- Test - lists.nanog.org

NKN.EDU
by Aleph One 09 Apr '97

09 Apr '97

Well while emailing the admins of all domains involved in a SPAM from UMARK.COM I came across their ISP, NKN.NET. They also happen to have registered NKN.EDU. How did this one get past the InterNIC? Aleph One / aleph1(a)dfw.net http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01

1 0

RE: SNMP probers
by Dave O'Shea 09 Apr '97

09 Apr '97

I'd ignore it. Having leaked a few (less than a million, I'm sure) SNMP 'gets' because I fat-fingered a subnet mask, or let a traceroute-based discovery routine go awry, or was just plain curious... -----Original Message----- From: Randy Bush [SMTP:randy@psg.com] Sent: Wednesday, April 09, 1997 9:28 AM To: nanog(a)merit.edu Subject: SNMP probers What do folk do about persistent SNMP probers? I.e. j random clueless sites which keep querying one's backbone router(s). E.g. this morning I get the NOC shift change report with the folk hammering on our routers as if we were stupid enough to use 'public' as the community string. > mae-east Bad community string from 194.168.51.4 > mae-east Bad community string from 193.38.113.216 > mae-west Bad community string from 202.85.254.5 > mae-west Bad community string from 206.79.240.190 > mae-west Bad community string from 193.38.113.216 > pdx Bad community string from 204.119.24.200 > pen Bad community string from 164.117.144.245 > pen Bad community string from 193.38.113.216 > paix Bad community string from 204.79.240.190 So every day some poor NOC person has to search these folk down with the great tools we have, send email, get told they're nazi idiots, ... So what do folk do about this? randy

2 1

RE: SNMP probers
by Chris A. Icide 09 Apr '97

09 Apr '97

I would suspect a good portion of these are run-away enterprise autodiscover jobs. As for what to do? Obviously, education would help alot, but, we all know how successful that is in this industry with the number of new folks getting involved every day. If I remember right, Proteon routers allowed you to specify what interfaces would accept SNMP queries. You could do something of the same with an access-list on a cisco thats not heavily used. I also believe that the Cisco routers do allow you to apply an access list to your SNMP config, but this won't prevent your router from receiving the request and expending CPU trying to figure out what to do with it. What do we do about it? Grumble. Make a phone call here and there if it gets out of hand. Chris ---------- From: Randy Bush[SMTP:randy@psg.com] Sent: Wednesday, April 09, 1997 9:28 AM To: nanog(a)merit.edu Subject: SNMP probers What do folk do about persistent SNMP probers? I.e. j random clueless sites which keep querying one's backbone router(s). E.g. this morning I get the NOC shift change report with the folk hammering on our routers as if we were stupid enough to use 'public' as the community string. > mae-east Bad community string from 194.168.51.4 > mae-east Bad community string from 193.38.113.216 > mae-west Bad community string from 202.85.254.5 > mae-west Bad community string from 206.79.240.190 > mae-west Bad community string from 193.38.113.216 > pdx Bad community string from 204.119.24.200 > pen Bad community string from 164.117.144.245 > pen Bad community string from 193.38.113.216 > paix Bad community string from 204.79.240.190 So every day some poor NOC person has to search these folk down with the great tools we have, send email, get told they're nazi idiots, ... So what do folk do about this? randy

1 0

SNMP probers
by randy＠psg.com 09 Apr '97

09 Apr '97

What do folk do about persistent SNMP probers? I.e. j random clueless sites which keep querying one's backbone router(s). E.g. this morning I get the NOC shift change report with the folk hammering on our routers as if we were stupid enough to use 'public' as the community string. > mae-east Bad community string from 194.168.51.4 > mae-east Bad community string from 193.38.113.216 > mae-west Bad community string from 202.85.254.5 > mae-west Bad community string from 206.79.240.190 > mae-west Bad community string from 193.38.113.216 > pdx Bad community string from 204.119.24.200 > pen Bad community string from 164.117.144.245 > pen Bad community string from 193.38.113.216 > paix Bad community string from 204.79.240.190 So every day some poor NOC person has to search these folk down with the great tools we have, send email, get told they're nazi idiots, ... So what do folk do about this? randy

5 5

Re: floods
by Kevin Brick 09 Apr '97

09 Apr '97

At 08:25 PM 4/8/97 -0400, Hoisl(a)aol.com wrote: > I am doing a project for school and I was wondering if you could answer my >question. What can be done to reduce the amount of flood damage? Thanks. rain > /dev/null -- Kevin Brick kevin(a)alink.net A-Link Network Services, Inc http://www.alink.net 408 720-6161 ------------------------------------------------ "The abdomen, the chest, and the brain will forever be shut from the intrusion of the wise and humane surgeon". --Sir John Eric Ericksen, British surgeon, appointed Surgeon Extraordinary to Queen Victoria 1873.

