- Test - lists.nanog.org

PacBell contact?
by David G. Andersen 18 Jun '02

18 Jun '02

We're seeing some strange packet dropping behavior with a monitoring host on PacBell DSL - if we send two packets back to back, the probability that both get dropped is actually higher than the probability of losing one packet if it's sent alone. We're trying to explain the behavior to understand in what situations some of our tools won't work, and I'd like to chat with someone in the know. (PacBell's trouble@ address didn't seem like the right place). Or, if anyone knows what kind of traffic shaping equipment or other such would exhibit that behavior, I'd love to know. The only places we've seen this are on DSL and Cable modem links. Thanks! -Dave -- work: dga(a)lcs.mit.edu me: dga(a)pobox.com MIT Laboratory for Computer Science http://www.angio.net/

1 0

Re: XO
by blitz 18 Jun '02

18 Jun '02

At 12:46 6/18/02 -0400, you wrote: >On Mon, 17 Jun 2002, Martin Hannigan wrote: > > > The difference is XO will be fine, Adelphia will be bought by <EVIL>, or > > potentially liquidated. > >They're talking about selling out to Charter. The deal with Charter fell through a week ago.....Adelphia's so dirty, no one wants to touch them...guess we'll wait for the fire sale.

2 1

XO
by blitz 18 Jun '02

18 Jun '02

Did I hear right on the nightly news, XO went bankrupt today? Presently, we're taking bets on when Adelphia goes chapter 11...

7 6

[Fwd: FOUND VIRUS IN MAIL from <owner-nanog@merit.edu>]
by Larry Rosenman 18 Jun '02

18 Jun '02

Fair Warning.... -----Forwarded Message----- From: vscan(a)lerctr.org To: virusalert(a)lerctr.org Subject: FOUND VIRUS IN MAIL from <owner-nanog(a)merit.edu> Date: 17 Jun 2002 22:48:16 -0500 A virus was found in an email from: <owner-nanog(a)merit.edu> The message was addressed to: -> <ler(a)lerami.lerctr.org> The message has been quarantined as: /var/virusmails/virus-20020617-224816-21028 Here is the output of the scanner: Scanning /var/amavis/amavis-milter-4Oa4l925/parts/* Scanning file /var/amavis/amavis-milter-4Oa4l925/parts/msg-21028-1.txt Scanning file /var/amavis/amavis-milter-4Oa4l925/parts/msg-21028-2.html Scanning file /var/amavis/amavis-milter-4Oa4l925/parts/msg-21028-3.exe /var/amavis/amavis-milter-4Oa4l925/parts/msg-21028-3.exe Found the DDoS-Slack trojan !!! Summary report on /var/amavis/amavis-milter-4Oa4l925/parts/* File(s) Total files: ........... 3 Clean: ................. 2 Possibly Infected: ..... 1 Here are the headers: ------------------------- BEGIN HEADERS ----------------------------- Received: by trapdoor.merit.edu (Postfix) id 0FA7F9124E; Mon, 17 Jun 2002 23:46:02 -0400 (EDT) Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Received: by trapdoor.merit.edu (Postfix, from userid 56) id B621F9124F; Mon, 17 Jun 2002 23:46:01 -0400 (EDT) Delivered-To: nanog(a)trapdoor.merit.edu Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) by trapdoor.merit.edu (Postfix) with ESMTP id A61099124E for <nanog(a)trapdoor.merit.edu>; Mon, 17 Jun 2002 23:45:58 -0400 (EDT) Received: by segue.merit.edu (Postfix) id 8CCEA5DE57; Mon, 17 Jun 2002 23:45:58 -0400 (EDT) Delivered-To: nanog(a)merit.edu Received: from web21109.mail.yahoo.com (web21109.mail.yahoo.com [216.136.227.111]) by segue.merit.edu (Postfix) with SMTP id D92105DE52 for <nanog(a)merit.edu>; Mon, 17 Jun 2002 23:45:57 -0400 (EDT) Message-ID: <20020618034556.54382.qmail(a)web21109.mail.yahoo.com> Received: from [68.36.89.121] by web21109.mail.yahoo.com via HTTP; Mon, 17 Jun 2002 20:45:56 PDT Date: Mon, 17 Jun 2002 20:45:56 -0700 (PDT) From: jim bruer <jim_teh_man(a)yahoo.com> Subject: ConfigMaker Beta To: nanog(a)merit.edu MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="0-340633384-1024371956=:50295" Sender: owner-nanog(a)merit.edu Precedence: bulk Errors-To: owner-nanog-outgoing(a)merit.edu X-Loop: nanog -------------------------- END HEADERS ------------------------------ -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: ler(a)lerctr.org US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749

