NTL NTL Group Limited NTUA National Technical Univer NTU-TW National Taiwan Univers NUCLEARFALLOUT-SEA - Nuclearfa NUVOX - NuVox Communications NWT-AS - Internet North NWT-AS-AP AS number for New Wo NXS Nxs Internet BV O1COMM - O1 COMMUNICATIONS OARNET-AS-1 - OARnet OCHOTA Ochota Campus Network OCN NTT Communications Corpora ODN JAPAN TELECOM CO. LTD. OMNITEL PLC OMNITEL ONLINE-BG BULGARIA ONLINE OPENFACE - Openface Inc. OVERSEE-DOT-NET - Oversee.net OVH OVH PAH-INC - Go Daddy Software I PDXNET - Portland State Univer PEER1 - Peer 1 Network Inc. PEGASUS - Pegasus Web Technolo PERFTECH-SLOVENIA-AS Perftech PERSONALNET-HU-AS Personalnet PKTELECOM-AS-AP Pakistan Telec PL-BYDMAN-EDU Educational User PLUSNET Plusnet Technologies L PORT80 Port80 AB Sweden POWTECH-AS PowerTech Informati Prima S.A. PRISM-AS Intellicenter PROBENETWORKS-AS Probe Network PRODIGY-AS Prodigy ASN PROXAD AS for Proxad ISP PUBNET1-AS KT PURDUE - Purdue University QualityNet AS number QUICKPACKET - Plusweb Communic RACKSPACE - Rackspace.com RAPIDSWITCH-AS RapidSwitch Ltd RAPIDUS - COGECO Cable Canada RCN-AS - RCN Corporation RDSNET Romania Data Systems S. REACH Reach Network Border AS REDIRIS RedIRIS Autonomous Sys REFLEX-AS Reflex Internet RE-STAFFORD - R. E. Stafford I RISQ-AS - Reseau Interordinate ROADRUNNER-MNPLS - Road Runner ROGERS-CABLE - Rogers Cable In RR-CINCINNATI-ASN-01 - Road Ru RR-NYSREGION-ASN-01 - Road Run RTCOMM-AS RTComm.RU Autonomous RUSTON - Cox Internet Services SAGONET-TPA - Sago Networks SAVVIS - Savvis SB-2 - ServerBeach SBIS-AS - SBC Internet Service SCARLET Autonomous System for SCARLET Scarlet Belgium SCHLUND-AS Schlund + Partner A SCRR-11426 - Road Runner SCRR-11427 - Road Runner SCRR-11707 - Road Runner SCRR-12271 - Road Runner SCRR-13343 - Road Runner SCRR-8052 - Road Runner SCV-AS-AP SCV Broadband Access SECURE-AS Oz Servers Data Cen SEEDNET Digital United Inc. SEKTORNET Sektornet DK Minist SERBIA-BROADBAND-AS Serbia Bro SERVER4YOU - Server4You Inc. SERVERBEACH - ServerBeach SERVER-CENTRAL-CHI - Server Ce SEVEN-AUTONOMOUS-SYSTEM SEVEN SHAW - Shaw Communications Inc SHAW-COMMUNICATIONS - Shaw Com SIG SIG - IP-MAN.NET SIL-AT SILVER:SERVER GmbH SINET-SK-AS SOFTITUS s.r.o. Po SIOL-NET SiOL Internet d.o.o. SKG_NW-AS-KR SK Global co. Lt SKYTURN-AS Groupe Ecritel Fran SLC-EXPEDIENT - e-xpedient SONOFON_AS SONOFON (Autonomous SONOMA - Sonoma Interconnect SPCS - Sprint Personal Communi SPRINT-CA-AS - Sprint Canada I SPRINTLINK - Sprint SSERV-AS Server-Service GmbH STAMINUS-COMM - Staminus Commu STARMAN Starman Internet AS STRATO Strato AG STSN-SLC-UT-US - STSN GENERAL SUNET SUNET Swedish University SUNRISE sunrise (TDC Switzerla SUNYSB - SUNY at Stony Brook SUREWEST-20172 - SureWest Broa SWIFTDESK - SWIFTDESK VENTURE SWIFTSYSTEMS - SWIFT SYSTEMS SYNAPSE Good Communications Co TAMPA2-TWC-5 - Time Warner Com TCNET-AS Telecom Centre Joint TDC TDC Data Networks TDCSONG TDC Song TDL - THE DIAMOND LANE TEAMTECH - Team Technologies Telecel S.A. Telecom Argentina S.A. Telecom Italia Network Telecomunicacoes da Bahia S.A. TELECOMUNICACOES DE SAO PAULO Telefonica de Argentina TELEFONICA-DATA-ESPANA Interne TELEMAXX TelemaxX Telekommunik TELENOR-NEXTEL Telenor Interne TELERING-AT tele.ring Telekom TELESC - Telecomunicacoes de S TELIANET-SWEDEN TeliaNet Swede TELKOMNET-AS2-AP PT TELEKOMUNI TERA-BYTE - Tera-byte Online S TFN-TW Taiwan Fixed Network T The JPCINET Autonomous System THEPLANET-AS - THE PLANET THRUNET-AS-KR THRUNET TIERZERO-AS11509 - Tierzero TISCALI-BACKBONE Tiscali Intl TISCALIDK Tiscali Denmark Auto TISCALI-NO Tiscali Norway TISCALI-UK Tiscali UK TOWERSTREAM - Towerstream TPNET Polish Telecom's commerc TRIERA Triera Internet TRUESERVER-AS TrueServer BV AS TTNET TTnet Autonomous System TUGNET Technische Universitaet TV Cable S.A. TVNET-HUNGARY TVNET Autonomus TWTC - Time Warner Telecom UCB - University of California UCONN-ARIN - University of Con UK2NET-AS UK-2 Ltd Autonomous UMDNET - University of Marylan UMN-AGS-NET-AS - University of Uninet S.A. de C.V. UNINETT UNINETT The Norwegian UNITEDCOLO-AS Autonomous Syste University of Salzburg UNL-AS - University of Nebrask UPC UPC Distribution Services UPENN-CIS - University of Penn USINTERNET - US Internet Corp USLEC-CORP-1 - USLEC Corp. UTAH - University of Utah UTORONTO-AS - University of To UTRANSIT-AS Utransit Internati UUNET-AS1 - UUNET Technologies VDI - Virtual Development INC VELCOM - Rcp.net VERICENTER - VeriCenter Inc. VERIO - Verio Inc. VERSATEL Versatel routing poli VIDEOTRON-LTEE - Videotron lte VIRTUALXS-AS VirtualXS Interne VISION-I-SYSTEMS-ASN - Vision VISIONNET - Vision Net Inc. VSNL-AS Videsh Sanchar Nigam L VTR BANDA ANCHA S.A. VZGNI-TRANSIT - Verizon Intern WA-K20 - Washington State K-20 WAN - Worldcom Advance Network WANTREE-AS-AP Wantree Developm WAYNE-BOCES - Wayne Finger-Lak WBSSC - Wolf Block Schorr an WEBHOSTPLUS-INC - WebHostPlus WEDARE We Dare BV Autonomous S WESTHOST - WestHost WEST-NET-WEST - Utah Education WHIDBEY1 - Whidbey Internet Se WII-KC - WholeSale Internet WINEASY WinEasy Autonomous Sys WISCNET1-AS - University of Wi WOLFPAWSERVICES - Wolfpaw Serv WOW-INTERNET - WideOpenWest LL WOW-INTERNET-ILL - WideOpenWes WVNET - West Virginia Network XILOGIX-ASN - Xilogix LLC XLON-TECHNOLOGIES - XLON Techn XO-AS15 - XO Communications XS4ALL-NL XS4ALL ZEELANDNET ZeelandNet BV

