Bellsouth and Redbacks

2005-02-08 Thread Pablo's Gmail
Just curious if anyone from Bellsouth can comment on why they're changing from existing vendor to Redbacks? Please take it offline. http://www.redback.com/PTE?rbAction=pressoperation=op_onenextPage=pressInfo.jspregionId=1localeId=en-UStableId=1pressId=1014cOrA=C

Williams contact needed

2005-02-08 Thread Greg Schwimer
If someone from Williams Communications is around, please contact me off list. Thanks! Greg Schwimer gschwimer at godaddy.com

IRC Bot list (cross posting)

2005-02-08 Thread J. Oquendo
On Tue, 8 Feb 2005, Justin Azoff wrote: I found an irc channel with 3000+ irc bots in it including a few hundred edu's. I have it posted at http://www.albany.edu/~ja6447/hacked_bots8.txt I started to sort them... Maybe I will finish when I get out of work or so. Here is the

Re: IRC Bot list (cross posting)

2005-02-08 Thread Stephen J. Wilcox
Hi, you probably didnt think of this but it might not be a good idea to publish a list of 3000 computers than can be infected/taken over for further nastiness. if you can privately send me a list of Ip addresses (no need to sort) i can assist you to distribute this information securely? Steve

Re: IRC Bot list (cross posting)

2005-02-08 Thread Gadi Evron
Stephen J. Wilcox wrote: Hi, you probably didnt think of this but it might not be a good idea to publish a list of 3000 computers than can be infected/taken over for further nastiness. if you can privately send me a list of Ip addresses (no need to sort) i can assist you to distribute this

UDP Port 80 Flooding

2005-02-08 Thread Greg Boehnlein
Anyone seen a rash of UDP port 80 packet floods lately? We found a huge flood of packets from an address in Taiwan flooding into a customer's IP on our LAN yesterday, which pushed traffic counts off the charts. Any idea what might be at the heart of this? -- Vice President of N2Net, a

Re: UDP Port 80 Flooding

2005-02-08 Thread Christopher L. Morrow
On Tue, 8 Feb 2005, Greg Boehnlein wrote: Anyone seen a rash of UDP port 80 packet floods lately? We found a huge flood of packets from an address in Taiwan flooding into a customer's IP on our LAN yesterday, which pushed traffic counts off the charts. Any idea what might be at the heart

Re: IRC Bot list (cross posting)

2005-02-08 Thread Jim Popovitch
On Tue, 2005-02-08 at 20:13 -0500, J. Oquendo wrote: On Tue, 8 Feb 2005, Justin Azoff wrote: I found an irc channel with 3000+ irc bots in it including a few hundred edu's. I have it posted at http://www.albany.edu/~ja6447/hacked_bots8.txt I started to sort them... Maybe I

Re: IRC Bot list (cross posting)

2005-02-08 Thread Jim Popovitch
On Tue, 2005-02-08 at 23:01 -0500, Jim Popovitch wrote: Here's a different version of the above, host'ed, awk'ed and sorted. NOTE: several of those hostnanes did not resolve, so this list is not an exact duplicate. http://jimpop.net/stuff/nanog-list-botlist-2005-02-08.sorted If you grabed

Re: IRC Bot list (cross posting)

2005-02-08 Thread william(at)elan.net
Wasn't there supposed to be special mail list setup for botnet tracking? If so can we please move this thread there and not continue it on main nanog list... -- William Leibzon Elan Networks [EMAIL PROTECTED]

Re: IRC Bot list (cross posting)

2005-02-08 Thread Bill Nash
You don't mass an army if you're not about to use it. This situation can (very quickly) have operational relevance. Bringing it to light to a wider forum than special interest groups is a good idea. You'd certainly care more if it was pointed at you. - billn On Tue, 8 Feb 2005,

Re: IRC Bot list (cross posting)

2005-02-08 Thread william(at)elan.net
On Tue, 8 Feb 2005, Bill Nash wrote: You don't mass an army if you're not about to use it. 3000 is no longer that large, maybe a brigade but not an army... This situation can (very quickly) have operational relevance. If every botnet investigation is brought up at nanog, the list

Re: IRC Bot list (cross posting)

2005-02-08 Thread Scott Weeks
: Wasn't there supposed to be special mail list setup for botnet : tracking? : : If so can we please move this thread there and not continue it on main : nanog list... Why worry? It's a done deal... scott

RE: IRC Bot list (cross posting)

2005-02-08 Thread Hannigan, Martin
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Nash Sent: Wednesday, February 09, 2005 12:37 AM To: william(at)elan.net Cc: [EMAIL PROTECTED] Subject: Re: IRC Bot list (cross posting) You don't mass an army if you're not about to use

RE: IRC Bot list (cross posting)

2005-02-08 Thread Bill Nash
On Wed, 9 Feb 2005, Hannigan, Martin wrote: Bill, haven't we been here before? :) There's TWO places that are doing this botnet stuff and the NANOG AUP discourages cross posting. I for one certainly don't want yet another list full of botnet stuff. And I'm not subscribed to either. Yet, I've no