- Test - lists.nanog.org

Re: Packet Kiddies Invade NANOG
by Gregory Taylor 14 Mar '04

14 Mar '04

maturity in its purest form. ---------- Original Message ---------------------------------- From: <albertpublic(a)hushmail.com> Date: Sat, 13 Mar 2004 17:17:42 -0800 > >I've noticed a number of shining stars in the network engineering industry >have graced us >with their presence and infinite wisdom in the past few days, including >Gregory Taylor. I >can't help but wonder if this is the same who launched multi-gigabit >DDoS attacks against >IRC servers and major ISP's recently: > >http://www.geocities.com/osek_owned/ >http://www.urbandictionary.com/define.php?term=osek > >Coincidence? You decide. Better yet, call his mother at 1-253-475-1227, > and let her know >you don't approve of his hacking activities. If enough of us put the >pressure on, it's possible >he'll be grounded, and his computer priviledges will be revoked. It's >happened before, it can >happen again. > >For those of you wondering, "Xpert Web Builders" (XWB.COM) is bogus. > They don't operate a >network, they're a sole proprietorship tech support and web dev group, > run by some clue- >challenged kids who don't even have the cashflow needed to invest in >a post-paid cellular >phone. > >Then there's Andrew Kirch, aka "trelane", who just published a fascinating >(albeit highly >technically inaccurate, and bearing little or no basis in reality) >whitepaper on the "script kiddie culture": > >http://software.newsforge.com/software/04/02/28/0130209.shtml > >Only problem is, he hangs out on EFNet in #sigdie, a channel known in >security circles as a >place where large-scale DDoS attacks, usually involving 1000's of >drone nets or otherwise compromised machines, are coordinated. Takes >one to know one, I >guess. The fun doesn't stop there: he's publicly admitted to helping > >packet IRC servers before! > >I'm still working on building a rap sheet on Kirch's friend, Brian Bruns, > and their "Summit >Open Source Development Group" (which, by all accounts, is a >legitimate-looking front for their not-so-legitimate activities). If >anyone has any info, mail >me privately, and I'll summarize. > > > >Concerned about your privacy? Follow this link to get >FREE encrypted email: https://www.hushmail.com/?l=2 > >Free, ultra-private instant messaging with Hush Messenger >https://www.hushmail.com/services.php?subloc=messenger&l=434 > >Promote security and make money with the Hushmail Affiliate Program: >https://www.hushmail.com/about.php?subloc=affiliate&l=427 >

1 0

Re: who offers cheap (personal) 1U colo?
by Paul Vixie 14 Mar '04

14 Mar '04

> On the other hand, if the person doesn't have a UPS at home, what good is > when their SMTP server in a colo is still chugging? :) as a matter of courtesy, it's good to let mail be delivered rather than sitting in other people's retry queues. especially secondary-mx retry queues.

1 0

Packet Kiddies Invade NANOG
by albertpublic＠hushmail.com 14 Mar '04

14 Mar '04

I've noticed a number of shining stars in the network engineering industry have graced us with their presence and infinite wisdom in the past few days, including Gregory Taylor. I can't help but wonder if this is the same who launched multi-gigabit DDoS attacks against IRC servers and major ISP's recently: http://www.geocities.com/osek_owned/ http://www.urbandictionary.com/define.php?term=osek Coincidence? You decide. Better yet, call his mother at 1-253-475-1227, and let her know you don't approve of his hacking activities. If enough of us put the pressure on, it's possible he'll be grounded, and his computer priviledges will be revoked. It's happened before, it can happen again. For those of you wondering, "Xpert Web Builders" (XWB.COM) is bogus. They don't operate a network, they're a sole proprietorship tech support and web dev group, run by some clue- challenged kids who don't even have the cashflow needed to invest in a post-paid cellular phone. Then there's Andrew Kirch, aka "trelane", who just published a fascinating (albeit highly technically inaccurate, and bearing little or no basis in reality) whitepaper on the "script kiddie culture": http://software.newsforge.com/software/04/02/28/0130209.shtml Only problem is, he hangs out on EFNet in #sigdie, a channel known in security circles as a place where large-scale DDoS attacks, usually involving 1000's of drone nets or otherwise compromised machines, are coordinated. Takes one to know one, I guess. The fun doesn't stop there: he's publicly admitted to helping packet IRC servers before! I'm still working on building a rap sheet on Kirch's friend, Brian Bruns, and their "Summit Open Source Development Group" (which, by all accounts, is a legitimate-looking front for their not-so-legitimate activities). If anyone has any info, mail me privately, and I'll summarize. Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Enterprise Multihoming
by John Neiberger 13 Mar '04

