- NANOG - lists.nanog.org

Mexico?
by Ryan Finnesey 02 Nov '11

02 Nov '11

If I want to get a block of IP's issued for a network within Mexico who do I talk with? I have been told arin does not cover Mexico. It was my understand arin covers North America. Cheers Ryan

5 4

Colocation providers and ACL requests
by Christopher Pilkington 02 Nov '11

02 Nov '11

Is it common in the industry for a colocation provider, when requested to put an egress ACL facing us such as: deny udp any a.b.c.d/24 eq 80 …to refuse and tell us we must subscribe to their managed DDOS product? -cjp

14 19

Re: Random five character string added to URLs?
by Jeff Kell 02 Nov '11

02 Nov '11

On 11/1/2011 7:05 PM, Stefan Fouant wrote: > Is there anything perhaps protecting or intercepting the data on its way to the server, perhaps an Arbor device of some type of load balancer? > > This type of behavior is quite common when protecting web assets to eliminate zombies and such, but its usually something you would see back to the clients, not tp the server. I have seen this in SEO-poisoning type of webpage defacement. They anchor a javascript in the main website "frame" and it generates optimization "links" using a numeric suffix or ?argument so that they appear as separate links. If the crawler is recognized (e.g., googlebot) then the SEO page is returned. Jeff

1 0

using IPv6 address block across multiple locations
by Dmitry Cherkasov 02 Nov '11

02 Nov '11

Hello, Please advice what is the best practice to use IPv6 address block across distributed locations. Recently we obtained our PI /48 from RIPE. The idea was to assign partial slices from this block to different locations (we have currently 3 offices in Europe and 2 in USA). All locations are interconnected with static VPNs. Each location is supposed to establish BGP session with local ISP. Partial prefix /56 + aggregate /48 (with long AS PATH) are to be announced by each office. The problem we ran across is that ISP in US does not wish to accept prefixes longer then /48 from us. Need your advice: is this normal to distribute /48 by /56 parts across locations or should we obtain separate /48 for each of them? Or maybe we need /32 that can be split into multiple /48? Anyway we are not ISP so /48 looks quite reasonable and sufficient for all our needs. Thank you. Dmitry Cherkasov

12 17

Re: Random five character string added to URLs?
by Stefan Fouant 01 Nov '11

01 Nov '11

Is there anything perhaps protecting or intercepting the data on its way to the server, perhaps an Arbor device of some type of load balancer? This type of behavior is quite common when protecting web assets to eliminate zombies and such, but its usually something you would see back to the clients, not tp the server. Also, IIRC, the LOIC DoS tool had this ability to create random strings in the URL, and I believe it did so with 5 characters. Might want to do a packet trace and identify if this is coming from LOIC. Regards, Stefan Fouant Technical Trainer, Juniper Networks GPG Key ID: 0xB4C956EC Sent from my HTC EVO. ----- Reply message ----- From: "Christopher J. Pilkington" <cjp(a)0x1.net> Date: Tue, Nov 1, 2011 3:51 pm Subject: Random five character string added to URLs? To: <nanog(a)nanog.org> This might be off-topic, my apologies if so. I seeing requests against a server with initial GET requests in the form: GET /[a-zA-Z]{5}/pagename.html pagename.html being optional. The 5 character string seems to be random. This GET always results in a 404, as our servers don't have these paths. The second request seems to always the same without the modified path, which results in a 20. I initially suspected this was something from an attack or DOS tool, but the traffic doesn't fit such a pattern. Is anyone familiar with what device/service behaves in this fashion? Clearly something layer 7 is between the clients and the server. Provider is without clue regarding this. Google results in many GoDaddy users complaining of same; the server in question is not hosted with them, but I suspect they may be doing something similar. Thanks, -cjp

1 0

IPV6 6to4 and 6In4 Lab
by Meftah Tayeb 01 Nov '11

01 Nov '11

Hello folks, i'm posting this Message to both nanog and afnog lists preferably if i can get one from afnog to work with me a bit for routing IPV6 prefixs over him using at least static or OSPFv3 or BGP (at you like) i want to anounce my /48 optained from a friend as number) and 2002::/16 (6to4 prefixs=) at least for 10min to see real IPV6 traffic. if someone want to help me, please contact me thank you Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6596 (20111102) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

2 2

Outgoing SMTP Servers
by Dennis Burgess 01 Nov '11

01 Nov '11

I am curious about what network operators are doing with outbound SMTP traffic. In the past few weeks we have ran into over 10 providers, mostly local providers, which block outbound SMTP and require the users to go THOUGH their mail servers even though those servers are not responsible for the domains in question! I know other mail servers are blocking non-reversible mail, however, is this common? And more importantly, is this an acceptable practice? Most of our smaller ISPs that we support; we allow any outbound SMTP connection, however we do watch residential users for 5+ outbound SMTP connections at the same time. But if the ISP has their own mail servers, and users wish to relay though them, we basically tell them to use their mail server that they contract with. What is the best practice? ----------------------------------------------------------- Dennis Burgess, Mikrotik Certified Trainer Link Technologies, Inc -- Mikrotik & WISP Support Services Office: 314-735-0270 <tel:314-735-0270> Website: http://www.linktechs.net <http://www.linktechs.net/> LIVE On-Line Mikrotik Training <http://www.onlinemikrotiktraining.com/> - Author of "Learn RouterOS" <http://routerosbook.com/>

42 95

Random five character string added to URLs?
by Christopher J. Pilkington 01 Nov '11

01 Nov '11

This might be off-topic, my apologies if so. I seeing requests against a server with initial GET requests in the form: GET /[a-zA-Z]{5}/pagename.html pagename.html being optional. The 5 character string seems to be random. This GET always results in a 404, as our servers don't have these paths. The second request seems to always the same without the modified path, which results in a 20. I initially suspected this was something from an attack or DOS tool, but the traffic doesn't fit such a pattern. Is anyone familiar with what device/service behaves in this fashion? Clearly something layer 7 is between the clients and the server. Provider is without clue regarding this. Google results in many GoDaddy users complaining of same; the server in question is not hosted with them, but I suspect they may be doing something similar. Thanks, -cjp

1 0

Verizon ISP mailing list / ATM ports
by Joe Maimon 01 Nov '11

01 Nov '11

Hey All, I am looking for verizon ATM/DSL wholesale DSL ports for NY/NJ latas, and I found some verizon-isp mailing lists, but nothing seems current. Off-list replies are welcome. Thanks, Joe

1 0

OT:Hotmail mail Admin
by Justin Wilson 01 Nov '11

01 Nov '11

Hi all, Sorry for the offtopic post. I have a need to talk to a real person at Hotmail regarding a user account. The normal channels aren't getting me what I need. Thanks, Justin

1 0