- Test - lists.nanog.org

possible exploit.. (Cisco Issue)
by Len Rose 18 Jul '03

18 Jul '03

This was posted a while ago. http://lists.netsys.com/pipermail/full-disclosure/2003-July/011421.html http://lists.netsys.com/pipermail/full-disclosure/2003-July/011420.html I haven't had the chance to test it in a controlled environment yet.

4 5

AOL Mail Blocking
by Gary Attard 18 Jul '03

18 Jul '03

Anyone notice any issues that began today regarding AOL blocking mail servers? Gary Attard Director Network Operations Center Invision.com Inc. http://www.invision.net Phone: (631) 543-1000 x306 Fax: (631) 864-8896 E-Mail: garya(a)invision.net

4 3

SC Signature and HPING Signature
by Jason Frisvold 18 Jul '03

18 Jul '03

For those interested, these are the packet dumps of all 4 protocols using HPing and the release ShadowChode exploit. I'm told you can create the necessary IDS filters from this.. we're working on this now as well... :) I'm not an IDS expert, so I don't have the know-how to do this... yet.. :) -----Forwarded Message----- From: Keith Pachulski Output below is from both the SC code and hping performing the same as SC. Feel free to develop your signatures from it. SC Exploit 11:59:59.014190 79.111.123.116 > dhcp9-1.noc.corp.ptd.net: swipe 181 0x0000 4500 00c9 bf25 0000 0235 fe3b 4f6f 7b74 E....%...5.;Oo{t 0x0010 ccba 6301 0001 0203 0405 0607 0809 0a0b ..c............. 0x0020 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b ................ 0x0030 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b .....!"#$%&'()*+ 0x0040 2c2d 2e2f 3031 3233 3435 3637 3839 3a3b ,-./0123456789:; 0x0050 3c3d 3e3f 4041 4243 4445 4647 4849 4a4b <=>?@ABCDEFGHIJK 0x0060 4c4d 4e4f 5051 5253 5455 5657 5859 5a5b LMNOPQRSTUVWXYZ[ 0x0070 5c5d 5e5f 6061 6263 6465 6667 6869 6a6b \]^_`abcdefghijk 0x0080 6c6d 6e6f 7071 7273 7475 7677 7879 7a7b lmnopqrstuvwxyz{ 0x0090 7c7d 7e7f 8081 8283 8485 8687 8889 8a8b |}~............. 0x00a0 8c8d 8e8f 9091 9293 9495 9697 9899 9a9b ................ 0x00b0 9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab ................ 0x00c0 acad aeaf b0b1 b2b3 b4 ......... 11:59:59.014402 dhcp9-1.noc.corp.ptd.net > 79.111.123.116: icmp: dhcp9-1.noc.corp.ptd.net protocol 53 unreachable [tos 0xc0] 0x0000 45c0 00e5 80f8 0000 4001 fdc0 ccba 6301 E.......@.....c. 0x0010 4f6f 7b74 0302 df39 0000 0000 4500 00c9 Oo{t...9....E... 0x0020 bf25 0000 0235 fe3b 4f6f 7b74 ccba 6301 .%...5.;Oo{t..c. 0x0030 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0040 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:;<=>? 0x0070 4041 4243 4445 4647 4849 4a4b 4c4d 4e4f @ABCDEFGHIJKLMNO 0x0080 5051 5253 5455 5657 5859 5a5b 5c5d 5e5f PQRSTUVWXYZ[\]^_ 0x0090 6061 6263 6465 6667 6869 6a6b 6c6d 6e6f `abcdefghijklmno 0x00a0 7071 7273 7475 7677 7879 7a7b 7c7d 7e7f pqrstuvwxyz{|}~. 0x00b0 8081 8283 8485 8687 8889 8a8b 8c8d 8e8f ................ 0x00c0 9091 9293 9495 9697 9899 9a9b 9c9d 9e9f ................ 0x00d0 a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf ................ 0x00e0 b0b1 b2b3 b4 ..... 11:59:59.014380 36.71.143.53 > dhcp9-1.noc.corp.ptd.net: mobile: [] (bad checksum 515) 0x0000 4500 00c9 fefc 0000 0237 d5c9 2447 8f35 E........7..$G.5 0x0010 ccba 6301 0001 0203 0405 0607 0809 0a0b ..c............. 0x0020 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b ................ 0x0030 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b .....!"#$%&'()*+ 0x0040 2c2d 2e2f 3031 3233 3435 3637 3839 3a3b ,-./0123456789:; 0x0050 3c3d 3e3f 4041 4243 4445 4647 4849 4a4b <=>?@ABCDEFGHIJK 0x0060 4c4d 4e4f 5051 5253 5455 5657 5859 5a5b LMNOPQRSTUVWXYZ[ 0x0070 5c5d 5e5f 6061 6263 6465 6667 6869 6a6b \]^_`abcdefghijk 0x0080 6c6d 6e6f 7071 7273 7475 7677 7879 7a7b lmnopqrstuvwxyz{ 0x0090 7c7d 7e7f 8081 8283 8485 8687 8889 8a8b |}~............. 