- Test - lists.nanog.org

Re: [nsp] known networks for broadcast ping attacks
by Jon Lewis 12 Aug '97

12 Aug '97

On Mon, 11 Aug 1997, some anonymous source wrote: > the program you are referring to is smurf.c which i believe was already > discussed on this list. I knew that...but I'd forgotten the name of the program. > the answer to the problem is the fact that there are hard coded > broadcast addresses within the programs. the people who are taking out > servers from irc are the idiots who would not know how to change these. This may be true, but what's to stop the writers of smurf and the other programs from distributing version 2 with all new network addresses? Fixing the 119 networks used to attack FDT will help, but I doubt it will solve the problem. Here's a sorted list of the networks used to attack FDT (pulled from my 1.5mb of tcpdump data which was just a brief sample of the data from our attack Sunday. If any of them belong to you, shame on you. The really interesting ones are the 0.0.0.0 and 255.255.255.255 sources. 18:55:54.836177 0.0.0.0 > 205.229.48.20: icmp: echo reply (ttl 245, id 61586) 18:55:55.816177 255.255.255.255 > 205.229.48.20: icmp: echo reply (ttl 249, id 4 Are these just misconfigured devices on some network from the list below? I suppose for bonus points, I could write a script to get the contact addresses from as many of these as possible and email them a note about how they're being used for network attacks. 0.0.0 4.0.1 4.0.144 4.0.84 38.146.219 128.101.101 128.101.233 128.101.87 128.102.18 128.135.181 128.135.23 128.161.1 128.190.156 129.16.1 129.237.128 129.237.129 129.237.130 129.237.131 129.237.2 129.237.80 129.237.83 129.237.86 129.237.87 129.241.181 129.241.56 129.241.57 129.43.7 130.132.1 130.132.143 130.132.159 131.119.0 131.119.58 134.24.38 134.84.254 136.142.185 136.142.254 137.39.130 137.39.136 137.39.166 137.39.184 144.228.20 144.232.8 160.147.28 163.179.230 165.154.1 166.48.35 170.140.3 170.140.35 170.140.4 170.140.5 170.140.6 192.160.127 192.88.114 192.9.9 193.10.85 198.137.140 198.163.155 198.3.101 198.41.0 198.53.119 198.53.145 198.53.33 198.53.44 198.80.46 199.0.154 199.0.216 199.166.6 199.183.24 199.199.93 199.227.0 199.227.28 199.242.23 204.112.14 204.162.96 204.186.0 204.186.95 204.225.245 204.50.176 204.7.246 204.7.247 204.70.59 204.71.242 205.147.225 205.149.75 205.150.207 205.150.221 205.164.8 205.177.10 205.177.4 205.211.8 205.211.9 205.252.5 205.253.29 206.102.224 206.129.122 206.13.28 206.141.250 206.161.255 206.170.28 206.171.128 206.222.98 206.54.225 206.98.160 207.107.244 207.137.200 207.154.150 207.171.87 207.181.65 207.19.74 207.216.162 207.240.8 207.25.16 207.51.36 207.67.241 207.91.124 209.12.0 209.20.130 209.82.1 255.255.255 ------------------------------------------------------------------ Jon Lewis <jlewis(a)fdt.net> | Unsolicited commercial e-mail will Network Administrator | be proof-read for $199/message. Florida Digital Turnpike | ______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key____

4 3

Re: Packet size data
by Paul G. Donner 12 Aug '97

12 Aug '97

What about cflowd? At 11:23 AM 8/11/97 -0700, Justin W. Newton wrote: >Hi, > Does anyone have any /recent/ information on the breakdown of packet sizes >crossing the net right now? I have seen some of the older data, but am >interested in whether or not the percentages are changing over time, and if >so, how. I.e. I could see people moving from interactive services such as >telnet for reading mail and news to going to a client based system would up >the packet sizes. Likewise, the use of some of the streaming video and >audio applications out there might lower it again. In my mind, recent is >anything that has been done in the last 6 months or so. > >************************************************************** >Justin W. Newton voice: +1-415-482-2840 >Senior Network Architect fax: +1-415-482-2844 >PRIORI NETWORKS, INC. http://www.priori.net >Legislative and Policy Director, ISP/C http://www.ispc.org >"The People You Know. The People You Trust." >************************************************************** > >

