AT&T Blocking ICMP

Tue Aug 19 16:45:58 UTC 2003

Are they blocking just icmp echo or everything ?

         ---Mike

At 12:29 PM 19/08/2003 -0400, Ingevaldson, Dan (ISS Atlanta) wrote:

>The "Nachi" worm propagates via MSRPC DCOM and the IIS WebDAV bug.  It
>may be causing this storm because it runs 300 scanning threads, and it
>pings each IP first.
>
>http://xforce.iss.net/xforce/alerts/id/150
>
>MS Blast wasn't multithreaded.
>
>Regards,
>===============================
>Daniel Ingevaldson
>Engineering Manager, X-Force R&D
>dsi at iss.net
>404-236-3160
>
>Internet Security Systems, Inc.
>The Power to Protect
>http://www.iss.net
>===============================
>
>
>-----Original Message-----
>From: Paul Jasa [mailto:pjasa at univision.net]
>Sent: Tuesday, August 19, 2003 12:19 PM
>To: nanog at merit.edu
>Subject: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?)
>
>
>
>A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking
>ICMP in order to deal with an undefined emergency.  Nothing posted on
>their site, nor any other info is available.  If anyone has info related
>to this "icmp outage", please advise.  Thanks! pj
>
>======================================
>Paul Jasa
>Network Engineer
>======================================
>
>
>-----Original Message-----
>From: Sean Crandall [mailto:sean at megapath.net]
>Sent: Tuesday, August 19, 2003 02:12 AM
>To: Paul Jasa; nanog at merit.edu
>Subject: RE: AT&T US Network Slowdown?
>Importance: High
>
>
> >
> > Dear Nanogers,
> > Is anyone aware of a "slowdown" issue throughout the US AT&T
> > network since 8/18 at around 4pm which is causing a lot of
> > internet circuits (including DSL) to be inaccessible and/or
> > appear down from the outside world?  AT&T says this has been
> > escalated to "Level 4" with no ETA and affecting the whole
> > country.  I am seeing this problem in the San Francisco area.
> >  Just wondering if anyone else is experiencing anything that
> > would confirm AT&T's claim, and fishing for more info about
> > the possible cause and ETA.  Thanks!
>
>We are currently seeing the slowdown on our network in San Jose.
>Started about exactly the time frame that you mentioned.  The rest of
>the country
>(oddly) seems unaffected by this at the moment, but San Jose is getting
>hammered by something.
>
>Still trying to sort out exactly where it is coming from.
>
>-Sean
>
>Sean P. Crandall
>VP Engineering Operations
>MegaPath Networks Inc.
>Pleasanton, CA  94588
>(925) 201-2530
>