44net April 2014

44net@mailman.ampr.org

62 participants
77 discussions

Test New Tool - APRS Code Recovery
by lleachii＠aol.com 24 Jun '15

24 Jun '15

All, I've added a new tool that I'd like you to test. This web application should provide the registration code required by APRS software suites. In order to use it, you must browse to: http://kb3vwg-010.ampr.org/tools/aprscode or http://44.60.44.10/tools/aprscode If you're on AMPRNet, you should be able to enter the callsign and look up the registration code. If you access it from outside of AMPRNet, you will be prompted for an access code (1234). Please let me know how it works 73, KB3VWG

39 87

New services idea.
by kb9mwr＠gmail.com 06 Aug '14

06 Aug '14

First, Lynwood thanks for sharing PHP code snippet. Does anyone know much about google maps? More than 15 years ago a younger local ham friend of mine wrote some web based interactive tools for wireless link planning. Maybe you have run into them: http://n9zia.ampr.org/ This isn't presently on 44-net. I have just been using the ampr dns to give it a hostname that has been pointing to my home cable modem for a long time now. They run horribly slow (same computer for 15 years and slow upload speed) I'd love to see these tools freshened up a bit to use PHP, and possibly integrate google maps. Neither the original author, Joe N9ZIA or myself really have a lot of experience with either. But we are both surprised someone hasn't already done this. Just throwing the idea out there for anyone who would like a project, the code is open under GPL. The tools help promote modern RF network planning. After a rewrite perhaps they could be hosted on a 44 IP, and put a paypal please donate nag screen if you come in from a commercial IP. The paypal proceeds can go to helping ARDC with Brian's ok. Steve, KB9MWR

3 3

Re: [44net] 44Net Digest, Vol 3, Issue 89
by Steve Wright 10 May '14

10 May '14

> Warning to 'echo', 'discard' and 'daytime' services too > since as per the 'chargen' they can otherwise be > used for some nasty denial-of-service attacks. This is a frequently encountered problem, stemming either from lazyness or inexperience. Do we need a standard ruleset, and documentation to use it, and have this in the wiki? iptables or iproute2? Does anyone HAVE a working iproute2 setup? This stuff can be a pain I know - a bit like mowing your lawns, but if you don't do it, eventually you'll be sorry.

2 1

44/8 allocation
by lleachii.aol.com 04 May '14

04 May '14

John, Lol...you know I meant the major /8's that were handed out long ago that, to date, have never signed an agreement with their RIR. I stand corrected, though, there are Legacy allocations smaller than /8 that exist as well...but they are not listed in RFCs (as fixtures of the 'DARPA Internet'). -KB3VWG

12 35

spam
by Steve Wright 02 May '14

02 May '14

> On Mon, Apr 28, 2014 at 7:00 AM, <44net-request(a)hamradio.ucsd.edu> wrote: > > BTW, your emails trigger gmail's spam filter -- I'm surprised any of this weeks' postings got past the spam filter whatsoever.... Can we get some tech content please, people? Enough of this rules and politics crap.

