- Test - lists.nanog.org

The Cidr Report
by Tony Bates 21 Jan '00

21 Jan '00

This is an auto-generated mail on Fri Jan 21 12:00:02 PST 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 21Jan00 0) General Status Table History ------------- Date Prefixes 140100 69862 150100 70956 160100 70982 170100 71135 180100 70228 190100 70246 200100 70143 210100 70096 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 219.91.160.0/22 from AS7742 *** Bogus 219.91.164.0/23 from AS7742 AS Summary ---------- Number of ASes in routing system: 6488 Number of ASes announcing only one prefix: 3493 (1893 cidr, 1600 classful) Largest number of cidr routes: 707 announced by AS701 Largest number of classful routes: 984 announced by AS701 1) Gains by aggregating at the origin AS level --- 21Jan00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 384 142 242 63.0% BCnet Backbone AS7046 410 267 143 34.9% UUNET-CUSTOMER AS9269 135 25 110 81.5% Hong Kong CTI AS2609 125 16 109 87.2% EUnet-TN AS1221 623 516 107 17.2% TELSTRA-AS AS7657 285 185 100 35.1% The Internet Group Limited AS7545 153 60 93 60.8% TPG Internet Pty Ltd AS6429 206 114 92 44.7% RDC-INTERNET AS4293 256 164 92 35.9% Internal ASN for C&W AS2715 156 65 91 58.3% REDERIO-AS AS174 563 479 84 14.9% Performance Systems International AS7496 119 39 80 67.2% Power Up AS705 270 193 77 28.5% ALTERNET-AS AS577 253 177 76 30.0% Bell Nexxia Backbone AS3749 135 61 74 54.8% TECNET AS9304 94 23 71 75.5% Hutchcity AS3602 315 249 66 21.0% Sprint Canada Inc. AS4200 170 105 65 38.2% AGIS (Apex Global Information Ser AS1727 138 76 62 44.9% MRMS-WEST AS816 244 185 59 24.2% UUNET Canada (ASN-UUNETCA-AS4) AS4740 343 285 58 16.9% Ozemail Pty Ltd (ASN-OZEMAIL) AS7260 103 46 57 55.3% NORLIGHT AS209 377 325 52 13.8% Qwest Communications AS4151 94 48 46 48.9% USDA Internet Access Network AS684 89 44 45 50.6% Manitoba Regional Network Backbon AS4755 120 77 43 35.8% Videsh Sanchar Nigam Ltd. India AS701 984 942 42 4.3% Alternet AS7568 56 16 40 71.4% C.S. Communications Co., Ltd. AS3549 154 115 39 25.3% Frontier GlobalCenter AS11127 124 85 39 31.5% UNKNOWN For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: Wireless cards for NANOG18
by Susan R. Harris 21 Jan '00

21 Jan '00

Now I see what you mean. Who did you mean to send this to. On Fri, 21 Jan 2000 robert(a)UU.NET wrote: > > Speaking of wireless cards, I was unable to get anyone here at UUNET > interested in the fact that my laptop was stolen. (Many things have changed > in the past few years. UUNET is not what it used to be.) I don't think we > even have insurance. > > If the offer to compensate John Brown <jmbrown(a)ihighway.net> is still good > please contact him as his business is still out 1 aironet card :( > >

1 0

Wireless cards for NANOG18
by Susan R. Harris 21 Jan '00

21 Jan '00

Greetings everyone - we wanted to let you know that Merit is looking for wireless sponsors for the upcoming meeting in San Jose. We've been offered the loan of several dozen cards, but if possible, we'd like to have even more available for the mobile among you. Our preferred formats are: - 802.11 compliant, Direct Sequence Spread 2.4 GHz (DS) 2 Mb/s, 11 Mb/s - 802.11 Compliant, Frequency Hopping 2.4 GHz (FH) - 2.4 GHz Non-802.11 (traditional WaveLAN, Roamabout, etc.) - 915 MHz Non-802.11 (Roamabout) Thanks in advance, and please contact us at nanog-support(a)merit.edu.

