- NANOG - lists.nanog.org

DNS Amplification attack?
by Wil Schultz 21 Jan '09

21 Jan '09

Anyone else noticing "." requests coming in to your DNS servers? http://isc.sans.org/diary.html?storyid=5713 I'm seeing them coming from the following addresses in my ns server logs. 69.50.142.110 69.50.142.11 76.9.16.171 66.230.128.15 66.230.160.1 -wil

9 10

Re: expectations for bgp peering?
by Scott Weeks 21 Jan '09

21 Jan '09

Apologies for top posting, but my response is a little long long... I wouldn't be too concerned about the multi-hop as there're many reasons why they might do that, but a week out and it's still not working? It's all about customer service. Are they giving you the appropriate level of service you expect for what you're paying? If not, vote with your dollars and move on... Usually, I get the circuit up and pingable to the IPs that will be doing the peering ahead of time. I then set a date for the BGP turn up. On my side, BGP is pre-configured and all I have to do is type 'no shut'. Most times everything comes up and we all go home happy. Sometimes I have to do a little troubleshooting. If they got the lower layers up ahead of time with you, set a date to turn up BGP and now it's a week later, I'd be worried about what type of customer service they'd give later on when trouble happens. And they don't allow you to prepend? In my book that'd be two strikes against them and this isn't baseball, so I wouldn't wait for the third strike. scott --- mike-nanog(a)tiedyenetworks.com wrote: So I am just wondering what my expecations should be in a bgp peering scenario where I am multihomed with my own ASN and arin assigned ip space. At issue is the fact that my backup isp forced me to use ebgp multihop to peer with a router internal to their network and not the border router I am directly attached to, and secondly, that they say I am not allowed to prepend at all - they will do it for me, and from the looks of things they have established a route-map that just prepends their AS 6 times to my announcement. This smells of bad engineering. I have looked up the bgp report for my provider and they have 0 downstream AS's, and the week that this project has taken (and it's still not up and working) has left me with less than absolute confidence in the provider. I want to know if anyone has an opinion on ebgp multihop for external customers, and wether I should really have an expectation to be able to assign my prepends as suits my needs? Are there any conditions that could make this fail that I should be aware of? Mike-

1 0

Re: "IP networks will feel traffic pain in 2009" (C|Net & Cisco)
by Matthew Kaufman 20 Jan '09

20 Jan '09

Alex H. Ryu wrote: > Probably IP v4 address runout may not affect for traffic amount that much. > Since people will use NATing for saving IP addresses, and IPv6 will be > slowly take some traffic for that matter. > > It's more of the cost of bandwidth, and the application people uses. > > As I said, "we'll see"... the people using NATing are still going to have to connect to something, somewhere, to get the data that makes up this traffic. The people buying boxes that move traffic around will be spending some of that money on either v6 capability or NATs or both, too. Matthew Kaufman

1 0

Re: Inauguration streaming traffic
by Scott Weeks 20 Jan '09

20 Jan '09

------- jay(a)west.net wrote: ------- From: Jay Hennigan <jay(a)west.net> We're a regional ISP, about 80% SMB 20% residential. We're seeing almost double our normal downstream traffic right now. Anyone else? ------------------------------------ Not much of a traffic boost here in Hawaii as it happened at 7am local time. Most folks caught the first part on TV and rushed to work, evidently. scott

2 1

Level3 NOC Contact
by Darryl Dunkin 20 Jan '09

20 Jan '09

Their support has been really giving me the run-around and is cluelessly sending me from department to department. Does anyone have a good NOC contact for them? I have one of their downstream customers hijacking some of my IP space and they don't really care as I am not a direct customer of theirs.

2 2

Single carrier multi-circuit asynchronous routing issue
by Aaron Millisor 20 Jan '09

20 Jan '09

I am curious to know if anyone has else has hit a problem like the one I am running into right now. I have two DS3 DIA's in my router, terminating on two separate routers at Sprint. We peer with BGP and I am prepending certain of my prefixes to balance the traffic load. src __________ dst 1.1.1.0 |----|- ds3 #1 -| sprint 1 |--( ) 2.2.2.0 ------- |me | ( internet ) ------- | | ( ) | | __________ ( ) |----|- ds3 #2 -| sprint 2 |--( ) If I were to prepend the network 1.1.1.0 to come in on 'sprint 1', but have a route to 2.2.2.0 via 'sprint 2' so that traffic comes in on one circuit but returns on the other, routing is broken. If I change my route so that packets directed to 2.2.2.0 return on the same circuit that the traffic is received on, everything works fine. Has anyone else run into an issue like this before? -- am

