- Test - lists.nanog.org

Re: TCP session disconnection caused by Code Red?
by George William Herbert 06 Aug '01

06 Aug '01

mike harrison <meuon(a)highertech.net> wrote >Blaz Zupan <blaz(a)amis.net> wrote: >> For the last few days, our network seems to be basically unreachable from the >> outside. Most incoming TCP sessions (web requests, incoming mail, telnet >> sessions, etc.) often fail with a simple "Connection refused" like nobody is > >Your routers are brain dead from the load.. routers that are used to >handling a few thousand connections are being asked to handle 10's of >thousands. 1 good 1000+ address scan from an ISDN user kills my >Lucent/Ascend TNT unless we filter for it. I've been told (but not given permission to forward details of who/how/what) that some major sites with a single router and relatively flat network topology are dying due to the ARP request flood that is being generated by Code Red scans on the inside of their border router choking the router. Check the rate of ARP requests coming off your border router and see if it seems excessive; if so, that may be it. -george william herbert gherbert(a)retro.com

7 6

The Death of TCP/IP
by Robert Hough 06 Aug '01

06 Aug '01

Felt like sharing this most amusing article that I discovered in my Inbox this morning: http://www.pbs.org/cringely/pulpit/pulpit20010802.html -- Robert Hough (rch(a)acidpit.org)

6 5

Re: CodeRedII worm..
by Larry Sheldon 06 Aug '01

06 Aug '01

> > worm creates a known backdoor. I'm certain that both the CodeRedII author > > and other black hats would love for us to compile a list of afflicted hosts > > for them to use. > > They have a few 'friendly' webservers collecting addresses > just like we do. Everyone on the 'net with a sniffer or web log now > has such a list. It's a good thought though. If we are pretty sure that is the case, how about posting a list somewhere for the good guys to see--or somebody send email to the ARIN-listed contact for the IP addresses detected. I'm trying to build a detector here, but it is hard, given the resources I can bring to bear. Mostly me, which means we are in really bad shape, resource-wise.

4 3

Negative ARP caching [was Re: TCP session disconnection caused by Code Red? ]
by Alex Bligh 06 Aug '01

06 Aug '01

>> Probably >> a bad idea. Rate limiting, as RFC 1122 suggests, would seem to be much >> better. > > Agree that rate-limiting is a good idea (indeed that's INCOMPLETE[n] and > [t1] in my proposal) but I don't see how it helps here. Or to put it another way: So if you are storing sufficient state in the OS to do rate-limiting (i.e. keeping state on incomplete / nonexistant entries too), then put it to some use, and (say) halve the rate-limit every time one proves non-existant (and you drop the queued packet(s)), (i.e. twice as many seconds between ARP packets), down to some minimum, like one every 5 mins, and reset the rate limit on reception of any IP packet from that machine and/or successful ARP. This is almost the same thing as I suggested, but looks more like rate limiting, with some intelligence as to the rate. -- Alex Bligh Personal Capacity

1 0

nanog mail not getting here
by Lou Katz 06 Aug '01

06 Aug '01

Due to the CRII load, apparently I cannot properly do a lookup on trapdoor.merit.edu, so nanog mail is bouncing with a temporary error 451 "Sender domain must resolve". If anyone knows how to jigger my sendmail to let this through without opening the floodgates, please contact me offlist. Thanks. -=[Lou Katz]=-

1 0

Re: The Death of TCP/IP
by smoot＠tic.com 06 Aug '01

06 Aug '01

> Owen DeLong <owen(a)delong.sj.ca.us> said: > Most of those 400 varieties interoperate with current IP. If you look > at the > history of VINES IP, as in his example, I think you will find that his > concerns > are not as far off as you would hope. I doubt if MS is deliberately trying to get rid of TCP/IP at this point in time. They did try to build their own proprietary network a few years ago and it failed because of the existense of the Internet. Also MS has a major problem in trying to close a network protocol around their OS and it is not technical. It is the finding they are a monopoly and monopolies have to be very careful about their business practices. Closing off generic use of TCP/IP from their OS would be seen as very anti-competitive. -- Smoot Carl-Mitchell Consultant