1 0

floods
by Hoisl＠aol.com 09 Apr '97

09 Apr '97

I am doing a project for school and I was wondering if you could answer my question. What can be done to reduce the amount of flood damage? Thanks.

2 1

Network Perf. Speaker Needed
by Susan R. Harris 08 Apr '97

08 Apr '97

Greetings - we're starting initial agenda planning for the next NANOG meeting, to be held June 5-6 in Tampa. Could we interest someone out there in giving a 20-to-30 minute "Introduction to Network Performance Measurement?" The talk would explain what it's possible to measure and give examples of useful types of internal and external measurements (e.g., link utilization and DS3/DS1 MIB stats for internal metrics, one-way delay and packet loss for external.) What we're aiming for is a discussion of performance measurement fundamentals - not specifics on what you're measuring in your network. The presentation would be followed by a panel discussion with short reports on specific tools (SNMP tools, ISODE, CMU, tcl etc.), to be moderated by Randy Bush. We'd also like volunteers to give short reports as part of the panel. Please let Bill Norton or me know if you're interested in helping out. And while we're at it, are there other topics you'd like to hear about at the meeting? ------------------------------------------------------------------------ Susan R. Harris, Ph.D. Merit Network, Inc. srh(a)merit.edu Phone: (313) 936-2100 Fax: (313) 747-3185 ------------------------------------------------------------------------

1 0

Problems with the inet-acess list
by Michael Dillon 08 Apr '97

08 Apr '97

I contacted someone at BSDI who tells me that Tony Sanders knows about the list problem and is working on it. Michael Dillon - Internet & ISP Consulting Memra Software Inc. - Fax: +1-250-546-3049 http://www.memra.com - E-mail: michael(a)memra.com

1 0

off-topic backhaul question
by andrew khoo 07 Apr '97

07 Apr '97

this is possibly off-topic, so i apologize in advance. we require to find suitable contacts to assist us in: 1) arranging a DS3 ATM connection into the Pacbell ATM cloud from PAIX 2) arranging a DS3 ATM connection from 49 Geary, San Francisco into the Pacbell ATM cloud. anyone can assist? --- andrew khoo plumber @ OGN ph: +61-2-9223-2777 gsm: +61-416-161-234

1 0

RE: Peering points
by Dave Van Allen 07 Apr '97

07 Apr '97

FYI Sprint is not allowing anything larger than 6Mb from Pensauken, circa April 4, 1997, for customer connections that is. Best regards, David Van Allen - You Tools Corporation / FASTNET(tm) dave(a)fast.net (610) 289-1100 http://www.fast.net FASTNET - PA/NJ/DE Internet Solutions >-----Original Message----- >From: Avi Freedman [SMTP:freedman@netaxs.com] >Sent: Saturday, April 05, 1997 5:03 AM >To: SEAN(a)SDG.DRA.COM >Cc: nanog(a)merit.edu >Subject: Re: Peering points > >> Or is the entire thing irrelevant, because everyone is moving to private >> bilateral connections. And the important thing is how many providers >> does someone peer, not how many exchange points they're connected to. >> For the price of one Sprint-NAP connection, I can get several connections >> to Canada. And we have a lot more customers in Canada than at the >> Sprint-NAP. We already peer with everyone at the Sprint-NAP, or been >> turned down by them elsewhere. So one more exchange point doesn't buy >> much. >> -- >> Sean Donelan, Data Research Associates, Inc, St. Louis, MO >> Affiliation given for identification not representation > >The SprintNAP is a much less congested place than MAE-East (though most >providers also have less capacity out of it [besides Sprintlink, GSL, >ICM, etc...])... > >Avi >

7 7