April 2003 - Test - lists.nanog.org

whois for just prefix list
by Randy Bush 14 Apr '03

14 Apr '03

irr whois servers seem to vary a bit. is there one simple query that, given an as-macro or aut-num, produces the list of prefixes one should accept? randy

9 16

Covad contact?
by Leo Bicknell 14 Apr '03

14 Apr '03

Could someone from Covad please contact me off list? -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0

Re: whois for just prefix list
by Kevin Oberman 14 Apr '03

14 Apr '03

> From: Randy Bush <randy(a)psg.com> > Date: Mon, 14 Apr 2003 06:01:07 -0700 > Sender: owner-nanog(a)merit.edu > > > irr whois servers seem to vary a bit. is there one simple > query that, given an as-macro or aut-num, produces the list > of prefixes one should accept? Randy, A part of the IIRToolSet is peval(1) which does exactly what you ask. It can expand an as-set or an aut-num object in a single call. For the RADB servers it works fine. For the current RIPE software just add "-protocol bird" to the command. % peval -h whois.ripe.net -protocol bird AS-CERN ({194.12.128.0/21, 193.110.95.0/24, 192.91.246.0/24, 192.91.244.0/23, 192.91.245.0/24, 192.91.240.0/22, 192.91.236.0/22, 192.91.236.0/24, 192.91.237.0/24, 192.91.238.0/24, 192.91.239.0/24, 192.65.196.0/23, 192.65.192.0/22, 192.65.184.0/21, 192.65.183.0/24, 192.16.166.0/24, 192.16.164.0/23, 192.16.160.0/22, 192.16.156.0/22, 192.16.155.0/24, 158.232.0.0/16, 137.138.0.0/16, 128.142.0.0/16, 128.141.0.0/16}) IRRToolSet is a part of the FreeBSD ports collection and is currently at version 4.7.2. I maintain the port (but not the actual software), so please let me know if there are any problems. R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0

Re: Remote hands ANYWHERE?
by k. scott bethke 14 Apr '03

14 Apr '03

Tuc, Good point, I would think we could take the approach that eBay does and have a sort of comments or feedback system so that we could at least have some idea of the level of work someone would do.. Someone does something for you, you pay them, and you post feedback about what they did. The other idea is public flogging at the nog... while extremely satisfying in nature, personally Id rather have something tangable that I can reference online before I ask someone to do something in my cage. Seriously though I see this risk in general with any remote hands you decide to use. There will always be unlabeled servers, and people who hit the wrong switch, pull the wrong cable or read the wrong port. While we hate to see it happen, the fact is we were not there to see it happen right ourselves. -Scotty ----- Original Message ----- From: "Tuc" <tuc(a)ttsg.com> To: "k. scott bethke" <kbethke(a)thruport.com> Cc: "Kevin Day" <toasty(a)dragondata.com>; <nanog(a)merit.edu>; "James Deibele" <jamesd(a)scn.rain.com> Sent: Sunday, April 13, 2003 8:19 PM Subject: Re: Remote hands ANYWHERE? > > > > Combine that with a list of people in each area to contact willing to come > > in and do stuff no matter where they are or what they are doing and you may > > have 90% of your solution. I don't think we are talking about a free > > service here either. I bet lots of people would be willing to help if they > > were in the area and were going to get some booty cash. > > > Hi, > > Sorry to throw a damper on this. There are alot of issues that while > we don't like to think about them, have to. What happens if they power off > the wrong machine? Drop something on their foot? Suddenly have their own > emergency and HAVE to get back to their problems? > > We've done alot of work for people at 25B Telehouse. Luckily all > of it ended up getting worked out properly. But its something I always am > concerned about. > > Tuc/TTSG Internet Services, Inc. >

2 1

Remote hands for One Wilshire?
by James Deibele 14 Apr '03

14 Apr '03

We're looking for someone (ideally a company) to be our emergency hands for equipment located in the ELI space at One Wilshire in LA. We would also have need for occasional non-emergency upgrades and additions. The reason we'd like a company is that we don't want someone on vacation at exactly the time we need those hands on our boxes. With the amount of internet equipment scattered around the US (and the world) it seems like there's a business here for somebody. Just not us. Thanks! jamesd(a)scn.rain.com

4 5

Datacenter Genset Summary
by Dan Lockwood 14 Apr '03

14 Apr '03

Everyone, I have finished compiling all of your responses into a summary document. I included all of the concerns that were surfaced and discuss why, for our particular situation, we will be using one technology vs another. I anticipate some controversy, so try to keep your criticism constructive in nature and I will revise the document to include those points as well. Thanks again to the operator community! http://www.danlockwood.com Dan Lockwood Microsoft Certified Professional CompTIA Network+ Certified Cisco Certified Network Associate

2 1

RE: Hijacking of address blocks assigned to Trafalgar House Group , London UK
by Temkin, David 13 Apr '03

