- NANOG - lists.nanog.org

Dormant space on blacklists, how can I resolve this?
by Matthew Crocker 28 Apr '23

28 Apr '23

Hello, I run Crocker Communications (AS7849) and have ARIN allocations of 161.77.0.0/16 & 66.59.48.0/20. The 66.58.48.0/20 space was used for our datacenter which shutdown a couple years ago. The space has mostly been dormant for the past couple years. I’m now starting to assign 66.59.[55-60].0/24 to a new group of residential FTTH customers. The customers are getting access denied messages from Akamai based websites. What can I do to get Akamai to unblock the 66.59.48.0/20 space. Is there a website I can look to research the reputation of the subnets? They haven’t been used in years so I would expect them to be pretty clean. Thanks -Matt

3 2

Looking for sales from comcast
by Brandon Zhi 27 Apr '23

27 Apr '23

Hello guys, Our company is looking for a way to get IP Transit from comcast, can someone give me the email of their sales team? Also, does anyone know about whether AT-Tand T-Mobile provide IP Transit or not? Best wishes,

1 0

NWS service assessment on 2021 Hurricane Ida
by Sean Donelan 27 Apr '23

27 Apr '23

Just published, buried in the after-action report on 2021 Hurricane Ida Commodity internet access is now part of life-safety. National Weather Service Service Assessment August-September 2021 Hurricane Ida April 2023 https://www.weather.gov/media/publications/assessments/Hurricane_Ida_Servic… [...] The Assessment Team found commodity internet access as important to the completion of the NWS mission as the AWIPS Wide Area Network (WAN) is to disseminating life-saving warnings. The lack of reliable, consistent internet access, to include sufficient bandwidth, would have led to mission failure during Ida if not for extraordinary measures taken by staff at WFO New Orleans/Baton Rouge and the LMRFC. WFO New Orleans/Baton Rouge and the LMRFC sent people to telework from a forecaster’s home, where they had reliable commodity internet, to provide IDSS. [...]

1 0

Standard DC rack rail distance, front to back question
by Chuck Church 27 Apr '23

27 Apr '23

Hey all. Question about standard 4 post racks. We bought some that are adjustable. Unfortunately, the posts are very flimsy, as these are some fancy cabinets with spacing on the sides for vertical patch panels, etc. We found that 2 post mounting of most Cisco devices (namely Cat 9500 1RU switches) are sagging quite bad. We're used to the new server type rails that extend to support most reasonable distances front rails to back for 4 post mounting. However, for a Cisco ASA1001, there aren't rails, but rather front and back 'ears' you use to hit both front and back posts. These would appear to not have any adjustability, the front to back post distance would seem to need to match the ears, I assume they don't adjust placement on the router much. Is there a 'standard' distance between front and back rails that devices usually adhere to? Googling didn't find an answer readily. These are 19" wide cabinets by the way. Thanks, Chuck

12 15

Upcoming Event: ABQNOG + New ISOC Course
by Nanog News 27 Apr '23

27 Apr '23

*Register Now for ABQNOG! * ABQNOG will take place next Thursday 4, May 2023 in Albuquerque, NM. ABQNOG allows industry professionals to network with others in the region and learn more about the latest technology trends. *REGISTER NOW* <https://www.nanog.org/events/abqnog-01/> *New ISOC Course: Fundamentals of Designing and Deploying Computer Networks* *Enroll in this New ISOC Moderated Course with an Instructor! * *This course will feature:* - Fundamentals of Networking - Ethernet - WIFI Technologies - Planning, Design, and Deployment of Simple LANs - How to Connect a LAN to the Internet *MORE INFO <https://nanog.org/events/fundamentals-of-designing-and-deploying-computer-n…>* *Join the Women in Tech Affinity Group! * *Have You Checked out our Online Community Discussion Threads? * The NANOG Affinity Groups are part of the Community Forum and allow our members to connect over shared interests. Did you know NANOG has a Women in Tech (WIT) Affinity group? Connect with other females in the tech industry and find mentorship and support while sharing your experiences. *MORE INFO <https://community.nanog.org/c/women-in-tech/33>*

