- Test - lists.nanog.org

RE: Virus emails from nanog mail list
by Dan Lockwood 19 Aug '03

19 Aug '03

I have not seen the NANOG email problem, but have received several tens of thousans of SPAM messages that claim to be from 'webmaster(a)apnic.net'. The originating address in the messages is 66.218.66.70. As David pointed out, this may or may not be correct. Dan -----Original Message----- From: David Diaz [mailto:techlist@smoton.net] Sent: Tuesday, August 19, 2003 9:43 To: nanog(a)merit.edu Subject: Virus emails from nanog mail list Spam may be off topic but in this case relevant. Has anyone else noticed bounced emails that appear to have origionated from their nanog email boxes and contain viruses? Obviously some bot has gone threw the nanog list and is now forging headers such that they appear to come from those addresses, and they are attaching viruses. The IP address (which may or may not be accurate) appears to be [195.157.87.253]. Has anyone else noticed this recently? Dave -- David Diaz dave(a)smoton.net [Email] pagedave(a)smoton.net [Pager] www.smoton.net Smotons (Smart Photons) trump dumb photons

1 0

Re: Details
by CERT(R) Coordination Center 19 Aug '03

19 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- *************************************************************************** [NOTE -- THIS IS AN AUTOMATED RESPONSE] Thank you for contacting the CERT(R) Coordination Center. We appreciate your contacting us and consider your communications with us to be very important. Because we focus our response efforts to have the greatest impact on the Internet community, we may be unable to provide you with a personal response to your message. Please review the pointers contained in this message for information which may be of immediate use to you. Section A - CERT/CC Current Activity Section B - Incident Reporting Information Section C - Vulnerability Reporting Information If you need additional information from the CERT/CC, we encourage you to begin by looking at our list of CERT/CC Frequently Asked Questions: http://www.cert.org/faq/cert_faq.html ====================================================================== Section A - CERT/CC Current Activity The CERT/CC Current Activity web page provides a summary list of the most frequent types of incident and vulnerability activity currently being reported to the CERT/CC. Please refer to this regularly updated page to obtain immediate assistance in response to frequently reported activity: http://www.cert.org/current/current_activity.html In addition, the latest CERT/CC documents can be found at: * CERT Advisories - http://www.cert.org/advisories/ * CERT Incident Notes - http://www.cert.org/incident_notes/ * CERT Vulnerability Notes - http://www.kb.cert.org/vuls/ * CERT Summaries - http://www.cert.org/summaries/ * CERT Tech Tips - http://www.cert.org/tech_tips/ * What's New - http://www.cert.org/nav/whatsnew.html * CERT/CC Web Site - http://www.cert.org/ For pointers to information about computer viruses and hoaxes, please see: * http://www.cert.org/other_sources/viruses.html ====================================================================== Section B - Incident Reporting Information We appreciate receiving incident reports because it helps us to gain a better understanding of ongoing intruder activities and attack profiles. From the information we receive, we are able to identify and address critical security issues within the Internet community. Because we prioritize our response efforts to have the greatest impact on the Internet community, we are not be able to provide everyone with a personal response. For general information about reporting incidents to the CERT/CC, please see our Incident Reporting Guidelines at: http://www.cert.org/tech_tips/incident_reporting.html To report incidents to the CERT/CC, please send information about the incident in plain text format to cert(a)cert.org. You may wish to use our Incident Reporting Form, located at: http://www.cert.org/reporting/incident_form.txt The CERT/CC considers the following types of incidents to be emergencies: * possible life-threatening activity * attacks on the Internet infrastructure, such as: - root name servers - domain name servers - major archive sites - network access points (NAPs) * widespread automated attacks against Internet sites * new types of attacks or new vulnerabilities If you are reporting such an emergency outside our operational hours - business days between 08:00-17:00 EST/EDT (GMT-5/GMT-4) and require immediate assistance, then please call the CERT hotline: +1 412 268 7090 If you believe the intruder activity is a threat to people's lives or to the Internet infrastructure, please contact us immediately. ====================================================================== Section C - Vulnerability Reporting Information If you would like to report a new type of vulnerability or tool being used by the intruder community, we would be interested in any details that you may have. If you are able, please include any or all of source code, log files of execution, and descriptions of operating dependencies. Please feel free to submit these details in ASCII format files (where possible) of your own design, or if you prefer to use a form, please see the file: http://www.cert.org/reporting/vulnerability_form.txt Please also encrypt the report using PGP if you are able to do so. Instructions are given at the top of the reporting form. Our vulnerability disclosure policy is available at http://www.kb.cert.org/vuls/html/disclosure ====================================================================== CERT(R) Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA USA 15213-3890 Internet e-mail: cert(a)cert.org (monitored during business hours) Telephone: +1-412-268-7090 24-hour hotline CERT Coordination Center personnel answer business days 08:00-17:00 EST/EDT (GMT-5)/(GMT-4), on call for emergencies during other hours. Fax: +1-412-268-6989 CERT and CERT Coordination Center are registered in U.S. Patent and Trademark Office. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8 iQCVAwUBPj72n2jtSoHZUTs5AQH8ogQAnuO94fFwfsCRDZ3Ug5G9jB53pLcMW6GW p0m1kgZfCvcKNze3De3d3VLPw9SwRdOkexg9mPuql7WRM78ySNYtqyN9G2vQjtmz EoOhSrPFmKpFI5+wrf5NzQzGre3x7Tk68UVKI3SpCDf0yLlc71urQ0f5QNeRRRrM ClWhCKv5uuA= =8mpq -----END PGP SIGNATURE-----

