- NANOG - lists.nanog.org

Re: ISP port blocking practice
by Robert Bonomi 08 Sep '10

08 Sep '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Tue Sep 7 15:15:13 2010 > Date: Mon, 6 Sep 2010 19:55:06 -0500 > From: Brett Frankenberger <rbf+nanog(a)panix.com> > To: deleskie(a)gmail.com > Subject: Re: ISP port blocking practice > Cc: NANOG list <nanog(a)nanog.org> > > On Mon, Sep 06, 2010 at 10:38:15PM +0000, deleskie(a)gmail.com wrote: > > > > Having worked in past @ 3 large ISPs with residential customer pools > > I can tell you we saw a very direct drop in spam issues when we > > blocked port 25. > > No one is disputing that. Or, at least, I'm not disputing that. I'm > questioning whether or not the *Internet* has experienced any decrease > in aggregate spam as a result of ISPs blocking port 25. Did the spam > you blocked disappear, or did it all get sent some other way? _I_ can't say about 'some other way', but, on average, between 1/4 and 1/3 of the all the incoming spam at my personal server is 'direct to MX', that would have been been, at least 'slowed a little bit' by "classical, dumb" port 25 blocking. Now, a *smart* port 25 enforcer -- where traffic outbound to port 25 was selectively NATted into a 'data sink' -- something that replies "200" to everything up to the DATA command, and _always_ gives a 5xy response to that (with text like "you must send outgoing mail though our server'), WOULD kill the traffic dead. Or, at least, force the spamware writers to start paying attention to SMTP response codes, *IF* they wanted to count deliveries. All available evidence says that -most- spammers/spamware/ botnets pay no attention to such -- as established by the effectiveness of GreetPause, and greylisting. It is worth noting that this kind of 'smart' port 25 blocking would also automatically identify 'infected' machines, and by consulting the records of who is corrently on that IP address, tell _which_customer_ is has the infected machine, *AND* notify the customer of their problem. all without any need for any (expensive) human involvement. Aside, if spamware _had_ to 'obey the rules' of SMTP transactions, regarding reading reply codes, that alone would probalbly reduce by 50%, if not more, the aggregate sending _capacity_ of the world's spam sources. Whether that would make much of a difference, I don''t know -- depnds on how far existing 'capacity' exeeeds existing usage/demand.133-136 140 142-145 147

1 0

Looking Glass
by Peter Rudasingwa 08 Sep '10

08 Sep '10

I have a linux (ubuntu) box and I would like to install a BGP looking glass. Are there any out there for free and how can one go about it? Is linux the best OS to use? Thanks, Peter R.

5 4

Inline Traffic Management / Tracking - Usage Based Billing
by Paul Stewart 08 Sep '10

08 Sep '10

Hi there... We are examining several options currently for appliances/devices that sit inline (most likely) and can perform all/some of these services: -Track customer usage and generate monthly reports based on username (PPPOE) or cable MAC (DHCP) - and doesn't require any changes to our Radius infrastructure. In other words, it has the smarts to gather the username/IP combination along with the Radius Start/Stop to do accurate reporting. -Throttling of certain services/applications at certain times of day (looking for fairly extensive options here including ability to take total link capacity into account - reasonably dynamic) -24X7X365 support and hardware coverage (no next business day shipping - 4 hour response onsite kind of stuff) -Clustering/HA options -Centralized management/reporting This is NOT an open invitation for sales people to contact me - I'm asking here for operational feedback with likes/dislikes. I can appreciate if most folks prefer to reply offline. We have trialled the Arbor solution to date but that is the only comparison we have so far. Thanks, Paul Stewart

1 0

just seen my first IPv6 network abuse scan, is this the start for more?
by Igor Ybema 07 Sep '10

07 Sep '10

Hi, Since recently we noticed "Neighbour table overflow" warnings from the kernel on a lot of Linux machines. As this was very annoying for us and our customers I started to dump traffic and tried to find the cause. I discovered a external IPv6 host was doing a (rather useless due to the amount of addresses) IPv6 ICMP scan on our network recurring daily and mostly during the nights, sometimes with speeds of 1000 scans per second. Due to the ammount of IPv6 neighbor discoveries from our routers resulting from this scan the Neighbour table overflow messages appeared on the machines. Are there more people who have seen this behaviour recently? Is this a start of hackers/spammers onto the IPv6 network? This is the first scan I have seen. I already contacted the ISP for the source address. No answer yet. If I have more news I will post them here. regards, Igor Ybema the Netherlands

15 26

whois at rest
by Jon Lewis 07 Sep '10

07 Sep '10

More often than not today the only replies I've been getting back from the ARIN whois servers is: ERROR 503: Unable to service request due to high volume. Is there really high volume today, or is the new restful thing broken again? ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

