- NANOG - lists.nanog.org

Re: Repeated Blacklisting / IP reputation
by dlr＠bungi.com 09 Sep '09

09 Sep '09

[In the message entitled "Re: Repeated Blacklisting / IP reputation" on Sep 8, 14:34, Joe Greco writes:] > > there is a fundamental disconnect here. the IP space is neutral. > > it has no bias toward or against social behaviours. its a tool. > > the actual/real target here are the people who are using these tools > > to be antisocial. blacklisting IP space is always reactive and > > should only beused in emergency and as a -TEMPORARY- expedient. > > > > IMHO of course., YMMV. > > > If people were given an option to "block this IP for 30 minutes, 24 hours, > 30 days, 12 months, 5 years, or forever" - I wonder how many people would > just shrug and click "forever." > > This may lead to the discovery of another fundamental disconnect - or two. > IP address space is neutral, but the operators of the space either permit, or deny, the social behaviour which comes from these spaces. For what it's worth, I just completed a study of about 5 years of data on spam. I looked at 100,000,000 IP addresses which had sent me spam. The median duration of sending was 300 days. There was a pronounced peak at 2-3 years of about 30%. The vast majority was more than 30 days. "forever" is pretty close to right, based on current behaviour. --

1 0

Cable and Wireless Antigua
by Ken Gilmour 09 Sep '09

09 Sep '09

Hi there, I have gone through all normal channels to try to get through to someone in Cable and Wireless Antigua (LIME). It seems difficult to get a fast response through normal channels (it can take up to 48 hours some times to get a response to a "network down" situation). Is there any senior admins who deal directly with the transit end on NANOG? I am having some difficulty getting a security issue dealt with. Thanks! Ken

1 0

Colt outages?
by Eric Brunner-Williams 08 Sep '09

08 Sep '09

Anyone have news on this? I understand Colt has fixed London and are working on Dublin, Bruxelles and Geneva... but that's all I have.

2 1

Re: Repeated Blacklisting / IP reputation
by O'Reirdan, Michael 08 Sep '09

08 Sep '09

MAAWG is has no size limitations as to members. Yes we do have a $4000 supporter membership. This has not proved a barrier to many organisations. Mike O'Reirdan Chairman, MAAWG ----- Original Message ----- From: Benjamin Billon <bbillon-ml(a)splio.fr> To: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Tue Sep 08 17:17:58 2009 Subject: Re: Repeated Blacklisting / IP reputation ISPs can be invited and there are specific meetings for them (closed to other members). There're also whitepapers for ISP (and others). But I agree, hoping ALL the ISPs join MAAWG or even hear about it is utopian. -- Benjamin William Astle a écrit : > J.D. Falk wrote: >> Seth Mattinen wrote: >> >>> I was always under the impression that smaller orgs were not allowed to >>> join the MAAWG club. >> >> I've heard that, too, but have no idea where it comes from. It's not >> true; there's no size requirement or anything like that. >> >> http://www.maawg.org/ has the membership application and other info. >> > > The $4000/year minimum membership fee is a non-starter for small > organizations who are already strapped for operating cash as it is. > This is probably where the perception comes from. >

2 1

Block of AS Numbers allocated to APNIC
by Leo Vegoda 08 Sep '09

08 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, The IANA AS Numbers registry has been updated to reflect the allocation of a block of AS Numbers to APNIC. 55296-56319 Assigned by APNIC whois.apnic.net 2009-09-02 The registry can be found at: http://www.iana.org/assignments/as-numbers/as-numbers.xml http://www.iana.org/assignments/as-numbers/as-numbers.xhtml http://www.iana.org/assignments/as-numbers/as-numbers.txt Regards, Leo Vegoda Number Resources Manager, IANA -----BEGIN PGP SIGNATURE----- Version: 9.10.0.500 wj4DBQFKpohJvBLymJnAzRwRAncHAJiRWENmmK+qwpvAZIaPrs/urIa/AJ9f1A05 PM9TJWxzbAxpSiXyIgzvfA== =MGZ2 -----END PGP SIGNATURE-----

