- Test - lists.nanog.org

Finding ASN from IP address
by Avleen Vig 10 Oct '03

10 Oct '03

I want to create a mapping of IP addresses to ASN, for a specific like of IP addresses. Eg: 1.2.3.4 12.34.56.78 etc, gathered from my system logs. What is the best way of doing this? I thought about something along the lines of: install routing software (zebra?) pass software the IP's, get it to spit back a string from which I can grab the ASN Two problems being I don't know which software to install that can do that, or where to get a copy of the current routing table, so that I can feed that to the software. Suggestions appreciated. -- Avleen Vig Systems Administrator Personal: www.silverwraith.com EFnet: irc.mindspring.com

7 6

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Dr. Jeffrey Race 10 Oct '03

10 Oct '03

On Thu, 9 Oct 2003 18:40:35 -0400, John Capo wrote: > I spent >the rest of the day googleing for case law that might be applied >to the network operators providing connectivity to the trojaned >boxes being used for illegal activities, identity theft. Didn't >accomplish much except wasting the day. This is a trivial legal exercise and I remain surprised the infamous "plaintiff's bar" has not started suing these scum. Some of the obviously relevant legal bases are negligent enablement, unjust enrichment, attractive nuisance. Talk to any lawyer; he'll tell you. I am sure there are BIG BIG damages to be had for a little litigation. Jeffrey Race

1 0

Is there anything that actually gets users to fix their computers?
by Sean Donelan 10 Oct '03

10 Oct '03

Short of turning off their network access, why won't users fix their computers when the computer is infected or needs a patch? The University of Massachusetts posted bulletins, sent an email to all incoming students, included an alert when they connected. Nevertheless, almost three months after Microsoft released the critical patch and almost two months after the first Blaster worm was released over 1,600 students failed to patched their computers. Eventually, the University started shutting off network access for the students and charging $3 for the CD with the patch and $25/hour for support to clean the student's computers. http://www.dailycollegian.com/vnews/display.v/ART/2003/10/03/3f7cfeb12c8c2 "Some students told the staff that they thought the University gave their systems a virus. "By no means was this a UMass internet problem," said Fairey. "People were probably infected before they got to campus." One student threatened to sue OIT, arguing that the offices did not have the right to turn off her port. "We have policies that clearly state our right to shut off systems," mentioned Fairey. "It's not something that we want to do. It's a nightmare."

