- NANOG - lists.nanog.org

Route Target rewrite
by shake righa 04 Dec '09

04 Dec '09

Anyone with material on how to perform route target re-write as well as filtering during vpnv4 BGP sessions. Have been ttying but the rewrite is not occuring. Regards, Shake Righa

2 2

port scanning from spoofed addresses
by Matthew Huff 04 Dec '09

04 Dec '09

We are seeing a large number of tcp connection attempts to ports known to have security issues. The source addresses are spoofed from our address range. They are easy to block at our border router obviously, but the number and volume is a bit worrisome. Our upstream providers appear to be uninterested in tracing or blocking them. Is this the new normal? One of my concerns is that if others are seeing probe attempts, they will see them from these addresses and of course, contact us. Any suggestions on what to do next? Or just ignore. ---- Matthew Huff | One Manhattanville Rd OTA Management LLC | Purchase, NY 10577 http://www.ox.com | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-460-4139

6 7

Sr. Net Eng needed.
by Joe Hamelin 04 Dec '09

04 Dec '09

Lots of travel, 6 month contract, 4G build-out. Contact Voshte at vgustafson(a)kforce.com. -- Joe Hamelin, W7COM, Tulalip, WA, 360-474-7474

1 0

FW: news from Google
by Kain, Becki (B.) 03 Dec '09

03 Dec '09

when is the European Union going to sue them for anti-trust, ala Microsoft? -----Original Message----- From: Seth Mattinen [mailto:sethm@rollernet.us] Sent: Thursday, December 03, 2009 1:49 PM To: nanog(a)nanog.org Subject: Re: news from Google Jorge Amodio wrote: >> now Google DNS, anything more? > > GoogleNation. > No kiddng. I must be the only one who is getting tired of seeing Google take over literally everything. ~Seth

3 2

Calling Comcast Postmaster or whomever actually is responsible for Comcast RBL maintenance
by Chris Stebner 03 Dec '09

03 Dec '09

For over a month now I've been fighting with Comcast Customer Security Assurance regarding a simple BlackList issue. Apparently there is some disconnect between internal applications and their ability to report BlackList status accurately and the 'actual' BlackList rule-set. Supposedly the ticket has been escalated to 'admin' and 'engineering' multiple times to no avail. Currently we are waiting for engineering again to examine the issue. The block is owned by us, a facilities based CLEC in business for over 10 years. The /24 in question is used for business T1's. If anyone has any contacts, ideas or the power to resolve the issue I'd be elated to hear from you. Thank you all for your time, Chris Stebner 970-403-0102

2 1

AT&T SMTP Admin contact?
by Brad Laue 03 Dec '09

03 Dec '09

Hi all, Would I be able to get an AT&T mail administrator to contact me off-list? We've recently moved our mailservers to a new IP address range, and the standard CGI forms haven't produced any progress for us in over a week now. Unfortunately this affects dozens of hosted clients... The CGI form at http://wn.att.net/cgi-bin/block_admin.cgi has also got a dead link at the bottom, which shakes my confidence in its level of maintenance a little. Thanks in advance, -- Regards, Brad Laue Systems Administrator, Inftek Hosting 1-888-44-SYNCD http://www.getsyncd.com (888) 44-SYNCD (888-447-9623) x702

13 19

New European IXP customer tool
by Serge Radovcic 03 Dec '09

03 Dec '09

Just wanted to announce that we published a handy little tool for those either already, or interested in, peering at an European IXP(s). The Euro-IX ASN filter allows one to make use of our IXP database that contains more than 4.800 ASNs that peer at IXPs around Europe. You can see which ASNs peer where and what the overlap is between multiple IXPs and, well more....just try it out and see. https://www.euro-ix.net/member/m/asnfilter All feedback is welcome Serge Euro-ix

1 0

Re: Leaving public peering?
by Serge Radovcic 03 Dec '09

03 Dec '09

On Thu, 3 Dec 2009 10:53:46 -0500 Ken Chase <math(a)sizone.org> wrote: >> Check out this report on the success of peering : >> https://www.euro-ix.net/member/m/document/showDocument/id/158 > This seems to be a protected document behind login-only section of the > site. Can anyone comment on wether the document should be publically > accessible? Would love to spread it around. This report is available to the public at: http://www.euro-ix.net/resources/reports/ Serge

1 0

Re: AT&T SMTP Admin contact?
by Andre Engel 03 Dec '09

03 Dec '09

> -----Ursprüngliche Nachricht----- > Von: Chris Owen [mailto:owenc@hubris.net] > Gesendet: Donnerstag, 3. Dezember 2009 07:25 > An: NANOG list > Betreff: Re: AT&T SMTP Admin contact? > > On Dec 2, 2009, at 9:52 PM, Valdis.Kletnieks(a)vt.edu wrote: > > > It only stops forgery if the SPF record has a -all in it (as > hubris.net does). > > However, a lot of domains (mine included) have a ~all instead. > > I guess I've never really seen the point of publishing a SPF record if > it ends in ~all. What are people supposed to do with that info? For instance some ISPs or Freemail providers give their customers the possibility to use SPF as a value added service to decide if "senders domain" should be dropped in theirs suspicious-folders or not . I also learned that SPF is qualified for senders reputation : http://www.ceas.cc/2006/19.pdf > Spamassassin assigns it a score of 0.6 but that is low enough it really > doesn't have much since it doesn't assign any negative points for > SPF_PASS. > > (And before anybody asks, yes ~all is what we want, and no you can't > ask us > > to try -all instead, unless we're allowed to send you all the > helpdesk calls > > about misconfigured migratory laptops".. ;) > I certainly understand that you may not be able to lock down your > domain. We don't even try for customers for instance. However, if > you can't, I guess I don't really see what good publishing a SPF record > is if you tell people not to enforce it. MAAWG published a document around : Trust in Email begins with Authentication http://www.maawg.org/about/publishedDocuments/MAAWG_Email_Authentication_Pap er_2008-07.pdf > Chris > > ----------------------------------------------------------------------- > -- > Chris Owen - Garden City (620) 275-1900 - Lottery (noun): > President - Wichita (316) 858-3000 - A stupidity tax > Hubris Communications Inc www.hubris.net > ----------------------------------------------------------------------- > -- > Cheers Andre -- Andre Engel Consulting Program Director, Email and Cyber Intelligence Services "..no ghost just a shell" FHE3 GmbH P: +49 721 869 5907 Scheffelstr. 17a M: +49 160 962 44476 76135 Karlsruhe andre.engel(a)fhe3.com http://www.fhe3.com/ Amtsgericht Mannheim, HRB 702495 Umsatzsteuer-Ident: DE254677931 Geschäftsführer: Peter Eisenhauer, Michael Feger, Dimitrij Hilt This message (including any attachments) is the property of FHE3 and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

1 0

Flash Media Servers as Open Proxies
by Marshall Eubanks 03 Dec '09

03 Dec '09

I recently found out that the Adobe Flash Media Server (FMS) can operate "out of the box" as an open proxy, enabling other people to steal server resources and bandwidth. Furthermore, I also found that there is an ecosystem of pirates taking advantage of this "feature" to illegally stream sports events (and maybe other stuff as well). Each event uses multiple (stolen) servers and can amount to thousands of streams and Gbps of consumed bandwidth. I believe but am not 100% sure that there are similar problems with Window Media Servers. I would like to hear (off-list) from people who have experience fighting this so that we could maybe pool techniques. I will try to write this up further later. Regards Marshall Eubanks

3 3