Smurf Amp Nets

Mailman List Mirror (Read Only)
1

Sorry to pollute the list with yet another e-mail about Smurf
Amp's, but at this very second, an IRC server that I run is being
hammered from these networks. I tried registering them in SAR, got
some of them in, but some wouldn't take, and entering all 132 nets
manually is kind of cumbersome. *hint hint* I've also assumed they
are all /24's (which the 141.161.x.x's are for sure). Anyway here they are.

Andrew

0.0.0.0
10.0.4.0
127.0.0.0
129.71.1.0
134.24.34.0
141.161.11.0
141.161.12.0
141.161.180.0
141.161.19.0
141.161.196.0
141.161.2.0
141.161.20.0
141.161.21.0
141.161.54.0
141.161.97.0
141.164.236.0
141.164.240.0
141.164.241.0
141.164.242.0
141.164.243.0
141.198.64.0
142.154.4.0
142.165.3.0
146.188.232.0
161.27.9.0
168.198.52.0
168.216.11.0
168.216.12.0
168.216.13.0
168.216.14.0
168.216.15.0
168.216.9.0
169.130.14.0
172.20.1.0
172.20.2.0
172.20.4.0
172.20.5.0
172.20.50.0
172.31.0.0
192.102.232.0
192.106.1.0
192.168.102.0
192.168.104.0
192.168.250.0
192.206.159.0
192.231.112.0
192.234.72.0
192.40.28.0
192.89.254.0
193.190.196.0
193.76.0.0
193.76.109.0
193.76.81.0
194.211.170.0
194.215.130.0
194.215.133.0
194.244.59.0
198.163.232.0
198.26.182.0
198.3.200.0
198.53.245.0
198.60.120.0
198.68.156.0
199.104.254.0
200.135.13.0
200.23.51.0
200.230.140.0
200.230.142.0
200.230.143.0
200.38.168.0
200.5.128.0
200.5.129.0
202.184.18.0
202.184.25.0
203.150.240.0
204.115.171.0
204.17.178.0
204.208.152.0
204.208.153.0
204.228.161.0
204.229.43.0
204.229.45.0
204.233.137.0
204.242.172.0
204.244.32.0
204.249.16.0
204.26.101.0
204.26.102.0
204.26.103.0
204.26.104.0
204.26.109.0
204.31.135.0
204.64.22.0
204.64.23.0
204.65.223.0
204.70.146.0
204.70.164.0
204.71.242.0
204.96.225.0
205.150.226.0
205.163.217.0
205.172.3.0
205.184.109.0
205.211.168.0
205.218.18.0
205.232.11.0
205.232.119.0
205.232.8.0
206.110.105.0
206.110.253.0
206.110.98.0
206.204.42.0
206.251.0.0
206.251.5.0
206.251.7.0
206.29.111.0
206.34.91.0
207.112.247.0
207.124.139.0
207.34.202.0
207.65.122.0
207.68.0.0
207.99.6.0
208.128.161.0
208.128.185.0
208.133.118.0
208.145.80.0
208.149.198.0
208.192.84.0
209.125.164.0
209.2.160.0
209.22.240.0
209.48.31.0
209.49.144.0
209.49.157.0
209.84.61.0
24.129.20.0
255.255.255.0

2

Sorry to pollute the list with yet another e-mail about Smurf
Amp's, but at this very second, an IRC server that I run is being
hammered from these networks. I tried registering them in SAR, got
some of them in, but some wouldn't take, and entering all 132 nets
manually is kind of cumbersome. *hint hint* I've also assumed they
are all /24's (which the 141.161.x.x's are for sure). Anyway here they are.

The entries for 208.128.161.0 and 208.128.185.0 have been fixed.

Those are 2 of our dialup class -Cs that were being used as amplifiers.

We have implemented no-directed broadcast on our router equipment at this time.

Please let me know if you continue to see activity from those blocks.

Morgan

3

So why are you registering them with SAR manually? Here are some scripts
I wrote for my own use...but maybe others will benefit from them.

First one, I call smurfstat. It expects a list of IP addresses on stdin.
I use it by piping tcpdump output through a little command-line awk that
reduces each line to just the source IP. It generates output like what I
posted a few days ago.

#!/usr/bin/perl

use Getopt::Std;
getopts('nh');

while (<STDIN>) {
        chomp;
        $addr = $_;
        (@net_parts) = split /\./, $addr;
        $net = join('.',$net_parts[0],$net_parts[1],$net_parts[2]);
        $nets{$net}++ unless ($addrs{$addr}++);
}

unless ($opt_n){
        print "\nNetworks\n";
        foreach (sort {$nets{$b} <=> $nets{$a}} keys(%nets)) {
                printf("%-12s %d\n","$_:", $nets{$_});
        }
}

unless ($opt_h){
        print "\n---\nHosts\n";
        foreach (sort {$addrs{$b} <=> $addrs{$a}} keys(%addrs)) {
                printf("%-16s %d\n","$_:", $addrs{$_});
        }
}

Next...because registering hundreds of networks by hand would be annoying
and time consuming, we have smurfreg. You can pipe the output of
smurfstat right into smurfreg. It will ignore some of the common invalid
addresses found in analyzing smurfs like 0/8, 255.255.255/24, 10/8,
192.168/16. I didn't bother trying to come up with an expression for
172.16/12.

#!/usr/bin/perl

while (<STDIN>) {
  ($net,$junk)=split /:/,$_,2;
  if (($net=~/\d+\.\d+.\d+/) && !($net=~/^(0\.)|(10\.)|(192\.168)|(255\.255\.255)/)){
    system("lynx -dump http://www.powertech.no/smurf/probe.cgi?network=$net");
  }
  elsif ($net=~/---/) {
    die "\ndone.\n";
  }
}

What does it mean when the SAR says "No entry found for that network."?
Many of the nets I'm in the process of registering result in that, even
though they still have multiple hosts responding and are in the whois
databases.

4

You need to push the "probe=" parameter to the cgi as well. What you are
doing above is merely looking up already-registered networks in the SAR
database. Again, you are NOT probing the networks through the SAR by
running the above lynx command!

To do what you want, you must use URLs of this form:

http://www.powertech.no/smurf/probe.cgi?network=1.2.3.4&probe=PROBE
                                                       ^^^^^^^^^^^^

Be careful with "&" in sh, and remember that probe= thing.

Oystein Homelien | oystein@powertech.no
PowerTech Information Systems AS | http://www.powertech.no/
Nedre Slottsgate 5, N-0157 OSLO | tel: +47-23-010-010, fax: +47-2220-0333

5

ack! I somehow missed that when pasting the URL from Netscape into my
editor. Here's an updated version. Chris Bongaarts <cab@tc.umn.edu> sent
the 172.16/12 regex I was too lazy to include before.

#!/usr/bin/perl

while (<STDIN>) {
  ($net,$junk)=split /:/,$_,2;
  if (($net=~/\d+\.\d+.\d+/) &&
   !($net=~/^(0\.)|(10\.)|(192\.168)|(172\.((1[6-9])|(2[0-9])|(3[01]))\.)|(255\.255\.255)/)){
    system(“lynx -dump ‘http://www.powertech.no/smurf/probe.cgi?network=$net&probe=PROBE’”);
  }
  elsif ($net=~/---/) {
    die “\ndone.\n”;
  }
}

I'm using this to make sure all the nets I recently posted about are
registered. Based on the times reported by SAR, I think I'll be adding a
bunch of new nets to it.