IPv4 squatters on the move again?
by Tero Toikkanen 07 Sep '10

07 Sep '10

Anyone hear of the SundownGroup? On Thursday we received an interesting RFQ from them and suspect their intentions for requesting an IP assignment isn't exactly what they state. We have already turned them down, but thought others might be interested in their activities as well. RIPE NCC has also been notified of this. In brief they wanted to buy colo form us: "P4 single core @ 2 Ghz, 1 GB RAM, 60 GB HD, Linux CentOS 5x.x, 10 Mbps bandwidth. A single /21 or /20 net block of IP Adresses" Their reason for requesting such a large address block was "As we are currently launching our WholesaleVOIP operation we are in desperate need of this IP space as part of our ARIN process we will need these ranges SWIPd to us and we will in turn renumber with ARIN and return the netblocks to you as soon as ours are allocated and routed." Interesting tidbits about the company we and the networking community have already found out: Compare http://sundowngroup.com/ and http://www.edgecast.com/ (Edgecast has been notified). The contact address is the same as National University Nevada (nu.edu) Sundown Capital Management LLC 2850 Horizon Ridge Parkway Henderson, Nevada 89052 United States of America They also have virtually no Internet presence (http://www.google.com/search?q=%22Sundown+Capital+Management%22) The first result shows them as a franchicing company with contact address in California: http://www.scribd.com/doc/14385124/QFA-Unit-Final-PDF-File-of-32709-FDD-Wit… I'd say this case is pretty obvious... With Kind Regards, -- Tero Toikkanen Nebula Oy Internet Services

7 10

OAM and QinQ
by Serge Vautour 07 Sep '10

07 Sep '10

Hello, We're working on deploying some L2 services over an MPLS network. Our model includes a CPE with OAM capabilities and QinQ from the PE to the CPE. For now we want to do simple OAM functions from CPE-CPE (no MIPs in the MPLS network). Our lab testing has shown some sort of incompatibilities between OAM and QinQ. OAM frames are encapsulated with a single VLAN tag (the SVLAN) on the CPE. When the PEs only perform SVLAN swapping, everything works fine. If we configure the PE to also perform CVLAN manipulation, it drops OAM frames. It likely does not know how to process them because they don't have a CVLAN tag. We're working with 2 CPE vendors and neither of them are able to add 2 VLAN tags to the OAM frames. Has anyone else encountered this problem? How do you get around it? One option we're looking at is to simply not perform CVLAN manipulation on the PE. This means limiting our service to customers. Our PEs are all Juniper MX boxes if it helps. Thanks, Serge

2 1

RE: Re: IPv6 Glue Records at Dotster / Domain.com
by Martin Hotze 07 Sep '10

07 Sep '10

> Date: Sat, 4 Sep 2010 11:17:36 -0400 > From: Jared Mauch <jared(a)puck.nether.net> > Subject: Re: IPv6 Glue Records at Dotster / Domain.com > > Opensrs also suffers from lack of v6 glue disease. Last I saw on their > forums it said "coming soon" for about a year. IBTD. We register our domains with them (Tucows/OpenSRS) and we got the entry, but you have to contact support and it is done manually. Check my domain hotze.com for proving it. #m hotze.com / AS8596

6 5

Re: Juniper to Watchguard IPSEC
by rhsv6＠hushmail.com 06 Sep '10

06 Sep '10

You have not specified what sort of settings you are using (PSK vs CERTS, Algos , route based VPN etc) However something along the following lines is working fine for me: set ike gateway "**************" address 172.16.250.1 Main outgoing- interface "ethernet0/8" preshare "**************" proposal "pre-g2- 3des-sha" set vpn "**************" gateway "**************" replay tunnel idletime 0 proposal "g2-esp-aes128-sha" set vpn "**************" id 0x7 bind interface tunnel.40 set vpn "**************" proxy-id local-ip 192.168.1.0/24 remote-ip 10.1.2.0/24 "ANY" >Anyone have any experience with IPSEC between a WG Firebox and Juniper >SRX/SSG? Running into some problems and beginning to think there might be >some incompatibilities in their IPSEC options. > TIA, > Bryan

1 0

seek cable/dsl provider in Troy MI 48083 USA
by nanog＠ilk.net 05 Sep '10

05 Sep '10

Hi, for a customer at Stephenson Highway Troy, MI 48083 USA we seek an internet access/service provider, cable/xdsl/... would be ok, fixed ip-address prefered. Please answer off-list. Thank you for your kind support, Have a nice weekend, Jürgen Marenda, ILK

4 3