- Test - lists.nanog.org

RE: UUNet Offer New Protection Against DDoS
by Terranson, Alif 06 Mar '04

06 Mar '04

> On Fri, 5 Mar 2004, Christopher L. Morrow wrote: > > the packets as possible. Nebulous filtering and dropping of > > miniscule amounts of traffic in the core of a large network is > > just a waste of effort and false panacea. Agreed. > uunet does operate lots of dialup RAS though correct? any > reason why urpf > is not reasonable there? Nobody I know terminates a dial connection on a *core router* ;-) //Alif Alif Terranson OpSec Engineering Mgr. Operations Security Dept. Savvis Communications Corp. (314) 628-7602 Voice (618) 558-5854 Cell (314) 628-7710 Fax >

1 0

RE: UUNet Offer New Protection Against DDoS
by Terranson, Alif 05 Mar '04

05 Mar '04

> Terranson, Alif wrote: > > >As long as we're doing "Me Too"... > > > >Savvis has had prefix:666 for around 18 months as well. > > > > > Do you know if C&W does? Or will that wait until the integration? While I am not 100% certain (and there are plenty of "new-Savvis" folks here who *do* know for sure ;-), I believe the CW network does support a BH tag. > This thread has caused me to add this as a requirement for a > new gigabit ISP circuit I am ordering, as well as uRPF in the core, Woah! Never said *anything* about that! No plans for it that I am aware of. No reason I can think of to do this either. > etc. > I've had two ISPs say "We don't do this yet, but based on the > fact you are making it a requirement, we will role those functions out > into our core." This is really not "new", and considering how easy it is to implement, I'm surprised it isn't *much* more widely implemented. > Steve > Voting with his money for better net-security.... Go Steve! Go!! Alif Terranson OpSec Engineering Mgr. Operations Security Dept. Savvis Communications Corp. (314) 628-7602 Voice (618) 558-5854 Cell (314) 628-7710 Fax

1 0

[OT: slightly]Looking for Engineers
by Owens, Loren 05 Mar '04

05 Mar '04

Currently Progress Telecom LLC is in need of 1 or 2 qualified IP engineers in the St. Pete area. The open positions are full time positions engineering PTC's IP network (EPIK Communications old network) and BGP AS 19962. The Network consists of Juniper M160/M20 routers and Foundry NetIron switches. Candidate must be highly skilled in BGP and MPLS, have an ability to communicate with customers (both internal and external), have a good working knowledge if IRR's, and have strong trouble resolution skills. If you are interested in applying, or for more information please contact ghadlock(a)progresstelecom.com. Shane

4 3

SPAM Prevention/Blacklists
by Brandon Shiers 05 Mar '04

05 Mar '04

Greetings from Wyoming -- Just a real quick question for the folks on the Nanog list: We are using the following RBL's on our MTA right now: Spamhaus (sbl-xbl) DSBL NJABL (dynablock) Are there any other good lists out there that you folks have had good experience with? Any that we might want to consider taking a look at? Thanks, Brandon

8 11

Re: One hint - how to detect invected machines _post morten_... Re: dealing with w32/bagle
by James M. Kretchmar 05 Mar '04

05 Mar '04

Also take a look at Neo at http://www.ktools.org/ which is scriptable and does all the SNMP work behind the scenes for you. A beta of the new 2.0 version (in Python) will be out within a week. kretch > Solution: > - get all port statistics from switch (using SNMPGET and using simple > 'telnetting' script - we have 'RUN-cmd' tool allowing to run switch commands > from shell file; > - remove all ports with traffic less than some threshold; > - calculate IN/OUT packets ratio for the rest of ports; > - find ports, where IN/OUT ratio (IN - to switch) > 6; > - in this ports, find ports with average packet size < 256 bytes; > > It shows all ports with infected notebooks (even if notebook was connected > for a half of day). > > PS. Of course, after this few additional monitoring tools was installed, and > we added _all_ switches and _all_ ports to 'snmpstat' monitoring system (it > allows to see a traffic in real time, and analiz historical charts, > including such things as packet size).

