- NANOG - lists.nanog.org

Re: NETGEAR in the core...
by Todd Vierling 04 Aug '05

04 Aug '05

On Thu, 4 Aug 2005, Mohacsi Janos wrote: > > Correct. You can create an in-memory startup script to do tunnel > > configuration, as well, with something like this: > PPPE over IPv6 also supported? You mean that the other way round -- IPv6 over PPPoE natively, without tunnelling? I don't know if the pppoe implementation in the firmware does the necessary IPv6CP negotiation to transit IPv6 natively (as I don't have an uplink where that is possible). -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

1 0

FCC delays meeting 'til Friday....
by Fergie (Paul Ferguson) 04 Aug '05

04 Aug '05

[snip] The Federal Communications Commission delayed its monthly meeting as its chairman worked Wednesday to build support for relaxing rules governing high-speed Internet services offered by phone companies. The meeting, scheduled for Thursday, was pushed back to Friday. [snip] http://news.yahoo.com/news?tmpl=story&u=/ap/20050803/ap_on_go_ot/fcc_broadb… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Traffic to our customer's address(126.0.0.0/8) seems blocked by packet filter
by mkawano＠bb.softbank.co.jp 04 Aug '05

04 Aug '05

Dear Network Operators and whom it may concern I hope you are doing well, We are facing a difficult problem and we would like to ask your assistance! The following address blocks were allocated from IANA to APNIC on the 27th of JAN of 2005. Please refer to the following link. http://www.cymru.com/Documents/bogon-list.html --- Changes in version 2.6 (27 JAN 2005) 124/8, 125/8 and 126/8 allocated to APNIC (JAN 2005). Removed from the bogon lists. --- Softbank BB (AS17676) was allocated 126/8 from APNIC, and Softbank BB (AS17676) immediately tried to use 126/8. However Softbank BB could not access the famous site using 126/8, It seems some of ISPs are blocking 126/8 due to outdated filter. Ladies and gentlemen, please check the following URL! http://www.cymru.com/Documents/bogon-list.html and if you find out you have outdated filter, please update the filter immediately. Please let me know if you have any problem, concern or doubt regarding opening a filter for 126/8, please let me know. Best regards & Thanks in advance, -- Makoto Kawano <mkawano(a)bb.softbank.co.jp> SOFTBANK BB Corp. Yahoo!BB Network Operation Center

6 5

DDoS attacks, spoofed source addresses and adjusted TTLs
by Mike Tancsa 03 Aug '05

03 Aug '05

I had a DDoS this morning (~ 130Mb) against one of my hosts. Packets were coming in all 3 of my transit links from a handful of source IP addresses that sort of make sense in terms of the path they would take to get to me. They were all large UDP packets of the form 09:08:58.981781 xx:xx:xx:xx:xx:xx yy:yy:yy:yy:yy:yy 0800 1514: 82.165.244.204 > ta.rg.et.IP: udp (frag 47080:1480@1480+) (ttl 54, len 1 500) 0x0010 yyyy yyyy 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBB 0x0020 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB 0x0030 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB 0x0040 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB 0x0050 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB 0x0060 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB The TTLs all kind of make sense and are consistent (e.g. if the host is 8 hops away, the TTL of the packet when it got to me was 56). Yes, I know those could be adjusted in theory to mask multiple sources, but in practice has anyone seen that ? I seem to recall reading the majority of DDoS attacks do not come from spoofed source IP addresses. Of the traffic snapshot I took, the break down seems to jive as well with the PTR records. i.e. PTR records that indicate a home broadband connection were less than PTR records suggesting a server in a datacentre somewhere. A few of the IPs involved capturing 1000 packets on one of my links at the time. 210 207.58.177.151 - server.creditprofits.com 287 65.39.230.20 - server4.xlservers.com 11 67.52.82.118 - rrcs-67-52-82-118.west.biz.rr.com 492 82.165.244.204 - u15178515.onlinehome-server.com It was pretty short lived as well -- about 8 min total. ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

