- Test - lists.nanog.org

European Nanog?
by Ken Gilmour 16 Sep '04

16 Sep '04

Hey there! Does anyone know of a list like nanog for Europe? I would be interested in subscribing... I've learned a lot from this list but would like to find a closer one as well :-) Thanks for your help Ken -- "Microsoft isn't evil, they just make really crappy operating systems." -- Linus Torvalds

19 38

Excessive Internet Traffic
by Robert Scott 16 Sep '04

16 Sep '04

The University of Central Florida has seen a sudden jump in tcp 445 denies. It began a little after 9:00 AM EDST. New Worm? I am denying about 32 thousand packets per second. IP Cache flow show them well spread over a wide range of addresses, targeted at what apeears to be a random sample of my class B. The ACL on our border router is taking 21 million denies every 10 minutes. 60 deny tcp any any eq 445 (346740094 matches) The packets are small, since I am seeing a large nuber of packets, but the bit count is low. 30 second input rate 72679000 bits/sec, 41033 packets/sec 30 second output rate 29208000 bits/sec, 7687 packets/sec Input bits per second are a little above normal, but the packet count would normally be under 10000 not 41000. Ideas? TIA AppleBees says "No Anheuser" Robert Scott says "NO APPLEBEES!" Join The Boycott! Robert D. Scott Associate Director Computer Services and Telecommunications Network Operations University of Central Florida Robert(a)mail.ucf.edu CSB-310 407-823-0662 Voice 407-823-5476 FAX 345-0662 Sun-Com 877-549-5390 Pager

3 2

Re: Problem with whois.ripe.net?
by Greg Schwimer 15 Sep '04

15 Sep '04

3 2

Problem with whois.ripe.net?
by Greg Schwimer 15 Sep '04

15 Sep '04

I'm seeing this from multiple locations. Anyone else? I get a similar response from their web whois as well. whois -h whois.ripe.net <any IP address, RIPE or otherwise> % This is the RIPE Whois secondary server. % The objects are in RPSL format. % % Rights restricted by copyright. % See http://www.ripe.net/db/copyright.html inetnum: 0.0.0.0 - 255.255.255.255 netname: IANA-BLK descr: The whole IPv4 address space country: EU # Country is really world wide org: ORG-IANA1-RIPE admin-c: IANA1-RIPE tech-c: IANA1-RIPE status: ALLOCATED UNSPECIFIED remarks: The country is really worldwide. remarks: This address space is assigned at various other places in remarks: the world and might therefore not be in the RIPE database. mnt-by: RIPE-NCC-HM-MNT mnt-lower: RIPE-NCC-HM-MNT mnt-routes: RIPE-NCC-RPSL-MNT changed: bitbucket(a)ripe.net 20010529 changed: bitbucket(a)ripe.net 20020625 changed: hostmaster(a)ripe.net 20031014 changed: bitbucket(a)ripe.net 20040422 changed: bitbucket(a)ripe.net 20040504 source: RIPE organisation: ORG-IANA1-RIPE org-name: Internet Assigned Numbers Authority org-type: IANA address: see http://www.iana.org remarks: The IANA allocates IP addresses and AS number blocks to RIRs remarks: see http://www.iana.org/ipaddress/ip-addresses.htm remarks: and http://www.iana.org/assignments/as-numbers e-mail: bitbucket(a)ripe.net admin-c: IANA1-RIPE tech-c: IANA1-RIPE mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT changed: bitbucket(a)ripe.net 20040417 source: RIPE role: Internet Assigned Numbers Authority address: see http://www.iana.org. e-mail: bitbucket(a)ripe.net admin-c: IANA1-RIPE tech-c: IANA1-RIPE nic-hdl: IANA1-RIPE remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: RIPE-NCC-MNT changed: bitbucket(a)ripe.net 20010411 source: RIPE

