November 2003 - Test - lists.nanog.org

68.0.0.0/7 from 3303
by william＠elan.net 25 Nov '03

25 Nov '03

Would swisscom AS3303 please check your routers and stop this from propogating into routeviews... route-views.oregon-ix.net>sh ip bgp 68.0.0.0/7 BGP routing table entry for 68.0.0.0/7, version 12278613 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 3277 13062 20485 8437 3303 194.85.4.249 from 194.85.4.249 (194.85.4.249) Origin IGP, localpref 100, valid, external, best -- William Leibzon Elan Networks william(a)elan.net

4 3

SORBS DUL (Dynamic User List) announcement and suggestions welcome.
by Matthew Sullivan 24 Nov '03

24 Nov '03

For those that didn't see it, I believe it is on topic as it is relating to connectivity/locations of ISPs mailservers. --- Subject: Notice SORBS DNSbl users, regarding the easynet blacklists being discontinued Dec 1 2003 Hi All, As of a last night SORBS imported and merged the Easynet (Wirehub) Dynablock database into the SORBS DUL. SORBS also has included the Dynablock exceptions list and now has a mechanism to include more exceptions to the DUL should they be nessesary. Users of the EasyNet Dynablock are welcome to use the SORBS DUL, however please remember that the Dynablock list was merged with the SORBS DUL. The DUL is available on its own as: dul.dnsbl.sorbs.net It is also available via the aggregate zone: dnsbl.sorbs.net Any positive entry in the DUL will return 127.0.0.10 Yours Matthew @ SORBS --- Network operators, you are welcome and requested to submit your networks, both static and dynamic to SORBS for inclusion/exclusion from the list. A number of you already do, for which I thank you, however with the import of a massive amount of data there are likely to be a couple or errors here and there , if you see any please mail me directly and I will be happy to correct the entry by either removing it or by creating an exclusion. My next planned work on SORBS is as mentioned a few days ago, creating a whitehat system for the spam databases. Again assuming I am not called off topic when it is complete I will announce it here and discuss it offlist. If anyone wishes to talk to me about SORBS which would be considered offtopic please mail me privately or subscribe and post to the public 'dnsbl-users(a)sorbs.net' list. Also network listed over the last few days in the spam database are requested to contact me as soon as possible as there are some virus mails that got into a spamtrap that made it into the system, these need to be removed asap, so if you are blocked or see any, please mail me offlist and I will sort them aout as soon as possible. (Earthlink representitive (if you are listening) I think one of your servers got in it, but I am unable to get an IP from your users at the moment) Thanks Yours Matthew

1 0

RE: Anit-Virus help for all of us?????? Must have more Free!
by Brennan_Murphy＠NAI.com 24 Nov '03

24 Nov '03

If only free could become contagious (no pun intended) and we could all accomplish what we need to with, for example, free bandwidth, free server hardware, free network engineering....free apple macintoshes :-)... Ha-ha, ho-ho, he-he..... --------------- All kidding aside...is "free" the answer to the current insecurity of the Internet? I hope not! :-) Speaking as someone who knows at least a fraction of what's involved in AV/FW research... free is not likely to deliver us any time soon. Free is almost always marketing. But of course, people and their pocketbooks tend to decide how these things go... -BM PS http://us.mcafee.com/root/catalog.asp?catid=free ...neener-neener... :) -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of McBurnett, Jim Sent: Monday, November 24, 2003 9:29 AM To: nanog(a)merit.edu Subject: Anit-Virus help for all of us?????? Thought this is on topic for the group with all the new virii and new problems out there. Would anyone here consider sending this out to all customers? Later, Jim Last week at the Comdex show in Las Vegas, Computer Associates International, Inc. (known to the world as CA) teamed up with Microsoft Corp to provide "qualified" Windows home computer users with a no-charge, one-year subscription to CA's eTrust EZ Armor antivirus and firewall desktop security suite. The move is designed to encourage home users to increase the protection of their Windows systems and CA has stated that the company will aggressively promote the offer as part of Microsoft's "Protect Your PC" campaign. SNIP The EZ Armor software carries a value of $49.95 and the free subscription offer for will be available for download until June 30, 2004 and comes complete with one year of personal firewall and antivirus protection including daily virus signature updates. http://www.it-analysis.com/article.php?articleid=11450