1 0

Questionnaire on building real network configuration dataset
by 徐惠三 27 Apr '23

27 Apr '23

Dear NANOG community members, We are post graduate students majoring in computer network and we are now conducting a research project aimed at setting up an open dataset of real network configurations for experiment needs. We think it will be a contributing work for network verification evaluations. As part of this effort, we are reaching out to the community to request your help in filling out a short questionnaire. Your participation in this survey would be greatly appreciated and valuable for our research. It will take only about 2-3 minutes of your time and your responses will be kept strictly confidential. To participate in the survey, please click on the following link: https://docs.google.com/forms/d/1XPBxVH40UcQRMZf-H-ENj4AUZQDEw8xxQtllyylCl4… Please note that the survey will be open for one month, and we kindly ask you to complete it by the end of May. Thank you in advance for your participation and support of our research. Best regards, Huisan

2 1

BKA Wiesbaden - Abteilung Cybercrime (Not sure if this is a phishing E-mail or real...)
by Glen A. Pearce 27 Apr '23

27 Apr '23

Hi All: I received an E-mail with an attachment claiming something on my network is infected and that I should look at the attachment to find out what. Normally I think everything with an attachment is phishing to get me to run malware but: #1: The sites linked to in it seem to be legit German government websites based on Wikipedia entries that haven't changed in several years. (Looked at archive.org) #2: The attachment is a .txt file which I've normally assumed to be safe. #3: None of the usual dead giveaways that most phishing E-mails have. If it is a phishing E-mail it has got to be the cleverest one I've ever seen, though someone would try to be cleaver considering the target would be holders of IP blocks. I right clicked and checked properties to make sure the attached ip_addresses.txt file really is a text file and not some fancy trickery with reverse direction characters ( As seen on https://www.youtube.com/watch?v=ieQUy8YTbFU ) I tried poking around to see if there was some vulnerability in notepad (or some versions of it) that I didn't know about and only found a vulnerability in the text editor on Macs but nothing with Windows Notepad. The other thing I felt was a bit off is that the originating mail server is in Deutsche Telekom AG space and not IP Space registered to the German government. I'm thinking someone could rent some IP space from Deutsche Telekom AG with a connection to them in a data center and get the DNS delegated to them so they could set the reverse DNS to whatever they want. A lot of effort to try to look legit by coming out of Germany and having a government domain in the reverse DNS to look like a plausible legit outsourcing but again Network operators are the target audience so the normal tricks that work on the general public won't work with this group so I can see someone going that far. I'll attach the E-mail below with all headers. Has anyone else gotten these? Is there some security risk opening it in Windows Notepad that I don't know about or is it actually safe to open this? Return-Path: <abuse(a)cyber.bka.de> Delivered-To: [REDACTED] Received: from ezp08-pco.easydns.vpn ([10.5.10.148]) by ezb03-pco.easydns.vpn with LMTP id oCfeBO/yEmTokhgAzaFxkQ (envelope-from <abuse(a)cyber.bka.de>) for <[REDACTED]>; Thu, 16 Mar 2023 10:43:59 +0000 Received: from smtp.easymail.ca ([127.0.0.1]) by ezp08-pco.easydns.vpn with LMTP id WCB5BO/yEmSHdgEABcrfzg (envelope-from <abuse(a)cyber.bka.de>); Thu, 16 Mar 2023 10:43:59 +0000 Received: from localhost (localhost [127.0.0.1]) by smtp.easymail.ca (Postfix) with ESMTP id 0DC85557DF for <arin(a)ve4.ca>; Thu, 16 Mar 2023 10:43:59 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at ezp08-pco.easydns.vpn X-Spam-Flag: NO X-Spam-Score: 0.075 X-Spam-Level: X-Spam-Status: No, score=0.075 required=4 tests=[BAYES_00=-1.9, DEAR_SOMETHING=1.973, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from smtp.easymail.ca ([127.0.0.1]) by localhost (ezp08-pco.easydns.vpn [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d0XbPteZN-Io for <arin(a)ve4.ca>; Thu, 16 Mar 2023 10:43:55 +0000 (UTC) Received: from mail.cyber.bka.de (mail.cyber.bka.de [80.146.190.22]) by smtp.easymail.ca (Postfix) with ESMTPS id 0BC0C557DC for <arin(a)ve4.ca>; Thu, 16 Mar 2023 10:43:54 +0000 (UTC) Date: Thu, 16 Mar 2023 10:43:53 +0000 To: arin(a)ve4.ca From: BKA Wiesbaden - Abteilung Cybercrime <abuse(a)cyber.bka.de> Reply-To: BKA Wiesbaden - Abteilung Cybercrime <abuse(a)cyber.bka.de> Subject: Information regarding possible infection with malware Message-ID: <M47LJRZpjy1zymUJDKsNtrYm3RimkafZfZTqeZpauZA(a)emailapi.apps.cc.bka> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="b1_M47LJRZpjy1zymUJDKsNtrYm3RimkafZfZTqeZpauZA" Content-Transfer-Encoding: 8bit Dear Sir or Madam, As part of criminal proceedings, the German Federal Criminal Police Office (Bundeskriminalamt) has been informed about public IP addresses and timestamps which indicate a potential infection by the malicious software "Bumblebee" of one or more systems behind the respective public IP address. Within this letter, the BKA is providing you with the data of the respective IP addresses which have been assigned to you as the appropriate provider. You are asked to take appropriate measures to inform your customers about the potential infection. The following information will be provided: 1. Public IP address 2. Last known timestamp of contact by the public IP address 3. Possible system name or username on the potentially infected system The following information may be sent to your customers in addition to the message of concern. What should you do now? 1. Donâ€™t panic! 2. Check your systems/networks for possible infections. If other institutions have already made you aware of infected systems recently, follow the action guidelines which you may have received from them. 3. For further information on cleaning up infections, please visit the English website of the Federal Office for Information Security (BSI): https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informat… Yours sincerely, Bundeskriminalamt Wiesbaden -- Glen A. Pearce gap(a)ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17

