Re: Symantec detected Slammer worm hours before

2003-02-25 Thread Scott Francis
On Mon, Feb 24, 2003 at 05:07:33PM -, [EMAIL PROTECTED] said: [snip] So they meant they got IDS hits hours before anyone posted a full description of the attacks to bugtraq when they said they had detected the worm hours before it spread? That's a novel use of english :) One typically

Re: IP Management tool for service providers

2003-02-25 Thread jlewis
On Thu, 20 Feb 2003, John Todd wrote: Here's one. I haven't used it in production, but the demo that I was given was pretty slick. Works on pretty much any POSIX platform... Alas, it is commercial software. Voyager IP http://www.vger.com/products.shtml#v_ip Where did you see a demo?

Web Caches..

2003-02-25 Thread Mark Segal
I'm wondering if anybody has had RECENT experience with web caches. If so, what is your favourites? why? Two stipulations: 1) I want one that doesn't require a department to maintain a list of uncachable objects. 2) It must support wccp. Off list replies are welcomed. Mark -- Mark

Thanks for the heads-up.

2003-02-25 Thread tbolling
Voyager IP http://www.vger.com/products.shtml#v_ip Where did you see a demo? Any idea what it costs? I just sent them an email. Not much info on their web site, and their contact submission form is broken. Sorry about the broken link, should be fixed now. Your e-mail should get a reply

[ISN] SIP weakness could expose VoIP gear to attacks

2003-02-25 Thread Bram Shirani
(forwarded from ISN) http://www.nwfusion.com/news/2003/0224sip.html By Phil Hochmuth Network World Fusion 02/24/03 A glitch in some vendors' Session Initiation Protocol (SIP) software could leave SIP-enabled devices - such as IP phones, IP PBXs and instant messaging clients - vulnerable to

Re: untied

2003-02-25 Thread Christopher L. Morrow
On Mon, 24 Feb 2003, Ron da Silva wrote: Hmm...I've called one of their 800's before and had an option to select 3 to complain (er I mean talk to someone) hint: if you have a 'nonstandard' computer (not windows/mac) don't mention that or your complaint gets /dev/null'd :( experience.

69.0.0.0/8 - Please update your filters

2003-02-25 Thread Hsu, Vicky
-Original Message- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has

Re: 69.0.0.0/8 - Please update your filters

2003-02-25 Thread E.B. Dreger
HV Date: Tue, 25 Feb 2003 14:09:26 -0800 HV From: Hsu, Vicky HV It has recently come to our attention that many Internet HV routers are still filtering out IP addresses in the HV 69.0.0.0/8 range. If YOU are still filtering this block in Even after the NANOG thread months back? Yuck. I

Re: 69.0.0.0/8 - Please update your filters

2003-02-25 Thread Stephen Sprunk
Thus spake E.B. Dreger [EMAIL PROTECTED] I _still_ like the idea of putting DNS roots in new IP blocks during sunrise and having the final octet be .0 and/or .255. It would be nice to catch dated bogon filters, lame attempts at smurf stopping, _and_ stale root.cache in one blow. From an

Re: 69.0.0.0/8 - Please update your filters

2003-02-25 Thread jlewis
On Tue, 25 Feb 2003, Stephen Sprunk wrote: Thus spake E.B. Dreger [EMAIL PROTECTED] I _still_ like the idea of putting DNS roots in new IP blocks during sunrise and having the final octet be .0 and/or .255. It would be nice to catch dated bogon filters, lame attempts at smurf stopping,

Re: 69.0.0.0/8 - Please update your filters

2003-02-25 Thread Haesu
Somebody with one of these new cursed allocations ought to setup a system with two IPs (one from the new block, one from an older established block) and do reachability tests to various parts of the net, and then automate sending a notice of bogus filters to those ASNs reachable from the old

Re: 69.0.0.0/8 - Please update your filters

2003-02-25 Thread E.B. Dreger
SS Date: Tue, 25 Feb 2003 19:46:53 -0600 SS From: Stephen Sprunk (Props to whoever thought up what you put in the To field) SS From an academic standpoint, that would be a very interesting SS experiment. However, most of us are paid to keep our SS networks or services running, not to

Re: 69.0.0.0/8 - Please update your filters

2003-02-25 Thread jlewis
On Tue, 25 Feb 2003, Haesu wrote: And how quickly would those ASN's respond to or even comprehend the bogon-filter update notices? If those ASN's are competent and quick-responsive ones, we should not even be having these prroblems to begin with. If the alternative is getting space, giving

Re: 69.0.0.0/8 - Please update your filters

2003-02-25 Thread Haesu
If the alternative is getting space, giving it to customers, and explaining why they can't reach X, Y, and Z on their connection to us, but they can on other internet connections, we're going to at least have to try. True, but we'd have to try something that would be effective... Imagine how

AS852 - AS577 problems ?

2003-02-25 Thread Mike Tancsa
Anyone know what is up between them in Ontario, Canada ? I am seeing pretty high latency and packet loss in both directions. Dont know if its a chronic capacity problem or just a dead/down circuit ? Bell's looking glass showed (prior to my prepending) BGP routing table entry for

Re: 69.0.0.0/8 - Please update your filters

2003-02-25 Thread Stephen Gill
As a brief reminder and in addition to the URLs below folks are also welcome to peer with the Team-Cymru's bogon route server which will automatically and securely update your bogon filters for you. Instructions are available at: http://www.cymru.com/Bogons/index.html Cheers, -- steve [EMAIL

Network monitoring/IDS rant - What's hot what's not?

2003-02-25 Thread Christopher J. Wolff
Tivoli, Openview, Unicenter, ipmonitor, mrtg, nagios? There are many network monitoring options but each option has its pitfalls. I'm rapidly coming to the conclusion that any software Computer Associates publishes is designed for the criminally insane. However, there 'has' to be something that