- Test - lists.nanog.org

RE: Large Cable ISP Looking for a Roadrunner contact...
by Dan Ellis 05 Dec '03

05 Dec '03

As per their bounceback instructions, tried removal(a)security.rr.com, it appears still blocked. -- Daniel Ellis, CTO, PenTeleData (610)826-9293 "The only way to predict the future is to invent it." --Alan Kay -----Original Message----- From: Suresh Ramasubramanian [mailto:suresh@outblaze.com] Sent: Friday, December 05, 2003 6:13 PM To: Dan Ellis Cc: nanog(a)merit.edu Subject: Re: Large Cable ISP Looking for a Roadrunner contact... Dan Ellis writes on 12/5/2003 6:05 PM: > Could someone from Roadrunner please contact me - you have blocked a > large ISP's mail server farm and are not responding to requests to > unblock. We received no notification of a block. > > Thanks > > --Dan > Doesn't spamblock(a)security.rr.com work? srs > -- > > Daniel Ellis, CTO, PenTeleData > > (610)826-9293 > > "The only way to predict the future is to invent it." > > --Alan Kay > -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

1 0

Peering BOF VII at NANOG 30 in Miami
by William B. Norton 05 Dec '03

05 Dec '03

Hi again - We have approval to run the Peering BOF again at the upcoming NANOG 30 in Miami ! Appropriate attire (Hawaiian Shirts) is required ;-) So, now my job is to draft Peering Coordinators to stand up, introduce themselves, say a few words about their peering requirements, why you should peer with them, etc. in order to facilitate peering. While you introduce yourself I will have a screen behind you that has the answers to the questions below. At the end of the BOF we break for beers and, if history is any indication, peering coordinators meet each other, exchange cards and get some direct peering going. BTW - This time we may add an agenda topic, perhaps a brief debate "Tier 1 Peering Policies: Defensible?". Taking the Affirmative will be _______, taking the Negative will be ______. (Both TBD, debaters being secretly solicited) Bill --------------- For Peering Coordinators participating in Peering Personals --------------- The Peering BOF focuses on meeting other Peering Coordinators using a methodology we call "Peering Personals." We solicit Peering Coordinators (before the meeting), asking them to characterize their networks and peering policies in general ways ("content heavy" or "access (eyeball) -heavy," "Multiple Points Required" or "Will Peer anywhere," "Peering with Content OK," etc.). From the answers we will select a set of ISP Peering Coordinators to present a 2-3 minute description of their network, what they look for in a peer, etc., allowing the audience to put a face with the name of the ISP. At the end of the Peering BOF, Peering Coordinators will have time to speak with Peering Coordinators of ISPs they seek to interconnect with. The expectation is that these interactions will lead to the Peering Negotiations stage, the first step towards a more fully meshed and therefore resilient Internet. If you are a Peering Coordinator and wish to participate in this BOF, please fill out the following form and e-mail it to wbn(a)umich.edu with Subject: Peering BOF VII We will only be able to accommodate maybe 20 peering coordinators this time so please RSVP early! --------------------------------------------- clip here ------------------------------------------ Name: Title: Company: AS#: Check each that applies: ___ We are an ISP (sell access to the Internet) -- OR -- ___ We are a Non-ISP (content company, etc.) ___ We are generally more Content-Heavy -- OR -- ___ We are generally more Access-Heavy ___ Peering with Content Players or Content Heavy ISPs is OK by us ___ We generally require peering in multiple locations ___ We will peer with anyone in any single location ___ We have huge volumes of traffic (lots of users and/or lots of content) (huge: > 1 Gbps total outbound traffic to peers and transit providers) ___ We have a global network ___ We require Contracts for Peering List all Current Peering Locations: 1) 2) 3) : List all Planned (3-6 mos) Peering Locations: 1) 2) 3) : Privacy Notice: This information is made available only to me, William B. Norton, as an individual, and will be used only for facilitating the BOF and making up the screen behind the speakers. People in the audience are certainly welcome to jot down information presented at the BOF, but the information will not be made available in any other form to anyone. Hopefully this clarifies things and will avoid the controversy of the past. To give you an idea of previous Peering BOFs please see ------------------------------------------------------------------------------- Peering BOF VI, NANOG 27, Phoenix, February 2003. http://www.nanog.org/mtg-0302/norton.html Peering BOF V. NANOG 25, Toronto, June 2002. http://www.nanog.org/mtg-0206/norton.html Peering BOF IV. NANOG 23, Oakland, October 2001. http://www.nanog.org/mtg-0110/norton.html Peering BOF III. NANOG 20, Washington, DC, October 2000. http://www.nanog.org/mtg-0010/peering.html Peering BOF II. . NANOG 19, Albuquerque, June 2000 http://www.nanog.org/mtg-0006/peering.html Peering BOF I. NANOG 17, Montreal, Oct 1999 http://www.nanog.org/mtg-9910/peering.html

