- Test - lists.nanog.org

Re: BGP to doom us all
by Rob Thomas 01 Mar '03

01 Mar '03

Hi, Dean. ] Assuming the router is compromised, so is the MD5 key. And presumably, ] the acls and anything else can be changed as well. Agreed. My point was to take a few steps to avoid the compromise. :) It isn't difficult to make things just a *bit* more difficult, and thus avoid the pain caused by the average scan and sploit crowd. Pick good passwords, limit access, keep routing tables clean, etc. Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: anti-spam vs network abuse
by Roger Marquis 28 Feb '03

28 Feb '03

> As a result the ISP must either A) purchase more RAM, faster CPUs, > and additional servers, or B) run the risk of complaints and lost > customer goodwill. All of this costs time and money. Looks like both a netscan and a portscan, and clearly not designed to limit damages to innocent third parties. Come on njabl.org, this isn't rocket science. Turn down that scan rate by a factor of at least 50, please. -- Roger Marquis Roble Systems Consulting http://www.roble.com/ 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55571 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55572 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55573 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55575 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55574 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55576 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55577 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55578 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55579 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55580 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55581 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55583 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55584 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:55585 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:55586 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:55587 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:55588 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:55589 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:55590 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55591 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55592 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55594 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55593 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55595 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55596 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55597 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55599 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:55601 15:16:21 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55600 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55571 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55572 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55573 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55574 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55575 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55576 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55579 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55581 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55577 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55578 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55580 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55584 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:55585 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55583 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:55586 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:55587 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:55590 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:55588 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:55589 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55591 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55593 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55592 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55594 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55595 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55597 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55596 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55599 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55600 15:16:24 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:55601 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55571 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55573 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55572 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55575 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55574 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55576 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55577 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55579 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55578 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55580 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55581 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55583 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55584 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:55587 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:55585 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:55586 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:55589 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55591 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:55588 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55593 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55592 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:55590 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55595 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55596 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55594 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55597 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55600 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:55601 15:16:30 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55599 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55571 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55572 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:55573 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:55574 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55575 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55576 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55577 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55578 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55579 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55580 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55581 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55583 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55584 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:55585 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:55586 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:55587 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:55588 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:55589 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:55590 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:55591 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:55594 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:55592 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:55593 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:55595 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:55596 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:55597 15:16:42 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:55599 15:16:43 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:55600 15:16:43 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:55601 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57092 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57091 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57093 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57096 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57095 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57094 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57097 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57098 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57099 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57100 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57101 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57103 15:17:10 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57104 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:57105 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:57106 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:57107 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:57108 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:57109 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:57110 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57111 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57112 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57113 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57114 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57115 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57116 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57117 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57119 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57120 15:17:11 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:57121 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57091 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57092 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57093 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57094 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57096 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57095 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57097 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57099 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57100 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57101 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57098 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57103 15:17:13 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57104 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:57105 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:57106 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:57107 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:57108 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:57109 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57111 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:57110 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57112 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57113 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57114 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57115 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57116 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57117 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57120 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57119 15:17:14 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:57121 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57091 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57092 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57094 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57093 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57095 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57096 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57097 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57098 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57099 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57100 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57101 15:17:19 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57103 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:57105 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57104 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:57106 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:57107 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:57108 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:57109 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:57110 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57111 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57113 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57112 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57114 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57115 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57117 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57116 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57120 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57119 15:17:20 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:57121 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57091 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57092 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1080 from 209.208.0.15:57093 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57095 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1180 from 209.208.0.15:57094 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57096 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57097 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57098 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57099 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57100 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57101 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57103 15:17:31 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57104 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:7033 from 209.208.0.15:57105 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8085 from 209.208.0.15:57106 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8095 from 209.208.0.15:57107 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8100 from 209.208.0.15:57108 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8110 from 209.208.0.15:57110 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8105 from 209.208.0.15:57109 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:80 from 209.208.0.15:57111 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:81 from 209.208.0.15:57112 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:4480 from 209.208.0.15:57115 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:1182 from 209.208.0.15:57113 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:3128 from 209.208.0.15:57114 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:6588 from 209.208.0.15:57116 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8000 from 209.208.0.15:57117 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8081 from 209.208.0.15:57119 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:8090 from 209.208.0.15:57120 15:17:32 PST Connection attempt to TCP IP.IP.IP.IP:1181 from 209.208.0.15:57121 15:17:40 PST Connection attempt to TCP IP.IP.IP.IP:25 from 209.208.0.15:57753 15:16:51 PST postfix/smtpd[94021]: connect from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:51 PST postfix/smtpd[94021]: lost connection after CONNECT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:51 PST postfix/smtpd[94021]: disconnect from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:51 PST postfix/smtpd[94026]: connect from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:51 PST postfix/smtpd[94026]: E3914DAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:52 PST postfix/smtpd[94026]: E3914DAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<relaytestsend(a)rt.njabl.org> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:53 PST postfix/smtpd[94026]: 71C6ADAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:53 PST postfix/smtpd[94026]: 71C6ADAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<relaytestsend(a)victim.com> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:54 PST postfix/smtpd[94026]: B4DD5DAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:54 PST postfix/smtpd[94026]: B4DD5DAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<relaytestsend@rt.njabl.org@victim.com> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:56 PST postfix/smtpd[94026]: 0492BDAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:56 PST postfix/smtpd[94026]: 0492BDAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 504 <relaytestsend>: Sender address rejected: need fully-qualified address; from=<relaytestsend> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:57 PST postfix/smtpd[94026]: 47B66DAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:57 PST postfix/smtpd[94026]: 47B66DAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 450 <relaytestsend@localhost>: Sender address rejected: Domain not found; from=<relaytestsend@localhost> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:58 PST postfix/smtpd[94026]: 8B9C9DAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:58 PST postfix/smtpd[94026]: 8B9C9DAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:16:59 PST postfix/smtpd[94026]: CDA4EDAD3D: client=before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:16:59 PST postfix/smtpd[94026]: CDA4EDAD3D: reject: RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15]: 554 <relaytest(a)rr.njabl.org>: Relay access denied; from=<relaytestsend(a)[IP.IP.IP.IP]> to=<relaytest(a)rr.njabl.org> proto=ESMTP helo=<rt.njabl.org> 15:17:09 PST postfix/smtpd[94026]: too many errors after RCPT from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] 15:17:09 PST postfix/smtpd[94026]: disconnect from before-reporting-as-abuse-please-see-www.njabl.org[209.208.0.15] ...

