- NANOG - lists.nanog.org

[NANOG-announce] NANOG45 Survey
by Betty Burke 27 Jan '09

27 Jan '09

Please excuse the posting to NANOG, however given the large number of remote viewers we wanted all to be aware; the NANOG45 Survey is online. Please take a moment and complete http://www.surveymonkey.com/s.aspx?sm=xAI_2bhyaMaWjl2diOG8lBKQ_3d_3d For those on site, there are also some paper copies in LaFiesta. We look forward to your comments!! All best. Betty Merit Network Inc. Merit/NANOG Project Manager _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

DNS DDoS - New Hosts
by Andrew Fried 27 Jan '09

27 Jan '09

As of 10:10am (EST) new hosts are now being targeted in the DDoS. Interestingly enough two of the ip addresses are in China. Attached is a file containing the geoip/whois and peering information for the targeted systems. +----------------+-------------+ | host | count(host) | +----------------+-------------+ | 202.104.106.49 | 45 | | 210.21.218.138 | 48 | | 63.217.28.226 | 1153 | | 64.57.246.146 | 1559 | | 67.192.144.0 | 11765 | | 76.9.16.171 | 582 | +----------------+-------------+ -- Andrew Fried andrew.fried(a)gmail.com GeoIP Location Information for IP: 202.104.106.49 Located in: Boshi, 26 (CN) Latitude: 34.7667 Longitude: 110.0500 Area Code: Postal Code: ARIN information for: 202.104.106.49 DNS PTR Record: Registrar: apnic ASN Number: AS4134 Country: CN Ip Starting Block: 202.104.0.0 IP Ending Block: 202.105.255.255 IP Block Size: 131072 Date Registered: 19980817 Block Status: allocated BGP Peering Information for ASN4134: PEER_AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name 174 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | COGENT Cogent/PSI 1239 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | SPRINTLINK - Sprint 1299 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | TELIANET TeliaNet Global Network 2516 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | KDDI KDDI CORPORATION 2828 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | XO-AS15 - XO Communications 2914 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | NTT-COMMUNICATIONS-2914 - NTT America, Inc. 3257 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | TISCALI-BACKBONE Tiscali Intl Network BV 3320 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | DTAG Deutsche Telekom AG 3491 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | BTN-ASN - Beyond The Network America, Inc. 3549 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | GBLX Global Crossing Ltd. 7132 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | SBIS-AS - AT&T Internet Services 7473 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | SINGTEL-AS-AP Singapore Telecommunications Ltd 11164 | 202.104.106.49 | 202.104.0.0/17 | CN | apnic | 1998-08-17 | TRANSITRAIL - National LambdaRail, LLC GeoIP Location Information for IP: 210.21.218.138 Located in: Shenzhen, 30 (CN) Latitude: 22.5333 Longitude: 114.1333 Area Code: Postal Code: ARIN information for: 210.21.218.138 DNS PTR Record: sym.gdsz.cncnet.net. Registrar: apnic ASN Number: AS17623 Country: CN Ip Starting Block: 210.21.128.0 IP Ending Block: 210.21.255.255 IP Block Size: 32768 Date Registered: 20001017 Block Status: allocated BGP Peering Information for ASN17623: PEER_AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name 4837 | 210.21.218.138 | 210.21.192.0/18 | CN | apnic | 2000-10-17 | CHINA169-BACKBONE CNCGROUP China169 Backbone GeoIP Location Information for IP: 63.217.28.226 Located in: Herndon, VA (US) Latitude: 38.9841 Longitude: -77.3827 Area Code: 703 Postal Code: 20170 ARIN information for: 63.217.28.226 DNS PTR Record: 63-217-28-226.static.pccwglobal.net. Registrar: arin ASN Number: AS3491 Country: US Ip Starting Block: 63.216.0.0 IP Ending Block: 63.223.255.255 IP Block Size: 524288 Date Registered: 19991209 Block Status: allocated BGP Peering Information for ASN3491: PEER_AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name 174 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | COGENT Cogent/PSI 701 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 1299 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | TELIANET TeliaNet Global Network 2516 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | KDDI KDDI CORPORATION 2828 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | XO-AS15 - XO Communications 3549 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | GBLX Global Crossing Ltd. 4565 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | MEGAPATH2-US - MegaPath Networks Inc. 4657 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | STARHUBINTERNET-AS Starhub Internet, Singapore 6695 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | DECIX-AS DE-CIX, the German Internet Exchange 7132 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | SBIS-AS - AT&T Internet Services 7473 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | SINGTEL-AS-AP Singapore Telecommunications Ltd 10310 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | YAHOO-1 - Yahoo! 11164 | 63.217.28.226 | 63.216.0.0/13 | US | arin | 1999-12-09 | TRANSITRAIL - National LambdaRail, LLC GeoIP Location Information for IP: 64.57.246.146 Located in: Suwanee, GA (US) Latitude: 34.0535 Longitude: -84.0659 Area Code: 770 Postal Code: 30024 ARIN information for: 64.57.246.146 DNS PTR Record: virtus.vps.4tvirtual.com. Registrar: arin ASN Number: AS20141 Country: US Ip Starting Block: 64.57.240.0 IP Ending Block: 64.57.255.255 IP Block Size: 4096 Date Registered: 20051012 Block Status: allocated BGP Peering Information for ASN20141: PEER_AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name 6983 | 64.57.246.146 | 64.57.240.0/20 | US | arin | 2005-10-12 | ITCDELTA - ITC^Deltacom 14745 | 64.57.246.146 | 64.57.240.0/20 | US | arin | 2005-10-12 | INTERNAP-BLOCK-4 - Internap Network Services Corporation GeoIP Location Information for IP: 67.192.144.0 Located in: San Antonio, TX (US) Latitude: 29.5073 Longitude: -98.5747 Area Code: 210 Postal Code: 78229 ARIN information for: 67.192.144.0 DNS PTR Record: Registrar: arin ASN Number: AS33070 Country: US Ip Starting Block: 67.192.0.0 IP Ending Block: 67.192.255.255 IP Block Size: 65536 Date Registered: 20070716 Block Status: allocated BGP Peering Information for ASN33070: PEER_AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name 209 | 67.192.144.0 | 67.192.128.0/18 | US | arin | 2007-07-16 | ASN-QWEST - Qwest Communications Corporation 1299 | 67.192.144.0 | 67.192.128.0/18 | US | arin | 2007-07-16 | TELIANET TeliaNet Global Network 2914 | 67.192.144.0 | 67.192.128.0/18 | US | arin | 2007-07-16 | NTT-COMMUNICATIONS-2914 - NTT America, Inc. 6461 | 67.192.144.0 | 67.192.128.0/18 | US | arin | 2007-07-16 | MFNX MFN - Metromedia Fiber Network 7018 | 67.192.144.0 | 67.192.128.0/18 | US | arin | 2007-07-16 | ATT-INTERNET4 - AT&T WorldNet Services GeoIP Location Information for IP: 76.9.16.171 Located in: Weehawken, NJ (US) Latitude: 40.7685 Longitude: -74.0199 Area Code: 201 Postal Code: 07086 ARIN information for: 76.9.16.171 DNS PTR Record: Registrar: arin ASN Number: AS23393 Country: US Ip Starting Block: 76.9.0.0 IP Ending Block: 76.9.31.255 IP Block Size: 8192 Date Registered: 20070208 Block Status: allocated BGP Peering Information for ASN23393: PEER_AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name 2516 | 76.9.16.171 | 76.9.0.0/19 | US | arin | 2007-02-08 | KDDI KDDI CORPORATION 3257 | 76.9.16.171 | 76.9.0.0/19 | US | arin | 2007-02-08 | TISCALI-BACKBONE Tiscali Intl Network BV 3356 | 76.9.16.171 | 76.9.0.0/19 | US | arin | 2007-02-08 | LEVEL3 Level 3 Communications 4565 | 76.9.16.171 | 76.9.0.0/19 | US | arin | 2007-02-08 | MEGAPATH2-US - MegaPath Networks Inc. 6453 | 76.9.16.171 | 76.9.0.0/19 | US | arin | 2007-02-08 | GLOBEINTERNET TATA Communications

