October 2003 - Test - lists.nanog.org

abuse from a user of this list
by Andrew D Kirch 16 Oct '03

16 Oct '03

Last night in conjunction with the attacks on my DSL line and the Summit Open Source Development Group, I received a threatening phone call on my home business line at 1:44 in the morning (GMT-5 CST Indiana-East). My roommate answered the call, and the dialog was simply "how's your DSL B----!", then the caller hung up. This evening my roommate informed me of the call, and told me that the caller had not blocked caller ID, the number in question being 320-282-5940. I tracked this number to a T Mobile cellphone in St Cloud, MN. Thinking this might be the kiddie responsible for the attack I made a *67 call back. I was greeted with the voice mail of Matthew Hallacy (AKA poptix) who has used this forum to take cheap shots at myself and my staff repeatedly. Now he has denigrated to simple threats and harassment off list that didn't even get to me but to my roommate who is entirely uninvolved in this. I must note that this incident greatly saddened me, as I would have thought that all on this list have suffered Denial of Service attacks, and understand the seriousness and severity of these attacks, obviously one of us doesn't get it. please contact me if you have questions regarding this incident. -- Andrew D Kirch | trelane(a)2mbit.com | Security Admin | Summit Open Source Development Group | www.sosdg.org

8 10

Blocking servers: Comcast accidently blocks gamers
by Sean Donelan 15 Oct '03

15 Oct '03

People use the Internet for a lot of different reasons. Its not all client/server access. End-to-end communications occurs between many applications. Its always interesting to watch what things break when ISPs start filtering ports, even if it happens accidently. http://news.com.com/2100-1043_3-5091176.html A Comcast representative confirmed that the problem was with the cable company. A routine upgrade of the software some Comcast routers use inadvertently blocked access to certain server ports, the representative said, adding that the problem was fixed late Monday. ISPs commonly use port-blocking rules to restrict access to a server that may be generating hacking attacks or other objectionable activity.

2 1

RIPE NCC allocations to African LIRs
by leo vegoda 15 Oct '03

15 Oct '03

Dear Colleagues, The RIPE NCC received the IPv4 address range 196.200.0.0/13 from ARIN in October 2003. This range will be used to make allocations and assignments to organisations based in African countries served by the RIPE NCC. This block is part of a /8 also used by ARIN. In order to reduce confusion the RIPE NCC will not assign prefixes longer than a /24 from it. You may wish to adjust any filters you have in place accordingly. More information on the IP space administered by the RIPE NCC can be found on our web site at: <http://www.ripe.net/ripe/docs/smallest-alloc-sizes.html> Kind regards, -- leo vegoda RIPE NCC Registration Services Manager

1 0

RE: Extreme BlackDiamond
by Michel Py 15 Oct '03

15 Oct '03

> Vivien M. wrote: > it does look like Randy hit the bounce option in pine A bounce that does not say "undeliverable"? Michel.

5 5

Re: ix's & prefix registration
by Suresh Ramasubramanian 15 Oct '03

15 Oct '03

Ayyasamy, Senthilkumar (UMKC-Student) writes on 10/15/2003 6:37 AM: > This is FUD. To my knowledge, your assertions have been clarified > by nixi folks. > https://ssl.cpsr.org/pipermail/india-gii/2003-June/004357.html you mean > (in fact...i can dare to add here that none of the connecting ISP's has > raised an issue on the multilateral peering clause...on the contrary some > ISP' want that..)..so there... Yeah, sure. *Some* ISPs want mandatory multilateral, I'm sure. > I agree with you that some of nixi exchange policies are not good. But, > they also dropped other dangerous policies ( e.g., nixi acting as a govt > mandated transit provider.) Also, in nixi case, exchange policies are set > by/to/for Indian ISPs (represented in nixi committee.) So, rather than > throwing clichés, you should participate in their mailing list and > convince them with constructive feedback. Man, a lot of us have given them our opinions, you know that. If they ask us (or better still, ask someone with clue like Bill Woodcock et al) then great. If they go on dancing to their own tune, very well then. The other "ideas" were dropped after a lot of hard work on several people's part. srs -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

