- Test - lists.nanog.org

Cogentco/PSI BGP Admin around ?
by Jan Czmok 09 Sep '03

09 Sep '03

Subject says all :-) i am in urgent need of a bgp engineer from cogentco. their noc isn't helpful at all, no answer (except a ticket #) --jan -- Jan Czmok, Network Engineering & Support, Global Access Telecomm, Inc. Ph.: +49 69 299896-35 - fax: +49 69 299896-40 - sip:13129*522@inoc-dba.pch.net

1 0

Cisco ONS 15454 Password Recovery
by Matthew Crocker 09 Sep '03

09 Sep '03

Dear List, I know this isn't the correct forum and for that I apologize. I have been searching Ciscos website for the past 5 hours with no luck. I need to know how I can gain access to a Cisco ONS 15454 with TCC+ running 2.2.1 software rev. If anyone knows how to accomplish this please e-mail me off list. I have physical access to the unit, I can access it via Telnet, TL1 or CTC (web). The Node isn't in service now so I can power cycle it if needed. I need to get this into service tomorrow and I have exhausted all of my ideas on where to look for the information. Ideally I would like to reset the CISCO15 password to the default ('') without deleting the database. Thanks -Matt

1 0

What were we saying about edge filtering?
by Matthew Sullivan 09 Sep '03

09 Sep '03

Hi All, More whining and bitching from me ... sorry... So who thinks allowing anyone to route to or from IANA Reserved blocks (Bogons) is acceptable? A few captured packets.... 15:42:41.434384 1.6.145.24.1116 > 203.101.254.254.53: S 2056192000:2056192000(0) win 16384 15:42:41.570812 1.6.145.161.1043 > 203.101.254.254.53: S 773455872:773455872(0) win 16384 15:42:41.678862 1.6.147.198.1505 > 203.101.254.254.53: S 424280064:424280064(0) win 16384 15:42:41.985075 1.6.148.115.1448 > 203.101.254.254.53: S 1675624448:1675624448(0) win 16384 15:42:42.045121 1.6.148.202.1467 > 203.101.254.254.53: S 2072117248:2072117248(0) win 16384 15:42:42.528080 1.6.151.121.1180 > 203.101.254.254.53: S 1363410944:1363410944(0) win 16384 15:42:42.851633 1.6.153.101.1904 > 203.101.254.254.53: S 786563072:786563072(0) win 16384 15:42:42.908956 1.6.153.158.1712 > 203.101.254.254.53: S 1205272576:1205272576(0) win 16384 15:42:43.564536 1.6.157.75.1864 > 203.101.254.254.53: S 1150615552:1150615552(0) win 16384 15:42:43.653790 1.6.157.220.1882 > 203.101.254.254.53: S 209584128:209584128(0) win 16384 15:42:43.900861 1.6.159.103.1172 > 203.101.254.254.53: S 1935015936:1935015936(0) win 16384 15:42:44.247869 1.6.161.53.1045 > 203.101.254.254.53: S 1374552064:1374552064(0) win 16384 15:42:44.247936 1.6.161.140.1877 > 203.101.254.254.53: S 1761083392:1761083392(0) win 16384 15:42:44.388279 1.6.162.58.1230 > 203.101.254.254.53: S 1534263296:1534263296(0) win 16384 15:42:44.583169 1.6.163.23.1584 > 203.101.254.254.53: S 467271680:467271680(0) win 16384 15:42:44.653624 1.6.163.168.1091 > 203.101.254.254.53: S 1094844416:1094844416(0) win 16384 15:42:44.960670 1.6.166.33.1953 > 203.101.254.254.53: S 517210112:517210112(0) win 16384 15:42:45.323007 1.6.167.182.1541 > 203.101.254.254.53: S 417857536:417857536(0) win 16384 