- NANOG - lists.nanog.org

NEVERMIND! (was: Seeking Google reverse DNS delegation contact)
by Ronald F. Guilmette 17 Nov '16

17 Nov '16

My profuse apologies to everyone. It seems that Google is not in fact involved in any way with providing reverse DNS for the 204.8.136.0/21 IP address block. I was deceived into believing it was by some unusual trickey on the part of the spammer-controlled name servers ns1.saversagreeable.com and ns2.saversagreeable.com. You can see the clever deception toward the very end of the dig +trace listing I posted: http://pastebin.com/raw/VNwmgMHh It seems those clever rascal spammers tried to implicate Google's name servers, but it is only their's which are giving out the reverse DNS which suoorts their snowshoe spamming efforts in the 204.8.136.0/21 block. Sorry for my mistake everyone. I wasn't expecting quite this level or kind of reverse DNS delegation trickery. Regards, rfg

2 2

198.154.60.0/22 bogon/hijacked?
by Jeremy Parsons 16 Nov '16

16 Nov '16

3 2

Port 2323/tcp
by Stephen Satchell 16 Nov '16

16 Nov '16

I've been seeing a lot of rejections in my logs for 2323/tcp. According to the Storm Center, this is what the Mirai botnet scanner uses to look for other target devices. Is it worthwhile to report sightings to the appropriate abuse addresses? (That assumes there *is* an abuse address associated with the IPv4 address that is the source.) Would administrations receiving these notices do anything with them? Alternatively, is there anyone collecting this information from people like me to expose the IP addresses of possible infections? I am toying with the idea of setting up a honey-pot, but I'm so far behind with $DAYJOB that such a project will have to wait a bit. I want to be a good net citizen. I also want to make sure I'm not wasting my time. Today's crop: > 1.34.169.183 > 12.221.236.2 > 14.138.22.12 > 14.169.142.30 > 14.174.71.158 > 14.177.197.101 > 31.168.146.33 > 31.168.212.174 > 36.71.224.179 > 36.72.253.206 > 37.106.18.86 > 42.115.187.189 > 42.117.254.248 > 42.119.228.222 > 43.225.195.180 > 46.59.6.249 > 49.114.192.91 > 58.11.238.146 > 58.186.231.59 > 59.8.136.21 > 59.49.191.4 > 59.57.68.56 > 59.126.35.47 > 59.126.242.70 > 59.127.104.67 > 59.127.242.8 > 60.251.125.125 > 61.219.165.38 > 73.84.152.194 > 78.179.113.148 > 78.186.61.30 > 78.189.169.142 > 78.226.222.234 > 79.119.74.255 > 81.16.8.193 > 81.101.233.14 > 81.214.121.43 > 81.214.134.133 > 81.214.137.197 > 82.77.68.189 > 83.233.40.141 > 85.96.202.199 > 85.99.121.41 > 85.238.103.111 > 86.121.225.48 > 87.251.252.22 > 88.249.224.167 > 89.122.87.239 > 89.151.128.198 > 90.177.91.201 > 92.53.52.235 > 92.55.231.90 > 94.31.239.178 > 94.254.41.152 > 94.255.162.90 > 95.78.245.54 > 95.106.34.92 > 95.161.236.182 > 96.57.103.19 > 101.0.43.13 > 108.203.68.245 > 110.55.108.215 > 110.136.233.10 > 112.133.69.176 > 112.165.93.130 > 112.186.42.216 > 113.5.224.110 > 113.161.64.11 > 113.169.18.153 > 113.171.98.158 > 113.172.4.204 > 113.183.204.112 > 113.188.44.246 > 114.32.28.219 > 114.32.87.32 > 114.32.189.5 > 114.34.29.167 > 114.34.170.10 > 114.35.153.123 > 114.226.53.133 > 115.76.127.118 > 116.73.65.248 > 116.100.170.92 > 117.0.7.77 > 117.1.26.234 > 117.195.254.3 > 118.32.44.99 > 118.42.15.21 > 118.43.112.120 > 118.100.64.159 > 118.163.191.208 > 119.199.160.207 > 119.202.78.47 > 120.71.215.81 > 121.129.203.22 > 121.178.104.129 > 121.180.53.143 > 122.117.245.28 > 123.9.72.86 > 123.16.78.77 > 123.23.49.149 > 123.24.108.10 > 123.24.250.187 > 123.25.74.209 > 123.27.159.13 > 123.240.245.72 > 124.66.99.251 > 124.131.28.38 > 125.166.193.206 > 125.227.138.132 > 138.204.203.66 > 171.97.245.221 > 171.224.7.147 > 171.226.20.220 > 171.232.118.93 > 171.248.210.120 > 171.249.223.213 > 171.250.26.209 > 173.56.21.67 > 175.138.81.130 > 175.203.202.232 > 175.207.137.139 > 175.211.251.156 > 177.207.49.108 > 177.207.67.170 > 177.223.52.193 > 178.222.246.96 > 179.4.140.63 > 179.235.55.39 > 179.253.163.107 > 180.73.117.62 > 180.254.224.10 > 182.37.156.98 > 182.180.80.75 > 182.180.123.43 > 183.46.49.216 > 183.144.245.235 > 186.19.48.158 > 186.69.170.130 > 186.219.1.156 > 187.104.248.17 > 187.211.63.51 > 188.209.153.15 > 189.101.220.244 > 189.234.9.147 > 191.103.35.250 > 191.180.198.31 > 191.249.21.41 > 196.207.83.23 > 197.224.37.108 > 201.243.225.103 > 210.178.250.121 > 211.7.146.51 > 211.216.202.191 > 213.5.216.213 > 213.14.195.100 > 213.170.76.149 > 217.129.243.48 > 218.161.121.178 > 218.186.43.224 > 220.85.169.133 > 220.132.111.124 > 220.133.24.142 > 220.133.198.71 > 220.133.234.229 > 220.134.132.200 > 220.134.193.133 > 220.135.64.43 > 221.145.147.78 > 221.159.105.17 > 221.167.64.53 > 222.254.238.188 > 223.154.223.159