4 3

Re: Packet size data
by pkavi＠pcmail.casc.com 12 Aug '97

12 Aug '97

Justin, Try the following web pointer maintained by the good folks at the National Lab for Advanced Network Research (NLANR). http://www.nlanr.net/NA/Learn/packetsizes.html Lots of useful recent and historical information there (most recent is a packet distribution recorded as of 6/25/97). The average packet size passed 250 bytes over a year ago, and still seems to be rising although I haven't calculated the exact value. Prabhu Kavi IP Business Marketing Manager Ascend Communications prabhu.kavi(a)ascend.com 508-952-1047 ______________________________ Reply Separator _________________________________ Subject: Packet size data Author: "Justin W. Newton" <justin(a)priori.net> at smtplink Date: 8/11/97 11:23 AM Hi, Does anyone have any /recent/ information on the breakdown of packet sizes crossing the net right now? I have seen some of the older data, but am interested in whether or not the percentages are changing over time, and if so, how. I.e. I could see people moving from interactive services such as telnet for reading mail and news to going to a client based system would up the packet sizes. Likewise, the use of some of the streaming video and audio applications out there might lower it again. In my mind, recent is anything that has been done in the last 6 months or so. ************************************************************** Justin W. Newton voice: +1-415-482-2840 Senior Network Architect fax: +1-415-482-2844 PRIORI NETWORKS, INC. http://www.priori.net Legislative and Policy Director, ISP/C http://www.ispc.org "The People You Know. The People You Trust." **************************************************************

1 0

Re: Backup Power Schemes
by Bill McCauley 12 Aug '97

12 Aug '97

>All share the same hassles to some extent or another. They have to >be run, UNDER LOAD, an hour+ per month. They need the oil changed. >They need clean fuel; #2 Diesel tends to grow weird bugs that clog >the filters. The propane and natural gas can feed modified gasoline >piston engines and turbines. Some Diesels run on a fix of #2 and >gases. [The ultimate example -- a sewage plant will recover sewer >gas and use it w/Diesel. If your userbase is full of BS; or your >tie curls and your boss has 2 horns, you might go this route...] >Natural gas has advantages of no storage hassles; propane does >not go stale. In earthquake country, natural gas is as prone to interruption as any other utility. The utility companies actually have shut off valves in the lines which shut off gas mains when seismic activity over a certain level is detected. Being as how gas lines themselves are prone to shearing fractures in the seismic event itself, natural gas doesn't buy you much as a backup fuel. Unless, you maintain your own tank, which takes you back to most of the problems noted above. Regards, Bill McCauley

5 4

Question ??
by Ignacio Funes Maderey 12 Aug '97

12 Aug '97

I have tried to run mrtg with my router (Cisco 7500). This router has a controller which accept an E1 and divides it as you want. The interfaces that are not directly connected to this controller are OK (for example interfaces such as Serial5/2, Ethernet3/5, etc...), but I have problems with those interfaces such as (Serial5/0:14, Serial5/0:13, etc.). The problems arise since I run cfgmaker public@router_ip, because the ports related with the interfaces directly connected to the controller are wrong. In fact, when I run ./mrtg mrtg.cfg I get the next error messages: CFG Error in "maxbytes[enepacatlan(rdi/e1)]": 256000 must be a Number smaller than maxint ........ What should I do?????? I will appreciate your help. Thank you!!!!!!

2 1

NANOG 11 UPDATE
by Pam Ciesla 12 Aug '97

12 Aug '97

I have had several people register for the NANOG 11 Meeting. I am working with NorthWest & America West on discount and NO Saturday Stay requirements fares. I hope to have both contract numbers later today. SO STAYED TUNED. I will also give a list of alternate hotels within 10 minutes of the meeting site. Thanks xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 313-936-0172 - phone Merit Network, Inc. 313-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