15:42:45.558600 1.6.168.235.1603 > 203.101.254.254.53: S 1652490240:1652490240(0) win 16384 15:42:45.588731 1.6.169.36.1581 > 203.101.254.254.53: S 1524498432:1524498432(0) win 16384 15:42:45.618207 1.6.170.39.1591 > 203.101.254.254.53: S 271319040:271319040(0) win 16384 15:42:47.164426 1.6.178.177.1159 > 203.101.254.254.53: S 879689728:879689728(0) win 16384 15:42:47.379603 1.6.179.231.1331 > 203.101.254.254.53: S 1859256320:1859256320(0) win 16384 15:42:47.979871 1.6.183.72.1516 > 203.101.254.254.53: S 1277362176:1277362176(0) win 16384 15:42:48.249871 1.6.184.215.1945 > 203.101.254.254.53: S 718929920:718929920(0) win 16384 15:42:48.581342 1.6.186.166.1478 > 203.101.254.254.53: S 889782272:889782272(0) win 16384 15:42:48.638018 1.6.187.54.1372 > 203.101.254.254.53: S 1532952576:1532952576(0) win 16384 15:42:48.803879 1.6.188.47.1253 > 203.101.254.254.53: S 1614348288:1614348288(0) win 16384 15:42:48.910837 1.6.188.191.1872 > 203.101.254.254.53: S 164429824:164429824(0) win 16384 15:42:49.014086 1.6.189.22.1078 > 203.101.254.254.53: S 1580924928:1580924928(0) win 16384 And a few more.... 13:31:16.215267 255.205.43.12.1146 > 203.101.254.254.53: S 1909522432:1909522432(0) win 16384 13:31:16.225790 254.255.110.156.1934 > 203.101.254.254.53: S 843513856:843513856(0) win 16384 13:31:16.255373 255.205.9.178.1040 > 203.101.254.254.53: S 1741881344:1741881344(0) win 16384 13:31:16.297785 255.64.58.64.1759 > 203.101.254.254.53: S 832634880:832634880(0) win 16384 13:31:16.365988 255.64.58.47.1057 > 203.101.254.254.53: S 1301217280:1301217280(0) win 16384 13:31:16.375685 254.255.111.56.1351 > 203.101.254.254.53: S 2103771136:2103771136(0) win 16384 13:31:16.397829 254.255.110.157.1513 > 203.101.254.254.53: S 1743912960:1743912960(0) win 16384 13:31:16.562945 254.255.111.57.1137 > 203.101.254.254.53: S 1048379392:1048379392(0) win 16384 13:31:16.586507 255.64.58.106.1017 > 203.101.254.254.53: S 1919811584:1919811584(0) win 16384 13:31:16.607479 254.255.110.158.1400 > 203.101.254.254.53: S 1749942272:1749942272(0) win 16384 13:31:16.633489 255.64.58.118.1783 > 203.101.254.254.53: S 1790640128:1790640128(0) win 16384 13:31:16.669888 255.64.58.130.1871 > 203.101.254.254.53: S 223608832:223608832(0) win 16384 13:31:16.727705 255.205.44.169.1309 > 203.101.254.254.53: S 1294270464:1294270464(0) win 16384 13:31:16.769538 255.205.11.113.1578 > 203.101.254.254.53: S 386662400:386662400(0) win 16384 13:31:16.804433 254.255.111.58.1724 > 203.101.254.254.53: S 1657602048:1657602048(0) win 16384 13:31:16.804552 255.64.58.195.1374 > 203.101.254.254.53: S 1183514624:1183514624(0) win 16384 13:31:16.838304 254.255.110.159.1749 > 203.101.254.254.53: S 2041905152:2041905152(0) win 16384 13:31:16.854785 255.205.45.24.1962 > 203.101.254.254.53: S 980942848:980942848(0) win 16384 13:31:16.891851 255.64.58.189.1145 > 203.101.254.254.53: S 1588723712:1588723712(0) win 16384 13:31:16.907291 255.205.45.101.1850 > 203.101.254.254.53: S 281804800:281804800(0) win 16384 13:31:16.926608 255.64.58.199.1491 > 203.101.254.254.53: S 