1 0

[NANOG-announce] NANOG 47 dates of interest
by David Meyer 08 Sep '09

08 Sep '09

Folks, Just a brief reminder of upcoming dates of interest - The NANOG PC will be posting an updated agenda for NANOG 47 after our 09/08/2009 call - The registration fee for NANOG 47 increases to US$525 on 09/14/2009 - Nominations for the NANOG PC open today, 09/08/2009 - Voting for the 2009/2010 NANOG SC closes at 13:00 EDT on 10-21-09. See http://www.nanog.org/governance/elections/2009elections/ for additional details - Last but not least, the hotel group rate expires in 09/30/2009. See http://www.nanog.org/meetings/nanog47/hotel.php See you all in Dearborn. Dave _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Need Help Getting IP Unblocked by AT&T
by Brian Raaen 08 Sep '09

08 Sep '09

I'm not sure where to take this issue. The Regular AT&T NOC contacts are refusing to talk to me since I do not have a circuit ID, and do not seem to have any understanding about transiting issues. I am unable to fully monitor and manage a router I control, as all traffic bound to its lan IP that transits through the AT&T network is blocked. The Router is connected to a Verizon circuit, but any connection that transits through AT&T is blocked. The ip in Question is from a direct ARIN allocation that I control. I have attached a ping demonstrating that I am receiving an ICMP deny from an AT&T core router. I have also attached a traceroute to both the offending IP and the WAN IP which appears to be working. braaen@brian-debian:~$ ping gw.bwtc.net PING gw.bwtc.net (72.14.76.1) 56(84) bytes of data. >From 12.89.27.105 icmp_seq=1 Packet filtered >From 12.89.27.105 icmp_seq=3 Packet filtered ^C --- gw.bwtc.net ping statistics --- 4 packets transmitted, 0 received, +2 errors, 100% packet loss, time 3004ms braaen@brian-debian:~$ sudo traceroute-nanog -AO gw.bwtc.net [sudo] password for braaen: traceroute to gw.bwtc.net (72.14.76.1), 64 hops max, 40 byte packets 1 gw-alpha.america.net (69.60.176.65) [AS4452] dns(a)america.net 3 ms 3 ms 3 ms 2 gw-alpha.america.net (69.60.176.65) [AS4452] dns(a)america.net 3 ms 3 ms 4 ms 3 69.60.160.8 (69.60.160.8) [AS4452] dns(a)america.net 13 ms rtrs00.america.net (69.60.176.21) [AS4452] dns(a)america.net 13 ms 69.60.160.8 (69.60.160.8) [AS4452] dns(a)america.net 13 ms 4 69.60.160.8 (69.60.160.8) [AS4452] dns(a)america.net 12 ms 35 ms 17 ms 5 gig4-16.core2.suw1.qualitytech.com (64.88.172.145) [AS20141] dnsadmin(a)globix.net [MPLS: Label 673 Exp 0] 15 ms 14 ms 25 ms 6 gig4-16.core2.suw1.qualitytech.com (64.88.172.145) [AS20141] dnsadmin(a)globix.net 14 ms 14 ms 18 ms 7 ten8-3.peer1.suw1.qualitytech.com (64.88.172.197) [AS20141] dnsadmin(a)globix.net 14 ms 12 ms 14 ms 8 border11.tge3-3.qts-1.acs.pnap.net (64.94.3.113) [AS14745] hostmaster(a)pnap.net 14 ms 14 ms 14 ms 9 core1.te2-2-bbnet2.acs002.pnap.net (64.94.0.79) [AS14745] hostmaster(a)pnap.net 14 ms core1.te2-1-bbnet1.acs002.pnap.net (64.94.0.15) [AS14745] hostmaster(a)pnap.net 14 ms 12.86.102.5 (12.86.102.5) [<NONE>] rm-hostmaster(a)ems.att.com 14 ms 10 