- Test - lists.nanog.org

SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
by Martin, Christian 02 May '98

02 May '98

All, Here is my contribution to the block list. The script that generated this will follow. It is 'public domain', in that it can be modified, BUT, please give credit where credit is due! !!!!!NOTE: This script assumes that the offending bounce sites are /24 blocks. It isn't that smart yet, but if someone can figure out a way to glean more info, modify the script and repost. #!/bin/ksh # ------------------------------------------------------------------------ -- # @(#) File: catch.sh by Kevin A. Ho and Christian Martin Release 1.0 # # Description: This script reads a NetFlow log produced on Cisco routers # that employ NetFlow switching. The script parses the log # and generates the network address of the amplifying network. # Then, the script runs the netblock (assumes a /24 mask) # against your favorite route-server (could use a gated box # as well) and pulls the originating AS from the BGP table. # Then, it runs the AS pulled from the route server against # the "whois" query program to obtain the AS info and # other related info on the network address. # ------------------------------------------------------------------------ -- LOGFILE=$1 WHOIS=/usr/bin/whois WHOIS_SRVR=whois.ra.net ROUTE_SRVR=route-server.cerf.net TARGET=$2 case $# in 1) IPlist[0]=$1 ;; *) print "Building network address list ..." set -A IPlist `awk '{if(($5 == "01")&&($4 == TG)) print $2}' TG=$TARGET ${LOGFILE} | awk -F"." '{ printf("%s.%s.%s.0\n", $1, $2, $3)}' | sort -u` ;; esac for IPaddr in ${IPlist[*]} do print ${IPaddr} done __________________________________________ HERE IS THE LIST 10.10.100.0 10.128.14.0 10.158.36.0 10.3.0.0 10.3.1.0 10.4.0.0 100.100.1.0 12.0.40.0 12.1.9.0 12.10.2.0 12.10.6.0 12.10.7.0 12.11.0.0 12.127.114.0 12.127.192.0 12.127.240.0 12.13.1.0 12.3.0.0 12.4.5.0 12.63.7.0 12.7.2.0 125.83.77.0 127.0.0.0 128.1.21.0 128.135.111.0 128.135.113.0 128.135.115.0 128.135.117.0 128.135.168.0 128.135.2.0 128.135.253.0 128.135.4.0 128.135.47.0 128.135.61.0 128.135.70.0 128.135.76.0 128.135.91.0 128.135.99.0 128.203.208.0 128.252.152.0 128.252.221.0 128.252.223.0 128.252.233.0 128.252.234.0 128.252.7.0 128.252.84.0 128.39.0.0 128.39.16.0 128.39.3.0 128.97.172.0 128.97.173.0 128.97.21.0 129.210.11.0 129.210.208.0 129.210.209.0 129.210.210.0 129.210.211.0 129.210.40.0 129.210.42.0 129.210.43.0 129.210.8.0 129.210.84.0 129.210.87.0 129.241.181.0 129.241.200.0 130.15.1.0 130.15.8.0 130.194.225.0 130.194.25.0 130.194.31.0 130.195.2.0 130.198.253.0 130.236.252.0 130.236.254.0 130.237.1.0 130.237.245.0 130.237.247.0 130.237.28.0 130.237.32.0 130.237.72.0 130.237.9.0 130.239.136.0 130.239.5.0 130.242.100.0 130.244.10.0 130.244.12.0 130.244.136.0 130.244.16.0 130.244.2.0 130.244.24.0 130.244.25.0 130.244.3.0 130.251.21.0 130.251.86.0 130.79.200.0 130.79.23.0 130.79.32.0 130.79.36.0 131.1.183.0 131.1.184.0 131.1.185.0 131.1.186.0 131.1.187.0 131.1.188.0 131.1.189.0 131.115.126.0 131.115.184.0 131.115.185.0 131.115.189.0 131.115.47.0 131.115.48.0 131.115.49.0 131.119.16.0 131.154.1.0 131.175.223.0 131.175.238.0 131.175.242.0 131.175.57.0 131.178.1.0 131.178.38.0 131.178.60.0 134.124.99.0 134.153.2.0 134.153.240.0 134.153.80.0 