4 4

Re: Excessive Internet Traffic
by J. Oquendo 15 Sep '04

15 Sep '04

// The packets are small, since I am seeing a large nuber of packets, but // the bit count is low. // 30 second input rate 72679000 bits/sec, 41033 packets/sec // 30 second output rate 29208000 bits/sec, 7687 packets/sec // Input bits per second are a little above normal, but the packet count // would normally be under 10000 not 41000. // // Ideas? This is likely a variant of what I forsee to become the "next big pain", a variant of sdbot, of which McAfee claims there are 4000 variants. I've had to deal with quite a few (and climbing) numbers of infected users of this pain. We use a Packeteer and have listed comps sending outbound 445 garbage and I've found that almost all have been infected by one of the versions of this particular worm. Which of the 4000 versions it is eludes me. This is what I've seen so far. If you look at the machine sending the traffic out, you're likely going to see a smorgasbord of junk in c:\WINDOWS\system32 ... If you view the folder as a list, then sort by date, you're likely to find a huge amount of executables on the machine. As well as logs, TFTP information etc. You can try opening up task manager but it will be useless... So being I'm already getting more and more familiar with this pest, here is what it does: ///// Public Sub AVkiller() On Error Resume Next 'prefix Dim AVmonz As Variant ' varz: Dim Cur As String '---||--- Dim i '---||--- AVmonz = Array("", "AVP Monitor", _ "AntiVir", _ "Vshwin", _ "F-STOPW", _ "F-Secure", _ "vettray", _ "InoculateIT", _ "Norman Virus Control", _ "navpw32", _ "Norton AntiVirus", _ "Iomon98", _ "AVG", _ "NOD32", _ "Dr.Web", _ "Amon", _ "Trend PC-cillin", _ "File Monitor", _ "Registry Monitor", _ "Registry Editor", _ "Task Manager") 'Declaration of AV shitz For i = 1 To 20 'kill'em all... Cur = AVmonz(i) 'convert to string Call TerminateTask(Cur) 'terminate task ;) Next i End Sub ///// Nifty huh? The virus installs itself in the registry under odd names associated with Microsoft for example, so far I've seen it installed in a Run, Run Once folder called Windows Security, Windows Update, etc. There is no removal tool for this and being it renders many virus software useless, you can either have a user reinstall Windows, or you can search the machine for instances of things created on the same date as the serv32.exe program, or one of the other ones it installs. Now... The worm seems to perhaps download 4 other programs I've always seen running in conjuction with it. wupd.exe which masquerades as "Windows Update" ftpd.exe which opens up an ftp server on the infected machine and goes around re-downloaded various other viruses and worms on the infected machine, and one which I believe tries to infect other machines perhaps a-la Blaster worm. Another program opens seems to randomly name viruses and worms once downloaded so for example, wupd.exe will probably turn into something like A032424.exe the next time around, and so on and so forth. So far I've seen students where I am either getting this via file sharing, one program which has been sticking out like a sore thumb is something called ARES. It could be also spreading, again, through some of the katrillion MS vulnerabilies and perhaps even the newly discovered "Drag and Drop" vulnerability. Drag and Drop vulnerabilities http://secunia.com/advisories/12321/ So now there is also the "bling.exe" issue which is the worm that "sniffs out passwords" (http://isc.sans.org/diary.php?date=2004-09-12) this one opens up an irc connection to dump out data to some channel. I will eventually (when I have some time) hexedit some of these to see what it does and perhaps repost more information. For a full view of what the serv32.exe does, please check out the coding at http://www.infiltrated.net/wormcode.txt which list the original URL (site down so it's Google cached) =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

1 0

Re: Network Configuration Management Practices
by John Neiberger 15 Sep '04

15 Sep '04

>Currently we do something sort of halfway: archive the actual configs >and then run audit scripts against them, which parse the configs. Definitely >not ideal but it helps catch simpler errors. One of these days when I have >extra cycles.. (yeah, right) > > Austin There are a handful of good products on the market that do this for you, like True Control from Rendition and Device Authority from Alterpoint. We recently purchased Device Authority primarily for its auditing and compliance monitoring, but also for the ease with which we can push out mass changes to devices. It's honestly cooler than sliced bread. The downside to these applications is the price. Ouch. Regardless, now that I have Device Authority, I sure as heck would not give it back! John --

1 0

Open-Source Network Management Tools
by Claydon, Tom 15 Sep '04

15 Sep '04

I'm looking for open-source alternatives for network management, such as Nagios or Big Brother. We are currently using WhatsUp Gold, and would like to move to something more flexible (and not running on a Windows platform). Something that has email/paging capabilities, and can process SNMP traps would be a plus for us as well. Recommendations? Thanks.

