Re: chargen is the new DDoS tool?

2013-06-12 Thread shawn wilson
On Wed, Jun 12, 2013 at 4:51 AM, Jimmy Hess wrote: > On 6/12/13, shawn wilson wrote: >>> The scope is constantly changing. >> Not really. The old tricks are the best tricks. And when a default install > By best, you must mean effective against the greatest number of target

Re: chargen is the new DDoS tool?

2013-06-12 Thread shawn wilson
On Wed, Jun 12, 2013 at 7:14 AM, Aaron Glenn wrote: > On Wed, Jun 12, 2013 at 11:17 AM, shawn wilson wrote: >> >> >> Banks and insurance companies supposedly have some interesting actuarial >> data on this. >> > > Do you know of any publicly available s

Re: chargen is the new DDoS tool?

2013-06-12 Thread shawn wilson
Getting back to the topic. I just saw quite a few of our hosts scanned for this by 192.111.155.106 which doesn't say much on its own as http://dacentec.com/ is a hosting company. On Tue, Jun 11, 2013 at 11:27 PM, Ricky Beam wrote: > On Tue, 11 Jun 2013 22:52:52 -0400, Jimmy Hess wrote: >> >> Who

Re: Blocking TCP flows?

2013-06-13 Thread shawn wilson
Johnathan is correct about not using perl for this. There are some iptables modules, but they're all out of date or incomplete (I mention this because if you get around to making them work decent, I'll love you for it). Otherwise, perl -> IPC::Run -> ipt isn't going to gain you anything. And I'd be

Re: This is a coordinated hacking. (Was Re: Need help in flushing DNS)

2013-06-20 Thread shawn wilson
I think ICANN would have to add a delay in where a request was sent out to make sure everyone was on the same page and then what happens the couple thousand (more) times a day that someone isn't updated or is misconfigured? I think Netsol should be fined. Maybe even a class action suite filed aga

Re: /25's prefixes announced into global routing table?

2013-06-22 Thread shawn wilson
RFC 3587 - IPv6 Global Unicast Address Format On Jun 22, 2013 6:50 AM, "John Curran" wrote: > On Jun 22, 2013, at 1:45 AM, Owen DeLong wrote: > > > Yes… It will probably settle out somewhere around 100-125K routes. > > Owen - > > Can you elaborate some on this estimate? (i.e. what approximati

PDU recommendations

2013-06-23 Thread shawn wilson
We currently use Triplite stuff but they've got an issue where after a few minutes, they stop accepting new tcp connections. We're adding a new 30A circuit and I'm thinking of going with APC (ran them in the past and never had any issues). However, I figured I'd see if there was a better brand / sp

RE: PDU recommendations

2013-06-23 Thread shawn wilson
I know, old) turning on/off outlets than either of APC or TrippLite. > > -Petter > > > From: trit...@cox.net [trit...@cox.net] > Sent: Sunday, June 23, 2013 12:05 PM > To: shawn wilson; North American Network Operators Group > Subject:

Re: PDU recommendations

2013-06-23 Thread shawn wilson
So, that's not a very good endorsement :) Idk why you'd use a fuse in a PDU. The management interface can be rebooted without taking anything down on the TrippLite but it's at a colo and it *shouldn't* time out like it does. I think of this like a vehicle computer - if it goes down, you might sti

Re: PDU recommendations

2013-06-24 Thread shawn wilson
al rack mountables with management? We're > looking at these for our remote sites. > > > > Sent from my iPhone > > > > On Jun 24, 2013, at 6:10 AM, Måns Nilsson > wrote: > > > >> Subject: Re: PDU recommendations Date: Sun, Jun 23, 2013 at 09:3

Re: Google's QUIC

2013-06-28 Thread shawn wilson
On Jun 29, 2013 12:23 AM, "Christopher Morrow" wrote: > > On Fri, Jun 28, 2013 at 10:12 PM, Octavio Alvarez > wrote: > > On Fri, 28 Jun 2013 17:20:21 -0700, Christopher Morrow > > wrote: > > > >> > >> "Runs in top of UDP"... "Is not UDP"... > >> > >> If it has protocol set to 17 it is UDP. > > >

Re: One of our own in the Guardian.

2013-07-14 Thread shawn wilson
Well, I think Google has the right idea with providing Internet by floating balloons. And the way that cell phone tech has been improving, we might all have 10G in... 10 years or so? If Google is providing it, it'll be monitored by our government but hey, we'll have enough bandwidth to hang oursel

Re: One of our own in the Guardian.

2013-07-14 Thread shawn wilson
You're on a continent with the second least amount of light pollution of all of the continents on earth (iirc) and are somehow surprised about bad net access? I would question the wisdom of planning a tech conference there, but not the facility itself. On Sun, Jul 14, 2013 at 4:16 AM, David Conrad

Re: One of our own in the Guardian.

2013-07-14 Thread shawn wilson
On Jul 14, 2013 5:36 AM, "Bill Woodcock" wrote: > > > On Jul 14, 2013, at 2:12 AM, shawn wilson wrote: > >> You're on a continent with the second least amount of light pollution >> of all of the continents on earth (iirc) and are somehow surprised >&g

Re: CableWiFi SSID in Washington DC?

