- Test - lists.nanog.org

Whitelists for email going to hotmail/msn/yahoo?
by crayola＠optonline.net 09 Jun '04

09 Jun '04

Folks, My company is currently exploring getting on AOL's email spam whitelist since we do send a large amount of email, but it is all requested by the people that get it (confirmation of bill payments/financial transactions). Are you aware of any of websites (like AOL's postmaster site) or whitelists for Hotmail/MSN, Yahoo, and other large email providers? Thanks, Mike

2 1

alert tool for out-of-norm bandwidth?
by matthew zeier 08 Jun '04

08 Jun '04

I'm looking for some sort of tool that tracks bandwidth on a switch port and when the bit rate "suddenly" changes from the baseline alerts me. I'm playing with Team Cymru's darknet project and basically need an automated way of noting darknet traffic increase and then trigger a nagios alert. If there isn't something like this, I'll have to write it I guess. thanks. -- matthew zeier - "Curiosity is a willing, a proud, an eager confession of ignorance." - Leonard Rubenstein

1 0

RE: NLB Recommendations
by Burton, Chris 08 Jun '04

08 Jun '04

Depending on the features you need and you price point; the Cisco CSM for the 6500 works great and should scale quite well but is quite pricey. If you are looking for something smaller you could use the Cisco CSS 11500; the CSS works well since the software has been upgraded and has far lower price then the CSM. I personally have not had any wide spread experience with the F5 and Foundry equipment. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of James Baldwin Sent: Tuesday, June 08, 2004 4:33 PM To: North American Network Operators Group Subject: NLB Recommendations I'm looking for recommendations for network load balancers. These, at this time, will primarily be used to attach to a cluster of webservers although I would like a solution which can be repurposed to other applications later. I am looking at F5's Big IP, Cisco's SLB, and Foundry's ServerIron at this time.

1 0

Re: Addresses for latest spam
by Gregory Hicks 08 Jun '04

08 Jun '04

Isn't this called a "dictionary" attack? > To: Adi Linden <adil(a)adis.on.ca> > Cc: nanog(a)merit.edu > Subject: Re: Addresses for latest spam > From: Valdis.Kletnieks(a)vt.edu > Date: Tue, 08 Jun 2004 11:44:50 -0400 > > On Tue, 08 Jun 2004 09:06:35 CDT, Adi Linden <adil(a)adis.on.ca> said: > > > > Does anyone know how the latest email worms assemble the email addresses > > they use? I am getting a large amount of junk destined for non-existant > > (never existant) email accounts. So the address cannot be taken from the > > various address books on the compromised PC's. > > I'll place bets on there being 'userA(a)domain1.net' and 'userB(a)domain2.com' > in the address books, and the worm is creating all 4 combinations of left and > right hand sides (and possibly other permutations too). So you're sitting at > domain1.net and seeing 'userB(a)domain1.net' bouncing (and possibly > 'userB(a)domain2.com' as well....) > > And of course, if it finds 200 addresses, you'll get the 1 valid LHS that > was attached to your domain - and 199 LHS's that used to be attached > to 199 other domain names and were probably never valid at your site. > > But since it's a compromised PC that belongs to somebody else and the > spammer isn't paying for the bandwidth, they might as well try all 200x200, > because they know 200 of them were valid, and maybe they'll get lucky > and another 50 or 75 of the cross-product will happen to match too... ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | Internet: ghicks(a)cadence.com I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

3 2

Addresses for latest spam
by Adi Linden 08 Jun '04

08 Jun '04

Does anyone know how the latest email worms assemble the email addresses they use? I am getting a large amount of junk destined for non-existant (never existant) email accounts. So the address cannot be taken from the various address books on the compromised PC's. Adi

2 1

RE: Verizon IP's and ARIN Records
by Dennis Dayman 08 Jun '04

08 Jun '04

Seems that the problem has been addressed and fixed. Turns out that Genuity/Level3 who "owned" that range decided to turn it in to ARIN as unutilized. We are addressing what is Verizon's and what is Level3's at this time. Why is it that I feel an addressing audit coming our way... Thanks to all who responded and were kind of enough to temporarily whitelisted us. -------------------------- Dennis Dayman Verizon Internet Services Operations Security and Legal Compliance vz.security(a)verizon.net -------------------------- > -----Original Message----- > From: Dennis Dayman > Sent: Monday, June 07, 2004 11:36 AM > To: 'Nanog' > Subject: Verizon IP's and ARIN Records > > ARIN has dropped all registry information for 206.46.0.0 - > 255.255.0.0. This range includes our residential and > business mail customers. We are aware of the issue and are > addressing this NOW to have our ARIN records re-published > again. We are not sure why this has happened at this time. > Any sender verification that checks for PTR records will fail > on outbound mail from Verizon Online. > > -------------------------- > Dennis Dayman > Verizon Internet Services Operations > Security and Legal Compliance > --------------------------

1 0

RE: Team Cymru Darknet Project
by Michel Py 08 Jun '04

08 Jun '04

Oops, sorry for the fat fingers. Did not intend to send to the list. -----Original Message----- From: Michel Py Sent: Tuesday, June 08, 2004 1:00 AM To: 'Nicolas FISCHBACH'; NANOG Cc: Rob Thomas Subject: RE: Team Cymru Darknet Project > Nicolas FISCHBACH > If of interest, I covered this and other tools/setups > during BHEU2004: "Building an Early Warning System in > a Service Provider Network" > PPT: http://www.securite.org/presentations/secip/ > BHEU2004-NF-SP-EWS-v11.ppt Est-ce que tu aurais un audio de cette présentation, par hasard? Merci Michel.