134.184.1.0 134.184.129.0 134.184.15.0 134.184.250.0 134.184.30.0 134.184.31.0 134.184.32.0 134.184.66.0 134.222.12.0 134.222.2.0 134.222.200.0 134.222.28.0 134.222.30.0 134.58.24.0 134.58.25.0 134.58.255.0 134.58.40.0 134.58.41.0 134.58.43.0 134.58.45.0 134.58.61.0 134.59.1.0 134.87.109.0 134.87.18.0 134.87.96.0 134.87.98.0 134.92.229.0 137.121.1.0 137.121.254.0 137.204.64.0 137.39.139.0 137.39.178.0 138.195.33.0 138.200.111.0 138.200.65.0 138.200.66.0 138.200.68.0 138.200.70.0 138.200.77.0 138.73.1.0 139.130.1.0 139.130.10.0 139.130.120.0 139.130.128.0 139.130.159.0 139.130.2.0 139.130.3.0 139.130.43.0 139.130.48.0 139.130.6.0 139.130.64.0 139.130.65.0 139.130.76.0 139.130.79.0 139.165.30.0 139.165.32.0 139.165.40.0 139.223.200.0 139.3.63.0 139.4.26.0 139.57.16.0 139.58.230.0 140.127.240.0 140.78.1.0 140.78.127.0 140.78.222.0 140.78.223.0 140.78.93.0 140.96.70.0 141.108.220.0 141.108.253.0 141.66.176.0 142.103.3.0 142.132.1.0 142.165.5.0 142.22.218.0 142.232.83.0 142.232.84.0 142.51.1.0 142.58.12.0 142.58.145.0 142.74.1.0 143.169.5.0 143.225.190.0 143.233.122.0 143.233.123.0 143.43.128.0 143.43.130.0 143.43.131.0 143.43.133.0 143.43.3.0 144.228.131.0 144.85.1.0 144.85.10.0 144.85.200.0 144.85.207.0 144.85.3.0 145.228.110.0 145.228.114.0 145.228.200.0 145.228.222.0 145.228.95.0 146.83.1.0 147.102.12.0 147.102.13.0 147.102.222.0 147.151.103.0 147.151.171.0 147.162.1.0 147.162.199.0 147.162.8.0 147.162.99.0 147.211.45.0 147.211.55.0 147.250.1.0 147.83.124.0 147.83.32.0 147.83.4.0 147.83.41.0 147.91.1.0 147.91.8.0 147.96.1.0 147.96.10.0 147.96.100.0 147.96.19.0 147.96.20.0 147.96.21.0 147.96.22.0 147.96.23.0 147.96.24.0 147.96.25.0 147.96.3.0 147.96.33.0 147.96.37.0 147.96.4.0 147.96.42.0 147.96.5.0 147.96.6.0 147.96.90.0 148.202.1.0 148.202.2.0 148.202.3.0 148.202.34.0 148.202.4.0 148.202.5.0 148.202.8.0 148.202.93.0 148.206.128.0 148.206.32.0 148.207.1.0 148.207.10.0 148.207.100.0 148.207.104.0 148.207.2.0 148.207.20.0 148.207.25.0 148.207.38.0 148.207.40.0 148.214.12.0 148.214.13.0 148.225.14.0 149.142.172.0 149.142.47.0 150.146.201.0 150.146.5.0 150.162.1.0 150.162.237.0 150.162.248.0 150.162.254.0 150.163.130.0 150.210.23.0 150.210.24.0 150.210.25.0 150.210.26.0 150.210.3.0 150.210.33.0 150.214.110.0 150.214.112.0 150.214.115.0 150.214.163.0 150.214.169.0 150.214.218.0 150.214.231.0 150.214.32.0 150.214.35.0 150.214.69.0 151.99.0.0 151.99.107.0 151.99.155.0 151.99.48.0 152.74.49.0 152.74.52.0 152.84.100.0 152.84.254.0 154.11.136.0 154.11.8.0 155.105.102.0 155.105.2.0 155.105.255.0 155.105.3.0 155.207.100.0 155.207.112.0 155.207.18.0 155.207.19.0 155.207.199.0 155.207.26.0 155.207.30.0 156.14.1.0 156.14.20.0 156.14.254.0 156.14.30.0 157.130.0.0 157.130.225.0 157.130.33.0 157.130.5.0 157.138.1.0 157.138.115.0 157.161.254.0 157.169.10.0 157.27.32.0 157.27.6.0 157.88.142.0 157.88.143.0 157.88.31.0 157.92.1.0 158.122.64.0 158.122.65.0 158.122.90.0 158.227.6.0 158.251.1.0 158.251.12.0 158.251.16.0 158.251.17.0 158.251.18.0 158.251.19.0 158.251.20.0 158.251.250.0 158.251.3.0 158.251.4.0 158.37.1.0 158.47.18.0 158.47.4.0 158.49.129.0 158.49.133.0 158.49.134.0 158.49.137.0 158.49.247.0 159.84.12.0 160.97.1.0 160.97.225.0 160.97.4.0 160.97.5.0 160.97.52.0 161.142.0.0 161.142.100.0 161.142.2.0 161.142.227.0 161.142.24.0 