2 1

Last minute DDoS attackers
by Gustavo Ponza 29 Apr '14

29 Apr '14

... as per information. gus i0ojj ------------- com. 0 IN SOA a.gtld-servers.net. nstld.verisign-grs.com. 1398772092 1800 900 604800 86400 dnsscan.shadowserver.org. 0 IN A 184.105.143.133 fema.gov. 0 IN NS asia2.akam.net. fema.gov. 0 IN NS eur2.akam.net. fema.gov. 0 IN NS use3.akam.net. fema.gov. 0 IN NS usw4.akam.net. fema.gov. 0 IN NS usc2.akam.net. fema.gov. 0 IN NS usw3.akam.net. fema.gov. 0 IN NS use1.akam.net. . 0 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2014042800 1800 900 604800 86400 com. 0 IN NS f.gtld-servers.net. com. 0 IN NS j.gtld-servers.net. com. 0 IN NS g.gtld-servers.net. com. 0 IN NS e.gtld-servers.net. com. 0 IN NS l.gtld-servers.net. com. 0 IN NS k.gtld-servers.net. admin.wilyee.com. 0 IN A 216.187.94.181 130.99.20.198.IN-ADDR.ARPA. 0 IN PTR census4.shodan.io. 1000.e920862c.dnsr.if-is.net. 0 IN A 134.147.203.115 ddosforums.pw. 0 IN SOA dina.ns.cloudflare.com. dns.cloudflare.com. 2014945315 10000 2400 604800 3600 ddosforums.pw. 0 IN NS dina.ns.cloudflare.com. ddosforums.pw. 0 IN NS ian.ns.cloudflare.com. ianawww.vip.icann.org. 0 IN A 192.0.32.8 www.iana.org. 0 IN CNAME ianawww.vip.icann.org. openresolvertest.net. 0 IN A 204.42.254.5 65cf69a0.openresolvertest.net. 0 IN CNAME openresolvertest.net. 1x1.cz. 0 IN A 46.234.99.18 114.70.20.198.IN-ADDR.ARPA. 0 IN PTR census3.shodan.io. isc.org. 0 IN NS ns.isc.afilias-nst.info. isc.org. 0 IN NS ord.sns-pb.isc.org. dnsamplificationattacks.cc. 0 IN SOA a.dns.gandi.net. hostmaster.gandi.net. 1349871047 10800 3600 604800 10800 dnsamplificationattacks.cc. 0 IN MX 10 spool.mail.gandi.net. dnsamplificationattacks.cc. 0 IN MX 50 fb.mail.gandi.net. dnsamplificationattacks.cc. 0 IN A 217.70.184.38 dnsamplificationattacks.cc. 0 IN NS c.dns.gandi.net. dnsamplificationattacks.cc. 0 IN NS b.dns.gandi.net. dnsamplificationattacks.cc. 0 IN NS a.dns.gandi.net. shodan.io. 0 IN NS b.dns.gandi.net. shodan.io. 0 IN NS a.dns.gandi.net. shodan.io. 0 IN NS c.dns.gandi.net. openresolverproject.org. 0 IN A 204.42.254.5 65cf69a0.openresolverproject.org. 0 IN CNAME openresolverproject.org. ietf.org. 0 IN NS ns1.yyz1.afilias-nst.info. ietf.org. 0 IN NS ns1.ams1.afilias-nst.info. ietf.org. 0 IN NS ns1.mia1.afilias-nst.info. ietf.org. 0 IN NS ns0.amsl.com. ietf.org. 0 IN NS ns1.sea1.afilias-nst.info. ietf.org. 0 IN NS ns1.hkg1.afilias-nst.info. iorr.ru. 0 IN SOA ns1.reg.ru. hostmaster.ns1.reg.ru. 1397802273 14400 3600 604800 43200 iorr.ru. 0 IN A 123.123.123.26 iorr.ru. 0 IN A 123.123.123.70 iorr.ru. 0 IN A 123.123.123.17 iorr.ru. 0 IN A 123.123.123.41 iorr.ru. 0 IN A 123.123.123.158 iorr.ru. 0 IN A 123.123.123.67 iorr.ru. 0 IN A 123.123.123.137 iorr.ru. 0 IN A 123.123.123.101 iorr.ru. 0 IN A 123.123.123.61 iorr.ru. 0 IN A 123.123.123.119 iorr.ru. 0 IN A 123.123.123.79 iorr.ru. 0 IN A 123.123.123.190 iorr.ru. 0 IN A 123.123.123.229 iorr.ru. 0 IN A 123.123.123.237 iorr.ru. 0 IN A 123.123.123.4 iorr.ru. 0 IN A 123.123.123.66 iorr.ru. 0 IN A 123.123.123.224 iorr.ru. 0 IN A 123.123.123.183 iorr.ru. 0 IN A 123.123.123.110 74.69.20.198.IN-ADDR.ARPA. 0 IN PTR census1.shodan.io. -----------------

1 0

chargen service
by Brian Kantor 29 Apr '14

29 Apr '14

You should check to make sure that you have the 'chargen' service disabled on your hosts, and block it in your routers if you can. I've already contacted the people whose system was involved in this attack. - Brian ----- Forwarded message ----- Subject: Exploitable chargen service used for an attack: 44.x.x.x. It appears that a public "chargen" service on your network, running on IP address 44.x.x.x, participated in a large-scale attack against a customer of ours today, generating large UDP responses to spoofed probes that claimed to be from the attack target. chargen is an old testing service that generates large quantities of traffic with only a small request required. It is commonly enabled by default on old printers and other connected appliances, but it has no useful purpose over the open internet. Please block UDP port 19 (inbound and outbound) at your network edge, as this should stop these chargen attacks without blocking legitimate traffic. If the endpoint device that generated this traffic is configurable, please further investigate whether it is running a chargen service (and disable it, if so) -- commonly exploited devices include Cisco hardware that has "udp small servers" mistakenly enabled, old printers, old UNIX boxes with "chargen" running under inetd, and Windows boxes with the "Simple TCP/IP services" package installed. Also, it is worth checking if it is a machine that has been compromised, as some malware directly generates port 19 traffic, simulating chargen, and in this way masks its presence. If you are an ISP, please also look at your network configuration and make sure that you do not allow spoofed traffic (that pretends to be from external IP addresses) to leave the network. Hosts that allow spoofed traffic make possible this type of attack. ----- End forwarded message -----

2 1

Re: [44net] chargen service
by kb9mwr＠gmail.com 29 Apr '14

29 Apr '14

Jerry, Stick this in the DD-WRT administration command shell box: /sbin/iptables -A OUTPUT -p udp --dport 19 -j DROP