13 Mar '04

>>> "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> 3/12/04 9:06:38 AM >>> >I dont agree that connecting to two+ upstreams makes you better. In my >experience end networks have a couple of orders of magnitude more downtime than >a PoP in any reasonably large ISP. Ie the percentage theoretical improvement is >small. > >In addition you seriously increase the complexity of your system, chances are >you're using the cheapest kit you could find (or at least cheaper and smaller >than what I would use).. its not great at BGP and may fall over when you get a >minor DoS attack, you probably generate flaps quite a bit from adhoc changes and >if you're announcing a /24 then thats going to get you dampened quickly.. so you >actually create a new weakest link. Also most of the corporates I've dealt with >take defaults rather than full tables.. so if the provider does have an issue >you still forward the traffic, theres no failover of outbound routing. > >Even if you spend (waste) the money on some decent gear, you're on your own and >when a problem occurs the ISPs are going to be less helpful to you (not by >choice, I mean they dont have control of your network any more.. there knowledge >of whats causing problems is limited to the bit that they provide to you), so >chances are your problems may be more serious and take longer to diagnose and >fix. The above arguments are rather similar to the ones I heard on the other discussion list I mentioned, and they were somewhat compelling. > >IMHO avoid multihoming. You will know when you are big enough and you *need* to >do it, if you're not sure or you only want to do it cause you heard everyone >else is and its real cool then I suggest you dont. In our case, we already are multihoming and I'm considering moving away from that to a simpler solution. It's been my assertion that we didn't need to multihome in the beginning. The decision was made at a level higher than me. However, now that we have it I'm trying to determine the pros and cons related to moving to a single provider. Thanks, John --

3 2

RE: who offers cheap (personal) 1U colo?
by Michel Py 13 Mar '04

13 Mar '04

>> Michel Py wrote: >> I pay $36/mo for my aDSL. $50 _more_ sounds a lot. > Paul Vixie wrote: > rest assured, some of the mail i've received in > response to this has even lower price points. I'm not the one to convince; you're preaching the choir. What do you say to the non-geek female Supreme Commander that oversees the home budget? I'm walking a fine line already with 9 computers, a 12U router that makes more noise than a 747, and a fair amount of other indispensable network geek items. > most domestic residences don't have UPS I do, and the geek clientele that reads this that would colo a 1U likely does as well. As a matter of fact, I have 5 UPSes at home: one for the server, one for the router (needs one on its own), one for my PC, one for my wife's PC and even one for the DirecTiVo DVR (an old 200va that can't power any recent computer). > or high speed IP with static global addresses. I also have this and it would also be higher on the list of many network geeks than the 1U colo me thinks. > jlewis(a)lewis.org wrote: > (though I imagine they'd also do some personal web hosting > and maybe other things as long as the machine was there), I don't see what. For the kind of personal web hosting I care of, my 384 upstream is more than I need. Besides, half of the stuff on my home page would have to come from the home server in the first place. > You'd have to be a pretty hard core netgeek and have the > disposible income ($600/year + the server...I can think > of lots of better ways to spend that) So can my wife. Michel.

1 0

RE: who offers cheap (personal) 1U colo?
by Michel Py 13 Mar '04

13 Mar '04

> Paul Vixie wrote: > every time i tell somebody that they shouldn't bother > trying to send e-mail from their dsl or cablemodem ip > address due to the unlikelihood of a well staffed and > well trained and empowered abuse desk defending the > reputation of that address space, i also say "buy a > 1U and put it someplace with a real abuse desk, and > use your dsl or cablemodem to tunnel to that place." <me puts the devil's advocate suit on> $50 is a lot of money; I currently send email from my aDSL address because a) my ISP's smarthost sucks b) historically their SMTP hosts have been blacklisted more than mine c) even if they did not suck (which has improved a lot recently, actually) they still won't accept large attachments or mailing-list traffic. I pay $36/mo for my aDSL. $50 _more_ sounds a lot. </me puts the devil's advocate suit on> Besides, although this list is definitely the right place to find people that would operate a personal SMTP relay in a colo just by the virtue that it's the geeky thing to do, what does it change in the big scheme of things? All these small business customers (20 persons) that I have that use a sub-$100 "business" DSL and M$ Small Business Server + Exchange are not going to go for it, because the cost then will suddenly become $50 plus the 1U server plus my time plus maintaining it. Michel.