396623872:396623872(0) win 16384 13:31:16.960441 255.64.58.240.1647 > 203.101.254.254.53: S 1321926656:1321926656(0) win 16384 13:31:17.041859 254.255.111.59.1760 > 203.101.254.254.53: S 1589116928:1589116928(0) win 16384 13:31:17.056862 254.255.110.160.1140 > 203.101.254.254.53: S 707133440:707133440(0) win 16384 13:31:17.080801 255.205.45.214.1924 > 203.101.254.254.53: S 1915224064:1915224064(0) win 16384 13:31:17.125443 255.64.59.0.1309 > 203.101.254.254.53: S 582287360:582287360(0) win 16384 13:31:17.228794 254.255.111.60.1733 > 203.101.254.254.53: S 1086128128:1086128128(0) win 16384 13:31:17.248735 255.205.13.20.1313 > 203.101.254.254.53: S 1997733888:1997733888(0) win 16384 13:31:17.272623 254.255.110.161.1478 > 203.101.254.254.53: S 2034368512:2034368512(0) win 16384 13:31:17.337051 255.205.46.189.1570 > 203.101.254.254.53: S 1085341696:1085341696(0) win 16384 13:31:17.380544 255.205.13.134.1182 > 203.101.254.254.53: S 1334706176:1334706176(0) win 16384 13:31:17.393981 255.64.59.108.1988 > 203.101.254.254.53: S 275841024:275841024(0) win 16384 13:31:17.394332 254.255.111.61.1225 > 203.101.254.254.53: S 1829044224:1829044224(0) win 16384 13:31:17.409783 254.255.110.162.1695 > 203.101.254.254.53: S 472383488:472383488(0) win 16384 13:31:17.419251 255.205.13.171.1933 > 203.101.254.254.53: S 1066336256:1066336256(0) win 16384 13:31:17.510895 254.255.111.62.1450 > 203.101.254.254.53: S 1052508160:1052508160(0) win 16384 13:31:17.535728 254.255.110.163.1492 > 203.101.254.254.53: S 289079296:289079296(0) win 16384 13:31:17.545043 255.205.47.123.1256 > 203.101.254.254.53: S 1559035904:1559035904(0) win 16384 13:31:17.680832 255.64.59.182.1939 > 203.101.254.254.53: S 930217984:930217984(0) win 16384 13:31:17.718981 254.255.111.63.1391 > 203.101.254.254.53: S 2029191168:2029191168(0) win 16384 13:31:17.739317 255.64.59.168.1043 > 203.101.254.254.53: S 1719926784:1719926784(0) win 16384 13:31:17.749319 254.255.110.164.1398 > 203.101.254.254.53: S 444006400:444006400(0) win 16384 13:31:17.820087 255.64.59.225.1438 > 203.101.254.254.53: S 186712064:186712064(0) win 16384 13:31:17.845466 255.64.59.232.1771 > 203.101.254.254.53: S 1787756544:1787756544(0) win 16384 13:31:17.849674 255.205.48.121.1409 > 203.101.254.254.53: S 1942159360:1942159360(0) win 16384 13:31:17.856734 254.255.111.64.1394 > 203.101.254.254.53: S 1471348736:1471348736(0) win 16384 13:31:17.883396 254.255.110.165.1367 > 203.101.254.254.53: S 611909632:611909632(0) win 16384 13:31:17.895921 255.205.48.160.1147 > 203.101.254.254.53: S 1586495488:1586495488(0) win 16384 13:31:17.913763 255.64.59.249.1026 > 203.101.254.254.53: S 708116480:708116480(0) win 16384 13:31:17.951460 255.205.15.147.1949 > 203.101.254.254.53: S 2000027648:2000027648(0) win 16384 13:31:17.989485 254.255.111.65.1467 > 203.101.254.254.53: S 81395712:81395712(0) win 16384 Is there any need to route bogons? Is there any reason why it cannot be filtered (I appreciate 224-239 is a different story)....? These packets were all originated on the other side of the Pacific to Telecom NZ. / Mat