5 4

Contact at NY State Health Department
by Eric C. Miller 15 Nov '16

15 Nov '16

Is there anyone from NY State Health Department here that can help me with random connection drops? Thank you! Eric Miller

1 0

Gmail failure recently?
by Hank Nussbacher 15 Nov '16

15 Nov '16

I woke today to find that all my Inbox items from May 1-Nov 15, 2016 were missing. All other folders are intact. Missing emails are not in Spam, Trash, Archive or auto-fwded. Did pswd reset and have initiated a request to restore the missing emails, but am wondering whether others have experienced some sort of Gmail failure in the past 8 hours. Thanks, Hank

2 1

Re: NEVERMIND! (was: Seeking Google reverse DNS delegation
by Brett Frankenberger 15 Nov '16

15 Nov '16

contact) User-Agent: Mutt/1.6.1 (2016-04-27) On Sun, Nov 13, 2016 at 03:57:19PM -0800, Christopher Morrow wrote: > So... actually someone did tell arin to aim these at > ns1/2google.com... > I'll go ask arin to 'fix the glitch'. For 138.8.204.in-addr.arpa ... ARIN is delegating to ns[12].saversagreeable.com The NS records on the saversagreeable.com servers are pointing to ns[12].google.com. > > http://pastebin.com/raw/VNwmgMHh -- Brett

3 3

Eisenach & the FCC - was: [Re: Here we go again.]
by Scott Weeks 14 Nov '16

14 Nov '16

--- jfmezei_nanog(a)vaxination.ca wrote: The president elect chose Mr Eisenach to help fill jobs in FCC and other telecom areas of govt. ---------------------------------------------------- That'll have impact on ops, if some of the papers are correct. Briefly: https://www.engadget.com/2016/11/09/under-trump-the-future-of-net-neutralit… "Eisenach has made a career out of crusading against industry regulation" "...authored several papers and op-ed pieces that were funded by Net Neutrality opponents ..." http://www.businessinsider.com/donald-trump-fcc-net-neutrality-zero-rating-… "The Economics of Zero Rating." In it, Eisenach defends the concept, writing that "broad-based bans or restrictions on zero-rating plans are likely to be counterproductive and harm consumer welfare." Interesting times ahead... scott

4 4

WHOIS Privacy & Proxy Services?
by Ryan Finnesey 14 Nov '16

14 Nov '16

Is there any news out of the ICANN meeting that just concluded regarding new policy's around WHOIS Privacy & Proxy Services?

2 2

Re: Eisenach & the FCC - was: [Re: Here we go again.]
by Scott Weeks 14 Nov '16

14 Nov '16

--- mel(a)beckman.org wrote: From: Mel Beckman <mel(a)beckman.org> This is discussing politics, not the "operational and technical issues" of NANOG's charter. ------------------------------------------- BTW, I didn't mean it to be talking politics. He was mentioned in the current discussion, I looked into a little more depth on the person and I thought it'd be interesting to the group. scott

1 0

pay.gov and IPv6
by Carl Byington 13 Nov '16

13 Nov '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Following up on a two year old thread, one of my clients just hit this problem. The failure is not that www.pay.gov is not reachable over ipv6 (2605:3100:fffd:100::15). They accept (TCP handshake) the port 443 connection, but the connection then hangs waiting for the TLS handshake. openssl s_client -connect www.pay.gov:443 openssl s_client -servername www.pay.gov -connect 199.169.192.21:443 Browsers (at least firefox) see that as a very slow site, and it does not trigger their happy eyeballs fast failover to ipv4. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iEYEAREKAAYFAlgoo9AACgkQL6j7milTFsEIhwCfS2nVWDwjGk5LLaPpAntLC8la RpMAniYdP2OmTcx4+lJmaIu538LK9pqJ =SOdT -----END PGP SIGNATURE-----

1 0