1 0

Re: Check your AS: Renesys Blackout Report Released
by Mike Tancsa 24 Nov '03

24 Nov '03

On page 9, table 1 you list Allstream as being "was Bell Canada." They were the network formerly known as AT&T Canada. ---Mike At 02:16 PM 24/11/2003, todd(a)renesys.com wrote: >Folx, > >Hot off the presses, from the people who brought you the excellent (and >fun!) reports on the effects of worms on routing instabilities, how the >Internet fared on Sept 11, 2001, and other fine topics of interest to the >operator community, comes a new report: > > >"Impact of the 2003 Blackouts on Internet Communications" >available now at: >http://www.renesys.com/news/index.html ><a href="http://www.renesys.com/news/index.html">here</a> > > >It is an attempt to do a thorough, retrospective analysis of the impact of >the power outages from a purely routing perspective. We tried to be quite >rigorous in our methodology and careful in our inferences. However, we >came to what may be an unpopular conclusion: the Internet fared worse >than others have previously reported. The main difference in our >conclusions lies in different measurement strategies (core to core layer >3-4 monitoring versus global BGP routing monitoring). Read the paper for >more information. > >We also hoped to produce a definitive analysis of the network (routing, >BGP) impact of the power outages so that others can compare future events. > >We're particularly interested in feedback from operators with assets in >the affected regions of the US, Canada and Italy (see Appendix B for a >good comparison of the Sept 28 Italy Blackout with the Aug 14 US >Blackout). > >A few specific ASes are mentioned in the report. We would love to hear >feedback from those ASes or others who were affected to learn more about >the backstory behind the outage. If your prefixes stayed up, why? If >some went down and some didn't, what caused that? Did your upstreams and >peers stay up? Were local power outages at routers the primary cause of >outages, or did other factors enter into the equation? We saw one AS with >nine (9!) upstream ASes lose all of it's prefixes. Could it be that >someone with 9 upstream adjacencies didn't have reliable power? > >These questions, plus a general discussion of Internet edge reliability >(power and interconnectedness) seem on-topic for the list. > >Of course, we read nanog :-), so we'd love to see those stories discussed >here in a context that would help all of us understand the causes and >mitigation strategies better, but private mail will also be gratefully >accepted. If you don't ever want us to mention your name in public, be >sure to let us know. > >Todd Underwood >todd(a)renesys.com

2 1

RE: Anit-Virus help for all of us??????
by Wesley Vaux 24 Nov '03

24 Nov '03

"if you build it they will come" Goes right along with "if you send it out you will support it" Think about it. -----Original Message----- From: Suresh Ramasubramanian [mailto:suresh@outblaze.com] Sent: Monday, November 24, 2003 2:08 PM To: Jeff Shultz Cc: nanog(a)merit.edu Subject: Re: Anit-Virus help for all of us?????? Jeff Shultz writes on 11/24/2003 1:46 PM: > Firewalls at least tend to be a bit more hands off... and I'd like to > hear more about the "snake oil" parts. Doesn't the 1/2wall that XP > ships with default to "disabled?" Interesting reading here - http://groups.google.com/groups?q=vernon+schryver+snake+oil+firewall -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