1 0

Re: anti-spam vs network abuse
by Richard Irving 28 Feb '03

28 Feb '03

Joe St Sauver wrote: > There is NO legal advice in this post. Really! > In Oregon, see ORS 164.377(4): > > "Any person who knowingly and without authorization uses, accesses or > attempts to access any computer, computer system, computer network, or any > computer software, program, documentation or data contained in such computer, > computer system or computer network, commits computer crime." Define "without authorization", and also "knowingly". Was the port open to the public internet ? If so, it sounds pretty "authorized" to me, therefore undermining "knowingly", afaict. Or, otherwise, with a few exceptions, almost every web site I have ever surfed has been "without authorization". Like I said, "intention" has to come into the picture.... in this case, it is in the form of "knowingly". Do you open your "unauthorized" ports to the public internet ? "Unauthorized" on wide open internet usually infers that there is an access scheme in place to -prevent- "unauthorized access", and activity that attempts to undermine that security scheme -then- becomes illegal, AFAIK. The absence of such an access scheme, on open internet, would infer an "implied authorization"... as in the case of the millions of WWW pages we all access daily. After all, protocol ports do not publish themselves..... Now, to add a twist, did I probe you from "authorized" space, and gain "illegal access", undermining your (inadequate) security scheme ? Well, then I must have been "authorized", or you wouldn't have allowed me in from this "auhtorized" space, eh ? Oh, I was in "authorized space", but "I" wasn't authorized, and I didn't know ? Oh, well there goes the "knowing" thing again. .JMHO. .Richard. ============== While some of this information could be considered legally valid coming from a "technical expert", it isn't to be construed as "legal advice". Get a lawyer for actual legal advice. > > http://www.leg.state.or.us/ors/164.html > > Regards, > > Joe

1 0

Sabotage cuts power to 18 million people
by Sean Donelan 28 Feb '03

28 Feb '03

ILIGAN, Mindanao - Muslim separatist rebels blacked out the southern third of the Philippines in overnight sabotage attacks, leaving about 18 million people in the dark for hours, officials said Thursday. Electricity supply was restored to most of Mindanao island by Thursday as the government fired up emergency generating stations to temporarily replace baseload plants disabled by the toppling of transmission pylons overnight Wednesday, they said. Moro Islamic Liberation Front (MILF) guerrillas blew up at least five steel transmission towers before midnight using improvised explosives from mortar shells on Wednesday, knocking out from the grid the key Agus hydro-electric power complex outside this city. [...] Repairs to restore the transmission lines to Agus were expected to take a week. http://www.malaysiakini.com/foreignnews/200302280111046662857.php

5 4

apologia to jlewis
by Paul Vixie 28 Feb '03

28 Feb '03

i realize now that i may have misread my IDS reports from the scanning i received from jon's blackhole list a few months ago, and that i have no basis for my claim that he scanned "every address i own." --paul

