- Test - lists.nanog.org

RE: Identifying DoS-attacked IP addresses)
by Pena, Antonio 16 Dec '02

16 Dec '02

Hello Andre The best way we use to identify DOS attacks is measuring and monitoring the backbone circuits the packets/second in and out, normally most of the DOS attacks generated a lot of packets/second, in our case we created an alarm that sends an email and page each time any of our backbone circuits exceed 17000 Packets/second, second alarm when packets exceed 20k using Intermapper 3.6 and SNMP. After this is you are using the Cisco 12000 is no problem to try of detect the type of traffic using Extended Access-list and sending to the loggin for 15-20 seconds and then look for ICMP, UDP and TCP, in our case we found 7 of ten DOS attacks target IP's and only 10% are coming from known sources, most of the attacks used smurfed sources. Regards; Antonio J. Pena Senior Manager, Network Engineering ( /_ _ _ __/_ _ |_/(-/ (-_) /(// Verestar, inc. 3040 Williams, Dr Suite 100 Fairfax, VA, 22031 Phone (703)206-9000 Direct (571)226-5772 Fax (703) 573-3522 antonio_pena(a)verestar.com http://www.verestar.com -----Original Message----- From: Andre Chapuis [mailto:chapuis@ip-plus.net] Sent: Monday, December 16, 2002 9:12 AM To: nanog(a)nanog.org Subject: Identifying DoS-attacked IP address(es) Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

1 0

'Digital Pearl Harbor' May Be No Real Threat
by Sean Donelan 16 Dec '02

16 Dec '02

Wall Street Journal Boomtown by Lee Gomes (subscription required) http://online.wsj.com/article/0,,SB1039990777685324633,00.html "As a result, homeland-security conferences, newsletters, sales offices and the like have become a standard part of the technology-business landscape. In the prototypical presentation, a salesperson describes some crucial part of the high-tech infrastructure -- for example, the router that moves messages around in a computer network -- and then asks, "Imagine what would happen if terrorists got their hands on THAT!" The better question, though, is, "How likely is it that terrorists would actually get their hands on that?"

2 1

Junipers / Concord
by Andrew McConnell 15 Dec '02

15 Dec '02

Can any Concord admins clue me in on how to configure Network Health so that it displays ifDescr as part of nmsName? Our current configuration requires manual effort to create an alias for each interface element even though Concord knows about ifDescr. That's obviously an annoyance for reporting purposes. When I discover Juniper devices, in particular, Concord refuses to populate nmsName in poller.cfg with any useful information...I see that it's using mib2-rfc1573-v2c*.mtf for MIB translations on Juniper devices but I'm not certain what needs to happen there (if anything) to make the poller populate nmsName properly. Concord's support tells me we need to purchase an additional level of support to fix this, but I imagine other people have found the same issue. Please respond off-list as I realize this is not exactly on topic. Thanks. -- Andrew McConnell <drew(a)pigish.com>

1 0

Bogon announcement list
by Rob Thomas 13 Dec '02

13 Dec '02

Hi, NANOGers. At the behest of several requestors, we have created a new, one-way list solely for the announcement of new IP prefix allocations to the sundry RIRs. The posts will include the allocated prefix, allocation date, the RIR(s) involved, and pointers to the documents we (Steve Gill, Barry Greene, and Rob Thomas) update when such allocations are made. These announcements will be made as we detect such allocations. The list is moderated by Steve Gill, Barry Greene, Jared Mauch, and Rob Thomas. It is open to anyone who wishes to subscribe. Aliases are welcome to subscribe. To subscribe to the list, please visit the following URL: http://puck.nether.net/mailman/listinfo/bogon-announce A mini-FAQ: 1. Why form yet another list? I already receive enough e-mail. We share your pain. :) Such a list will help some folks to automagically process, filter, or file such announcements. 2. How do you know about new allocations from IANA to the RIRs? We have a cronjob that diffs the list on a daily basis. 3. How soon after the allocation is made will you announce it? In some cases our release will be coordinated with the RIR. In other cases it will be made as soon as we detect it. In all cases it will be made as quickly as possible. Please note that all of the monitoring and templates will be updated as soon as the allocation is detected. 4. What sort of message volume can I expect on the list? Messages will only be posted to the list when new allocations are made. 5. Does this mean you won't send these updates to several other lists? No. We will continue to send e-mail to a variety of lists when allocations are made. 6. Sheesh, where do you find the time for such things? Have you no social life? Nope, none at all. :) Thanks! Steve, Barry, Jared, Rob, your bogon-announce list administrators.