1 0

Check your AS: Renesys Blackout Report Released
by todd＠renesys.com 24 Nov '03

24 Nov '03

Folx, Hot off the presses, from the people who brought you the excellent (and fun!) reports on the effects of worms on routing instabilities, how the Internet fared on Sept 11, 2001, and other fine topics of interest to the operator community, comes a new report: "Impact of the 2003 Blackouts on Internet Communications" available now at: http://www.renesys.com/news/index.html <a href="http://www.renesys.com/news/index.html">here</a> It is an attempt to do a thorough, retrospective analysis of the impact of the power outages from a purely routing perspective. We tried to be quite rigorous in our methodology and careful in our inferences. However, we came to what may be an unpopular conclusion: the Internet fared worse than others have previously reported. The main difference in our conclusions lies in different measurement strategies (core to core layer 3-4 monitoring versus global BGP routing monitoring). Read the paper for more information. We also hoped to produce a definitive analysis of the network (routing, BGP) impact of the power outages so that others can compare future events. We're particularly interested in feedback from operators with assets in the affected regions of the US, Canada and Italy (see Appendix B for a good comparison of the Sept 28 Italy Blackout with the Aug 14 US Blackout). A few specific ASes are mentioned in the report. We would love to hear feedback from those ASes or others who were affected to learn more about the backstory behind the outage. If your prefixes stayed up, why? If some went down and some didn't, what caused that? Did your upstreams and peers stay up? Were local power outages at routers the primary cause of outages, or did other factors enter into the equation? We saw one AS with nine (9!) upstream ASes lose all of it's prefixes. Could it be that someone with 9 upstream adjacencies didn't have reliable power? These questions, plus a general discussion of Internet edge reliability (power and interconnectedness) seem on-topic for the list. Of course, we read nanog :-), so we'd love to see those stories discussed here in a context that would help all of us understand the causes and mitigation strategies better, but private mail will also be gratefully accepted. If you don't ever want us to mention your name in public, be sure to let us know. Todd Underwood todd(a)renesys.com

1 0

RR/ATDN NYC
by Charles Sprickman 24 Nov '03

24 Nov '03

Howdy, Does anyone have any details on the issues that RoadRunner/ATDN was having in the NYC area when passing through Level3? I have ticket number 155247 as the master ticket. Things seem to have just cleared up, but it was a long-running problem that started around Saturday morning. In short, pieces of the RR network were unreachable via Level3. I'd rather let the RR folks sleep, but if anyone's lurking here, I'd love an explanation that I can pass on to our customers that are eager to jump down our throats about "being down all weekend". --- As an aside, this past week has had me calling a number of large and small NOCs with various issues, and I'd like to express great pleasure in saying that almost all of them were very easy to contact, and I encountered no "you're not our customer, go away" responses. A very pleasant surprise. And Jared's list is excellent, but even contacting those not listed there via ARIN info, etc. yielded quick responses. Standouts include: rr.com/atdn - it sounded like chaos, but I was at least able to get info that there was a problem C&W/Exodus - multiple responses from sharp people CV.net *above and beyond* Akamai Telus Microsoft Above The only two folks that I was not able to reach were Yahoo! and SBCGlobal. Just wanted to throw this in here, as I am very grateful to those that helped (to shave off some cynicism). Thanks, Charles -- Charles Sprickman spork(a)inch.com

4 3

Optical media converters?
by Ben Buxton 24 Nov '03

24 Nov '03

Hi, Does anyone have any experience with optical media convertors and using them directly with router interfaces? I have found one such supplier what makes exactly the thing: http://www.mrv.com/product/MRV-FD-SFPMC/ I'm curious as to whether anyone has any experience with these or knows of anyone else who makes a similar device... BB

2 1

RE: Port 41170 traffic
by McBurnett, Jim 23 Nov '03

23 Nov '03

Google: http://www.google.com/search?as_q=tcp+udp+41170&num=10&hl=en&ie=UTF-8&oe=UT… http://cert.uni-stuttgart.de/archive/incidents/2003/06/msg00130.html It appears to be a file sharing program called Blubster, at least for udp.... www.blubster.com Later, Jim SNIP Anyone has any idea what is carried on tcp and udp port 41170? Adi

1 0

Port 41170 traffic
by Adi Linden 23 Nov '03

23 Nov '03

Anyone has any idea what is carried on tcp and udp port 41170? Adi

2 1