5 6

Re: speaking of lynn...
by Robert Bonomi 13 Aug '05

13 Aug '05

> From owner-nanog(a)merit.edu Fri Aug 12 22:11:34 2005 > Date: Sat, 13 Aug 2005 06:08:22 +0200 > From: Gadi Evron <ge(a)linuxbox.org> > To: nanog list <nanog(a)merit.edu> > Subject: speaking of lynn... > > [[.. munch ..]] > > Cisco's lawyers are sending out cease-and-desist notices to Web sites > that have published a controversial presentation by ex-Internet Security > Systems (ISS) employee .... > > -- > > I guess that answers the question of the lgality of the matter? "Not exactly." <wry grin> That tells us what Cicso is 'claiming'. In *any* legal dispute, that which one party 'claims' to be true is not necessarily the same thing as the actual 'facts of the matter'.

1 0

Re: Cisco crapaganda (Modified by Jason Chambers)
by Jason Chambers 13 Aug '05

13 Aug '05

On Aug 10, 2005, at 05:53, Michael.Dillon(a)btradianz.com wrote: >> Also, what about DoD Orange Book certification? Can this kind of >> testing methodology be applied to routing systems as well, such as >> IOS? > > I don't claim to fully understand Orange Book but it seems to > me that one of the essences of Open Source is the process of > certification. <--snip--> > To learn more about the Orange book, look here > http://www.dynamoo.com/orange/ In relation to the Orange Book, There is a evaluation program available, named TPEP, links are below. Very interesting and intense. Yes, routing systems \ IOS applies. See 1.3 TPEP Process Overview at http://www.radium.ncsc.mil/tpep/process/procedures.html I chatted briefly with a fed @ Defcon about this program, specifically about work to make this achievement something [buzzword warning] "Critical Infrastructure" and the well known software manufacturers would look to engage in \ use. Maybe by way of public forums such as this is that accomplished. In labels we trust. http://www.radium.ncsc.mil/tpep/index.html http://www.radium.ncsc.mil/tpep/tpep.html http://www.radium.ncsc.mil/tpep/process/faq-sect6.html#Q8 -Jason

