- Test - lists.nanog.org

149.174.10.0 149.174.99.0 Ddos UDP DNS Denial ?
by Pete 13 Jun '04

13 Jun '04

149.174.10.0 149.174.99.0 DDOS UDP DNS Aol your clients are either performing a ddos attack on the following IP addresses or they are refusing the answers. The NetFlow Output shows the requests and the answers, what is going on here? Aol admins, if you are there then, please call us immediately, 301-340-1533 Sincerely, Peter Schroebel crossfire(a)smsonline.net admin(a)e-annix.com Se1/0 149.174.10.7 Fa0/0 66.79.98.30 11 2427 0035 2 Se3/1 149.174.10.8 Fa0/0 66.79.98.30 11 2427 0035 16 Se3/0 149.174.10.7 Fa0/0 66.79.98.40 11 2427 0035 13 Se3/0 149.174.10.9 Fa0/0 66.79.98.30 11 2427 0035 21 Se3/0 149.174.10.8 Fa0/0 66.79.98.30 11 2427 0035 11 Se3/1 149.174.10.7 Fa0/0 66.79.98.40 11 2427 0035 18 Se3/0 149.174.10.9 Fa0/0 66.79.98.30 11 2425 0035 1 Se3/1 149.174.10.4 Fa0/0 66.79.98.40 11 2427 0035 11 Se3/0 149.174.10.8 Fa0/0 66.79.98.30 11 2425 0035 1 Se3/0 149.174.10.4 Fa0/0 66.79.98.40 11 2427 0035 11 Se1/0 149.174.10.9 Fa0/0 66.79.98.30 11 2427 0035 3 Se1/0 149.174.10.7 Fa0/0 66.79.98.40 11 2427 0035 9 Se1/0 149.174.10.8 Fa0/0 66.79.98.30 11 2427 0035 11 Se1/0 149.174.10.4 Fa0/0 66.79.98.40 11 2427 0035 29 Se3/0 149.174.10.7 Fa0/0 66.79.98.30 11 2427 0035 6 Se3/1 149.174.10.7 Fa0/0 66.79.98.30 11 2427 0035 11 Se1/0 149.174.10.9 Fa0/0 66.79.98.40 11 2427 0035 2 Se1/0 149.174.10.8 Fa0/0 66.79.98.40 11 2427 0035 16 Se3/0 149.174.10.9 Fa0/0 66.79.98.40 11 2425 0035 1 Se3/1 149.174.10.8 Fa0/0 66.79.98.40 11 2427 0035 11 Se3/0 149.174.10.9 Fa0/0 66.79.98.40 11 2427 0035 44 Se3/0 149.174.10.8 Fa0/0 66.79.98.40 11 2427 0035 3 Se3/1 149.174.10.9 Fa0/0 66.79.98.40 11 2427 0035 16 Se3/1 149.174.10.4 Fa0/0 66.79.98.30 11 2427 0035 13 Se3/0 149.174.10.4 Fa0/0 66.79.98.30 11 2427 0035 15 Se1/0 149.174.10.4 Fa0/0 66.79.98.30 11 2427 0035 17 Fa0/0 66.79.98.60 Se1/0 149.174.166.25 11 0035 8001 5 Fa0/0 66.79.98.40 Se3/0 149.174.10.4 11 0035 2427 98 Fa0/0 66.79.98.40 Se3/0 149.174.10.8 11 0035 2427 43 Fa0/0 66.79.98.40 Se3/0 149.174.10.9 11 0035 2425 1 Fa0/0 66.79.98.40 Se3/0 149.174.10.7 11 0035 2427 179 Fa0/0 66.79.98.40 Se3/0 149.174.10.9 11 0035 2427 46 Fa0/0 66.79.98.30 Se3/0 149.174.10.9 11 0035 2427 46 Fa0/0 66.79.98.30 Se3/0 149.174.10.9 11 0035 2425 1 Fa0/0 66.79.98.30 Se3/0 149.174.10.8 11 0035 2427 43 Fa0/0 66.79.98.30 Se3/0 149.174.10.7 11 0035 2427 