7 8

UltraDNS contact
by Matthew Crocker 26 Apr '23

26 Apr '23

Can anyone from UltraDNS contact me off list please? I have some security issues I’d like to discuss with you. Thanks -Matt

1 0

OARC 41- Call for Contributions
by John Todd 26 Apr '23

26 Apr '23

OARC 41 will be a two-day hybrid meeting and the tentative dates are 6th-7th September to be co-located with ICANN DNS Symposium in Asia. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: * Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling) * Deployment: DNS config management and release process.Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection * Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency * Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT The presentations can be either a full-length presentation - 20 mins (+5 mins Q/A) or a lightning presentation - 10 mins (+5 mins for Q/A) Workshop Milestones: 2023-04-16 Submissions open via Indico 2023-06-10 Deadline for submission (23:59 UTC) 2023-06-27 Preliminary list of contributions published 2023-07-11 Full agenda published 2023-08-08 Deadline for slideset submission and Rehearsal 2023-09-06 OARC 41 Workshop - Day1 2023-09-07 OARC 41 Workshop - Day2 The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc41> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Example guidelines for presentation slides: https://www.grammarly.com/blog/presentation-tips/ Additional information for speakers of OARC 41: * Your talk will be broadcast live and recorded for future reference * Your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting * Remote speakers have mandatory rehearsal on 2023-08-08 at 14:00 UTC. It would be very useful to have your slides (even if draft) ready for this. Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net OARC depends on sponsorship to fund its workshops and associated social events. Please contact sponsor(a)dns-oarc.net if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) John Todd, for the DNS-OARC Programme Committee -- John Todd - jtodd(a)quad9.net General Manager - Quad9 Recursive Resolver

1 0

IPv4 Subnet 23.151.232.0/24 blackholed?
by Neel Chauhan 26 Apr '23

26 Apr '23

Hi, I recently got the IPv4 allocation 23.151.232.0/24 from ARIN. I also had my hosting company ReliableSite announce it to the internet. Right now, I can only access networks that peer with ReliableSite via internet exchanges, such as Google, CloudFlare, OVH, Hurricane Electric, et al. It seems the Tier 1 ISPs (e.g. Lumen, Cogent, AT&T, et al.) are blackholing the IPv4 subnet 23.151.232.0/24. Could someone who works at a Tier 1 NOC please check and remove the blackhole if any exists? Normally when ReliableSite announced my prior (then-leased) IPv4 space it gets propagated via BGP almost immediately. This time it's not going through at all. Best, Neel Chauhan

6 6