161.142.8.0 163.117.131.0 163.13.1.0 163.13.140.0 163.13.141.0 163.15.250.0 163.15.252.0 163.179.230.0 163.9.4.0 164.128.116.0 164.128.119.0 164.128.122.0 164.128.123.0 164.128.57.0 164.128.81.0 164.15.44.0 164.15.89.0 164.41.2.0 165.154.1.0 165.154.105.0 165.154.140.0 166.48.38.0 168.8.16.0 169.226.116.0 169.226.2.0 169.226.23.0 169.226.28.0 169.226.38.0 169.226.4.0 170.210.0.0 172.16.0.0 172.16.1.0 172.16.2.0 172.16.4.0 172.17.50.0 172.21.10.0 172.31.7.0 18.26.0.0 192.0.1.0 192.100.161.0 192.100.180.0 192.100.181.0 192.106.1.0 192.106.7.0 192.107.131.0 192.107.51.0 192.107.52.0 192.107.53.0 192.108.114.0 192.109.80.0 192.109.81.0 192.12.77.0 192.121.120.0 192.121.83.0 192.129.50.0 192.132.41.0 192.134.106.0 192.134.130.0 192.134.192.0 192.135.34.0 192.135.68.0 192.139.190.0 192.139.196.0 192.139.197.0 192.139.230.0 192.139.245.0 192.147.246.0 192.148.167.0 192.150.75.0 192.159.121.0 192.16.137.0 192.165.120.0 192.165.146.0 192.165.243.0 192.167.13.0 192.167.192.0 192.167.198.0 192.168.0.0 192.168.1.0 192.168.10.0 192.168.11.0 192.168.122.0 192.168.162.0 192.168.168.0 192.168.177.0 192.168.191.0 192.168.199.0 192.168.2.0 192.168.203.0 192.168.21.0 192.168.250.0 192.168.5.0 192.168.6.0 192.168.66.0 192.176.122.0 192.190.209.0 192.197.60.0 192.2.200.0 192.228.128.0 192.33.182.0 192.36.60.0 192.36.97.0 192.4.0.0 192.41.218.0 192.44.77.0 192.5.82.0 192.54.144.0 192.54.174.0 192.54.188.0 192.54.242.0 192.6.5.0 192.65.91.0 192.67.248.0 192.68.63.0 192.70.23.0 192.70.34.0 192.70.57.0 192.70.82.0 192.70.87.0 192.70.98.0 192.71.157.0 192.71.57.0 192.72.111.0 192.72.151.0 192.72.24.0 192.72.33.0 192.75.204.0 192.75.205.0 192.75.62.0 192.82.124.0 192.83.196.0 192.84.152.0 192.89.123.0 192.93.29.0 192.93.74.0 192.93.8.0 192.93.80.0 192.93.82.0 192.95.223.0 193.10.48.0 193.10.49.0 193.10.50.0 193.10.62.0 193.103.148.0 193.103.168.0 193.104.101.0 193.105.56.0 193.114.246.0 193.118.192.0 193.118.200.0 193.12.151.0 193.12.69.0 193.12.71.0 193.122.87.0 193.127.1.0 193.13.131.0 193.13.144.0 193.14.104.0 193.14.11.0 193.14.29.0 193.14.68.0 193.141.156.0 193.141.171.0 193.141.232.0 193.141.241.0 193.141.75.0 193.141.76.0 193.141.77.0 193.141.78.0 193.144.75.0 193.145.132.0 193.145.133.0 193.145.222.0 193.145.248.0 193.145.254.0 193.145.40.0 193.145.41.0 193.145.54.0 193.145.59.0 193.145.60.0 193.145.61.0 193.146.95.0 193.15.20.0 193.15.241.0 193.15.55.0 193.15.86.0 193.156.89.0 193.156.92.0 193.158.124.0 193.164.160.0 193.164.161.0 193.164.172.0 193.170.33.0 193.170.35.0 193.171.114.0 193.171.20.0 193.171.22.0 193.180.104.0 193.182.172.0 193.189.224.0 193.189.241.0 193.189.249.0 193.190.10.0 193.190.144.0 193.190.170.0 193.190.171.0 193.190.192.0 193.190.194.0 193.190.196.0 193.190.197.0 193.190.2.0 193.190.231.0 193.190.249.0 193.192.192.0 193.192.193.0 193.192.199.0 193.192.200.0 193.192.206.0 193.192.225.0 193.192.23.0 193.204.120.0 193.204.16.0 193.204.191.0 193.204.208.0 193.204.210.0 193.204.30.0 193.204.64.0 193.205.160.0 193.205.165.0 193.205.189.0 193.205.190.0 193.216.236.0 193.216.250.0 193.252.19.0 193.252.235.0 193.252.252.0 193.36.32.0 193.36.37.0 193.38.83.0 193.38.84.0 193.43.43.0 193.43.44.0 193.44.236.0 193.44.5.0 193.44.90.0 193.45.158.0 193.45.251.0 193.45.79.0 193.48.145.0 193.48.168.0 193.48.198.0 193.48.200.0 193.48.226.0 