| |
ZL3AI > APRDIG 07.09.03 10:08l 202 Lines 9159 Bytes #999 (0) @ WW
BID : 1872-ZL3AI
Read: GUEST
Subj: TAPR Digest, Sep 04, 2/3
Path: DB0FHN<DB0RGB<OK0PPL<DB0RES<ON0AR<ZL2BAU<ZL3VML
Sent: 030906/1346Z @:ZL3VML.#80.NZL.OC #:7869 [Chch-NZ] FBB7.00i $:1872-ZL3AI
From: ZL3AI@ZL3VML.#80.NZL.OC
To : APRDIG@WW
Subject: Re: APRS Map
From: Bob Bruninga <bruninga@usna.edu>
Date: Thu, 4 Sep 2003 21:07:43 -0400 (EDT)
X-Message-Number: 11
Yes, there is a lot of bad information out there..
>1. It was announced at Dayton this year that Trace was depreciated in
>use.
Yes, if you are talking about UIDIGI TRACE, then yes. But my
understanding was that the AZ digi removed UITRACE so that packets could
not be traced because too many people were using it. This is bad.
>2. I won't disagree [with 30 min ID's for digis], however I think most
>of our digi's are not doing it that frequent in part because they do
>callsign replacement and in part to minimize bandwidth whereever
>possible. It's not like those digi's will move in an hour.
That is exactly the wrong thinking that is killing the APRS concept.
APRS is not designed for 24/7 nothing moving scenarios. It was designed
for come-as-you-are, turn on your radio and begin operating. The net
cycle time for a local net is 10 minutes. THis is the total time that a
local should have to wait to see the full tactical picture withiin his one
digi area. Seeing a position report from a digi does TWO THINGS. 1) it is
a position packet, but more importantly, it show's you WHAT all is on the
air in your LOCAL area. THus, DIGI's should ID locally every 10 minues
with NO HOPS so that people know it is there and that it is on line
serving them.
>3.Again, I believe this was announced at Dayton, but I was (and I
>believe others) under the understanding that we should be or have moved to
>WIDEn-n support only. We've suggested to all of our users to go to a
>RELAY,WIDE2-2 path for mobiles and WIDEn-n of some sort for a fixed
>station.
No, removing WIDE totally kills the NOID concept that we have fought so
hard over the last 6 years to preserve. If WIDE is removed then NO PATHS
can self-idenftify their point of origin! This is CRAZY to remove WIDE.
The recommended general purpose path for point-of-entry identification is
WIDE,WIDEn-N. WIth out WIDE being supported, there is no callsign
substitution and therefore no point-of-entry identificaiton.
>I wish I remember who made these statements (anyone else care to comment?)
>but the Nashville area (and others I believe) been pushing ourselves to
>this point. We're not fully compliant (then again, we don't maintain
>those digi's) but we're moving towards this. We were under the impression
>that others were too.
Because they dont understand the total APRS concept for real-time
tactical local support of emergent communications. ANd all they want is
pretty maps of the whole state and less traffic. Its just plain
shortsightedness...
Just because others are doing it, does not make it right. Heck one person
put up a web page back in 1996 recommending ID settings on digis. It took
another 7 years to counteract the damage that was done. Please, everyone,
APRS is NOT for looking at the whole state via WIDE3-3 paths. It is for
serviing your local area for emergent communications. ANYTHING that
detracts from thatprimary objecive I will fight tooth-and-nail..
Yes, it is nice to see everything else around you when nothti8ng else is
going on, but THAT IS ONLY A BIPRODUCT of the APRS concept. It is not the
GOAL...
de WB4APR
----------------------------------------------------------------------
Subject: aprsfl.net appearing as "port-scanner"
From: Neil Johnson <njohnsn@njohnsn.com>
Date: Thu, 4 Sep 2003 20:22:53 -0500
X-Message-Number: 12
Does anyone have any idea why aprsfl.net is port scanning me ?
Some users (like me) have configured their routers to send their logs of
rejected packets to an organization known as the Distributed Intrusion
Detection System. (http://www.dshield.org). Also known as the "Internet
Storm Center" (http://isc.incidents.org)
dshield.org collects router and firewall logs from all over the net and
attempts to correlate the data to spot emerging security issues.
They also have a feature called "fight-back" that will automatically
contact the administrative contact for a block of ip addresses to inform
them if someone is port scanning systems from a machine in their IP address
block.
From the reports I have received I see that aprsfl.net is being considered
a port scanner by their system.
I do not have the "fight-back" option enabled. I have been thinking about
enabling it, but I'm concerned that it might cause trouble.
Below is an excerpt from one of the daily dshield reports I receive.
