- NANOG - lists.nanog.org

So -- what did happen to Panix?
by Steven M. Bellovin 08 Feb '06

08 Feb '06

It's now been 2.5 business days since Panix was taken out. Do we know what the root cause was? It's hard to engineer a solution until we know what the problem was. --Steven M. Bellovin, http://www.cs.columbia.edu/~smb

27 61

Denial of service Attack.
by Ejay Hire 08 Feb '06

08 Feb '06

Hello. For the last couple of days we have intermittently been experiencing a (>1gbps) denial of service attack. I want to apologize to anyone whose DNS servers have been (ab)used in the attack, and let you know what is occurring. The attacker is forging our source address on dns requests, and the DNS reply is routing to us. I promise, we're not attacking your dns servers. Please take a moment to consider implementing RPF checks to prevent these type of forged packet attacks. Advice is welcomed both on-list and off. Thanks, Ejay Hire ISDN-Net Network Engineer

1 0

ml hacks for goodmail
by Randy Bush 08 Feb '06

08 Feb '06

so, anyone working on the majordomo and mailman hacks for goodmail? "i am sorry, but you can not subscribe to this list from an aol.com address. don't ask us to explain, ask support(a)aol.com." or am i missing something here? clue-bat if so, please. randy

4 5

CAUTION: Potentially Dumb Question...
by Rich Sena 08 Feb '06

08 Feb '06

Not sure how dumb this question is so I'll float it here and beat any flames back with a little Godwin's Law or other Bourseyesque implements of power... I'm trying to cut a few financial corners in our remote site budgets. I have sites that are homed back to the main campus offices via ATM and other leased lines. These sites also currently have dedicated Internet access. I was doing some brain cramming re: MPLS and possibly killing our dependence on ATM by going the MPLS route over a common provider. It struck me to venture a guess as to why I couldn't utilize the same connection for both - Internet transit via the common provider as well as an MPLS mesh between all my sites and my main campuses also via that same connection with the common provider... Can someone swing the clue-by-four for me aiming for what's left of my mullet and learn me - thanks... If you feel this is OT then reply to me direct if there is other interest I will summarize... -- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

4 4

FYI - RFC 4367 on What\'s in a Name: False Assumptions about DNS Names
by william(at)elan.net 08 Feb '06

08 Feb '06

I think some of the people here may want to read this new RFC: http://www.rfc-editor.org/rfc/rfc4367.txt RFC 4367 Title: What\'s in a Name: False Assumptions about DNS Names Author: J. Rosenberg, Ed., IAB Status: Informational Date: February 2006 Mailbox: jdrosen(a)cisco.com Pages: 17 Characters: 41724 -- William Leibzon Elan Networks william(a)elan.net

1 1

Interesting netflow entry
by Wil Schultz 08 Feb '06

08 Feb '06

After setting up netflow this morning I have a of recurring flow that seems bothersome to me. I have an internal host (10.X.X.99) that continually attempts to hit various external hosts (AA, BB, CC, etc...) on seemingly random ports but always sources port udp.1204. In about 2 hours this host has hit 155 different external hosts, some of them once or twice and some of them more than 10 times. Below is a sanitised 10 minute output. 11:41:37.031 0.000 UDP 10.XX.XX.99:1204 -> AA.AA.AA.AA:46299 (RoadRunner, VA US) 11:42:07.032 0.000 UDP 10.XX.XX.99:1204 -> BB.BB.BB.BB:15989 (Comcast, MI US) 11:42:37.096 0.000 UDP 10.XX.XX.99:1204 -> CC.CC.CC.CC:52566 (Comcast, IL US) 11:43:17.204 0.000 UDP 10.XX.XX.99:1204 -> DD.DD.DD.DD:47756 (Adelphia, CA US) 11:45:27.521 0.000 UDP 10.XX.XX.99:1204 -> EE.EE.EE.EE:20797 (Tokyo) 11:46:07.685 0.000 UDP 10.XX.XX.99:1204 -> FF.FF.FF.FF:21363 (Surrey UK) 11:48:47.991 0.000 UDP 10.XX.XX.99:1204 -> GG.GG.GG.GG:48324 (Israel) Interestingly enough, I've checked to see if this seemingly random port was actually listening and each of the 15-20 hosts I've checked are all listening on their port, i.e. AA.AA.AA.AA has udp.46299 open while BB.BB.BB.BB has udp.15989 open. When a host was contacted multiple times the "random" dstport is always the same. Anyone have any clue on to what could be going on here? -Wil