1 0

Email security poll
by Jon R. Kibler 05 Mar '04

05 Mar '04

Hello all, We are conducting an informal poll regarding email security practices. Reply to me offlist and I will publish the results this weekend. Identity of replies will be kept confidential and all replies deleted after tabulation. Thanks! I will publish results this weekend. If for some reason our anti-spam filter bounces you, or you want to remain anonymous, please set your sender email address to be SURVEY _AT_ ASET.COM. -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 Please respond YES (Y), NO (N), or Not Applicable (N/A): -------------------------------------------------------- Does your organization perform any screening of email attachments? Does your organization perform A-V checks on all email attachments? Does your organization perform any checks on email attachment file type? Does your organization allow users to receive executable content attachments? Does your organization allow users to receive zip file or similar compressed attachments? Does your organization allow users to receive MS Office and similar type files that may contain macro viruses? Does your organization allow users to receive embedded or attached HTML email? Does your organization allow users to receive active content attachments, such as HTML with <SCRIPT> tags? Please respond as appropriate: ------------------------------ What AV engine do you use to screen email attachments (Symantec, NAI, FProtect, Trend, ClamAV, etc)? How often does your organization update its AV signatures? ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

1 0

dealing with w32/bagle
by Dan Hollis 05 Mar '04

05 Mar '04

I am curious how network operators are dealing with the latest w32/bagle variants which seem particularly evil. Also, does anyone have tools for regexp and purging these mails from unix mailbox (not maildir) mailspool files? Eg purging these mails after the fact if they were delivered to user's mailboxes before your virus scanner got a database update. -Dan

19 22

Bangalore Connectivity to USA
by Brennan_Murphy＠NAI.com 05 Mar '04

05 Mar '04

I'm investigating connectivity options between Bangalore and the US. Hoping to talk with others who have gone through the same process. What can be done to cut costs on E3+ capacity circuits? Any recommendations such as fiber plays, wireless last mile, satellite, etc. I prefer to hear from actual customers rather than sales persons. I guess basically, I'm looking for a clue on how to cut costs.

1 0

Re: dealing with w32/bagle
by JC Dill 05 Mar '04

05 Mar '04

At 07:39 PM 3/4/2004, Curtis Maurand wrote: >Too many steps. Once it's installed and configured, this one is drag and drop: <http://www.hilgraeve.com/dropchute/> They also have a solution for dynamic addressing: <http://www.hilgraeve.com/KB/KnowledgeBase/index_html?topic=DropChute&articl…> >DropChute can work with and connect to dynamic IP addresses through the >use of the address server. ldap.dropchute.com. With the address server >available to you, you can wait for calls on the Internet using a dynamic >IP address assigned by your Internet service provider. Your DropChute will >post the address on the address server so others can connect to you. jc -- p.s. Please do not cc me on replies to the list. Please reply to the list only, or to me only (as you prefer) but not to both.

