- NANOG - lists.nanog.org

WISP Lists - Networking in Honduras
by Israel Lopez 18 Jan '09

18 Jan '09

Hello NANOG & LACNOG, Can point me towards an active WISP mailing list? I have a few questions about conducting site surveys for wireless infrastructure in Honduras. I'm mostly concerned about; the use of 802.11A/B/G & 900MHz equipment, RF interference, radio placement and Local Regulations,. I can take my answers off list. Thank You Kindly, Israel Lopez (EWB-OC Olancho Aid Technical Lead <http://ewb-oc.org/olancho/>)

1 0

"Smart" hands around Dulles airport / northern VA.
by Warren Kumari 17 Jan '09

17 Jan '09

Hi all, This is a mail that I have been meaning to send ever since I moved back to the NoVA area, but have only gotten around to now... Many years ago I used to provide emergency, smart hands type assistance to those in need, but had to give this up when I moved out of the area. Anyway, I'm back and am willing to start doing this again.... This is primarily for those cases where you would normally have to fly someone out to have them replace a line-card or two, hook up a few cables, maybe swap a disk in an array, etc. This is not for those cases where you simple need someone to push the reset button, nor for rebuilding your entire cage from scratch... Anyway, if you have gear here and think that you might need to take me up on this, drop me a mail and I'll give you my direct contact info... If you like this idea, and are willing to also provide this sort of thing to the community (either in this, or in another area), please let me know -- I'll look into setting up a website / mailing list / something... Important disclaimers and limitations: 1: I do not want (nor may I accept) any compensation for this, other than good-will and a hope that you might help out someone else in need (AKA, I miss the days when this industry was more co-operative). 2: $day_job comes first. 3: If you are a competitor of $day_job you are probably out of luck. 4: If you wants me to plug in a new device, its your responsibility to make sure that you have sufficient power. 5: If you are a shady spammer, don't bother... FAQ: Q: What! Are you crazy? I'd never let a stranger into my cage! A: Huh, neither would I, but some people are less paranoid than us and / or know and trust me. Q: Why are you doing this again? What's in it for you? A: Back in the day, this industry used to be much more friendly and people would often go out of their way to help others. I fully understand why this has changed over time, but, well, it sucks.. I'd like to try and bring back some of the community feeling. Q: How did you end up so handsome!? A: First off, thank you. It was mainly luck.... Q: I am a small company looking to build a network for my 200 sales people (or something similar). Can I hire you as a consultant? A: Sorry, no. I have a day job that keeps me busy and entertained. I am not a consultant, nor do I have any wish to be one (and can think of few things worse). Oh, and I'm assuming that you meant that you own and / or work at a small company and not that you *are* a small company, because that would be weird. W -- Never criticize a man till you've walked a mile in his shoes. Then if he didn't like what you've said, he's a mile away and barefoot.

6 6

Jay Shao is out of the office.
by Jay Shao 17 Jan '09

17 Jan '09

I will be out of the office starting 01/17/2009 and will not return until 02/09/2009. I will respond to your message when I return. Please contact with NETTCP(a)DTCC.COM for any production issues ----------------------------------------- ________________________________________________________ DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

1 0

What might have been a lightning talk on anycast had I gotten to a meeting
by Howard C. Berkowitz 17 Jan '09

17 Jan '09

Economies and underemployment being what they are, I won't be getting to the in-person meeting, but it occurred to me that a brief tutorial on some of the operational applications of anycast might be a lightning tutorial. I wrote such a short article at http://en.citizendium.org/wiki/Anycasting. Citizendium, as some of you may know, is a open-content wiki that operates on a real-names model with hopefully helpful expert review. I'm starting to take some of my past NANOG presentations and turn them into articles or sets of related articles, obviously updating them. Since NANOG doesn't have a publication mechanism for its presentations, or even summaries of long mailing list threads written for someone who had not been following them, it might be useful as a means of education. I'd welcome anyone who would like to participate; it's still an early project. Given, for example, the various trade press pieces on BGP security and vulnerability expert, I may try, unless someone already has a tutorial they might like to be adapted, they'd like to write, or co-write, to do something at a little more detailed level than Network World, but lighter than an RFC. I have assorted BGP articles there, still at an introductory level, and was starting something on routing policy.