1 0

Re: anti-spam vs network abuse
by Roger Marquis 28 Feb '03

28 Feb '03

Richard Irving wrote >Jack Bates wrote:(SNIPO) >> > Should we outlaw a potentially beneficial practice due to its abuse by >> > criminals? >> > >> Okay. What happens if you make a mistake and overload one of my devices >> costing my company money. > > That is usually a civil issue, not criminal. Legal considerations aside it is not good practice to scan a subnet/server hosting dozens of websites. Typical symptoms are slow connections to all the sites, increased memory utilization, and error logs like the following: [Wed Feb 26 02:14:57 2003] [info] server seems busy, (you may need to increase StartServers, or Min/MaxSpareServers), spawning 26 children, there are 60 idle, and 88 total children As a result the ISP must either A) purchase more RAM, faster CPUs, and additional servers, or B) run the risk of complaints and lost customer goodwill. All of this costs time and money. The best mitigation is to set a _slow_ scan rate but even that can still get you blacklisted by a well designed NIDS. Given the potential cost to third parties it's difficult to see any case for netscanning, regardless of the scanner's rational. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0

Re: ebgp-multihop
by Stewart, William C (Bill), SALES 28 Feb '03

28 Feb '03

I'm assuming that the reason Tim's asking about setting TTLs to numbers like 255 is because he wants to use the BGP TTL Security Hack to protect against BGP DDOS attacks. The hack works by setting TTL to a very high value, and ACL-discarding any BGP packets that don't have TTLs >= ~254, because it's very hard to fake TTLs, especially from far away. http://www.ietf.org/internet-drafts/draft-gill-btsh-01.txt http://www.nanog.org/mtg-0302/hack.html - Dave Meyer's Abstract http://www.nanog.org/mtg-0302/ppt/meyer.pdf - Dave Meyer's Talk. (Hmmm.. Dave's abstract says he's at Sprint and U of Oregon Tim is at Oregon Health Sciences University.) The internet-draft and Dave's talk both say that for multi-hop you need to set the ACL thresholds a hop or two lower (obviously), which expands the set of people who might be able to inject hostile packets, but it's still pretty tightly contained. Bill Stewart bill.stewart(a)pobox.com

1 0

RE: BGP to doom us all
by Jim Deleskie 28 Feb '03

28 Feb '03

Bruce, I agree, while we all need to 'do the right thing' and only announce what we are suppose to, we also need to maintain the right level being paranoid to protect the networks we are responsible for. -Jim -----Original Message----- From: Bruce Pinsky [mailto:bep@whack.org] Sent: Friday, February 28, 2003 5:17 PM To: Jim Deleskie Cc: 'nanog(a)merit.edu' Subject: Re: BGP to doom us all Jim Deleskie wrote: > > http://news.com.com/2100-1009-990608.html?tag=fd_lede1_hed > > Seems the BGP will be the down fall of the internet, the sky is falling the > sky is falling What a crock of crap. Knowing who someone is doesn't stop them from causing intentional or unintentional problems. In fact, authentication is more likely to cause people to become complacent wrt their filtering policies. Hey I've authenticated that router so it's going to only send me correct routes. Puleeeaaazzzz... ========== bep

2 1

Re: Cidera shuts down
by David Colon 28 Feb '03

28 Feb '03

I know that some others have made offers and Newsread.com is doing the same. We can provide news feeds to networks that we peer with and those that we do not have direct connectivity to. Contact me offlist for details. David Colon News Admin Newsread.com > Just received this from Cidera: > > "We regret to inform you that Cidera has discontinued its netnews and caching services effective immediately. > > We wished to provide you with more advanced notification of this termination of service, but unfortunately we were not able to do so. > > The current economic situation has been difficult for us and for our customers, and we wish all of you the best of luck and good fortune with your businesses. Everyone at Cidera feels it has been a privilege to serve you." > > > > > I am now in need of obtaining a new source for news that is satellite based. Can anyone offer any suggestions > and or recommendations? All information is appreciated! > > Regards, > Jeff > > --- > Outgoing mail is certified Virus Free. > Checked by AVG anti-virus system (http://www.grisoft.com) > Version: 6.0.459 / Virus Database: 258 - Release Date: 2/25/2003

1 0

ebgp-multihop
by Tim Rand 28 Feb '03

28 Feb '03

Hi - I have searched the archives but have not found an answer to my question - is there any danger in using excessively high TTL values with ebgp-multihop? For example, neighbor x.x.x.x ebgp-multihop 255 - 255 is generally much higher than needed, but is there any risk/danger ?? Thanks in advance. - Tim Tim Rand Network Engineer OHSU Information Technology Group ph: 503.418.1045 fx: 503.494.7143

7 6