1 0

RE: Team Cymru Darknet Project
by Michel Py 08 Jun '04

08 Jun '04

> Nicolas FISCHBACH > If of interest, I covered this and other tools/setups > during BHEU2004: "Building an Early Warning System in > a Service Provider Network" > PPT: http://www.securite.org/presentations/secip/ > BHEU2004-NF-SP-EWS-v11.ppt Est-ce que tu aurais un audio de cette présentation, par hasard? Merci Michel.

1 0

RE: IT security people sleep well
by Jason Frisvold 08 Jun '04

08 Jun '04

> -----Original Message----- > From: Robert Boyle [mailto:robert@tellurian.com] > > Agreed. I really truly don't see the problem with plaintext telnet > management of routers. We have access-lists on vty 0 15 > specifying which > networks can even connect. We can't connect except for from a trusted > internal management network and I control all the routers and > circuits in > the path. If someone is in the middle of one of my circuits > doing some type > of dump of the data to disk, they are probably the NSA or > CIA, and I've got > much bigger problems. Can someone please provide a situation Yeah, that would be a concern... :) > where doing > this can lead to compromise or any type of problem at all? I > just don't see Do you trust every person you work with? Are your internal networks completely segmented (including the ethernet switches?) Here, they are not. And as much as it's been pointed out, they continue to leave everyone in the company on the same segment. Our security guy proved this point by hijacking a switch, convincing it that the traffic had to pass through his computer, and sniffed a TON of traffic ... All within a few minutes, without anyone knowing until he showed it... Through this, he was able to grab a number of passwords all through telnet sessions. Unless you can completely trust everyone in your internal network, ACL's aren't always enough... > it. However, I see people having unpatched servers running > without proper > ACLs every day and this is rarely discussed and as Stephen > Sprunk points > out, lot of people here on nanog don't apply bogon filters or > even source > filter their customers - and this doesn't require a feature > set upgrade to > IOS. (All of which we do, btw) So I'm still not convinced that SSL on > routers is needed. Nice, sure, but needed? no. Please > convince me otherwise > if you feel this is such a hugely pressing need or at least > explain your > position. I've been converted into the "secure it if you can, ensure it's not important if you can't" way of thinking ... I would very much like to change our ACL's to only allow telnet from our server farm (which is SSH *ONLY*), thus allowing a little bit of security ... This would at least bring us into the "if someone's listening, it's gotta be the NSA or CIA" class of security... :) > R Jason Frisvold Penteledata

3 3

RE: IT security people sleep well
by Michel Py 08 Jun '04

08 Jun '04

> Valdis.Kletnieks(a)vt.edu wrote: > OK.. Say you can get it into the code train for 200K. What do > you do with all those routers that have only 100K or 125K of > space left in the flash (if that), and the flash is NOT going > to get any bigger without massive abuse of a soldering iron Being one of these who have massively abused the soldering iron (I run 12.2T on a 3102 and I _do_ plan on running it on an IGS) the fact of the matter is that these days are gone. On my all-mighty home router (7507/RSP2) I have 64 _megs_ of flash that cost me a mere 20 bucks at Fry's and 128 megs of RAM that cost me $0 because I scrounged them from an old server. The RSP2 does not support el-cheapo digital camera flash? That's true, it's not in the list of approved memory. Nevertheless :-D cisco7507#sh diagbus Slot 2: EEPROM format version 1 Route/Switch Processor 2, HW rev 1.02, board revision F0 Flags: cisco 7000 board; 7500 compatible cisco7507#sh ver cisco RSP2 (R4700) processor with 131072K/2072K bytes of memory. R4700 CPU at 100Mhz, Implementation 33, Rev 1.0 64000K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). In modern environments, I have to admit that 2500s are a though call but I will also point out that a 2600 goes for near-to-nothing on eBay, and even when you re-license IOS and upgrade it still costs near-to-nothing. For the enjoyment of Nanog readers, the following links display what you should _not_ do if you don't want to void the warranty on your brand new Cisco 3102 (it was before I decided to run 12.2(T) on it, more soldering has happened since). Michel. http://arneill-py.sacramento.ca.us/photo_albums/first%20album/high/cisco %203000%20decapitated%20serial.jpg http://arneill-py.sacramento.ca.us/photo_albums/first%20album/high/cisco 3000.jpg What do you mean, it's not new? It was new when I bought it!

1 0