2 1

The Cidr Report
by cidr-report＠potaroo.net 05 Mar '04

05 Mar '04

This report has been generated at Fri Mar 5 21:48:09 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 27-02-04 132022 92109 28-02-04 132095 92116 29-02-04 132186 92115 01-03-04 132204 92062 02-03-04 132222 91984 03-03-04 132040 92020 04-03-04 132129 92142 05-03-04 132261 92225 AS Summary 16688 Number of ASes in routing system 6718 Number of ASes announcing only one prefix 1385 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 73583360 Largest address span announced by an AS (/32s) AS568 : DISOUN DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 05Mar04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 132415 92202 40213 30.4% All ASes AS4323 694 205 489 70.5% TWC-34 Time Warner Communications, Inc. AS7018 1385 963 422 30.5% ATTW AT&T WorldNet Services AS6197 676 302 374 55.3% BNS-14 BellSouth Network Solutions, Inc AS701 1319 946 373 28.3% UU UUNET Technologies, Inc. AS7843 491 120 371 75.6% ADELPH-13 Adelphia Corp. AS27364 388 33 355 91.5% ARMC Armstrong Cable Services AS6198 545 215 330 60.6% BNS-14 BellSouth Network Solutions, Inc AS4134 646 326 320 49.5% CHINANET-BACKBONE No.31,Jin-rong Street AS22909 354 34 320 90.4% CMCS Comcast Cable Communications, Inc. AS22773 349 37 312 89.4% CXAB Cox Communications Inc. Atlanta AS1239 939 655 284 30.2% SPRN Sprint AS4355 385 101 284 73.8% ERSD EARTHLINK, INC AS6347 367 87 280 76.3% SAVV SAVVIS Communications Corporation AS9583 387 118 269 69.5% SATYAMNET-AS Satyam Infoway Ltd., AS6140 373 110 263 70.5% IMPSA ImpSat AS17676 295 42 253 85.8% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS1221 888 644 244 27.5% ASN-TELSTRA Telstra Pty Ltd AS6478 267 40 227 85.0% ATTW AT&T WorldNet Services AS25844 243 16 227 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS209 720 507 213 29.6% QWEST-4 Qwest AS14654 214 4 210 98.1% WAYPOR-3 Wayport AS11305 242 41 201 83.1% INTERL-80 Interland Incorporated AS2386 431 240 191 44.3% ADCS-1 AT&T Data Communications Services AS4766 436 245 191 43.8% KIX Korea Internet Exchange for "96 World Internet Exposition AS5668 349 161 188 53.9% CIH-12 CenturyTel Internet Holdings, Inc. AS20115 605 419 186 30.7% CHARTE-72 Charter Communications AS4519 204 21 183 89.7% MAASCO Maas Communications AS9929 209 30 179 85.6% CNCNET-CN China Netcom Corp. AS6327 206 28 178 86.4% SHAWC-2 Shaw Communications Inc. AS3356 849 681 168 19.8% LEVEL3 Level 3 Communications Total 15456 7371 8085 52.3% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 64.46.0.0/18 AS7850 IHIGHW iHighway.net, Inc. 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.60.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.62.126.0/23 AS25700 SWIFTD SWIFTDESK VENTURE 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 66.114.28.0/24 AS15083 INMM Infolink Communication Services, Inc. 66.114.29.0/24 AS15083 INMM Infolink Communication Services, Inc. 66.114.30.0/24 AS15083 INMM Infolink Communication Services, Inc. 66.114.31.0/24 AS15083 INMM Infolink Communication Services, Inc. 69.8.128.0/17 AS7260 NORL Norlight Telecommunications 132.0.0.0/10 AS568 DISOUN DISO-UNRRA 137.0.0.0/13 AS568 DISOUN DISO-UNRRA 138.136.0.0/13 AS568 DISOUN DISO-UNRRA 158.0.0.0/13 AS568 DISOUN DISO-UNRRA 164.234.0.0/16 AS721 DNIC DoD Network Information Center 164.234.0.0/18 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 DISOUN DISO-UNRRA 192.172.0.0/19 AS568 DISOUN DISO-UNRRA 192.188.208.0/20 AS568 DISOUN DISO-UNRRA 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS568 DISOUN DISO-UNRRA 198.97.80.0/20 AS568 DISOUN DISO-UNRRA 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.192.0/20 AS568 DISOUN DISO-UNRRA 198.97.240.0/20 AS568 DISOUN DISO-UNRRA 198.101.4.0/22 AS568 DISOUN DISO-UNRRA 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS568 DISOUN DISO-UNRRA 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.84.0.0/16 AS701 UU UUNET Technologies, Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS568 DISOUN DISO-UNRRA 199.114.128.0/18 AS568 DISOUN DISO-UNRRA 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 DISOUN DISO-UNRRA 199.123.0.0/18 AS568 DISOUN DISO-UNRRA 199.123.16.0/20 AS568 DISOUN DISO-UNRRA 199.123.80.0/21 AS568 DISOUN DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.2.64.0/20 AS9729 IS-AP iAdvantage Limited 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.24.0/24 AS17888 SINGTEL-HK SingTel Hong Kong Limited 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.128.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.142.0/24 AS30362 HAWAI-1 Hawaii-Pacific Teleport 202.86.171.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.172.0/23 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.190.0/24 AS4750 LOXLEY-TH Loxley Information Co., Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.143.56.0/21 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.149.240.0/21 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.149.248.0/21 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.155.243.0/24 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.170.128.0/22 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.170.133.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.170.134.0/23 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.87.224.0/19 AS4799 CHINA169-JT CNCGROUP old Jitong IP network 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 204.69.144.0/22 AS5668 CIH-12 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NCC-105 NewSouth Communications Corp. 206.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 206.108.34.0/24 AS852 AGTA Telus Advanced Communications 206.108.35.0/24 AS852 AGTA Telus Advanced Communications 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.169.219.0/24 AS189 GNTY Genuity 209.169.223.0/24 AS189 GNTY Genuity 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.205.95.0/24 AS6347 SAVV SAVVIS Communications Corporation 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL-33 Telesat International Ltd. 209.240.96.0/19 AS10815 KCNETI-1 KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 209.251.64.0/19 AS10266 MDCN MDC, Inc. 210.213.0.0/19 AS6453 GIEUROPE Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 222.192.0.0/14 AS4538 ERX-CERNET-BKB China Education and Research Network Center Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0