Re: Botnet hunting resources (was: Re: DOS in progress ?)

2009-08-08 Thread goemon
On Fri, 8 Aug 2009, Luke S Crawford wrote: 1. are there people who apply pressure to ISPs to get them to shut down botnets, like maps did for spam? sadly no. I've got 50 gigs of packet captures, and have been going through with perl to detect IPs who send me lots of tcp packets with 0 payload

DNS query repetition ( was DNS Hardening )

2009-08-08 Thread George Barwood
In an earlier thread, Jon Levine asked > Other than DNSSEC, I'm aware of these relatively simple hacks to add > entropy to DNS queries. > 1) Random query ID > 2) Random source port > 3) Random case in queries, e.g. GooGLe.CoM > 4) Ask twice (with different values for the first three hacks) an

Re: sat-3 cut?

2009-08-08 Thread William Allen Simpson
William Allen Simpson wrote: By the map in the article, the termini are Spain and Portugal on one end, and South Africa on the other. Surely, a single break wouldn't affect both ends A week later article by the BBC says it didn't. Rather, the Benin branch has the break. http://news.bbc.c

RE: Botnet hunting resources (was: Re: DOS in progress ?)

2009-08-08 Thread Frank Bulk
Some hardcore stuff on S/RTBH here: http://www.arbornetworks.com/index.php?option=com_docman&task=doc_download&g id=112 http://www.cisco.com/web/about/security/intelligence/blackhole.pdf (which appears to have replaced http://www.cisco.com/warp/public/732/Tech/security/docs/blackhole.pdf) http://ww

Re: Botnet hunting resources

2009-08-08 Thread Joel Jaeggli
Roland Dobbins wrote: > > On Aug 8, 2009, at 11:57 AM, Luke S Crawford wrote: > >> 2. is there a standard way to push a null-route on the attackers >> source IP upstream? > > Sure - if you apply loose-check uRPF (and/or strict-check, when you can > do so) on Cisco or Juniper routers, you can c

ServerBeach Name Server Outage?

2009-08-08 Thread Jon Kibler
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, Is anyone else that uses ServerBeach hosting having issues with their name servers (ns[12].geodns.net) failing to resolve their hostnames? Jon K - -- Jon R. Kibler Chief Technical Officer Advanced Systems Engineering Technology, Inc. Charleston,

Re: Botnet hunting resources (was: Re: DOS in progress ?)

2009-08-08 Thread Luke S Crawford
Roland Dobbins writes: > On Aug 8, 2009, at 11:57 AM, Luke S Crawford wrote: > > > 2. is there a standard way to push a null-route on the attackers > > source IP upstream? > > Sure - if you apply loose-check uRPF (and/or strict-check, when you > can do so) on Cisco or Juniper routers, you can c