3 8

NANOG36 PGP Key Signing
by Majdi S. Abbas 07 Feb '06

07 Feb '06

The key signing will be on Monday at 3pm in the State room. If you can't make it, feel free to submit keys as there will be a follow-up session during the Wednesday morning break. So get those keys in and I'll see you in Dallas! --msa -snip- Stickers for Your Name Badge When you stop by the registration desk at NANOG36, there will be colored stickers available for your name tag that indicate if you have an interest in signing PGP keys. If people keep trying to peer with you, you've picked up the wrong color sticker and should go back. How the Key Signing Works Those of you who plan to participate should email an ASCII extract of your public key to msa(a)latt.net by 10:00 p.m. CST on Sunday, February 12. Please include 'NANOG PGP KEY' in the subject, and if possible, don't send your key as a MIME attachment. I realize that some MUAs make this difficult, and I will attempt to fix any MIME-attached keys. Instructions for extracting your key to an ASCII file are below. After noon on the 13th, a complete key ring with all of the submitted keys will be available at puck.nether.net/~majdi/nanog36.pgp in binary form, and as an ASCII file at puck.nether.net/~majdi/nanog36.txt. Handouts with the details of each key submitted will be provided. All you should need to bring with you is: * Photo ID (driver's license, passport, etc.) * Your key ID, and its fingerprint * A pen Thank you, and I'm looking forward to seeing you all in Dallas! How to Extract Your Public Key to an ASCII File PGP 2.x: pgp -kxa your_email_address mykey.asc PGP 5.x: pgpk -xa your_email_address > mykey.asc GnuPG: gpg --export --armor your_email_address > mykey.asc PGP on Windows: Start the PGPkeys application, select your key in the list, click on the Keys menu, select Export, name the resulting file, and make sure that Include Private Keys is NOT checked. PGP on a Mac: I assume the procedure is similar to the one for Windows, but cannot confirm this. Hopefully it's easy enough to figure out.

2 1

Re: Middle Eastern Exchange Points
by Aaron Glenn 07 Feb '06

07 Feb '06

On 2/7/06, Howard C. Berkowitz <hcb(a)gettcomm.com> wrote: > > I know of a Cairo IXP, and possibly one in the UAE. Is there one in > Kuwait as yet? http://www.emix.net.ae/ it's flash heavy fyi

3 2

RE: Did anyone else notice the CAIDA skitter poster in the background of George Bush's speech at the NSA?
by Barry Greene (bgreene) 07 Feb '06

07 Feb '06

Maybe now the US Gov can open their pocket book and pay for Skitter? :-) > -----Original Message----- > From: Martin Hannigan [mailto:hannigan@renesys.com] > Sent: Sunday, February 05, 2006 10:55 PM > To: Etaoin Shrdlu > Cc: Barry Greene (bgreene) > Subject: Re: Did anyone else notice the CAIDA skitter poster > in the background of George Bush's speech at the NSA? > > At 06:02 PM 2/5/2006, Etaoin Shrdlu wrote: > > >Joe McGuckin wrote: > > > >>http://tinyurl.com/doy6r > > > > > >Um... (noticed on other lists, by the way) > > > >http://securitywizardry.com/radar.htm > > > > > > I like the skitter chart, but at the Vegas NANOG, Barry > Greene disclaimed it and said it was "out of date". I hope > the NSA is using up to date data. It would be horrific if > they weren't. > > > > > Martin Hannigan (c) 617-388-2663 > Renesys Corporation (w) 617-395-8574 > Member of the Technical Staff Network Operations > hannigan(a)renesys.com >

5 4

RE: Triple Play [was: CAUTION: Potentially Dumb Question...]
by Bora Akyol 07 Feb '06

07 Feb '06

I think the main challenge in making this type of media distribution a reality is not the technology, we mostly know how to make it work. The real challenge is the content owners' willingness to make the content available while preserving their IP rights. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Christian Kuhtz > Sent: Tuesday, February 07, 2006 7:46 AM > To: Sean Donelan > Cc: nanog(a)merit.edu > Subject: Re: Triple Play [was: CAUTION: Potentially Dumb Question...] > > > > On Feb 7, 2006, at 10:27 AM, Sean Donelan wrote: > > > On Mon, 6 Feb 2006, Christian Kuhtz wrote: > >> If you're near real time, you have lots of options actually. And I > >> would contend that p2p can be efficient for broadcast distribution > >> actually. There already are several startups doing > exactly that for > >> large scalability. > > > > Yep. Lots of startups have lots of ideas. If you are selling > > hammers, you can use the same hammer for lots of projects. But I'm > > not a true believer in the hammer religion. > > Argh. What I'm saying is that this is being worked on. And > I know from the research perspective in a previous life that > it can be made work. The fact that startups are working on > commercializing wasn't supposed to suggest viability (it > never does), but that products are on the way to market. I > have my confirmation of viability of the concept from a > different background altogether and I don't subscribe to > startup=viability for anything. > > >

1 0