2013-08-26 Thread Shawn Wilson
There are indeed "FreePublicWiFi" nodes in some areas like Dupont Circle but it's not very convenient most of the time (signal strength or speed issues). IIRC there's a Commotion mesh around Columbia Heights which should be much faster. Personally, I just use a Mifi and never have any issues.

Re: Parsing Syslog and Acting on it, using other input too

2013-08-30 Thread Shawn Wilson
Christopher Morrow wrote: >On Thu, Aug 29, 2013 at 10:50 AM, Don Wilder >wrote: >> I wrote a script in Linux that watches for unauthorized login >attempts and >> adds the ip address to the blocked list in my firewall. You might >want to >> search sourceforge for a DYN Firewall and modify it fro

Re: Parsing Syslog and Acting on it, using other input too

2013-08-30 Thread shawn wilson
0:00 AM, Christopher Morrow < morrowc.li...@gmail.com> wrote: > On Fri, Aug 30, 2013 at 8:55 AM, Shawn Wilson wrote: > > > > > > Christopher Morrow wrote: > >>On Thu, Aug 29, 2013 at 10:50 AM, Don Wilder > >>wrote: > >>> I wrote a script in

Re: Bandwidth for a weekend @ Gaylord National Harbor, DC metro area

2013-09-17 Thread shawn wilson
I'm not sure of te topology around there, but you can get these 2.4Ghz dishes for *cheap* (I got one at a hamfest for $20 - spent as much on the rp-sma converter cost almost as much). If someone (or a colo) is near there, you might convince them to put up the same thing and work with that. I think

Re: The Making of a Router

2013-12-26 Thread Shawn Wilson
Totally agree that a routing box should be standalone for tons of reasons. Even separating network routing and call routing. It used to be that BSD's network stack was much better than Linux's under load. I'm not sure if this is still the case - I've never been put in the situation where the Li

Re: The Making of a Router

2013-12-27 Thread shawn wilson
On Fri, Dec 27, 2013 at 1:33 AM, wrote: > On Thu, 26 Dec 2013 11:16:53 -0800, Seth Mattinen said: >> On 12/26/13, 9:24, Andrew D Kirch wrote: >> > >> > If he can afford a 10G link... he should be buying real gear... I mean, >> > look, I've got plenty of infrastructure horror stories, but lets no

Re: The Making of a Router

2013-12-27 Thread Shawn Wilson
This has gotten a bit ridiculous. I was hoping someone could give technical insight into why this is good or not and not just "buy a box branded as a router because I said so or your business will fail". I'm all for hearing about the business theory of running an ISP (not my background or day

Re: The Making of a Router

2013-12-28 Thread Shawn Wilson
Chris Adams wrote: >Once upon a time, Shawn Wilson said: >> I was hoping someone could give technical insight into why this is >good or not and not just "buy a box branded as a router because I said >so or your business will fail". I'm all for hearing about the

Re: NSA able to compromise Cisco, Juniper, Huawei switches

2013-12-30 Thread Shawn Wilson
Saku Ytti wrote: >On (2013-12-30 20:30 +1100), sten rulz wrote: > >I really think we're doing disservice to an issue which might be at >scale of >human-rights issue, by spamming media with 0 data news. Where is this >backdoor? How does it work? How can I recreate on my devices? I don't really

Re: NSA able to compromise Cisco, Juniper, Huawei switches

2013-12-30 Thread shawn wilson
On Mon, Dec 30, 2013 at 8:07 AM, Ray Soucy wrote: > > I hope Cisco, Juniper, and others respond quickly with updated images for > all platforms affected before the details leak. So, if this plays out nice (if true, it won't), the fix will come months before the disclosure. Think, if you're leasi

Re: NSA able to compromise Cisco, Juniper, Huawei switches

2013-12-30 Thread shawn wilson
On Mon, Dec 30, 2013 at 1:17 PM, Lorell Hathcock wrote: > NANOG: > > Here's the really scary question for me. > > Would it be possible for NSA-payload traffic that originates on our private > networks that is destined for the NSA to go undetected by our IDS systems? > Yup. Absolutely. Without a d

Re: NSA able to compromise Cisco, Juniper, Huawei switches

2013-12-31 Thread shawn wilson
On Tue, Dec 31, 2013 at 8:05 AM, Ray Soucy wrote: > This whole backdoor business is a very, very, dangerous game. While I agree with this (and the issues brought up with NSA's NIST approved PRNG that RSA used). If I were in their shoes, I would have been collecting every bit of data I could (ie,

Re: verify currently running software on ram

2014-01-13 Thread shawn wilson
dd kmem and see if it's what you'd expect (size of ram+swap). If so you should be able to look at it Also see Volatility On Jan 13, 2014 7:21 AM, "Tassos Chatzithomaoglou" wrote: > Saku Ytti wrote on 13/1/2014 12:51: > > On (2014-01-13 12:46 +0200), Saku Ytti wrote: > >> On (2014-01-13 12:26 +02

Re: verify currently running software on ram

2014-01-13 Thread shawn wilson
Doh, tired and not reading - the util should help after you get a dump though. On Jan 13, 2014 7:29 AM, "shawn wilson" wrote: > dd kmem and see if it's what you'd expect (size of ram+swap). If so you > should be able to look at it > > Also see Volatility &g

Windows Update subnets

2014-01-16 Thread shawn wilson
Does anyone have a list of all of the ranges Microsoft uses for Windows Update? I've found domains but not a full list of subnets.

<    1   2