2 3

OT: Cisco.com password reset.
by Joe Blanchard 03 Aug '05

03 Aug '05

FYI I got an email that my CCO account's password was reset last night. Not sure how widespread this issue was, but I called my account contact and verified that this is a valid email, and that my password needed to be reset. Just a heads up. -Joe Blanchard

19 24

FW: CISCO - CCO Passwords
by Dave Anderson 03 Aug '05

03 Aug '05

Got this regarding the CCO password issue earlier today. Seeya, Dave -----Original Message----- From: Kim Christensen (kichrist) [mailto:kichrist@cisco.com] Sent: Wednesday, August 03, 2005 11:58 AM Subject: CISCO - CCO Passwords Dear Cisco Partner, I'd like to bring your attention to an issue that may cause minor inconvenience for customers and partners. You may experience issues with your login to <http://www.cisco.com/> www.cisco. <http://www.cisco.com> com You will be required to reset your password, please send an email to cco-locksmith(a)cisco.com from the same email address that is associated with your CCO userid. Within a few minutes you should receive a new working password back to that same email address. Please note that when you send an email to cco-locksmith(a)cisco.com - the only requirement is that the email is sent from the same email address associated with your userid to receive the return email with the new password. Once this is received you should be able to reset your password to one of your own choosing. It is possible that you are not impacted by this issue but I wanted to ensure you are aware of this in the event you have a problem logging into CCO today. Your Cisco Channel Team

1 0

NETGEAR in the core...
by Robert E.Seastrom 03 Aug '05

03 Aug '05

OK, not really "in the core", but the subject made you look at least. :) I'm interested in people's experiences with consumer-grade routers functioning in non-NAT mode; that is to say, running PPPoE to the ISP and routing a /29 or a /28. A sane filtering language and stateful firewall that can operate in non-NAT mode is a plus. My experiences with Linksys (and Netscreen, which isn't really at the price point I wanted anyway) have caused me to rip out substantial amounts of my already insufficient hair. "Cisco 1700 series" or "Cisco 2600XM" would be nice answers if their price had the decimal point moved one place to the left. Linux or other non-vendor-supplied firmware, while cool, represents an unacceptable support load for my application. Any thoughts? ---Rob

17 18

Re: Problems at Microsoft?
by Fergie (Paul Ferguson) 03 Aug '05

03 Aug '05

Completely unrelated, but apparently Vonage is also having some problems this morning: http://gigaom.com/2005/08/03/massive-vonage-outage/ - ferg -- Richard A Steenbergen <ras(a)e-gerbil.net> wrote: On Wed, Aug 03, 2005 at 10:44:40AM -0400, Drew Weaver wrote: > Hi there, we've had a few complaints about connectivity > issues to Microsoft, is anyone else seeing a problem? Usually I get > between 2-3MBps when I download from them, at the moment I get 8k/sec > downloading > http://download.microsoft.com/download/b/6/2/b624b535-644a-41e1-9727-812 > dcd6bad87/E3SP1ENG.EXE (service pack 1 for exchange 03) from Both my > network, and a monitoring server we have in chicago. > > Anyone else seen this? Seeing this from several locations. For all the locations I am looking from, it appears that their CDN service (Savvis footprint.net) has gone insane. >From SBC on the west coast, it is going to what looks for all the world to be a cable modem in Korea: 19 catv09634.usr.hananet.net (210.180.96.34) 292.576 ms 218.396 ms 242.135 ms >From a cable modem in Seattle behind broadwing, it is going to this, behind SBC in southern California: 16 62 ms 61ms 50 ms Savvis-CDN-IAF1075825.cust-rtr.pacbell.net [69.108.147.58] >From the northern VA area: 7 cdn-colo.Frankfurtfrx.savvis.net (208.174.60.2) 90.626 ms 90.722 ms 90.661 ms Makes you wonder if they'll be switching back to Akamai soon. :) -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