193.48.24.0 193.48.241.0 193.48.39.0 193.48.40.0 193.48.45.0 193.48.75.0 193.49.105.0 193.49.112.0 193.49.164.0 193.49.205.0 193.49.29.0 193.49.67.0 193.5.152.0 193.5.153.0 193.5.154.0 193.5.54.0 193.5.56.0 193.50.217.0 193.50.225.0 193.50.235.0 193.51.104.0 193.51.105.0 193.51.136.0 193.51.198.0 193.51.80.0 193.51.86.0 193.52.10.0 193.52.211.0 193.52.223.0 193.52.72.0 193.52.80.0 193.52.81.0 193.54.185.0 193.54.208.0 193.54.232.0 193.54.238.0 193.54.42.0 193.54.98.0 193.55.218.0 193.55.220.0 193.55.96.0 193.56.4.0 193.71.3.0 193.74.243.0 193.80.12.0 193.80.60.0 193.90.64.0 193.92.3.0 193.98.1.0 193.98.110.0 193.98.230.0 193.98.9.0 193.98.90.0 194.103.200.0 194.103.205.0 194.106.165.0 194.106.254.0 194.109.7.0 194.109.9.0 194.115.115.0 194.115.128.0 194.117.203.0 194.117.204.0 194.118.1.0 194.118.23.0 194.118.26.0 194.119.216.0 194.119.225.0 194.119.228.0 194.120.12.0 194.120.124.0 194.120.40.0 194.122.108.0 194.122.231.0 194.122.236.0 194.122.240.0 194.123.81.0 194.133.98.0 194.134.5.0 194.137.236.0 194.137.237.0 194.139.104.0 194.148.1.0 194.158.141.0 194.158.154.0 194.158.155.0 194.158.96.0 194.158.97.0 194.16.110.0 194.16.184.0 194.16.186.0 194.16.190.0 194.16.2.0 194.16.207.0 194.16.50.0 194.162.192.0 194.162.200.0 194.162.25.0 194.162.252.0 194.162.253.0 194.162.254.0 194.162.27.0 194.162.29.0 194.162.66.0 194.162.73.0 194.163.184.0 194.164.0.0 194.164.70.0 194.167.133.0 194.167.136.0 194.167.138.0 194.167.139.0 194.167.147.0 194.167.148.0 194.167.195.0 194.168.23.0 194.168.7.0 194.17.121.0 194.17.162.0 194.17.163.0 194.17.177.0 194.172.112.0 194.174.238.0 194.174.252.0 194.175.112.0 194.175.173.0 194.177.121.0 194.177.122.0 194.177.124.0 194.177.125.0 194.177.127.0 194.177.208.0 194.179.10.0 194.179.100.0 194.179.107.0 194.179.13.0 194.179.21.0 194.179.29.0 194.179.46.0 194.179.47.0 194.18.124.0 194.18.161.0 194.18.197.0 194.18.34.0 194.18.35.0 194.18.47.0 194.18.60.0 194.184.1.0 194.184.148.0 194.184.179.0 194.184.204.0 194.185.134.0 194.185.148.0 194.198.105.0 194.198.203.0 194.199.140.0 194.199.58.0 194.2.12.0 194.2.16.0 194.2.17.0 194.2.236.0 194.20.12.0 194.20.40.0 194.20.41.0 194.20.45.0 194.20.6.0 194.206.126.0 194.206.137.0 194.206.228.0 194.206.91.0 194.21.56.0 194.218.187.0 194.219.163.0 194.22.0.0 194.22.107.0 194.224.52.0 194.224.53.0 194.23.141.0 194.23.86.0 194.23.92.0 194.231.76.0 194.235.58.0 194.235.8.0 194.236.202.0 194.236.211.0 194.236.232.0 194.236.60.0 194.236.87.0 194.237.63.0 194.242.165.0 194.242.166.0 194.244.56.0 194.25.10.0 194.25.133.0 194.250.1.0 194.250.152.0 194.250.2.0 194.250.252.0 194.250.5.0 194.250.50.0 194.251.240.0 194.251.241.0 194.251.242.0 194.251.244.0 194.251.254.0 194.251.255.0 194.254.65.0 194.254.66.0 194.254.67.0 194.255.253.0 194.3.128.0 194.30.193.0 194.30.220.0 194.38.93.0 194.45.104.0 194.45.109.0 194.47.134.0 194.5.224.0 194.51.102.0 194.51.123.0 194.51.146.0 194.51.151.0 194.51.16.0 194.51.197.0 194.51.203.0 194.51.222.0 194.51.223.0 194.51.246.0 194.52.0.0 194.52.175.0 194.52.18.0 194.52.2.0 194.52.205.0 194.52.223.0 194.52.240.0 194.52.242.0 194.52.4.0 194.52.86.0 194.57.177.0 194.57.232.0 194.6.128.0 194.62.44.0 194.64.106.0 194.64.113.0 194.68.196.0 194.68.97.0 194.7.74.0 194.7.86.0 194.72.131.0 194.72.186.0 194.73.141.0 194.73.58.0 194.74.136.0 194.74.52.0 