12.86.102.5 (12.86.102.5) [<NONE>] rm-hostmaster(a)ems.att.com 13 ms 23 ms 13 ms 11 cr1.attga.ip.att.net (12.122.141.2) [<NONE>] rm-hostmaster(a)ems.att.com [MPLS: Label 16745 Exp 0] 40 ms cr2.ormfl.ip.att.net (12.122.5.141) [<NONE>] rm-hostmaster(a)ems.att.com [MPLS: Label 20348 Exp 0] More labels 40 ms More labels 40 ms 12 cr2.ormfl.ip.att.net (12.122.5.141) [<NONE>] rm-hostmaster(a)ems.att.com More labels 40 ms More labels 41 ms More labels 40 ms 13 cr2.nwrla.ip.att.net (12.122.30.77) [<NONE>] rm-hostmaster(a)ems.att.com [MPLS: Label 0 Exp 0] More labels 40 ms gar1.nwrla.ip.att.net (12.123.153.85) [<NONE>] rm-hostmaster(a)ems.att.com 38 ms 38 ms 14 gar1.nwrla.ip.att.net (12.123.153.85) [<NONE>] rm-hostmaster(a)ems.att.com 50 ms 38 ms 38 ms 15 12.89.27.106 (12.89.27.106) [<NONE>] rm-hostmaster(a)ems.att.com 43 ms 44 ms 44 ms 16 * * 12.89.27.105 (12.89.27.105) [<NONE>] rm-hostmaster(a)ems.att.com 44 ms !A braaen@brian-debian:~$ sudo traceroute-nanog -AO 157.130.26.166 traceroute to 157.130.26.166 (157.130.26.166), 64 hops max, 40 byte packets 1 gw-alpha.america.net (69.60.176.65) [AS4452] dns(a)america.net 4 ms 3 ms 6 ms 2 gw-alpha.america.net (69.60.176.65) [AS4452] dns(a)america.net 3 ms 3 ms 3 ms 3 rtrs00.america.net (69.60.176.21) [AS4452] dns(a)america.net 14 ms 13 ms 13 ms 4 69.60.160.8 (69.60.160.8) [AS4452] dns(a)america.net 13 ms 13 ms 12 ms 5 66.0.192.194 (66.0.192.194) [AS20141] dns(a)deltacom.net 13 ms 13 ms 15 ms 6 gig4-16.core2.suw1.qualitytech.com (64.88.172.145) [AS20141] dnsadmin(a)globix.net [MPLS: Label 673 Exp 0] 30 ms ten8-3.peer1.suw1.qualitytech.com (64.88.172.197) [AS20141] dnsadmin(a)globix.net 14 ms gig4-16.core2.suw1.qualitytech.com (64.88.172.145) [AS20141] dnsadmin(a)globix.net 34 ms 7 ten8-3.peer1.suw1.qualitytech.com (64.88.172.197) [AS20141] dnsadmin(a)globix.net 19 ms 13 ms 13 ms 8 core3.tge4-1-bbnet1.acs.pnap.net (64.94.0.3) [AS14745] hostmaster(a)pnap.net 14 ms core3.tge4-1-bbnet2.acs.pnap.net (64.94.0.67) [AS14745] hostmaster(a)pnap.net 14 ms 15 ms 9 core3.tge4-1-bbnet2.acs.pnap.net (64.94.0.67) [AS14745] hostmaster(a)pnap.net 14 ms core3.tge4-1-bbnet1.acs.pnap.net (64.94.0.3) [AS14745] hostmaster(a)pnap.net 14 ms 15 ms 10 TenGigabitEthernet3-4.ar5.ATL1.gblx.net (207.218.80.217) [AS3549] dns(a)gblx.net.80.218.207.in-addr.arpa 14 ms 14 ms 14 ms 11 ge4-3-1000M.ar3.PTY1.gblx.net (67.16.135.18) [AS22566] dns(a)gblx.net 18 ms 14 ms 14 ms 12 0.so-1-1-0.XT1.ATL4.ALTER.NET (152.63.86.170) [<NONE>] hostmaster(a)uu.net 14 ms 49 ms verizon-1.ar2.ATL2.gblx.net (64.208.110.170) [AS3549] dns(a)gblx.net 17 ms 13 0.so-1-1-0.XT1.ATL4.ALTER.NET (152.63.86.170) [<NONE>] hostmaster(a)uu.net 33 ms 14 ms 16 ms 14 0.so-7-1-0.XL3.BOS4.ALTER.NET (152.63.0.209) [<NONE>] hostmaster(a)uu.net 42 ms 48 ms 49 ms 15 POS6-0.GW10.BOS4.ALTER.NET (152.63.17.37) [<NONE>] hostmaster(a)uu.net 41 ms 42 ms 41 ms 16 * networkinnovations-gw.customer.alter.net (157.130.26.166) [<NONE>] hostmaster(a)uu.net 53 ms * -- ----------------- Brian Raaen Network Engineer email: /braaen(a)zcorum.com/ <mailto:braaen@zcorum.com>