2 1

RE: AT&T Blocking ICMP
by Mike Tancsa 19 Aug '03

19 Aug '03

Are they blocking just icmp echo or everything ? ---Mike At 12:29 PM 19/08/2003 -0400, Ingevaldson, Dan (ISS Atlanta) wrote: >The "Nachi" worm propagates via MSRPC DCOM and the IIS WebDAV bug. It >may be causing this storm because it runs 300 scanning threads, and it >pings each IP first. > >http://xforce.iss.net/xforce/alerts/id/150 > >MS Blast wasn't multithreaded. > >Regards, >=============================== >Daniel Ingevaldson >Engineering Manager, X-Force R&D >dsi(a)iss.net >404-236-3160 > >Internet Security Systems, Inc. >The Power to Protect >http://www.iss.net >=============================== > > >-----Original Message----- >From: Paul Jasa [mailto:pjasa@univision.net] >Sent: Tuesday, August 19, 2003 12:19 PM >To: nanog(a)merit.edu >Subject: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?) > > > >A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking >ICMP in order to deal with an undefined emergency. Nothing posted on >their site, nor any other info is available. If anyone has info related >to this "icmp outage", please advise. Thanks! pj > >====================================== >Paul Jasa >Network Engineer >====================================== > > >-----Original Message----- >From: Sean Crandall [mailto:sean@megapath.net] >Sent: Tuesday, August 19, 2003 02:12 AM >To: Paul Jasa; nanog(a)merit.edu >Subject: RE: AT&T US Network Slowdown? >Importance: High > > > > > > Dear Nanogers, > > Is anyone aware of a "slowdown" issue throughout the US AT&T > > network since 8/18 at around 4pm which is causing a lot of > > internet circuits (including DSL) to be inaccessible and/or > > appear down from the outside world? AT&T says this has been > > escalated to "Level 4" with no ETA and affecting the whole > > country. I am seeing this problem in the San Francisco area. > > Just wondering if anyone else is experiencing anything that > > would confirm AT&T's claim, and fishing for more info about > > the possible cause and ETA. Thanks! > >We are currently seeing the slowdown on our network in San Jose. >Started about exactly the time frame that you mentioned. The rest of >the country >(oddly) seems unaffected by this at the moment, but San Jose is getting >hammered by something. > >Still trying to sort out exactly where it is coming from. > >-Sean > >Sean P. Crandall >VP Engineering Operations >MegaPath Networks Inc. >Pleasanton, CA 94588 >(925) 201-2530 >

1 0

AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?)
by Paul Jasa 19 Aug '03

19 Aug '03

A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking ICMP in order to deal with an undefined emergency. Nothing posted on their site, nor any other info is available. If anyone has info related to this "icmp outage", please advise. Thanks! pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Sean Crandall [mailto:sean@megapath.net] Sent: Tuesday, August 19, 2003 02:12 AM To: Paul Jasa; nanog(a)merit.edu Subject: RE: AT&T US Network Slowdown? Importance: High > > Dear Nanogers, > Is anyone aware of a "slowdown" issue throughout the US AT&T > network since 8/18 at around 4pm which is causing a lot of > internet circuits (including DSL) to be inaccessible and/or > appear down from the outside world? AT&T says this has been > escalated to "Level 4" with no ETA and affecting the whole > country. I am seeing this problem in the San Francisco area. > Just wondering if anyone else is experiencing anything that > would confirm AT&T's claim, and fishing for more info about > the possible cause and ETA. Thanks! We are currently seeing the slowdown on our network in San Jose. Started about exactly the time frame that you mentioned. The rest of the country (oddly) seems unaffected by this at the moment, but San Jose is getting hammered by something. Still trying to sort out exactly where it is coming from. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA 94588 (925) 201-2530

2 1

RE: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?)
by Ingevaldson, Dan (ISS Atlanta) 19 Aug '03