0x00a0 8c8d 8e8f 9091 9293 9495 9697 9899 9a9b ................ 0x00b0 9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab ................ 0x00c0 acad aeaf b0b1 b2b3 b4 ......... 11:59:59.014603 dhcp9-1.noc.corp.ptd.net > 36.71.143.53: icmp: dhcp9-1.noc.corp.ptd.net protocol 55 unreachable [tos 0xc0] 0x0000 45c0 00e5 5815 0000 4001 3e0b ccba 6301 E...X...@.>...c. 0x0010 2447 8f35 0302 df39 0000 0000 4500 00c9 $G.5...9....E... 0x0020 fefc 0000 0237 d5c9 2447 8f35 ccba 6301 .....7..$G.5..c. 0x0030 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0040 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:;<=>? 0x0070 4041 4243 4445 4647 4849 4a4b 4c4d 4e4f @ABCDEFGHIJKLMNO 0x0080 5051 5253 5455 5657 5859 5a5b 5c5d 5e5f PQRSTUVWXYZ[\]^_ 0x0090 6061 6263 6465 6667 6869 6a6b 6c6d 6e6f `abcdefghijklmno 0x00a0 7071 7273 7475 7677 7879 7a7b 7c7d 7e7f pqrstuvwxyz{|}~. 0x00b0 8081 8283 8485 8687 8889 8a8b 8c8d 8e8f ................ 0x00c0 9091 9293 9495 9697 9899 9a9b 9c9d 9e9f ................ 0x00d0 a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf ................ 0x00e0 b0b1 b2b3 b4 ..... 11:59:59.014572 57.21.62.14 > dhcp9-1.noc.corp.ptd.net: nd 181 0x0000 4500 00c9 bcb9 0000 024d 5450 3915 3e0e E........MTP9.>. 0x0010 ccba 6301 0001 0203 0405 0607 0809 0a0b ..c............. 0x0020 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b ................ 0x0030 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b .....!"#$%&'()*+ 0x0040 2c2d 2e2f 3031 3233 3435 3637 3839 3a3b ,-./0123456789:; 0x0050 3c3d 3e3f 4041 4243 4445 4647 4849 4a4b <=>?@ABCDEFGHIJK 0x0060 4c4d 4e4f 5051 5253 5455 5657 5859 5a5b LMNOPQRSTUVWXYZ[ 0x0070 5c5d 5e5f 6061 6263 6465 6667 6869 6a6b \]^_`abcdefghijk 0x0080 6c6d 6e6f 7071 7273 7475 7677 7879 7a7b lmnopqrstuvwxyz{ 0x0090 7c7d 7e7f 8081 8283 8485 8687 8889 8a8b |}~............. 0x00a0 8c8d 8e8f 9091 9293 9495 9697 9899 9a9b ................ 0x00b0 9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab ................ 0x00c0 acad aeaf b0b1 b2b3 b4 ......... 11:59:59.014837 dhcp9-1.noc.corp.ptd.net > 57.21.62.14: icmp: dhcp9-1.noc.corp.ptd.net protocol 77 unreachable [tos 0xc0] 0x0000 45c0 00e5 8357 0000 4001 4f22 ccba 6301 E....W..@.O"..c. 0x0010 3915 3e0e 0302 df39 0000 0000 4500 00c9 9.>....9....E... 0x0020 bcb9 0000 024d 5450 3915 3e0e ccba 6301 .....MTP9.>...c. 0x0030 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0040 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:;<=>? 0x0070 4041 4243 4445 4647 4849 4a4b 4c4d 4e4f @ABCDEFGHIJKLMNO 0x0080 5051 5253 5455 5657 5859 5a5b 5c5d 5e5f PQRSTUVWXYZ[\]^_ 0x0090 6061 6263 6465 6667 6869 6a6b 6c6d 6e6f `abcdefghijklmno 0x00a0 7071 7273 7475 7677 7879 7a7b 7c7d 7e7f pqrstuvwxyz{|}~. 0x00b0 8081 8283 8485 8687 8889 8a8b 8c8d 8e8f ................ 0x00c0 9091 9293 9495 9697 9899 9a9b 9c9d 9e9f ................ 0x00d0 a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf ................ 0x00e0 b0b1 b2b3 b4 ..... 11:59:59.015060 43.53.57.126 > dhcp9-1.noc.corp.ptd.net: pim v0 0x0000 4500 00c9 2404 0000 0267 ff5b 2b35 397e E...$....g.[+59~ 0x0010 ccba 6301 0001 0203 0405 0607 0809 0a0b ..c............. 0x0020 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b ................ 0x0030 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b .....!"#$%&'()*+ 0x0040 2c2d 2e2f 3031 3233 3435 3637 3839 3a3b ,-./0123456789:; 0x0050 3c3d 3e3f 4041 4243 4445 4647 4849 4a4b <=>?@ABCDEFGHIJK 0x0060 4c4d 4e4f 5051 5253 5455 5657 5859 5a5b LMNOPQRSTUVWXYZ[ 0x0070 5c5d 5e5f 6061 6263 6465 6667 6869 6a6b \]^_`abcdefghijk 0x0080 6c6d 6e6f 7071 7273 7475 7677 7879 7a7b lmnopqrstuvwxyz{ 0x0090 7c7d 7e7f 8081 8283 8485 8687 8889 8a8b |}~............. 0x00a0 8c8d 8e8f 9091 9293 9495 9697 9899 9a9b ................ 