(Sorry but you need to use a fixed width font to see the columns).
It is kind of interesting to see who has been "jiggling" the door knobs to
see if the door is unlocked :).
For 2003-09-03 you submitted 2185 packets from 505 sources hitting 1
targets.
Port Summary
============
Port | Packets | Sources | Targets | Service | Name
------+-----------+-----------+-----------+--------------------+-------------
137 | 362 | 361 | 1 | netbios-ns | NETBIOS Name
Service
135 | 1306 | 101 | 1 | epmap | DCE endpoint
resolution
1434 | 7 | 7 | 1 | ms-sql-m |
Microsoft-SQL-Monitor
80 | 10 | 5 | 1 | www | World Wide Web
HTTP
1433 | 15 | 5 | 1 | ms-sql-s |
Microsoft-SQL-Server
139 | 13 | 3 | 1 | netbios-ssn | NETBIOS
Session Service
21 | 6 | 3 | 1 | ftp | File Transfer
[Control]
554 | 4 | 2 | 1 | rtsp | Real Time
Stream Control Protocol
0 | 2 | 1 | 1 | |
3389 | 2 | 1 | 1 | ms-term-services | MS Terminal
Services
14072 | 9 | 1 | 1 | |
14661 | 8 | 1 | 1 | |
14954 | 17 | 1 | 1 | |
443 | 3 | 1 | 1 | https | HTTP protocol
over TLS SSL
6112 | 1 | 1 | 1 | dtspc | CDE subprocess
control
14165 | 4 | 1 | 1 | |
14662 | 8 | 1 | 1 | |
14955 | 17 | 1 | 1 | |
53 | 1 | 1 | 1 | domain | Domain Name
Server
500 | 18 | 1 | 1 | isakmp | VPN Key
Exchange
Port Scanners
=============
source | Ports Scanned | Host Name
---------------+---------------+------------
64.58.200.20| 6 | aprsfl.net
209.157.136.81| 6 | gw.lne.com
216.110.42.179| 4 | politechbot.com
204.118.115.12| 4 | ip12.cc7673.adsl.digitaldune.net
67.105.155.82| 3 | 67.105.155.82.ptr.us.xo.net
137.201.240.65| 2 | images.micron.com
205.188.11.220| 2 |
66.47.213.227| 2 | user-112vlf3.biz.mindspring.com
Source Summary
==============
source | hostname |packets|targets| all pkts | all trgs | first seen
---------------+-----------+-------+-------+----------+----------+-----------
216.51.247.254|telecom.net| 141 | 1 | 4006 | 1 | 06-17-2003
64.58.200.20| aprsfl.net| 46 | 1 | 690 | 1 | 06-29-2003
204.118.115.12|taldune.net| 31 | 1 | 844 | 2 | 06-27-2003
205.188.11.220| | 31 | 1 | 344 | 2 | 07-30-2003
65.222.20.71|lestica.com| 18 | 1 | 257 | 1 | 06-18-2003
66.47.213.227|dspring.com| 16 | 1 | 623 | 2 | 06-29-2003
80.117.227.11|business.it| 3 | 1 | 7 | 5 | 08-17-2003
66.192.18.56|telecom.net| 3 | 1 | 16474 | 6932 | 06-08-2003
200.58.60.28| | 3 | 1 | 629 | 195 | 07-14-2003
210.82.43.66| | 3 | 1 | 10002 | 4774 | 05-17-2003
208.37.221.195|dsl.cnc.net| 2 | 1 | 3391 | 2360 | 08-30-2003
80.14.213.201|.wanadoo.fr| 2 | 1 | 1 | 1 | 08-23-2003
211.108.90.8| | 2 | 1 | 2 | 1 | 08-05-2003
216.213.230.25|t.k12.tx.us| 2 | 1 | 128 | 82 | 09-03-2003
200.105.156.170|elerate.com| 1 | 1 | 2555 | 2507 | 08-08-2003
24.225.154.57|atmedia.net| 1 | 1 | 737 | 737 | 08-08-2003
213.98.172.31|ima-tde.net| 1 | 1 | 1 | 1 | 07-21-2003
200.67.95.206|digy.net.mx| 1 | 1 | 3 | 3 | 08-08-2003
212.217.33.25| | 1 | 1 | 859 | 762 | 06-28-2003
203.129.254.8| | 1 | 1 | 4607 | 4069 | 07-23-2003
Fightback Summary
=================
IP Address | Date/Time sent | Reply | Sent To
---------------+---------------------+-------+-------------------------
--
Neil Johnson
http://www.njohnsn.com
PGP key available on request.
----------------------------------------------------------------------
Read previous mail | Read next mail
| |
