- Test - lists.nanog.org

Re: One more thing to watch out for at data centers - fire drills
by Larry Sheldon 18 Sep '16

18 Sep '16

On 9/17/2016 07:39, Suresh Ramasubramanian wrote: > http://motherboard.vice.com/read/a-loud-sound-just-shut-down-a-banks-data-c… > > Releasing inert gas from fire suppression units that were over > pressurized resulted in an extremely loud noise My experience is only with in-specification systems (and only in tape libraries) but those tests were pretty loud. – causing cabinets > full of hard drives to vibrate – which got transmitted to the read – > write heads of the drives. My experiences were back in the days of washing-machine class disc drives and they were a 4-hour fire-wall away, but I don't remember them being impacted. (I can't believe that I was allowed to conduct a test with them running, but I don't remember shutting them down.) I wonder if orientation mattered--mine were all platters parallel to the floor, I wonder if the damaged ones were parallel to the wave front. > full of hard drives to vibrate – which got transmitted to the read – > write heads of the drives. > > Amazing sort of outage + data loss, and this time the physical > security plant chief gets to write up the RCA. -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

2 1

Re: "Defensive" BGP hijacking?
by Sean Rose 17 Sep '16

17 Sep '16

I know Bryant Townsend (ex staminus employee), Marshal Webb (aka m_nerva, lulzsec informant) and others from backconnect.net performed a similar BGP hijacking against staminus earlier this year. https://bgpstream.com/event/21051 Shortly afterwards, on 10th of march a zine is released leaking the Staminus user database and contents of several customer servers. The times aren't the only interesting factor here, even the format of the release just screams m_nerva. Zines are very rare these days. So rare in fact that the last similar zine before the staminus hack was released in 2013 by HTP, a hacker group m_nerva was loosely affiliated with during it's early days. I *strongly* believe Bryant Townsend and Marshal Webb hacked Staminus and produced the "Fuck 'em all." zine Sean Rose

1 1

Re: One more thing to watch out for at data centers - fire drills
by hcb＠netcases.net 17 Sep '16

17 Sep '16

On 2016-09-17 08:39, Suresh Ramasubramanian wrote: > http://motherboard.vice.com/read/a-loud-sound-just-shut-down-a-banks-data-c… > > Releasing inert gas from fire suppression units that were over > pressurized resulted in an extremely loud noise – causing cabinets > full of hard drives to vibrate – which got transmitted to the read – > write heads of the drives. > > Amazing sort of outage + data loss, and this time the physical > security plant chief gets to write up the RCA. > > --srs Another unexpected result when we had an all-out Halon test: thick fog, apparently from cold gas and somewhat humid air. I'm glad to have been watching through windows. Visibility in the room dropped to zero.

2 1

One more thing to watch out for at data centers - fire drills
by Suresh Ramasubramanian 17 Sep '16

17 Sep '16

http://motherboard.vice.com/read/a-loud-sound-just-shut-down-a-banks-data-c… Releasing inert gas from fire suppression units that were over pressurized resulted in an extremely loud noise – causing cabinets full of hard drives to vibrate – which got transmitted to the read – write heads of the drives. Amazing sort of outage + data loss, and this time the physical security plant chief gets to write up the RCA. --srs

2 1

Anyone with a clue at Zayo?
by Patrick Sumby 17 Sep '16

17 Sep '16

Have a turnup we've been working on all day and no luck so far. Now we're being told that nobody can help outside hours :( Any help much appreciated. Thanks Pat

