- Test - lists.nanog.org

'best'
by Bill Becker 16 Dec '98

16 Dec '98

Is anyone else seeing this crap from best.com besides me? I complained to them last time and received no reply. So i decided to filter parts of them and it's looking like i did the right thing. Here are a few entries from 209K of ejectamenta. Someone checked through an entire /19 for a place to login. Dec 12 18:32:02 139o-4700 105: Dec 12 18:32:01: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4783) -> 207.171.128.1(23), 1 packet Dec 12 18:32:06 139o-4700 106: Dec 12 18:32:05: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4791) -> 207.171.128.9(23), 1 packet Dec 12 18:32:09 139o-4700 107: Dec 12 18:32:08: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4800) -> 207.171.128.18(23), 1 packet Dec 12 18:32:13 139o-4700 108: Dec 12 18:32:12: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4807) -> 207.171.128.25(23), 1 packet ...etc. Annoying. Bill

6 8

Re: System and Network Monitoring
by Tim Salo 16 Dec '98

16 Dec '98

> Date: Tue, 15 Dec 1998 16:48:06 -0800 (PST) > From: Derek Balling <dredd(a)megacity.org> > To: nanog(a)merit.edu > Subject: System and Network Monitoring > > OK, I'm looking for "real world" data and not sales/marketing hype. > > I'm looking for a package to do network and system monitoring. It's a > heterogenous environment consisting of all manner of routers, at least 700 > servers (Mostly FreeBSD, but also Solaris and Network Appliance boxen). > [...] I would be interested to hear about your comparison of a commercial package such as HP OpenView with free alternatives. My inclination is towards a commercial package. I even suspect that it would be less expensive in the long run, plus it seems likely to free up your technical talent for revenue-producing activities. -tjs

1 0

heads up ... another imapd attack source
by Phil Howard 16 Dec '98

16 Dec '98

Just a few minutes ago, another attempted IMAPD breakin. This one originated from rock.careers.csulb.edu [134.139.149.100]. It was logged at Dec 14 16:59:56 CST.

10 11

Re: heads up ... another imapd attack source
by Roeland M.J. Meyer 15 Dec '98

15 Dec '98

At 04:54 AM 12/15/98 , Dave Crocker wrote: >At 05:17 PM 12/14/98 -0800, Roeland M.J. Meyer wrote: >>FYI: Not that I sell shell accounts anyway, but I additionally block all >>non-http access, from *.EDU, with tcp_wrappers and my POP3 is wrapped up in >>SSH. IMAPD was shot and buried(deleted) a long time ago. > >this means that any user who is traveling, and happens to try to get their >mail while accessing from a .edu site won't be able to pick it up. Only if they are accessing mail on MHSC systems, from an *.EDU dial-up. There are other dial-up options and MHSC has direct dial-up ports available. Also, we do allow VPN tunnels from *.EDU, but only to directed hosts with no routing and on advanced arrangement. The user that does so, does it under our TOS and AUP. >since imap popularity is growing, lack of imap service is also problematic. It's balance of problems. We consider the rootkit risk more severe than the loss of business from *.EDU sites. We have secure POP3 and Web-based (SSL) mail, we are investigating POP3 over SSL. Those services are allowed to *.EDU, from MHSC. As has been shown by others, IMAPD attacks are on the rise. It would not do for a security advocate to get rootkit'd, just think of the publicity <grin>. It's one of the things that keep me up at night. Many of the vulnerable systems are in *.EDU, as has already been shown to my satisfaction. Granted, MHSC has always viewed *.EDU is a huge potential security risk. That is an unapologized bias on our part. It is the nature of the beast. When the reference code, for IMAPD, becomes better written, or we (MHSC) re-write it ourselves, we will reinstantiate the IMAPD service. Until then, it remains dead. A current example is a spammer that I've been tracing for weeks. They always come from a different host, but it's obviously the same guys, they are very good. Many of the relays they use have been root'd. The latest one I've found is at sun.soci.niu.edu. So a SAINT run against it yourself and see how vulnerable they are. If they aren't root'd now, they soon will be, IMHO. I am quickly gaining the unsupported suspicion that spammers may be behind many of the IMAPD attacks. They are looking for hosts to send their spew from. Note that this *is* an unsupported view/suspicion, I claim no solid evidence. _________________________________________________ Morgan Hill Software Company, Inc. Roeland M.J. Meyer, ISOC (RM993) President and CEO. e-mail: <mailto:rmeyer@mhsc.com>mailto:rmeyer@mhsc.com Web-pages: <http://www.mhsc.com/~rmeyer>http://www.mhsc.com/~rmeyer Web-site: <http://www.mhsc.com>http://www.mhsc.com Colorado Springs, CO - Livermore, CA - Morgan Hill, CA -----------------------------------------(legal notice)-------- Note: Statements made in this message do not necessarily reflect the position of MHSC. All forcasts and projections are to be considered as forward-looking and presume conditions which may not be referenced herein. -----------------------------------------(/legal notice)-------

