- NANOG - lists.nanog.org

US DOJ victim letter
by Jay Hennigan 19 Jan '12

19 Jan '12

We have received three emails from the US Department of Justice Victim Notification System to our ARIN POC address advising us that we may be the victim of a crime. Headers look legit. We have been frustrated in trying to follow the rabbit hole to get any useful information. we've jumped through hoops to get passwords that don't work and attempted to navigate a voice-mail system that resembles the "twisty maze of passages all different" from an old text adventure game. This *seems* to be legit, and I would think that the end result is likely to be a list of IP addresses associated with infected hosts. Has anyone else received the email? Is it legit? If so has anyone successfully navigated the maze, and if so how? Is it worth it? (And why don't they just send the list of infected IPs to the ARIN contact in the first place?) -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

12 11

RIS raw data
by andra.lutu＠imdea.org 19 Jan '12

19 Jan '12

Hi all, I am working on getting a better grasp on what data we have in the RIS project from RIPE. To this end, I am checking the export policies of the ASes peering with RIPE AS12654 at different IXPs. I am wondering if anybody knows what these ASes actually announce to the RIPE repositories? Do they dump their entire routing tables (including their internal routes) ? In some cases I saw the export policy ANNOUNCE ANY, is this consistent with a particular AS behaving like the RIPE AS was its customer? Another type of export policy is for example 'to AS12654: ANNOUNCE AS "YYY" '(where "YYY" is any AS peering with RIPE in the RIS project). How is this policy different from the previous one from the point of view of the routing feed the RIPE repository receives? Thank you for your help! Best regards, Andra

9 10

AlcaLu Adds Security to Routers
by Henry Linneweh 19 Jan '12

19 Jan '12

http://www.lightreading.com/document.asp?doc_id=216514&f_src=lrdailynewslet… -Henry

2 1

Security Contact for PlusServer.de (AS8972)
by Tim Donahue 19 Jan '12

19 Jan '12

Hi all, Sorry for the noise, but I am looking for a contact for PlusServer.de (AS8972) to get a security issue resolved. Email to their abuse@ address has gone unanswered for nearly 24 hours at this point and the malicious traffic has not been stopped yet. Hopefully someone here has a security or noc contact that can I can reach out to. Thank you, Tim

1 0

Skype in the Enterprise
by Mike Gatti 19 Jan '12

19 Jan '12

Hello Everyone, I wanted to get the groups opinions/thought on how you would or currently handle users wanting or using Skype in the enterprise. Recently what has brought this to light was the fact that our firewalls started to deny/shun users randomly from access to the internet. After a couple of dozen packet captures and cross checking software installed on the clients machines we narrowed down the culprit to be Skype, which later we validated in Lab. What we saw was in random intervals all skype clients would send a burst of requests to the internet which would trigger the intrusion detection threshold of our security appliances. Given that there were no changes to those thresholds I am left to ask what caused this behavior to start, a software update or an update to the skype network (if it can be called that)? I am trying to educate myself a little more before facing the lynch mobs when I start advising on a solution. Thanks for taking the time, -- Michael Gatti main. 949.371.5474 (UTC -8)

2 1

bgp question
by Deric Kwok 19 Jan '12

19 Jan '12

Hi all When we get newip, we should let the upstream know to expor it as there should have rule in their side. how about upstream provider, does they need to let their all bgp interconnect to know those our newip? If no, Can I know how it works? If they don't have rules each other, ls it any problems? Thank you so much

5 8

dial-peer authenticaton in ios 12.3?
by Gregory Edigarov 19 Jan '12

19 Jan '12

Hello everybody, Is there a good person who could try to remember how to configure authentication in dial-peer on IOS (tm) MC3810 Software (MC3810-A2ISV5-M), Version 12.3(13), RELEASE SOFTWARE (fc2)? dial-peer voice 1 pots authentication username someuser password somepassword does not seem to be any help as it points an error on "authentication" keyword. Is there anything I could try to do about this before I through it out from my balcony? Thank you. -- With best regards, Gregory Edigarov

1 0

World IPv6 Launch Day - June 6, 2012
by Derek Ivey 19 Jan '12

19 Jan '12

Just saw this new site: http://www.worldipv6launch.org/ Many large companies and ISPs are planning to finally go live with IPv6 by June 6, 2012. I don't see Verizon (my ISP) on the list though :(. I'm glad to see companies moving forward with IPv6! Derek

16 21

Tata AS6453 not peering with NTT AS2914 in Japan
by Anurag Bhatia 19 Jan '12

19 Jan '12

Hello everyone! Was wondering is there's anyone from Tata Communications (VSNL/TeleGlobe) or NTT Communications? I can see Tata Comm's AS6453 is not exchanging traffic with NTT AS2914 in Japan. Is there's any specific reason for that? I can see traffic exchange is being done at London, New York, San Jose but not in Japan. Thus packets from Tokyo (Tata) to Tokyo (NTT) and having a round trip to US. This is screwing up performance of networks which are in downstream for NTT e.g Akamai. Route to Akamai.com webserver from Indian networks is going like India - UK - Japan adding over 200ms of overhead latency. If someone is interested in detailed data, I have blogged about it here <http://link.anuragbhatia.com/zywpr>. Any ideas what's preventing them peering in Japan itself? -- Anurag Bhatia anuragbhatia.com or simply - http://[2001:470:26:78f::5] if you are on IPv6 connected network! Twitter: @anurag_bhatia <https://twitter.com/#!/anurag_bhatia>

2 2

Re: DNS Attacks
by Dennis 18 Jan '12

18 Jan '12

I agree with Roland on the firewall placement. I add that the attack would have likely succeeded to exhaust the servers. There is alot of recent ddos activity on DNS with what looks like legitimate queries. You should also look at some DOS/ application level protections; Radware and Arbor top the list. Leigh Porter <leigh.porter(a)ukbroadband.com> wrote: > > >On 18 Jan 2012, at 05:06, "toor" <lists(a)1337.mx> wrote: > >> Hi list, >> >> I am wondering if anyone else has seen a large amount of DNS queries >> coming from various IP ranges in China. I have been trying to find a >> pattern in the attacks but so far I have come up blank. I am completly >> guessing these are possibly DNS amplification attacks but I am not >> sure. Usually what I see is this: >> > >At various seemingly random times over the past week I have had a DNS which is behind a firewall come under attack. The firewall is significant because the attacks killed the firewall as it is rather under specified (not my idea..). > >It did originate from Chinese address space and consisted of DNS queries for lots of hosts. There was also a port-scan in the traffic and a SYN attack on a few hosts on the same small subnet as the DNS, a web server and an open SSH port. > >-- >Leigh Porter > > >______________________________________________________________________ >This email has been scanned by the Symantec Email Security.cloud service. >For more information please visit http://www.symanteccloud.com >______________________________________________________________________ > >

7 7