- NANOG - lists.nanog.org

Request Spamhaus contact
by Jeffrey Lyon 18 Jan '11

18 Jan '11

Someone at Spamhaus please contact me concerning your second consecutive preemptive strike against our IP space. Fun Fact: No one at Spamhaus has ever successfully sent us an abuse complaint. Also, some rocket scientist decided that their sbl-removals@ box should also filter e-mail so blocked parties can't even get in touch. As such, it will be necessary to reply to jeffrey.lyon(a)gmail.com vs. @blacklotus.net . You claim to monitor sbl-removals@ but it seems i've been ignored for several hours. -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions

27 96

PCCW Admin
by Andrew Kirch 18 Jan '11

18 Jan '11

Would a PCCW admin contact me off-list regarding one of your customers? Andrew

1 0

Re: Software DNS hghi availability and load balancer solution
by William Herrin 18 Jan '11

18 Jan '11

On Tue, Jan 18, 2011 at 3:49 PM, Dorn Hetzel <dorn(a)hetzel.org> wrote: > If it wouldn't be too ugly, could this be circumvented by having the web > application continually do its next operation against an incrementing > subhost name like syymmddhhmmss or snnnnnnn.www.foo.com in order to convince > the local browser and client os to do a fresh lookup? Hi Dorn, There's an efficiency problem where you can no longer pipeline http requests and have to delay every http request while a DNS lookup happens. Also it'd probably crush your google pagerank. And you still wouldn't get around the javascript in your web 2.0 pages needing to go back to the same server name it came from in order to update the content on those pages. The custom name strategy does have some other really neat applications though. You can track a session without setting a cookie. And consider a large email system: suppose you encode the account name in the server name and then point that encoded name to the server which actually holds that user's account? You can eliminate the expensive front-end that multiplexes user access to the backend servers. Regards, Bill Herrin -- William D. Herrin ................ herrin(a)dirtside.com bill(a)herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004

1 0

Re: Auto ACL blocker
by Brian R. Watters 18 Jan '11

18 Jan '11

Agreed, time to live in the ACL is critical as well .. this is primary to be used to stop sweeps and penetration testing .. We have SNORT deployed now but the process is still manual on the back end and of course does not respond in the time required. ----- Original Message ----- From: " Dorn Hetzel " < dorn @ hetzel .org> To: "Brian R. Watters " < brwatters @ absfoc .com> Cc: nanog @ nanog .org, "Ronald Bonica " < rbonica @juniper.net> Sent: Tuesday, January 18, 2011 1:01:43 PM Subject: Re: Auto ACL blocker One suspects this sort of automated defense should only be used against attack styles that eliminate the likelihood of a forged source ip and that the acl needs to be pruned and compacted for size. Nearby bad ips can be collected into a larger mask but there is then risk of collateral damage (how many bad source ips in a /24 or whatever before you nuke the whole thing for a while? Does the length of a prefixes "rap sheet" change its treatment? Etc) On Jan 18, 2011 3:03 PM, "Brian R. Watters " < brwatters @ absfoc .com > wrote: > Ron, > > I am sure any solution given enough time could be used against you, However my hope was that a whitelist could help in that regard however I know your correct. > > > ----- Original Message ----- > From: "Ronald Bonica " < rbonica @juniper.net > > To: "Brian R. Watters " < brwatters @ absfoc .com >, nanog @ nanog .org > Sent: Tuesday, January 18, 2011 11:55:28 AM > Subject: RE: Auto ACL blocker > > Brian, > > Have you thought about what a bad guy might do if he knew that you had such a policy deployed? Is there a way that the bad guy might turn the policy against you? > > Ron > >> -----Original Message----- >> From: Brian R. Watters [ mailto : brwatters @ absfoc .com ] >> Sent: Tuesday, January 18, 2011 2:12 PM >> To: nanog @ nanog .org >> Subject: Auto ACL blocker >> >> We are looking for the following solution. >> >> Honey pot that collects attacks against SSH/FTP and so on >> >> Said attacks are then sent to a master ACL on a edge Cisco router to >> block all traffic from these offenders .. >> >> Of course we would require a master whitelist as well as to not be >> blocked from our own networks. >> >> Any current solutions or ideas ?? >> >> -- >> >> BRW > > -- > > Brian R. Watters > Director > American Broadband Family of Companies > 5718 East Shields Ave > Fresno, CA. 93727 > brwatters @ absfoc .com > http :// www . americanbroadbandservice .com > tel: 559-420-0205 > fax:559-272-5266 > toll free: 866-827-4638 > > ABS offers T-1's starting at $289 in over 450 cities. Is your city on the list? Click here to find out. > > This message and any attachment(s) are solely for the use of intended recipients. They may contain privileged and/or confidential information legally protected from disclosure. If you are not the intended recipient, you are hereby notified that you received this e-mail in error and that any review, dissemination, distribution or copying of this e-mail and any attachment(s) is strictly prohibited. If you have received this e-mail in error, please contact the sender and delete the message and any attachment(s) from your system. Thank you for your cooperation. > -- Brian R. Watters Director American Broadband Family of Companies 5718 East Shields Ave Fresno, CA. 93727 brwatters @ absfoc .com http :// www . americanbroadbandservice .com tel: 559-420-0205 fax:559-272-5266 toll free: 866-827-4638 ABS offers T-1's starting at $289 in over 450 cities. Is your city on the list? Click here to find out. This message and any attachment(s) are solely for the use of intended recipients. They may contain privileged and/or confidential information legally protected from disclosure. If you are not the intended recipient, you are hereby notified that you received this e-mail in error and that any review, dissemination, distribution or copying of this e-mail and any attachment(s) is strictly prohibited. If you have received this e-mail in error, please contact the sender and delete the message and any attachment(s) from your system. Thank you for your cooperation.

