- Test - lists.nanog.org

dos of the week? was RE: Level3 routing issues?
by Joshua Smith 25 Jan '03

25 Jan '03

my transit traffic doubled (luckily it is the low time of the night for me) from 10-12ish "Kevin Welch" <kevinw(a)iserv.net> wrote: > > I am seeing similar traffic loads on my network at this hour, one of our > MS SQL servers seemed to be sending a large amount of traffic out to the > Internet. Still looking into it but too similar for me to avoid sending > an e-mail. > > ------------------------------------------------- > Kevin Welch kevinw(a)iserv.net > Network Engineer The Iserv Company > Desk Ph: 616.493.0577 Cell Ph: 616.437.3861 > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Alex Rubenstein > Sent: Saturday, January 25, 2003 1:04 AM > To: hc > Cc: nanog(a)merit.edu > Subject: Re: Level3 routing issues? > > > > I dunno about that. But, I am seeing, in the last couple hours, all > kinds > of new traffic. > > like, customers who never get attacked or anything, all of a sudden: > > > http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.ht > ml > > > We are seeing this on ports all across out network -- nearly 1/2 our > ports > are in delta alarm right now. > > Anyone else? > > I will dig more to look at the traffic. > > > > > On Sat, 25 Jan 2003, hc wrote: > > > > > Anyone seeing routing problems with Level3 at this hour? I just > > witnessed tons of prefixes behind level3's network withdraw. Any > > information on what is happening (if you know) would be great. Thanks! > > > > -hc > > > > > > > > -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- > -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net -- > > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

2 1

Re: BBnow 24.219/16
by Pascal Gloor 25 Jan '03

25 Jan '03

if you look at http://mogwai.frnog.org/wwwbin/looking-glass? query=show+ip+bgp+regexp&extra=_8092%24 you can clearly see that they only have 'some' troubles with 24.219.12.0/22 I dont see any route for 24.219/16, it seems they splitted the /16 into multiple /19 and small subnets P. > ----- Original Message ----- > From: "Jim Hickstein" <jxh(a)jxh.com> > To: <nanog(a)merit.edu> > Sent: Saturday, January 25, 2003 11:17 AM > Subject: BBnow 24.219/16 > > > > > > My cable-modem provider, bbnow.net (AS 8092), is apparently entirely off > > the air. Even their customer-support number (888 674 8282) changed its > > main OGM to say that their upstream was having a problem, and they will > > "not be able to provide Internet service" to their subscribers until > > Monday. They estimate. They're sorry for the inconvenience. > > > > So I'm wondering: What upstream? What problem? This started long before > > the jolly happy MS SQL server thing, so I think it's unrelated. Can > anyone > > shed any light on this for me? How does it take until Monday for a > > not-tiny ISP to fix "the" upstream? Did they not pay their bill? > > >

1 0

How do I get host records deleted?
by Matthew Kaufman 25 Jan '03

25 Jan '03

I have IP address space. An address in that address space is listed as a host record for a fair number of domains that are not mine. Hence, DNS requests come to that address. But I cannot delete the host record, because there are domains using it. Is there a magic contact somewhere at Network Solutions that can fix this? Matthew Kaufman matthew(a)eeph.com

7 7

Re: Level3 routing issues?
by George William Herbert 25 Jan '03

25 Jan '03

Has someone reported the details to CERT yet? Preferably someone who's got logs and such? -george william herbert gherbert(a)retro.com

1 0

Level3 routing issues?
by hc 25 Jan '03

25 Jan '03

Anyone seeing routing problems with Level3 at this hour? I just witnessed tons of prefixes behind level3's network withdraw. Any information on what is happening (if you know) would be great. Thanks! -hc

9 9

1434 traffic
by Christopher J. Wolff 25 Jan '03

25 Jan '03

Gotta love it.. Extended IP access list 172 deny udp any any eq 1434 (21313219 matches) permit ip any any (38402 matches) Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

1 0

this attack is still strong here..
by Alex Rubenstein 25 Jan '03

25 Jan '03

jamesc(a)gbr1.oct> show firewall filter proactive-filter Name Bytes Packets mssql-drops 916252204 2267951 term NO-MSSQL { from { packet-length 404; protocol udp; destination-port 1434; } then { count mssql-drops; discard; } }

