- Test - lists.nanog.org

SCO blames ISPs for blocking access to web site
by Sean Donelan 02 Feb '04

02 Feb '04

SCO's spokesperson Blake Stowell blamed ISPs around the world for blocking access to SCO's web site. SCO says their web site bandwidth is at normal levels. According to SCO the attack is not schedule to begin until Sunday at 1609 GMT. http://www.channelnewsasia.com/stories/afp_world_business/view/68946/1/.html So much for spin-control. If you thought you were helping SCO, it appears SCO doesn't want your help.

5 4

Re: What happened to dot pro... (BTW)
by J. Oquendo 02 Feb '04

02 Feb '04

Anyone can send a spoof through say a misconfigured email server responsible for that TLD say through remixer, posing as someone on that network. Just because someone has some 'nifty' tld means absolutely nothing. If someone truly wants to be held accountable in such fields they could always use PGP to sign the messages they send. Wait for that to happen and I'll be a millionaire before it does. Not to get into an accountability issue here, but in certain professions I feel digital messages should be signed entirely, it sends a sign of some form of trust being given/desired. Personally I would love to see people in office use some form of digital based signature, but that would after all - hold them accountable. ;O =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "Men have been taught that it is a virtue to agree with others. But the creator is the man who disagrees. Men have been taught that it is a virtue to swim with the current. But the creator is the man who goes against the current. Men have been taught that it is a virtue to stand together. But the creator is the man who stands alone." -- Ayn Rand

4 4

Did Wanadoo, French ISP, block access to SCO?
by Sean Donelan 02 Feb '04

02 Feb '04

EWeek is reporting an anonymous source that Wanadoo, a major French ISP, has stopped all traffic to SCO's web site? Is this true? Have any other ISPs taken similar action?

11 14

Outbound Route Optimization
by Jim Devane 02 Feb '04

02 Feb '04

Hello, I am trying to determine for myself the relevance of Intelligent Routing Devices like Sockeye, Route Science etc. I am not trying to determine who does it better, but rather if the concept of optimizing routes is addressing a significant problem in terms of improved traffic performance ( not in cost savings of disparate transit pipes ) I am interested in hearing other views ( both for and against ) these devices in the context of optimizing latency for a small multi-homed ISP. I want to make sure I understand their context correctly and have not missed any important points of view. My questions are these: "Is sub-optimal routing caused by BGP so pervasive it needs to be addressed?" "Are these devices able to effectively address the need?" Thanks, Jim

11 16

What happened to dot pro ?
by John R Levine 02 Feb '04

02 Feb '04

One of the new domains set up in 2002 was .pro, with three initial subdomains .med.pro, .law.pro, and .cpa.pro. They'd register applicants only after checking evidence that they're licensed in the appropriate profession. (Applicant sends state and license number, registry looks them up to be sure the name matches.) With the growing epidemic of phishing, it would be handy to know that mail from, say, deloitte.cpa.pro was really from my accountant and not from some phisher who'd registered a similar looking .com. They had a sunrise period in early 2003 so big firms could pre-squat on their famous names and trademarks, and it was supposed to go live in July. The registrar's site at registrypro.com is up, but shows no evidence of having been touched since about May, and I can't find anything else since May either. Anyeone know what happened to them? I know a couple of CPAs and lawyers who could use a hard-to-spoof domain name. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner "I dropped the toothpaste", said Tom, crestfallenly.

1 0

RE: Did Wanadoo, French ISP, block access to SCO?
by CHUNIKHIN Igor FTLD 02 Feb '04

02 Feb '04

Did go through last time: -----Original Message----- From: CHUNIKHIN Igor FTLD Sent: Sun 2/1/2004 6:18 PM To: 'hackerwacker(a)cybermesa.com'; Sean Donelan Cc: nanog(a)merit.edu Subject: RE: Did Wanadoo, French ISP, block access to SCO? Let me clarify: 1) Wanadoo is French domestic network, while Opentransit is international backbone. 2) Opentransit (AS 5511) didn't block www.sco.com. Your traceroute goes via Opentransit but dies on peering point with XO; it looks like they killed this host. Cheers, Igor Chunikhin Engineering Support Lead Engineer FTLD IPTAC +1 703 375 6154 (office) > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > James Edwards > Sent: Sunday, February 01, 2004 4:21 PM > To: Sean Donelan > Cc: nanog(a)merit.edu > Subject: Re: Did Wanadoo, French ISP, block access to SCO? > > > Here is a view from the west coast, This is via > Opentransit, which is my limited understanding of French > indicates is owned/part of FranceTelecom: > > trace 216.250.128.12 > > Type escape sequence to abort. > Tracing the route to www.sco.com (216.250.128.12) > > 1 P12-0.PALBB2.Palo-alto.opentransit.net (193.251.240.26) 0 msec 0 > msec 0 msec > 2 * * > p5-0.IR1.PaloAlto-CA.us.xo.net (207.88.250.29) [AS 2828] !H > > >From Pastourelle, via Opentransit: > > trace 216.250.128.12 > > Type escape sequence to abort. > Tracing the route to www.sco.com (216.250.128.12) > > 1 P12-0.NYKCR3.New-york.opentransit.net (193.251.241.134) 144 msec 216 > msec 212 msec > 2 P7-0.NYKBB3.New-york.opentransit.net (193.251.241.242) 76 msec 76 msec > 76 msec > 3 * * * > > > >