14 17

dns.exe virus?
by Christopher J. Wolff 08 Sep '03

08 Sep '03

Greetings, After tracking down what I believed was an attempted DOS attack, it turns out that two Windows 2000 servers, fully updated, were spewing out hundreds of port 53 requests. Upon further investigation dns.exe was hogging 99% of the CPU. I haven't found any reference to this at CERT so I thought I would drop the occurrence into the nanog funnel to see what comes out. The attack started around 8AM MST. Thank you for your consideration. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

6 8

arin.net DNS problems
by Kai Schlichting 08 Sep '03

08 Sep '03

I had intermittent failures to resolve whois.arin.net today, and haven't bothered to investigate this until now: someone please forward this to an after-hours person at ARIN, hostmaster(a)arin.net will probably not be read for a while. Reason: BUCHU.arin.net. 3H IN A 192.100.59.110 arrowroot.arin.net. 3H IN A 198.133.199.110 are both not returning any A record for 'whois.arin.net' $ dig +norec @a.gtld-servers.net arin.net ns ;; ANSWER SECTION: arin.net. 2D IN NS l3.nstld.com. arin.net. 2D IN NS a3.nstld.com. arin.net. 2D IN NS c3.nstld.com. arin.net. 2D IN NS f3.nstld.com. arin.net. 2D IN NS g3.nstld.com. arin.net. 2D IN NS buchu.arin.net. arin.net. 2D IN NS arrowroot.arin.net. All *.nstld.com servers respond with: whois.arin.net. 3H IN A 192.149.252.43 The zone serials are consistent: ;; ANSWER SECTION: arin.net. 3H IN SOA arrowroot.arin.net. bind.arin.net. ( 2003061812 ; serial 3H ; refresh 10M ; retry 2W ; expiry 1H ) ; minimum However, buchu and arrowroot.arin.net BOTH answer very oddly when queried for an SOA: they are returning an A record for arin.net - not quite what was asked for! $ dig +norec @198.133.199.110 arin.net soa ; <<>> DiG 8.2 <<>> +norec @198.133.199.110 arin.net soa ; (1 server found) ;; res options: init defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1426 ;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 10, ADDITIONAL: 2 ;; QUERY SECTION: ;; arin.net, type = SOA, class = IN ;; ANSWER SECTION: arin.net. 3H IN A 192.149.252.17 ;; AUTHORITY SECTION: arin.net. 3H IN NS L3.NSTLD.COM. arin.net. 3H IN NS G3.NSTLD.COM. arin.net. 3H IN NS F3.NSTLD.COM. arin.net. 3H IN NS E3.NSTLD.COM. arin.net. 3H IN NS D3.NSTLD.COM. arin.net. 3H IN NS C3.NSTLD.COM. arin.net. 3H IN NS BUCHU.arin.net. arin.net. 3H IN NS B3.NSTLD.COM. arin.net. 3H IN NS arrowroot.arin.net. arin.net. 3H IN NS A3.NSTLD.COM. ;; ADDITIONAL SECTION: arrowroot.arin.net. 3H IN A 198.133.199.110 BUCHU.arin.net. 3H IN A 192.100.59.110 ;; Total query time: 17 msec ;; FROM: sonet.conti.nu to SERVER: 198.133.199.110 ;; WHEN: Mon Sep 8 18:34:11 2003 ;; MSG SIZE sent: 26 rcvd: 263 However, an 'any' query yields: $ dig +norec @198.133.199.110 arin.net any ; <<>> DiG 8.2 <<>> +norec @198.133.199.110 arin.net any ; (1 server found) ;; res options: init defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55882 ;; flags: qr aa; QUERY: 1, ANSWER: 16, AUTHORITY: 0, ADDITIONAL: 4 ;; QUERY SECTION: ;; arin.net, type = ANY, class = IN ;; ANSWER SECTION: arin.net. 3H IN SOA arrowroot.arin.net. bind.arin.net. ( 2003061812 ; serial 3H ; refresh 10M ; retry 2W ; expiry 1H ) ; minimum arin.net. 3H IN A 192.149.252.17 arin.net. 3H IN MX 10 smtp2.arin.net. arin.net. 3H IN MX 20 smtp1.arin.net. arin.net. 3H IN NS L3.NSTLD.COM. arin.net. 3H IN NS G3.NSTLD.COM. arin.net. 3H IN NS F3.NSTLD.COM. arin.net. 3H IN NS E3.NSTLD.COM. arin.net. 3H IN NS D3.NSTLD.COM. arin.net. 3H IN MX 40 cumin.apnic.net. arin.net. 3H IN NS C3.NSTLD.COM. arin.net. 3H IN NS BUCHU.arin.net. arin.net. 3H IN NS B3.NSTLD.COM. arin.net. 3H IN MX 30 aso.icann.org. arin.net. 3H IN NS arrowroot.arin.net. arin.net. 3H IN NS A3.NSTLD.COM. ;; ADDITIONAL SECTION: smtp2.arin.net. 3H IN A 192.149.252.32 smtp1.arin.net. 3H IN A 192.149.252.33 arrowroot.arin.net. 3H IN A 198.133.199.110 BUCHU.arin.net. 3H IN A 192.100.59.110 ;; Total query time: 117 msec ;; FROM: sonet.conti.nu to SERVER: 198.133.199.110 ;; WHEN: Mon Sep 8 18:36:01 2003 ;; MSG SIZE sent: 26 rcvd: 437 The *.nstld.com servers are answering to these queries in normal fashion. bye,Kai -- "Just say No" to Spam Kai Schlichting New York, Palo Alto, You name it Sophisticated Technical Peon Kai's SpamShield <tm> is FREE! http://www.SpamShield.org | | LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxes WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMath

