- Test - lists.nanog.org

NANOG 20 Meeting Information -- Registration Open
by Carol Wadsworth 23 Aug '00

23 Aug '00

**************************** NANOG 20 Meeting Information **************************** All, Registration is now open for the Fall NANOG 20 meeting, October 22-24, at the Renaissance Washington D.C. Hotel. The meeting will be hosted by America Online. ---------------------- Registration ---------------------- https://www.merit.edu/nanog/registration.form.html ---------------------- Hotel Reservations ---------------------- Renaissance Washington D.C. Hotel 999 9th Street, N.W. Washington, D.C. 20001-4427 Direct Hotel Reservations: 202-898-9000 Central Reservations: 800-228-9290 Room Block Name: NANOG Dates Available: October 21-24 Rate: $169/single; $189/double Cut-off date: September 21 ---------------------- Call for Presentations ---------------------- Submission deadline: September 11 http://nanog.org/mtg-0010/call20.html http://nanog.org/mtg-0010/call20.pdf Hope to see you in Washington, D.C! Carol Wadsworth Merit Network, Inc.

6 7

FCC's NRIC to start monitoring ISP Reliability
by Robert Cannon 23 Aug '00

23 Aug '00

NRIC V held its meeting at the FCC today. NRIC announced that the one year voluntary trial period of monitoring non traditional network reliability, including ISP reliability, will be initiated in September. Letters have been sent out to industry associations announcing the voluntary trail and inviting participation. The letter includes a template for filling out outage information. Data collected from the voluntary trial will be posted at the NRIC website www.nric.org. There will be a mid-year report and a report at the end concerning whether NRIC recommends going forward with this type of outage reporting. The FCC Designated Federal Officer is Kent Nilsson. A real audio recording of the NRIC meeting is available on the FCC website. -B www.cybertelecom.org ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup

1 0

ARIN approvals
by Timothy Brown 22 Aug '00

22 Aug '00

How long does ARIN typically take to approve a request, assuming all documentation is in place? Tim

1 0

Re: Now the idiots at ORBS are probing random dial-ups
by John Payne 22 Aug '00

22 Aug '00

On Mon, Aug 21, 2000 at 11:22:13PM -0700, Keith Woodworth wrote: > > > On Mon, 21 Aug 2000, John Payne wrote: > > >>What trouble does MAPS cause? RSS and DUL are blocking quite a bit of spam > >>for *me*. Dunno how much the RBL is blocking... 'cos I'm behind a BGP feed. > > I find that RBL does not really block all that much overall. We dont use > RSS or DUL here. Though one fellow posted a link to his stats on > inet-access to his mail stats as graphed by RRDTool/Cricket. Shows most of > the mail tagged as spam is blocked via RSS. Don't forget - the main purpose of the RBL is not to block spam... its to educate spam(mers| friendly networks). If the RBL is blocking lots of mail, then its failed its primary purpose. -- John Payne http://www.sackheads.org/jpayne/ john(a)sackheads.org http://www.sackheads.org/uce/ Fax: +44 870 0547954 340% tax? http://www.boycott-the-pumps.com/

4 5

Now the idiots at ORBS are probing random dial-ups
by Barry Shein 22 Aug '00

22 Aug '00

Obviously random dial-ups have different hosts logged on each time they try, often no one is logged on. So of course they get to imagine whatever they like (e.g., when no one is dialed up that maybe they've been firewalled.) Somehow their broken software imagines it sees the same open relay repeatedly on some random dialup IP, which of course is incredibly unlikely. Is there any reasonable way to tell these ORBS and MAPS losers "possibly good intentions, but so badly run that: no thanks" from the net administrator community. I'm really getting sick of these incompetent self-promoters wasting peoples' times. Maybe if they heard enough voices telling them "no thanks" they'd get the hint their efforts are not appreciated and not wanted. Oh, and a word from ORBS' fearless leader: From alan(a)manawatu.gen.nz Sun Feb 7 23:11:52 1999 >As for you, fuck off. Your attitude has got you a permanent entry in ght >shub list. No doubt something to do with all the attention I get from these jerks. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo*