3 3

ADMIN: List FAQ/Monthly Post.
by NANOG Mail List Committee 19 Jan '09

19 Jan '09

This 100-line document contains 62% of what you need to know to avoid annoying 10,000 people in your email to the NANOG list. It also contains pointers to another 23%. Please take 5 minutes to read it before you post [again]. General Information =================== About NANOG: http://www.nanog.org/about/ NANOG News: http://www.nanog.org/ NANOG lists and AUP: http://www.nanog.org/mailinglist/ NANOG List FAQ: http://www.nanog.org/mailinglist/listfaqs/ To Subscribe or Unsubscribe from the list: http://mailman.nanog.org/mailman/listinfo/nanog To contact the list's admins: admins(a)nanog.org Posting Policy ============== The NANOG list has over 10,000 subscribers so it is very easy for a thread to have scores of posts while being off-topic and only of interest to only a small proportion of subscribers. Please consider before each post if your email will be of interest to the majority of members or might alternatively be emailed directly the people of interest or posted to another forum. Please read the FAQ and AUP policy before posting for more details. Especially the following are discouraged: * Is a certain site down? Other Outages not affecting half the Internet. Please use http://downforeveryoneorjustme.com/ or a similar site. Please post to the Outages mailing list: http://wiki.outages.org * Spam Please use SPAM-L - http://www.claws-and-paws.com/spam-l * Contacting People * http://puck.nether.net/netops/ * Please try other methods of contacting sites before you post to NANOG. Saying something like "I tried calling 213-555-3333 but no answer" shows you _have_ tried alternative methods first. * Political Issues * Topics such as ICANN policy, Government Policy or Law changes that do not have short term Operational impact should be avoided. * Operation topics with more specific lists * DNS - http://lists.oarci.net/mailman/listinfo/dns-operations * Email - http://www.mailop.org/ * NANOG Mailing list policy Please use the nanog-futures list or contact admins(a)nanog.org Please also avoid ================= * Sending posts to the list relevant to only one or two people on this list, such as tests or traceroutes in response to another post for comparison to those originally posted. * Jokes, Puns, amusing observations, spelling corrections. Other NANOG related lists ========================= * NANOG-futures - for discussion of the evolution of NANOG, including organizational structure, policies and procedures, and agendas for NANOG meetings. Such topics aren't appropriate for the main NANOG mailing list. http://mailman.nanog.org/mailman/listinfo/nanog-futures * nanog-attendee - For discussion of venue-specific issues relevant to attendees of the current NANOG physical meeting. http://mailman.nanog.org/mailman/listinfo/nanog-attendee * nanog-announce - For announcements of NANOG meetings an other Important NANOG related announcements. Low traffic and all posts are also sent to main list. http://mailman.nanog.org/mailman/listinfo/nanog-announce Other Mailing Lists =================== Information about related lists: http://www.nanog.org/mailinglist/listfaqs/otherlists.php

1 0

spam decrease since friday
by Sebastian Ganschow 19 Jan '09

19 Jan '09

Hi nanog, we're seeing that we're getting about 2/3 fewer spam since friday. Even blacklist hits are declining. Does anyone has an explanation? Regards Sebastian

3 2

Cisco ASA / Comcast SMTP problem workaround
by lorell＠hathcock.org 19 Jan '09

19 Jan '09

I have the problem when working out of my house that Comcast will lock down outbound SMTP on the regular ports. This may be due to the kids' computer getting infected with a virus from time to time. That is its own problem and I want to deal with it on its own. The problem I want to discuss is a workaround to Comcast blocking outbound SMTP. I have noticed at my house when I have problems with regular SMTP traffic on port 25 to my own colo servers, that my Yahoo! premium email goes through fine without problem. I have a premium Yahoo! account and use SMTP on port 465 and POP3 on 995 with SSL configured on both. The thought occurred to me that I could solve my immediate problem as well as let me send/receive email at hotels and wifi hotspots that all block regular SMTP traffic on port 25. And roll out an encrypted new service to my hosted customers. I run my own small hosting company at a colo for a handful of customer domains and several that I own. I have a Cisco ASA 5505 (security plus license) and a pair of mail servers needed for in- and out-bound SMTP. The servers are on private IP addresses behind the ASA which has static statements for the servers inside. Also, I have additional IPs available if needed for this solution. Here is my question: How do I configure my ASA (and Outlook) to: 1. Encrypt traffic between Outlook and the ASA on non-traditional SMTP and POP3 ports without using a VPN? (Using SSL just as Yahoo! does it.) 2. Leave my servers' configuration alone so that they continue to send/receive email in exactly the same way they are doing now? Summarized: How do I duplicate Yahoo! premium email service using PAT on my Cisco ASA without changing any settings on my server? Qualifiers: 1. I don't want to change the email server configurations because it is run by a control panel software and if I take it out of spec, the next update could wipe out my custom config. 2. I don't want to use a VPN client on my laptop because it takes up VPN licenses on the ASA and because a successful solution would be a boon to my customers. I believe the ASA would have to do these things: 1. Accept SSL connections on the outside interface. 2. Accept the inbound SMTP request on an arbitrary, but non-dynamic port and translate it to port 25 and send it on to the server. 3. Accept the response from the server and translate it back into the arbitrary port (from #2 above) on the remote client. 4. Do the same thing as above except for POP3. This configuration would allow customers to also configure their SMTP/POP3 clients to allow them access to email without configuring a VPN client for each one. Stated simply, I want to duplicate what Yahoo! premium email is doing between their servers and their customers like me. Any thoughts? Lorell Hathcock

2 3

Circuit numbering scheme - best practice?
by Jay Hennigan 18 Jan '09

18 Jan '09

We've grown to the point that "The MCI T-1 in Ontario" or "Bob's ethernet to port 6/23 on switch 7" aren't scaling. Also in working with carriers we are frequently asked to provide our internal circuit number. I've seen a lot of the the LEC scheme NN-XXXX-NNNNNN where XXXX has some significance with regard to the speed and type of circuit. The leading NN seems to be a mystery and the trailing NNNNNN is a serial number. I've also seen DS1-NNNNNNN as a straight speed-serial number type of thing and horrendously long circuit numbers including CLLI codes such as 101/T3/SNLOCAGTH07/SNLOCA01K15 . Any suggestions from those who have been down this road as to a schema that makes sense and is scalable? Are there documented best practices? -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

6 5