swinog August 2013

swinog@lists.swinog.ch

37 participants
20 discussions

How to automate abuse complaints for ip based violations
by Markus Wild 23 Aug '13

23 Aug '13

Hi there, when looking through traffic analysis, I can more or less easily identify IP addresses that exhibit bad behavior (like massive port/address scanning, attempting to log into joomla/wp administration URLs, POP3/SMTP account scanning, etc) which need to be blocked. Now, since most of these IPs are not the actual culprits, but merely infected machines, it would be helpful for the internet health as a whole to report such incidents to their respective ISPs. Here's where the problem starts:) My manual approach would be to lookup whois data for the respective IP (which by itself can be a multi step process, since you first need to find the right registry), and look for an abuse-contact there. But, whois isn't exactly engineered for automated mass lookups (+), and if I did this I'm sure I'd probably be violating terms of use of at least some of the registry whois servers, and be locked out. So, what alternatives are there? I saw that abuse.net keeps a nice DNS based lookup service for domain names, but they unfortunately don't do this for IP addresses. How are others doing this? I know I occasionally received output of fail2ban scripts when working for a larger ISP. Are these all in-house local developments? Cheers, Markus (+) joomla/wp scans alone yielded > 3000 ip addresses in one day for our little network...

4 4

cisco switches: new config with vlan defintion is not applied to startup-config for some reason
by Lukas Eisenberger 21 Aug '13

21 Aug '13

Hi list During a future migration I will migrate the configuration of around onehundert already existing switches. Because I am lazy as many it guys I prepared the configs which I want to apply to the switches in order to safe time. Many things change from the previous config to the future one: lacp uplinks, vlan defintions, management vlan and so on. So during the miration I want to do something like this: copy tftp://10.6.100.3/config.txt startup-config and do a reload or configure replace tftp://10.6.100.3/config.txt I tested my miration path in the lab and I figured out that low numbering vlans in the range of 2-1001 are for some strange reason not applied to the config. I tried also deleting vlan.dat and change to vtp of or transparent/server/client and diffrent vtp versions before applying the config without success. Does somebody have a clou about the strange behaviour? I use iso version 15.0(2)SE on a 2960S Cheers Luke

3 3

Domain ip-plus.net hijacked?
by Fredy Kuenzler 20 Aug '13

20 Aug '13

It seems that the Domain ip-plus.net got hijacked by some domain grabber: http://www.ip-plus.net/ Traceroutes to any Swisscom host look rather ugly. -- Fredy Kuenzler Init7 (Switzerland) Ltd. AS13030 St. Georgen-Strasse 70 CH-8400 Winterthur Skype: flyingpotato Phone: +41 44 315 4400 Fax: +41 44 315 4401 Twitter: @init7 / @kuenzler http://www.init7.net/

9 8

DDoS Attack to ZUGERNET
by ZUGERNET NOC 19 Aug '13

19 Aug '13

Dear all We are memeber on this list since many years now, but not so chatty, more listening. But today I feel a strong necessity to contact the community, since we (ISP ZUGERNET, AS 28859) are being attacked many times over the last 24 hours with huge traffic disabling our network completely. The attack is really very damaging: to ourselves, to our customers and to their customers and partners. You can imagine... If someone of you can give me a hint on how to track down, WHO is causing this, I would really appreciate any help and may it be very small. I know, that technically such attacks are not trackable - but what I mean is more: if someone can share some "underground knowledge" with me to possibly finding out which bot-net is used (under the control of whom etc; we can share some netflow capture with a huge amount of source-ip-addresses) and possibly has "underground-contacts" to find out more about them...? Thank you in advance! Feel free to answer me off-list if you feel more appropriate. Kind regards, Patrick Hofmann ___________________________________________________________________________ ZUGERNET, Hofmann Informatik AG · Grienbachstr. 17 · 6300 Zug · Switzerland http://www.zugernet.ch/ · fon +41 (0)41 766 88 22 · fax +41 (0)41 766 88 33

4 4

Domain ip-plus.net hijacked?
by Fredy Kuenzler 19 Aug '13

19 Aug '13

1 0

DNS amplification attack (bfhmm.com in TXT)
by Michael Richter 16 Aug '13

16 Aug '13

Anyone else see such packets on his DNS servers? I've just blocked that query. http://blog.righter.ch/?p=581 no comments if it's not the best idea :-)) Freundliche Grüsse sasag Kabelkommunikation AG Michael Richter Professional Bachelor ODEC in Engineering mrichter(a)sasag.ch 052 633 01 71

1 0

DNS Secondary providers in Geneva
by Peter Hessler 14 Aug '13

14 Aug '13

Hi Everyone My company is looking for a Secondary DNS name server, preferrably located in Geneva. Our Primary NS is in Zurich, and we would like geographic redundancy. Please contact me off-list, if you know of a provider or are willing to provide this yourself.

1 0

SwiNOG-BE123 - Beer Event 123 @ Pumpstation / ZH
by Steven Glogger 02 Aug '13

02 Aug '13

Dear SwiNOGers, Enjoy the Sun, the Beer and the Lake. Details for the next event: ----------------------------------------------- Event: SwiNOG-BE123 - Beer Event 123 When? Monday, 5th August 2013 18:30 Where? Pumpstation Utoquai 10, 8008 Zürich http://www.pumpstation.ch/ (GoogleMaps Link: http://goo.gl/maps/a7O3Q) !! In case it would rain: we would move over to another place. Stay tuned and check your mailbox before coming... !! !! Please note: I cannot reserve ANY table - the first one to come should get a big table for all ,-) !! ----------------------------------------------- Registration: Start: Friday, 2nd August 2013 - 14:05 Stop: Monday, 5th August 2013 - 14:00 Reg-URL: http://swinog.be/ ----------------------------------------------- Since we have to make reservations, I need to know who's coming and who not. If you can't attend and you're registered please inform me ASAP (+41 79 277 92 35). greetings -steven

1 0

Re: [swinog] Returned mail: Data format error
by Stanislav Sinyagin 01 Aug '13

01 Aug '13

wow, cool, a virus at swinog :) >________________________________ > From: "steven(a)glogger.ch" <steven(a)glogger.ch> >To: swinog(a)lists.swinog.ch >Sent: Thursday, August 1, 2013 9:38 AM >Subject: [swinog] Returned mail: Data format error > > >The original message was received at Thu, 1 Aug 2013 13:08:52 +0530 >from glogger.ch [197.134.5.171] > >----- The following addresses had permanent fatal errors ----- >swinog(a)lists.swinog.ch > > > > > >_______________________________________________ >swinog mailing list >swinog(a)lists.swinog.ch >http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog > > >

1 0

Returned mail: Data format error
by steven＠glogger.ch 01 Aug '13

01 Aug '13

The original message was received at Thu, 1 Aug 2013 13:08:52 +0530 from glogger.ch [197.134.5.171] ----- The following addresses had permanent fatal errors ----- swinog(a)lists.swinog.ch

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog August 2013