3 2

possible new DoS?
by Christopher J. Wolff 13 Mar '04

13 Mar '04

Over the past week the following error started to appear in the router logs; Mar 9 19:44:16 fe-0-1-100.blah.net 16: Mar 10 02:44:15.477: %CRYPTO-4-IKMP_NO_SA: IKE message from 206.207.248.58 has no SA and is not an initialization offer. According to Cisco, 1. %CRYPTO-4-IKMP_NO_SA: IKE message from [IP_address] has no SA and is not an initialization offer IKE maintains the current state for a communication in the form of security associations. No security association exists for the specified packet, and it is not an initial offer from the peer to establish one. This situation could indicate a denial-of-service attack. Any suggestions are appreciated. The router that generated those log files dropped part of an IGP routing table. Since I've never seen this log entry before, I'm curious whether it's a 'new' DoS. Thank you. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

1 0

Telia v ATT?
by Timothy Brown 13 Mar '04

13 Mar '04

Can anyone shed any light on the difficulties last night between Telia and {AT&T, ATDN, others}? For a while it seemed like it was AT&T specific. The problem started about 9:30pm Eastern and didn't get resolved until about 12:30am; during this time routes were being seen but traffic wasn't passing over interfaces between Teliasonera and AT&T at a minimum, and probably several other providers as well. Feel free to respond privately. Tim

1 0

RE: Load Balancing Multiple DS3s (outgoing) on a 7500
by Michel Py 13 Mar '04

13 Mar '04

> Patrick W.Gilmore wrote: > It's just a little difficult for BGP to "load balance" > outbound bits when the bulk of the Internet these days > is 2 AS hops away from each of four upstreams. Not > impossible, but it doesn't happen by default either. Indeed. If the following conditions are met: a) all four upstreams are transit providers (and therefore even a default to any would be fair game) b) the goal is to distribute more evenly (in terms of bandwidth) the egress traffic between the four upstreams (in other terms, the egress traffic tends to peg one of the upstreams (which are being paid to carry the traffic) for no clear reason) IMHO there is nothing wrong with some WAEG route-map to police egress traffic to a different upstream that the one the BGP process would have chose at the 5th tie-breaker, all 4 including the AS-PATH being equal. My $0.02 plus tax. Michel.

1 0

Port 80 Navigation Problem (was:FW: hey had eric sent you)
by Riley, Marty 13 Mar '04