5 6

RE: Open-Source Network Management Tools
by Lucas Iglesias 15 Sep '04

15 Sep '04

We have been using JFFNMS (http://www.jffnms.org) for the last 2 years and works just great. You can monitor almost anything you'd like to via SNMP (we currently use it to graph Traffic, Drops, Input Errors, RTT, Packet Loss, CPU, Memory, Temperature, TCP Connections, BGP, etc). And has email/paging capabilities. Try it out and let me know. Luckas.- -----Mensaje original----- De: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]En nombre de Claydon, Tom Enviado el: Martes, 14 de Septiembre de 2004 04:48 p.m. Para: nanog(a)merit.edu Asunto: Open-Source Network Management Tools I'm looking for open-source alternatives for network management, such as Nagios or Big Brother. We are currently using WhatsUp Gold, and would like to move to something more flexible (and not running on a Windows platform). Something that has email/paging capabilities, and can process SNMP traps would be a plus for us as well. Recommendations? Thanks.

4 3

RE: Email Complexes
by JDeane＠sungardfutures.com 15 Sep '04

15 Sep '04

Fantastic. Call the providers, purchase an account and let's be done with this thread. -----Original Message----- From: Hosman, Ross [mailto:Ross.Hosman@chartercom.com] Sent: Tuesday, September 14, 2004 4:40 PM To: 'Mark Foster'; Hannigan, Martin Cc: nanog(a)merit.edu Subject: RE: Email Complexes Let me see if I can explain your entire email. Ensuring that email flows freely between our mail complex and other top mail provider complexes is a support issue correct. Actually setting up the system to monitor and to ensure the support people get the data they need is operations/engineering. We like automating a lot of our procedures as our mail complex isn't staffed 24/7. Right now we have a script that monitors incoming mail sent from probes across the us. It monitors how long it takes the email to first hit the IronPort's, then how long it takes to hit the Brightmail, then how long it takes to hit the MTA's. Our script uses pop3 to grab the email and parse the headers we send from the probes (or in this case from the complex to the pop accounts). Yes I do realize some are webmail (AOL, MSN, Gmail), but even a lot of the webmail providers do have pop3 servers. Our intent here is not not only verify that the email got there but that it got there in a reasonable time (lets face it email is becoming a more imporant part of life/business today). As fair as teaching the support guys to go look at the mail queue, would you honestly want them to be doing that? We have over 65 mail machines and should I trust them with checking them every 10 min? Since we are not staffed 24/7 what happeneds if we have all gone home? The way we have it setup if the mail never reaches the complex tier-1 gets a page, 15 minutes later if the problem still isn't solved tier-2 gets a page. I believe automating the system rather then trutsing a staff member to check it and to pray that it dosen't break during the night is a much better way of doing it. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Mark Foster Sent: Tuesday, September 14, 2004 4:04 PM To: Hannigan, Martin Cc: nanog(a)merit.edu Subject: RE: Email Complexes I find it interesting that you'd like pop3 access to a bunch of listed *webmail* providers. Who provide access via the web - NOT pop3. I also agree with the below statement - your mail queues themselves will provide far more accurate information. The issue of 'successful mail delivery' would be a support issue, not an operations issue, as long as you as an operations staffer can verify that your mailserver is not holding the mail for undue periods. (Mail doesnt have a delivery SLA in general, after all.) And if your support staff need offsite mail accounts to verify delivery delay times, they should be able to purchase them or otherwise obtain them, and keep a database of mail account access details that they can use *on demand*. This would of course entail them becoming customers and footing the regular monthly bill, or whatever. In every ISP i've ever worked for, all we've needed to do is verify that we're delivering the mail to the advertised MX in a timely fashion, and our responsibility ends at that point. Outside of the usual responsibilities of a good ISP - like providing responsive abuse/security staff, like providing a valid abuse@ contact :-) This would be one of the primary reasons your mail doesn't get accepted, and prevention is better than cure... So in all honesty - if your company wants to extend its monitoring-ability outside of its own network to those of other providers, it should do so in the 'usual fashion' - sign up. How is this something that yourself as an operations employee got involved in anyway, as it strikes me as a support issue? - Mark. On Tue, 14 Sep 2004, Hannigan, Martin wrote: > > > > Ross, > > There are a lot of knowledgeable people on this list [tier 3]. > > Why can't you already tell if you aren't getting through to major > providers? Wouldn't your queues backup, or are you being blocked and > the messages are being rejected and you are trying to track that? > > -M< > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Hosman, Ross > Sent: Tuesday, September 14, 2004 2:41 PM > To: 'paul(a)adelphiacom.net'; Roy > Cc: nanog(a)merit.edu > Subject: RE: Email Complexes > > > > Your right this isn't my department and it's not my place to tell them > how to do their job. If Roy would like to send me a valid abuse > complaint I'll make sure to forward it on or even walk it over to the > abuse department supervisor. > > I would also like to say I'm suprised at how many people have been attacking > me on/off the list for asking a simple question. I'm just trying to > ensure people are able to recieve/send mail from/to charter's mail > complex. I didn't think asking for some help would be a big deal (as I > thought there might be some people on the list from the companies that > were knowledgeable > instead of having to deal with typical tier-1 support). > > -----Original Message----- > From: Paul Bradford [mailto:paul@adelphiacom.net] > Sent: Tuesday, September 14, 2004 1:31 PM > To: Roy > Cc: Hosman, Ross; nanog(a)merit.edu > Subject: RE: Email Complexes > > > Come on... what is this.... Ross doesn't have the ability to put more > "clueful" people in abuse, he's prolly an engineer like you and me.... > we just want to fix the network.... why take this e-mail as a chance > to bash Charter? > > Ease up, > Paul > > On Tue, 2004-09-14 at 14:01, Roy wrote: > > I suggest you concentrate some resources in your abuse department. > > One charter IP address hit my firewall 1617 times so far today. > > Repeated complaints to abuse(a)charter.net just get ignored. > > > > According to the local newspaper, my fellow citizens consider > > Charter the > > worst company in town. > > > > Roy >

