- NANOG - lists.nanog.org

Unable to reach security.debian.org through an HurricaneElectric IPv6 pipe
by Laurent CARON 29 Oct '09

29 Oct '09

Hi, I'm currently unable to reach security.debian.org (2001:8d8:2:1:6564:a62:0:2) through IPv6. donald:~# traceroute -M tcpconn -p 80 wieck.debian.org -n -6 traceroute to wieck.debian.org (2001:8d8:2:1:6564:a62:0:2), 30 hops max, 80 byte packets 1 2001:7a8:820:1::1 0.170 ms 0.151 ms 0.126 ms 2 2001:7a8:820::1 0.317 ms 0.274 ms 0.515 ms 3 2001:7a8:1:9ff2::1 1.753 ms 1.745 ms 1.724 ms 4 2001:7a8:0:ff22::1 2.384 ms 2.374 ms 2.355 ms 5 2001:7a8:1:91::1 48.524 ms 48.530 ms 48.495 ms 6 2001:7a8:0:ffe1::fffe 10.203 ms 10.345 ms 10.270 ms 7 2001:7f8:4::2170:1 10.457 ms 10.390 ms 10.572 ms 8 2001:8d8:0:2::6 20.535 ms 19.820 ms 20.003 ms 9 2001:8d8:0:2::a 19.953 ms 20.517 ms 20.458 ms 10 2001:8d8:0:2::12 22.901 ms 2001:8d8:0:2::2a 22.333 ms 22.707 ms 11 2001:8d8:0:4::11 23.908 ms 2001:8d8:0:4::10 23.388 ms 2001:8d8:0:5::11 23.338 ms 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * donald:~# traceroute -M tcpconn -p 25 wieck.debian.org -n -6 traceroute to wieck.debian.org (2001:8d8:2:1:6564:a62:0:2), 30 hops max, 80 byte packets 1 2001:7a8:820:1::1 0.185 ms 0.147 ms 0.128 ms 2 2001:7a8:820::1 0.435 ms 0.417 ms 0.396 ms 3 2001:7a8:1:9ff2::1 1.633 ms 1.860 ms 1.849 ms 4 2001:7a8:0:ff22::1 2.317 ms 2.305 ms 2.287 ms 5 2001:7a8:1:91::1 108.936 ms 108.943 ms 108.926 ms 6 2001:7a8:0:ffe1::fffe 10.407 ms 10.354 ms 10.305 ms 7 2001:7f8:4::2170:1 14.970 ms 15.158 ms 15.114 ms 8 2001:8d8:0:2::6 20.555 ms 20.161 ms 19.901 ms 9 2001:8d8:0:2::a 19.862 ms 19.425 ms 20.330 ms 10 2001:8d8:0:2::2a 22.282 ms 2001:8d8:0:2::12 23.129 ms 2001:8d8:0:2::2a 22.314 ms 11 2001:8d8:0:4::10 23.035 ms 2001:8d8:0:5::10 22.910 ms 2001:8d8:0:4::10 23.190 ms 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * -- lcaron(a)unix-scripts.info

3 5

dealing with bogon spam ?
by Leslie 29 Oct '09

29 Oct '09

First off, I'm not certain if unallocated space in blocks less than a /8 is properly called bogon, so pardon my terminology if I'm incorrect. We're seeing a decent chunk of spam coming from an unallocated block of address space. We use CYMRU's great list of /8 bogon space to prevent completely off the wall abuse, but the granularity stops at /8's. Obviously, I've written the originating AS and its single upstream provider (sadly without any response). I'm not looking for a one time solution for this issue however -- I'd like to permanently block (and kick) anyone who's using unallocated space illegitimately. How have you dealt with this issue? Does anyone publish a more granular listing of unallocated space? Does arin have this information somewhere other than just probing any given ip via whois? Thanks! Leslie Craigslist Spam Hater

12 16

Redundant Data Center Architectures
by Stefan Fouant 29 Oct '09

29 Oct '09

I'm wondering what are the growing trends in connecting Data Centers for redundancy in DR/COOP environments. I imagine VPLS has a big play here, but I'm willing to bet there are all sorts of weirdness that such environments can create, such as the effect it may have on DR elections, etc. Also, what are your experiences in replication of storage over WAN links? Are people tending towards iSCSI or do trends indicate that FCoE or FCoIP may become the preferred mechanism? Any experience with WAN acceleration in such environments? Thanks in advance! -- Stefan Fouant

9 12

ALTDB Problems
by Renato Frederick 28 Oct '09

28 Oct '09

Hello I'm having some problems to send a new record to ALTDB by using mail. Old records work OK and I can update. Someone here at nanog is having same issues? Is there any ALTDB admins here? Thanks!