5 5

RE: Problems at Microsoft?
by Jeff Jirsa 03 Aug '05

03 Aug '05

> From a cable modem in Seattle behind broadwing, it is going to this, > behind SBC in southern California: > > 16 62 ms 61ms 50 ms > Savvis-CDN-IAF1075825.cust-rtr.pacbell.net [69.108.147.58] > > Makes you wonder if they'll be switching back to Akamai soon. :) > >From Southern California off Level3, I get the akamai'd version: [jeff@www jeff]$ traceroute download.microsoft.com traceroute to dom.dl.ms.akadns.net (207.46.253.62), 30 hops max, 38 byte packets 1 vps041118.2advanced.net (216.174.103.241) 0.081 ms 0.091 ms 0.054 ms 2 reverse.techspace.com (216.174.111.210) 0.682 ms 0.435 ms 0.444 ms 3 reverse.techspace.com (216.174.116.19) 0.816 ms 0.839 ms 0.664 ms 4 ge-6-1-108.hsa1.Tustin1.Level3.net (65.58.240.5) 1.646 ms 1.253 ms 1.061 ms 5 4.68.114.1 (4.68.114.1) 1.334 ms 1.690 ms 1.825 ms 6 as-0-0.mp1.Seattle1.Level3.net (209.247.10.137) 31.052 ms so-3-0-0.mp2.Seattle1.Level3.net (209.247.9.122) 30.559 ms 30.541 ms 7 ge-10-1.hsa1.Seattle1.Level3.net (4.68.105.70) 30.957 ms ge-11-1.hsa1.Seattle1.Level3.net (4.68.105.102) 30.896 ms ge-10-0.hsa1.Seattle1.Level3.net (4.68.105.6) 30.753 ms 8 unknown.Level3.net (63.211.220.82) 36.724 ms 34.164 ms 31.604 ms 9 ten8-3.wst-76cb-1a.ntwk.msn.net (207.46.35.105) 30.788 ms 30.521 ms 30.724 ms 10 pos1-0.iusnixcpxc1201.ntwk.msn.net (207.46.36.210) 30.931 ms 30.782 ms 30.626 ms 11 pos1-0.tke-12ix-2a.ntwk.msn.net (207.46.155.10) 32.050 ms 31.518 ms 31.479 ms 12 po10.tuk-65ns-mcs-1a.ntwk.msn.net (207.46.224.151) 31.212 ms 30.886 ms 31.020 ms [jeff@www jeff]$ dig +trace download.microsoft.com soa ; <<>> DiG 9.2.2-P3 <<>> +trace download.microsoft.com soa [snip ....] microsoft.com. 172800 IN NS ns1.msft.net. microsoft.com. 172800 IN NS ns2.msft.net. microsoft.com. 172800 IN NS ns3.msft.net. microsoft.com. 172800 IN NS ns4.msft.net. microsoft.com. 172800 IN NS ns5.msft.net. ;; Received 218 bytes from 192.5.6.30#53(A.GTLD-SERVERS.NET) in 72 ms download.microsoft.com. 3600 IN CNAME main.dl.ms.akadns.net. ;; Received 75 bytes from 207.46.245.230#53(ns1.msft.net) in 31 ms - J -- Jeff Jirsa jjirsa(a)2advanced.net Senior Network Engineer 2advanced.net: Precision Hosting Platform

1 0

Problems at Microsoft?
by Drew Weaver 03 Aug '05

03 Aug '05

Hi there, we've had a few complaints about connectivity issues to Microsoft, is anyone else seeing a problem? Usually I get between 2-3MBps when I download from them, at the moment I get 8k/sec downloading http://download.microsoft.com/download/b/6/2/b624b535-644a-41e1-9727-812 dcd6bad87/E3SP1ENG.EXE (service pack 1 for exchange 03) from Both my network, and a monitoring server we have in chicago. Anyone else seen this? -Drew

5 4