3 5

Comcast Abuse Contact
by Ken Gilmour 08 Sep '09

08 Sep '09

Hi There, I am trying to get through to Comcast Abuse dept in a hurry due to a DoS... I have called the normal number on the whois for the offending IP: RAbuseHandle: NAPO-ARIN RAbuseName: Network Abuse and Policy Observance RAbusePhone: +1-856-317-7272 RAbuseEmail: abuse(a)comcast.net Which tells me to call +1-877-477-5537, Which gives me a busy tone. Is there anyone on the list from Comcast watching right now? Thanks! Ken

1 0

ruling: liability for providers who don't act on clients' illegal activities?
by Gadi Evron 08 Sep '09

08 Sep '09

Jury Exacts $32M Penalty From ISPs For Supporting Criminal Websites http://darkreading.com/securityservices/security/cybercrime/showArticle.jht… 'Landmark case' indicates that ISPs may be held liable if they know about criminal activity on their customers' Websites and fail to act A federal jury in California this week levied a total of $32 million in damages from two Internet service providers that knowingly supported Websites that were running illegal operations. In a lawsuit brought by fashion company Louis Vuitton, a jury ruled that two ISPs -- Akanoc Solutions and Managed Solutions Group -- knew about counterfeit Vuitton goods that were being sold on their customers' sites, but didn't act quickly to pull the plug on those sites. The decision was first reported on Tuesday. The ruling has been called a landmark decision by some legal experts, who note that ISPs historically have been protected by the Digital Millennium Copyright Act, which limits service providers' liability for criminal actions that take place on their networks.

2 3

RE: FCCs RFC for the Definition of Broadband
by Frank Bulk 07 Sep '09

07 Sep '09

I don't think LECs to MSOs have first right of refusal..it's possible that with MSOs that the city has give the franchise exclusivity, but blame the city then, not the MSO. What happens more often is that the LEC or MSO uses legal, lobbying, or legislative means to put a stop to the competition, but it's not first right of refusal. In the cases where munis lost, it was in relationship to telephone service and a city's ability to obtain a certificate of service (see here for one muni's story: http://www.cityofhawarden.com/HiTec/History.html) Another route to opposition is if it fills up RoW, though I haven't personally read as much about that. Possibly because if the new company is a desperate enough, they'll come up with a way to address the RoW constraints or show how it's not a real issue. Remember, if it really *is* constrained, the new company won't be super eager to build in there, either. Frank From: James Downs [mailto:egon@egon.cc] Sent: Saturday, September 05, 2009 12:02 PM To: frnkblk(a)iname.com Cc: nanog(a)nanog.org Subject: Re: FCCs RFC for the Definition of Broadband On Aug 28, 2009, at 7:55 PM, Frank Bulk wrote: I'm not following you here -- which party has the right of first refusal? The incumbent companies (generally, a LEC or cable company) are able to refuse projects and also effectively prevent buildouts and upgrades from being done by a 3rd party. However, I have seen reports that in a few areas, municipalities are starting to win lawsuits against them (in apparently the long appeals process). urban area receives no USF, and is not able to financially justify it even with a dense customer base. That might apply to fiber, but even speed upgrades (Newer DSL services) are apparently subject to the same refusal process, but the rules are different across the country, too. -j

1 0