- Test - lists.nanog.org

Re: National Infrastructure Protection Center
by Bill Woodcock 17 Nov '98

17 Nov '98

Ah, but at least they're kind enough to warn you, right next to their mailto link, that they don't respond to email. :-) -Bill

1 0

Another origin IP
by Richard Irving 17 Nov '98

17 Nov '98

209.119.115.65 telnetd a mile a minute....... to our DNS. Check yours !

2 1

Re: RBL quandry - opinions hereby solicited
by Dean Anderson 16 Nov '98

16 Nov '98

>>> Technically, this is an opt-out customer-relationship spam. >>> >>> I think it is a special case, because _there is no where else to go_. Uhh, aside from the other issues, there are actually other registries you can use. You don't _have to_ use NSI. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

RE: Exodus / Clue problems
by John Fraizer 16 Nov '98

16 Nov '98

Why on earth would anyone let any of the following networks in to their network at the border? 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 Hell, for that matter, I block anything claiming to be from our networks as well. There's no way they'll be originating from the outside unless it's spoofed. Nothing and I mean NOTHING claiming to be from any of them at your border is valid. At 09:36 PM 11/15/98 -0500, Adam Rothschild wrote: >On Sun, 15 Nov 1998, Dave Van Allen wrote: > >> Same here, dozens of times in a few seconds just now, to all listed >> nameservers... I can't imagine what "process" could do this >> unintentionally. Exodus??? You home? > >Interesting you mention this. I've noticed the following on a FreeBSD >2.2.6 box, running BIND 8.1.2... > >server# netstat >Active Internet connections >Proto Recv-Q Send-Q Local Address Foreign Address (state) >tcp 0 0 server.4375 172.16.1.1.1984 >SYN_SENT >tcp 0 0 server.ftp server.4374 >TIME_WAIT > >Internal addr space... port 1984.. cute. > > > ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

5 4

Re: Hold on to your news servers
by Scott Gifford 16 Nov '98

16 Nov '98

>> I think a lot of people hope you are reconsidering your plans to do this. >> It's a nice idea, and your motivation is good. It just won't work in >> practice. So, in my nicest and most appreciative tone, I would like to ask >> you on behalf of myself and many people who are also appreciative of your >> efforts and your motives to reconsider and abandon this plan. > >I'd be happy to abandon it if something that accomplishes the same job, or >substantially the same job, shows up before it goes online. Have you considered using NoCeM's to do this? This would be much more opt-in, as somebody would have to specifically configure NoCeM to accept your key. It is also much more efficient than cancels, at least propogation-wise. Just a thought from a news administrator who doesn't want to be processing 300,000+ cancels a day all of a sudden, -------Scott.

1 0

Exodus / Clue problems
by TTSG 16 Nov '98

16 Nov '98

Hi, Sorry to cross post, but is there anyone monitoring this list from Exodus with 1/2 a clue who might be able to help me? I called the NOC with an in-progress abuse and was told : 1) We don't know who owns that IP 2) We can't get into our own routers 3) We don't have a ticket system 4) The abuse people have a ticket system, but only if we can associate it to a customer (See #1) 5) We don't know how often the "abuse@" is checked 6) Email us the logs, and thanks for calling. AAAAAAAAARRRRRRRRRRGGGGGGGGGGGHHHHHHHHHHHHH!!!!!!!!!!!!!!! Tuc/TTSG