2 1

NANOG 15 Hotel
by Pam Ciesla 15 Dec '98

15 Dec '98

Possible hotel shortage in Denver for NANOG 15. The hotel people informed me that they have several meetings going on at the same time as NANOG 15. If you are planning on attending the NANOG 15 Meeting in Denver book your hotel early. The room block for NANOG is available until January 8, after that it's on space available only. Hotel and other info can be found on the NANOG webpage http://www.nanog.org. Any questions please contact me. Thanks Pam Pam Ciesla Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 Bldg.I, Suite C pam(a)merit.edu Ann Arbor, MI 48107

1 0

Anyone on this list from Australia?
by Pete Kruckenberg 15 Dec '98

15 Dec '98

Or are you familiar with ISPs in Australia? If so, would you please contact me privately so I might ask you a few questions about ISPs there? Thanks. Pete.

1 0

The Path to Fame and Riches -- NANOG Summer'99 Host
by Craig Labovitz 15 Dec '98

15 Dec '98

We are still looking for a NANOG Summer (sometime during the beginning of June'99) host. The main responsibilities of the host include: * Provide connectivity to the conference site (at least a T1) * Help provide ~10 PC/Macs and a printer for the terminal room (terminal room equipment is also often donated) * Provide staff to help with local logistics (e.g. identifying hotels) and conference setup (mainly wiring the terminal room and hubs in the conference room) All hotel costs (catering, lighting, room rental, cookies, etc.) are covered by the NANOG registration fees. In addition, the conference room hubs and wireless equipment are usually donated equipment (and some are owned by NANOG). The benefits of NANOG hosting include: * Reduced travel expenses for your staff to attend NANOG * Your company name forever engraved on the official NANOG t-shirt * Life-time, official membership in NANOG * Fame and riches Please send email to nanog-support(a)nanog.org if you are interested in hosting a future NANOG. - Craig -- Craig Labovitz labovit(a)merit.edu Merit Network, Inc. http://www.merit.edu/~labovit 4251 Plymouth Road, Suite C. (734) 764-0252 (office) Ann Arbor, MI 48105-2785 (734) 647-3185 (fax)