4 5

looking for optonline/cablevision contact
by andrew young 28 Oct '09

28 Oct '09

ive been having a mailing issue with optonline/cablevision for several weeks now and normal business tech support is giving me the run around. can someone from optonline/cablevision contact me off thread so i can try to get this simple thing resolved. -- ---------------------------------------- Andrew Young Webair Internet Development, Inc. Phone: 1 866 WEBAIR 1 x143 http://www.webair.com Shift hours: Tues-Friday 12PM-8PM, Sat 9AM-5PM

1 0

ISP with CSC/CoC?
by Luan Nguyen 28 Oct '09

28 Oct '09

Hello, I am studying for the CCIE Service Provider and ran across a few CSC/CoC scenarios. I am wondering if any major ISP uses/offers this kind of service? Thanks. ----------------------------- Luan Nguyen Chesapeake NetCraftsmen, LLC. http://www.netcraftsmen.net ----------------------------- __________ Information from ESET NOD32 Antivirus, version of virus signature database 4551 (20091028) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

1 0

IPv6 could change things - Was: DMCA takedowns of networks
by Michael Dillon 28 Oct '09

28 Oct '09

> Not sure how much I believe of the article and its lack of detail and > chopped quotes...but did HE really disconnect an entire downstream network > over a DMCA notice, or did they null route a /32 that was used by a customer > to host hundreds of virtual web sites? Since the tools at a network operator's disposal are ACLs which make it easy to block traffic to a /32 without the need for deep packet inspection, one would expect that this regularly causes collateral damage if that /32 is a web server hosting hundreds of virtual websites. But, when IPv6 is a bit more common, there is no need for virtual hosters to share a single IP address between several sites. They may as well use a unique IPv6 address for every single site, even if they are all on the same server. The side effect of this is that it makes the network operator's tool sharper, and able to knock down single sites with a /32 ACL. For a hosting provider, I would think that this strengthens the business case for IPv6. --Michael Dillon

11 11

Re: IPv6 could change things - Was: DMCA takedowns of networks
by William Pitcock 27 Oct '09

27 Oct '09

To expand on this from a programmers perspective, usually at the kernel/network stack level, a "patricia" radix-style trie is used for fast ipv6 lookups. The benefit of the patricia trie being that if you only have a difference keylength of 8 bits (/120) then the ip lookup only takes 8 steps in a worst-case scenario. The same concept applies to ipv4 cidr as well, but it is less obvious. William ------Original Message------ From: Adrian Chadd To: Jeroen Massar Cc: North American Network Operators Group Subject: Re: IPv6 could change things - Was: DMCA takedowns of networks Sent: Oct 27, 2009 10:39 AM On Tue, Oct 27, 2009, Jeroen Massar wrote: > But yes, the network stack itself is a different question, then again, > you can just route a /64 into the loopback device and let your apache > listen there... (which also allows you to do easy-failover as you can > move that complete /64 to a different box ;) Funny you should mention that. A couple of tricks I've seen: * instead of a linked list and O(n) searching of interface aliases, use some kind of tree to map local IP -> interface. * hacks to do a "bind to all damned IP addresses and let userspace sort it out". I've done the former for a few thousand aliases with no degredation in performance. The hacks available for freebsd-4.x for the Web Polygraph software did something similar. 2c, Adrian -- William Pitcock SystemInPlace - Simple Hosting Solutions 1-866-519-6149

1 0

DMCA takedowns of networks
by William Allen Simpson 27 Oct '09

27 Oct '09

http://www.huffingtonpost.com/2009/10/23/chamber-of-commerce-stron_n_332087… Hurricane Electric obeyed the Chamber's letter and shut down the spoof site. But in the process, they shut down hundreds of other sites maintained by May First / People Link, the Yes Men's direct provider (Hurricane Electric is its "upstream" provider). What's going on? Since when are we required to take down an entire customer's net for one of their subscriber's so-called infringement? Heck, it takes years to agree around here to take down a peering to an obviously criminal enterprise network.... My first inclination would be to return the request (rejected), saying it was sent to the wrong provider.

22 35

Re: DMCA takedowns of networks
by William Pitcock 27 Oct '09

27 Oct '09

Mayfirst / Peoplelink did not get any notice that service would be turned down prior to it happening. Hurricane has had a really bad history of handling copyright complaints. The situation for example resulting in mayfirst's circuit being turned down had nothing at all to do with copyright and was instead a trademark violation dispute. IANAL, but trademark issues are not copyright issues nor are they handled via the dmca. Therefore what hurricane did in this instance is really unacceptable. It should be emphasized that the dmca does not require turning down service - only sending the takedown notice along to an appropriate contact. See also: common-carrier immunity concept. I don't know about you, but hurricanes actions in this instance has made me reevaluate the use of their products in future projects. (this post definitely does not reflect the opinions of my employer.) William ------Original Message------ From: Jack Bates To: Richard A Steenbergen Cc: North American Network Operators Group Subject: Re: DMCA takedowns of networks Sent: Oct 26, 2009 1:44 PM Richard A Steenbergen wrote: > had no liability in the matter. Of course Hurricane is well within their > rights not to serve any customer that they please, but the customer is > also well within their rights to find another provider who better > respects the rights of free speech on the Internet (if the above is what > actually happened). > I'm sure HE respects the rights of free speech just fine. That being said, a notice was delivered, customer may not have replied with the appropriate legal notice, and so HE honored it's obligation to maintain safe harbor. One would have to be an idiot to jeopardize their company by rolling the dice in an effort to protect free speech (which may not legally be free speech). Courts determine what is free speech. ISPs just try to stay the hell out of the way. Jack -- William Pitcock SystemInPlace - Simple Hosting Solutions 1-866-519-6149

1 0