194.75.6.0 194.75.72.0 194.75.84.0 194.77.113.0 194.77.54.0 194.77.74.0 194.77.9.0 194.79.160.0 194.79.171.0 194.79.181.0 194.79.190.0 194.8.194.0 194.8.212.0 194.8.218.0 194.88.75.0 194.88.77.0 194.88.82.0 194.97.110.0 194.98.176.0 195.0.45.0 195.1.0.0 195.10.0.0 195.10.20.0 195.10.39.0 195.100.119.0 195.100.194.0 195.101.240.0 195.101.241.0 195.101.37.0 195.101.38.0 195.115.1.0 195.119.105.0 195.12.192.0 195.12.193.0 195.13.0.0 195.13.1.0 195.13.10.0 195.13.14.0 195.13.17.0 195.13.2.0 195.13.23.0 195.13.30.0 195.13.9.0 195.134.160.0 195.134.161.0 195.134.162.0 195.134.163.0 195.138.35.0 195.14.237.0 195.141.19.0 195.146.192.0 195.146.194.0 195.15.6.0 195.152.138.0 195.152.149.0 195.165.12.0 195.167.133.0 195.17.0.0 195.17.1.0 195.17.252.0 195.17.80.0 195.178.61.0 195.179.50.0 195.18.195.0 195.18.241.0 195.180.0.0 195.180.245.0 195.180.3.0 195.185.191.0 195.185.30.0 195.188.206.0 195.198.147.0 195.198.15.0 195.198.151.0 195.198.152.0 195.198.159.0 195.198.162.0 195.198.163.0 195.206.65.0 195.216.16.0 195.216.24.0 195.22.104.0 195.22.105.0 195.22.96.0 195.22.98.0 195.220.240.0 195.220.241.0 195.220.242.0 195.220.243.0 195.220.244.0 195.220.245.0 195.220.248.0 195.221.35.0 195.222.195.0 195.222.215.0 195.223.41.0 195.224.1.0 195.224.29.0 195.238.142.0 195.238.160.0 195.238.162.0 195.246.128.0 195.25.133.0 195.25.165.0 195.250.255.0 195.31.190.0 195.32.0.0 195.35.17.0 195.4.192.0 195.42.192.0 195.42.197.0 195.45.0.0 195.50.72.0 195.52.33.0 195.53.9.0 195.6.46.0 195.62.224.0 195.62.227.0 195.63.140.0 195.63.48.0 195.63.52.0 195.63.71.0 195.66.161.0 195.66.166.0 195.67.10.0 195.67.19.0 195.67.235.0 195.67.42.0 195.67.69.0 195.7.69.0 195.70.105.0 195.70.96.0 195.71.235.0 195.74.193.0 195.78.136.0 195.78.145.0 195.78.64.0 195.83.11.0 195.83.231.0 195.83.232.0 195.83.239.0 195.83.75.0 195.83.76.0 195.83.9.0 195.84.194.0 195.84.224.0 195.84.80.0 195.89.136.0 195.89.149.0 195.89.151.0 195.89.160.0 195.89.163.0 195.90.0.0 195.99.122.0 195.99.124.0 198.103.20.0 198.103.6.0 198.103.97.0 198.161.111.0 198.161.24.0 198.161.28.0 198.161.29.0 198.161.93.0 198.161.96.0 198.162.3.0 198.163.221.0 198.163.232.0 198.166.16.0 198.166.17.0 198.166.18.0 198.168.28.0 199.0.23.0 199.1.90.0 199.166.213.0 199.186.25.0 199.212.15.0 199.212.4.0 199.212.45.0 199.212.85.0 199.243.210.0 199.45.130.0 199.45.183.0 199.71.64.0 199.84.155.0 199.84.162.0 199.95.207.0 200.0.135.0 200.0.70.0 200.12.165.0 200.13.80.0 200.13.81.0 200.135.15.0 200.17.206.0 200.17.209.0 200.17.234.0 200.201.0.0 200.201.1.0 200.215.160.0 200.215.167.0 200.218.1.0 200.223.64.0 200.223.74.0 200.223.76.0 200.23.224.0 200.23.240.0 200.23.39.0 200.231.103.0 200.231.188.0 200.251.254.0 200.255.253.0 200.28.35.0 200.32.73.0 200.32.79.0 200.33.12.0 200.33.186.0 200.33.210.0 200.33.211.0 200.33.212.0 200.33.214.0 200.33.240.0 200.34.128.0 200.34.254.0 200.4.12.0 202.10.1.0 202.10.2.0 202.132.147.0 202.132.20.0 202.132.226.0 202.132.227.0 202.132.230.0 202.132.232.0 202.132.254.0 202.138.0.0 202.139.0.0 202.139.7.0 202.145.130.0 202.145.228.0 202.145.234.0 202.145.255.0 202.232.1.0 202.232.2.0 202.27.210.0 202.36.227.0 202.37.101.0 202.37.129.0 202.37.245.0 202.39.128.0 202.39.157.0 202.39.216.0 202.39.235.0 202.39.254.0 202.39.74.0 202.49.252.0 202.49.88.0 202.61.255.0 203.0.156.0 