- Test - lists.nanog.org

Question about Dynamic Graphs of the Nimda worm
by Jeff Ogden 19 Sep '01

19 Sep '01

The Dynamic Graphs of the Nimda worm at http://www.caida.org/dynamic/analysis/security/nimda/ are interesting. To what degree do the graphs really tell us how many hosts are infected? Or do they just tell us how many infected hosts are observed every 15 minutes? I guess what I am asking is, is the 15 minute sample period causing the graph to under report the total number of infected sites? How likely is it that the CAIDA monitor will be visited at least once every 15 minutes by an infected system? No matter what the answer to this question is, I do like the fact that the trend is down. -Jeff Ogden Merit

1 0

Virus fix
by Steve Smith 19 Sep '01

19 Sep '01

Looks like Trend has a cleaning tool now, www.anitivirus.com Steve Smith MCSE, CCNA, CCDA Data Networks Technical Manager Freeliant Inc. (901)309-3919 The brave may not live forever, but the cautious never live.

1 0

Blocking nimda probes with a content-layer switch
by Joe Abley 19 Sep '01

19 Sep '01

Has anybody tried to block nimda HTTP GET probes using URL pattern matches in a "layer-4-7"[1] switch? The ideal result is to prevent nimda GET probes from ever reaching the destination address, but causing the session to be reset towards the server after the open handshake but before the GET can be sent to the server would be acceptably useful. Particularly whether it's possible on a cisco/Arrowpoint switch, but it would be interesting to know about other vendors too. Please reply directly, will summarise if there are answers to share. Thanks! [1] substitute phrase-du-jour as appropriate

4 3

Photos from Verizon's West St. (NYC) CO
by Jeff Wasilko 19 Sep '01

19 Sep '01

A friend of mine passed this URL on to me: http://www.internetsvc.com/vznwestco.ppt It's got 5 photos from inside of Verizon's CO, showing their DACS and 5ESS and the surrounding damage... -jeff

2 2

Re: Online DB of Nimda infected hosts.
by Ulf Zimmermann 19 Sep '01

19 Sep '01

I just fixed a problem in my php code, which will make the search for "prefix" work right. Searching for "10.10%" will not return an IP like "172.16.10.10" anymore. Going to try and work on a search based on real CIDR, so that you can enter "172.16.0.0/16". -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

1 0

Summary: Blocking nimda probes with a content-layer switch
by Joe Abley 19 Sep '01

19 Sep '01

Summary of suggested comments on defeating nimda probes follows. Lincoln Dale's comments were cc'd to the list, but I've included fragments here anyway just to keep them together with the other bits. Thanks! Three people suggested using NBAR on cisco routers, along these lines: http://www.cisco.com/warp/public/63/nbar_acl_codered.shtml One person suggested the following config fragment for F5's Big/IP switches: rule block_nimda { if (http_uri starts_with "/scripts" or http_uri contains "root.exe") { discard } else { use ( server_pool) } } with the proviso that adjustments might be required of those url patterns are too general for your purposes. Users of Big/IP versions prior to 4.0 (which don't support "discards" can route the connections to a dummy pool. One person was using a Nortel/Alteon switch to redirect all traffic to a cacheflow client accelerator, then using pattern matching on the cacheflow box to prevent the traffic reaching the origin servers. Lincoln suggested the following for the cisco Content Engine and Content Services Switch: Cisco Content Engine: rule enable rule block url-regex http://.*/cmd\.exe rule block url-regex http://.*/root\.exe Cisco CSS11K (Content Services switch): service dummy ip address 10.1.1.1 keepalive type none active ! header-field-group cmd.exe header-field cmd.exe request-line contain "cmd.exe" header-field-group root.exe header-field root.exe request-line contain "root.exe" ! content block_cmd.exe protocol tcp port 80 url "/*" header-field-rule cmd.exe add service dummy active content block_root.exe protocol tcp port 80 url "/*" header-field-rule root.exe add service dummy active Lincoln also pointed out that the CSS and CE configs above will prevent the client's TCP SYN from reaching the server (the devices will accept the TCP sessions and receive the HTTP headers before deciding whether to pass them on to the servers). NBAR will only match the HTTP headers on TCP sessions that successfully establish a TCP session with the server ("delayed binding").

1 0

Nimda & Yahoo
by Bill Larson 19 Sep '01

19 Sep '01

Well It looks as if the Yahoo Corporate network is infected. hilla.corp.yahoo.com - [19/Sep/2001:11:22:10 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 280 "-" "-" If anyone from Yahoo is reading this list you might want to start scanning systems. --- Bill Larson Network Administrator Compu-Net Enterprises

2 1

Online DB of IPs for Nimda worm infected machines
by Ulf Zimmermann 19 Sep '01

19 Sep '01

Hello, at: http://seven.alameda.net/~ulf/nimda/ I put a page to search for infected IPs. This is the first version. Currently I put IPs into it which probed me before about 2pm PDT. I got email from 2 people who sent me their IPs, which I am going to add when they ok it. You can right now search by SQL for IPs like: 64.81.% This will display all IPs which probed me starting with 64.81. Things I am adding in the next minutes is so that people can submit them self single IPs or bulk list. -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

5 7

Afghanistan
by Smith, Rick 19 Sep '01

19 Sep '01

Has anyone started to deny all traffic to/from Afghanistan ? Wouldn't that be worth it ? Or did I miss that post? R

13 15

RE: looping traceroutes
by Hire, Ejay 19 Sep '01

19 Sep '01

This behavior would occur if the traffic was routed to a loopback interface. -----Original Message----- From: Leo Bicknell [mailto:bicknell@ufp.org] Sent: Wednesday, September 19, 2001 8:09 AM To: nanog(a)merit.edu Subject: Re: looping traceroutes On Wed, Sep 19, 2001 at 12:40:51AM -0700, Ratul Mahajan wrote: > Do you think that it can be a real persistent routing loop (data packets > would actually shuttle between the two interfaces) as against some > wierdness because of traceroute? I'd tell you a story, but it would make all of nanog cringe. Put simply, I know of at least one medium size regional network who when they couldn't make "bgp work" decided to implement a series of scripts that logged into all routers and installed statics to make things work. Let me just tell you, after a few short weeks of adding and removing (and missing) such routes there were loops all over the place, many of which are probably still there. :-( There are a number of ways long lived loops can occur. I believe others have pointed out some other methods. -- Leo Bicknell - bicknell(a)ufp.org Systems Engineer - Internetworking Engineer - CCIE 3440 Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0