1 0

Level 3 Philly "Major outage"?
by up＠3.am 17 Jan '09

17 Jan '09

I have a cabinet at Broadwing's (now Level 3) Norristown data center, for over 2 years now. It has always seemed something of a backwater in terms of Broadwing's network, and even more so with Level 3. An outage started yesterday morning, reportedly caused by a broadcast storm on their Philly Big Iron switch that connects to Norristown (this happened before last August). In a couple of hours, they had it fixed, only for it to go into up-and-down mode a couple of hours later, for the rest of the day. I escalated the ticket at around 6:20pm, but saw no lasting improvment. This morning, I started getting customer calls that it was down again. I called Level 3 once more, after seeing the same "Analysis in Progress" message on their portal from the previous evening. The rep described that a "major outage" was happening in Philly, even though there's nothing on their "Network Outages" list about it. I would think that if this was a "Major Outage" in Philadelphia for Level 3, there would be some NANOG chatter on it, which I don't see. It's back up for now, but does anybody have any knowledge of this? As an aside, would it be ok for me to solicit colocation services in the Philadelphia area on this list? A change has to be made at some point. Thanks, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

1 0

BGPSEC & soBGP
by Naveen Nathan 17 Jan '09

17 Jan '09

I came across this article on /.: http://www.networkworld.com/news/2009/011509-bgp.html?page=1 I'm not too familiar with security of routing protocols, but it became immediately evident as I read this article that much of the work has been accomplished with soBGP. I'm wondering why there is a new initiative for another technology to secure BGP. -- Naveen Nathan

2 1

Re: Circuit numbering scheme - best practice?
by Scott Weeks 17 Jan '09

17 Jan '09

----- jay(a)west.net wrote: ------ <snip> thing and horrendously long circuit numbers including CLLI codes such as 101/T3/SNLOCAGTH07/SNLOCA01K15. ------------------------------- That is what's used by the transport section (I'm in the IP section) in the company where I work. Even though the description is long, I use the entire CID from the carrier along with something that makes sense to me and the NOC folk that'll be troubleshooting before I get to it. Long in information many times means more work done by the first level folks. Here's a couple of examples: "LAG 29 LINK 1 for CKT ID: 101/GE1/HNLLHIMN37W/HNLLHIMN53W" "101/GE1/HNLLHIMN37W/HNLLHIMN44W to Cisco 3750 7th floor data center" "OC-12 POS line to AT&T: CIDs-> HT: 82.ODGS.xxxxxx.HAWT AT&T: IVEC.xxxxxx..ATI" Long? Yes. Helpful to the first level NOC folks? Yes. scott

1 0

multicast meltdown?
by Antonio Querubin 16 Jan '09

16 Jan '09

We've detected a large drop in the IPv4 multicast prefix count over the past few days. Anybody know what's going on? Antonio Querubin whois: AQ7-ARIN

