- NANOG - lists.nanog.org

Need contact info for AS1798 - State of Oregon
by Tyler Applebaum 05 Dec '16

05 Dec '16

If you could contact me off-list, I'd appreciate it. - Tyler

1 0

Acquiring unused IP range. Some questions
by William McLendon 05 Dec '16

05 Dec '16

Hi everyone, we are about to acquire a block of IP’s from another organization that has unused space, and being fairly new to these procedures, I was hoping for some guidance. We have already been pre-approved by ARIN for the block size we are acquiring, and finalizing the deal with the current owner of the address space. First question is, once they initiate the transfer request to transfer the IP range to us, how long does that typically take for ARIN to complete? Secondly, our relationship with the IP block owner is a very good one, such that I think they would be ok with us advertising this block before we technically own it. My question is, what do they and we need to do to accomplish that in the proper way, so that the internet at large would accept the advertisement from a different ASN, and not view as some sort of hijacking, etc. I am guessing they may need to update some RADB or something like that, but i’ll be honest my knowledge of how those things work and their complete function is pretty slim. This would be a short term thing as we expect the purchase process to complete pretty quickly, but it would be advantageous to us to be able to advertise the space immediately. We just want to make sure we start off on the right foot. Thanks, Will

4 3

Wormly SMTP Test Message
by Wormly SMTP Test 04 Dec '16

04 Dec '16

This message was sent using the Wormly SMTP testing tool by this user: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36 197.230.17.94

1 0

Wormly SMTP Test Message
by Wormly SMTP Test 04 Dec '16

04 Dec '16

This message was sent using the Wormly SMTP testing tool by this user: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36 197.230.17.94

1 0

Wormly SMTP Test Message
by Wormly SMTP Test 04 Dec '16

04 Dec '16

This message was sent using the Wormly SMTP testing tool by this user: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36 105.159.251.206

1 0

Wormly SMTP Test Message
by Wormly SMTP Test 04 Dec '16

04 Dec '16

This message was sent using the Wormly SMTP testing tool by this user: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36 197.230.17.94

1 0

Disney Brands GeoIP Contact
by James Baldwin 03 Dec '16

03 Dec '16

Does anyone have contacts at Disney or an associated brand (Hulu, Disney, ESPN)? They all appear to have out of date or incorrect GeoIP information for our Level3 block. I have been able to whitelist our corporate locations with Hulu however I have been unable to reach anyone at the other sites. I would love to find out which third party they are using for their information and correct the problem at the source (MaxMind is correct). - James

2 1

Comcast business IPv6 vs rbldnsd & PSBL
by Rik van Riel 03 Dec '16

03 Dec '16

First of all, kudos to Comcast for trying to roll out IPv6 across their entire network. Static IPv6 netblocks seem to be available for Comcast business users, and IPv6 is enabled unconditionally in the CPE routers used by Comcast business class internet. Unfortunately, the software in the two available CPE routers (SMC & Cisco) is horribly broken when it comes to IPv6. The TL;DR summary: even when IPv6 firewalling is disabled in the configuration, the router still tracks every IPv6 "connection", which causes every single DNS lookup to fill up a slot in its connection tracking table. The router's logs say it blocks tens of thousands of IPv6 connections every day, despite firewalling being "disabled" on the router. Once the connection tracking table fills up, both IPv6 and IPv4 start having trouble, with packet loss on ICMP, high ping times to the local router (and the internet), and new connections not establishing. The router randomly crashes and reboots too, sometimes multiple times a day. This ends up breaking both IPv6 and IPv4. It only takes about 300kbit/s of DNS traffic to trigger the bug, in both the SMC and the Cisco routers. Are there any Comcast NOC or other technical people present who could help? I am interested both in helping resolve the firmware issues in the routers (there will no doubt be other customers who hit this in the future, as IPv6 becomes ore common) or, if that is not an option, finding some way to avoid the issue. http://forums.businesshelp.comcast.com/t5/Equipment-Modems-Gateways/Cis co-DPC3941B-slows-to-a-crawl-and-crashes-several-times-a-day/td-p/30807 -- All Rights Reversed.

9 11

BRAS/BNG Suggestion
by Lorenzo Mainardi 03 Dec '16

03 Dec '16

Good morning, Could you suggest some vendors of BRAS/BNG for PPPoE termination? We have more than 20.000 users. In my short list there are already Juniper, Cisco and NOKIA/ALU. Do you have any other honorable brand or good experiences? Regards digitel Via della Fortezza 6 - 50129 Firenze www.digitelitalia.com<http://www.digitelitalia.com/> - 800 901 669 Ing. Lorenzo Mainardi Tel +39 055 4624933 Fax +39 055 4624 947 lom(a)digitelitalia.com<mailto:lom@digitelitalia.com>

9 10

None
by Rich Kulawiec 02 Dec '16

02 Dec '16

Cc Bcc: Subject: Re: Avalanche botnet takedown Reply-To: In-Reply-To: <32993.1480633310(a)segfault.tristatelogic.com> On Thu, Dec 01, 2016 at 03:01:50PM -0800, Ronald F. Guilmette wrote: > As you probably know Rich, that's not exactly a novel observation. Vixie > was already saying it a full six years ago, and things have only gotten > worse since then. Yep. I remember reading that. The only change I would make is that Paul wrote: Most new domain names are malicious. and I think a more accurate/updated/refined statement in 2016 would be: Almost all new domain names are malicious. We are busy trying to support a domain name system that is two to three orders of magnitude larger (as measured by domains) than it should be or needs to be. And nearly all of what we're supporting is malicious. ---rsk

4 3