1 0

Does your Certifying Authority have a clue who you are? Do they care?
by Bob Beck 05 Dec '03

05 Dec '03

So, an interesting thing happened to me yesterday. I run OpenBSD's https.openbsd.org site. Of course, we have an SSL Site certificate for this site. When we first started the site, (about 6 years ago) we got a site certificate from Thawte. Back in these days they were based in South Africa, and had a Canadian Legal firm to verify who we were. So of course, Theo had to fax them some stuff, as did I. etc. etc. The whole process was rather painful, particularly since "OpenBSD" isn't a company, so we couldn't exactly send incorporation documents and the like. Nevertheless, supposedly this is to provide some sort of protection for people - that "OpenBSD" really is who it claims to be. So, time comes to renew the certificate again, and give Thawte their bi-yearly sum to keep our server cert alive. Every other year, the renewal process has been automatic, They already have our documentation on file so presumably they can and do check this. This year, they know nothing, They have been bought by verisign and they want new documentation. The conversation went something like this: <"What happened to our previously sent documentation?" >"It's in a warehouse in Canada, because we changed how we do things" <"Why can't you get it from there - We're a multinational volunteer organization, coming up with any sort of stuff like this is a pain" >"Well, we can't". <"So you've lost it?" >"No, we know where it is, it's in the Warehouse" <"Well, you can't get it because you don't know where it is in the Warehouse" >"Yes, so what can you send us?" <"Are you going to get the documents from Canada?" >"Yes, but we're not sure when or how?" So the long and the short of it is, our CA has *LOST* the documents showing who we are, and wants new ones. Had someone previously filed fraudulent documents to obtain an ssl certificate, they wouldn't have copies of those. So, the real question is, what good does it do to send supporting documentation to these services, if all they do is lose them? Is this really providing anyone with any security, or is this really just a thinly veiled revenue generation procedure. If they can't even produce the documentation used to support a certificate they've issued, then why the heck ask for, and charge money for this in the first place? Of course my certificate is good for X years, not to protect me from my cert being exposed, but just to get more money after X years. Certificate revocation? Who actually uses that, for real, in a manner that any widespread public apps (i.e. web browsers) will pay attention to? Needless to say, any real confidence I (used to) have in Thawte (back when it made Mark Shuttleworth enough money to buy a ride on the space station) is really no more. (And no, I never really did have any confidence in https, because of the human engineering issues) Anyway, we got a new cert from a provider that only cares about domain ownership, which works fine. The real question is, between the fact that the web browsers makes it so easy for knuckle dragging apes to accept any certificate out there anyway, and if the CA's aren't doing anything to speak of with the "Supporting Documentation", Who are we kidding that there's any real point (security wise) to this exercise? Time for a new protocol that just stores the public key the first time like SSH, and the user maintains their own list? Really, is that any less secure than this ongoing nonsense from a practical perspective? (Other than there's no way for CA's to make money off of it?) -Bob

10 17

Always renew your domain names
by Mike Hyde 05 Dec '03

05 Dec '03

Looks like someone forgot to renew there domain name and another party decided to do it for them, with some slight changes: host 206.108.102.93 93.102.108.206.in-addr.arpa domain name pointer bells-network-has-lots-of-security-holes-to-exploit.bell-nexxia.net

