- Test - lists.nanog.org

FTP exploit?
by Clayton Fiske 20 Mar '01

20 Mar '01

Is there a (fairly) recent exploit for common ftp daemons going around lately? In the past several days, I've seen a very noticeable jump in the number of people attempting anonymous ftp logins. Typically I noticed it once or twice a week, and usually single attempts, but now they're coming in every few hours and they each make 4 attempts within a second (which is one per IP bound to the box I'm watching). It looks like it has to be some kind of script. Anyone else seeing any noticeable increases like this? -c

5 4

Re: Is www.cisco.com down?
by Richard A. Steenbergen 20 Mar '01

20 Mar '01

On Mon, Mar 19, 2001 at 11:15:59PM -0500, Kent Yu wrote: > route-server>tr 198.133.219.25 Ok, lets get with the program here. Is this topic really worth the reading time of 1,000 network engineers (and the 3 spammers who keep posting)? Do you really expect a useful answer? Cisco probably has 10 people who's only job is to click refresh on the webpage just to make sure it's up. Please, the DNS thread is bad enough without this noise. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Is www.cisco.com down?
by Kent Yu 20 Mar '01

20 Mar '01

route-server>tr 198.133.219.25 Type escape sequence to abort. Tracing the route to www.cisco.com (198.133.219.25) 1 white_dwarf.cbbtier3.att.net (12.0.1.1) [AS 7018] 4 msec 0 msec 0 msec 2 ar3.n54ny.ip.att.net (12.126.0.30) [AS 7018] 4 msec 4 msec 4 msec 3 gbr2-a30s2.n54ny.ip.att.net (12.127.0.26) [AS 7018] 4 msec 4 msec 4 msec 4 gbr3-p00.n54ny.ip.att.net (12.122.5.246) [AS 7018] 4 msec 4 msec 0 msec 5 gbr3-p30.cgcil.ip.att.net (12.122.2.173) [AS 7018] 24 msec 24 msec 20 msec 6 gbr3-p30.sffca.ip.att.net (12.122.2.150) [AS 7018] 64 msec 60 msec 60 msec 7 gbr2-p60.sffca.ip.att.net (12.122.5.253) [AS 7018] 60 msec 60 msec 68 msec 8 ar4-a3120s3.sffca.ip.att.net (12.123.12.101) [AS 7018] 68 msec 68 msec 60 ms ec 9 12.126.204.58 [AS 7018] 64 msec 60 msec 60 msec 10 pigpen.cisco.com (128.107.240.166) [AS 109] 60 msec 64 msec 64 msec 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * Kent Yu

1 0

California rolling blackouts - March edition
by Sean Donelan 20 Mar '01

20 Mar '01

Rolling blackouts are back in California. Starting about 11:45am PST, CA-ISO requested utilities start shedding approximately 500 to 1000 MW. Involuntary load curtailment is expected to continue through the evening. 11,500 MW of power production was unavailable due to planned and unplanned maintenance. An additional 1,000 MW of power product was lost this morning when a transformer fire knocked two plants off-line in Southern California. A couple of colocation and Internet service providers reported they were operating on backup generators for 60-90 minutes as their power blocks were affected. No customer loads were reportedly dropped. Sun Microsystems reported loss of power at a manufacturing facility for two hours. PG&E is rezoning those blocks "exempted" from rolling blackouts beinging this month. Some customers previously identified as being in an exempt block are being moved since they aren't sharing a circuit with a critical facility. Likewise, some circuits not identified as serving critical facilities are now exempt because a critical facility is on the circuit. Critical facility means a hospital, emergency operations center, etc.