1 0

Has anyone out there had problems with Sunrise Leasing?
by Alex Rubenstein 13 Dec '02

13 Dec '02

Let me first start with the comment that I apologize for this off topic post. However that being said, this is very relevant for any ISPs or other companies that do business in the used equipment market. We are gathering information on Sunrise Leasing relating to any alleged problems or possible mistreatment that you may have had. We are interested in any legal, billing, alleged unfair business practices, or other related problems. I am not a lawyer, nor do represent one. I represent Net Access Corporation (aka nac.net) and as a long time participant in the ISP community we are very interested in anything that helps to protect the interests of the independent ISPs. Sunrise Leasing is also known as (all based out of Minnesota): Sunrise International Leasing International Leasing Sunrise Leasing Corporation Cisco Systems Capital Corporation Internet Finance & Equipment (IF&E) Capital Corporation Redirect Tech We are considering a class action lawsuit against Sunrise and any information that is relevant may help. Even if your dealings with them were many years ago or if your company has since gone out of business we are still interested in hearing from you about your interactions with Sunrise Leasing. In addition, if you know of any current or ex employees that have information we would be very happy to speak with them as well. We are interested in both good and bad experiences, we need your help. Please direct all replies to me (off list), as I do not want to clutter the list with extraneous traffic. All replies will be kept confidential. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

1 0

The Cidr Report
by cidr-report＠potaroo.net 13 Dec '02

13 Dec '02

This report has been generated at Fri Dec 13 21:45:30 2002 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 06-12-02 116870 84511 07-12-02 116855 84559 08-12-02 116930 84442 09-12-02 116755 84596 10-12-02 116879 84724 11-12-02 117039 84740 12-12-02 117133 84733 13-12-02 116860 84827 AS Summary 14178 Number of ASes in routing system 5599 Number of ASes announcing only one prefix 1805 Largest number of prefixes announced by an AS AS3908 : SUPERNETASBLK SuperNet, Inc. 72982528 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 13Dec02 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 116935 84790 32145 27.5% All ASes AS3908 1805 1063 742 41.1% SUPERNETASBLK SuperNet, Inc. AS701 1676 1219 457 27.3% ALTERNET-AS UUNET Technologies, Inc. AS18566 419 5 414 98.8% COVAD Covad Communications AS7018 1389 1014 375 27.0% ATT-INTERNET4 AT&T WorldNet Services AS4323 524 185 339 64.7% TW-COMM Time Warner Communications, Inc. AS1221 1162 843 319 27.5% ASN-TELSTRA Telstra Pty Ltd AS6197 456 141 315 69.1% BATI-ATL BellSouth Network Solutions, Inc AS7843 596 295 301 50.5% ADELPHIA-AS Adelphia Corp. AS4355 405 136 269 66.4% ERMS-EARTHLNK EARTHLINK, INC AS6347 352 85 267 75.9% DIAMOND SAVVIS Communications Corporation AS7046 586 319 267 45.6% UUNET-CUSTOMER UUNET Technologies, Inc. AS22927 289 22 267 92.4% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS1239 935 670 265 28.3% SPRINTLINK Sprint AS705 434 195 239 55.1% ASN-ALTERNET UUNET Technologies, Inc. AS4814 249 15 234 94.0% CHINANET-BEIJING-AP China Telecom (Group) AS1 665 440 225 33.8% GNTY-1 Genuity AS6198 420 201 219 52.1% BATI-MIA BellSouth Network Solutions, Inc AS17676 232 28 204 87.9% GIGAINFRA XTAGE CORPORATION AS690 513 319 194 37.8% MERIT-AS-27 Merit Network Inc. AS6140 314 121 193 61.5% IMPSAT-USA ImpSat AS4151 326 135 191 58.6% USDA-1 USDA AS4134 292 108 184 63.0% ERX-CHINALINK Data Communications Bureau AS209 519 339 180 34.7% ASN-QWEST Qwest AS852 625 445 180 28.8% ASN852 Telus Advanced Communications AS2048 260 88 172 66.2% LANET-1 State of Louisiana AS6327 183 34 149 81.4% SHAWFIBER Shaw Fiberlink Limited AS2386 377 232 145 38.5% INS-AS AT&T Data Communications Services AS17557 314 173 141 44.9% PKTELECOM-AS-AP Pakistan Telecom AS3215 308 170 138 44.8% AS3215 France Telecom Transpac AS702 807 670 137 17.0% AS702 UUNET - Commercial IP service provider in Europe Total 17432 9710 7722 44.3% Top 30 total Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)lists.apnic.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