2 1

Weekly Routing Table Report
by Routing Analysis Role Account 16 Jan '09

16 Jan '09

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 17 Jan, 2009 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 277721 Prefixes after maximum aggregation: 132482 Deaggregation factor: 2.10 Unique aggregates announced to Internet: 135762 Total ASes present in the Internet Routing Table: 30352 Prefixes per ASN: 9.15 Origin-only ASes present in the Internet Routing Table: 26399 Origin ASes announcing only one prefix: 12865 Transit ASes present in the Internet Routing Table: 3953 Transit-only ASes present in the Internet Routing Table: 98 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 23 Max AS path prepend of ASN (46211) 20 Prefixes from unregistered ASNs in the Routing Table: 523 Unregistered ASNs in the Routing Table: 184 Number of 32-bit ASNs allocated by the RIRs: 73 Prefixes from 32-bit ASNs in the Routing Table: 12 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 283 Number of addresses announced to Internet: 1984280064 Equivalent to 118 /8s, 69 /16s and 182 /24s Percentage of available address space announced: 53.5 Percentage of allocated address space announced: 63.3 Percentage of available address space allocated: 84.6 Percentage of address space in use by end-sites: 75.2 Total number of prefixes smaller than registry allocations: 136430 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 64135 Total APNIC prefixes after maximum aggregation: 23147 APNIC Deaggregation factor: 2.77 Prefixes being announced from the APNIC address blocks: 60996 Unique aggregates announced from the APNIC address blocks: 27679 APNIC Region origin ASes present in the Internet Routing Table: 3506 APNIC Prefixes per ASN: 17.40 APNIC Region origin ASes announcing only one prefix: 956 APNIC Region transit ASes present in the Internet Routing Table: 537 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 19 Number of APNIC addresses announced to Internet: 395113632 Equivalent to 23 /8s, 140 /16s and 244 /24s Percentage of available APNIC address space announced: 78.5 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 123561 Total ARIN prefixes after maximum aggregation: 64986 ARIN Deaggregation factor: 1.90 Prefixes being announced from the ARIN address blocks: 92979 Unique aggregates announced from the ARIN address blocks: 35380 ARIN Region origin ASes present in the Internet Routing Table: 12731 ARIN Prefixes per ASN: 7.30 ARIN Region origin ASes announcing only one prefix: 4911 ARIN Region transit ASes present in the Internet Routing Table: 1224 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 23 Number of ARIN addresses announced to Internet: 406799520 Equivalent to 24 /8s, 63 /16s and 68 /24s Percentage of available ARIN address space announced: 78.2 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 62265 Total RIPE prefixes after maximum aggregation: 36910 RIPE Deaggregation factor: 1.69 Prefixes being announced from the RIPE address blocks: 57284 Unique aggregates announced from the RIPE address blocks: 38268 RIPE Region origin ASes present in the Internet Routing Table: 12514 RIPE Prefixes per ASN: 4.58 RIPE Region origin ASes announcing only one prefix: 6573 RIPE Region transit ASes present in the Internet Routing Table: 1913 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 23 Number of RIPE addresses announced to Internet: 386225504 Equivalent to 23 /8s, 5 /16s and 85 /24s Percentage of available RIPE address space announced: 88.5 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-49151 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 22923 Total LACNIC prefixes after maximum aggregation: 5659 LACNIC Deaggregation factor: 4.05 Prefixes being announced from the LACNIC address blocks: 21089 Unique aggregates announced from the LACNIC address blocks: 11650 LACNIC Region origin ASes present in the Internet Routing Table: 1051 LACNIC Prefixes per ASN: 20.07 LACNIC Region origin ASes announcing only one prefix: 337 LACNIC Region transit ASes present in the Internet Routing Table: 174 Average LACNIC Region AS path length visible: 4.0 Max LACNIC Region AS path length visible: 17 Number of LACNIC addresses announced to Internet: 59821824 Equivalent to 3 /8s, 144 /16s and 207 /24s Percentage of available LACNIC address space announced: 59.4 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 4336 Total AfriNIC prefixes after maximum aggregation: 1365 AfriNIC Deaggregation factor: 3.18 Prefixes being announced from the AfriNIC address blocks: 5161 Unique aggregates announced from the AfriNIC address blocks: 2190 AfriNIC Region origin ASes present in the Internet Routing Table: 277 AfriNIC Prefixes per ASN: 18.63 AfriNIC Region origin ASes announcing only one prefix: 88 AfriNIC Region transit ASes present in the Internet Routing Table: 59 Average AfriNIC Region AS path length visible: 3.9 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 13030656 Equivalent to 0 /8s, 198 /16s and 213 /24s Percentage of available AfriNIC address space announced: 25.9 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 1664 6411 376 Korea Telecom (KIX) 17488 1488 105 96 Hathway IP Over Cable Interne 4755 1184 435 166 TATA Communications formerly 9583 1111 87 524 Sify Limited 4134 901 16059 364 CHINANET-BACKBONE 18101 779 174 27 Reliance Infocom Ltd Internet 4780 719 358 65 Digital United Inc. 9498 678 297 52 BHARTI BT INTERNET LTD. 7545 669 152 81 TPG Internet Pty Ltd 24560 660 224 181 Bharti Airtel Ltd. Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4380 3435 344 bellsouth.net, inc. 209 2835 4031 615 Qwest 20115 2030 1464 746 Charter Communications 1785 1720 734 156 PaeTec Communications, Inc. 4323 1611 1081 380 Time Warner Telecom 2386 1584 714 897 AT&T Data Communications Serv 7018 1425 5869 984 AT&T WorldNet Services 11492 1220 192 12 Cable One 6478 1185 293 488 AT&T Worldnet Services 3356 1115 10997 441 Level 3 Communications, LLC Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8452 864 188 7 TEDATA 3292 440 1765 386 TDC Tele Danmark 12479 390 578 6 Uni2 Autonomous System 30890 387 85 199 SC Kappa Invexim SRL 3301 336 1669 302 TeliaNet Sweden 3320 333 7065 282 Deutsche Telekom AG 8866 332 109 22 Bulgarian Telecommunication C 3215 330 2897 99 France Telecom Transpac 29049 325 26 3 AzerSat LLC. 35805 312 30 8 United Telecom of Georgia Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1480 2833 231 UniNet S.A. de C.V. 10620 697 151 74 TVCABLE BOGOTA 11830 672 299 9 Instituto Costarricense de El 22047 565 302 14 VTR PUNTO NET S.A. 7303 508 253 78 Telecom Argentina Stet-France 6471 434 94 42 ENTEL CHILE S.A. 16814 426 27 10 NSS, S.A. 11172 406 118 72 Servicios Alestra S.A de C.V 28573 369 493 20 NET Servicos de Comunicao S.A 7738 360 730 27 Telecomunicacoes da Bahia S.A Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 593 72 40 LINKdotNET AS number 3741 269 857 227 The Internet Solution 20858 269 34 3 This AS will be used to conne 2018 240 215 141 Tertiary Education Network 33783 150 10 8 EEPAD TISP TELECOM & INTERNET 6713 144 135 11 Itissalat Al-MAGHRIB 29571 128 15 8 Ci Telecom Autonomous system 5536 120 8 17 Internet Egypt Network 33776 118 6 3 Starcomms Nigeria Limited 5713 117 555 66 Telkom SA Ltd Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4380 3435 344 bellsouth.net, inc. 209 2835 4031 615 Qwest 20115 2030 1464 746 Charter Communications 1785 1720 734 156 PaeTec Communications, Inc. 4766 1664 6411 376 Korea Telecom (KIX) 4323 1611 1081 380 Time Warner Telecom 2386 1584 714 897 AT&T Data Communications Serv 17488 1488 105 96 Hathway IP Over Cable Interne 8151 1480 2833 231 UniNet S.A. de C.V. 7018 1425 5869 984 AT&T WorldNet Services Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 209 2835 2220 Qwest 1785 1720 1564 PaeTec Communications, Inc. 17488 1488 1392 Hathway IP Over Cable Interne 4766 1664 1288 Korea Telecom (KIX) 20115 2030 1284 Charter Communications 8151 1480 1249 UniNet S.A. de C.V. 4323 1611 1231 Time Warner Telecom 11492 1220 1208 Cable One 18566 1060 1050 Covad Communications 4755 1184 1018 TATA Communications formerly Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic 32326 UNALLOCATED 12.40.49.0/24 7018 AT&T WorldNet Servic 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.75.116.0/22 10796 ServiceCo LLC - Road Runner 24.75.160.0/19 7843 Adelphia Corp. 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 41.208.128.0/18 8346 SONATEL-AS Autonomous System 41.214.0.0/17 8346 SONATEL-AS Autonomous System 41.223.108.0/22 17175 New Skies Satellites 41.223.112.0/22 5713 Telkom SA Ltd 41.223.132.0/24 12491 IPPlanet 41.223.133.0/24 12491 IPPlanet Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:9 /10:20 /11:54 /12:159 /13:311 /14:561 /15:1108 /16:10298 /17:4523 /18:7805 /19:16749 /20:19686 /21:19269 /22:24472 /23:24862 /24:145716 /25:657 /26:817 /27:512 /28:98 /29:8 /30:1 /31:0 /32:7 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2859 4380 bellsouth.net, inc. 209 1578 2835 Qwest 4766 1397 1664 Korea Telecom (KIX) 17488 1273 1488 Hathway IP Over Cable Interne 2386 1263 1584 AT&T Data Communications Serv 11492 1185 1220 Cable One 1785 1169 1720 PaeTec Communications, Inc. 20115 1104 2030 Charter Communications 18566 1041 1060 Covad Communications 9583 968 1111 Sify Limited Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:12 8:174 12:2195 13:2 15:21 16:3 17:5 20:36 24:1136 32:52 38:535 40:96 41:1468 43:1 44:2 47:9 52:3 55:3 56:3 57:26 58:516 59:609 60:454 61:1112 62:1115 63:1984 64:3405 65:2429 66:3656 67:1439 68:669 69:2443 70:532 71:198 72:1602 73:7 74:1357 75:198 76:307 77:791 78:532 79:307 80:959 81:845 82:580 83:389 84:598 85:1053 86:397 87:642 88:356 89:1374 90:44 91:1863 92:327 93:1071 94:921 95:187 96:97 97:166 98:179 99:10 110:1 111:1 112:9 113:59 114:156 115:203 116:1120 117:467 118:251 119:605 120:130 121:708 122:924 123:492 124:834 125:1274 128:357 129:226 130:134 131:411 132:70 133:9 134:326 135:35 136:219 137:136 138:145 139:92 140:414 141:109 142:384 143:312 144:325 145:38 146:372 147:143 148:609 149:224 150:134 151:209 152:149 153:132 154:10 155:255 156:168 157:269 158:161 159:279 160:277 161:139 162:261 163:143 164:516 165:505 166:361 167:351 168:674 169:162 170:465 171:37 172:10 173:161 174:28 186:1 187:24 189:359 190:2509 192:5822 193:4189 194:3317 195:2679 196:1062 198:3682 199:3310 200:5473 201:1488 202:7824 203:8095 204:3921 205:2168 206:2331 207:2764 208:3817 209:3490 210:2746 211:1169 212:1556 213:1647 214:67 215:29 216:4535 217:1200 218:374 219:403 220:1226 221:463 222:294 End of report

