- NANOG - lists.nanog.org

Re: Blackholing traffic by ASN
by Paul Ferguson 30 Jan '08

30 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Justin Shore <justin(a)justinshore.com> wrote: >The ASN I'm referring to is that of the Russian Business Network. A Google search should turn up plenty of info for those that haven't heard of them. > Not possible anymore, sorry -- they have now diversified into many different origin ASs. Up until late last year, they primarily operated out of AS40989, but no more: http://www.cidr-report.org/cgi-bin/as-report?as=AS40898 Too much negative publicity forced them to fly lower under the radar. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHoQtlq1pz9mNUZTMRAreXAJ0aLASYfEpRmp2MDI3u8/nnT6oFbQCfYU0Q +Idq5R574HBUPFSXsqNewg0= =GKem -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

circuits to NASDAQ and NYSE
by Philip Lavine 30 Jan '08

30 Jan '08

Is there any problem with network connectivity to Nasdaq or NYSE. Specifically on Yipes. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Sicily to Egypt undersea cable disruption
by Sean Donelan 30 Jan '08

30 Jan '08

If its not one cable, its another cable. http://www.guardian.co.uk/technology/2008/jan/30/asia.internet.outage Huge swathes of the Middle East and Asia have been left without internet access after a vital undersea cable was damaged. A fault in the pipeline, which runs between Sicily and Egypt, has dramatically reduced access in countries including Saudi Arabia, Dubai and India, leaving millions of workers struggling to get online.

1 0

Anyone (else)still have a Extreme Black Diamond deployed?
by Drew Weaver 30 Jan '08

30 Jan '08

This is slightly technical (not really, but slightly)... I am looking for folks willing to help me determine whether or not newer versions of the firmware have "slightly closer to functional" SNMP support please contact me off-list if you are interested. I've tried asking extreme directly, but they're honestly not sure. I'm mainly interested in whether or not you can pass a value to OID: RFC1213-MIB::atIfIndex when issuing a snmpwalk as you are able to when polling a Cisco, Foundry switch (at least the ones I have) For example: snmpwalk -v1 -c com host OID: RFC1213-MIB::atIfIndex.20399 (should return all IP addresses which are attached to Vlan 20399 ;-) TIA as always, -Drew

2 1

Worst Offenders/Active Attackers blacklists
by Tomas L. Byrnes 29 Jan '08

29 Jan '08

There are a number of public network attacker threat feeds available, the most well know of which, AFAIK, is the Internet Storm Center's DShield system. I know a few network operators, including at least one on this list, also run private versions of the DShield system. Are there many others? Do any or most network operators have some sort of private current block list that gets pushed out to routers and or firewalls/traffic shapers in real time? I'm the CTO and founder of ThreatSTOP (www.threatstop.com) and we're currently propagating the DShield, and some other, block lists for use in firewalls. I'm interested in gathering additional threat information, and serving additional communities. Is there any interest in a collaborative platform where anonymized candidates for blocking would be submitted by a trusted group, and then propagated out to the whole group? I'd be happy to collect responses anonymously and submit a summary back to the list, if people don't want to open this up on the list.