1 0

Re: [44net] chargen service
by Jerry Kutche 29 Apr '14

29 Apr '14

Brian. Can u tell me how. Been having some kind of issues here. Also think my router it sick. Have a new one on way. Buffalo wzr-600dhp running dd-wrt latest .. Non beta.. 73 jerry On Apr 29, 2014 1:34 PM, Brian Kantor <Brian(a)UCSD.Edu> wrote: > > (Please trim inclusions from previous messages) > _______________________________________________ > You should check to make sure that you have the 'chargen' service > disabled on your hosts, and block it in your routers if you can. > > I've already contacted the people whose system was involved in this attack. > - Brian > > > ----- Forwarded message ----- > > Subject: Exploitable chargen service used for an attack: 44.x.x.x. > > It appears that a public "chargen" service on your network, running > on IP address 44.x.x.x, participated in a large-scale attack against a > customer of ours today, generating large UDP responses to spoofed probes > that claimed to be from the attack target. > > chargen is an old testing service that generates large quantities of > traffic with only a small request required. It is commonly enabled by > default on old printers and other connected appliances, but it has no > useful purpose over the open internet. > > Please block UDP port 19 (inbound and outbound) at your network > edge, as this should stop these chargen attacks without blocking > legitimate traffic. If the endpoint device that generated this traffic > is configurable, please further investigate whether it is running a > chargen service (and disable it, if so) -- commonly exploited devices > include Cisco hardware that has "udp small servers" mistakenly enabled, > old printers, old UNIX boxes with "chargen" running under inetd, and > Windows boxes with the "Simple TCP/IP services" package installed. Also, > it is worth checking if it is a machine that has been compromised, as > some malware directly generates port 19 traffic, simulating chargen, > and in this way masks its presence. > > If you are an ISP, please also look at your network configuration and > make sure that you do not allow spoofed traffic (that pretends to be from > external IP addresses) to leave the network. Hosts that allow spoofed > traffic make possible this type of attack. > > ----- End forwarded message ----- > > _________________________________________ > 44Net mailing list > 44Net(a)hamradio.ucsd.edu > http://hamradio.ucsd.edu/mailman/listinfo/44net >

1 0

help?
by Jerry 28 Apr '14

28 Apr '14

I have been having severe issues staying connected to the internet all day.. I did two things as a test.. I think its related to my Net 44 box. 1) Turned off the JNOS/URO box 2) Removed it from DMZ Going to see how things look. I think it is getting hit with junk from the internet . If so I may be forced to leave it off.. if so.. But not sure how to tell.. Other than if I can stay connected and so far it has improved a thousand fold.. If anyone knows how to stop this let me know. A Script I can install on my dd-wrt enabled buffalo wzr600dhp router would be best or anything I can run on linux. Thanks 73 jerry n9lya Join Dropbox today <https://db.tt/72qWEIC2> https://db.tt/72qWEIC2 N9LYA/K9BBS <http://w9bbs.no-ip.org:8080/> http://w9bbs.no-ip.org:8080 K9BBS IP 44.48.0.42 Linbpq 6.0.7.2 Debian Linux 6.0.7 Dell_Server_2600_4GBRAM_73GBHD_Dual_Dual_Core_CPU_1.8Ghz W9HU <http://w9bbs.no-ip.org:8081/> http://w9bbs.no-ip.org:8081 W9HU IP 44.48.0.44 PilinBPQ 6.0.7.2 Raspbian-wheezy-7_Rpi_B_700MHz_256MBram_128GB-SD-class10 N9LYA-5 IP 44.48.0.46 Jnos 2.0j N9LYA-9 IP 44.48.0.41 Uronode 2.1 Debian Linux 6.0.7 HP 3.4Ghz 2GB Ram 2TB Hard drive W9BBS-3 IP 44.48.0.45 MSYS 1.20Beta4 Dell XP Sp3 40GB HD 756 MB Ram NODE's I CO-SYSOP KC9JIH-7:LEHIGH K9UY-7:NOIRAM <http://www.mitchellwx.com/> http://www.mitchellwx.com wview 5.20.2 <http://www.n9lya.com/> http://www.n9lya.com <http://www.hfskipnet.net/> http://www.hfskipnet.net <http://www/indianapacketcouncil.com> http://www/indianapacketcouncil.com <http://aprs.fi/#!mt=roadmap&z=11&call=a%2FN9LYA-5&timerange=3600&tail=3600> http://aprs.fi/#!mt=roadmap&z=11&call=a%2FN9LYA-5&timerange=3600&tail=3600 <http://aprs.fi/#!mt=roadmap&z=11&call=a%2FN9LYA-3&timerange=3600&tail=3600> http://aprs.fi/#!mt=roadmap&z=11&call=a%2FN9LYA-3&timerange=3600&tail=3600 My net44 subnet 44.48.0.41 uronode.n9lya.ampr.org uronode.n9lya 44.48.0.42 k9bbs.ampr.org k9bbs 44.48.0.43 w9otr.ampr.org w9otr 44.48.0.44 w9hu.ampr.org w9hu 44.48.0.45 w9bbs.ampr.org w9bbs 44.48.0.46 n9lya.ampr.org n9lya n9lya-3 73 Jerry N9LYA HF Skipnet Coordinator HF Skipnet Midwest HUB ARRL Net Manager - Packet Indiana AmprNet IP Coordinator Indiana Indiana Packet Coordinator Sysop N9LYA/K9BBS/W9BBS/W9OTR W9OTR Hoosier Amateur Radio Digital Society W9HU Hoosier Radio Society

5 6

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net April 2014