- NANOG - lists.nanog.org

ISP Security BOF @NANOG 40
by Danny McPherson 14 May '07

14 May '07

Folks, Can you please try to slot the ISP security BOF into the first day (Monday) of the agenda? Something has come up and I have to leave late Monday night. Thanks for your consideration! -danny

1 0

Re: [urgent assistance] 198.32.0.0/16 - Disappeared...
by Fergie 14 May '07

14 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Joe Abley <jabley(a)ca.afilias.info> wrote: >I'm not sure that 198.32.0.0/16 was ever advertised. EP.NET runs a registry for exchange points and other people that Bill feels like helping out and assigns from that number range; since the /16 covers many varied applications and organisations all over the planet, it seems unlikely that a /16 would do anything useful. > >I have no problems reaching FLAG.EP.NET (198.32.4.13), DOT.EP.NET (198.32.2.10), both of which live in subnets numbered from 198.32.0.0/16 and administered by EP.NET directly. > Hi Joe, Yes, I'm aware that 198.32.0.0/16 is really only a bunch of swampy /24 allocations -- mea cupla. In any event, flag.ep.net seems to be reachable now, so things are good again: route-views.isc.routeviews.org> sho ip bgp 198.32.4.13 BGP routing table entry for 198.32.4.0/24 Paths: (9 available, best #9, table Default-IP-Routing-Table) Not advertised to any peer 6079 3356 1239 4555 198.32.176.126 from 198.32.176.126 (207.172.6.3) Origin IGP, metric 1, localpref 100, valid, external Last update: Sun May 13 22:03:59 2007 14361 7385 1239 4555 198.32.176.10 from 198.32.176.10 (66.36.224.11) Origin IGP, localpref 100, valid, external Last update: Sun May 13 22:03:58 2007 174 1239 4555 198.32.176.131 from 198.32.176.131 (154.54.0.8) Origin IGP, metric 2000, localpref 100, valid, external Community: 174:21000 174:22013 Last update: Sun May 13 22:03:57 2007 2497 1239 4555 198.32.176.24 from 198.32.176.24 (216.98.96.13) Origin IGP, localpref 100, valid, external Last update: Sun May 13 22:03:52 2007 4513 3356 1239 4555 198.32.176.48 from 198.32.176.48 (209.10.12.156) Origin IGP, metric 0, localpref 100, valid, external Last update: Sun May 13 22:03:18 2007 1280 174 1239 4555 198.32.176.3 from 198.32.176.3 (149.20.65.193) Origin IGP, localpref 100, valid, external Community: 1280:380 Last update: Sun May 13 22:03:11 2007 3557 1280 174 1239 4555 198.32.176.4 from 198.32.176.4 (192.5.4.246) Origin IGP, localpref 100, valid, external Community: 3557:380 Last update: Sun May 13 22:03:08 2007 2914 1239 4555 198.32.176.14 from 198.32.176.14 (129.250.0.2) Origin IGP, metric 5, localpref 100, valid, external Community: 2914:420 2914:2000 2914:3000 65504:1239 Last update: Sun May 13 22:03:23 2007 7575 1239 4555 198.32.176.177 from 198.32.176.177 (202.158.192.19) Origin IGP, localpref 100, valid, external, best Community: 7575:1003 7575:2019 7575:6003 Last update: Sun May 13 22:03:11 2007 route-views.isc.routeviews.org> Thanks, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGR9M4q1pz9mNUZTMRApQ1AJ0QQwy8+VG4oG5e/sGGNnyKTEFNtwCaAlqb fFEqU5qhPuxmeVOV/qgpwCc= =GdQd -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: [urgent assistance] 198.32.0.0/16 - Disappeared...
by Fergie 14 May '07

14 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just as a follow-up to this: The situation still exists: 198.32.0.0/16 is still missing in action in the routing system, and more importantly, so are EP.net's DNS servers. :-( So, if Bill magically re-appears, or if anyone else can provide any insight or assistance, please contact ops-staff(a)mail-abuse.org. Thanks, - - ferg - -- "Fergie" <fergdawg(a)netzero.net> wrote: Paging Bill Manning... Unfortunately, we've tried to reach Bill, as well as other folks at EP.NET to no avail, and this is impacting us quite negatively. [snip] Not available in any routing tables I have access to or any of the looking glasses from http://www.nanog.org/lookingglass.html. this is significant because any in-addr blocks that are authoritative @ flag.ep.net and dot.ep.net will now suffer from reverse name resolution issues. - - From ATT route server: route-server>sh ip bgp 198.32.4.13 % Network not in table - - From CerfNET route server: route-server>sh ip bgp 198.32.4.13 % Network not in table Allstream Toronto: route-server.east>sh ip bgp 198.32.4.13 % Network not in table This has been a problem since yesterday evening. [snip] FYI, some of our address space has been sub-allocated via EP.net and relies on it's reachability: [DOMAIN whois information for EP.NET ] Domain Name: EP.NET Namespace: ICANN Unsponsored Generic TLD - http://www.icann.org TLD Info: See IANA Whois - http://www.iana.org/root-whois/net.htm Registry: VeriSign, Inc. - http://www.verisign-grs.com Registrar: NETWORK SOLUTIONS, LLC. - http://www.networksolutions.com Whois Server: whois.networksolutions.com Name Server[whois+dns with ip] DOT.EP.NET 198.32.2.10 Name Server[from whois+dns, whois ip]: DOT.EP.NET 2001:478:6:0:230:48FF:FE22:6A29 Name Server[whois+dns with ip] FLAG.EP.NET 198.32.4.13 Updated Date: 11-Jan-2007 Creation Date: 09-Dec-1994 Expiration Date: 08-Dec-2012 Status: clientTransferProhibited [whois.networksolutions.com] Please contact me off-list is you have any inisght into this. Thanks, - - ferg [snip] -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGRV/jq1pz9mNUZTMRAjw/AJ0eV+YKWd1L1ze/eTStl+JaJC8s5QCfZhh0 Rf/sutXg5Mj9jK0IZA571do= =8UzZ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Best practices for abuse@ mailbox and network abuse complaint handling?
by K K 13 May '07