known networks for broadcast ping attacks
by Edward Henigin 12 Aug '97

12 Aug '97

Here's a list of KNOWN NETWORKS that are being used to ping flood other networks. If one of your networks is in here, FILTER BROADCAST PINGS NOW FROM ENTERING YOUR NETWORK. YOUR NETWORK IS BEING USED TO ATTACK OTHER NETWORKS. In my original e-mail, I noted that I suspected that there was a list of known networks that could be used to attack other networks. It appears my suspicion has been validated. This is from source code for 'smurf.c', which is used to generate the ICMP broadcast pings, as I described in an earlier e-mail to this mailing list. -----Forwarded message----- /* * * smurf.c by TFreak [21:52 - 07/28/97] * * spoofs icmp packets from a host to various broadcast addresses resulting * in multiple replies to that host from a single packet. * * mad head to: * nyt, soldier, autopsy, legendnet, #c0de, irq for being my guinea pig, * MissSatan for swallowing, napster for pimping my sister, the guy that * invented vaseline, fyber for trying, knowy, old school #havok, kain * cos he rox my sox, zuez, toxik, robocod, Bug_Lord, and everyone else * that i might have missed (you know who you are). * * mad anal to: * #madcrew/#conflict for not cashing in their cluepons, EFnet IRCOps * because they plain suck, Rolex for being a twit, everyone that * trades warez, Caren for being a lesbian hoe, AcidKill for being her * partner, #cha0s, sedriss for having an ego in inverse proportion to * his penis and anyone that can't pee standing up. * * disclaimer: * I cannot and will not be held responsible nor legally bound for the * malicious activities of individuals who come into possession of this * program and refuse to provide help or support of any kind and do NOT * condone use of this program to deny service to anyone or any machine. * This is for educational use only. Please Don't abuse this. * */ [.. code deleted... EJH ] /* add your own broadcast ips, just make sure to end with NULL */ char *bcastaddr[] = { "206.154.141.255", "165.154.1.255", "205.139.4.255", "198.3.101.255", "204.71.177.255", "255.255.255.255", "207.137.200.255", "192.41.177.255", "206.13.28.255", "144.228.20.255", "206.137.184.255", "192.41.177.255", "206.154.141.255", "165.154.1.255", "206.13.28.255", "129.16.1.0", "198.32.186.255", "205.206.120.255", "206.186.21.255", "204.212.36.255" "149.142.13.255", "208.132.231.255", "129.82.103.255", "130.63.236.255" "130.113.64.255", "198.53.145.255", "205.211.8.255", "204.186.99.255", "208.131.162.255", "130.132.143.255", "128.135.181.255", "204.162.96.0", "205.180.58.255", "206.86.0.255", "128.2.72.255", "199.227.0.255", "199.103.128.255", "208.218.130.255", "208.150.60.255", "206.26.128.255", "199.0.65.255", "207.69.200.255", "207.228.64.255", "204.247.0.255", NULL }; [.. code deleted... EJH ] -----End of forwarded message-----

16 26

Re: Packet size data
by brett watson 11 Aug '97

11 Aug '97

> Hi, > Does anyone have any /recent/ information on the breakdown of packet sizes > crossing the net right now? I have seen some of the older data, but am > interested in whether or not the percentages are changing over time, and if > so, how. I.e. I could see people moving from interactive services such as > telnet for reading mail and news to going to a client based system would up > the packet sizes. Likewise, the use of some of the streaming video and > audio applications out there might lower it again. In my mind, recent is > anything that has been done in the last 6 months or so. i can't give you historical data but here's current netflow data from our mae-west (san jose, not nasa/ames) and mae-east peer routers: peer1.sjc1#sh ip ca fl IP packet size distribution (9577M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .001 .500 .032 .013 .016 .009 .009 .009 .020 .017 .006 .009 .009 .007 .003 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .008 .004 .088 .042 .188 .000 .000 .000 .000 .000 .000 peer1.wdc1#sh ip ca flow IP packet size distribution (12535M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .000 .646 .045 .010 .010 .005 .006 .005 .015 .013 .015 .009 .005 .005 .003 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .003 .006 .095 .014 .078 .000 .000 .000 .000 .000 .000 i guess everyone is pinging these days :) -brett

1 0

Re: Backup Power Schemes
by Tony Li 11 Aug '97

11 Aug '97

> That takes us back to UPSi on equipment, and generators. Technologies > available are: > .... Don't forget cogeneration equipment. One would think that local power, UPS, and one flavor of generator should suffice. For the "reasonable". ;-) Tony

3 2

Packet size data
by Justin W. Newton 11 Aug '97

11 Aug '97

Hi, Does anyone have any /recent/ information on the breakdown of packet sizes crossing the net right now? I have seen some of the older data, but am interested in whether or not the percentages are changing over time, and if so, how. I.e. I could see people moving from interactive services such as telnet for reading mail and news to going to a client based system would up the packet sizes. Likewise, the use of some of the streaming video and audio applications out there might lower it again. In my mind, recent is anything that has been done in the last 6 months or so. ************************************************************** Justin W. Newton voice: +1-415-482-2840 Senior Network Architect fax: +1-415-482-2844 PRIORI NETWORKS, INC. http://www.priori.net Legislative and Policy Director, ISP/C http://www.ispc.org "The People You Know. The People You Trust." **************************************************************

1 0