1 0

smtp.comcast.net self-signed certs
by Jeff Mitchell 16 Jan '09

16 Jan '09

I've been seeing some odd behavior today with some of the servers that respond to smtp.comcast.net on port 587. Some, but not all, of the servers are presenting self-signed certs, causing my own server to balk at making a connection. (The Organization is RTFM, Inc. -- it'd be funny if mail wasn't queueing up on my end). Sometimes I get a server with a legit cert, so I can slowly drain my queue by flushing it over and over and over... openssl s_client output below. I can send a libpcap trace on request. --Jeff ┌─(root@bookcase)(04:48:06) └─(~)-> openssl s_client -CApath /etc/ssl/certs/ -starttls smtp -connect smtp.comcast.net:587 CONNECTED(00000003) depth=1 /C=US/O=RTFM, Inc./OU=Widgets Division/CN=Test CA20010517 verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/C=US/O=RTFM, Inc./OU=Widgets Division/CN=localhost i:/C=US/O=RTFM, Inc./OU=Widgets Division/CN=Test CA20010517 1 s:/C=US/O=RTFM, Inc./OU=Widgets Division/CN=Test CA20010517 i:/C=US/O=RTFM, Inc./OU=Widgets Division/CN=Test CA20010517 --- Server certificate -----BEGIN CERTIFICATE----- MIICGDCCAYECAgEBMA0GCSqGSIb3DQEBBAUAMFcxCzAJBgNVBAYTAlVTMRMwEQYD VQQKEwpSVEZNLCBJbmMuMRkwFwYDVQQLExBXaWRnZXRzIERpdmlzaW9uMRgwFgYD VQQDEw9UZXN0IENBMjAwMTA1MTcwHhcNMDEwNTE3MTYxMDU5WhcNMDQwMzA2MTYx MDU5WjBRMQswCQYDVQQGEwJVUzETMBEGA1UEChMKUlRGTSwgSW5jLjEZMBcGA1UE CxMQV2lkZ2V0cyBEaXZpc2lvbjESMBAGA1UEAxMJbG9jYWxob3N0MIGfMA0GCSqG SIb3DQEBAQUAA4GNADCBiQKBgQCiWhMjNOPlPLNW4DJFBiL2fFEIkHuRor0pKw25 J0ZYHW93lHQ4yxA6afQr99ayRjMY0D26pH41f0qjDgO4OXskBsaYOFzapSZtQMbT 97OCZ7aHtK8z0ZGNW/cslu+1oOLomgRxJomIFgW1RyUUkQP1n0hemtUdCLOLlO7Q CPqZLQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAIumUwl1OoWuyN2xfoBHYAs+lRLY KmFLoI5+iMcGxWIsksmA+b0FLRAN43wmhPnums8eXgYbDCrKLv2xWcvKDP3mps7m AMivwtu/eFpYz6J8Mo1fsV4Ys08A/uPXkT23jyKo2hMu8mywkqXCXYF2e+7pEeBr dsbmkWK5NgoMl8eM -----END CERTIFICATE----- subject=/C=US/O=RTFM, Inc./OU=Widgets Division/CN=localhost issuer=/C=US/O=RTFM, Inc./OU=Widgets Division/CN=Test CA20010517 --- No client certificate CA names sent --- SSL handshake has read 1965 bytes and written 375 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA Session-ID: 8B976D67A76BBFEF5E46CA9D079C1C1208D037B8F5825049C45B57C05786A891 Session-ID-ctx: Master-Key: 4DC43D803056BF32082F3E35B2818539E33B7321455AD625D3AD124BAD719C12C5903C9F1889EAB7A5F313B9A54D74A6 Key-Arg : None Start Time: 1232081287 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain) --- 250 OK

6 9