13 May '07

Can anybody point me at best practices for monitoring and responding to abuse complaints, and good solutions for accepting complaints about network abuse? Any recommended outsourced services for processing abuse complaints? My interest in this is to more effectively respond to complaints about "bad" network traffic and abuse originating from IP addresses allocated to my employer and to the not-for-profit ISP I help run. (Two similar needs, two very different budgets). My employer has multiple Internet-connected networks, several IP allocations, and several hundred active domains. Currently abuse@* is sporadically monitored by a Messaging team, and any complaints which seem relevant to the Network or Security groups are forwarded to the appropriate internal contact. This is inefficient and untimely. Probably 98% of the mailbox is from are spammers who've harvested or randomly targeted abuse@ addresses for male enhancement, maybe 1.99% are email abuse complaints from customers who subscribed to company-run mailing lists and then forgot about it (I've worked hard to educate management on responsible mass mailing). But every once in a while there is a legitimate network-related "incident", and my team does need to see those messages in a timely manner. How do other network operators address the need for timely notification of network abuse? Some people are clueful enough to pull up the ARIN records and contact us by phone, but I don't want to depend on the victim of an attack sourced from our network being bright and persistent. Thanks, Kevin Kadow

11 16

No Verizon ethernet @ 505 Marquette in ABQ?
by Neal Rauhauser 13 May '07

13 May '07

There is really no ethernet connectivity to Verizon (UUNet) in the 505 Marquette building in ABQ? That seems very, very strange to me this late in the game ... can anyone confirm/deny this for me?

1 0

Re: ISP CALEA compliance
by Martin Hannigan 13 May '07

13 May '07

Steve Bellovin said: >I've tried hard to keep this discussion factual, with copious >references. But I think I've run out of things to say that are even >vaguely on-topic, so I'll shut up. Anytime the word CALEA is pops up here the threads tend to quickly degenerate into a large demonstration of a serious lack of knowledge. This is also not an area that is typically managed by operational people at the engineer level, it's a function run from regulatory and legal side of the business. Too bad the PC hasn't solicited a talk in this area. They ought to. There are at least two companies participating in NANOG that provide CALEA service bureaus, past employees of either with direct, relevant experience, and current employees of both that read the list. VeriSign: http://vcs-www.verisign.com/docs/netDiscovery/ NeuStar: http://www.neustar.biz/infrastructure/fcs.cfm (Formerly FiduciaNet) Best, -M<

2 1

Quest route server
by Todd White 13 May '07

13 May '07

Does anyone know if Quest has a looking glass web site or router server to see the view from their network? thanks -Todd

2 1

Re: How many others are nullrouting BT?
by Jo Rhett 12 May '07

12 May '07

Neil Harris wrote: > Jo Rhett wrote: >> >> Matthew Smith wrote: >>> What address did BT give you? >> >> 221b Baker Street, London > > 221b Baker Street is the home address of the fictional detective > Sherlock Holmes. Right, which is why I said what I did. Okay, not a fictional address but a fictional character and absolutely not useful. -- Jo Rhett senior geek Silicon Valley Colocation

1 0

Re: How many others are nullrouting BT?
by Jo Rhett 12 May '07

12 May '07

On May 11, 2007, at 1:50 PM, Niels Bakker wrote: > Maybe, just maybe, they are under (British) police orders to keep > those scammers connected to gather more evidence. > > Happened in the Netherlands with an apartment full of Nigerian > scammers connected to UPC. They have refused all of the evidence we have offered to date. They refer us to the UK law enforcement. We ask for contact information for their local office, and they responded with the (fictional) address of Scotland Yard from the popular tv show. That's sarcasm, not helpfulness. It's reckless, inconsiderate behavior. -- Jo Rhett senior geek Silicon Valley Colocation Support Phone: 408-400-0550

2 2

HSRP availability in datacenters?
by Randal Kohutek 11 May '07

11 May '07

My cohorts in suits have begun wondering if HSRP is standard for customer gateways, and from there wondering if it is something we should charge for. I did some research and came up with mixed results; I'd like to hear nanogers experiences with this: In your experience, do datacenters provide free HSRP gateways, or do they make you pay for it? Real world examples are better than Google :) Thanks, Randal

7 13