Subject: List of infected mrouters

From: Dino Farinacci <[email-masked]>
Date: Wed, 28 Aug 1996 17:10:46 -0700

Here is a recent list of routers that are infected. Please put the
    workaround in.

    I'm building a small IP-only 11.0 version for you poor AGS+ folks that
    are still on 10.2. Look in the /ftp/dino/bogus-rp directory. Should be
    avialable in about 15 minutes.

Dino

------------------------------------------------------------------------
n233-119-cisco7000-dvl.arc.nasa.gov - 128.102.192.33
n233-119-cisco7000-idn.arc.nasa.gov - 128.102.80.33
n233-119-cisco7000-mbone.arc.nasa.gov - 128.102.84.129
zappa-61.psc.edu - 128.182.61.1
ser2.gw.utexas.edu - 128.83.7.7
GANGWAY.GRAPHICS.CORNELL.EDU - 128.84.247.246
al-rtr.ameslab.gov - 147.155.3.252
inr-666-dmz.berkeley.edu - 198.128.16.21
core1-fe1-0.hou.neo.net - 206.109.1.252
n233-119-cisco7000-dvl.arc.nasa.gov - 128.102.192.33
n233-119-cisco7000-idn.arc.nasa.gov - 128.102.80.33
n233-119-cisco7000-mbone.arc.nasa.gov - 128.102.84.129
zappa-61.psc.edu - 128.182.61.1
ser2.gw.utexas.edu - 128.83.7.7
GANGWAY.GRAPHICS.CORNELL.EDU - 128.84.247.246
al-rtr.ameslab.gov - 147.155.3.252
iki-gw.rssi.ru - 193.232.212.101
inr-666-dmz.berkeley.edu - 198.128.16.21
core1-fe1-0.hou.neo.net - 206.109.1.252
? - 207.10.165.1

---

From: Bill Fenner <[email-masked]>
Date: Wed, 28 Aug 1996 17:43:55 PDT

>    Here is a recent list of routers that are infected. Please put the

Different places in the network will see different infected routers, due
to topology and Cisco's forwarding path.  I see the following that weren't
on your list:

128.241.254.1 (MBONE.SESQUI.NET)
128.252.5.120
128.9.160.26 (bah.isi.edu)
137.39.12.38 (UUNET6-GW.UU.NET)
139.130.204.6 (mbone-act.gw.au)
206.101.198.1 (gw1.packardbell.com)

  Bill

P.S. I just monitored a pretty constant 150kbps of Register traffic,
cutting the MBone's effective available bandwidth to 350kbps or so.

---

From: Mitch Collinsworth <[email-masked]>
Date: Thu, 29 Aug 1996 11:45:19 -0400

>GANGWAY.GRAPHICS.CORNELL.EDU - 128.84.247.246

This one is done.

-Mitch

---

From: John Meylor <[email-masked]>
Date: Thu, 29 Aug 1996 10:19:06 -0700

Dino,
 Thanks, we cleaned up the first three last night (probably as you
wrote this list).  These three:

were same router.  We used the blunt method (remove PIM and clear ip
mroute *). 

From the FIX-West router mbone2.nsi.nasa.gov I see the following 
routers listed as origins when netstat.rsvp -M | is greped for
239.133.130.34:

128.83.7.7 (ser2.gw.utexas.edu) [version 11.0,prune,mtrace]:
144.228.84.6 (144.228.84.6) [version 10.3]:
139.130.204.6 (mbone-act.gw.au) [version 11.1,prune,mtrace]:
128.9.160.26 (bah.isi.edu) [version 11.2,prune,mtrace]:
199.103.128.254 (boston.terra.net) [version 11.0,prune,mtrace]:
206.109.1.252 (core1-fe1-0.hou.neo.net) [version 11.1,prune,mtrace]:
207.10.165.1 (207.10.165.1) [version 11.1,prune,mtrace]:
193.232.212.101 (iki-gw.rssi.ru) [version 11.0,prune,mtrace]:
137.39.2.254 (?)
132.203.2.15 (132.203.2.15) [version 10.3]:
133.246.10.65 (KEIO-SFC-cisco-e01.expo96.ad.jp) [version 11.0,prune,mtrace]

I'm working with IKI to make the corrections necessary.

- John