- Test - lists.nanog.org

RE: Alert to Phone/Pager System
by kwallace＠pcconnection.com 12 Sep '03

12 Sep '03

you may want to check out DPS's IAM product. We use it and it's been reliable. They have also been willing to customize things for us in the past- http://dpstele.com/ Regards, Keith -----Original Message----- From: Allan Liska [mailto:allan@allan.org] Sent: Thursday, September 11, 2003 5:46 PM To: nanog(a)merit.edu Subject: Alert to Phone/Pager System I am looking for a hardware/software solution to a problem and I am hoping someone has implemented something similar: A monitoring system notices an error and sends an alert to a system (the alert can be sent over POTS or SMTP). The system recevies the alert and sends out a message (Pager/POTS/SMTP/SMS) to a group of people in a pager rotation. The 1st person is paged, if no response is received the second person is paged and so on down the line until someone responds. I looked at the Dialogic's The Communicator: http://www.dccusa.com/products.html But, it is a little pricey. I also looked at VOCP System: http://www.vocpsystem.com/ But, the desision maker is a little skittish about open source projects. Does anyone know of a happy medium between these two systems that will fill the requirements outlined above? Thanks! allan -- Allan Liska allan(a)allan.org http://www.allan.org

1 0

RE: ISS X-Force MS03-039 Free Scanner
by Ingevaldson, Dan (ISS Atlanta) 11 Sep '03

11 Sep '03

We have just released a new version of the scanner that has addressed some reporting inaccuracies. We have also included a MD5 checksum. It is available here: http://www.iss.net/support/product_utilities/Xfrpcss.php Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Ingevaldson, Dan (ISS Atlanta) Sent: Thursday, September 11, 2003 7:54 AM To: first-teams(a)first.org; nanog(a)merit.edu Subject: ISS X-Force MS03-039 Free Scanner Please see our X-Force Alert for more information about the new set of MSRPC issues. We have published a free CLI tool to scan for computers vulnerable to MS03-039. X-Force Alert: http://xforce.iss.net/xforce/alerts/id/152 Free Scanner: http://www.iss.net/support/product_utilities/Xfrpcss.php Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+ This message was posted through the FIRST mailing list server. Contact your team's FIRST representative to (un)subscribe, DO NOT REDISTRIBUTE BEYOND MEMBERS OF FIRST TEAMS UNLESS THE AUTHOR OF THIS MESSAGE GRANTS EXPRESS PERMISSION TO REDISTRIBUTE -+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+

1 0

Re[2]: Alert to Phone/Pager System
by Allan Liska 11 Sep '03

11 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 Hello Jeffrey, Thursday, September 11, 2003, 5:50:40 PM, you wrote: JM> I may be missing something, but don't monitoring systems (ie, Nagios) JM> have the built-in ability to send out pages w/ a locally attached modem, JM> or SMS (if you setup an email forwarder). In this case the monitoring system in place, which cannot be changed, can send out an alert, but only to a single source. The current system does not have the ability to handle the additional rotation capabilities needed for this project. Thanks for all the responses I have gotten so far. allan - -- Allan Liska allan(a)allan.org http://www.allan.org http://www.hosthideout.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUAP2D6Yikg6TAvIBeFAQEcxQP/SwPCAX9yeCWxUDml4si5CA4hR5SmDmMW 0w2x4GX20/Nh4Nc4rYJW1oqrWLw0Mw+fy5oPSht7IcJqzTPCJNKHvW72+Yx20nLt I10uGQ6iP/ldhdqV20vJ1d5XbU5n/3Iwq+OpaQPE8E6P8CPkFaMr79yk+vl/1TFO xn2tLDrEJ+M= =9V+V -----END PGP SIGNATURE-----

1 0

157.112.0.0/16 ARIN info updated, AT&T still announcing /16
by Kai Schlichting 11 Sep '03

11 Sep '03

>From the [Hijacked] list: > The ARIN information has been updated to have up-to-date contact info for > the original owner, the original owners' ISP is announcing 4 /18s but AT&T > is still announcing 157.112.0.0/16. Can whoever's been bugging AT&T to stop > announcing it to bug them some more? abuse(a)att.net seems to be a dead horse - demands from numerous parties, including the owner of this /16 (the true source of records is JPNIC: whois -h whois.nic.ad.jp "157.112.0.0 /e" , ARIN has not proceeded with 'early registration' transfer of this group of records to JPNIC, it seems) that have been mailed there and to various other @att.net addresses, including their so-called "legal demands center" (that is reportedly hard to reach via email) have been summarily ignored, and we mean "/dev/null'd". AT&T, for lack of presenting any TRO forcing them to keep routing this, appears to willingly conspire with the Empire Towers IP space hijackers while presented with overwhelming evidence that whatever forged documents Empire Towers and Thomas Cowles may have presented to them are indeed that - forged. ARIN zapping the legacy record for this block apparently isn't convincing enough for them to stop announcing this route. The ISP for Systems Clipper Inc. (AS 23720) had started announcing a competing /16 almost 2 weeks ago, but for reasons obvious to nearly all members of this list, that of course wasn't good enough: it's four /18's now, and AT&T should be seeing none of the traffic just about now. If you are peering with AS 7018, a nicely worded email to your peering contacts expressing your concern with AT&T's non-existent cooperation in IP space hijacking cases would be appreciated. Thank you. bye,Kai ps: and this says nothing about the amount and nature of actual abuse that's been reported from this /16 while it originated from AS 7018.