18 Fa0/0 66.79.98.30 Se3/0 149.174.10.4 11 0035 2427 99 Fa0/0 66.79.96.5 Se1/0 149.174.166.25 11 0035 8001 5 Fa0/0 66.79.98.40 Se3/0 149.174.99.54 11 0035 2425 1 Fa0/0 66.79.98.40 Se3/0 149.174.99.54 11 0035 2427 50 Fa0/0 66.79.98.40 Se3/0 149.174.99.48 11 0035 2427 42 Fa0/0 66.79.98.40 Se3/0 149.174.99.44 11 0035 2427 207 Fa0/0 66.79.98.40 Se3/0 149.174.99.43 11 0035 2427 36 Fa0/0 66.79.98.30 Se3/0 149.174.99.48 11 0035 2427 42 Fa0/0 66.79.98.30 Se3/0 149.174.99.44 11 0035 2427 125 Fa0/0 66.79.98.30 Se3/0 149.174.99.43 11 0035 2427 36 Fa0/0 66.79.98.30 Se3/0 149.174.99.54 11 0035 2427 52 Fa0/0 66.79.98.30 Se3/0 149.174.99.54 11 0035 2425 1 Se3/0 149.174.166.25 Fa0/0 66.79.96.5 11 8001 0035 4 Se3/1 149.174.166.25 Fa0/0 66.79.96.5 11 8001 0035 1 Se1/0 149.174.166.25 Fa0/0 66.79.96.5 11 8001 0035 2 Se1/0 149.174.166.25 Fa0/0 66.79.98.60 11 8001 0035 1 Se3/1 149.174.166.25 Fa0/0 66.79.98.60 11 8001 0035 3 Se3/0 149.174.166.25 Fa0/0 66.79.98.60 11 8001 0035 3 Se3/1 149.174.99.54 Fa0/0 66.79.98.40 11 2427 0035 7 Se3/0 149.174.99.54 Fa0/0 66.79.98.40 11 2427 0035 17 Se3/0 149.174.99.54 Fa0/0 66.79.98.40 11 2425 0035 1 Se1/0 149.174.99.54 Fa0/0 66.79.98.30 11 2425 0035 1 Se3/1 149.174.99.48 Fa0/0 66.79.98.40 11 2427 0035 12 Se3/0 149.174.99.48 Fa0/0 66.79.98.40 11 2427 0035 19 Se1/0 149.174.99.54 Fa0/0 66.79.98.30 11 2427 0035 18 Se3/1 149.174.99.54 Fa0/0 66.79.98.30 11 2427 0035 13 Se1/0 149.174.99.48 Fa0/0 66.79.98.40 11 2427 0035 11 Se3/0 149.174.99.54 Fa0/0 66.79.98.30 11 2427 0035 22 Se1/0 149.174.99.54 Fa0/0 66.79.98.40 11 2427 0035 9 Se3/1 149.174.99.44 Fa0/0 66.79.98.30 11 2427 0035 2 Se3/0 149.174.99.44 Fa0/0 66.79.98.30 11 2427 0035 9 Se3/1 149.174.99.43 Fa0/0 66.79.98.30 11 2427 0035 25 Se1/0 149.174.99.44 Fa0/0 66.79.98.30 11 2427 0035 19 Se1/0 149.174.99.43 Fa0/0 66.79.98.30 11 2427 0035 15 Se3/1 149.174.99.48 Fa0/0 66.79.98.30 11 2427 0035 14 Se3/0 149.174.99.48 Fa0/0 66.79.98.30 11 2427 0035 6 Se1/0 149.174.99.48 Fa0/0 66.79.98.30 11 2427 0035 13 Se1/0 149.174.99.43 Fa0/0 66.79.98.40 11 2427 0035 8 Se1/0 149.174.99.44 Fa0/0 66.79.98.40 11 2427 0035 6 Se3/1 149.174.99.44 Fa0/0 66.79.98.40 11 2427 0035 24 Se3/0 149.174.99.44 Fa0/0 66.79.98.40 11 2427 0035 1 Se3/0 149.174.99.43 Fa0/0 66.79.98.40 11 2427 0035 9 Se3/1 149.174.99.43 Fa0/0 66.79.98.40 11 2427 0035 44 Sincerely, Peter Schroebel crossfire(a)smsonline.net admin(a)e-annix.com

