- NANOG - lists.nanog.org

OT: used / refurb voip phones?
by Shacolby Jackson 20 Dec '10

20 Dec '10

A little off topic but anyone have any recommendations for vendors selling used voip handsets, especially Polycom? Looking for some IP335 or better. There are only a couple used gear resellers I trust and none seem to carry Polycom, only Cisco and even those only seem to have low end handsets. -shac

2 1

blackhole-1.iana.org and blackhole-1.iana.org servers are down?
by "Oleg A. Arkhangelsky" 20 Dec '10

20 Dec '10

Hello, It seems that 192.175.48.6 and 192.175.48.42 not replying to RFC1918 addresses DNS-reverse lookups. Does anybody noticed this? -- wbr, Oleg.

3 2

DWDM on a single strand
by MKS 19 Dec '10

19 Dec '10

Hi there I was wondering about DWDM equipment on a single strand fiber. What are the capabilities of a "mainstream" DWDM equipment operating on a single strand of fiber on terms of number of channels and reach? By mainstream I mean equipment somewhere in the middle of the price range for DWDM, like a standard offer from a reputable manufacturer. Are the same optical ampifiers used on single strand DWDM and DWDM on a pair? Regards MKS

1 0

Spamhaus under DDOS from AnonOps (Wikileaks.info)
by Steve Linford 19 Dec '10

19 Dec '10

As many of you know, both Trend Micro and Spamhaus have published warnings about a Wikileaks mirror site 'wikileaks.info' which is run by the person or persons behind 'AnonOps' from an IP address of a Russian dedicated cybercrime host (Heihachi) on which there is nothing but malware and other cybercrime. Innocent people seeking to read or download Wikileaks documents are being directed to the rogue wikileaks.info server and into the hands of the crime gangs located there. For trying to warn about the crime gangs located at the wikileaks.info mirror IP, Spamhaus is now under ddos by AnonOps. The criminals there do not like our free speech at all. As our site can't be reached now, you can not read our article on this, and we can not continue to warn Wikileaks users not to load things from the Heihachi IP. If you know journalists who would get this message out to Wikileaks users, please forward this message (entire) to them. The anonymous folks at AnonOps did not like our article update, here's what we said and what brought the ddos on us: ---- In a statement released today on wikileaks.info entitled "Spamhaus' False Allegations Against wikileaks.info", the person running the wikileaks.info site (which is not connected with Julian Assange or the real Wikileaks organization) called Spamhaus's information on his infamous cybercrime host "false" and "none of our business" and called on people to contact Spamhaus and "voice your opinion". Consequently Spamhaus has now received a number of emails some asking if we "want to be next", some telling us to stop blacklisting Wikileaks (obviously they don't understand that we never did) and others claiming we are "a pawn of US Government Agencies". None of the people who contacted us realised that the "Wikileaks press release" published on wikileaks.info was not written by Wikileaks and not issued by Wikileaks - but by the person running the wikileaks.info site only - the very site we are warning about. The site data, disks, connections and visitor traffic, are all under the control of the Heihachi cybercrime gang. There are more than 40 criminal-run sites operating on the same IP address as wikileaks.info, including carder-elite.biz, h4ck3rz.biz, elite-crew.net, and bank phishes paypal-securitycenter.com and postbank-kontodirekt.com. Because they are using a Wikileaks logo, many people thought that the "press release" was issued "by Wikileaks". In fact there has been no press release about this by Wikileaks and none of the official Wikileaks mirrors sites even recognise the wikileaks.info mirror. We wonder how long it will be before Wikileaks supporters wake up and start to question why wikileaks.info is not on the list of real Wikileaks mirrors at <a href="http://wikileaks.ch/mirrors.html">wikileaks.ch</a>. Currently wikileaks.info is serving highly sensitive leaked documents to the world, from a server fully controlled by Russian malware cybercriminals, to an audience that faithfully believes anything with a 'Wikileaks' logo on it. Spamhaus continues to warn Wikileaks readers to make sure they are viewing and downloading documents only from an official Wikileaks mirror site. We're not saying "don't go to Wikileaks" we're saying "Use the wikileaks.ch server instead". ---- Steve Linford The Spamhaus Project http://www.spamhaus.org