1 0

Fwd: stream.c - new FreeBSD exploit?
by Allan Carscaddon 21 Jan '00

21 Jan '00

Fresh from BUGTRAQ: >Approved-By: aleph1(a)SECURITYFOCUS.COM >Delivered-To: bugtraq(a)lists.securityfocus.com >Delivered-To: bugtraq(a)securityfocus.com >Date: Tue, 18 Jan 2000 14:44:38 -0800 >Reply-To: The Tree of Life <ttol(a)JAMES.KALIFORNIA.COM> >Sender: Bugtraq List <BUGTRAQ(a)SECURITYFOCUS.COM> >From: The Tree of Life <ttol(a)JAMES.KALIFORNIA.COM> >Subject: stream.c - new FreeBSD exploit? >X-To: bugtraq(a)securityfocus.com >To: BUGTRAQ(a)SECURITYFOCUS.COM >X-Loop-Detect: 1 > >I've been informed today by an irc admin that a new exploit is circulating >around. It "sends tcp-established bitstream shit" and makes the "kernel >fuck up". > >It's called stream.c. > >The efnet ircadmin told me servers on Exodus (Exodus Communications) were >being >hit and they managed to get a hold of the guy. When asked what was going >on, he just said "stream.c". > >When I talked to another person to ask if he had 'acquired' the source, he >said he wasn't going to give it out. I asked him if he had a patch for it, >and he replied "the fbsd team is working on it. No patch is available right >now." > >What's the importance of this? Major companies such as Yahoo >(www.yahoo.com) and others run freebsd. > >According to the irc admin, a simple reboot fixes it. "Your box reboots or >dies." He also stated, when asked if anything noticeable happened, that >"nothing unusual [happened]". > >The only log that he could provide was this one: > >---snip--- > >syslog:Jan 18 12:30:36 x kernel: Kernel panic: Free list empty > >---snip--- > >One thing of note: he also stated this happened on non-freebsd systems, >which is contrary to what the other person said, who was "under the >impression it was freebsd specific." > >I have the source, which I'm not going to post for 2-3 days (give time for >fbsd to work on the fix). If it isn't out before the 21st, I'll post it up. > >---snip--- > >void usage(char *progname) >{ > fprintf(stderr, "Usage: %s <dstaddr> <dstport> <pktsize> <pps>\n", >progname); > fprintf(stderr, " dstaddr - the target we are trying to attack.\n"); > fprintf(stderr, " dstport - the port of the target, 0 = random.\n"); > fprintf(stderr, " pktsize - the extra size to use. 0 = normal >syn.\n"); > exit(1); >} > >---snip--- > >Thanks for listening to my ramblings, hope everything I said helps. > >- ttol >http://www.alladvantage.com/home.asp?refid=AME389 >Get Paid to Surf. It works actually, cause people get thousands of dollars >a month from it...it's neet :P My id is AME389 - use it! :)

3 2

New form of packet attack named Stream
by Henry R. Linneweh 20 Jan '00

20 Jan '00

anyone have a preventative method for this? -- Thank you; |--------------------------------------------| | Thinking is a learned process so is UNIX | |--------------------------------------------| Henry R. Linneweh

4 3

NON-OP: Paintball and BBQ Outing Sunday B4 NANOG 18
by William B. Norton 20 Jan '00

20 Jan '00

Hi all - I've reserved the WoodStalk paintball field down in Santa Cruz for folks who are interested playing paintball *Sunday* Feb 6th (before NANOG) If previous paintball outings are any indication, it should be a blast! I can only take about 20 or so people, so in fairness I'll take folks on a first-come first-serve basis. The Game: For those who haven't played before, the basic paintball game is Capture the Flag but with paint ball guns. Once shot you are out of that 20 minute game. Logistics: To avoid car issues I have reserved transportation that will pick us up at 10:30AM sharp on Sunday at the Doubletree and take us to the field, returning us to the Doubletree around 3:30 or so. We'll fire up a BBQ for hamburgers, hot dogs, etc. The cost is $30 per person and I'll need to get a check/credit card deposit to hold spaces (sorry, otherwise the cancellation issues creep in). First time players are welcome: see http://www.woodstalk.com for details (you should bring a headband, hat, change of clothes, towel, etc.) If you want to reserve a spot, send me private e-mail. Invite people you'd like to shoot ;-) We'll fire up the burgers when we arrive and start the games at high noon. Hope to see you there - Bill

1 0

Fw: Administrivia: ORBS
by Sehmel, William C. 19 Jan '00

19 Jan '00

Got this from bugtraq. Bill Sehmel Peninsula School District Information Services Jr. Network Engineer. 253-857-8180 bsehmel(a)mail.peninsiula.wednet.edu -----Original Message----- From: Elias Levy <aleph1(a)SECURITYFOCUS.COM> To: BUGTRAQ(a)SECURITYFOCUS.COM <BUGTRAQ(a)SECURITYFOCUS.COM> Date: Wednesday, January 12, 2000 1:48 PM Subject: Administrivia: ORBS >It seems the folks at ORBS (orbs.org) have decided that since our mail >server its hosted of above.net, and above.net is filtering their >probes since they claim they are a DoS, ORBS is adding any mail servers >connected via above.net (including ours) to their spam relaying list, >regardless that our servers have never perform relaying functions. >I've emailed them but so far they have not responded. You may wish >to email them (orbs(a)orbs.org) and voice your dissatisfaction. >Of curse if our email to you is being blocked by ORBS then you will >probably not receive this message ;-) > >-- >Elias Levy >Security Focus >http://www.securityfocus.com/

