- Test - lists.nanog.org

Clued ISP in/around Detroit
by Mark Radabaugh - Amplex 09 May '01

09 May '01

We have a dedicated customer in need of a connection (DSL/ISDN) in/around Detroit, Michigan. Please contact off-list. Prefer connectivity to Sprint and/or Verio. Mark Radabaugh Amplex (419) 833-3635

1 0

OT: Questions...
by Rich Sena 09 May '01

09 May '01

Implimenting tacacs on some Extreme Networks gear - can anyone who has done this or might have some info re: same contact me privately. I have it working but am chasing down some issues with command accounting... thanks... -- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0

Re: HR 1542 [OT, anti-BS attempt, US]
by Fletcher E Kittredge 09 May '01

09 May '01

> > Some areas still have both a contract with the local government, and tax > breaks and other services provided to them by the local government. This is > why the 'open access' arguement is raging fiercly in places like Northern > Virginia -- Fox Cable got millions in tax and right of access breaks from > the government over the years, but now claims that they own the cable and > shouldn't be required to resell access to competitors. Non-germane to this discussion. Roland Meyers claimed that US cable companies had current, exclusive contracts to provide high speed Internet access. We are waiting for him to come up with quotations from said contracts. It is accepted by all that cable companies have contracts with local municipalities. regards, fletcher

3 3

RE: black hat .cn networks
by Paul Lantinga 09 May '01

09 May '01

> -----Original Message----- > From: Justin Hinderliter > > The past week i've seen attacks increase 5-fold, mostly > 111/udp attacks [snip] Justin, et al, do you have any *proof* that these attacks are coming from Chinese attackers on Chinese machines? If so, look for commonalities amongst the attacks such as common netblocks etc. If not, the hype could probably be routed into the round file. Attacks happen all the time to the good and the bad. We still need good documentation and due diligence. Until then, join "North America Nonblocking Oriental Groups" -Paul Lantinga -- Pretty much guaranteed that these are solely my opinions

8 12

Cisco DS3 Performance data
by Bill Thomas 09 May '01

09 May '01

Thanks to all for the valuable feedback. The LightReading article that covers the "Edge Router" bakeoff data was most revealing. thanks again, Bill Thomas

1 0

vBNS MSDP
by Marshall Eubanks 09 May '01

09 May '01

Does anyone have a contact e-mail or number for the vBNS NOC ? Sometime between Tue May 8 16:55:20 EDT and Tue May 8 21:10:13 EDT we stopped getting MSDP SA's from them, and thus from Abilene. There seems to be no indication of problems on our end. Regards Marshall Eubanks Multicast Technologies, Inc. 10301 Democracy Lane, Suite 410 Fairfax, Virginia 22030 Phone : 703-293-9624 Fax : 703-293-9609 e-mail : tme(a)on-the-i.com http://www.on-the-i.com Test your network for multicast : http://www.multicasttech.com/mt/

1 0

Re: black hat .cn networks
by Roger Marquis 08 May '01

08 May '01

Walter Prue <prue(a)ISI.EDU> wrote: > The folks in the US who counterattack might be well advised to > reconsider doing so. I would imagine that traffic from the US would be > closely monitored. Any new hacking tricks that these counterattacks > might use would then be recorded and analyzed. These techniques could > then be used by them to further attack the US. Does anyone know if these China scares are for real? The probability they are simply Pentagon/Administration propaganda seems too high to discount. I ask because we've seen no increase in the (already substantial) number of scans from CN/KR/HK/... netblocks. Does any hard evidence exist? -- Roger Marquis Roble Systems Consulting http://www.roble.com/