6 6

New Statistics Format Released
by Ginny Listman 05 Dec '03

05 Dec '03

ARIN has been working along with APNIC, LACNIC and RIPE NCC to provide number resource statistics in a unified format and location. The following changes will be made to the existing statistics reporting: - Addition of IPv6 allocations - Report generated daily - Summary lines are included - Reports are signed with GPG key - MD5 hash is provided for verification - Minor changes in format We understand that many researchers have scripts that pull these reports on a regular basis and/or perform analysis based on the current format. To facilitate the change and acceptance of the new format, ARIN will run the old and new format from now until January 5, 2004. We have also included a README file in the directory defining the new format. During this time period the location of the stats will be: Current format: ftp://ftp.arin.net/pub/stats/arin/latest New format: ftp://ftp.arin.net/pub/stats/arin/new/delegated-arin-latest On and after January 5, 2004, the only set of stats will be located at: ftp://ftp.arin.net/pub/stats/arin/latest Comments concerning the publicly released statistics can be addressed on the ARIN DBWG mailing list. A mailing list description and subscription information can be found: http://www.arin.net/mailing_lists/index.html Ginny Listman Director of Engineering ARIN

1 0

Re: Does your Certifying Authority have a clue who you are? Do they care?
by Michael.Dillon＠radianz.com 05 Dec '03

05 Dec '03

> So the long and the short of it is, our CA has *LOST* the >documents showing who we are, and wants new ones. Wow! Have you contacted http://www.geotrust.com about this? I'm sure they would fly people out to Calgary to personally inspect your identity at no charge just for a chance to use your story in the marketing. Check what they're saying about Verisign on their website. The bumbling fools at Verisign are not the only choice for SSL certs. The security ecology demands diversity and competition so that there are always plenty of watchers watching the watchers. --Michael Dillon

1 0

Re: MTU path discovery and IPSec
by Michael.Dillon＠radianz.com 05 Dec '03

05 Dec '03

>Is there any discussion on better alternatives to PMTUD such as leaving >off DF and a new ICMP subtype, rate limited, to inform senders that >they've been fragged and at what (call it reverse PMTUD?) ? There is a better alternative that is already used in production. When a router receives packets too big for an outgoing link, it fragments the packets. On the other side of the small MTU link, the receiving router reassembles the packets which are always in the correct order. All you need to do to enable this functionality is to turn on IPv6. Or perhaps you would like to keep on reinventing the same wheel over and over again? >Does IP6 really do away with fragmenting? Is there any current >discussion on all this? What!? Are there still people who haven't at least read one or two IPv6 books? Try Huitema, "IPv6 The New Internet Protocol" or Loshin, "IPv6 Clearly Explained" >I see I have to go do some research. Yes. This http://www.ipv6forum.com/ is the best website to use to find resources. The best slideware I've ever seen on IPv6 comes from the folks at the Technical University of Madrid who presented at the 2002 IPv6 summit. You can get their slides from the agenda page here http://www.ipv6-es.com/02/in/i-agenda.htm --Michael Dillon