0x00b0 9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab ................ 0x00c0 acad aeaf b0b1 b2b3 b4 ......... 11:59:59.015239 dhcp9-1.noc.corp.ptd.net > 43.53.57.126: icmp: dhcp9-1.noc.corp.ptd.net protocol 103 unreachable [tos 0xc0] 0x0000 45c0 00e5 65bf 0000 4001 7f2a ccba 6301 E...e...@..*..c. 0x0010 2b35 397e 0302 df39 0000 0000 4500 00c9 +59~...9....E... 0x0020 2404 0000 0267 ff5b 2b35 397e ccba 6301 $....g.[+59~..c. 0x0030 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0040 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:;<=>? 0x0070 4041 4243 4445 4647 4849 4a4b 4c4d 4e4f @ABCDEFGHIJKLMNO 0x0080 5051 5253 5455 5657 5859 5a5b 5c5d 5e5f PQRSTUVWXYZ[\]^_ 0x0090 6061 6263 6465 6667 6869 6a6b 6c6d 6e6f `abcdefghijklmno 0x00a0 7071 7273 7475 7677 7879 7a7b 7c7d 7e7f pqrstuvwxyz{|}~. 0x00b0 8081 8283 8485 8687 8889 8a8b 8c8d 8e8f ................ 0x00c0 9091 9293 9495 9697 9899 9a9b 9c9d 9e9f ................ 0x00d0 a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf ................ 0x00e0 b0b1 b2b3 b4 ..... HPING 11:56:40.024194 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: swipe 0 0x0000 4500 0014 9f64 0000 0235 b9a6 ccba 6334 E....d...5....c4 0x0010 ccba 6301 0000 0000 0000 0000 0000 0000 ..c............. 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:56:40.024731 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net: icmp: dhcp9-1.noc.corp.ptd.net protocol 53 unreachable [tos 0xc0] 0x0000 45c0 0030 29df 0000 4001 f083 ccba 6301 E..0)...@.....c. 0x0010 ccba 6334 0302 fcfd 0000 0000 4500 0014 ..c4........E... 0x0020 9f64 0000 0235 b9a6 ccba 6334 ccba 6301 .d...5....c4..c. 11:57:26.534797 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: nd 0 0x0000 4500 0014 38fa 0000 024d 1ff9 ccba 6334 E...8....M....c4 0x0010 ccba 6301 0000 0000 0000 0000 0000 0000 ..c............. 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:57:26.534898 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net: icmp: dhcp9-1.noc.corp.ptd.net protocol 77 unreachable [tos 0xc0] 0x0000 45c0 0030 29e1 0000 4001 f081 ccba 6301 E..0)...@.....c. 0x0010 ccba 6334 0302 fcfd 0000 0000 4500 0014 ..c4........E... 0x0020 38fa 0000 024d 1ff9 ccba 6334 ccba 6301 8....M....c4..c. 11:57:39.829722 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: pim v0 0x0000 4500 0014 368f 0000 0267 224a ccba 6334 E...6....g"J..c4 0x0010 ccba 6301 0000 0000 0000 0000 0000 0000 ..c............. 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:57:39.829814 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net: icmp: dhcp9-1.noc.corp.ptd.net protocol 103 unreachable [tos 0xc0] 0x0000 45c0 0030 29e2 0000 4001 f080 ccba 6301 E..0)...@.....c. 0x0010 ccba 6334 0302 fcfd 0000 0000 4500 0014 ..c4........E... 0x0020 368f 0000 0267 224a ccba 6334 ccba 6301 6....g"J..c4..c. 11:57:52.245620 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: [|mobile] 0x0000 4500 0014 96be 0000 0237 c24a ccba 6334 E........7.J..c4 0x0010 ccba 6301 0000 0000 0000 0000 0000 0000 ..c............. 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:57:52.245699 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net: icmp: dhcp9-1.noc.corp.ptd.net protocol 55 unreachable [tos 0xc0] 0x0000 45c0 0030 29e3 0000 4001 f07f ccba 6301 E..0)...@.....c. 0x0010 ccba 6334 0302 fcfd 0000 0000 4500 0014 ..c4........E... 0x0020 96be 0000 0237 c24a ccba 6334 ccba 6301 .....7.J..c4..c. |Keith A. Pachulski, PPS, GCIH, GCFW | NSA IATF Member| FBI InfraGard Secure Member| |PenTeleData/Prolog Internet Services | Information Security & Privacy| |6B56 C8DC 6201 6D1A BFF5 5799 E193 ABAA 9549 74D0| |"In God We Trust - - - All Others We Monitor"| |--- United States Navy Intelligence| -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]