13 Mar '04

My apologies to the list - I haven't slept in a day or two and completely forgot to make a semi-intelligent subject line... mjr -----Original Message----- From: Riley, Marty Sent: Friday, March 12, 2004 22:18 To: nanog(a)merit.edu Subject: FW: hey had eric sent you I'm running short on theories and options, so I thought I would see if any other ISPs have seen this problem on your network(s). If so, what was the cure? mjr -----Original Message----- The Unknown problem. Symptoms: At random times dialup, dedicated, & internal network users are unable to pass TCP traffic to off network sites. ICMP and UDP appears to be uneffected by the outage which lasts anywhere from 2 to 5 minutes. The problem appears to be wide spread with similar reports from WVNET and other ISPS. nTelos is experiencing a similar problem but we have yet to confirm it is the same. Problem has changed in it's action but remained similar enough to consider it the same problem. Effected Platforms: Windows 2000 Pro, XP Home, XP Pro, & 2003 Server. Uneffected Platforms: Unix, MacOS (?) History: During the week of 2/9/04 the call center started recieving reports of users being unable to connect to sites off the CityNet network. Sites hosted on the internal network are uneffected by the outage. Initally it was thought to be a Internet Explorer problem possably caused by the KB832894 / IE SP1 or other updates but after further investigation it was found that Mozilla users were encountering the same problem. After several days of testing it was determined that during the outage any TCP session started on any port would fail. TCP sessions started before the outage continue to work and show no ill effects from the outage. After logging connection attempts at various intervals on many machines there appears to be no sort of pattern in the outages. Most machines encounter the problem, some more than others and a few do not encounter it at all. The duration and frequency of the outage is very fluid. During an outage, we can verify that the packet does seem to leave and reenter the network: Mar 5 22:28:04 pittpa-chaswv-ds3 17083: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3376) -> 216.41.224.3(80), 1 packet Mar 5 22:28:09 pittpa-chaswv-ds3 17084: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.14.174(3376), 1 packet Mar 5 22:28:09 pittpa-chaswv-ds3 17085: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3378) -> 216.41.224.3(80), 1 packet Mar 5 22:28:09 pittpa-chaswv-ds3 17086: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.14.174(3378), 1 packet Mar 5 22:33:24 pittpa-chaswv-ds3 17089: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.14.174(3378), 7 packets Mar 5 22:33:24 pittpa-chaswv-ds3 17090: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.14.174(3376), 17 packets Mar 5 22:33:58 pittpa-chaswv-ds3 17092: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3378) -> 216.41.224.3(80), 7 packets Mar 5 22:33:58 pittpa-chaswv-ds3 17093: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3376) -> 216.41.224.3(80), 18 packets Mar 5 00:58:30 pittpa-clarwv-ds3 16062: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3183) -> 216.41.224.3(80), 1 packet Mar 5 00:58:30 pittpa-clarwv-ds3 16063: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3183), 1 packet Mar 5 01:03:28 pittpa-clarwv-ds3 16067: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3217) -> 216.41.224.3(80), 1 packet Mar 5 01:03:28 pittpa-clarwv-ds3 16068: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3217), 1 packet Mar 5 01:03:34 pittpa-clarwv-ds3 16069: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3228) -> 216.41.224.3(80), 1 packet Mar 5 01:03:34 pittpa-clarwv-ds3 16070: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3228), 1 packet Mar 5 01:03:39 pittpa-clarwv-ds3 16072: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3239) -> 216.41.224.3(80), 1 packet Mar 5 01:03:47 pittpa-clarwv-ds3 16073: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3183) -> 216.41.224.3(80), 74 packets Mar 5 01:04:13 pittpa-clarwv-ds3 16075: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3183), 72 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16078: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3218) -> 216.41.224.3(80), 4 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16079: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3217) -> 216.41.224.3(80), 3 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16080: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3221) -> 216.41.224.3(80), 19 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16081: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3228) -> 216.41.224.3(80), 5 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16082: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3229) -> 216.41.224.3(80), 6 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16083: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3236) -> 216.41.224.3(80), 9 packets Mar 5 01:08:47 pittpa-clarwv-ds3 16084: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3233) -> 216.41.224.3(80), 12 packets Mar 5 01:08:47 pittpa-clarwv-ds3 16085: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3239) -> 216.41.224.3(80), 21 packets Mar 5 01:09:12 pittpa-clarwv-ds3 16087: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3239), 19 packets Mar 5 01:09:12 pittpa-clarwv-ds3 16088: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3228), 4 packets Mar 5 01:09:12 pittpa-clarwv-ds3 16089: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3217), 2 packets Mar 5 01:09:12 pittpa-clarwv-ds3 16091: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3218), 3 packets Mar 5 01:09:13 pittpa-clarwv-ds3 16092: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3221), 17 packets Mar 5 01:09:13 pittpa-clarwv-ds3 16093: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3229), 5 packets Mar 5 01:09:13 pittpa-clarwv-ds3 16094: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3236), 7 packets Mar 5 01:09:13 pittpa-clarwv-ds3 16096: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3233), 9 packets Network analysis showed significant amounts of spoofed multicast traffic and odd arp traffic. 10:17:16.416222 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 278 10:17:16.421886 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 334 10:17:16.423873 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 262 10:17:16.426948 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 254 10:17:16.432095 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 298 10:17:16.435921 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 274 10:17:16.439959 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 328 10:17:16.445317 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 326 10:17:16.449688 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 330 10:17:16.463537 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 322 Steps were taken to elminiate the spoofed traffic on the routers and access servers in the form of ACLs and filter lists. Neither have eliminiated the problem... but to what extent they might have helped has yet to be determined. The problem is still occuring, for some users the duration of the outage seems to have shortened other users notice no difference. It is not yet known if the filtering on the routers and access servers or the conversion to the 10.x.x.x network has made any difference. We should have a better idea in the upcoming days. What Doesn't help: Removing windows updates. Turning off XP firewall. Searching for malware. (SpyBot-SD, Adaware) Virus scanning (Various softwares) Specifying dns servers. Reinstalling windows.

1 0