1 0

RE: Multiple Roots are "a good thing" - Karl Auerbach
by Roeland Meyer 20 Mar '01

20 Mar '01

> From: Miles Fidelman [mailto:mfidelman@civicnet.org] > Sent: Monday, March 19, 2001 3:14 PM > > On Mon, 19 Mar 2001, Shawn McMahon wrote: > > > > If you don't want to read, you don't have to. A lot of > us do feel that > > > this has operational impact, and will continue to discuss > the topic long > > > after its death. > > > > I suppose Susan could kick half of the list's members out, > if she think's > > that's productive. > > Haven't we all repeated the various positions to death? I > don't think any > minds are going to change at this point. Susan has a point, > let's drop it > - or at least take it to a venue where some policy might > really be made > (like the various DNSO lists). I sort of agree with Susan. DOMAIN-POLICY is the place to be, or the ICANN lists, for matters of policy and legitimacy. Contrary to some beliefs, those are not technical issues. The point that's made here is that most of these issues were covered years ago, on many of those other lists. I mentioned earlier that opinions expressed here were reminiscent of DOMAIN-POLICY, circa 3-years ago. The reason this is true is that many of you have NOT been keeping up with the changing issues and the moving consensus. The fact that many of NANOG felt sandbagged by the new.net play, may be explained by a sad case of denial and failing to follow the issues on those other lists. I've been expecting such a play since the November ICANN meet. Y'all may ridicule me all you want, but the sad fact remains that if y'all don't get involved you have not much room to complain, when the fecal material impacts the rotating blades. At that time, about all that you can do is duck and avoid the bigger pieces. IOW, it'll be too late. Poking your collective heads in the NANOG sands will not make these issues go away. BTW, the ORSC has been working the technical side for over three years. see www.icann.org www.dnso.org www.dnso.net www.open-rsc.org Let's take this over to the DOMAIN-POLICY lists, I'll see y'all there.

2 1

Multiple Roots simply need context
by Chris Davis 19 Mar '01

19 Mar '01

There is no problem in having hundreds or thousands of multiple root servers for DNS. We have a problem with CONTEXT. There is no existing way to ascertain the context from which users are resolving domain names. Solution: DNS Context Servers... DNS operators subscribe their machines to the DNS context they want. In one context, ".xxx" can resolve via new.net, in another context, ".xxx" resolves via one of the other .xxx providers. To keep ICANN and friends happy, ICANN could be the "default" context. Help calls then have one and only one additional question: "To which DNS context do you subscribe?" Context servers are pretty obviously where things are headed. Sooner or later, some new.net company is going to "take." If we already have DNS context servers in place, life will be much easier when an alternative TLD provider does succeed. -Chris Davis --not really selling private address space, that was a joke --not a fan of new.net's plugin, since it breaks ping, traceroute, and tradition