4 3

Re: *blocking access to rebel web sites
by J. Oquendo 15 Sep '04

15 Sep '04

>> Russian Internet providers block access to Chechen rebel web site Please excuse my off-topic response. Earlier this year I was researching terror related websites and snagged the top 25 (according to Alexa, and articles mentioning these sites) "Jihad(iot)" related "terror" sites and found that of the 25 sites, 22 were running in my own backyard, America. Rather than make this already off topic post longer here is the link to the article for anyone who would like to read it. Basically, whois, nslookup information for the top sites. I didn't bother posting the other 3 since they had little relevance to someone else's "War on Terror" http://www.politrix.org/modules.php?name=News&file=article&sid=1141 As for Kavkaz... Same *foo* different day. ISP's can block all they'd like to, but it does little since my government tells me the terrorists now use crypto, proxies, and weapons of mass destruction. So most of these cmopilliterates are now hijacking mars rovers to read my GMail and plot, just what I needed. whois kavkaz.org Domain Name: KAVKAZ.ORG Registrar: NETWORK SOLUTIONS, INC. Whois Server: whois.networksolutions.com Referral URL: Name Server: ATRIVO.BASSINTER.COM Name Server: ATRIVO2.BASSINTER.COM Updated Date: 23-feb-2002 Registrant: Udug, Movladi (KAVKAZ14-DOM) 10 Bird Lane Orlando, FL 32860 US Domain Name: KAVKAZ.ORG Administrative Contact, Technical Contact: Udug, Movladi (ZWWPQJQEGI) salatag(a)hotmail.com Udug,Movladi 10 Bird Lane Orlando, FL 32860 US +1-9745572730 123 123 1234 # whois -a 66.28.38.232 OrgName: Cogent Communications OrgID: COGC NetRange: 66.28.0.0 - 66.28.255.255 CIDR: 66.28.0.0/16 NetName: COGENT-NB-0000 TechHandle: ZC108-ARIN TechName: Cogent Communications TechPhone: +1-877-875-4311 TechEmail: noc(a)cogentco.com =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

1 0