22 61

Re: Fw: Administrivia: ORBS
by Martin Cooper 19 Jan '00

19 Jan '00

woods(a)most.weird.com (Greg A. Woods) wrote: > [ On , January 15, 2000 at 22:24:53 (-0800), Paul Vixie wrote: ] > > Subject: Re: Fw: Administrivia: ORBS > > > > So, Greg, have you stopped beating your wife? (Never mind.) > > Oh, boy, you were being a real asshole the other day.... > > I'll have you know that I didn't see this until today because I've been > in the hospital caring for my wife who fell and broke her ankle very > badly the other day. > > If I were an American I'd have your ass in court. But I'm not a > slandering inconsiderate bastard. Oh dear - I think you've misunderstood. "Have you stopped beating your wife?" is irony - the point being that you can't answer "Yes" or "No" without logically acknowledging that you have at some point beaten your wife, even if you haven't. You seem to want people to accept that imposing your will on other people without asking (allegory: "beating your wife") is ok in one context (ORBS scanning people's mail servers without asking), but not in another (spammers using people's mail relays without asking). The "I don't want anyone imposing their will on me without asking." option doesn't exist in your argument, just as the "I've never beaten my wife." option didn't exist in Paul's question. M.

2 1

Re: Fw: Administrivia: ORBS
by Paul Vixie 19 Jan '00

19 Jan '00

Just hit D now. Move along. There's nothing to see. I warned you. > So far AboveNet hasn't denied that there are/were open relays on "their" > networks either, at least not to my knowledge. Well, if they didn't deny it, then it MUST be true. Q.E.D. > All we know now is that > ORBS can no longer be used to prove that there are none remaining. So, Greg, have you stopped beating your wife? (Never mind.) > ORBS also maintains that they do not, nor have they ever, systematically > and preemptively scanned any networks. They also actively discourage > users of their web interface from doing such scanning and I've heard > second hand that they do in fact cut off access to the web interface > by anyone attempting such scans. Your second hand information differs significantly from mine. > Eg. even though my own network is assigned from a UUNET block, I am the > only one who owns the rights to receive packets at my IP addresses, or > indeed the right to block such packets (to the extent that packets to or > from my network don't cause some transit provider grief in the form of a > denial of service attack or such). You're assuming that packets with your IP address on either end of them are sacred in some way and have the right to pass unmolested on any wire no matter who pays for that wire or what their preferences are. I find that reasoning strikingly similar to what spammers say about THEIR traffic, and I'm starting to wonder why you are defending the efforts of an anti-spam organization (ORBS) if your ethical sympathies are all completely compatible with "theft of service"? > ... -- it should only be AboveNet's customers who have any > right to refuse service to anyone, not AboveNet themselves. So your provider ought not do anything about smurf attacks forged in your name, either? > That's certainly what I expect of my provider. I'm very happy that you have a choice of providers, and that you can find one who will sell you the kind of service you want. It sounds, though, as if you're not quite as happy that I have the same choice, or that I exercise it differently than you exercise yours. Why is that? > Your absolutely right on that > last point though -- AboveNet's customers can decide with their feet. > It won't be an easy decision though as in all other aspects AboveNet > seems to be a premium service. Gee, I wonder if there's a connection between this aspect and all others, or if the premium aspect is merely accidental or in spite of the blocking aspect? (HINT! That's a rhetorial question, the answer being "yes, there is a connection.") > > They are looking for port 25 on all addresses within /16'. You call it > > what you want, I'll call it a port scanner. > > Are they really? Can you prove it? ORBS and MAPS have a mutual nonaggression pact, which I'm skating near the edge of by entering this discussion at all. No, I won't be "proving it." -- Paul Vixie <vixie(a)mibh.net> >> But what *IS* the internet? > It's the largest equivalence class in the reflexive transitive > symmetric closure of the relationship "can be reached by an IP > packet from". --Seth Breidbart

4 3

Problems in Seattle/Northwest
by Sean Donelan 19 Jan '00

19 Jan '00

The northwest and seattle appear to be having a variety of problems. This weekend several people were killed in storms and downed power lines serving some 300,000 customers. Besides those problems, I've also noticed ongoing internet problems in the Northwest area since the weekend. It seemed concentrated to Sprint and UUNET, but I've had problems reaching sites in the Northwest with several providers sporadically. This is the first news story I've seen on the subject. http://www.seattlep-i.com/local/smrf18.shtml

1 0