1 0

Cisco exploit and Huawei
by Rubens Kuhl Jr. 18 Jul '03

18 Jul '03

It would be interesting to know if Huawei routers also falls to the Cisco IOS exploit... Rubens

1 0

Protecting inbound interfaces (re: Cisco exploit)
by Rick Ernst 18 Jul '03

18 Jul '03

Is there a way to globally protect all inbound interfaces on a router via ACL (specifically hundreds of frame/sub-interfaces) without applying the same ACL to each individual interface? Is the "line vty" config only for telnet/ssh, etc. or is it the magic global that I'm looking for? I'd post this on inet-access but this is where the conversation is taking place. Thanks, Rick

6 5

The Cidr Report
by cidr-report＠potaroo.net 18 Jul '03

18 Jul '03

This report has been generated at Fri Jul 18 21:46:44 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 11-07-03 123604 88075 12-07-03 123592 88071 13-07-03 123714 88100 14-07-03 123808 88156 15-07-03 123888 88120 16-07-03 123922 88227 17-07-03 123979 88183 18-07-03 124001 88100 AS Summary 15468 Number of ASes in routing system 6128 Number of ASes announcing only one prefix 1495 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73223680 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 18Jul03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 123940 88132 35808 28.9% All ASes AS7132 843 233 610 72.4% SBIS-AS SBC Internet Services - Southwest AS701 1495 1052 443 29.6% ALTERNET-AS UUNET Technologies, Inc. AS4323 608 178 430 70.7% TW-COMM Time Warner Communications, Inc. AS11305 558 145 413 74.0% INTERLAND-NET1 Interland Incorporated AS7018 1345 935 410 30.5% ATT-INTERNET4 AT&T WorldNet Services AS702 1007 614 393 39.0% ALTERNET-AS UUNET Technologies, Inc. AS7843 598 241 357 59.7% ADELPHIA-AS Adelphia Corp. AS3908 873 518 355 40.7% SUPERNETASBLK SuperNet, Inc. AS1221 1044 740 304 29.1% ASN-TELSTRA Telstra Pty Ltd AS6198 482 185 297 61.6% BATI-MIA BellSouth Network Solutions, Inc AS1239 968 674 294 30.4% SPRINTLINK Sprint AS6197 527 234 293 55.6% BATI-ATL BellSouth Network Solutions, Inc AS4355 399 112 287 71.9% ERMS-EARTHLNK EARTHLINK, INC AS6347 363 95 268 73.8% DIAMOND SAVVIS Communications Corporation AS25844 257 9 248 96.5% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS17676 250 24 226 90.4% GIGAINFRA Softbank BB Corp. AS22773 231 11 220 95.2% CCINET-2 Cox Communications Inc. Atlanta AS27364 301 84 217 72.1% ACS-INTERNET Armstrong Cable Services AS209 518 307 211 40.7% ASN-QWEST Qwest AS705 485 306 179 36.9% ALTERNET-AS UUNET Technologies, Inc. AS17557 352 175 177 50.3% PKTELECOM-AS-AP Pakistan Telecom AS6327 197 24 173 87.8% SHAWFIBER Shaw Fiberlink Limited AS2386 404 232 172 42.6% INS-AS AT&T Data Communications Services AS2048 255 90 165 64.7% LANET-1 State of Louisiana AS690 442 292 150 33.9% MERIT-AS-27 Merit Network Inc. AS14654 153 3 150 98.0% WAYPORT Wayport AS3602 228 79 149 65.4% SPRINT-CA-AS Sprint Canada Inc. AS20115 473 327 146 30.9% CHARTER-NET-HKY-NC Charter Communications AS2686 257 112 145 56.4% AS2686 AT&T Global Network Services - EMEA AS9583 239 99 140 58.6% SATYAMNET-AS Satyam Infoway Ltd., Total 16152 8130 8022 49.7% Top 30 total Possible Bogus Routes 24.119.0.0/16 AS11492 CABLEONE CABLE ONE 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.30.64.0/19 AS14900 USLEC-CORP-1 USLEC Corp. 66.41.192.0/18 AS13367 ATT-BBND-B AT&T Broadband 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.240.0.0/13 AS1 GNTY-1 Genuity 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 165.212.0.0/16 AS7424 USANET USA.Net 166.16.0.0/16 AS7132 SBIS-AS SBC Internet Services - Southwest 171.64.0.0/10 AS1 GNTY-1 Genuity 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 ALTERNET-AS UUNET Technologies, Inc. 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.136.0/21 AS568 SUMNET-AS DISO-UNRRA 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.228.0.0/16 AS4637 REACH Reach Network Border AS 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.98.8.0/21 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.79.32.0/20 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 202.3.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.145.