6 5

ISS X-Force MS03-039 Free Scanner
by Ingevaldson, Dan (ISS Atlanta) 11 Sep '03

11 Sep '03

Please see our X-Force Alert for more information about the new set of MSRPC issues. We have published a free CLI tool to scan for computers vulnerable to MS03-039. X-Force Alert: http://xforce.iss.net/xforce/alerts/id/152 Free Scanner: http://www.iss.net/support/product_utilities/Xfrpcss.php Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net ===============================

1 0

Migrating DSL Agg from Redback to Cisco
by Nick A Montante 11 Sep '03

11 Sep '03

Hello all- We are trying to move all of our DSL aggregation off of a Redback SMS1000 to a Cisco 7513. We are using the PA-A3-T3 card on the Cisco to talk to our DSL subscribers. We are currently running rfc1483 routed and bridged customers on the same ATM DS3 on the Redback. We're trying to figure out how to convert the config from the Redback to a Cisco config with no luck as of yet. Does anyone have a sample Cisco config for rfc1483 routed and bridged subs? TIA

1 0

RE: Cisco IOS Failure due to Virus
by Niaz, Wajahat 11 Sep '03

11 Sep '03

Try using only CEF. I have seen similar problems in the past using dcef -----Original Message----- From: Richard J.Sears [mailto:rsears@adnc.com] Sent: Thursday, September 11, 2003 12:26 AM To: Robert Blayzor Cc: Nanog Subject: Re: Cisco IOS Failure due to Virus Hi Robert, Thanks for the info. We are running dCEF...routers show about 4% CPU load and the following memory: BR02#sh mem Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 613AE340 247798976 106515996 141282980 140653360 134546752 Fast 6138E340 131080 37240 93840 93840 93788 Also, we are not blocking 92 byte ICMP due to the traceroute problems on customers networks... Thanks On Wed, 10 Sep 2003 23:17:01 -0400 Robert Blayzor <rblayzor(a)inoc.net> wrote: > > On 9/10/03 10:58 PM, "Richard J.Sears" <rsears(a)adnc.com> wrote: > > > %SYS-2-MALLOCFAIL: Memory allocation of 704 bytes failed from > > 0x60329F00, alignment 0 > > Pool: Processor Free: 92744 Cause: Memory fragmentation > > Alternate Pool: None Free: 0 Cause: No Alternate pool > > -Process= "Pool Manager", ipl= 0, pid= 6 > > -Traceback= 6038049C 60382200 60329F08 6038DEDC > > > > %TCP-6-NOBUFF: TTY0, no buffer available > > -Process= "BGP Router", ipl= 0, pid= 132 > > > > %% Low on memory; try again later > > Did you enable CEF? > Are you dropping 92 byte ICMP packets where needed? > > -- > Robert Blayzor, BOFH > INOC, LLC > rblayzor(a)inoc.net > PGP: http://www.inoc.net/~dev/ > Key fingerprint = A445 7D1E 3D4F A4EF 6875 21BB 1BAA 10FE 5748 CFE9 > > "I don't need parents. All I need is a recording that says, 'Go play > outside!" - Calvin and Hobbes > ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

1 0

Re: Max TNT ping thing
by Andy Walden 10 Sep '03

10 Sep '03

Drew, I believe this was the last message about it. Basically, put on all of your filters on all interfaces for both worms, play with the cache as indicated below and make sure you are running later code. At least 9.0.0.9 if I recall if not TAOS 10+. andy -- PGP Key Available at http://www.tigerteam.net/andy/pgp On Sat, 30 Aug 2003, Edward Murphy wrote: > Geo. said: > > > Tonight we either made to double checked the following parameters and the > > > problem seems to have cleared up: > > > > > > iproute-cache-enable = yes > > > ipport-cache-enable = yes > > > suppress-host-routes = no > > > iproute-cache-size = 1500 > > > ignore-icmp-redirects = yes > > > icmp-reply-directed-bcast = no > > > send-icmp-dest-unreachable = no > > > tcp-syn-flood-protect = yes > > > > I just checked and we had: > > > > iproute-cache-size = 50 > > send-icmp-dest-unreachable = yes > > tcp-syn-flood-protect = no > > > > and our box has been staying up just fine. I just modified the last two in > > order to see if that does anything different. the iproute-cache-size of 50 I > > decided to leave alone because I figure that depends on how much memory you > > have and I don't know how your box compares to ours in that respect.

1 0

TnT ethernet card fix?
by Drew Weaver 10 Sep '03

10 Sep '03

Anyone ever come up with a solution for the performance/reliability issues with the TNT without having to buy a new Ethernet card? Thanks, -Drew

3 2

SoBig volume way down
by up＠3.am 10 Sep '03

10 Sep '03

the volume of SoBig virii hitting our mail server had gotten so big that I had to have a cron job delete the quarantine every hour. We were averaging about 400 of them per hour until around midnight last night, where the volume went to and remains about 1/10th of that. Did this thing expire (in which case, roughly 10% of all infected machines have misconfigured clocks, assuming the exp date was in UDT), or did something else happen? Just curious... James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

3 2