6 8

ICMP broadcast amplifiers
by Troy Davis 21 Aug '00

21 Aug '00

netscan.org has rechecked all routed /24s for ICMP directed broadcasts (smurf amplification) and made public the complete list of misconfigured networks. The probes ran from 8/18-8/21. The results are queryable and downloadable at http://netscan.org Cheers, Troy

1 0

RE: lame delegations
by Karyn Ulriksen 21 Aug '00

21 Aug '00

> Unless I misunderstand what you mean, my version of BIND (8.2.2p3) > doesn't do that. > > $ host -a 2.254.92.204.in-addr.arpa > 2.254.92.204.in-addr.arpa PTR most.weird.com > 2.254.92.204.in-addr.arpa PTR mail.weird.com Interesting. I actually haven't tried this since BIND 4. It made sense that it wouldn't so I assumed it shouldn't and further assumed that in BIND 8 that it didn't as well. (Sorry about that last sentence!) Anyways, I think you catch up with me in your next paragraph here ... So does the reverse resolve work correctly with the two PTR responses for most resolvers? Karyn > > I don't think it round-robins them though (that's the order > they appear > in my zone file and several queries in a row always return > them in that > order -- I've not read the code recently so I don't remember > for sure), > because normally you don't want to round-robin them, and if > you did you > wouldn't be able to distinguish between the primary host and > its aliases > with the BIND resolver library: > > $ host -a 204.92.254.2 > Name: most.weird.com > Address: 204.92.254.2 > Aliases: mail.weird.com > > (The "primary", or "official" hostname comes from the > "h_name" field of > "struct hostent", which is returned by gethostbyaddr() and friends.) > > > << Yes, I know what kind of flack that this > > will lead to, but the logic isn't that wierd... > > I can't give you any flack about multiple PTRs, I use them too! :-) > > -- > Greg A. Woods > > +1 416 218-0098 VE3TCP <gwoods(a)acm.org> > <robohack!woods> > Planix, Inc. <woods(a)planix.com>; Secrets of the Weird > <woods(a)weird.com> >

2 1

RE: Verio NOC Contact
by Karyn Ulriksen 21 Aug '00

21 Aug '00

800-551-1630 and 214-290-8620 Be prepared to send them your logs, etc. Of Note: About two months ago we got hit by about a 40mbps inbound slaughter on one of our pipes from a server on their network. Even with introducing the FBI into the whole circus, it still took them a little over 48 hours to squelch it (filters or no). The whole time they told us that they were doing "everything they could", "somebody was working on it right now", etc. If you're getting hit by one of these TRINOO type attacks and not getting results, I feel for you. I wish their was a forum or some type of coalition that could help networks that have to suffer from other networks bad manners. I was *very* unhappy with Verio's response time and general attitude when their dog got into our backyard... Karyn > -----Original Message----- > From: Jeremy T. Bouse [mailto:undrgrid@toons.UnderGrid.net] > Sent: Monday, August 21, 2000 6:18 AM > To: NANOG > Subject: Verio NOC Contact > > > Anyone happen to have a contact name/number for Verio's NOC or > Abuse/Security Dept. Seems they are very unresponsive to DoS > attacks I've > been receiving. A more recent incident has the markings of > being a Luser > that was on a Bellsouth ADSL line doing the same attempts jumping over > to Verio after being dealt with by Bellsouth. > > Respectfully, > Jeremy T. Bouse > UnderGrid Network Services, LLC > > -- > ,------------------------------------------------------------- > ----------------, > | Jeremy T. Bouse - UnderGrid Network Services, LLC - > www.UnderGrid.net | > | All messages from this address should be atleast > PGP/GPG signed | > | Public PGP/GPG key available through http://wwwkeys.us.pgp.net | | If received unsigned (without requesting as such) DO NOT trust it! | | Jeremy.Bouse(a)UnderGrid.net - NIC Whois: JB5713 - undrgrid(a)UnderGrid.net | `--------------------------------------------------------------------------- --'

