- Test - lists.nanog.org

Re: netscan.org update
by Patrick W. Gilmore 27 Sep '00

27 Sep '00

At 12:36 AM 9/27/2000 -0400, John Fraizer wrote: >I do understand where you may draw that conclusion however. Testing >for the presence of gas (smurf amplifiers) with a sniffer (single ICMP >echo-request scan) is NOT the same as simply throwing a match at the gas >main (waiting for an attack). > >So, the simple answer to your question is no. Especially since the source address is not spoofed. >John Fraizer TTFN, patrick

1 0

AS-Path analysis tool?
by Dan Hollis 27 Sep '00

27 Sep '00

Anyone know of good AS-Path analysis tools? I'd like to do some AS-Path statistical analysis in order to do some BGP tuning. -Dan

1 0

Re: Port 139 scans
by Ben Browning 27 Sep '00

27 Sep '00

At 01:14 PM 9/27/00 -0400, Bill Becker wrote: >Speaking of the internet and the way it operates, is anyone >else seeing a large number of random hosts scanning through >their address space using TCP on port 139? I get about 4 or 5 of these a day on my home boxen and I receive 5-10 times that many abuse complaints regarding this activity. My current suspicion is that a backdoor trojan (pause here to decline the port 139 attempt that just zipped by me) is on the loose and being propagated like mad. This would certainly fit with the rumour of a huge DDoS attack in the works, as m@d l33t h@x0rs get as many machines as possible compromised and ready to help the attack. I have noticed that the large majority of these scans from my address space (216.39.128.0 - 216.39.192.255) are targeted at others in the 216.39.* and 216.40.* blocks. Also, all of the computers in question seem to be Win9x boxes. Coincidence? I think not. Perhaps this is a new virus afoot that replicates itself by hunting through an IP block and the ones above and below it for an open Windows share. That would make sense, given the data I have thus far. CERT has an advisory up (http://www.cert.org/vul_notes/VN-2000-03.html) about NetBIOS DoS attacks, but these don't seem to be hosing networks, just kind of feeling around. If anyone else has more info, please share it! --- Ben Browning <benb(a)oz.net> oz.net Network Operations Tel (206) 443-8000 Fax (206) 443-0500 http://www.oz.net/

5 4

Re: Port 139 scans
by ken lindahl 27 Sep '00

27 Sep '00

On Wed, 27 Sep 2000, Bill Becker wrote: > Speaking of the internet and the way it operates, is anyone else seeing a > large number of random hosts scanning through their address space using TCP > on port 139? > > Bill we've seen similar scans here at UCB, and have traced a number of them to a win32 trojan variously named {note.com,Qaz.Trojan,QAZ.worm,TROJ_QAZ.A, Trojan/Notepad,W32.HLLW.Qaz.A}. if you're so inclined, you can test for this by telnetting to port 7597 on the machine that scanned you. http://vil.nai.com/villib/dispVirus.asp?virus_k=98775 for details. ken

1 0

Re: NANOG 20 River Rafting *unofficial* Trip
by Nanog20＠aol.com 27 Sep '00

27 Sep '00

In a message dated 9/27/00 12:08:55 AM Eastern Daylight Time, aaronm(a)toothpick.net writes: > Ron, > > What time is this event? Itinerary is availabe at Keyword...err... I mean from the main rafting info URL. :-) <A HREF="http://nanog.aol.com/nanog-raft.htm">WHITEWATER RAFTING TRIP</A> <A HREF="http://nanog.aol.com/raft-itin.htm">ITINERARY FOR SATURDAY 21ST OCTOBER</A> cheers! -ron

1 0

Re: NANOG 20 River Rafting *unofficial* Trip
by Sean Donelan 27 Sep '00

27 Sep '00

> http://nanog.aol.com/nanog-raft.htm Wow, this is awesome. Not even AOL's strategic partners have a subdomain under AOL.COM. Or even AOL wasn't brave enough to say "AOL Keyword: NANOG" :-) The rafting trip looks cool too.