2 1

Weekly Routing Table Report
by cscora＠apnic.net 16 Sep '16

16 Sep '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 17 Sep, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 609829 Prefixes after maximum aggregation (per Origin AS): 220069 Deaggregation factor: 2.77 Unique aggregates announced (without unneeded subnets): 297950 Total ASes present in the Internet Routing Table: 54857 Prefixes per ASN: 11.12 Origin-only ASes present in the Internet Routing Table: 36396 Origin ASes announcing only one prefix: 15402 Transit ASes present in the Internet Routing Table: 6516 Transit-only ASes present in the Internet Routing Table: 168 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 54 Max AS path prepend of ASN ( 55644) 51 Prefixes from unregistered ASNs in the Routing Table: 60 Unregistered ASNs in the Routing Table: 15 Number of 32-bit ASNs allocated by the RIRs: 15444 Number of 32-bit ASNs visible in the Routing Table: 11945 Prefixes from 32-bit ASNs in the Routing Table: 47636 Number of bogon 32-bit ASNs visible in the Routing Table: 84 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 347 Number of addresses announced to Internet: 2826656228 Equivalent to 168 /8s, 123 /16s and 89 /24s Percentage of available address space announced: 76.3 Percentage of allocated address space announced: 76.3 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.3 Total number of prefixes smaller than registry allocations: 197571 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 156454 Total APNIC prefixes after maximum aggregation: 42942 APNIC Deaggregation factor: 3.64 Prefixes being announced from the APNIC address blocks: 169988 Unique aggregates announced from the APNIC address blocks: 68960 APNIC Region origin ASes present in the Internet Routing Table: 5194 APNIC Prefixes per ASN: 32.73 APNIC Region origin ASes announcing only one prefix: 1156 APNIC Region transit ASes present in the Internet Routing Table: 946 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 54 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2380 Number of APNIC addresses announced to Internet: 759640004 Equivalent to 45 /8s, 71 /16s and 47 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 183986 Total ARIN prefixes after maximum aggregation: 89627 ARIN Deaggregation factor: 2.05 Prefixes being announced from the ARIN address blocks: 189745 Unique aggregates announced from the ARIN address blocks: 88444 ARIN Region origin ASes present in the Internet Routing Table: 16204 ARIN Prefixes per ASN: 11.71 ARIN Region origin ASes announcing only one prefix: 5699 ARIN Region transit ASes present in the Internet Routing Table: 1705 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1467 Number of ARIN addresses announced to Internet: 1106648544 Equivalent to 65 /8s, 246 /16s and 29 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 145716 Total RIPE prefixes after maximum aggregation: 71812 RIPE Deaggregation factor: 2.03 Prefixes being announced from the RIPE address blocks: 156009 Unique aggregates announced from the RIPE address blocks: 96512 RIPE Region origin ASes present in the Internet Routing Table: 18132 RIPE Prefixes per ASN: 8.60 RIPE Region origin ASes announcing only one prefix: 7832 RIPE Region transit ASes present in the Internet Routing Table: 3032 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 27 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5048 Number of RIPE addresses announced to Internet: 708290048 Equivalent to 42 /8s, 55 /16s and 166 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 61300 Total LACNIC prefixes after maximum aggregation: 12400 LACNIC Deaggregation factor: 4.94 Prefixes being announced from the LACNIC address blocks: 77048 Unique aggregates announced from the LACNIC address blocks: 37423 LACNIC Region origin ASes present in the Internet Routing Table: 2473 