1 0

Verio NOC Contact
by Jeremy T. Bouse 21 Aug '00

21 Aug '00

Anyone happen to have a contact name/number for Verio's NOC or Abuse/Security Dept. Seems they are very unresponsive to DoS attacks I've been receiving. A more recent incident has the markings of being a Luser that was on a Bellsouth ADSL line doing the same attempts jumping over to Verio after being dealt with by Bellsouth. Respectfully, Jeremy T. Bouse UnderGrid Network Services, LLC -- ,-----------------------------------------------------------------------------, | Jeremy T. Bouse - UnderGrid Network Services, LLC - www.UnderGrid.net | | All messages from this address should be atleast PGP/GPG signed | | Public PGP/GPG key available through http://wwwkeys.us.pgp.net | | If received unsigned (without requesting as such) DO NOT trust it! | | Jeremy.Bouse(a)UnderGrid.net - NIC Whois: JB5713 - undrgrid(a)UnderGrid.net | `-----------------------------------------------------------------------------'

1 0

DDOS attacks lately?
by John O Comeau 21 Aug '00

21 Aug '00

It's been a while since the big-name websites got DDOS'ed, but some large data centers I know of still see hosts on their networks getting DDOS'ed once or twice a day. It's not uncommon for those with only DS3 connections to get them completely clogged for several minutes with attack traffic. If it happens on the UUNet connection then it can get blocked quickly but other NOCs often take a half hour or more to answer. And as discussed earlier on this list, the major players will NOT maintain access lists on their routers for their customers. (At least, that's what they tell their DS3-and-smaller customers). One thing I've recommended to my clients is to temporarily add a (shorter prefix) route through one of their upstream providers who _will_ maintain access lists for them. For example, 1.2.3.4 is under attack. 1.0.0.0/8 is the netblock being advertised through teir 1 providers, and the DS3's to those major providers is being swamped with attack traffic. Quickly modify the BGP advertisement through ???.net to advertise 1.2.3.0/24 as a route. Since that is a shorter prefix, it becomes the preferred route to 1.2.3.4, and since ???.net will maintain access lists providing, let's say, CAR for UDP and ICMP, that's all that needs to be done to block that particular attack. That plan quickly falls apart if several hosts are getting attacked at once, though if your total NORMAL inbound traffic is smaller than the committed rate on ???.net, you can split all your netblocks into two subnets and advertise those through ???.net for the duration of the attacks. Or if it's an ACK attack, or something else that can't easily be rate-limited or blocked, you're still screwed until you can reach the provider and have the target null-routed. I know this causes the global routing tables to increase temporarily, BUT it keeps the datacenter's routes from flapping due to losing the BGP sessions with the upstreams, which often happens if nothing is done about the attack. Another interesting point to note is that lately, most attacks have been for the age-old purpose of taking over IRC channels by knocking out the host on which the operator's bot is running. At least, none of my clients have seen their websites getting attacked lately. Maybe the calm before the storm? Of course, there is also the option of stopping them at the source, which is time-consuming and is usually done after it has been blocked via other means. And for every compromised server or workstation (usually on .edu domains) that gets fixed, two more take its place. Plus, we rarely get helpful responses from non-US domains (primarily because we're unwilling to make the international long-distance calls and find out we don't have any languages in common). It's looking like the only way to improve is to buy bigger connections; but in light of the Yahoo attack (800Mbps was the last word I guess?) how big is big enough? How many OC48 connections can _your_ data center afford? jcomeau(a)world.std.com aka John Otis Lene Comeau Home page: http://world.std.com/~jcomeau/ Disclaimer: Don't risk anything of value based on free advice. "Anybody can do the difficult stuff. Call me when it's impossible."

9 13