10 15

Re: IPv6 questions
by snort bsd 29 Jan '08

29 Jan '08

It does make sense though. Say one megabits interface with 20 VLANs. In that scenario, every VLAN, usually has own link-local address. It is more practical than "multiple interfaces with same link-local address." I found this on Juniper router and now assume it is Juniper specific implementation. Thanks all ----- Original Message ---- From: Scott Morris <swm(a)emanon.com> To: Erik Nordmark <erik.nordmark(a)sun.com>; snort bsd <snortbsd(a)yahoo.com.au> Cc: nanog(a)merit.edu; juniper-nsp <juniper-nsp(a)puck.nether.net> Sent: Tuesday, 29 January, 2008 12:36:55 PM Subject: RE: IPv6 questions And unless you are on only certain particular devices (e.g. L3 switches) then the end device won't necessarily have any relevant clue what VLAN it's on. I have never seen/heard of an RFC for it either and would certainly wonder "WHY?". :) Scott -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Erik Nordmark Sent: Tuesday, January 29, 2008 1:44 PM To: snort bsd Cc: nanog(a)merit.edu; juniper-nsp Subject: Re: IPv6 questions snort bsd wrote: > Never mind > > it is the VLAN number. But which RFC define this? I've never seen an IPv6 RFC specify to put the VLAN number in the link-local address. Thus this must be an (odd) choice made by some implementation. Perhaps the implementation somehow requires that all the link-local addresses for all its (sub)interfaces be unique, even though the RFCs assume that the implementation should be able to deal with multiple interfaces with same same link-local address. Erik > Thanks all > > Dave > > ----- Original Message ---- > From: snort bsd <snortbsd(a)yahoo.com.au> > To: nanog(a)merit.edu; juniper-nsp <juniper-nsp(a)puck.nether.net> > Sent: Monday, 28 January, 2008 3:05:59 PM > Subject: IPv6 questions > > > Hi All: > > With link-local IPv6 address, the converting from MAC-48 to EDU-64 > address format (FF FE stuffing). How does the VLAN tags affect the > conversion? > > With the rule of FF FE stuffing, I can see clearly work on the ptp > interfaces. But on those Ethernet based VLANs, it doesn't seem to > follow that pattern: > > Current address: 00:90:69:4a:b9:5d, Hardware address: > 00:90:69:4a:b9:5d > > well, i assume the link-local should be fe80::290:69ff:fe4a:b95d/64. > actually, it shows: > > Destination: fe80::/64, Local: fe80::290:6903:94a:b95d > > how does the router get this 03 09 instead of ff fe? > > Thanks all > > > > > > > > > Make the switch to the world's best email. Get the new Yahoo!7 > Mail now. www.yahoo7.com.au/worldsbestemail > > > > > > > > Make the switch to the world's best email. Get the new Yahoo!7 > Mail now. www.yahoo7.com.au/worldsbestemail > > Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail

1 0

Re: IPv6 questions
by snort bsd 29 Jan '08

29 Jan '08

Never mind it is the VLAN number. But which RFC define this? Thanks all Dave ----- Original Message ---- From: snort bsd <snortbsd(a)yahoo.com.au> To: nanog(a)merit.edu; juniper-nsp <juniper-nsp(a)puck.nether.net> Sent: Monday, 28 January, 2008 3:05:59 PM Subject: IPv6 questions Hi All: With link-local IPv6 address, the converting from MAC-48 to EDU-64 address format (FF FE stuffing). How does the VLAN tags affect the conversion? With the rule of FF FE stuffing, I can see clearly work on the ptp interfaces. But on those Ethernet based VLANs, it doesn't seem to follow that pattern: Current address: 00:90:69:4a:b9:5d, Hardware address: 00:90:69:4a:b9:5d well, i assume the link-local should be fe80::290:69ff:fe4a:b95d/64. actually, it shows: Destination: fe80::/64, Local: fe80::290:6903:94a:b95d how does the router get this 03 09 instead of ff fe? Thanks all Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail

3 2

Quality Technologies?
by Mike Lyon 29 Jan '08

29 Jan '08

Anyone ever heard of these peeps? http://www.qualitytech.com/ Feedback on any of their services? -Mike

2 1

IPv6 questions
by snort bsd 28 Jan '08

28 Jan '08

Hi All: With link-local IPv6 address, the converting from MAC-48 to EDU-64 address format (FF FE stuffing). How does the VLAN tags affect the conversion? With the rule of FF FE stuffing, I can see clearly work on the ptp interfaces. But on those Ethernet based VLANs, it doesn't seem to follow that pattern: Current address: 00:90:69:4a:b9:5d, Hardware address: 00:90:69:4a:b9:5d well, i assume the link-local should be fe80::290:69ff:fe4a:b95d/64. actually, it shows: Destination: fe80::/64, Local: fe80::290:6903:94a:b95d how does the router get this 03 09 instead of ff fe? Thanks all Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail

1 0

NANOG 42, Feb. 17-20, San Jose
by Carol Wadsworth 28 Jan '08

28 Jan '08

Reminder - if you are planning to attend NANOG 42 in San Jose, Feb. 17-20, and need overnight accommodations, the special group room rate at the Fairmont expires later today. For all meeting details, please see www.nanog.org.

1 0