1 0

The Cidr Report
by cidr-report＠potaroo.net 05 Dec '03

05 Dec '03

This report has been generated at Fri Dec 5 21:47:15 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 28-11-03 128347 90330 29-11-03 128360 90279 30-11-03 128411 90309 01-12-03 128392 90290 02-12-03 128418 90292 03-12-03 128561 90308 04-12-03 128539 90397 05-12-03 128663 90435 AS Summary 16204 Number of ASes in routing system 6463 Number of ASes announcing only one prefix 1406 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73591040 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 05Dec03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 128617 90395 38222 29.7% All ASes AS6197 764 265 499 65.3% BATI-ATL BellSouth Network Solutions, Inc AS4323 678 206 472 69.6% TW-COMM Time Warner Communications, Inc. AS701 1406 972 434 30.9% ALTERNET-AS UUNET Technologies, Inc. AS7018 1387 962 425 30.6% ATT-INTERNET4 AT&T WorldNet Services AS7843 524 122 402 76.7% ADELPHIA-AS Adelphia Corp. AS4134 502 123 379 75.5% CHINANET-BACKBONE No.31,Jin-rong Street AS6198 610 254 356 58.4% BATI-MIA BellSouth Network Solutions, Inc AS209 859 535 324 37.7% ASN-QWEST Qwest AS22909 317 12 305 96.2% DNEO-OSP1 Comcast Cable Communications, Inc. AS1239 953 669 284 29.8% SPRINTLINK Sprint AS22773 315 31 284 90.2% CCINET-2 Cox Communications Inc. Atlanta AS4355 383 101 282 73.6% ERMS-EARTHLNK EARTHLINK, INC AS27364 354 73 281 79.4% ACS-INTERNET Armstrong Cable Services AS1221 954 677 277 29.0% ASN-TELSTRA Telstra Pty Ltd AS6347 331 85 246 74.3% DIAMOND SAVVIS Communications Corporation AS17676 283 39 244 86.2% GIGAINFRA Softbank BB Corp. AS25844 243 17 226 93.0% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS6140 346 130 216 62.4% IMPSAT-USA ImpSat AS14654 206 2 204 99.0% WAYPORT Wayport AS11305 230 37 193 83.9% INTERLAND-NET1 Interland Incorporated AS2386 402 218 184 45.8% INS-AS AT&T Data Communications Services AS4519 194 13 181 93.3% MAAS Maas Communications AS6327 204 28 176 86.3% SHAW Shaw Communications Inc. AS9583 228 58 170 74.6% SATYAMNET-AS Satyam Infoway Ltd., AS9929 197 27 170 86.3% CNCNET-CN China Netcom Corp. AS20115 581 413 168 28.9% CHARTER-NET-HKY-NC Charter Communications AS2048 251 85 166 66.1% LANET-1 State of Louisiana AS15270 203 41 162 79.8% AS-PAETEC-NET PaeTec.net -a division of PaeTecCommunications, Inc. AS6478 193 41 152 78.8% ATT-INTERNET3 AT&T WorldNet Services AS6517 237 87 150 63.3% YIPESCOM Yipes Communications, Inc. Total 14335 6323 8012 55.9% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI Andara High Speed Internet c/o Halifax Cable Ltd. 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.62.64.0/24 AS3549 GBLX Global Crossing 64.62.126.0/23 AS25700 SWIFTDESK SWIFTDESK VENTURE 66.41.192.0/18 AS13367 CCCH-AS3 Comcast Cable Communications Holdings, Inc 69.8.128.0/17 AS7260 NORLIGHT Norlight Telecommunications 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.143.2.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 ALTERNET-AS UUNET Technologies, Inc. 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 AS719 LANLINK autonomous system 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.98.8.0/21 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.79.32.0/20 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.136.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.154.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.114.156.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.160.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 202.0.180.0/24 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.4.252.0/22 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.72.112.0/22 AS22351 INTELSAT-1 INTELSAT 202.74.32.0/19 AS9315 CWN-AS-AP Chomanan WorldNet Co., Ltd. 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.165.0.0/19 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.165.0.0/20 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.165.16.0/20 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.179.64.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.65.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.66.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.67.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 202.179.68.0/24 AS7633 SOFTNET-AS-AP Software Technology Parks of India 203.29.222.0/24 AS22934 EBROADBANDNOW E Broadband Now Inc. 203.32.4.0/23 AS7617 APNIC-AS-2-BLOCK Asia Pacific Network Information Centre 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.86.2.0/23 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 203.132.95.0/24 AS9787 CONCEPT-AU-AP Concept Networks 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.102.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.103.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.106.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.109.0/24 AS10141 CALOUNDRA-AS-AP Caloundra.net 203.132.110.0/24 AS7598 ALPHALINK-AS-AP Alphalink Pty Limited - Melbourne, Australia 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.112.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.89.225.0/24 AS2495 KANREN Kansas Research and Education Network 204.154.125.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.194.110.0/23 AS10588 ICSNET Intelligent Computer Solutions, Inc 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.82.64.0/18 AS7029 ALLTELNET Alltel Information Services, Inc. 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 208.104.103.0/24 AS1239 SPRINTLINK Sprint 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 TELEGLOBE-AS Teleglobe Inc 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.36.46.0/24 AS7176 GENUITY-AS7176 Genuity 216.36.47.0/24 AS7176 GENUITY-AS7176 Genuity 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 218.211.0.0/16 AS4788 TMNET-AS-AP TMnet, Telekom Malaysia Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Cisco MGX and Cisco CSG issues
by John Bittenbender 05 Dec '03