LACNIC Prefixes per ASN: 31.16 LACNIC Region origin ASes announcing only one prefix: 541 LACNIC Region transit ASes present in the Internet Routing Table: 583 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 22 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2789 Number of LACNIC addresses announced to Internet: 170641728 Equivalent to 10 /8s, 43 /16s and 201 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 14676 Total AfriNIC prefixes after maximum aggregation: 3278 AfriNIC Deaggregation factor: 4.48 Prefixes being announced from the AfriNIC address blocks: 16692 Unique aggregates announced from the AfriNIC address blocks: 6293 AfriNIC Region origin ASes present in the Internet Routing Table: 734 AfriNIC Prefixes per ASN: 22.74 AfriNIC Region origin ASes announcing only one prefix: 174 AfriNIC Region transit ASes present in the Internet Routing Table: 181 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 261 Number of AfriNIC addresses announced to Internet: 81097728 Equivalent to 4 /8s, 213 /16s and 116 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5553 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3514 382 250 TPG-INTERNET-AP TPG Telecom Limited, AU 4766 3113 11142 1062 KIXS-AS-KR Korea Telecom, KR 17974 2945 904 78 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9829 2688 1496 528 BSNL-NIB National Internet Backbone, IN 9808 2250 8781 42 CMNET-GD Guangdong Mobile Communication 4755 2052 429 218 TATACOMM-AS TATA Communications formerl 4808 1761 2295 528 CHINA169-BJ China Unicom Beijing Provin 45899 1727 1235 89 VNPT-AS-VN VNPT Corp, VN 24560 1542 510 221 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3514 2964 145 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6389 2219 3671 41 BELLSOUTH-NET-BLK - BellSouth.net Inc., 18566 2195 405 110 MEGAPATH5-US - MegaPath Corporation, US 20115 1938 1977 404 CHARTER-NET-HKY-NC - Charter Communicat 30036 1738 337 332 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1717 5070 652 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1676 848 227 ITCDELTA - Earthlink, Inc., US 16509 1394 2532 466 AMAZON-02 - Amazon.com, Inc., US 7018 1370 20092 1008 ATT-INTERNET4 - AT&T Services, Inc., US 11492 1288 230 622 CABLEONE - CABLE ONE, INC., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3329 169 15 ALJAWWALSTC-AS , SA 20940 2791 1059 1980 AKAMAI-ASN1 , US 34984 1974 327 356 TELLCOM-AS , TR 12479 1331 1018 46 UNI2-AS , ES 13188 1234 99 62 BANKINFORM-AS , UA 8551 1206 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 6849 1144 355 21 UKRTELNET , UA 8402 1078 544 15 CORBINA-AS Russia, RU 12389 925 1113 401 ROSTELECOM-AS , RU 6830 886 2752 465 LGI-UPC formerly known as UPC Broadband Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3479 539 195 Telmex Colombia S.A., CO 8151 2275 3382 561 Uninet S.A. de C.V., MX 7303 1544 955 245 Telecom Argentina S.A., AR 6503 1397 437 55 Axtel, S.A.B. de C.V., MX 11830 1327 367 57 Instituto Costarricense de Electricidad 7738 994 1882 40 Telemar Norte Leste S.A., BR 3816 966 467 206 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 28573 911 2181 167 CLARO S.A., BR 11172 907 125 76 Alestra, S. de R.L. de C.V., MX 18881 883 1036 22 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1179 402 50 LINKdotNET-AS, EG 36903 684 344 115 MT-MPLS, MA 37611 668 51 5 Afrihost, ZA 36992 547 1373 25 ETISALAT-MISR, EG 8452 543 1472 15 TE-AS TE-AS, EG 37492 384 250 69 ORANGE-TN, TN 24835 345 610 16 RAYA-AS, EG 29571 301 37 12 CITelecom-AS, CI 15399 297 35 6 WANANCHI-KE, KE 2018 269 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5553 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3514 382 250 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3514 2964 145 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3479 539 195 Telmex Colombia S.A., CO 39891 3329 169 15 ALJAWWALSTC-AS , SA 4766 3113 11142 1062 KIXS-AS-KR Korea Telecom, KR 17974 2945 904 78 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2791 1059 1980 AKAMAI-ASN1 , US 9829 2688 1496 528 BSNL-NIB National Internet Backbone, IN 8151 2275 3382 561 Uninet S.A. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3514 3369 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 39891 3329 3314 ALJAWWALSTC-AS , SA 10620 3479 3284 Telmex Colombia S.A., CO 7545 3514 3264 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2945 2867 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2250 2208 CMNET-GD Guangdong Mobile Communication 6389 2219 2178 BELLSOUTH-NET-BLK - BellSouth.net Inc., 9829 2688 2160 BSNL-NIB National Internet Backbone, IN 18566 2195 2085 MEGAPATH5-US - MegaPath Corporation, US 4766 3113 2051 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65512 PRIVATE 45.252.244.0/24 45899 VNPT-AS-VN VNPT Corp, VN 65512 PRIVATE 45.252.245.0/24 45899 VNPT-AS-VN VNPT Corp, VN Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.249.144.0/20 40430 COLO4JAX-AS - colo4jax, LLC, US 24.49.144.0/20 30164 USACOMMUNICATIONS-1 - USA COMPANIES, LP 27.100.7.0/24 56096 UNKNOWN 41.73.1.0/24 37004 -Reserved AS-, ZZ 41.73.2.0/24 37004 -Reserved AS-, ZZ 41.73.3.0/24 37004 -Reserved AS-, ZZ 41.73.4.0/24 37004 -Reserved AS-, ZZ 41.73.5.0/24 37004 -Reserved AS-, ZZ 41.73.6.0/24 37004 -Reserved AS-, ZZ 41.73.7.0/24 37004 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:101 /12:269 /13:518 /14:1052 /15:1768 /16:13136 /17:7840 /18:12986 /19:25332 /20:38742 /21:40307 /22:67944 /23:59536 /24:338713 /25:531 /26:511 /27:344 /28:55 /29:32 /30:13 /31:1 /32:33 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 39891 2896 3329 ALJAWWALSTC-AS , SA 22773 2739 3514 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2087 2195 MEGAPATH5-US - MegaPath Corporation, US 30036 1552 1738 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 6389 1418 2219 BELLSOUTH-NET-BLK - BellSouth.net Inc., 10620 1401 3479 Telmex Colombia S.A., CO 6983 1326 1676 ITCDELTA - Earthlink, Inc., US 34984 1257 1974 TELLCOM-AS , TR 11492 1190 1288 CABLEONE - CABLE ONE, INC., US 13188 1011 1234 BANKINFORM-AS , UA Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1631 2:776 4:22 5:2169 6:27 8:990 12:1803 13:42 14:1740 15:47 16:2 17:95 18:126 20:50 22:1 23:1836 24:1804 27:2325 31:1781 32:85 33:4 35:5 36:323 37:2311 38:1254 39:36 40:97 41:2909 42:452 43:1859 44:47 45:2140 46:2554 47:95 49:1212 50:905 51:13 52:547 54:344 55:6 56:7 57:42 58:1569 59:1015 60:376 61:1821 62:1514 63:1923 64:4547 65:2179 66:4266 67:2205 68:1118 69:3256 70:1282 71:527 72:2031 74:2547 75:399 76:413 77:1380 78:1210 79:908 80:1293 81:1400 82:988 83:708 84:856 85:1565 86:486 87:1125 88:545 89:2086 90:204 91:6061 92:947 93:2365 94:2448 95:2472 96:521 97:340 98:939 99:90 100:78 101:1152 103:12319 104:2469 105:108 106:432 107:1403 108:671 109:2257 110:1269 111:1625 112:1054 113:1271 114:1078 115:1683 116:1659 117:1553 118:2031 119:1584 120:936 121:1118 122:2266 123:2070 124:1571 125:1835 128:670 129:438 130:414 131:1353 132:611 133:175 134:485 135:192 136:387 137:409 138:1895 139:424 140:574 141:456 142:662 143:933 144:735 145:165 146:942 147:653 148:1391 149:531 150:665 151:884 152:666 153:297 154:676 155:946 156:526 157:524 158:391 159:1232 160:511 161:733 162:2394 163:544 164:773 165:1118 166:334 167:1183 168:2175 169:669 170:1920 171:254 172:701 173:1686 174:758 175:669 176:1726 177:3996 178:2234 179:1186 180:2157 181:1767 182:2051 183:996 184:827 185:7399 186:3202 187:2142 188:2166 189:1767 190:7346 191:1272 192:9037 193:5724 194:4456 195:3855 196:1771 197:1146 198:5567 199:5760 200:7116 201:3597 202:10124 203:9822 204:4512 205:2744 206:2972 207:3076 208:4044 209:3862 210:3887 211:2036 212:2739 213:2332 214:870 215:70 216:5791 217:1979 218:805 219:609 220:1631 221:885 222:700 223:1305 End of report