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.146.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.152.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.155.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.156.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.157.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.4.252.0/22 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.6.96.0/24 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.6.97.0/24 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.6.99.0/24 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.10.72.0/21 AS9716 AUSTAR-AS-AP Austar Entertainement 202.44.112.0/20 AS17458 CWNETDG-IO-AP Cable and Wireless 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.130.224.0/20 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.130.240.0/21 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.130.248.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 202.130.252.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 202.136.254.0/23 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.136.254.0/24 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.142.130.0/23 AS17820 DIL-AP DIRECT INTERNET LTD. 202.142.132.0/22 AS17820 DIL-AP DIRECT INTERNET LTD. 202.143.48.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.143.56.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.161.0.0/19 AS10097 FLOWCOM flow communications level 2 541 kent st sydney nsw 2000 202.161.0.0/21 AS4634 -No Whois Entry- 202.161.8.0/21 AS4634 -No Whois Entry- 202.164.192.0/19 AS7599 IPXC-AS-AP IP Exchange 202.165.0.0/19 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.78.125.0/24 AS17653 PCM-HK-AP Pacific Century Matrix 203.86.2.0/23 AS4058 APNIC-4058 Asia Pacific Network Information Centre 203.90.192.0/20 AS9658 ETPI-IDS-AS-AP Eastern Telecoms Phils., Inc. 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 203.135.224.0/19 AS4058 APNIC-4058 Asia Pacific Network Information Centre 203.171.96.0/19 AS703 ALTERNET-AS UUNET Technologies, Inc. 203.171.102.0/24 AS703 ALTERNET-AS UUNET Technologies, Inc. 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.29.189.0/24 AS11755 WAYMARKCOMM Waymark Internet Services, Inc. 204.52.232.0/24 AS7177 DFWNET DFW Internet Services, Inc. 204.89.225.0/24 AS2495 KANREN Kansas Research and Education Network 204.154.240.0/21 AS11572 MEDIACOM Mediacom,llc / RidgeNet 204.194.110.0/23 AS10588 ICSNET Intelligent Computer Solutions, Inc 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.82.64.0/18 AS7029 ALLTELNET Alltel Information Services, Inc. 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.126.0.0/19 AS5750 FLEXNET-HAWAII FlexNet Inc. 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.92.0.0/14 AS2551 ICG ICG NetAhead, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.65.232.0/23 AS701 ALTERNET-AS UUNET Technologies, Inc. 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 208.104.103.0/24 AS1239 SPRINTLINK Sprint 209.104.198.0/24 AS6137 SISNA SISNA, Inc. 209.104.199.0/24 AS6137 SISNA SISNA, Inc. 209.104.218.0/24 AS6137 SISNA SISNA, Inc. 209.104.219.0/24 AS6137 SISNA SISNA, Inc. 209.104.252.0/22 AS12030 PACIFIC-ONLINE-PON Pacific Online Services 209.108.0.0/14 AS2551 ICG ICG NetAhead, Inc. 209.151.128.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 209.160.73.0/24 AS13415 LUMIX Lumix Communications, Inc. 209.160.209.0/24 AS13415 LUMIX Lumix Communications, Inc. 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.160.0/19 AS4355 ERMS-EARTHLNK EARTHLINK, INC 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.4.20.0/22 AS10095 -No Whois Entry- 210.4.60.0/24 AS10095 -No Whois Entry- 210.4.61.0/24 AS10095 -No Whois Entry- 210.213.0.0/19 AS6453 TELEGLOBE-AS Teleglobe Inc 211.27.156.0/24 AS9768 PUBNET1-AS KT 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.47.32.0/19 AS11304 SPLUS Solutions Plus Inc. 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 216.153.0.0/17 AS6203 ISDN-NET ISDN-Net Inc. 216.226.108.0/22 AS3602 SPRINT-CA-AS Sprint Canada Inc. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

