- Test - lists.nanog.org

TWTC Backbone
by Don Lundquist 21 Mar '04

21 Mar '04

Is anyone experiencing difficulties with the TWTC backbone? I have been experiencing some strange performance issues where icmp and trace routes seem to work fine but http and other protocols seem to get squashed...? Regards, Don don.lundquist(a)peak-10.com 704.264.1010

2 1

FW: Where is this info coming from?
by Eric Krichbaum 21 Mar '04

21 Mar '04

When I use a looking glass tool like GASP or lg.level3.net etc. on our 66.118.64.0/19 space, it's shows up as MOUNTAINNET which we haven't used for years. ARIN's whois info shows it correctly. Where should I go to correct this, please? Eric Krichbaum

1 0

Re: UDP port 4000 traffic: likely a new worm
by Rodney Joffe 21 Mar '04

21 Mar '04

Unfortunately the vulnerability has proven to not be restricted to port 4000. Keep monitoring SANS :-( -----Original Message----- From: Josh Richards <jrichard(a)digitalwest.net> Date: Sat, 20 Mar 2004 13:50:30 To:nanog@merit.edu Subject: Re: UDP port 4000 traffic: likely a new worm The good news is that "witty" appears to not be a very witty propagator. Our flow data shows attempts to connect to 4000/udp on hosts in our network having a downward trend over the last few hours: Time Unique Source IPs 08:00 350 09:00 332 10:00 297 11:00 298 12:00 265 (all times PST) -jr * Josh Richards <jrichard(a)digitalwest.net> [20040320 11:10]: > > Confirmed. We had our first customer (colo) hit yesterday evening at > 20:43 PST. Additionally, they experienced the hard drive corruption (which > was added to the ISC diary entry within the last several hours). Traffic > was 4000/udp. Initial 90 Mbit/s peak which leveled out at a constant > 60 Mbit/s before we took them off-line. > > -jr > > * Johannes B. Ullrich <jullrich(a)sans.org> [20040320 00:44]: > > Looks like there may be a worm going around hitting systems that run > > BlackIce. Common characteristics of the packets: Source port 4000 (but > > random target port) and the string > > "insert witty message here". > > > > details will be posted here: > > http://isc.sans.org/diary.html > > as I get them together. -- Josh Richards | Colocation Web Hosting Bandwidth Digital West Networks | +1 805 781-9378 / www.digitalwest.net San Luis Obispo, CA | AS14589 & AS29962 jrichard(a)digitalwest.net | DWNI - Making Internet Business Better

1 0

Re: Personal Co-location Registry
by Michael Hanulec 21 Mar '04

21 Mar '04

many servers are also starting to feature IPMI <nanog(a)merit.edu> which allows for the remote console (that provides the VGA output slow.. only good for emergencies or for Windows servers) and power cycling of servers. Compaq/HP includes this feature in their Proliant servers, and many other white box vendors do too via the re-selling/integration of machines/motherboards from companies like SuperMicro.com. if anyone has some really specific questions about IPMI and various motherboard manufactures i might be able to help out as i work as a Sr. System Engineer at a white box company (but in reality i'm a unix hack/administrator) -mike -- hanulec(a)hanulec.com cell: 858.518.2647 && 516.410.4478 https://secure.hanulec.com EFnet irc && aol im: hanulec

6 5

Suresh in the WSJ
by Fred Heutte 20 Mar '04

20 Mar '04

Forgive the continuing thread on s**m, but there was a good article on the front page of the Friday Wall Street Journal's Marketplace section, "The Spam-China Link." Countries like China, South Korea and Taiwan "are becoming centers of Internet fraud, the way Grand Cayman or the Bahamas are havens for tax fugitives," says Suresh Ramasubramanian, a founder of the Asia Pacific Coalition Against Unsolicited Commercial Email. fh

1 0

Prodigy
by Curt Akin 20 Mar '04

20 Mar '04

Anyone have a security contact e-mail at prodigy.net? security(a)prodigy.net bounces with user unknown. -- Best regards, Curt 42.7% of all statistics are made up on the spot.

2 1

Personal Co-location Registry
by Paul Vixie 20 Mar '04

20 Mar '04

http://www.vix.com/personalcolo/ http://www.vix.com/personalcolo/ http://www.vix.com/personalcolo/ notes: (1) even in germany they call them "19 inch" racks, thus setting the clock back several decades. (2) i'm very interested in listing more non-US locations (3) i'm interested in listing more locations, period (4) further additions, or any changes, should be sent in HTML source format (5) what a great community -- i've learned a LOT in the last four days!

15 18

Re: Progress against spam
by Eric Brunner-Williams in Portland Maine 20 Mar '04

20 Mar '04

Two weeks ago at the Rome meeting of ICANN I made a proposal informally to a few other registrars that we look into this. I'd not heard that AOL was going to do something similar. Basically, something EPP-esque, so that registrars, a smaller body to define one, or more levels of "trust", than "users" could automate hijacking of the receive-value sites. In theory, registrars share state with registrars, and allow 3rd-parties to act on the shared state, and there is a value proposition. When the ICANN BoD said VGRS may define as a "registry service" any instance of shared state between registrars and monopolize the services that arise from shared state, that idea was moot. The WLS non-debate at Rome looked like it was about morality and wonderfullness and all that, YMMV, but it ment that if there is money to be made in the dns around capturing the value spammers take without paying, and improving the situation, something similar to the approaches taken by ISPs and 3rd-party address list (block|permit|modify) maintainers, that VGRS will take it. Eric

1 0

Progress against spam
by Henry Linneweh 20 Mar '04

20 Mar '04

AOL Blocks Spammers' Web Sites http://www.washingtonpost.com/wp-dyn/articles/A9449-2004Mar19.html � I think this is noteworthy and may help... � -Henry

1 0

Re: SPAM and Virus emails to NANOG
by George William Herbert 19 Mar '04

19 Mar '04

Steve Bellovin writes: >"Gregory Taylor" writes: >>Can somebody explain to me why I keep getting e-mails with no content that are >> setting off my virus scanners via NANOG list? > >Probably because there's a worm that's sending the messages -- messages >that purport to be from legitimate NANOG posters. Let me guess -- the >body of these messages starts <OB JECT STYLE='display:none"...> (I've >added a blank because the existence of the exact string does trigger >some filters.) Yeah, exactly. The one last night appeared to come from one of my old accounts (gherbert(a)crl.com) CRL (the ISP, in San Francisco) no longer exists, though the domain is apparently now an alias for Charles River Labratories in Massachusetts. Presumably, gherbert(a)crl.com was still in the nanog-post list database from the Early days because I didn't delete it when CRL became an ex-company, so it got in through the filters at Merit (I have sent them mail to rectify that). But this was just random bad luck from virus. A lot of the virus/worm infections now will pick random pairs of addresses out of people's mailboxes; one is used as the "from" in a new virus message, the other as the recipient. Someone I sent mail to at some point, who had received nanog mail (or some combination thereof) got a virus, and it lucked out in picking a recipient (nanog) that was a closed list but using a From: address that was a valid sender for the list. This could happen again any time if anyone else on the list gets a virus, if the From/To pairs that are randomly picked turn out to line up with the list in a valid way. The virus came to Merit from 151.202.157.67, which is a Verizon parent block, and the particular set of addresses are One FN (NET-151-202-157-64-1). Who are someone at 1 Park ave, New York. I live in Oakland, California. Welcome to the new exciting world of Outlook. This is why I use nmh as my mail user agent. But it doesn't protect anyone else out there from viruses impersonating me in this manner. Or impersonating you, or anyone else... -george william herbert gherbert(a)retro.com

3 2