3 2

Re: netscan.org update
by John Fraizer 27 Sep '00

27 Sep '00

On Tue, 26 Sep 2000, Todd Lyons wrote: > John Fraizer wrote: > > > Liken it to the Gas company driving up and down your street with a sniffer > > looking for leaks (SMURF amps) and someone walking up to every house in > > But do you not consider this the equivalent of using a lighter as the > sniffer? > -- > Blue skies... Cannonball http://www.mrball.net > * People are more violently opposed to fur than leather because * > * it's safer to harrass rich women than motorcycle gangs. * > "Well M'am... It looks like your new stove is all set. Just one more check. [click] [click] <BOOM!> OOPS... Sorry bout that. We forgot to set the 'no LP directed-explosion' command on your stove. We'll get that fixed right up." Sorry... I couldn't resist. I do understand where you may draw that conclusion however. Testing for the presence of gas (smurf amplifiers) with a sniffer (single ICMP echo-request scan) is NOT the same as simply throwing a match at the gas main (waiting for an attack). So, the simple answer to your question is no. --- John Fraizer EnterZone, Inc

1 0

NANOG 20 River Rafting *unofficial* Trip
by Nanog20＠aol.com 27 Sep '00

27 Sep '00

AOL Inc is hosting an "unofficial" social event for those of you arriving early in Washington DC for NANOG 20. What: White water rafting on the Shenandoah River URL: <A HREF="http://nanog.aol.com/nanog-raft.htm"> http://nanog.aol.com/nanog-raft.htm</A> How much: $25 to secure a seat When: Saturday, October 21st Where: We will pick up and return you at the Renaissance Hotel. Who: The first 40 respondents via fax. You must complete the waiver form and size information for wet suits. Please see URL for additional directions and information. See you there! Ron da Silva America Online, Inc.

2 1

Web page for DNSSEC workshop
by Edward Lewis 26 Sep '00

26 Sep '00

Sorry for not announcing this sooner. There is a web page with information regarding registration a DNSSEC workshop to be held in conjunction with NANOG 20 (a day later and close by). I was giving those who asked early access to sign up, and a few did. In case you haven't seen this, here is information on the workshop. http://www.nanog.org/mtg-0010/dnssec.html -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NAI Labs Phone: +1 443-259-2352 Email: lewis(a)tislabs.com "It takes years of training to know when to do nothing" - Dogbert Opinions expressed are property of my evil twin, not my employer.

1 0

FW: netscan.org update
by Roeland M.J. Meyer 26 Sep '00

26 Sep '00

> > Simpler than what you suggest is to read RFC 2644, then turn off > > directed broadcasts in routers being deployed, and making the > > default be > > DISABLED on new routers. > > I agree. But, for some reason, that isn't working as well as > it should. BTW, one feature that has been enabled for years > is a default ingress filter that blocks inbound packets that > have a source addr from inside the net-block (obviously wrong > or an attack). Because bcast addrs values are configuration > dependent, it is not possible to use such a generic filter. > However, it should be possible to build dynamic bcast > scanning into a router such that it scans the internal net > for bcast addrs and subsequently ingress filters all packets > to those source addrs that do not originate on the local > netblock. This will not solve the immediate problem with > existing routers. But, that same method can be used to scan > the /24 and auto-generate the required filter statements for > the firewall. The upstream can run it the other way, for the > client, except that they would be egress filtering. This > method requires no in-addr.arpa edits. > > > I'd rather see sites spend their time on that rather than > > adding INADDR entries to their domains. Remember that > delegations to other > > organizations (i.e. clients of ISPs) are able to subdivide networks > > further, and that won't be apparent to the ISP. > > Agreed, that's why I also wrote about dynamic bcast discovery methods. > > In case anyone missed my point, using BGP blackholing becomes > anti-social behavior when more surgical techniques are > available. Moreso when such techniques aren't even explored > before implementing the blackhole method. > > MAPS has only gained a modicum of acceptability because more > socially acceptable methods were tried and subsequently > failed. Moreover, they have been shown to not even be > feasible. This is NOT the case with the smurf-amp problem. I, > for one, am NOT convinced that sufficient thought has been > directed at more socially acceptable alternative solutions. >

1 0