RE: Latency issues (CW and Qwest)
by Vandy Hamidi 18 Jul '03

18 Jul '03

That's what the CW tech told me when he called. I suggested a MED change and he said they are a customers of CW and they can't make any changes. Greaaat. TA has re-reouted and times are down to about +20ms (100ms end to end). -=Vandy=- -----Original Message----- From: Leete, Tony [mailto:Tony.Leete@cw.com] Sent: Thursday, July 17, 2003 5:30 PM To: Vandy Hamidi; nanog(a)merit.edu Subject: RE: Latency issues (CW and Qwest) don't expect any re-routes... this problem is here to stay untill TA works out how to manage their traffic. -----Original Message----- From: Vandy Hamidi [mailto:vandy.hamidi@markettools.com] Sent: Thursday, July 17, 2003 5:06 PM To: nanog(a)merit.edu Subject: Latency issues (CW and Qwest) Just an FYI, A peering between CW and Qwest (actually Touch America - tamerica.net) is experiencing some significant latency ~+250ms. They are apparently working to re-route. Unfortunately I don't know the peer point, but our issue is between Minnesota and San Jose. -=Vandy=-

1 0

New information on cisco exploit
by Alex Rubenstein 18 Jul '03

18 Jul '03

http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

3 2

RE: Fixed IOS datestamps?
by Steve Rude 18 Jul '03

18 Jul '03

> You write that calling the TAC didn't help. Did you ask them "Does > 12.2(15)T5 contain the fix for this bug?" and were they unable to answer > that? That sounds... improbable. That is exactly what I did. I asked if it was the correct version of code to use, and the response was ... "There is a URL at www.cisco.com/warp/707... that is what we are telling people to look at to find the fix." I then asked why the date was so old, and the reps response was "I don't know." Sorry if it doesn't fit what you would expect to hear from the TAC. It is not what I was looking to hear either. Best of luck to everyone tonight. Thanks for the responses. --steve

1 0

Latency issues (CW and Qwest)
by Vandy Hamidi 18 Jul '03

18 Jul '03

Just an FYI, A peering between CW and Qwest (actually Touch America - tamerica.net) is experiencing some significant latency ~+250ms. They are apparently working to re-route. Unfortunately I don't know the peer point, but our issue is between Minnesota and San Jose. -=Vandy=-

1 0