- NANOG - lists.nanog.org

RCMP contact
by - 05 Nov '03

05 Nov '03

I need a contact with the RCMP in Calgary (Alberta) concerning a network fraud issue. If anybody has one, please relay off list. Thx Bert hostmaster(a)nso.org

1 0

Copper 10 gigabit @ 15 metres
by Eric Kuhnke 05 Nov '03

05 Nov '03

http://www.lightreading.com/document.asp?doc_id=42956&site=lightreading http://grouper.ieee.org/groups/802/3/10GBCX4/ Regarding the first URL, I am curious how many networks will be interested in using a 15 metre 10GbE solution. Even for intra-MMR xconns, it seems like the cable length limit will very quickly become an obstacle. I guess it depends what price point copper 10Gb solutions enter the market at, compared to their optical counterparts.

4 4

RE: Sabotage investigation of fiber cuts in Northwest
by Chad Skidmore 05 Nov '03

05 Nov '03

FWIW, the following is the notes from Qwest's outage notification on the 3rd. ------------------------------------------------------------------------ -- NOTES: SS7 DUAL A-LINK FAILURE UNDER INVESTIGATION BY SS7,NFC AND SWITCH. (3) OC48'S FAILED/ SUSPECT FIBER CUT BTWN BLHMWA & E. STANWD RPTR/ UPGRADED TO RED DUE TO NALS/ STILL INVEST./ RR'G SS7 LINK TO RADIO OTDR INDICATES 42 N. OF STTLWA04/ TECH ENROUTE TO ESWDWA RPTR/ ETA 45MINS. TECHS ON SITE NOW / SUSPECT VANDALISM / LAW ENFORCEMENT ON SITE TECHS ARE INSIDE HUT/ CABLE IS CUT AT HUT/ CONFIRMED VANALISM INSIDE HUT TAKING PICTURES INSIDE HUT/ TEN FIBERS CUT/ LOADING EQPT. FROM TRUCK/ NO ETR FIBERS PRIORITIZED / 6 OF 10 FIBERS CUT / SPLICING WILL START IN 15MINS. FIRST FIBERS ARE SPLICED/ A-LINKS RESTORED/ BLOCKING IS ST FIRST FIBERS ARE SPLICED/ A-LINKS RESTORED/ BLOCKING IS STARTING TO CLEAR BLOCKAGE STOPPED AT 12:45 PDT / SPLICING CONTINUES CLEARING ALARMS & FINAL CLEAN UP ONGOING/ 6 FIBERS SPLICE ALL ALARMS HAVE CLEARED 911 BACK ON NORMAL PATH AND TESTED. 6 FIBERS SPLICE ALL ALARMS HAVE CLEARED 911 BACK ON NORMAL PATH AND TESTED. 6 FIBERS SPLICE ALL ALARMS HAVE CLEARED 911 BACK ON NORMAL PATH AND TESTED. RESTORE DATE & TIME 2003-09-03 12:28:44 PDT ------------------------------------------------------------------------ -- Regards, Chad ------------------------ Chad Skidmore One Eighty Networks http://www.go180.net 509-688-8180 -----Original Message----- From: Laurence F. Sheldon, Jr. [mailto:larrysheldon@cox.net] Posted At: Monday, November 03, 2003 8:08 PM Posted To: NANOG Conversation: Sabotage investigation of fiber cuts in Northwest Subject: Re: Sabotage investigation of fiber cuts in Northwest JC Dill wrote: > > At 07:32 PM 11/3/2003, John Fraizer wrote: > >On Mon, 3 Nov 2003, Owen DeLong wrote: > > > > > Maybe I'm missing something, but, if you have the bolt cutters, I > > > don't see why you need the key to an adjacent lock or any of the locks. > > > >Um, cutting a lock out gets it out of the mix but, you still have to > >have the key to one of the other locks to complete the chain again. > >Think about it. > > A cut lock can be replaced with a similar replacement lock and usually > no one will be the wiser. Look at the locks here: > > <http://www.qsl.net/kf4lhp/telweb/microwave/kiv70/padlocks.jpg> > > The lock marked ATC is between 2 other locks (that's a hasp to its > left, with rusty chain further to the left). It could be cut and > replaced with a similar lock linking the other two locks, without > opening either of the other two locks. On gates with many locks (I've > seen chains of 6 or more), there is rarely any interest given to the > locks that are not one's own responsibility. I wonder if that Bell System (F7?) is ever unlocked anymore.

1 0

RE: Hijacked IP space.
by McBurnett, Jim 05 Nov '03

05 Nov '03

/lurkingmode disabled Should we, as a community, register with RIR's with PGP. And use special keys for resources? The only people to have the keys would be the end user/ISP and the RIR. Forged PGP can be done but not so easily. Basically email is so easy to forge should we not do what we do everywhere else and just add security? or ACL's or a firewall or....... /lurkingmode enabled ->-----Original Message----- ->From: william(a)elan.net [mailto:william@elan.net] ->Sent: Tuesday, November 04, 2003 7:00 AM ->To: nanog(a)merit.edu ->Subject: Re: Hijacked IP space. -> -> -> -> ->Also while we're on ip hijacking subject as I mentioned there ->is a new way it ->has been done where instead of reregistering domains, the ->actual email ->account is reused by somebody else and where whois at arin is ->for themost ->part left unchanged (making it difficult for arin to do anything). -> ->Because these cases are difficult to track the original ->owners and to proof ->hijacking or to notice that it happend, it would be nice to stop such ->activity in the first place. So I'd would really be good if ->somebody from ->earthlink contacts me and I can then tell them privately what ->names they ->need to "lock" as far as what their customers can request for ->additional ->emails. Same applies for other ISPs - if you who work for ->company that ->has in the past bought other large ISPs AND where you still ->allow new or ->existing customers to get new email accounts at the domains ->of those old ->companies (i.e. like earthlink is presumably doing with ->netcom.com) then ->let me know domains and I can tell you what not to allow your ->customers ->for emails. -> ->-- ->William Leibzon ->Elan Networks ->william(a)elan.net -> ->