lists of DNS servers by region.
by Tatsuya Kawasaki 13 Dec '02

13 Dec '02

Many web sites which are mulihome/mult co-located seem to act differnetly depend on which DNS severs that we use. Questions: 1. Does anyone have lists of DNS servers by region to may optimize the path?-- of course it may depend on the network topology ...Assume that If ISP is fully messed with others.. ie Teir I provider for exmaple. 2. what is the typical of method they(web hosts) used to decide which one to give? Tatsuya --------------------------------------------------- Tatsuya Kawasaki - Engineer III - CSC tatsuya.kawasaki(a)allegiancetelecom.com - 240-616-2417 800-581-8711 (24 Hour Support) - 240-616-2414 (fax) Allegiance Internet

7 8

Re: Net block blocked
by Michael.Dillon＠radianz.com 12 Dec '02

12 Dec '02

> We are currently working on this issue on a case by case basis, but it is > becoming an overwhelming task to try and track down the appropriate > contact(s) of the larger organizations and military agencies. If anyone has > some advise, suggestions, or assistance that they can offer in regards to > this situation, it would be greatly appreciated. Talk to the trade press, i.e. write emails to editors or columnists at your favorite network or internet publications. That is the only way to reach a significant fraction of the people who have built filtering into firewalls, VPN gateways, system admin software etc. The implication of this is that we have already almost run out of IPv4 address space because the rest of the former Class A space is tainted and unusable on the global Internet. IPv6 anyone? http://www.ipv6forum.org http://hs247.com/ --Michael Dillon

1 0

Re: BGP version 5 announcement
by Paul Ferguson 12 Dec '02

12 Dec '02

I almost thought you were serious when I scanned the subjectline. ;-) - fergie ---------- Michael.Dillon(a)radianz.com writes: > Perhaps e-mails > can be sent to the registered contacts of existing IP space upon initial > allocation, on the first of each month, and then on the last day of the > hold. That's a brilliant idea! We could call this BGP version 5. This is such an amazingly simple idea that I can't understand why anyone would want to run any other data distribution protocol. -- Michael Dillon ;-)

1 0

Guam - Typhoon 180 MPH winds
by Sean Donelan 12 Dec '02

12 Dec '02

Guam was struck by Typhoon Pongona with sustanted winds of 150 mph, and gusts of 184 mph. Electricity is out on the entire island. Most telephone service is down, although some calls have been received. The University of Guam, the the ccTLD manager for .GU, is offline. Backup name service for .GU is being provided by NS.RIPE.NET, although I haven't found working Internet service to the island.

3 3