December 2003 - NANOG - lists.nanog.org

APNIC delegation change
by Eric Germann 02 Dec '03

02 Dec '03

Just a heads up for those who use http://ftp.apnic.net/stats/apnic/apnic-latest .... It moved. If you have scripts that slurp APNIC ASN or IPv4 allocations, they probably broke this morning. The new correct link is at http://ftp.apnic.net/stats/apnic/new/delegated-apnic-latest ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

2 1

Re: incorrect spam setups cause spool messes on forwarders
by Suresh Ramasubramanian 02 Dec '03

02 Dec '03

" John Brown (CV)" <jmbrown(a)chagresventures.com> wrote: > telling spammers 4xx or 5xx doesn't matter, they don't listen. The goal is to keep your spool clear, and your mailservers operational. At least, that is, if you are running a production server and not a hobbyist / family and friends type setup. -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

1 0

Re: incorrect spam setups cause spool messes on forwarders
by Michael.Dillon＠radianz.com 02 Dec '03

02 Dec '03

>Also imagine your domain being joe-jobbed. You, as an innocent bystander, >then get hammered by Verizon as they try to do a lookup on possibly >millions of incoming mails. Why on earth would Verizon need to do the lookup once per incoming email? If they need to verify that a given MX does indeed exist and is reachable and is running an SMTP server, then why not cache that info for some reasonable time period, say an hour, to avoid disrupting everyone else's Internet. Coupled with that caching, they could reasonably make a few tries over the space of 3 to 5 minutes before giving up on the incoming email by sending 450s. And if they are going to do something like this which imposes a requirement on other ISPs, i.e. your MX must point to a live SMTP server, and which impacts other ISP's mail operations, i.e. we will send you 450s, then why can't they *PUBLISH* what they are doing. NANOG seems an appropriate place for this. --Michael Dillon

1 0

Re: TAT 14 failure
by garrett.allen＠comcast.net 02 Dec '03

02 Dec '03

still seeing decent ping times. anyone detect an actual outage or issue? thanks. > > I saw that link when I googled for TAT-14. I was looking more for a "see, I > told you so" link that I can forward to management that provides proof that > this is why our UK office is down...if you know what I mean. > > Here's an interesting explanation of undersea cabling: > http://davidw.home.cern.ch/davidw/public/SubCables.html > > > -Jack > > > --- Jared Mauch <jared(a)puck.nether.net> wrote: > > > > This is a basic map of the fiber path for those > > that haven't found one yet. > > > > http://www.kddiscs.co.jp/e/business/02_15.html > > > > - jared > > > > On Tue, Nov 25, 2003 at 10:32:16AM -0800, Jack McCarthy wrote: > > > > > > Anyone have additional info regarding this outage? Links? Besides > > tat-14.com > > > - it seems to be down or just flooded with requests. > > > > > > > > > -Jack > > > > > > > > > --- jmalcolm(a)uraeus.com wrote: > > > > > > > > The northern leg of TAT14 seems to have just taken an outage about an > > > > hour ago. As the southern leg was already down due to other faults, > > > > this will probably be an exciting time for many providers. > > > > > > > > > > > > > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > > > > > >

7 6

port 1026-1031 traffic
by Johannes B. Ullrich 02 Dec '03

02 Dec '03

Well, for the last week there has been an odd increase in port 1026-1031 traffic. While everything points to popup spam, there are a few issues that are 'odd': - increase in sources that cause this traffic. - "natural" source ports vs. crafted source port which is typical for popup spam - 2-byte '00 00' payload (more details: http://isc.sans.org/diary.html ) As it very much looks like that the origin are compromised Windows systems (some appear to be behind NAT routers), I posted a list with IPs at http://feeds.dshield.org/port1026.dat The list is sorted by IP. If any of these systems live on your network, your help in tracking down the root cause of all this traffic is appreciated. Its (not yet) a big deal. But maybe its one of the few times we can stay ahead of the problem. Also, at this point it shouldn't be too hard to track these systems (its only about 5,000 unique sources) the columns of the data file: - ip address - first time seen on this day (GMT) - last time seen on this day (GMT) - number of packets detected - date The filter applied to the list: - the hosts sent traffic to port 1026-1031 - the source port was not 666 or 4177 - it happened today or yesterday (today: Dec. 2nd). -- CTO SANS Internet Storm Center http://isc.sans.org phone: (617) 786 1563 fax: (617) 786 1550 jullrich(a)sans.org

1 0

TAT 14 failure
by jmalcolm＠uraeus.com 02 Dec '03

02 Dec '03

The northern leg of TAT14 seems to have just taken an outage about an hour ago. As the southern leg was already down due to other faults, this will probably be an exciting time for many providers.

5 5

Google-jacking?
by Dave Temkin 01 Dec '03

01 Dec '03

Has anyone seen a situation on their internal networks where going to a (non-Google) page "Hijacks" them and they end up with either the Google front page or a broken link page? This happens on machines both with the toolbar and without, and we've seen it on machines on different networks/running different OS's. Just curious. Thanks, -Dave

2 2

Quarantaine network for infected hosts?
by Adi Linden 01 Dec '03

01 Dec '03

Reading about the various ways universities deal with ill behaved client PCs, is there documentation on how to quarantaine devices on a network? Adi

3 2

Anyone from Cogent that can look at "show log" and not get confused?
by Alex Yuriev 01 Dec '03

01 Dec '03

Hello, If there is possibly maybe a person from Cogent that does not get severely confused and say "Oh, it is just the way the routers work" or "Oh it just takes a long time for routes to be sent to you" after being shown synch errors, garbage in AS_PATH that cogent is sending, I would greatly appreciate hearing from you since your lead tech thinks that it is normal for a GSR to take 30 minutes to receive entire 576 routes. Thanks, Alex

1 0

Need contact information for ATDN
by J. Oquendo 01 Dec '03

01 Dec '03

//Second posting// Good evening all, anyone have a good contact for AOL (ATDN) engineers? Having a problem with users on a /17 getting mail there, checked for blackholes on my end, would like to know if my routes are being null0'd. TIA J. Oquendo =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How do you know where I'm at when you haven't been where I've been understand where I'm coming from" -- Cypress Hills

1 0