18 40

Re: Finding clue at comcast.net
by Howard C. Berkowitz 10 Oct '03

10 Oct '03

>----- Original Message ----- >From: "Howard C. Berkowitz" <hcb(a)gettcomm.com> >To: <nanog(a)merit.org> >Sent: Thursday, October 09, 2003 11:20 AM >Subject: RE: Finding clue at comcast.net > > >> >> At 9:29 AM -0500 10/9/03, Austad, Jay wrote: >> >Comcast's phone support department is the *worst*, WORST, I've ever dealt >> >with. I think they are outsourced, they have to go by a script, and many >of >> >them probably hardly know what a computer even is. Once I called because >of >> >a problem on their network, and I told the person on the phone that there >> >was a problem on their network, and I pinned it down to a couple of >routers >> >where the problem may be, and she responded, very sternly, "Sir, WE DON'T >> >HAVE ANY ROUTERS" >> >> Same thing here. Last night, I was told that no escalation personnel >> were available. >* Depending on how big a company is or how the outsourcing company staffs at >night this can be true. No escalation personnel may be physically present, >but this doesn't mean there isn't someone they can call. An outsourcing >companies call center agents have to first decide (policy?) that the issue >warrants escalation, and then they probably have to call THEIR manager (of >the outsourcing company). This manager then gets to decide if it REALLY >warrants escalation to their client (the cable company). They don't want to >call them after-hours unneccesarily. And cable companies are used to having >24-hours to resolve most outages, and if it doesn't affect a LOT of their >customers it isn't considered an outage worth escalating. A real world >example is: 6 calls in one cable node with the problem persisting for 15 to >30 minutes (calls keep coming in) would be a case for an on-call technician >to be called. Anything less just gets Service Calls placed in CableMaster on >AS/400. These things can wait for a scheduled (all-day) appointment unless >the customer insists on a time-frame. *sigh* Y'know, I could live with it if I could even have a mailbox to which I could send detailed trouble reports, even if no one looked at them on the next day. While their routing seems to be fairly stable these days, there would be times I'd traceroute from several sites I could reach and take views from multiple looking glasses, giving me a pretty fair idea where, and even what, the problem is. The customer disservice people that really drive me nuts are the first-levels that believe they are NEVER wrong. If you say there's an IP routing problem, they may say "how do you know there's a problem with our ippp(rhymes with pip)?" "We don't support SMTP or POP3. You have to use Outlook.." "You must remove your firewall and router so we can troubleshoot." "It's irrelevant that you can ping the access router. It must be your modem. Go to the local office and exchange it." "I'm sure the problem will be resolved, so there's no reason to give you a trouble ticket" "b'gop? bajop? We don't support bee-gee-pee in our network." "access router? We just have Windows servers." > >* Exactly what I described above. But I wouldn't accept "hopefully somebody >would respond". That is NOT acceptable. Someone should respond within 1 >business day at most. Again your not going to find many on-call or >higher-level support reading email after-hours and responding to things. >Even I couldn't do it ALL of the time. And I was the only one doing that in >a local cable company (not a national company) with 2 cities. I'd be happy, again, if they'd let me give them a trouble ticket. Oh, they have told me at times that I could do that at their website, which is an interesting problem when you don't have connectivity. I'd gladly pay extra for dial backup at low speed, but they don't offer that. > >> >> At the time, I was paying for their "Pro" service, intermediate >> between regular residential and full business. My contact said that >> while that was supposed to get better customer support, an early plan >> to route it to business Comcast failed, and there really was NO > > separate Pro support organization. I dropped the Pro service after I >> learned that residential service no longer insisted you remove any >> local routers and firewalls before deigning to troubleshoot. They >> still ask you to do that, but repeated NO responses can get them to >> proceed. >* Pro services, where I was working, gets escalated like the above >description I wrote. If you are not completely down you're probably not >going to see something done about it until the next business day (assuming >after-hours). They treated completely-down situations like that. > >> >> A few NANOGs back (Atlanta), I did a presentation on customer >> satisfaction, which, frankly, was in many respects a case study of >> how I'd reform customer support at my then ISP/DSL, cais.net. If >> NANOG ever did formal documents, I'd like to see a guideline on how >> to run customer support. >* I saw you powerpoint and I liked it. > >> >> > >> >In any case, if you manage to get the call escalated a couple of times >> >(after lying about rebooting your computer 47 times), >> >> You forgot reinstalling Windows. On a Mac. >> >* Typicall front line support (should) be able to figure out if you are >reporting a problem with your connection, e.g. your cable modem is not >"acquired" or you have no IP connectivity or DNS resolution, or if you are >reporting something else that needs escalation to a higher level of support >(or to the cable company on-call). Again the rules of engagement I described >above about number of calls on one cable node and how long it has been down >(need 15-30 minutes). [Some things in outside plant reset themselves >automatically]. > >A lot of cable companies are likely new to providing PRO services. Also >remember a lot of cable companies just recently took the ISP infrastructure >in-house after having outsourced for many years to companies like >Excite@Home and ISPChannel. Also some of these outsourced call centers >surely don't have the ISP support background they need. The one I was at, >wether they'd admit it or not, learned a lot from me. I came from small ISP >dial-up support where I was everything as well as working at a Latin >American Countries ISP aggregator. So I wasn't made from the same mold as >many of these newer personnel you will come across. Things may have to >escalate to a pretty high level to find someone with the kind of clue to >have dealt with knowledgeable customers ... especially Internet Core NSP >persons. A few times, mostly at 2nd level, someone recognizes my name from one of my books -- and gets helpful. Indeed, in some of those trouble calls, they set up a conference call and I did some tutorials.

