- NANOG - lists.nanog.org

Postini contact in the house ??
by John Brown (CV) 12 Oct '03

12 Oct '03

Hi list, seems there is no technical email contact listed for Postini on their website. a client is having an issue with postini, if there is someone with clue from postini on the list please contact me off list john at chagres d0t net thanks

1 0

DDOS Today?
by Greg Valente 12 Oct '03

12 Oct '03

I just got on today. Was there any large DDOS attacks today. Any specific networks impacted? -----Original Message----- From: Jeroen Massar [mailto:jeroen@unfix.org] Sent: Friday, October 10, 2003 8:16 PM To: 6bone(a)ISI.EDU; nanog(a)merit.edu Subject: Reserved ASN 64702, 6to4, 2 ghosts, other oddities and still no working contacts... -----BEGIN PGP SIGNED MESSAGE----- Checking http://www.sixxs.net/tools/grh/lg/?show=bogons&find=::/0 People might want to filter on private ASN's also when that ASN is being used as "transit"... 2001:a40::/32 AS64702 is reserved (path: 15516 3257 2497 4697 2914 10109 4538 4787 64702 20646 8763 5539 1930 9186) Ghost Route (14/12) 3ffe:3500::/24 3ffe:4005:fefe:: 25396 1752 10109 4538 4787 64702 20646 8319 We still have these 6to4 specifics btw: 2002:c2b1:d06e::/48 More specific 6to4 prefix (194.177.208.110/32) from AS5408 2002:c8a2::/33 More specific 6to4 prefix (200.162.0.0/17) from AS15180 2002:c8c6:4000::/34 More specific 6to4 prefix (200.198.64.0/18) from AS15180 2002:c8ca:7000::/36 More specific 6to4 prefix (200.202.112.0/20) from AS15180 And nopes, no contact has been made yet, apparently having your email address listed in the registry frees you of any obligations... Another funny one: 3ffe:3::/32 Subnet of 3ffe::/24 Mismatching origin ASN, should be 4555 (now: 29216) While there also is an announcement for: 2001:7fe::/32 I-rootserver-net-20030916 The ghosts of this month: 3ffe:1f00::/24 3ffe:2400::/24 Both with "10318 5623" common in their paths, obvious isn't it ? Oh and yes, still no contact from anybody at nortel, apparently that company doesn't know what IPv6 is. AS10318 (check above also) is still announcing *their* block and still haven't made any comment or reply back whatsoever. AS10318 have their own pTLA but apparently are not contactable for that pTLA either. If anybody knows someone alive for 3ffe:1300::/24 or AS762 or AS10318 please notify them. Maybe posting to nanog raises some people from sleep. Mailing the whois contacts directly doesn't help apparently. Greets, Jeroen -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Alpha 13 Int. Comment: Jeroen Massar / jeroen(a)unfix.org / http://unfix.org/~jeroen/ iQA/AwUBP4dLximqKFIzPnwjEQKluACglQJ+2QtJZ6O2fJZShwxLe0Z6Fz8AnRym p0Clq/HyC9EoC/RsaYudqZey =XBo4 -----END PGP SIGNATURE-----

3 2

internet consumers forum?
by Richard Welty 11 Oct '03

11 Oct '03

_please reply offlist_ i've sent some time (at least 20 minutes) considering that while there are forums for operators and engineers to discuss issues (nanog, ietf, others too numerous to mention), there aren't really forums for informed consumers of internet services to exchange notes (or for uninformed consumers to become informed.) if anyone knows of such, please let me know. otherwise, i'm considering starting an unmoderated but carefully monitored mailing list for business oriented discussion from the viewpoint of consumers. i'd probably want to tie this in with the development of FAQs and tutorials targeted at business consumers of internet services. again, comments offlist, please. richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security

3 3

edge interface bits
by Petri Helenius 11 Oct '03

11 Oct '03

Does anyone know, either on the east coast US, London, Stockholm, Copenhagen, Amsterdam or Helsinki transit providers which would allow edge/handoff interface control to different traffic classes using BGP communities? (for example to announce DDoS destinations and/or sources with different community which would drop the precedence of those packets to a lower level and thus de-prioritize them and allow legitimate traffic to have better performance) Pete

3 2

Puerto Rico
by Mehmet Akcin 11 Oct '03

11 Oct '03

Anyone living in Puerto Rico (if they are getting this mail, they should be working for computer/internet related anyway) can contact me offlist please? thanks. Mehmet Akcin