1 0

QWEST.NET can you fix your nameservers
by Mark Andrews 16 Sep '16

16 Sep '16

In case anyone is wondering why I've been harping on about EDNS compliance this is why. Failure to follow the protocol can result in DNS lookup failures. nara.gov is signed and the recursive server performs DNSSEC validation and sends queries with DNS COOKIEs. BADVERS is NOT a valid response to a EDNS version 0 query. Can you please contact your DNS vendor for a fix. QWEST isn't the only DNS provider that has broken nameservers. One shouldn't have to try and contact every DNS operator to get them to use protocol compliant servers. Mark ;; BADCOOKIE, retrying. ; <<>> DiG 9.11.0rc1 <<>> nara.gov ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 5744 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 85faf1e39a1a6a149bebd00a57da4b266b8546c1b75015db (good) ;; QUESTION SECTION: ;nara.gov. IN A ;; Query time: 5000 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Sep 15 17:17:58 EST 2016 ;; MSG SIZE rcvd: 65 Checking: 'nara.gov' as at 2016-09-15T07:16:32Z nara.gov @63.150.72.5 (sauthns1.qwest.net.) dns=ok edns=ok edns1=ok edns@512=ok ednsopt=badvers,nosoa edns1opt=ok do=nodo ednsflags=ok edns@512tcp=ok optlist=badvers,nosoa nara.gov @2001:428::7 (sauthns1.qwest.net.) dns=ok edns=ok edns1=ok edns@512=ok ednsopt=badvers,nosoa edns1opt=ok do=nodo ednsflags=ok edns@512tcp=ok optlist=badvers,nosoa nara.gov @208.44.130.121 (sauthns2.qwest.net.) dns=ok edns=ok edns1=ok edns@512=ok ednsopt=badvers,nosoa edns1opt=ok do=nodo ednsflags=ok edns@512tcp=ok optlist=badvers,nosoa nara.gov @2001:428::8 (sauthns2.qwest.net.) dns=ok edns=ok edns1=ok edns@512=ok ednsopt=badvers,nosoa edns1opt=ok do=nodo ednsflags=ok edns@512tcp=ok optlist=badvers,nosoa The Following Tests Failed EDNS - Unknown Option Handling (ednsopt) dig +nocookie +norec +noad +ednsopt=100 soa zone @server expect: SOA expect: NOERROR expect: OPT record with version set to 0 expect: that the option will not be present in response See RFC6891, 6.1.2 Wire Format EDNS - DO=1 (do) dig +nocookie +norec +noad +dnssec soa zone @server expect: SOA expect: NOERROR expect: OPT record with version set to 0 expect: DO flag in response if RRSIG is present in response See RFC3225 EDNS - Supported Options Probe (optlist) dig +edns +noad +norec +nsid +subnet=0.0.0.0/0 +expire +cookie -q zone @server expect: NOERROR expect: OPT record with version set to 0 See RFC6891 Codes ok - test passed. nodo - EDNS DO flag not echoed. nosoa - SOA record not found when expected. badvers - BADVERS returned. To retrieve this report in the future: https://ednscomp.isc.org/ednscomp/25f2ebe619 -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

6 12

Lawsuits for falsyfying DNS responses ?
by Jean-Francois Mezei 16 Sep '16

16 Sep '16

As many may know, the province of Québec has passed a law to protect the interests of its lottery corporation. To do so, it will provide ISPs with list of web sites to block (aka: only allow its own gambing web site). There is an opportunity to comment this week in which I will submit. (I've gathered many arguments over the past little while already). But have a specific question today: Are there examples of an ISP getting sued because it redirected traffic that should have gone to original site ? For instance, user asks for www.google.com and ISP's DNS responds with an IP that points to a bing server? If the risk of a lawsuit is real, then it brings new dimension to arguments already made agains that (stupiod) Québec law. (And it also creates interesting issues for DNS servers from companies such as Google which may have a anycast server located in Québec but are not considered an ISP and won't receive those documenst from the gov with list of websites to block.

11 13

Re: ___Your___$ __l O O O Walmart___GiftCard
by Aaron C. de Bruyn 15 Sep '16

15 Sep '16

That's interesting. heyaaron.com is one big huge catch-all that funnels into my Google Apps for Domains mailbox. There's one account, it has a good password, and it's protected by a Ubikey. I'd be interested in seeing a copy of the headers from that e-mail. -A On Thu, Sep 15, 2016 at 3:15 PM, Brian majors <majors200(a)gmail.com> wrote: > I am reporting you to the Fed scammer > > On Sep 15, 2016 6:10 PM, "__WLM__" <textayaro(a)heyaaron.com> wrote: > > > > Congarts____This__is Your____$ l O O O ____GiftCard >

1 0

Can someone from Amazon please answer.
by Mark Andrews 15 Sep '16

15 Sep '16

I'm curious. What are you trying to achieve by blocking EDNS version negotiation? Is it really too hard to return BADVERS to a EDNS query with version != 0 along with the version of EDNS you support in the version field? Are you deliberately trying to prevent the IETF from deciding to bump the EDNS version in the future? Do you have firewalls that have this behaviour hard coded? Do you even test for RFC compliance? Mark lostoncampus.com.au. @205.251.195.156 (ns-924.awsdns-51.net.) dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok,nsid,subnet signed=ok ednstcp=ok lostoncampus.com.au. @205.251.192.78 (ns-78.awsdns-09.com.) dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok,nsid,subnet signed=ok ednstcp=ok lostoncampus.com.au. @205.251.196.198 (ns-1222.awsdns-24.org.) dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok,nsid,subnet signed=ok ednstcp=ok lostoncampus.com.au. @205.251.199.20 (ns-1812.awsdns-34.co.uk.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok,nsid,subnet signed=ok ednstcp=ok -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

5 8