2 1

RE: Finding clue at comcast.net
by Austad, Jay 10 Oct '03

10 Oct '03

Comcast's phone support department is the *worst*, WORST, I've ever dealt with. I think they are outsourced, they have to go by a script, and many of them probably hardly know what a computer even is. Once I called because of a problem on their network, and I told the person on the phone that there was a problem on their network, and I pinned it down to a couple of routers where the problem may be, and she responded, very sternly, "Sir, WE DON'T HAVE ANY ROUTERS" In any case, if you manage to get the call escalated a couple of times (after lying about rebooting your computer 47 times), you'll get someone good. Also, there are some good people who read this list. But calling their phone support to get anything useful is like trying to squeeze blood from a rock. -jay > -----Original Message----- > From: Howard C. Berkowitz [mailto:hcb@gettcomm.com] > Sent: Wednesday, October 08, 2003 7:36 PM > To: nanog(a)merit.org > Subject: Finding clue at comcast.net > > > > I'm rapidly beginning to believe this is equivalent to finding the > pot of gold at the end of the rainbow. When my broadband alternative > is Verizon and it's looking better, this is scary. > > Sometime today, their SMTP server started bouncing messages with more > than 3 addressees. When I called customer support, I was told "we > only handle troubleshooting, not mail service." The operator > "guessed" they might be doing software updates on the mail service, > had no information, and said there was no person to which it could be > escalated. > > She insisted that I call my local cable office to find out when the > "server repair" would be completed, because "they schedule all > repairs." > > Is this a bad dream? >

7 6

RE: Qwest bgp communities
by Williams, Ken 10 Oct '03

10 Oct '03

Disregard, I thought they had allowed bgp queries on that site as well.... -----Original Message----- From: Haesu [mailto:haesu@towardex.com] Sent: Thursday, October 09, 2003 5:39 PM To: nanog(a)merit.edu Subject: Qwest bgp communities Hi, Anyone here know if Qwest operates a route server like GBLX, HE, ATT, that also shows AS209's communities? It would be useful for some bgp troubleshooting.. There is one peer in route-views.oregon-ix.net that shows 209 routes, but unfortunately, that particular peer strips off all 209's communities. I am trying to troubleshoot a problem where 209:70 set on a prefix doesn't seem to work/propagate, etc et al. Or does anyone know of any route-servers run by a Qwest customer/peer that receives communities? I know that http://stat.qwest.net has looking glass but it doesn't let you run any bgp commands; just ping and traceroute :-( If you can assist, please reply to me off-list. Thank you very much for your time, -hc -- Haesu C. TowardEX Technologies, Inc. Consulting, colocation, web hosting, network design and implementation http://www.towardex.com | haesu(a)towardex.com Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 Fax: (978)263-0033 | POC: HAESU-ARIN

1 0

RE: Qwest bgp communities
by Williams, Ken 10 Oct '03

10 Oct '03

http://stat.qwest.net/looking_glass.html -----Original Message----- From: Haesu [mailto:haesu@towardex.com] Sent: Thursday, October 09, 2003 5:39 PM To: nanog(a)merit.edu Subject: Qwest bgp communities Hi, Anyone here know if Qwest operates a route server like GBLX, HE, ATT, that also shows AS209's communities? It would be useful for some bgp troubleshooting.. There is one peer in route-views.oregon-ix.net that shows 209 routes, but unfortunately, that particular peer strips off all 209's communities. I am trying to troubleshoot a problem where 209:70 set on a prefix doesn't seem to work/propagate, etc et al. Or does anyone know of any route-servers run by a Qwest customer/peer that receives communities? I know that http://stat.qwest.net has looking glass but it doesn't let you run any bgp commands; just ping and traceroute :-( If you can assist, please reply to me off-list. Thank you very much for your time, -hc -- Haesu C. TowardEX Technologies, Inc. Consulting, colocation, web hosting, network design and implementation http://www.towardex.com | haesu(a)towardex.com Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 Fax: (978)263-0033 | POC: HAESU-ARIN