1 0

NANOG stream - projector screens
by Tim Chown 27 Jan '09

27 Jan '09

Hi, Just a minor comment - yesterday the projector screen appeared larger in the streamed picture (I think we only saw one screen?) and was readable. Today the view seems to have been made wider, and both screens appear brighter and smaller and no longer readable on the HD stream. Would be nice if they were :) -- Tim

3 3

Comcast NOC contact wanted
by Bobby Kuzma 26 Jan '09

26 Jan '09

Hello all, We've been having issues with latency on one of our customers in Tallahassee, FL on Comcast, due to some very odd routing. Could anyone with Comcast please get in touch with me off-list. Thanks, Bobby Kuzma, CISSP VP, Professional Services ElectroNerdz, Inc.

1 0

Updated: New meeting hd stream servers
by Anton Kapela 26 Jan '09

26 Jan '09

So, I underestimated the popularity of the NANOG 45 meeting. <g> We've moved the streams to a SJC and NYC reflector pair. I'm too cheap to implement GSLB or bothering coordinating anycast, so you'll need to self-direct your choice of which POP you'll watch from. HD-lite streams: http://nanog-east.owhost.net:8000 http://nanog-west.owhost.net:8000 Full-HD streams: http://nanog-east.owhost.net:9000 http://nanog-west.owhost.net:9000 Of course, you'll need a player that supports mpeg TS's and h.264. Videolan VLC or Mplayer work, others, not so much. Best, -Tk

5 6

ATT Contact
by Jeff Rooney 26 Jan '09

26 Jan '09

Does anyone have an ATT contact that might be able to help with a Business Class DSL issue? We are seeing pretty major packet loss across their network, but since their tests are not registering any problems they will not escalate the the issue: Host Loss% Snt Last Avg Best Wrst StDev 1. 216.x.x.x 0.0% 15 0.9 1.8 0.9 11.6 2.8 2. 64.14.x.x 0.0% 15 1.3 1.6 1.3 4.5 0.8 3. hr2-ge-11-46.Elkgrovech3.savvis.net 0.0% 14 0.7 0.7 0.6 1.5 0.2 4. cr2-tengig-0-7-5-0.chicago.savvis.net 0.0% 14 1.9 2.1 1.8 3.2 0.4 5. 204.70.200.90 0.0% 14 18.6 18.8 18.5 19.3 0.2 6. 204.70.197.241 0.0% 14 19.3 19.5 19.3 19.9 0.2 7. ex1-g4-0-1.eqabva.sbcglobal.net 15.4% 14 22.3 22.1 21.8 23.2 0.4 8. dist1-g1-3.chcgil.ameritech.net 21.4% 14 24.5 24.6 24.0 24.8 0.2 9. Se20-g5-2.chcgil.sbcglobal.net 0.0% 14 23.9 24.0 23.7 24.1 0.1 10. adsl-76-193-193-214.dsl.chcgil.sbcglobal.net 7.1% 14 32.0 35.3 32.0 54.0 6.1 11. adsl-76-193-193-210.dsl.chcgil.sbcglobal.net 7.1% 14 32.9 34.1 32.9 39.8 1.8 Jeff Rooney jtrooney(a)nexdlevel.com

2 1

DNS DDoS Host list
by Andrew Fried 26 Jan '09

26 Jan '09

Based on the logs from the past 48 hours, here are the hosts that appear to be under attack. The count field reflects the individual number of "'./NS/IN' denied" log entries that appeared in my logs. Note that the stats for 206.71.158.30 are under-reported due to the fact that I blackholed that address last night, however packet captures reveal that I'm no longer seeing spoofed packets targeting that address. +----------------+-------------+ | host | count(host) | +----------------+-------------+ | 10.168.69.6 | 18 | | 202.104.106.49 | 84 | | 206.71.158.30 | 34327 | | 210.21.218.138 | 84 | | 63.217.28.226 | 2696 | | 66.230.160.1 | 3541 | | 76.9.16.171 | 1355 | +----------------+-------------+ -- Andrew Fried andrew.fried(a)gmail.com

1 0

Mcast mpeg2 and unicast h.264 for NANOG-45
by Anton Kapela 26 Jan '09

26 Jan '09

List, The DR meeting is now available in HD video format at the following addresses: mcast feed: 25 mbit HDV, mpeg Transport Stream, UDP: 233.0.59.45 port 1234 unicast feeds: ~1mbit HD-Lite h.264, in mpeg TS: HTTP://208.66.134.110:8000 ~3mbit HDV h.264, in mpeg TS: HTTP://208.66.134.110:9000 Enjoy, -tk

11 16

NANOG 45 PGP signing party. (update)
by Joel Jaeggli 26 Jan '09

26 Jan '09

Just a quick note, The thrice annual NANOG pgp key signing party will be making an appearance at NANOG 45. The keysigning sessions are going to be during the morning breaks during the general session, and will be located in the Higuey room on the pool side of the hotel. Monday January 26th 11:00-11:30 Tuesday January 27th 11:00-11:30 It is not to late to add your key to the keyring at: https://biglumber.com/x/web?keyring=9210 Then come to one or both sessions with some form of government issued photo ID. If you have any further questions, feel free to contact me via email. Feel free to add your key to the keyring right up to the time of the last keysigning event. Thanks Joel

1 0

BGP on Mac OS X?
by cayle.spandon＠gmail.com 26 Jan '09

26 Jan '09

Does anyone known which open source BGP implementation I can get running on Mac OS X Leopard with a minimum of fuss? This is for experimentation only (not for a production environment) so I am not too concerned about scaling and performance. If any tweaking is needed to get it to compile / run on OS X, a pointer to a website with instructions would be highly appreciated. -- Cayle.

4 4