- Test - lists.nanog.org

SMURF Detector Software
by prue＠ISI.EDU 10 Feb '99

10 Feb '99

Hi, I, as many of you have had to deal with various types of denial of service attacks or other attacks. A good number of these attacks can be characterized by one host sending to many destinations, many hosts on one subnet sending to one destination, one host sending to very similar or the same IP address (host/port scans) etc. Confronted with detecting this to warn my customers if they are victims, or admonish my customers if they are the culprits, I wrote a tool to give me some indication when this kind of thing is going on, while it is still happening using netflow data. I modified Ciscos' fdget program they make available on one of their ftp sites to look for self similar source or destination addresses in netflow data blocks. Thanks go to Cisco for leting me distribute this to the group. You can give it a try if you want. It is avaliable via anonymous ftp on venera.isi.edu in subdirectory mon. The file names you will need to know to retrieve by name are: smurfind.c C program README.smurfind documentation flowdata.h C program definitions (written by cisco folks) smurfind.rc sample data file You can't do an ls on the directory. I used version 5 netflow data to debug the code. I haven't tested it against version 1 or other versions. B.T.W. The program dumps legitimate data as suspect. If however the rate at which the program shows suspect data changes, that is when you need to look more closely. The output from the program is very valuable to confront the guilty party to demonstrate that something inapropriate is going on. Let me know what you think. Walt Prue Los Nettos

2 1

Discussing, or not discussing, major business outages
by George Herbert 10 Feb '99

10 Feb '99

I am not going to name names, but I have it on good authority that late this week a large hosting provider went out of business abruptly. So far, the news that it did so has not been discussed anywhere, that I can tell, which is starting to disturb me. There have been some significant dislocations related to this shutdown, obviously, and this sort of event seems to me to be something that involved parties should be at least sending warnings out on nanog or other appropriate discussion lists. I and a third party ISP executive discussed this lack of discussion some yesterday; their opinion is that businesses and ISPs formerly hosted at the now defunct site are loath to admit their connecitvity is down lest their customers defect en masse causing a snowball of business failures, when they will be up and stable via new providers shortly and are not themselves fundamentally unsound. I understand that logic but cannot entirely agree with it. I would like to see the issue discussed in general terms at least; what is appropriate for notifications, what are fair responsibilities to customers, the public, other ISPs etc. in terms of this sort of event. -george william herbert gherbert(a)crl.com I am not employed by, and do not speak for, CRL.

10 15

Re: info
by hypnotherapy254＠biocentricb.net 09 Feb '99

09 Feb '99

ACCEPT CREDIT CARDS ONLINE! INCREASE YOUR PROFITS! GO HERE--> http://www.merchantonline.com or http://www.creditco.com

1 0

ADMIN: reminder about posting procedures
by John Hensley 09 Feb '99

09 Feb '99

Hello everyone, There've been a ton of bounces because of this lately, so here's a reminder that to send mail to nanog(a)merit.edu, you need to be subscribed to nanog-post(a)merit.edu. See http://www.nanog.org/email.html. Another document to review while you're thinking of posting, especially in the wake of the "spam whore" fiesta, is the charter of this list, at http://www.nanog.org/aup.html. -- John Hensley <hensley(a)merit.edu> Merit Network, Inc.

1 0

FIBER CUT: South Bend Indiana
by Sean Donelan 09 Feb '99

09 Feb '99

MCI/Worldcom is reporting a fiber cut in South Bend Indiana as of 4:00pm CST 9-FEB-1999. Customer service recordings say techs are en-route. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Palo Alto Power Hit
by Sean Donelan 09 Feb '99

09 Feb '99

Apparently my normal sources inside the carriers got stomped on by senior management, and aren't allowed to talk to me anymore. So here is a summary of unofficial reports from various unofficial sources. The West Coast is experience severe weather, including storms and flash flooding. There are multiple weather advisories up and down most of the coast. Approximately 55,000 people are without power. At the moment, no reported deaths due to the storms. Internet related incidents There were power problems through the early morning hours. A major power surge hit the Palo Alto grid at 7:16am PST. I haven't seen any SCADA information on just how large the surge was. This appears to be the instigating factor for several carrier outages. Several significant Internet trunks pass through the Palo Alto area. Customers of several carriers reported problems including MCI/Worldcom/UUNET/MFS, GTE/BBN, and Sprint. One person reported loss of residential phone service, which may indicate Pacific Bell was also affected. A lot of dead routes, and partially routed CIDR blocks seem to indicate those backbones may have been partitioned for some time. UUNET and MFS customers reported loss of a Palo Alto node. I don't know if this referred to their equipment in the PAIX building, or at another Palo Alto location. MFS had a power problem at PAIX a few years ago, but elected to use utility power instead of PAIX power. PAIX reported their power equipment absorbed the surge, and continues to operate normally. BBN at Stanford appeared to have some communication problems, no word if any rats were implicated. MAE-West-San Jose, Mae-West-Ames, and PacBell AADS appear unaffected. Sprint didn't appear to have any circuits down, but had enough problems with the few people they peer with externally, that Internet routing wasn't working well. A common report was the power surge either blew the fuses, or the entire power supply on a MFS OC192 piece of equipment. This may be the source for some reports of a fiber cut in the area. Most problems cleared up around 9:15PST after the fuse/equipment was repaired. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

ICANN forces the issue
by Henry Linneweh 09 Feb '99

09 Feb '99

ICANN Releases Guidelines For Domain Registrars http://www.internetnews.com/bus-news/article/0,1087,3_65921,00.html Hopefully this will bring some form of sanity to the process. Henry R. Linneweh

1 0

Palo Alto Power Hit
by Sean Donelan 09 Feb '99

09 Feb '99

The City of Palo Alto had a power problem early this morning, estimated at 7:30PST 9-Feb-1999. Portions of the city were without power, and there are some reports of some telelcommunications carriers in the area being affected. So far none of the carriers I've contacted would confirm or deny any problems, although some customers of carriers did report problems. P.S. The Digital/Compaq PAIX sent a note saying they were NOT affected. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2

Fiber Outage
by Tim Wolfe 09 Feb '99

09 Feb '99

FYI: I have heard that there is a fiber cut in Palo Alto that has directly affected 1.2 Gbps of capacity into PA... Tim ---------------------------------------------------- Timothy M. Wolfe | Why surf when you can Sail? tim(a)clipper.net | Join Oregon's Premier Sr. Network Engineer | Wireless Internet Provider! ClipperNet Corporation | http://www.clipper.net/ ----------------------------------------------------

2 1

SNMP Hub management tools
by Matt Braun 09 Feb '99

09 Feb '99

Since the System monitoring query had such good results, I am going to try a variation. I am looking for SNMP management tools (windows or Unix) that can use multiple MIBS for an environment with hubs from several different vendors. The tools need not be GUI, and I am espically interested in 'free' tools. The functionality I am looking for includes (but is not limitted to): gathering port / board pps and bps information port link status the ability to determine what port an IP addresses / MAC addreses is connected to enable / disable ports reset hub / hub management Don't bother reporting on Openview and Optivity...I know about those :-) Please send responses to me personally (with URLS or other appropriate pointers) and I will digest / sumarize them and send them to the list. Matt

2 2