05 Dec '03

Greetings NANOG, If anyone has experience with Sonet OC3 between a Cisco MGX and a Lucent 5ESS (preferably with APS configured) can you please contact me off-list. I am also interested in anyone having problems with Cisco CSG (Content Services Gateway) and the units hanging all of the active sessions (may have to do with L2TP Tunneling). Thanks, John Bittenbender

1 0

popupad spam wrapup.
by Johannes B. Ullrich 05 Dec '03

05 Dec '03

Thanks everyone here on this list who helped track down this! We just published a (hopefully more or less final) "Diary" on this topic at http://isc.sans.org/diary.html (see below for text). As it turns out, at least one particular version of the software distributed by PopAdStop.com did include a Trojan component sending out popup spam. ------------- For over a week, we had been tracking an increase in port 1026-1031 UDP traffic. More detailed investigation revealed a component in this traffic with the following characteristics: (*) The payload consisted of two zero bytes (*) A large number of sources participated in these scans (*) the scans came from valid IPs, and the source port did not appear to be crafted. This is different from most popup spam sent to this port. Most popup spam is sent by only a small number of sources. And usually uses a fixed source port. While popup spam in itself is not any more dangerous then e-mail spam, and more of an annoyance, the large number of sources hinted to the fact that it is likely sent from unsuspecting exploited systems ("Zombies"). The connection with popup spam was made later, by allowing a honeypot to respond to the two byte probe. The result was an ad sent by the probing host. PACKET DUMP (IP Addresses are obfuscated) 11:57:11.361783 IP w.x.y.z.1974 > a.b.c.d.1030: udp 2 0x0000 4500 001e c33d 0000 6a11 8094 wwxx yyzz E....=..j...R#@3 0x0010 aabb ccdd 07b6 0406 000a e720 0000 0000 ................ 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:57:11.363913 IP 129.170.248.252.1030 > w.x.y.z.1974: udp 84 0x0000 4500 0070 0169 0000 8011 2c17 aabb ccdd E..p.i....,..... 0x0010 wwxx yyzz 0406 07b6 005c aa23 0406 0000 R#@3.....\.#.... 0x0020 1000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0050 0000 0000 52f7 c93f 0000 0000 0000 0000 ....R..?........ 0x0060 0000 0000 0000 0400 0000 0000 0800 001c ................ 11:57:11.477413 IP w.x.y.z.1975 > 129.170.248.252.1026: udp 519 0x0000 4500 0223 c350 0000 6a11 7e7c wwxx yyzz E..#.P..j.~|R#@3 0x0010 aabb ccdd 07b7 0402 020f 43b2 0400 0800 ..........C..... 0x0020 1000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0030 0000 0000 f891 7b5a 00ff d011 a9b2 00c0 ......{Z........ 0x0040 4fb6 e6fc 82f5 b0ec e32c 41ec 173c 5a07 O........,A..<Z. 0x0050 dee7 8629 0000 0000 0100 0000 0000 0000 ...)............ 0x0060 0000 ffff ffff b701 0000 0000 1400 0000 ................ 