1 0

Re: botnet reporting by AS - what about you?
by Fergie (Paul Ferguson) 13 Aug '05

13 Aug '05

I can understand that -- right on. :-) One must understand that this whole thing is a moving target, and perhaps the reporting features are just now maturing (now Gadi, don't make a liar out of me). Insofar as as detection methodologies, I'll have to defer to Gadi to elaboarate (illustrate?) them for a wide audience. Cheers! - ferg p.s. For what it's worth, I got a bit bloody last month neutralizing a pertty large Pertibot infection in a client network -- it was, at that point, new and undetectable by most AV vendor ID mechanisms. Like I said, moving target, etc. "Hannigan, Martin" <hannigan(a)verisign.com> wrote: I was on it and unsubscribed. They wouldn't disclose the collection or validation process at that time. This made it useless for the most part as its hard to act on someones word without some idea of how they are getting their data and avoiding collateral damage. I'm not saying there aren't valid zombies on it, but my criteria for a list that identifies rogues includes trust. I have lists I felt were more trustworthy than DA. Things may have changed. Martin -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: botnet reporting by AS - what about you?
by Hannigan, Martin 13 Aug '05

13 Aug '05

I was on it and unsubscribed. They wouldn't disclose the collection or validation process at that time. This made it useless for the most part as its hard to act on someones word without some idea of how they are getting their data and avoiding collateral damage. I'm not saying there aren't valid zombies on it, but my criteria for a list that identifies rogues includes trust. I have lists I felt were more trustworthy than DA. Things may have changed. Martin -----Original Message----- From: Christopher L. Morrow [mailto:christopher.morrow@mci.com] Sent: Fri Aug 12 23:56:53 2005 To: Fergie (Paul Ferguson) Cc: nanog(a)merit.edu Subject: Re: botnet reporting by AS - what about you? On Sat, 13 Aug 2005, Fergie (Paul Ferguson) wrote: > Chris, > > I can assure you that the Drone Army project is not run that > way, and is quite useful, effective, etc. > > The folks behind the DA Project are certainly professionals... > ...and the infromation is quite useable, parse-able, and genuine. cool, among the 800k+ complaints we see a month (yes, 800k) there are quite a few completely useless ones :( Anything sent in as a complaint has to have complete and useful information, else it's hard/impossible to action properly. It'd help if the format it was sent in was also machine parseable :) With 800k+ complaints/month I'm not sure people want to spend time figuring each one out, a script/machine should be doing as much as possible. > > - ferg > > -- "Christopher L. Morrow" <christopher.morrow(a)mci.com> wrote: > > perhaps we could back up and ask: > > 1) why are you not using the arin/ripe/apnic/japnic/krnic/lacnic poc's for > these asn's? certainly some are not up to date, but there are a large > number that are... > 2) what is this for again? > 3) are you planning on sending something to these poc's? > 4) what are you planning on sending to them? > 5) how often should they expect to see something, and from 'whom'? > 6) looked at the INCH working group in IETF, thought about using some of > these evolving standards for your alerts/messags/missives? > 7) please don't send in bmp files of traceroutes (make the info you send > in complete and usable... 'I saw a bot on ip 12' is not useable, as an > fyi) > > -Chris > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net > ferg's tech blog: http://fergdawg.blogspot.com/ >

2 1

Re: botnet reporting by AS - what about you?
by Fergie (Paul Ferguson) 13 Aug '05

13 Aug '05

Chris, I can assure you that the Drone Army project is not run that way, and is quite useful, effective, etc. The folks behind the DA Project are certainly professionals... ...and the infromation is quite useable, parse-able, and genuine. - ferg -- "Christopher L. Morrow" <christopher.morrow(a)mci.com> wrote: perhaps we could back up and ask: 1) why are you not using the arin/ripe/apnic/japnic/krnic/lacnic poc's for these asn's? certainly some are not up to date, but there are a large number that are... 2) what is this for again? 3) are you planning on sending something to these poc's? 4) what are you planning on sending to them? 5) how often should they expect to see something, and from 'whom'? 6) looked at the INCH working group in IETF, thought about using some of these evolving standards for your alerts/messags/missives? 7) please don't send in bmp files of traceroutes (make the info you send in complete and usable... 'I saw a bot on ip 12' is not useable, as an fyi) -Chris -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1