4 3

NANOG 22!
by Susan Harris 19 Mar '01

19 Mar '01

Greetings everyone - the next NANOG meeting will be held May 20-22 in Scottsdale, Arizona, at the DoubleTree Paradise Valley. Our local host will be CenterGate Research Group. You'll find a Call for Presentations below. Thanks for being patient while we made final arrangements for the conference. Meeting registration begins April 2 and details about hotel reservations will follow shortly. Thanks also for the comments about NANOG and Merit that many of you made on the list after the Atlanta meeting. We've written up a FAQ that answers some of your questions: http://www.nanog.org/faq.html Questions and comments are welcome - please send them to nanog-support(a)nanog.org, so that we can keep the main list focused on operational issues. ============================================================================== * * * * * * * * * * * * * * * * * CALL FOR PRESENTATIONS * * NANOG 22 * * May 20 - 22, 2001 * * * * * * * * * * * * * * * * * The North American Network Operators' Group (NANOG) will hold its 22nd meeting in Scottsdate, Arizona, between May 20-22, 2001. The meeting will be hosted by CenterGate Research Group. NANOG conferences provide a forum for the coordination and dissemination of technical information related to large-scale (i.e., national/international) Internet backbone networking technologies and operational practices. NANOG meetings, held three times each year, include two days of short presentations, plus afternoon/evening tutorial sessions. Meetings are informal, with an emphasis on relevance to current backbone engineering practices. The conference draws over 600 participants, mainly consisting of engineering staff from large national service providers, and members of the research and education community. Now in its sixth year, NANOG evolved from the NSFNET "regional-techs" meetings, where technical staff from the regional networks met to discuss operational issues of common concern. With the emergence of the commercial Internet, NANOG meetings evolved to include a broader base of providers, network operators, and researchers. The meeting will be held at the DoubleTree Paradise Valley. For more information about NANOG meetings, schedules, and logistics, see: http://www.nanog.org ------------------------------------------------------------------------------ CALL FOR PRESENTATIONS NANOG invites presentations on backbone engineering, coordination, and research topics. Presentations should highlight issues relating to technology already deployed or soon to be deployed in core Internet backbones and exchange points. Previous meetings have included presentations on: - Backbone traffic engineering - Coordination of inter-provider QoS - Deployment experience with queueing disciplines (CAR, RED) - Inter-provider security and routing protocol authentication - Routing scalability in backbone infrastructures - Security issues for the Internet core - Routing policy specification and backbone router configuration - Building large-scale measurement infrastructure - Cooperative inter-provider caching - Alternatives to hot-potato routing - Recommendations on queue management and congestion avoidance - Experience with differentiated services - Reports from next-generation networks (CANARIE, Internet2)) - Inter-domain multicast deployment - Backbone network failure analysis Tutorials have covered topics such as: - BGP case studies - MPLS fundamentals - External route selection - IP multicast technologies - Distributed content caching in large IP networks ------------------------------------------------------------------------------ HOW TO PRESENT Submit an informal one- or two-paragraph abstract describing the presentation in email to nanog-support(a)nanog.org. The deadline for proposals is April 16, 2001. While the majority of speaking slots will be filled by April 16, a limited number of slots will be available after that date for topics that are exceptionally timely and important. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by April 23, 2001. NANOG also welcomes suggestions/recommendations for tutorials, panels and other presentation topics. ---------------------------------------------------------------------------

1 0

Re: Multiple Roots are "a good thing" - Karl Auerbach
by Shawn McMahon 19 Mar '01

19 Mar '01

On Mon, Mar 19, 2001 at 03:50:06PM -0500, Susan Harris wrote: > Hello Shawn - I sent a message to the list asking everyone to stop posting > on the topic of DNS. Did you not see it? Please don't post on this topic > any longer. Thanks. A tremendous number of people in the list seem to think it's a valid topic with operational impact. Why do you feel it appropriate to go against their wishes?

6 7

Re: FTP exploit?
by Spencer.Wood＠dot.state.oh.us 19 Mar '01

19 Mar '01

Yes, FTP based attacks are up....Check out http://www.cert.org/current/current_activity.html#scans **************************************************** Spencer Wood, Network Administrator Ohio Department Of Transportation 1320 Arthur E. Adams Drive Columbus, Ohio 43221 E-Mail: Spencer.Wood(a)dot.state.oh.us Phone: 614.644.5422/Fax: 815.361.0714 **************************************************** Clayton Fiske <clay(a)bloomcounty.org> Sent by: owner-nanog(a)merit.edu 03/19/2001 04:01 PM To: nanog(a)merit.edu cc: Subject: FTP exploit? Is there a (fairly) recent exploit for common ftp daemons going around lately? In the past several days, I've seen a very noticeable jump in the number of people attempting anonymous ftp logins. Typically I noticed it once or twice a week, and usually single attempts, but now they're coming in every few hours and they each make 4 attempts within a second (which is one per IP bound to the box I'm watching). It looks like it has to be some kind of script. Anyone else seeing any noticeable increases like this? -c

1 0

RE: Multiple Roots are "a good thing" - Karl Auerbach
by Roeland Meyer 19 Mar '01

19 Mar '01

> From: woods(a)weird.com [mailto:woods@weird.com] > Sent: Sunday, March 18, 2001 12:47 PM > > In other words, we need an authorized international body > with the clout to > > oversee the whole mess. But then, isn't that what ICANN is > supposed to be? > > (Or would you rather have the ITU oversee the Internet?) > > some days I'd rather have the UN do it... :-) The ITU is a UN body, so is WIPO (a part of WTO).

4 3