19 Aug '03

The "Nachi" worm propagates via MSRPC DCOM and the IIS WebDAV bug. It may be causing this storm because it runs 300 scanning threads, and it pings each IP first. http://xforce.iss.net/xforce/alerts/id/150 MS Blast wasn't multithreaded. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Paul Jasa [mailto:pjasa@univision.net] Sent: Tuesday, August 19, 2003 12:19 PM To: nanog(a)merit.edu Subject: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?) A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking ICMP in order to deal with an undefined emergency. Nothing posted on their site, nor any other info is available. If anyone has info related to this "icmp outage", please advise. Thanks! pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Sean Crandall [mailto:sean@megapath.net] Sent: Tuesday, August 19, 2003 02:12 AM To: Paul Jasa; nanog(a)merit.edu Subject: RE: AT&T US Network Slowdown? Importance: High > > Dear Nanogers, > Is anyone aware of a "slowdown" issue throughout the US AT&T > network since 8/18 at around 4pm which is causing a lot of > internet circuits (including DSL) to be inaccessible and/or > appear down from the outside world? AT&T says this has been > escalated to "Level 4" with no ETA and affecting the whole > country. I am seeing this problem in the San Francisco area. > Just wondering if anyone else is experiencing anything that > would confirm AT&T's claim, and fishing for more info about > the possible cause and ETA. Thanks! We are currently seeing the slowdown on our network in San Jose. Started about exactly the time frame that you mentioned. The rest of the country (oddly) seems unaffected by this at the moment, but San Jose is getting hammered by something. Still trying to sort out exactly where it is coming from. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA 94588 (925) 201-2530

1 0

Worldnet People on list?
by Drew Weaver 19 Aug '03

19 Aug '03

Any worldnet people on the list? It looks like they blacklisted one of my email servers and the reason: is truncated and I have no idea why, I've tried sending a bunch of email to them from another domain but I've been summarily ignored. Thanks, -Drew

1 0

RE: Natural Gas Generator manufacturer opinions? (might be off topic?)
by Bender, Andrew 19 Aug '03

19 Aug '03

Capstone and Ingersoll-Rand NG turbines seem to be in favor these days among the paranoid. http://www.capstoneturbine.com/ http://www.irpowerworks.com/ These may be up to 2x the cost of a diesel, but they run forever, you can put them anywhere, they always start, and the fuel never gets fouled. For installations large enough to care about tank pressure, heaters are an option, but then there's the question of how you power the heater... :) Regards, Andrew Bender taqua.com -----Original Message----- From: Jeffrey Wheat [mailto:jeff@cetlink.net] Sent: Tuesday, August 19, 2003 9:47 AM To: Drew Weaver; nanog(a)merit.edu Subject: RE: Natural Gas Generator manufacturer opinions? (might be off topic?) I'd be interested in this information as well. Thanks, Jeff -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Monday, August 18, 2003 10:21 AM To: 'nanog(a)merit.edu' Subject: Natural Gas Generator manufacturer opinions? (might be off topic?) Hi, we're looking to purchase our 3rd natural gas generator and need some opinions about the different manufacturers, off-list is fine if you like. Thanks, -Drew --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.507 / Virus Database: 304 - Release Date: 8/4/2003 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.507 / Virus Database: 304 - Release Date: 8/4/2003

1 0

RE: Natural Gas Generator manufacturer opinions? (might be off topic?)
by Jeffrey Wheat 19 Aug '03

19 Aug '03

I'd be interested in this information as well. Thanks, Jeff -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Monday, August 18, 2003 10:21 AM To: 'nanog(a)merit.edu' Subject: Natural Gas Generator manufacturer opinions? (might be off topic?) Hi, we're looking to purchase our 3rd natural gas generator and need some opinions about the different manufacturers, off-list is fine if you like. Thanks, -Drew --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.507 / Virus Database: 304 - Release Date: 8/4/2003 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.507 / Virus Database: 304 - Release Date: 8/4/2003

1 0

BGP route tracking.
by Mark Segal 19 Aug '03

19 Aug '03

Anybody watching the bgp routing table.. I see about 5,000 less routes than usual. Anybody know a good pointer.. (im just getting bored waiting for us to run out of fuel) Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband

6 8

RE: Did Sean Gorman's maps show the cascading vulnerability in Oh io?
by St. Clair, James 19 Aug '03

19 Aug '03

>Capacity isn't the problem. The problem is that there aren't enough lines >between the providers and consumers to carry the current volume. >Eric A. Hall Exactly, and everyone on this list should realize this exists in EVERY utility. A quote from CNN.com, Money section: "However, the wireless telecom sector has many problems. Most carriers are faced with large debt loads. And because of intense competition (there are six major carriers nationwide) they are resorting to price wars to attract new subscribers. All that means that it has been difficult for the carriers to upgrade their networks to handle more calls and will probably remain so for the foreseeable future. "It will be years before wireless carriers are at a level where they can handle the type of volume that landlines can," said Allan Tumolillo,chief operating officer of Probe Group, a telecom research firm." So, wireless failed to guarantee service because they lacked the economic incentive to do so, which meant people couldn't call during a blackout caused because Power wasn't economically incentivized to do so either.

4 3