1 0

QOD: Which is worse - Spam or Attacks?
by Pete 13 Jun '04

13 Jun '04

a.>Spam is a relative issue that consumes a fixed percentage of everyone's time. [ DONE ] b.> Ddos, Syn, Udp and Ack Attacks are limitless and ever consuming, there is no sure fix without blocking and even then the blocking must be additionally carried up the upstream or peers. What makes matters worse is that ISP's such as SBC don't publish their NOC's telephone number, due to anti spam complaints. Yet, one of their clients can be infected with the pound-it-up-your-ass worm and whipping up a wicked Ddos Attack on anyone within the same class "a" and their subsequent peers. You' will have to send the SBC NOC a Fax!. And if they feel like it, they will call you back? I hosting many bulk websites over the years, but at all times our contact information was correct and we answered the telephone. Granted, I may have been impolite to some folks but, I did shutdown sites upon request too. We did not tolerate anyone that used invalid information and tossed them out just as soon as we found them or were notified of the problem. So, I put these question on the floor . . . How is it that a small web-hosting ISP can be condemned for not handling their clientele as spammers. On the otherhand the "fat-dog" ISP's can blantantly state that they deny access and using misleading information are not held to the same standards. And in-fact are not even using any port filtering to prevent their clients from infecting the world?

1 0

Re: "Default" Internet Service
by Per Gregers Bilse 13 Jun '04

13 Jun '04

Just because one can find a counter argument against an argument doesn't mean the original argument is invalid. Do you lock your front door when you leave home? Yes. Can a burglar break in? Yes. Is the police responsible for maintaining law and order? Yes. Are car owners responsible for keeping their cars roadworthy? Yes. Are road authorities responsible for keeping the roads carworthy? Yes. Are car manufactureres responsible for manufacturing roadworthy cars? Yes. Do pilots have responsibility? Yes. Are air traffic controllers responsible for air traffic? Yes. Are you allowed to shout "FIRE" in a crowded theatre? Yes. Does paper wrap rock? Yes. Do scissors cut paper? Yes. Does rock blunt scissors? Yes. "Yes to all?" Yes. Anybody care to mention Hitler and Nazis? Yes? Please? Pretty please? -- Per

5 5

Re: Points on your Internet driver's license (was RE: Even you can be
by Adi Linden 13 Jun '04

13 Jun '04

> Sorry, that doesn't hold up entirely. My ADSL connections to my ISP are > being used to route IP addresses that belong to me. It's a home DSL > service coming into my house, but, I have my own portable address space > and enough clue to manage my own systems, firewall(s), etc. Why should > I be forced to pay your clue tax? My arguments are in respect to broadband connections to homes and offices without IT department, firewalls or cluefulness. If you own your own IP space you'd be considered an ISP, buying transit rather than broadband home DSL. What the physical wire looks like the service is delivered on really doesn't matter. If I see your ip space bombarding my mail server I can trace its origin. I can contact you and request to fix the problem. If you ignore me, refuse to fix the problem I can contact your upstream. Your upstream should then have a repsonsiblility to resolve the issue including suspension of service if my claims are valid and breach AUP. Adi

2 1

Re: "Default" Internet Service (was: Re: Points on your Internet
by Paul Vixie 13 Jun '04