203.0.159.0 203.1.75.0 203.10.72.0 203.101.254.0 203.102.128.0 203.111.120.0 203.111.41.0 203.12.144.0 203.12.160.0 203.12.171.0 203.12.176.0 203.13.174.0 203.13.35.0 203.14.177.0 203.16.60.0 203.16.61.0 203.17.166.0 203.17.36.0 203.17.49.0 203.17.96.0 203.18.192.0 203.19.214.0 203.2.239.0 203.20.43.0 203.21.205.0 203.21.6.0 203.23.170.0 203.24.95.0 203.25.127.0 203.29.157.0 203.29.170.0 203.30.0.0 203.30.255.0 203.30.77.0 203.31.164.0 203.31.216.0 203.36.123.0 203.37.13.0 203.37.163.0 203.37.32.0 203.37.33.0 203.4.212.0 203.5.101.0 203.5.102.0 203.5.74.0 203.55.112.0 203.56.35.0 203.56.8.0 203.57.156.0 203.57.24.0 203.57.93.0 203.60.16.0 203.66.109.0 203.66.150.0 203.66.155.0 203.67.34.0 203.67.6.0 203.69.140.0 203.7.132.0 203.7.224.0 203.79.224.0 203.8.105.0 203.9.148.0 203.96.119.0 203.97.1.0 203.97.100.0 203.97.176.0 203.97.98.0 203.97.99.0 203.98.4.0 204.101.130.0 204.101.46.0 204.112.54.0 204.112.6.0 204.144.246.0 204.149.178.0 204.174.235.0 204.174.35.0 204.174.90.0 204.187.89.0 204.189.108.0 204.189.136.0 204.19.14.0 204.19.15.0 204.19.79.0 204.209.46.0 204.239.129.0 204.239.156.0 204.239.157.0 204.244.155.0 204.244.32.0 204.253.4.0 204.50.124.0 204.59.1.0 204.59.81.0 204.59.82.0 204.6.117.0 204.70.35.0 204.70.40.0 204.71.97.0 204.91.143.0 204.92.90.0 205.150.206.0 205.150.89.0 205.151.222.0 205.151.224.0 205.189.200.0 205.192.3.0 205.205.33.0 205.207.122.0 205.207.160.0 205.207.203.0 205.236.148.0 205.236.172.0 205.236.182.0 205.237.65.0 205.252.128.0 206.12.129.0 206.12.130.0 206.12.131.0 206.121.215.0 206.156.239.0 206.181.51.0 206.186.225.0 206.186.227.0 206.186.248.0 206.186.54.0 206.210.64.0 206.215.191.0 206.217.169.0 206.248.62.0 206.248.70.0 206.29.100.0 206.29.101.0 206.34.102.0 206.34.141.0 206.48.24.0 206.49.58.0 206.49.59.0 206.72.196.0 206.85.92.0 207.102.126.0 207.102.141.0 207.102.142.0 207.102.143.0 207.102.94.0 207.107.244.0 207.112.240.0 207.164.237.0 207.164.63.0 207.174.14.0 207.175.36.0 207.175.50.0 207.181.101.0 207.181.89.0 207.194.101.0 207.194.102.0 207.194.107.0 207.213.36.0 207.213.41.0 207.213.42.0 207.213.44.0 207.214.49.0 207.217.126.0 207.217.50.0 207.23.240.0 207.230.225.0 207.230.228.0 207.230.231.0 207.230.248.0 207.236.228.0 207.236.231.0 207.236.238.0 207.239.227.0 207.249.144.0 207.249.165.0 207.249.181.0 207.253.115.0 207.253.215.0 207.253.253.0 207.253.36.0 207.45.206.0 207.54.188.0 207.61.147.0 207.68.2.0 207.68.8.0 207.93.1.0 207.96.136.0 207.96.159.0 207.96.187.0 207.96.222.0 207.98.190.0 208.134.170.0 208.134.171.0 208.134.172.0 208.140.169.0 208.141.98.0 208.158.112.0 208.158.121.0 208.201.90.0 208.201.91.0 208.211.32.0 208.211.33.0 208.211.34.0 208.211.35.0 208.211.36.0 208.211.37.0 208.211.39.0 208.213.229.0 208.230.128.0 208.230.129.0 208.230.130.0 208.230.131.0 208.230.132.0 208.230.134.0 208.230.135.0 208.237.8.0 208.237.9.0 209.100.136.0 209.131.128.0 209.131.129.0 209.150.128.0 209.196.128.0 209.196.150.0 209.196.153.0 209.212.38.0 209.44.32.0 209.48.31.0 209.52.234.0 209.54.112.0 209.54.114.0 209.54.189.0 209.54.190.0 209.76.102.0 209.91.128.0 210.208.232.0 210.209.7.0 210.64.123.0 210.64.98.0 210.65.13.0 210.65.231.0 210.67.33.0 210.67.40.0 210.68.182.0 210.68.85.0 212.29.0.0 62.156.145.0 62.20.26.0 62.20.27.0 62.52.64.0 62.52.65.0 62.52.66.0 97.3.0.0 97.5.2.0