1 0

DoS
by Christopher J. Wolff 25 Jan '03

25 Jan '03

Forwarded from Jack Bates. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Saturday, January 25, 2003 1:09 AM To: Christopher J. Wolff Subject: Re: Level3 routing issues? *repost* Forgive me if this shows up twice. Mail is flaked via this smtp. Temporary block in place. My border cpu was starting to hammer up. Outbound stat about 2 minutes later: deny udp any any eq 1434 (445523 matches) permit ip 69.8.0.0 0.0.63.255 any (55749 matches) permit ip 206.27.138.0 0.0.1.255 any permit ip 206.30.96.0 0.0.31.255 any (97851 matches) permit ip 205.162.224.0 0.0.15.255 any (146920 matches) permit ip 205.240.128.0 0.0.15.255 any (49146 matches) permit ip 204.249.192.0 0.0.15.255 any (27351 matches) permit ip 192.133.7.0 0.0.0.255 any (5 matches) permit ip 63.136.128.0 0.0.3.255 any (379 matches) permit ip 216.226.0.0 0.0.31.255 any (27173 matches) permit ip 64.58.32.0 0.0.15.255 any (17368 matches) permit ip 206.230.34.128 0.0.0.127 any permit ip 209.54.40.0 0.0.1.255 any permit ip 206.61.140.0 0.0.0.255 any (52 matches) Inbound stat at same time: deny udp any any eq 1434 (53534 matches) permit ip any any (431556 matches) cpu load drop of about 20%....Definately a bad port. virus suspected due to inbound and outbound. Jack Bates Network Engineer BrightNet Oklahoma

1 0

New MS SQL Exploit DOS Attack started tonight at 12:30AM EST (GMT -0500)
by Robert Boyle 25 Jan '03

25 Jan '03

Everyone, I don't know what is causing this, but we had several customer machines (which we don't manage) affected tonight. The common thread is that all were running an unpatched MS SQL Server. This new worm seems to create MASSIVE network traffic which propagates outbound. Somehow it seems to be amplified at each of our Cisco routers. In our colo facility, we had 3 "infected" servers on 10Base-T connections - after this traffic hit our core router, the traffic increased from just under 30Mbits/sec inbound from our colo switch to 80+Mbits/sec outbound over ALL transit and peering connections. I know our routers aren't smurf amplifiers and I don't know what caused the increased outbound traffic. Once this process is started, the MSSQLServer service cannot be stopped (or killed with pview). If the service is disabled and the server rebooted, it will not generate this traffic. It is not a master-slave program which requires a connection from outside to start the flow. Once the SQL server has been infected, no Internet connection is needed to continue the traffic storm even after a reboot. None of our managed customer machines were affected, but all of them are patched with current patches and none of them have 1433 exposed to the world either. I don't have any more detail at this time, but I plan to look into this worm/virus/exploit further in the AM. This seems to affect both MSSQL and MSDE. Does anyone else have more to add. I have seen several networks drop off the earth tonight as a result of this exploit. -Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Good will, like a good name, is got by many actions, and lost by one." - Francis Jeffrey

1 0

New worm/DOS/Level3 routing issues
by Jack Bates 25 Jan '03

25 Jan '03

repost* Forgive me if this shows up twice. Mail is flaked via this smtp, and the last time I sent this, I accidentally sent it to the individual and not list. heh. Temporary block in place. My border cpu was starting to hammer up. Outbound stat about 2 minutes later: deny udp any any eq 1434 (445523 matches) permit ip 69.8.0.0 0.0.63.255 any (55749 matches) permit ip 206.27.138.0 0.0.1.255 any permit ip 206.30.96.0 0.0.31.255 any (97851 matches) permit ip 205.162.224.0 0.0.15.255 any (146920 matches) permit ip 205.240.128.0 0.0.15.255 any (49146 matches) permit ip 204.249.192.0 0.0.15.255 any (27351 matches) permit ip 192.133.7.0 0.0.0.255 any (5 matches) permit ip 63.136.128.0 0.0.3.255 any (379 matches) permit ip 216.226.0.0 0.0.31.255 any (27173 matches) permit ip 64.58.32.0 0.0.15.255 any (17368 matches) permit ip 206.230.34.128 0.0.0.127 any permit ip 209.54.40.0 0.0.1.255 any permit ip 206.61.140.0 0.0.0.255 any (52 matches) Inbound stat at same time: deny udp any any eq 1434 (53534 matches) permit ip any any (431556 matches) cpu load drop of about 20%....Definately a bad port. virus suspected due to inbound and outbound. Jack Bates Network Engineer BrightNet Oklahoma

1 0