1 0

RE: CodeRed: New Variant?
by Seth M. Kusiak 06 Aug '01

06 Aug '01

Perhaps I should explain a bit more: This is a known exploit (http://www.microsoft.com/technet/security/bulletin/ms01-023.asp) however I saw many requests from multiple IP's. I thought that this was odd to see so many in such a short time. I thought that maybe another worm was on the loose. ~Seth Seth M. Kusiak writes: > > I'm seeing this. Anyone else? > > -------------------------------------------------------------------------- > 2001-08-05 22:11:37 <Client IP> - <Server IP> 80 GET /NULL.printer - 302 0 > 315 2365 0 > > > > > > > > 3À°Ø@`3Û³$Ãÿàë¹1j - - - > --------------------------------------------------------------------------

2 1

Earthlink NOC contact needed
by jlewis＠lewis.org 06 Aug '01

06 Aug '01

I sent this out last week, but the list server seems to have intercepted and tossed the message. It seems that some of our customer IP blocks are in whatever Earthlink uses for spam blacklisting on their incoming mail gateways. Emails to OpenRelay(a)Corp.EarthLink.Net have not generated any response, and calls to 1-800-EARTHLINK result in lots of time spent on hold and not much else. If anyone in a capacity to do anything about this at Earthlink sees this, could you please contact me off-list? 550-EarthLink's inbound mail servers do not allow mail from your site. 550-Please contact your ISP to find out how to send e-mail using a 550-proper mail server. If you are an EarthLink customer, and need 550-assistance configuring your e-mail software, please contact 550-EarthLink's technical support department at 1-800-EARTHLINK. 550-Server administrators that feel they are being blocked in error 550 may send e-mail to OpenRelay(a)Corp.EarthLink.Net for assistance. -- ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

RE: The Death of TCP/IP
by Roeland Meyer 06 Aug '01

06 Aug '01

> From: Wojtek Zlobicki [mailto:wojtekz@idirect.com] > Sent: Sunday, August 05, 2001 3:09 PM > > <RANT> > > Nothing other than anti-Microsoft propaganda. You cannot > blame Microsoft > for high market share. But you can blame them for making Vbasic available to every email message that wants to rape your system. Boy, what a brain-fart that was. It still stinks. Repeat after me; nothing in an email message should be executable without express and very deliberate operator intervention. > The main reason that *Nix hosts are generally more > resilient to these type of worms is that it is less likely for a non > informed administrator to administer a *Nix sever. False. A very large portion of the *nux machines are in this sad condition. > If everyone that had a > IIS box available on the big I, installed all related > patches, worms like Code Red would never propagate very far. Sure they would, you'd just never notice it. A *real* programmer would have started CodeRed out at the current Level III version. > Raw socket support in NOT a bad thing. I wonder if Robert > Cringely and Steve Gibson are friends. Now here, we agree. > "Say goodbye to TCP/IP and to anonymous connections of any > kind. Hello to > Hailstorm, tracking everything down to the last mile, and a more > business-friendly Internet with prioritized packet-handling. " I've just been looking at Hailstorm, it sucks. Think "totalitarianism". Think, re-enforcment of monopoly position. > </RANT> > > I really encourage anyone with a tough skin, and looking for > a good laugh to > read this article. > > > ----- Original Message ----- > From: "Robert Hough" <rch(a)acidpit.org> > To: <nanog(a)merit.edu> > Sent: Sunday, August 05, 2001 12:23 AM > Subject: The Death of TCP/IP > > > > > > Felt like sharing this most amusing article that I discovered in my > > Inbox this morning: > > > > http://www.pbs.org/cringely/pulpit/pulpit20010802.html > > > > -- > > Robert Hough (rch(a)acidpit.org) > >

5 4

IP address blocks for out-of-band inter-provider links
by Sean Donelan 06 Aug '01

06 Aug '01

While working on how to set up an out-of-band communication network between several providers, a question about whose IP addresses to use came up. The intent is to provide an out-of-band management network allowing member providers to exchange management information and alerts even if the main Internet is severely congested by malicious traffic. Because this isn't supposed to be connected to the Internet, its not necessary to use IANA/ARIN/RIPE/APNIC assigned IP address blocks. Several providers use private addresses on their out-of-band management networks. I would prefer to use globally unique IP addresses between providers to avoid conflicts with the RFC1918 private addresses already in use in provider's networks, and if the addresses accidently leak. Other than exchange points, are there any other cases of unique IP addresses being allocated for multi-provider purposes?

4 3