8 7

pacbell sales rep
by andrew khoo 01 May '98

01 May '98

can someone recommend a clueful pacbell sales rep who can help me order multiple T1s in the 650-617 area?

3 2

Two renumbering questions
by John R Levine 01 May '98

01 May '98

My ISP is changing upstreams for a variety of reasons around May 18th. 1. I have a /24 SWIPed to me, 205.238.207.0. The ARIN listing doesn't say it's non-portable, so can I take it with me? And if I do, how likely is it that the new ISP's announcement will get installed in backbone routers rather than filtered for being too long? It's right in the middle of the old upstream's block 205.238.192/18. 2. Assuming I have to renumber, I have a whole bunch of virtual domains all DNS served from one server in the renumbered space called ivan.iecc.com. (There's other servers elsewhere that won't get renumbered.) If I tell the Internic that ivan's host number has changed, will that update all the domains served from it? TIA. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner Finger for PGP key, f'print = 3A 5B D0 3F D9 A0 6A A4 2D AC 1E 9E A6 36 A3 47

4 5

RE: Network Operators and smurf
by Doug Stanfield 01 May '98

01 May '98

Don't assume it's not needed for the 75xx, or anything else for that matter. Many networks are single connected to routers that are also acting multihomed to core providers and these boxes are being used. Doug Stanfield Oceanic Cable Data Networking Manager 200 Akamainui St. dougs(a)oceanic.com Mililani, HI 96789 Usially the low-end traffic is symmetrical. The problem is that CEF code and other anty-frauding realisations are appearing for the high-end routers, white they are nessesary for the low-end routers and useless for the core routers. For cisco, we need this future for 4500/4700/3640/2511 ASAP, 720x slightly, and don't need it for 75xx at all. On Sat, 25 Apr 1998, Al Reuben wrote: > Date: Sat, 25 Apr 1998 12:30:50 -0400 (EDT) > From: Al Reuben <alex(a)nac.net> > To: Havard.Eidnes(a)runit.sintef.no > Cc: jra(a)scfn.thpl.lib.fl.us, nanog(a)merit.edu > Subject: Re: Network Operators and smurf > > > > This should (naturally) be implemented where routing is symmetric > > and where a "reverse-path check" (looking up the source address in > > the routing table to find the "expected" incoming interface and > > checking whether the packet did indeed enter through that interface) > > The big question is, what do you do if most of your traffic _is_ > asymetrical? I mean, a more basic check could be, "Does the network that > this packet was sourced from exist *at all*?", or "Do I have a route back > to the source network through *any* interface?" > > That would cut down on a good amount of spoofing, like the idiots who > spoof from 1.1.1.1 etc. > > > Aleksei Roudnev, Network Operations Center, Relcom, Moscow (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 239-10-10, N 13729 (pager) (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)

2 1

One more smurf amp fixed
by darcy＠druid.net 01 May '98

01 May '98

I had contacted BBNPlanet about some of their networks being involved in a smurf attack. As a result they have fixed 137.49. iIf you have this one in a block list you can take it out. They have been asking one of their customers with 143.132 to fix their routers. So far that second one is still amplifying. Oh well. One by one we'll get them all. -- D'Arcy J.M. Cain <darcy(a){druid|vex}.net> | Democracy is three wolves http://www.druid.net/darcy/ | and a sheep voting on +1 416 424 2871 (DoD#0082) (eNTP) | what's for dinner.