10 13

Some truth about Comcast - WikiLeaks style
by Backdoor Santa 19 Dec '10

19 Dec '10

Ever wonder what Comcast's connections to the Internet look like? In the tradition of WikiLeaks, someone stumbled upon these graphs of their TATA links. For reference, TATA is the only other IP transit provider to Comcast after Level (3). Comcast is a customer of TATA and pays them to provide them with access to the Internet. 1 day graphs: Image #1: http://img149.imageshack.us/img149/78/ntoday.gif Image #1 (Alternate Site): http://www.glowfoto.com/viewimage.php?img=13-224638L&rand=6673&t=gif&m=12&y… Image #2: http://img707.imageshack.us/img707/749/sqnday.gif Image #2 (Alternate Site): http://www.glowfoto.com/static_image/13-205526L/4331/gif/12/2010/img6/glowf… Notice how those graphs flat-line at the top? That's because they're completely full for most of the day. If you were a Comcast customer attempting to stream Netflix via this connection, the movie would be completely unwatchable. This is how Comcast operates: They intentionally run their IP transit links so full that Content Providers have no other choice but to pay them (Comcast) for access. If you don't pay Comcast, your bits wont make it to their destination. Though they wont openly say that to anyone, the content providers who attempt to push bits towards their customers know it. Comcast customers however have no idea that they're being held hostage in order to extort money from content. Another thing to notice is the ratio of inbound versus outbound. Since Comcast is primarily a broadband access network provider, they're going to have millions of eyeballs (users) downloading content. Comcast claims that a good network maintains a 1:1 with them, but that's simply not possible unless you had Comcast and another broadband access network talking to each other. In the attached graphs you can see the ratio is more along the lines of 5:1, which Comcast was complaining about with Level (3). The reality is that the ratio argument is bogus. Broadband access networks are naturally pull-heavy and it's being used as an excuse to call foul of Level (3) and other content heavy networks. But this shoulnd't surprise anyone, the ratio argument has been used for over a decade by many of the large telephone companies as an excuse to deny peering requests. Guess where most of Comcasts senior network executive people came from? Sprint and AT&T. Welcome to the new monopoly of the 21st century. If you think the above graph is just a bad day or maybe a one off? Let us look at a 30 day graph... Image #3: http://img823.imageshack.us/img823/8917/ntomonth.gif Image #3 (Alternate Site): http://www.glowfoto.com/static_image/13-205958L/4767/gif/12/2010/img6/glowf… Comcast needs to be truthful with its customers, regulators and the public in general. The Level (3) incident only highlights the fact that Comcast is pinching content and backbone providers to force them to pay for uncongested access to Comcast customers. Otherwise, there's no way to send traffic to Comcast customers via the other paths on the Internet without hitting congested links. Remember that this is not TATA's fault, Comcast is a CUSTOMER of TATA. TATA cannot force Comcast to upgrade its links, Comcast elects to simply not purchase enough capacity and lets them run full. When Comcast demanded that Level (3) pay them, the only choice Level (3) had was to give in or have its traffic (such as Netflix) routed via the congested TATA links. If Level (3) didn't agree to pay, that means Netflix and large portions of the Internet to browse would be simply unusable for the majority of the day for Comcast subscribers. Love, Backdoor Santa

48 104

Mastercard problems
by andrew.wallace 19 Dec '10

19 Dec '10

It appears the site is under a sustained attack, CNET reports. http://news.cnet.com/8301-13578_3-20024966-38.html Andrew

26 38

BGP Attribute 92 ?
by Atticus 19 Dec '10

19 Dec '10

I'm not a network engineer, I merely subscribe to NANOG for interesting things that come across for me to learn about. That being said, I find it hard to take someone seriously who doesn't know how to write using proper English with words capatalized and punctuation, etc. I also saw noone taking the BGP attribute 92 stuff personally. Not to mention, anything that can disturb services uptime warrants at least a "Sorry guys, my bad." Without a forewarning, its not exactly a wild assumption to think it could have been an attack. I believe I remember a thread from a while back about the same attribute messing a lot of Cisco products up. I also don't see anyone else resorting to foul language to get their point across. Mayhaps I'm out of line for sending this, and just needed to vent. If I've offended anyone, I appologize. Sent from my Motorola Droid. On Dec 19, 2010 1:17 AM, "Randy Bush" <randy(a)psg.com> wrote:

1 0

BGP Attribute 92 ?
by Jared Mauch 19 Dec '10

19 Dec '10

Someone seems to have leaked this out, with the following data within the bgp update: Unknown BGP attribute 92 (flags: 234) Hexdump start--- DD 78 FF 71 Hexdump end ---- Not sure what prefix this was related to yet, but if you saw your BGP drop, it could be related to improper handling of this. Seemed to go out around 2200 UTC - Jared

5 6

"potential new and different architectural approach" to solve the Comcast - L3 dispute
by Loránd Jakab 18 Dec '10

18 Dec '10

Since it is Friday, maybe some of peering experts have some time to speculate what this new approach proposed by Comcast might be, as they assert it would represent "a significant shift of Internet infrastructure." http://www.lightreading.com/document.asp?doc_id=202121 http://blog.comcast.com/2010/12/comcast-continues-discussions-with-level-3-… Well, their previous proposal was already representing quite a significant shift, and not in a good way, but I wonder what the new offer could be so that they figured it would be more acceptable to Level 3. I hope due to the speculative nature of the question it will not be considered off-topic. -Lorand Jakab

16 20

Charter abuse contacts?
by Mike 18 Dec '10

18 Dec '10

Greetings, I am having trouble getting network abuse reports to charter. Forwarded spam reports, as well as 'message headers only', are being rejected as spam themselves for no other reason given. Would like to get this out as we've identified an abuser on the charter network who needs to re-read their ToS agreement.... Mike-

1 0