18 23

Abovenet
by Nakul Malik 05 Nov '03

05 Nov '03

Anyone know if abovenet had a major router crash in or near Seattle or some location that feeds it?? Thanks -Nakul

3 2

Re: Hijacked IP space
by Stewart, William C (Bill), RTSLS 04 Nov '03

04 Nov '03

Chuck Goolsbee wrote that one of his clients was having problems because miscreants have hijacked IP space that they own but haven't actively used in a while. While it's definitely worth submitting it to completewhois and developing whatever paper trail it takes to give it back to the registrars if they don't want to keep it, another obvious stopgap would be to advertise the space, including their /21 and any /24s they see route advertisements for. Either point it to some spare PC with a web server handing out "Forgers hijacked our address space" pages, or null route it. Also check the reverse DNS listings, if there are any, and have them advertise a pointer to a subdomain like weve-been-hijacked.theirdomain.com with an appropriate web page.

2 1

Content filter (was - Re: [arin-announce] IPv4 Address Space)
by william＠elan.net 04 Nov '03

04 Nov '03

> Leave content filtering to the ES, and *force* ES to filter the content. And just to make sure we know what content filter is, this is what I received immedialy following my previous post to nanog. Whoever you are, that did not see my post, please at least configure your content filter to reject email and specify your own mail server name there (and preferably specifying what original rcpt to as well), putting my own server name in "from" is just not very polite, nor is it according to standards (you have no idea if "Administrator" account exist on my machine, in fact for most it would not). ---------- Forwarded message ---------- Date: Wed, 29 Oct 2003 19:22:54 -0500 From: Administrator(a)sokol.elan.net To: william(a)elan.net Subject: [MailServer Notification]To sender: Message matched eManager setting and action was taken. **************** eManager Notification ***************** The following mail was blocked since it contains sensitive content. Source mailbox: william(a)elan.net Destination mailbox(es): nanog(a)merit.edu Rule/Policy: Profanity Action: Quarantine to D:\Logs\Trend\SMCF\Quarantine\2003-10-29\19\22\DFImessagebody3fa059de2479.tmp Content filter has detected a sensitive e-mail. ******************* End of message *********************

11 18

Re: Hijacked IP space.
by Andrew - Supernews 04 Nov '03

04 Nov '03

>>>>> "chuck" == chuck goolsbee <chucklist(a)forest.net> writes: chuck> Of course I have no hard data, other than my client's phone chuck> call about another phone call, so I can't query based on a chuck> timestamp to see where this was being announced from. It chuck> appears to vanished, and has remained so according to my chuck> casual glances here and there. chuck> The netblock in question is: chuck> 204.89.0.0/21 No announcement for that block has been visible here at any time in the past couple of weeks (specifically, since Oct 13). We might have missed it if it was never announced for more than a few minutes at a time, but it's _much_ more likely that the block was never announced and was merely forged into headers of a spam. -- Andrew, Supernews

10 15

Re: Sabotage investigation of fiber cuts in Northwest
by Gregory Hicks 04 Nov '03

04 Nov '03

> From: Valdis.Kletnieks(a)vt.edu > Date: Sun, 02 Nov 2003 22:12:20 -0500 > > On Sun, 02 Nov 2003 21:37:30 EST, "Robert M. Enger" <enger(a)comcast.net> said: > > > You'd think after three previous disruptions, that Qwest would > > have enabled some form of redundancy. > > Redundancy hell. How about a *PADLOCK*? You mean that these places aren't even locked? Who has (had) the key? That'd be the first place I looked. Oh well... Back to lurk mode. --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com Never attribute to malice that which is adequately explained by ignorance or stupidity. Asking the wrong questions is the leading cause of wrong answers "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

17 22

RE: Harassment (was Re: ELAN.NET ...)
by Jeffrey Wheat 04 Nov '03

04 Nov '03

Enough with this thread already. > -----Original Message----- > From: Eric Brunner-Williams in Portland Maine > [mailto:brunner@nic-naa.net] > Sent: Tuesday, November 04, 2003 9:29 AM > To: Suresh Ramasubramanian > Cc: Eric Brunner-Williams in Portland Maine; > william(a)elan.net; nanog(a)merit.edu; Booth, Michael (ENG); > brunner(a)nic-naa.net > Subject: Re: Harassment (was Re: ELAN.NET ...) > > > > Again, without comment on any other issue ... > > <hat = registrar> > > Siegfried Langenbach's execution of some registrar-basics > causes many registrars puzzlement and/or concern. I don't > know of any registrants who actually transfered successfully > _from_ joker/csl to a compeating registrar, but I do know > many registrars who've complained that they have been > unsuceessful in obtaining registrant-authorized transfers > from joker/csl. > > I don't have any direct customer experience, that's just > "registrars at the table/bar" talk, 2nd hand. > > </hat> > > Eric > > --- > Incoming mail is certified Virus Free. > Checked by AVG anti-virus system (http://www.grisoft.com) > Version: 6.0.536 / Virus Database: 331 - Release Date: 11/3/2003 > > --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.536 / Virus Database: 331 - Release Date: 11/3/2003

1 0