3 3

RE: Qwest leaking routes?
by Jeff Harper 18 Jun '02

18 Jun '02

Humble suggestion would be to block the advert of RFC 1918 addresses at your peering points. Jeff Harper, VCE, CNEP IEEE#: 40306184 Manager of Network Engineering Verizon Internet Services [AS 6541/AS 6976] 214.513.6791 | jharper(a)vzlink.com -----Original Message----- From: Vinny Abello [mailto:vinny@tellurian.com] Sent: Tuesday, June 18, 2002 10:47 AM To: nanog(a)merit.edu Subject: Qwest leaking routes? Has anyone else noticed that Qwest appears to be leaking routes to 10.0.0.0/8?? BGP routing table entry for 10.0.0.0/8, version 1073573 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 1784 209 216.182.0.65 (metric 5803520) from 216.182.0.65 (216.182.0.65) Origin IGP, localpref 90, valid, internal, best Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN

1 0

Qwest leaking routes?
by Vinny Abello 18 Jun '02

18 Jun '02

Has anyone else noticed that Qwest appears to be leaking routes to 10.0.0.0/8?? BGP routing table entry for 10.0.0.0/8, version 1073573 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 1784 209 216.182.0.65 (metric 5803520) from 216.182.0.65 (216.182.0.65) Origin IGP, localpref 90, valid, internal, best Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN

2 1

Looking for infrastructure, international & national peering policies
by ren 18 Jun '02

18 Jun '02

Hi folks, As mentioned to several of you last week in Toronto, I'm looking for infrastructure, international and national peering policies that anyone wants to donate to a good cause. It is time for the bi-annual update! If we have a wide variety of policies in hand it will help. For some reason I'm having trouble finding public facing documents about infrastructure peering... thanks in advance, -ren

1 0

???
by blitz 18 Jun '02

18 Jun '02

Anyone else getting the group msgs in duplicate like I am? Server brainfart?

2 1

Sean takes a vacation somewhere sunny....
by David Lesher 18 Jun '02

18 Jun '02

Sean has branched out into lightweight tools.... MADRID, June 15 (AFP) - Thousands of phones and Internet connections were severed in 15 Spanish provinces after saboteurs used chainsaws to cut through fibre optic cables belonging to Spanish telecoms operator Telefonica, the Spanish press reported Saturday. ..... Communications between airports were particularly affected, causing delays of three hours in the Galicia region, northwestern Spain, while numerous automatic cash distributors shut down across Spain. ... The Spanish ministry of science and technology has asked telecommunications companies to activate a backup plan in the case of such emergencies in future. Spare fibers in the same duct ;-? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

4 3

NANOG wins a bot
by Rob Thomas 18 Jun '02

18 Jun '02

Hi, all. This evening the NANOG mailing list received e-mail from a "jim bruer," aka jim_teh_man(a)yahoo.com. This e-mail, with a topic of "ConfigMaker Beta" (a Cisco product) included an attachment labelled as "cisco_configmaker.exe." This is actually a war bot known as Slackbot, version 1.0. This bot attempts to connect to the IRC server irc.easynews.com, 140.99.102.3. This IP address is part of the 140.99.96.0/19 prefix announced by ASN 2 (ACES Research - The Tucson Interconnect). The channel is #midgets_in_drag with no channel key. The server is not running, so this botnet (perhaps an old one) is not available for woe. The bot runs on Windows as wuordona.exe, and installs in c:\winnt\. This is likely an attempt by some miscreants to build a botnet through the e-mail spam method. Since Slackbot does not include a spam mechanism, some other bit of malware must be involved. Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

3 3