1 0

AOL DNS Queries?
by Deepak Jain 15 Oct '03

15 Oct '03

Over the last 6 weeks, we have been noticing an increase in the #/speed of AOL DNS queries from say dns-01.ns.aol.com and dns-02.ns.aol.com. (say ~6mb/s of udp 53 alone to a single name server of a cluster). Obviously, this could be spoofed UDP, but I'd like to know if this is something others are seeing or something we should configure around. Has anyone else been noticing anything of this sort? The traffic pattern only appears on a few of our name servers. Given the slope of the graph, it could be growth related, it just isn't distributed the way one would typically expect. If you are an AOL DNS person, I can send you more information. Thanks in advance, Deepak Jain AiNET

1 0

RE: Block all servers?
by Eric Kuhnke 15 Oct '03

15 Oct '03

The TOS/AUP for most residential broadband connections already allows the ISP to shut off service or do anything they want to the customer without prior notice. It has been this way for at least 3 or 4 years, since the advent of @Home. Take a look at the TOS/AUP for Comcast, Shaw Cable, MSN DSL or similar... >Second, in the acceptable use policy for high speed connections, require >a "licence" of some kind. We have licenses/permits for our cars, our >dogs, our burglar alarms, for going fishing,..... Why not for broadband. >Actually I can see many reasons both to do it and not to do it, so this >is clearly an area where debate is reasonable.

13 24

Level3 direct sales rep in SJC area?
by Steve Francis 15 Oct '03

15 Oct '03

Anyone have a good level3 sales rep in the SJC area they can refer me to? We currently have a gigabit level3 circuit out of Equinix SJC, but through a reseller, as we were too small for level3 to talk to directly. (We only push about 50Mbps through level3 right now.) Of course, this means our support goes through the reseller too, and consequently sucks. So if we cannot get direct level3 support, we won't be renewing that contract. If we can, we want to consider getting it at another site, and possibly using some other services. So, if anyone has a good level3 contact, please send me their contact info. Thanks

1 0

Re: ix's & prefix registration
by Suresh Ramasubramanian 15 Oct '03

15 Oct '03

Niels Bakker <niels=nanog(a)bakker.net> writes: > AMS-IX does not, nor does it require its members to peer with anybody > (including the exchange-supporting network infrastructure). AMS-IX > believes that the decision to peer is up to the individual members. NIXI (http://www.nixi.org) - the national internet exchange of india - seems to enforce a mandatory multilateral peering policy (though their policy, and their setup, sure sounds like a godawful mess, right about now) :( Quoting from their membership agreement (a word doc at http://www.nixi.org/NIXI%20T&C_%20ver_%202.doc) - > Peering Policy of NIXI > > NIXI has adopted a Multilateral peering policy . Member ISPs shall > not refuse to accept traffic from other members. --srs

1 0

domainmonger.com with wildcard NS?
by Rick Ernst 15 Oct '03

15 Oct '03

This was brought to my attention by a friend. It looks like ns1.domainmonger.com and ns2.domainmonger.com are doing wildcard A records for all zones, including those that already exist. If you go to their site and try to register a domain, it properly shows if the domain exists or not. I'm trying to figure out what the reasoning is behind this. My friend alo pointed out this CERT alert, but I'm not sure how it relates: http://www.kb.cert.org/vuls/id/109475 Rick ------- ; <<>> DiG 9.2.3rc4 <<>> @ns1.domainmonger.com www.esdfsadfsdftreet.com a ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50340 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.esdfsadfsdftreet.com. IN A ;; ANSWER SECTION: www.esdfsadfsdftreet.com. 1200 IN A 216.52.102.86 ;; AUTHORITY SECTION: com. 1200 IN NS ns1.domainmonger.com. com. 1200 IN NS ns2.domainmonger.com. ;; Query time: 37 msec ;; SERVER: 216.98.150.33#53(ns1.domainmonger.com) ;; WHEN: Tue Oct 14 09:59:24 2003 ;; MSG SIZE rcvd: 107 ----- ; <<>> DiG 9.2.3rc4 <<>> @ns2.domainmonger.com www.legendz.com a ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40110 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.legendz.com. IN A ;; ANSWER SECTION: www.legendz.com. 1200 IN A 216.52.102.86 ;; AUTHORITY SECTION: com. 1200 IN NS ns1.domainmonger.com. com. 1200 IN NS ns2.domainmonger.com. ;; Query time: 91 msec ;; SERVER: 216.122.4.81#53(ns2.domainmonger.com) ;; WHEN: Tue Oct 14 10:01:28 2003 ;; MSG SIZE rcvd: 98

3 4