2 1

Re: Software DNS hghi availability and load balancer solution
by Christopher Hunt 18 Jan '11

18 Jan '11

>Message: 7 >Date: Tue, 18 Jan 2011 12:31:32 -0600 >From: Jack Bates <jbates(a)brightok.net> >Subject: Re: Software DNS hghi availability and load balancer solution >To: Sergey Voropaev <serge.devorop(a)gmail.com> >Cc: NANOG list <nanog(a)nanog.org> >Message-ID: <4D35DC84.8020508(a)brightok.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >On 1/18/2011 11:42 AM, Sergey Voropaev wrote: >> I know that it is possible by BIND with set of script. But we are trying to >> find more usable solution with frendly interface. > > >I think powerdns is more flexible in this regard. Not sure about a >friendly interface, though. > > >Jack > > I find Poweradmin quite usable. See https://www.poweradmin.org/trac/ for details. -Christopher Hunt

1 0

Looking for fiber
by Nick Olsen 18 Jan '11

18 Jan '11

We are looking for fiber in the Port St Lucie/Stuart area of Florida, Maybe as north as Fort Pierce. Anyone have, Or know who has fiber in this area? Feel free to hit me on or offlist. Thanks. Nick Olsen Network Operations (855) FLSPEED x106

1 0

RE: Nexus 5000 with 4G FC module - initialization ?
by Dantzig, Brian 18 Jan '11

18 Jan '11

You need to turn on fcoe support with the configuration command "feature fcoe". You will also need the appropriate license for fabric services. But even without the license you should be able to enter fc commands. They just won't work until you add the license. Without the"feature fcoe", the interface type won't even show up in command help. There are other storage fabric related services that you may want to turn on with the feature command as well. Brian Dantzig Senior Network Engineer Medline Industries

2 1

Donating servers.. where?
by Mehmet Akcin 18 Jan '11

18 Jan '11

Hi, I have got some dell servers ( 860s and 1425s ) in mint condition. what's the best way to donate this hardware to someone who can use it for educational research? feel free to contact me directly mehmet

3 2

Re: Request Spamhaus contact
by Jeffrey Lyon 18 Jan '11

18 Jan '11

Perhaps PCCW is not accepting the null routes? I'll have the DC power down the pertinent machines. Jeff On Mon, Jan 17, 2011 at 8:24 PM, Raymond Dijkxhoorn <raymond(a)prolocation.net> wrote: > Hi! > >> How are you seeing this? It is null routed from my home connection, it >> is null routed from the L3 Looking Glass. Please show me evidence that >> something is wrong with my null routes. >> >> Or perhaps this is just funny to you? > > I mailed you evidence, its up, still. Hey, its your network, look on the > boxes there. > > What more evidence you need then the actual pages??????? > > [root@ratsack ~]# wget -S www.vertrouwdeapotheek.nl > --2011-01-18 02:22:34-- http://www.vertrouwdeapotheek.nl/ > Resolving www.vertrouwdeapotheek.nl... 208.64.120.197 > Connecting to www.vertrouwdeapotheek.nl|208.64.120.197|:80... connected. > HTTP request sent, awaiting response... > HTTP/1.1 301 Moved Permanently > Cache-Control: private > Content-Length: 0 > Location: http://www.vertrouwdeapotheek.nl/Home.aspx > Server: Microsoft-IIS/7.0 > X-AspNet-Version: 4.0.30319 > X-Powered-By: ASP.NET > Date: Tue, 18 Jan 2011 01:22:16 GMT > Connection: close > Location: http://www.vertrouwdeapotheek.nl/Home.aspx [following] > --2011-01-18 02:22:35-- http://www.vertrouwdeapotheek.nl/Home.aspx > Connecting to www.vertrouwdeapotheek.nl|208.64.120.197|:80... connected. > HTTP request sent, awaiting response... > HTTP/1.1 200 OK > Cache-Control: private > Content-Length: 126007 > Content-Type: text/html; charset=utf-8 > Server: Microsoft-IIS/7.0 > X-AspNet-Version: 4.0.30319 > WL-Version: 2475.0 > Set-Cookie: ASP.NET_SessionId=aqvgayz5c23hmfrvksqk30y1; path=/; HttpOnly > X-Powered-By: ASP.NET > Date: Tue, 18 Jan 2011 01:22:16 GMT > Connection: close > Length: 126007 (123K) [text/html] > Saving to: "Home.aspx.1" > > Thats your network. > > 4. Te2-2.ar2.AMS1.gblx.net 0.0% 3 1.3 1.3 1.3 1.3 0.0 > 5. 64.213.176.242 0.0% 3 99.2 99.2 99.2 99.3 0.0 > 6. irc.ge9-7.br01.lax04.pccwbtn.net 0.0% 3 162.3 162.3 162.3 162.4 > 0.1 > 7. 208.64.120.17 0.0% 3 155.2 155.1 155.0 155.2 0.1 > > Its up. Period. > > Bye, > Raymond. > -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions

1 0

Cruzio peering
by Jeroen van Aart 17 Jan '11

17 Jan '11

Cruzio in Santa Cruz recently opened a new coloc facility using a newly installed fiber connection (I believe they share this with UCSC, I am not sure who "owns" it in practice). Which in theory should be good news for the Monterey Bay Area which has been without fiber connectivity before. I would like to know with who they're peering with in San Jose and who their provider(s) is or are. Any other information is welcome. Thank you, Jeroen -- http://goldmark.org/jeff/stupid-disclaimers/ http://linuxmafia.com/~rick/faq/plural-of-virus.html

2 3