1 0

Re: Cable & Wireless, Verio and/or Level 3 port blocking?
by Jared Mauch 08 Sep '03

08 Sep '03

On Mon, Sep 08, 2003 at 12:32:14PM -0700, Tom (UnitedLayer) wrote: > On Mon, 8 Sep 2003, Jared Mauch wrote: > > NTT/Verio is performing no network-wide port blocking > > of such services. > > Last time I asked, they were filtering to some degree. > I don't recall where they were filtering however. I know that there were some filters deployed initally but they were removed. Any filters that remain are one-off filters on individual customer connections. If you are a NTT/VERIO customer (is that better? ;-) ) and are experiencing problems you should obviously contact your relevant support teams. - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

RE: Don't forget about physical security - Australia
by St. Clair, James 08 Sep '03

08 Sep '03

My apologies to spamming Sean - here is the link to the tale: Personal Message: Brilliant display of chutzpah and social engineering. The brazen airport computer theft that has Australia's anti-terror fighters up in arms By Philip Cornford September 5, 2003 URL: http://www.smh.com.au/articles/2003/09/04/1062548967124.html -----Original Message----- From: Sean Donelan [mailto:sean@donelan.com] Sent: Saturday, September 06, 2003 2:13 AM To: nanog(a)merit.edu Subject: Don't forget about physical security - Australia Two people dressed as computer technicians entered Australia's mainframe data center for customs and intelligence centre at the Sydney International Airport. They impersonated EDS technicians hired to repair the mainframes. They spent two hours disconnecting the mainframe communications equipment. They then put the equipment on trolleys and pushed them out the front door past the guards.

1 0

Re: wire rate filtering and policy routing
by sthaug＠nethelp.no 08 Sep '03

08 Sep '03

> Aside from Juniper, what are the options for wire rate filtering and policy > routing (for at least 1Gbps and say 500+kpps)? > > As usual, private responses will result in a summary to the list. Cisco 6500 with Sup2/MSFC2/PFC2 or with Sup720. If you don't need a full routing table you might even be able to do it with a Cisco 3550. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

wire rate filtering and policy routing
by John Payne 08 Sep '03

08 Sep '03

Aside from Juniper, what are the options for wire rate filtering and policy routing (for at least 1Gbps and say 500+kpps)? As usual, private responses will result in a summary to the list. Thanks

1 0

Roll call, custom IPG support
by Adam Rothschild 08 Sep '03

08 Sep '03

Do any providers support non-standard inter-packet gap (IPG) configurations on transit customers' ethernet interfaces? Please respond privately, and I'll post a summary to the list. Thanks, -a

1 0