20 32

Re: Exodus / Clue problems
by John Fraizer 16 Nov '98

16 Nov '98

At 05:18 PM 11/16/98 -0500, Daniel Senie wrote: >Actually, the blocks are mine, not theirs. If you use a traceroute on a >system which uses ICMP ECHO packets to do the trace, instead of the >older Unix implementations which use random UDP ports, your traceroute >will get to my site without trouble. The traceroute I am running is current as it gets, for the unix world that is. I have found that most sites won't block UDP near as often as they block ICMP and this, I have much more success with this traceroute than say, the tracert program on winblows boxes. > >I hadn't thought about the PMTU failure this causes. Not nice at all. Most people don't think about it. It can cause you problems though. Especially when in most cases, when PMTU can't be determined, it is defaulted to 1500. >The problem with this is I can't do traceroutes out, then, because all >the responses from the 10.x.x.x/8 and 172.16.0.0/16 machines get caught >in the filters. Sure you can. Any decent NAT or MASQ system will take care of that for you. Case in point: root> ifconfig eth0 eth0 Link encap:Ethernet HWaddr 00:A0:C9:06:7C:82 inet addr:192.168.101.250 Bcast:192.168.101.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:5427402 errors:0 dropped:0 overruns:0 TX packets:4912650 errors:0 dropped:0 overruns:0 Interrupt:9 Base address:0xff40 root> route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.101.0 0.0.0.0 255.255.255.0 U 0 0 62 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 19 lo 0.0.0.0 192.168.101.48 0.0.0.0 UG 0 0 412 eth0 root> traceroute mae-east.psi.net traceroute to mae-east.psi.net (192.41.177.245), 30 hops max, 40 byte packets 1 barrister (192.168.101.48) 0.467 ms 0.363 ms 0.346 ms 2 38.1.1.1 (38.1.1.1) 154.795 ms 139.175 ms 139.722 ms 3 38.17.10.1 (38.17.10.1) 139.654 ms 139.077 ms 139.712 ms 4 leaf2.nc.us.psi.net (38.1.46.2) 179.613 ms 179.044 ms 159.642 ms 5 rc1.nc.us.psi.net (38.1.26.1) 299.494 ms 188.930 ms 169.680 ms 6 core.net223.psi.net (38.1.2.6) 209.555 ms 178.857 ms * Note: I am quite amazed to only see ONE "*" in that trace considering the network that box is attached to. >> than your own. I Hope nothing happens that would require your PERSONAL >> attention while you're at some convention, on vacation, etc. > >Fortunately I have enough of an operation to have a direct dial-in to my >network so that I can get in even if the ISP link is down, but I agree >with your assessment. I think most of us can do that. The difference is that I use the dialin for security to get devices that I can NOT install SSH on. For everything else, it is a backup link. It would be quite costly for me to dial into the box from the Philippines while I'm over there, even if I could find a decent phone line to do so. The satellite link while slower than I would like, works quite well though. I suppose that you could also telnet/ssh to a "real" IP address behind your router and then telnet to the router though. >> ...and one last point... >> >> - Have someone loan them a clue about why they should NOT use RFC1918 space >> in the way your isp is doing so. > >Agree. Unfortunately, when selecting ISPs, this was not an aspect I >expected I'd have to worry about, and so I didn't ask. It certainly goes >on my list for the next negotiation, though. I never asked FNSI either. I guess that considering how many providers actually do this, I was lucky to find one that actually knows better. ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

1 0

RE: Exodus: this is bad
by Chris Mauritz 16 Nov '98

16 Nov '98

The jerkoff is trying from 207.104.58.91 too. I've just filtered it as well. Check out /var/log/secure on oven. C Chris Mauritz Director, Systems Administration Rare Medium, Inc. chrism(a)raremedium.com -----Original Message----- From: Adam Rothschild [mailto:asr@millburn.net] Sent: Monday, November 16, 1998 5:31 PM To: nanog(a)merit.edu; list(a)inet-access.net Subject: Exodus: this is bad Hrrrm, I'm seeing 38.29.63.195 trying to telnet to every IP addr in one of my Exodus /24's... (around 4.30p EST) Anyone notice any similar behaviour?

2 1

new version of caida tool for capacity planning/trend analysis
by k claffy 16 Nov '98

16 Nov '98

heads up to ISPs into operational measurement of workload characteristics cflowd 2.0 code is now available for use in analyzing export-flows from ciscos http://www.caida.org/Tools/Cflowd/ software collects output from cisco's netflow export then aggregates the data in ISP-engineering relevant ways as-to-as matrices ( --> peering engineering) net-to-net matrics ( --> peering/routing engineering ) port and protocol tables ( --> capacity engineering, what traffic is your infrastructure supporting, how is it changing, how much of it elastic/optimizable/ hyperzealous/cache-able/etc ) other stuff ( and continually adding features for members, plus src available for your own footloose entertainment ) cflowd 2.0 is a redesign of cflowd 1.3b2 and includes arts++ for storage as well as significant improvements in user interfaces and functionality. details on the code and mail lists are available at the website, or by contacting cflowd's developer, daniel mcRobb, at dwm(a)caida.org think you'll like always seeking your feedback/experience, k

1 0

Re: Hold on to your news servers
by John Fraizer 16 Nov '98

16 Nov '98

THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! At 03:07 PM 11/16/98 -0600, Karl Denninger wrote: >Given that a large number of people have threatened to commit felonious acts >(ping floods, etc) against these machines, I believe being "furtive" is >quite appropriate. THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! When and if they do ping -f karls.server.that.shouldnt.be.a.nanog.issue.com, THAT will be something to discuss on NANOG. Take the lame-%^*## news server griping, bickering, pissing and moaning to another list. Preferrably /dev/null. THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! Sheesh! Can't you people read? THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! THIS IS NOT A NANOG ISSUE! ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

1 0