- NANOG - lists.nanog.org

Re: Don't press the big red buttom on the wall!
by Chris Dunn 02 Sep '16

02 Sep '16

On Mon, Aug 29, 2016 at 4:51 PM, Sean Donelan <sean(a)donelan.com> wrote: > > See that big red button on the wall under the sign "Do Not Push This > Button!".... > > > This is going to date me, well, because it happened in my high school years mid 1970's... but my best power off story was when in senior year we were working on the school Sperry/Univac Solid State Systems 90 mainframe. ( https://en.wikipedia.org/wiki/UNIVAC_Solid_State) Well this thing used a Mil-Spec 4K DRUM as its main memory. Now being mil-spec means the motor to spin the drum is 400 cycle AC. Where do you get 400 cycle AC in a 60 cycle world? Well you install a 60 cycle motor in the base of this monstrosity, and connect it via a fan belt to a 400 cycle AC generator that feeds the drum. We came in to class one day to warm the Univac up (it took about 30 minutes to fully power up) and noticed the machine being very quiet when we applied power. We eventually tracked it down to no power to the drum and it not spinning. And the reason the drum was not spinning? The fan belt had broken on the motor/generator set. :) Lucky, this was a Technical/Vocational high school, and we ran down to the auto repair class and bummed a new belt off them. :) ---- Then there was the time an engineer I worked with pressed the lamp test button on the huge engineering console display for a Burroughs B6700 room sized mainframe (like 3 foot by 3 foot bank of incandescent register and status displays) and the inrush caused the entire machine shut down.... but that's another story. ;) Chris Dunn Data Center Operations ServerCentral

1 0

Arbor Reports 540Gbps "Sustained" Attack
by Dennis B 01 Sep '16

01 Sep '16

https://www.arbornetworks.com/blog/asert/rio-olympics-take-gold-540gbsec-su… I've used SP Peakflow before and I have my opinions. With all the intelligence out there about DDoS attacks, DDoS attackers, DDoS tools and techniques this article leaves me with ton's of questions. IE: What industry was the attack target? Was it a single customer or multiple customers at the same time? What was the attack vector? Was it multi-vector? What was the duration of the 540Gbps attack? Did you actually block the attack or did you just report on it from your cloud signaling alliance aka cloud offering? Could you help explain if the peak of the attack lasted X minutes, Y hours, Z days? What was the attack targeted protocol? Was it TCP against TCP or UDP against UDP or UDP against TCP? I have to be honest, IDK if Arbor is attempting to claim the largest recorded DDoS attack in the world cup of DDoS attacks but the fact that your a local appliance shop. Selling to the global 100 and T1-3 ISPs - I'd hope for more than a marketing ploy to take the top attack vector. Thought I'd ask Nanog if they heard any whispers about this "white buffalo", which ISPs were Transiting the event, what course of actions were taken. Thanks!

2 1

Don't press the big red buttom on the wall!
by Sean Donelan 01 Sep '16

01 Sep '16

See that big red button on the wall under the sign "Do Not Push This Button!".... DC 911 outage caused by contractor error http://wtop.com/dc/2016/08/dc-911-outage-caused-by-contractor-who-pulled-wr… WASHINGTON — D.C. is now operating two separate 911 centers after a power outage caused by human error left the nation’s capital without any emergency phone service for almost an hour on a busy weekend night. A contractor working Saturday night inadvertently pulled an emergency power shut off switch that cut electricity to the 911 phone system and a call routing system at the District’s Unified Communications Center, said the center’s Director Karima Holmes. “Unfortunately because it was human error we weren’t prepared for it,” Holmes said. [...]

11 16

IPv4 Broker
by Lorenzo Mainardi 01 Sep '16

01 Sep '16

Do you know any good IPv4 broker? I need a /20. Regards

7 7

routing at IXPs privacy survey
by Marco Chiesa 31 Aug '16

31 Aug '16

Hi all, as part of our academic effort to devise more powerful routing services at Internet eXchange Points (IXPs), we aim to understand the privacy considerations of network operators in the context of peering with other networks, in general, and at IXPs in particular. We created a short survey for gathering some real-world operational information and we need help from you - network operators - to fill it. The survey will take less than 5 minutes. Link to the survey: http://goo.gl/1e7cDG The survey is fully anonymized (unless you explicitly choose to reveal your identity) and the resulting data analysis will only be presented via aggregate statistics and in an anonymized format. We look forward to receiving your responses! You can find more information, including a short paper about our current research work, on our website: http://six-pack.bitbucket.org/ Thanks for your help, Marco Chiesa (UC Louvain), Marco Canini (UC Louvain), Daniel Demmler (TU Darmstadt), Michael Schapira (Hebrew University of Jerusalem) & Thomas Schneider (TU Darmstadt)