0x0070 0000 0000 1400 0000 5757 572e 504f 5041 ........WWW.POPA 0x0080 4453 544f 502e 434f 4d00 0000 1400 0000 DSTOP.COM....... 0x0090 0000 0000 1400 0000 554e 5345 4355 5245 ........UNSECURE 0x00a0 4420 434f 4d50 5554 4552 0000 6b01 0000 D.COMPUTER..k... 0x00b0 0000 0000 6b01 0000 5055 424c 4943 2053 ....k...PUBLIC.S 0x00c0 4552 5649 4345 2041 4e4e 4f55 4e43 454d ERVICE.ANNOUNCEM 0x00d0 454e 543a 0d0a 0d0a 0d0a 594f 5552 2043 ENT:......YOUR.C 0x00e0 4f4d 5055 5445 5220 4953 204e 4f54 2053 OMPUTER.IS.NOT.S 0x00f0 4543 5552 4544 2041 4741 494e 5354 2050 ECURED.AGAINST.P 0x0100 4f50 2d55 5053 2121 210d 0a0d 0a0d 0a44 OP-UPS!!!......D 0x0110 4f4e 2754 2053 5045 4e44 2041 4e59 204d ON'T.SPEND.ANY.M 0x0120 4f4e 4559 2046 4f52 2041 4e59 2050 4f50 ONEY.FOR.ANY.POP 0x0130 2d55 5020 424c 4f43 4b45 5221 0d0a 0d0a -UP.BLOCKER!.... 0x0140 4765 7420 6f75 7273 2066 6f72 2046 5245 Get.ours.for.FRE 0x0150 4521 2121 0d0a 0d0a 5965 7320 7468 6174 E!!!....Yes.that 0x0160 2773 2072 6967 6874 2c20 5354 4f50 2050 's.right,.STOP.P 0x0170 6f70 2d55 7020 6164 7320 666f 7220 4652 op-Up.ads.for.FR 0x0180 4545 2121 210d 0a0d 0a0d 0a0d 0a20 2020 EE!!!........... 0x0190 2020 2020 2020 2020 2020 2a20 2a20 2a20 ..........*.*.*. 0x01a0 2020 2020 444f 204e 4f54 2043 4c49 434b ....DO.NOT.CLICK 0x01b0 2022 4f4b 2220 4245 464f 5245 2047 4f49 ."OK".BEFORE.GOI 0x01c0 4e47 2054 4f20 4f55 5220 5745 4253 4954 NG.TO.OUR.WEBSIT 0x01d0 4520 2020 2020 2a20 2a20 2a0d 0a0d 0a4f E.....*.*.*....O 0x01e0 6e20 796f 7572 2077 6562 2062 726f 7773 n.your.web.brows 0x01f0 6572 2773 2061 6464 7265 7373 2062 6172 er's.address.bar 0x0200 2c20 5459 5045 2049 4e3a 2020 2020 2077 ,.TYPE.IN:.....w 0x0210 7777 2e50 6f70 4164 5374 6f70 2e63 6f6d ww.PopAdStop.com 0x0220 0d0a 00 ... The advertised site, "www.popadstop.com", does offer a program for download, which promises to stop future popup spam. We downloaded the application, and installed it in an isolated lab network. During install, the application checks for updates by requesting: http://www.neweststuff.com/versinfo.dat . Recent version of the application do not show any further outbound traffic. However, earlier version of the application did start to send the typical two zero bytes and popup spam. We have been made available the following trace from an infected system: 1. connection to popadstop.com, port 80 (http) e.f.g.h 066.225.219.162 6 1485 80 88472 4249 17:27:21.5791 e.f.g.h 066.225.219.162 6 1486 80 15401 1203 17:27:27.9025 e.f.g.h 066.225.219.162 6 1489 80 4802 1159 17:28:16.9154 e.f.g.h 066.225.219.162 6 1490 80 1331056 25025 17:28:41.2205 e.f.g.h 066.225.219.162 6 1491 80 824 408 17:29:20.3522 2. connection to neweststuff.com, port 80 (http) e.f.g.h 216.058.174.211 6 1492 80 746 410 17:29:20.4347 (snip one min) 3. scanning for port 1026-1030 e.f.g.h x.x.x.x 17 1528 1026 0 44 17:30:20.0967 e.f.g.h x.x.x.x 17 1529 1030 0 44 17:30:20.0979 e.f.g.h y.y.y.y 17 1528 1026 0 44 17:30:20.1787 e.f.g.h y.y.y.y 17 1529 1030 0 44 17:30:20.1790 Summary ------- An earlier version of the software distributed by PopAdStuff did actively scan and send popup spam from unsuspecting user's system. -- CTO SANS Internet Storm Center http://isc.sans.org phone: (617) 786 1563 fax: (617) 786 1550 jullrich(a)sans.org

1 0