1 0

Qwest bgp communities
by Haesu 10 Oct '03

10 Oct '03

Hi, Anyone here know if Qwest operates a route server like GBLX, HE, ATT, that also shows AS209's communities? It would be useful for some bgp troubleshooting.. There is one peer in route-views.oregon-ix.net that shows 209 routes, but unfortunately, that particular peer strips off all 209's communities. I am trying to troubleshoot a problem where 209:70 set on a prefix doesn't seem to work/propagate, etc et al. Or does anyone know of any route-servers run by a Qwest customer/peer that receives communities? I know that http://stat.qwest.net has looking glass but it doesn't let you run any bgp commands; just ping and traceroute :-( If you can assist, please reply to me off-list. Thank you very much for your time, -hc -- Haesu C. TowardEX Technologies, Inc. Consulting, colocation, web hosting, network design and implementation http://www.towardex.com | haesu(a)towardex.com Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 Fax: (978)263-0033 | POC: HAESU-ARIN

1 0

RE: Wired mag article on spammers playing traceroute games with trojaned boxes
by Mike Damm 09 Oct '03

09 Oct '03

Actually, running a web server on 8290 isn't as easy as 80. SpamAssassin tests (WEIRD_PORT) for this, as do many other filtering packages. Forcing spammers to use non-standard ports will greatly increase their rate of detection, and in turn help to solve the spam problem. -Mike -----Original Message----- From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] Sent: Thursday, October 09, 2003 9:56 AM To: Joe Boyce Cc: nanog(a)merit.edu Subject: Re: Wired mag article on spammers playing traceroute games with trojaned boxes On Thu, 9 Oct 2003, Joe Boyce wrote: > VA> Personally, I think preventing residential broadband customers from hosting > VA> servers would limit a lot of that. I'm not saying that IS the solution. > > It's not like those customers are aware they are hosting servers, they > most likely were exploited and are now unaware they are hosting > websites. That's obviously the case. No spammer has "thousands" of legitimately purchased DSL/Cable connections. The article pretty clearly says they're exploiting insecure windows (isn't that redundant?) boxes. Trouble is, how do you stop this? Just blocking common ports like 80 by default (unless the customer plans to actually run a web server and asks for the filter to be removed) won't work. The spammers can just as easily spam with urls containing ports (http://blah.biz:8290/) if they find 80 is filtered or find that filtering has become common. So other than waiting some infinitely long time for a secure out of the box version of windows (and for everyone to upgrade), how do you stop this? Widespread deployment of reflexive access lists? Force all broadband customers to use NAT and let them forward ports or entire IPs to their private IP servers if they have any? Wait for the legal system to catch and prosecute a few people who do this and deter others from trying it? Convince registrars to kill domains that are clearly being used by thieves? ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

3 2

RE: Wired mag article on spammers playing traceroute games with trojaned boxes
by McBurnett, Jim 09 Oct '03

09 Oct '03

-> ->I found one of these today, as a matter of fact. The spam was ->advertising an anti-spam package, of course. -> ->The domain name is vano-soft.biz, and looking up the address, I get -> ->Name: vano-soft.biz ->Addresses: 12.252.185.129, 131.220.108.232, 165.166.182.168, ->193.165.6.97 -> 12.229.122.9 -> ->A few minutes later, or from a different nameserver, I get -> ->Name: vano-soft.biz ->Addresses: 131.220.108.232, 165.166.182.168, 193.165.6.97, ->12.229.122.9 -> 12.252.185.129 -> ->This is a real Hydra. If everyone on the list looked up ->vano-soft.biz ->and removed the trojaned boxes, would we be able to kill it? -> ->--Chris I got : Canonical name: vano-soft.biz Addresses: 165.166.182.168 193.92.62.42 200.80.137.157 12.229.122.9 12.252.185.129 I think even if we get all the ones for this domain name today, assuming we can muster even man hours to get it today, another 5000 will be added tomarrow. And looking at my list We have US(a very small ISP and a large ISP) RIPE, and LACNIC. I wonder if the better question should be: Can Broadband ISP's require a Linksys, dlink or other broadband router without too many problems? That is what it will take to slow this down, and then only if ALL of ISP's do it. This not only affects this instance but global security as a whole. Just a few days ago, Cisco was taken offline by a large # of Zombies, I am willing to say that those are potentially some of the same compromised systems. Thoughts? Jim

12 13