1 0

Need abuse/postmaster contact for AT&T to resolve IP block
by Webhosting.net Admin 31 Aug '16

31 Aug '16

A few of our exchange IPs get blocked intermittently, but only by ATT. Ips are clean, no issues, we’re diligent about finding and fixing these types of issues as it has a large impact. It would be very helpful to know why the IP below got blocked so we can find and fix the problem to prevent further listing. We have a few ips in rotation and some have no issue. It’s a “blind” listing, so we only find out about it when customers complain that they getting blocked. ff-ip4-mx-vip1.prodigy.net #<ff-ip4-mx-vip1.prodigy.net #5.3.0 smtp; 553 5.3.0 flph399 DNSBL:ATTRBL 521< 67.215.167.170 >_is_blocked.__For_information_see_http://att.net/blocks> #SMTP# Any info/help would be most helpful. Many thanks, Webhosting.net Postmaster

4 3

Cloudflare reverse DNS SERVFAIL, normal?
by Jeremy 31 Aug '16

31 Aug '16

We're seeing a huge uptick in reverse dns lookup failures across an app, 99% are all for Cloudflare ip addresses. Instead of seeing a PTR or NXDOMAIN we're getting back SERVFAIL. Does anyone know if this is a standard response from them? Do they not have reverse DNS setup for their networks? Trying to narrow this down to see if it's a result in a change in how our application handles these errors or if there's an issue going on with cloudflare's DNS setup. Thanks! Jeremy

8 13

Looking for Spamhaus contact
by Hristo Dimitrov 30 Aug '16

30 Aug '16

Hi, Could somebody from Spamhaus contact me offlist? I've run in the case "[CIDR] conflicts with other PBL master records" where the whole range previously seems to have belonged to another ISP who has returned the range to RIPE. However they still have it listed in a PBL and it is not possible to contact them. As per Spamhaus FAQ "...contact Spamhaus directly to obtain control of those Master Ranges. There is a contact address in your PBL Account." The issue is that I do not see a Spamhaus contact address in our PBL account. And there doesn't seem to be any other conventional way to contact Spamhaus... Best regards, Hristo D.

1 1

Handling of Abuse Complaints
by Jason Lee 30 Aug '16

30 Aug '16

NANOG Community, I was curious how various players in this industry handle abuse complaints. I'm drafting a policy for the service provider I'm working for about handing of complaints registered against customer IP space. In this example I have a customer who is running an open resolver and have received a few complaints now regarding it being used as part of a DDoS attack. My initial response was to inform the customer and ask them to fix it. Now that its still ongoing over a month later, I'd like to take action to remediate the issue myself with ACLs but our customer facing team is pushing back and without an idea of what the industry best practice is, management isn't sure which way to go. I'm hoping to get an idea of how others handle these cases so I can develop our formal policy on this and have management sign off and be able to take quicker action in the future. Thanks, Jason

14 14

ARIN 2016 Election - Nominations and Voter Eligibility
by John Curran 29 Aug '16

29 Aug '16

Folks - For those of you associated with ARIN member organizations, please note two important deadlines fast approaching - 31 August<x-apple-data-detectors://11> is the last day for ARIN Members to nominate candidates to serve on the ARIN Board of Trustees and/or Advisory Council. Note that 31 August is also the last day to nominate candidates to represent the ARIN region on the NRO Number Council (and anyone in the community may make such a nomination.) Submit your nomination(s) at https://www.surveymonkey.com/r/ARIN2016 and find more information about ARIN elections at: https://www.arin.net/participate/elections/ Each ARIN member organization may cast one ballot in the ARIN elections and voting is done by their Voting Contact on record. New this year, all Voting Contacts must be linked to an ARIN Online account in order to cast their ballot. 6 September<x-apple-data-detectors://14> is the deadline to have that account linked and otherwise ensure that your organization is eligible to vote. Information is available at: https://www.arin.net/about_us/membership/votingcontacts.html or please reach out to members(a)arin.net<mailto:members@arin.net> today with questions or requests for assistance. Thanks for your time and interest in the governance of ARIN! /John John Curran President and CEO American Registry for Internet Numbers (ARIN)

1 0