1 0

Re: Impending (mydoom) DOS attack
by E.B. Dreger 02 Feb '04

02 Feb '04

PG> Date: Sat, 31 Jan 2004 17:04:32 +1100 (EST) PG> From: Phillip Grasso PG> I've implemented a means of distributing the www.sco.com/32 PG> or any other DDoS destination network block around my own PG> AS and blocking it by routing to null on the edge routers. Consider also: Martini tunnels IIRC, a recent NANOG presentation explained this in greater detail. Eddy -- Brotsman & Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

RE: Verizon mail troubles
by Alon Tirosh 01 Feb '04

01 Feb '04

Personal Favorite: We put a move order in with VZ for June 12, then rescheduled to July 12 (we were moving across the st.) of this year. On May 12 we come in and discover that half our lines don't work. After 4 hours on the phone, it turns out they took exactly half our lines (interestingly enough 1,3,5,7,etc.) and moved them across the street, and wired them into the phone block for what was to be our neighbouring office. People calling us got a furniture consulting firm half the time. It took me 5 days to get all our lines back where they belonged, as when they moved them back they decided to leave a couple there and then not acknowledge the problem, only to move again finally in July and have them forget to move a couple lines over. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gerald Sent: Thursday, January 29, 2004 3:03 PM To: Brian Wallingford Cc: Andy Dills; Bob Snyder; nanog(a)merit.edu Subject: Re: Verizon mail troubles On Wed, 28 Jan 2004, Brian Wallingford wrote: > There's no question that there's a certain amount of social > engineering involved in contacting (or being allowed to contact) > competent folk. It's advisable to be sure that any staff who will be > contacting them are fully versed in any services they will be > discussing. The clueful staff at VZ are much more receptive and > accessible when they know in advance that they can expect to pick up a likewise-clued individual. My favorite (extreme sarcasm) lines I received from Verizon: - (At 25 Bway with a T3 from the carrier room.) "The T3 outage you are experiencing is not our problem." Turned out someone messed up a cable in to their router in the carrier room. A tech that they dispatched to 25 Bway got access to the carrier room and recrimped the cables in to THEIR equipment, not ours. Anyone who knows 25Bway knows you can't enter the carrier room without a purpose. I can't go there and say let me work on VZ equipment in the Carrier room. - "I don't see the circuit ID for the T3 you just gave me in here do you have another CID for it?" - Random person in back office I had been transferred to, "(definitively) It's not a problem on our system...What was that CID again? Let me trace each leg of the Circuit. (pause) Oh wait, there is a problem in the Central Office that that would affect that line" Me, "How do I keep up with the progress of this ticket? Is there a ticket number on that problem?" Him, "It's an internal ticket number. I can't give it out." - "If you are having intermittent problems, we can't do anything about it. We can test the line and if the T1 shows clean we will close the ticket." - Me, "The T1 CID $CID is down." Them, "What would you like us to do?" - (From a T1 plagued with issues after 9/11. Paraphrased:) "Due to the wiring in your building it would probably be best if we just ran a new T1 out to you. You will need to sign a new 60 month contract and we will work out the details of closing the old T1 once the new one is setup." (This was a sales rep.) - "Hi, I'm Chris L. I'm your new account manager. I will be your contact with any problems you have." (Chris no longer answers his phone. Neither does anyone else from the "Enterprise Services" dept here in NYC. None of the phone numbers Chris sent to me respond either.) - The Trouble ticket line has given up any semblance of desire to help Most companies answer "$Company_Name, This is $Name speaking, how may I help you?" The TT line, "Verizon?!" - T1 group, "I can loop the smart jack." Me on site, "The smart jack has no lights." Them, "Oh, wait I was looping the wrong smart jack, what was that CID again?" - My favorite recording from the trouble ticket line: "We are experiencing an unusually high call volume, please try your call again later <CLICK>" - One T1 outage last year: T1 tech says need to dispatch to site, Site tech says no issue at smart jack need to get basement people in here (don't remember the name right off), basement people say we can't hear anything from C.O., C.O. tech says we can't hear anything from the building. This outage took 5 days to recover from to get techs on site and dispatched after each person pointed the finger at another person. I could go on, but it is just depressing. I still have no one to complain to if I can't get a hold of my sales rep or the T1 TT line screws up royally.

3 2

www.sco.com no longer has an DNS A record
by Sean Donelan 01 Feb '04

01 Feb '04

Asia (remember the international date line) started on MyDoom already, although some reports said the worm used 1609 GMT to start its attack. SCO appears to have deleted the A record for www.sco.com from their DNS about 1 hour ago. I don't know how often MyDoom does the DNS lookup, so it may not stop things. As far as I can tell, no third-party ISP is blocking traffic to SCO. Traceroutes by IP address continue to nearly their last upstream hop. SCO's immediate upstream providers are probably helping.

6 6

Impending (mydoom) DOS attack
by bcm 01 Feb '04

01 Feb '04

Is anyone taking any special precautions given the potential for a sudden increase in aggregate packets per second across your networks come Sunday afternoon when the original Mydoom virus enters into its DOS phase? Does anyone know if the virus' assault will be slowed if it is unable to reach www.sco.com? I am hoping that if it cannot reach SCO's site that the HTTP GET command will be slow in returning, effectively reducing the volume of traffic a single PC is capable is generating. I am having a difficult time artificially forcing the virus to start its attack in a lab environment, so I am unable to confirm this. Any input would be appreciated. Thanks!

10 14