13 Jun '04

> I don't think it should be limited to cable and dsl providers. I > think this model is applicable across the board, and, I think it is a > reasonable solution. ... thanks for your kind words, but this only scales. for a home dsl/cable user (or a home ppp user if there still are any), values of N are imaginable, like USD$500.00 for example, where the cost of paying a fraction of it is close to the cost of managing the operating systems of the connected computers, which assumes that (a) there are many millions of possible customers for this, and (b) the operating system environments are mostly identical or very simple, like bimodal between apple mac/os x and microsoft windows xp. to offer this "across the board" one would find that the cost of providing operating system management to the average T1 user is far far far in excess of what that user is willing to pay to avoid progressive fines. but that's actually not a problem, since there are comparatively few of these users and they're probably paying enough to justify a real abuse desk for them. re: > > now, though, there's an opportunity to do a marketing U-turn on this. > > cable and dsl providers in the USA can point to the national > > cybersecurity plan and say that to comply with it they have to put > > infected computers in cyberjail, with a fee of $N to get these machines > > audited, and if found clean, put back on the net, noting that N doubles > > every time this process is invoked, and that a deposit of $(0.5*N) is > > required as prepayment for the next incident, refundable after one year > > if there are no further incidents. then offer to remotely manage their > > host ("give me your root passwords, trust me!") for an annual fee of > > $(0.75*N). if the initial value of N were $500, you might be able to get > > the people who need this service to pay for it. it's worth a try? -- > > Paul Vixie

1 0

Re: Points on your Internet driver's license (was RE: Even you can
by Paul Vixie 13 Jun '04

13 Jun '04

> > so you aren't going to google for "chemical polluter business model", huh? > > I hope you also google for Nonpoint Source Pollution. > > ISPs don't put the pollution in the water, ISPs are trying to clean up > the water polluted by others. ISPs are spending a lot of money cleaning > up problems created by other people. where you got it from before you dumped it into the stream that feeds me is a yet another problem that i'd rather you resolved without my involvement.

1 0

Looking for a Akamai admin
by Pete 13 Jun '04

13 Jun '04

If their is a Akamai Admin in the channel, please contact me off channel crossfire(a)smsonline.net Peter 301-340-1533

1 0

Re: AboveNet major backbone issues
by Edward Henigin 12 Jun '04

12 Jun '04

Edward Henigin wrote: > > It appears that AboveNet is having major worldwide backbone issues at > the moment. We were seeing high latency from the US to Europe, and now > some European routes are no longer being advertised to the US. We are seeing those European routes again. Looks like the downtime for the European routes was from 11:00am to 12:15pm central time. Anyone have any more information? Leo? Ed

2 1

AboveNet major backbone issues
by Edward Henigin 12 Jun '04

12 Jun '04

It appears that AboveNet is having major worldwide backbone issues at the moment. We were seeing high latency from the US to Europe, and now some European routes are no longer being advertised to the US. Ed

5 6

RE: Even you can be hacked
by David Schwartz 12 Jun '04

12 Jun '04

This will be my last post on this issue. In this case: 1) Almost certainly the traffic was due to a worm. 2) Almost certainly the ISP knew (or strongly suspected) the traffic was due to a worm. 3) Quite likely, the ISP never carried most of the traffic to its destination. Once they knew it was worm traffic, they were probably filtering by port. 4) The ISP should not have carried the attack traffic, if they actually did. Doing so is negligent and creates additional innocent victims. Maybe they would give their customer a short time to straighten things out, but that's it. 5) An ISP should not be paid for traffic they only carried out of their own negligence. This doesn't negate the customer's responsibility to anyone but the ISP and only if the ISP is actually negligent, not just the customer. Yes, given the facts we know, it's possible that the ISP really does deserve to be paid, this traffic wasn't due to a worm, or there was no way the ISP could be sure. However, far more likely, the facts are as I state them above. So why does everyone think the ISP is almost certainly entitled to be paid? Is it because they're ISPs? Is it because it's easy to blame someone else? DS

3 3