13 Apr '03

Maybe they should do everyone a favor and return the hijacked blocks to ARIN.... I mean hell, does anyone really think that they have 6 /16's worth of machines directly accessible via the 'net? Obviously if they have been hijacked and the admins had the time to post here about it, it's not the end of the world for them... Just a little something to fuel a Sunday flamewar :-) -Dave -----Original Message----- From: bdragon(a)gweep.net [mailto:bdragon@gweep.net] Sent: Saturday, April 12, 2003 7:19 PM To: richard(a)mandarin.com Cc: nanog(a)merit.edu Subject: Re: Hijacking of address blocks assigned to Trafalgar House Group, London UK > Hello! > > I've been asked to draw the attention of Network administrators to the > recent hijacking of various large blocks of ARIN IP-space: > particularly six /16 blocks allocated to the London-based Trafalgar > House Group. > > Trafalgar House Group (THG): > Trafalgar House Group TRAF (NET-144-176-0-0-1) 144.176.0.0/16 > Trafalgar House Group THIN1 (NET-144-177-0-0-1) 144.177.0.0/16 > Trafalgar House Group THIN3 (NET-144-179-0-0-1) 144.179.0.0/16 > Trafalgar House Group THIN4 (NET-144-180-0-0-1) 144.180.0.0/16 > Trafalgar House Group THIN5 (NET-144-181-0-0-1) 144.181.0.0/16 > Trafalgar House Group THIN2 (NET-158-181-0-0-1) 158.181.0.0/16 An example of why allocation boundary based prefix-filters are a good thing. IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

4 7

AT&T NOC contact?
by Rick Ernst 13 Apr '03

13 Apr '03

Anybody have an AT&T NOC contact, or can an AT&T NOC person contact me off list? I have a bouncing DS-3 interface, but I'm remote from my office and don't have contact information. Thanks!

1 1

www.worldnet.att.net Network not in table
by Sean Donelan 13 Apr '03

13 Apr '03

Is anyone else having difficulty reaching ATT's Worldnet? traceroute to www.worldnet.att.net (204.127.43.37), 30 hops max, 40 byte packets 1 e3-4.aggr2.bwi1.network.coloco.com (199.34.53.129) 1.769 ms 1.869 ms 1.777 ms 2 fa3-0.core1.bwi1.network.coloco.com (198.180.62.134) 2.162 ms 1.752 ms 1.836 ms 3 dca1-lan2-g6-0-102.cidera.net (208.184.7.229) 2.706 ms 3.114 ms 3.328 ms 4 dca1-lan2-g6-0-102.cidera.net (208.184.7.229) 2.566 ms !H * * C ***************************************************** AT&T Enhanced Network Services (CERFnet) route-server For questions please contact vandusb(a)attens.com ***************************************************** route-server>show ip bgp 204.127.43.37 % Network not in table

5 5

Hijacking of address blocks assigned to Trafalgar House Group, London UK
by Richard Cox 12 Apr '03

12 Apr '03

Hello! I've been asked to draw the attention of Network administrators to the recent hijacking of various large blocks of ARIN IP-space: particularly six /16 blocks allocated to the London-based Trafalgar House Group. Trafalgar House Group (THG): Trafalgar House Group TRAF (NET-144-176-0-0-1) 144.176.0.0/16 Trafalgar House Group THIN1 (NET-144-177-0-0-1) 144.177.0.0/16 Trafalgar House Group THIN3 (NET-144-179-0-0-1) 144.179.0.0/16 Trafalgar House Group THIN4 (NET-144-180-0-0-1) 144.180.0.0/16 Trafalgar House Group THIN5 (NET-144-181-0-0-1) 144.181.0.0/16 Trafalgar House Group THIN2 (NET-158-181-0-0-1) 158.181.0.0/16 I'm sure I don't need to remind people here why this is bad - a zombie block that can be announced and de-announced at an abuser's whim makes it far more difficult to trace the source of spam or the destination of responses: particularly where fraud and password-phishing has occurred. The company originally known as Trafalgar House is now part of Aker Kvaerner, headquartered in Norway, who have already set in train the processes to recover the ARIN and other handles associated with their Internet assets. Information about the original change of ownership is available, if anyone wants further confirmation or background, at http://www.brookes.ac.uk/other/conmark/IJCM/issue_02/010201.html and http://www.kvaerner.com/group/investor_relations/reports/1996/3q/Default.as… I could give a lot more details but do not want to bore those of you who have, inevitably, "heard it all before". I'm not claiming this is new - or any sort of special case. I'm posting this solely as a heads-up to help any admins who may have been asked to accept forged credentials authorising the announcement of the above blocks, and at the same time to ask for help from anyone who may have already been approached in similar terms. But if anyone does want more background they're welcome to mail me via the security account @ my domain. At the time of writing THIN5 is being announced via Level3 in Boston, and THIN2, plus two other hijacked blocks not owned by Aker Kvaerner (137.171.0.0/16 and 170.67.0.0/16) are being announced via Telia in Amsterdam. Sadly we have had difficulty reaching the right people at Telia, so if anyone from Telia is here, we'd be real pleased to hear from you. ARIN is now aware that handles ST58-ARIN and AMS87-ARIN are completely bogus, as is also the statement on the WHOIS for ST58-ARIN, that: "This company Is currently contracted by trafalgar House to provide network management services. Further information will be made avaiblible to request" (sic); If, therefore, any of you are asked to let through BGP announcements of any of the above blocks, or if you have been asked anything like this in the recent past - we ask you not to pass those announcements, but to get in touch with us urgently, taking care to preserve any documents that may have been sent to you to support that request: as these may be needed for prosecution and possible civil litigation against the perpetrators. Any valid authority for the use of these blocks would come directly from either Aker Kvaerner in Norway, or Equant (on their behalf). It certainly would NOT claim to be from Trafalgar House Group at any address because that Group is no longer trading under that identity. However I'm told that there are no plans to deploy those blocks in the immediate future, or until this incident has been cleared up. Thanks! -- Richard Cox Mandarin Technology Ltd, Penarth, UK

3 2