1 0

contact at yahoo mail? (they think we're an open relay :< )
by Mark Jeftovic 10 Oct '03

10 Oct '03

Today our email forwarders started getting this from yahoo.com mail handlers: 553 Mail from 216.220.40.247 not allowed - VS99-IP1 deferred - see help.yahoo.com/help/us/mail/defer/defer-02.html (#5.7.1) Connection closed by foreign host. Which when you go look at that page basically tells you you're probably an open relay (which we're not), etc. Can any mail admins at Yahoo contact me offlist, or post what the restrictions are or at what levels this will kick in? -mark -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

6 9

first Yahoo, now RoadRunner?
by Mark Jeftovic 10 Oct '03

10 Oct '03

rr.com blocking our netblock since this morning now.... 5.7.1 Mail Refused - 216.220.40 - See http://security.rr.com/mail_blocks.htm#security Anyone else? -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

6 10

The Earth's not slowing down fast enough to
by bmanning＠karoshi.com 10 Oct '03

10 Oct '03

> Date: Tue, 07 Oct 2003 23:33:45 -0700 > Subject: The Earth's not slowing down fast enough to suit Motorola > > Motorola reports that several GPS receivers in its Oncore line will > misdisplay the date on 28 Nov 2003 at midnight UTC. For a one-second window > the receivers will mistakenly report the date as 29 Nov instead of 28 Nov. > > Here's why. Every couple of years or so for the past three decades, the > International Earth Rotation Service has announced a leap-second because the > Earth is rotating slightly more slowly than an 86400-second day would > suggest. But since 1 Jan 1999, we've had an unusually long dry spell > without any leap seconds. The GPS week number in the UTC correction > parameter is 8 bits long, which allows for 256 weeks of unambiguous time > calculation. Until now this parameter has never rolled over, but because of > the dry spell 28 Nov will be exactly 256 weeks after the most recent leap > second, and the rollover will contribute to the bug. > <http://www.motorola.com/ies/GPS/docs_pdf/notification_oncore.pdf> > > Steve Allen writes in <http://www.ucolick.org/~sla/leapsecs/onlinebib.html> > that some JDAM smart bombs and other munitions are rumored to contain these > receivers. Anyone intending to use those weapons around the magic window > might want to reschedule their bombing runs for some other time. ... for all you NTP/GPS junkies out there... :) --bill

1 0

Re: RE: Finding clue at comcast.net
by Alan Spicer 10 Oct '03

10 Oct '03

>From: "Austad, Jay" <JAustad(a)temgweb.com> >Date: 2003/10/09 Thu AM 10:29:25 EDT >To: "'Howard C. Berkowitz'" <hcb(a)gettcomm.com>, nanog(a)merit.org >Subject: RE: Finding clue at comcast.net > > >Comcast's phone support department is the *worst*, WORST, I've ever dealt >with. I think they are outsourced, they have to go by a script, and many of >them probably hardly know what a computer even is. Once I called because of >a problem on their network, and I told the person on the phone that there >was a problem on their network, and I pinned it down to a couple of routers >where the problem may be, and she responded, very sternly, "Sir, WE DON'T >HAVE ANY ROUTERS" > >In any case, if you manage to get the call escalated a couple of times >(after lying about rebooting your computer 47 times), you'll get someone >good. Also, there are some good people who read this list. But calling >their phone support to get anything useful is like trying to squeeze blood >from a rock. > >-jay * You might want to try and Social Engineer this one a little bit. In your other email you had mentioned someone in their call center suggesting you call the local cable company about the server (or such). Now I'm not suggesting anyone lie ... or such a thing ... but say you called the local office on a cold sales call asking for the person that handles their data networking. As you work your way through that try to find out who is the Head Engineer(s). From there try to find out who handles the CMTS equipment (Cisco uBR?) equipment in the local office Head End, and likely who handles the network including routers and switches and such. You might even try emailing the domain Technical Contact and explain who you are and ask them if there is an Engineering or Network Administrative contact for the local head end of your city. Good Luck, --- Alan Spicer (a_spicer(a)bellsouth.net) Systems and Network Adminstration http://aspicer.homelinux.net

4 6

New attack against port 135?
by Peter John Hill 10 Oct '03

10 Oct '03

I am seeing lots of scanning of port 135 on my network. 66 byte long packets. Anyone have a name for this? It is less aggressive than the welchia scans I have seen. Seems to scan at about 3000 or so flows per 5 minutes. Thanks Peter Hill Network Engineer Carnegie Mellon

3 2