1 0

Spaghetti routes.
by Roeland M.J. Meyer 14 Dec '98

14 Dec '98

I seem to be getting one hell of a lot of hops between here and Toronto. It looks like they have a serious case of spaghetti routing in cerf.net. Does anyone know what's up? > ~ > traceroute www.mhsc.com >traceroute to falcon.lvrmr.mhsc.com (199.108.175.225), 30 hops max, 40 byte packets > 1 209.82.43.1 (209.82.43.1) 2.344 ms 2.176 ms 2.160 ms > 2 172.17.18.177 (172.17.18.177) 4.429 ms 4.436 ms 4.284 ms > 3 207.245.35.65 (207.245.35.65) 4.334 ms 4.411 ms 4.647 ms > 4 205.150.154.141 (205.150.154.141) 4.563 ms 13.403 ms 13.971 ms > 5 f000-10.bb2.tor2.f000-10.bb1.tor2.uunet.ca (205.150.242.109) 37.502 ms 190.594 ms 17.974 ms > 6 224.Atm4-0-0.GW3.NYC4.Alter.Net (137.39.75.21) 17.302 ms 18.527 ms 17.855 ms > 7 140.ATM2-0.XR1.NYC4.ALTER.NET (146.188.179.146) 17.266 ms 17.609 ms 22.412 ms > 8 189.ATM3-0.XR1.NYC1.ALTER.NET (146.188.178.86) 18.167 ms 19.935 ms 27.089 ms > 9 195.ATM11-0-0.BR1.NYC1.ALTER.NET (146.188.177.153) 20.739 ms 29.381 ms 34.891 ms >10 atm12-0.nyc-bb2.cerf.net (134.24.32.49) 24.081 ms 21.021 ms 19.815 ms >11 pos2-0-155M.nyc-bb4.cerf.net (134.24.29.162) 19.283 ms 22.170 ms 21.047 ms >12 pos12-0-0-155M.nyc-bb3.cerf.net (134.24.29.165) 20.439 ms 20.227 ms 20.116 ms >13 atm3-0-155M.phl-bb1.cerf.net (134.24.46.9) 549.826 ms 559.131 ms 507.581 ms >14 pos4-0-0-155M.nyc-bb1.cerf.net (134.24.46.169) 455.182 ms 454.303 ms 471.459 ms >15 atm9-0-3-155M.san-bb1.cerf.net (134.24.29.45) 1267.546 ms 1257.430 ms 1138.974 ms >16 pos0-0-155.san-bb6.cerf.net (134.24.29.130) 418.926 ms 410.702 ms 434.318 ms >17 atm6-0-622M.lax-bb4.cerf.net (134.24.29.142) 425.456 ms 362.121 ms 364.302 ms >18 pos3-0-0-155M.lax-bb1.cerf.net (134.24.29.133) 1190.588 ms 1130.962 ms 1180.913 ms >19 atm3-0-155M.sfo-bb1.cerf.net (134.24.29.42) 340.919 ms 297.623 ms 285.305 ms >20 fe9-0-0.sfo-bb2.cerf.net (134.24.29.118) 282.859 ms 287.957 ms 300.554 ms >21 atm3-0-155M.sjc-bb3.cerf.net (134.24.29.22) 337.961 ms 396.046 ms 412.056 ms >22 199.108.168.1 (199.108.168.1) 1133.342 ms 1299.682 ms 1149.291 ms >23 199.108.168.51 (199.108.168.51) 380.942 ms 307.255 ms 301.474 ms >24 falcon.lvrmr.mhsc.com (199.108.175.225) 309.010 ms 298.941 ms 309.333 ms > ___________________________________________________ Roeland M.J. Meyer - e-mail: mailto:rmeyer@mhsc.com Internet phone: hawk.lvrmr.mhsc.com Personal web pages: http://staff.mhsc.com/~rmeyer Company web-site: http://www.mhsc.com ___________________________________________________ Who is John Galt? - "Atlas Shrugged" - Ayn Rand

1 0

RE: Space in 55 South Market St
by Chris Mauritz 14 Dec '98

14 Dec '98

Why was ANY of this on the list in the first place? Geez. C Chris Mauritz Director, Systems Administration Rare Medium, Inc. chrism(a)raremedium.com -----Original Message----- From: Mike Leber [mailto:mleber@he.net] Sent: Monday, December 14, 1998 4:12 PM To: Alex Bligh Cc: nanog(a)merit.edu Subject: Re: Space in 55 South Market St On Mon, 14 Dec 1998, Alex Bligh wrote: > > We can provide you with 1 rack or even a cage of 6 if you like. We have > > generator power, battery backup, aircon, fiber to worldcom and pacbell, > > and it's staffed 24 x 7. > > In 55 South Market St itself? Yes. > If so, what floor and how much? 2nd floor and 14th floor. > Any cross connect (i.e. per circuit) charges? No charge for copper. Small charge for fiber in our conduit. > Can your guys do remote > feeding and watering of Cisco's (both 24x7 and we occasionally send > out new cards etc. that need fitting, circuits that need commissioning > etc. and expect to be charged by the hour)? Yes. Contact me off the list by phone or email. Mike. +------------------- H U R R I C A N E - E L E C T R I C -------------------+ | Mike Leber Direct Internet Connections Voice 408 282 1540 | | Hurricane Electric Web Hosting & Co-location Fax 408 971 3340 | | mleber(a)he.net http://www.he.net | +--------------------------------------------------------------------------- +

1 0

Space in 55 South Market St
by Alex Bligh 14 Dec '98

14 Dec '98

Does anyone have space in 55 South Market St SJ sufficient to house 1 rack? (or failing that 1x7507). UPS, Aircon & preferably Generator. Worldcom & PacBell fiber appreciated. GTEI need not apply. Has to be in the building, not down the road. -- Alex Bligh GX Networks (formerly Xara Networks)

2 4