15 16

Re: black hat .cn networks
by Justin Hinderliter 08 May '01

08 May '01

RE: black hat .cn networksNo, and I stated as much in my original post, despite the angst. One of the attacks planted worm shich in turn planted a series of indexes claiming to be part of the Chinese offensive. It affects HTML and ASP files. The original connection attempt on that box came from a Czechoslovakian host, and the tftp host that the worm grabbed the scripts from was actually in Canada. Othere hosts that were attacked in the same timeframe came from Mapquest, rutgers,edu, and a non-DNS-qualified APNIC host. This doesn't "prove" or disprove anything. Could be Czechs, could be Americans, could be Chinese, could be anyone. I'm not necessarily a proponent of blocking netblocks or blackholing them from a routing perspective on a large network, but I am more than happy to block the offending hosts personally from my internal networks, and do. The tftp server that was serving up the scripts for the NT worm was 205.205.117.6 FYI. The linux exploit (different hosts and exploits altogether from the NT hacks, obviously) seemed to have gotten in on htdig package (3.1.5-6mdk), not apache as I originally expected. I haven't found the script/kit yet, but I did find out that something fully opened up UDP port 4265. Since she's unplugged, I can't grok what was listening on that port at the moment. I'm highly tempted to try to hook it back up after some tweaking and let it run as a honeypot for a few days or until I can nail down what is lurking on there and watch how they're doing their work & see if I can grab more goods on who they are and where their backdoor connects to. More in a bit. Justin Hinderliter ----- Original Message ----- From: Paul Lantinga To: 'Justin Hinderliter' Cc: nanog(a)merit.edu Sent: Tuesday, May 08, 2001 12:39 AM Subject: RE: black hat .cn networks >> -----Original Message----- >> From: Justin Hinderliter >> > The past week i've seen attacks increase 5-fold, mostly >> 111/udp attacks >[snip] >Justin, et al, do you have any *proof* that these attacks are coming from Chinese attackers on Chinese >machines? If so, look for commonalities amongst the attacks such as common netblocks etc. If not, the hype >could probably be routed into the round file. Attacks happen all the time to the good and the bad. We still need >good documentation and due diligence. Until then, join "North America Nonblocking Oriental Groups" >-Paul Lantinga >-- >Pretty much guaranteed that these are solely my opinions

1 0

RE: black hat .cn networks
by Dan Hollis 08 May '01

08 May '01

On Tue, 8 May 2001, Wing Wong wrote: > On Mon, 7 May 2001, Dan Hollis wrote: > > On Tue, 8 May 2001, Paul Lantinga wrote: > > > Justin, et al, do you have any *proof* that these attacks are coming from > > > Chinese attackers on Chinese machines? > > We may never know since mainland china admins never respond to abuse mails. > Ever consider the possibility that the admins in question don't understand > English? It'd be like if someone sends you a Big5 or SJIS encoded message > complaining about spam or cracks and all you see is binary jiberish on > your screen. > Even romanized communications would be difficult to understand. I can use babelfish, why can't they? Yes, babelfish is less than perfect, but I can usually grok the gist of an email. And if babelfish isnt good enough, there's others. FWIW I've had a chinese friend in canada send a BIG5 email once and the same -- no response. -Dan

8 10

RE: Instant chats and central servers
by Cerqua, Toby 08 May '01

08 May '01

On a partially related topic, I've recently run across a service that tries to put all the instant messenging services together in one package. Check out Jabber.com; it's still under development, but it seems like it may be a good idea in the making. Redundancy in messengers may be useful, but the program's still a teeny bit buggy. On 5/8/2001 at 11:35:27 -0700, Sean Donelan wroteified: > > A question (and a test to see if I'm still subscribed) > > The various instant messenging services, such as AIM, ICQ, Microsoft, > Yahoo, other Messenger uses a central server to manage "presence". > > No central server appears to mean no instant messages, am I correct? > > What does this have to do with NANOG, apparently it is becoming more > common for backbone NOC folks to communicate with their friends in > other NOCs via one of these instant chat programs. I didn't realize > how common it was until I was informed about it last month when AOL/AIM > had difficulties. This month Yahoo Messenger had power difficulties, > which disrupted their central servers. > > If folks are using this these services for real-time communications, > should we be trying to improve their reliability? Or is this just a > "feature" of how presence services work. > > -- Dave Israel Senior Manager, IP Backbone Intermedia Business Internet

1 0