1 0

Re: More amplifier blocks
by Chuck Davisson 01 May '98

01 May '98

Hi folks, > 204.183.36 11 is mine and is now fixed. Sorry for the problem. Must have missed this interface. Chuck Davisson Network Engineer TTSG

1 0

The Cidr Report
by Tony Bates 01 May '98

01 May '98

This is an auto-generated mail on Fri May 1 12:00:00 PDT 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 01May98 0) General Status Table History ------------- Date Prefixes 240498 51504 250498 51831 260498 51362 270498 51498 280498 51499 290498 51512 300498 51446 010598 51507 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 3510 Number of ASes announcing only one prefix: 1656 (861 cidr, 795 classful) Largest number of cidr routes: 371 announced by AS3561 Largest number of classful routes: 1116 announced by AS701 1) Gains by aggregating at the origin AS level --- 01May98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS2493 638 396 242 37.9% iSTAR Internet, Inc. AS4293 442 218 224 50.7% IMCI AS816 678 459 219 32.3% UUNET Canada (ASN-UUNETCA-AS4) AS174 798 615 183 22.9% Performance Systems International AS701 1116 938 178 15.9% Alternet AS3602 482 309 173 35.9% Sprint Canada Inc. AS3749 219 64 155 70.8% TECNET AS8505 156 30 126 80.8% Middle East Technical University AS7046 256 151 105 41.0% UUNET-CUSTOMER AS5668 118 46 72 61.0% Century Telephone Inc. AS2048 162 90 72 44.4% LaNet AS3221 110 41 69 62.7% EENet Autonomous System AS10928 106 46 60 56.6% UNKNOWN AS271 111 52 59 53.2% BCnet Backbone AS4755 90 32 58 64.4% Videsh Sanchar Nigam Ltd. India AS3804 200 142 58 29.0% Bell Solutions AS1239 555 500 55 9.9% SprintLink Backbone AS549 210 156 54 25.7% ONet Backbone AS1221 275 224 51 18.5% AARNET-AS AS72 84 36 48 57.1% Schlumberger Information Network AS4763 123 76 47 38.2% Telstra New Zealand AS7545 104 58 46 44.2% TPG Internet Pty Ltd AS684 95 53 42 44.2% Manitoba Regional Network Backbon AS852 157 117 40 25.5% AGT Advance Communication AS4740 365 325 40 11.0% ASN-OZEMAIL (Ozemail Pty Ltd) AS4200 131 93 38 29.0% AGIS (Apex Global Information Ser AS3493 163 125 38 23.3% INTERLINK AS6392 69 32 37 53.6% MidWest Communications, Inc. AS803 72 36 36 50.0% SaskNet Backbone AS6335 63 27 36 57.1% NTRNET For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

[Fwd: [Fwd: More amplifier blocks]]
by Jan Czmok 01 May '98

01 May '98

1 0

RE: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
by Dennis Simpson 01 May '98

01 May '98

So that's how we wound up on your list! Please remove any addresses you have for us. We are quite diligent about this, and you are most welcome to test us for smurf sourcing any time. It should definitely not work. Current addresses: 205.189.200/23 205.210.186/23 206.130.244/23 209.212.32/19 Old addresses we no longer use and will be turning back in by June: 204.50.247/24 206.107.177/23 206.186.216/23 209.5.14/23 209.50.76/22 209.50.80/22 If you are smurfed by any our downstreams on any address belonging to one of our blocks, let us know, and we will take steps to prevent their being a participant in a smurf attack. Thx, dennis > From: NOC <NOC(a)mercury.balink.com> > To: "'Erik Muller'" <nc0773(a)corp.netcom.com> > Cc: "'nanog(a)merit.edu'" <nanog(a)merit.edu> > Subject: RE: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!! > Date: Thu, 30 Apr 1998 15:44:58 -0400 > MIME-Version: 1.0 > Content-Transfer-Encoding: 7bit > > Erik, > > The script I wrote isn't really that smart... It just looks for two IP's > within the same /24 that were sending some kind of ICMP packet to the > victim machine. Since NetFlow logs don't break ICMP down to the type > and codes, I had to unilaterally make that decision. If your network is > clean, I sincerely apologize for any embarrassment or hassle this may > have caused, and I will remove it from the list. > > Regards, > Christian > > >-----Original Message----- > >From: Erik Muller [SMTP:nc0773@corp.netcom.com] > >Sent: Thursday, April 30, 1998 12:14 PM > >To: Martin, Christian > >Subject: Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!! > > > > > >> 163.179.230.0 > > > >This one's mine... the entire /24 is broken down as /30s, and .255 will > >respond with nothing more sinister than an ICMP unreachable. Any details > >on what results you saw that pointed to this network as an offender would > >be appreciated (since I can't see any danger from it). > > > >--------------------------------------------------------------------------- - > >Erik Muller, Network Engineer emuller(a)noc.netcom.net > >NETCOM Network Services Support NETCOM On-Line Communication Services > > > > > >On Wed, 29 Apr 1998, Martin, Christian wrote: > > > >> All, > >> > >> Here is my contribution to the block list. The script that generated > >> this will follow. It is 'public domain', in that it can be modified, > >> BUT, please give credit where credit is due! > >>

1 0

RE: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
by Douglas E. Pickett 01 May '98

01 May '98

> 199.243.210.0 Sorry, that's one of mine, but it should be fixed up now. Regards, Doug.

1 0