May 2003 - Test - lists.nanog.org

Re: Class "B" IP BLOCK
by ddragon＠hushmail.com 04 May '03

04 May '03

> There are gweep.net peeps all over the East Coast, including Canada. How are the "peeps" organized? Is "GweepCo" a 501(c)(3) Nonprofit Organization? Or are they a C-corp, S-corp, or Limited Liability Corporation which has not yet obtained a DUNS number? And what is the history behind their IP address assignment? Is the space legit? > If you don't understand what gweeps have done for the community you > just haven't been invited to participate yet. No, I understand and appreciate their contributions to the operational community. At the same time, one can never be too vigilant. It's been demonstrated repeatedly that the same people and providers we respect on the surface are actively engaged in large-scale spamming and Internet abuse behind closed doors. Please understand I'm not trying to single out you, or any of the "gweeps" with whom you associate, in particular. > FWIW, jzp is looking into the Enteract concerns listed below. Thanks for the timely response. And can we assume he's also looking into the concerns of RCN-originated spam listed below, and will be posting to NANAE or SPAM-L in the days to come with a detailed follow-up, including punative action taken against the spamming marketeers and customers on his network? Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Class "B" IP BLOCK
by John Immel 03 May '03

03 May '03

Dear Nanog, I have a class "B" IP block of addresses (IP 143.170.0.0 - 143.170.255.255) for sale / lease and two questions for the group: 1) Are there any resources for buying / selling IP address? 2) Is anyone in the group interested in making an offer? I understand ARIN has made it difficult to sell IP addresses. We have fixed this problem by creating a corporation whose only asset is the block of IP addresses. Sincerely, John Immel isp(a)jimmel.com 617-869-8326 _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

14 16

Re: Question about 223/8
by Michael.Dillon＠radianz.com 03 May '03

03 May '03

>The reason I ask is that I was perusing RFC 3330 and noted that it >specifically stated that the basis for the reservation of >223.255.255.0/24 no longer applied and that the block was subject to >future allocation to a RIR. Yet there was an argument about it. The argument was because it wasn't clear what the original basis was for the reservation nor was it clear how things had changed. Imagine you have a device that uses lots of addresses but considers them to be sequential numbers rather than bit patterns. For instance, this device could be configured with a starting number and then dole out sequential numbers to connections based on that starting number. This is how a lot of terminal servers work. Imagine that you give the terminal server a number like 223.255.255.200 as the starting number to assign to dialup connections and that terminal server has a 32 port card installed. Then one day an engineer installs a second 32 port card. The terminal server continues to function just fine until one day when it tries to assign 223.255.255.255 to an incoming call followed by assigning 224.0.0.0 to the next call. Suddenly you have all kinds of wierdness breaking out with mysterious broadcast traffic and multicast traffic coming from the device. But it only happens for short bursts during the busiest times of the day. What the heck is going on!? Could you debug that? Would you want to debug that? Maybe that's why 223.255.255/24 should be forever reserved. --Michael Dillon

3 2

Re: Interesting Announcements
by miltonningis＠hushmail.com 03 May '03

03 May '03

Replying to myself is stupid, but... On Sat, 03 May 2003 05:45:53 -0700 miltonningis(a)hushmail.com wrote: >Also, perhaps Internap (AS10910) might explain the story behind >seemingly >stolen ASN 8143 and their many seemingly stolen IP blocks... > > Perhaps Internap (AS10910) can ALSO explain the seemingly jacked IP space being announced by seemingly legitimately registered, but rogue AS27255... And if you traceroute from something that goes over their internap (say a verio customer, perhaps), it looks like they come from the SAME internap router, one port away... interesting.... (Perhaps AS8143 and AS27255 have something in common) Hello? Internap? Are you out there? Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

4 4

Re[3]: The in-your-face hijacking example, was: Re: Who is announcing bogons?
by Richard Cox 03 May '03

03 May '03

On 3 May 2003 01:18 UTC Emil Kacperski <emil(a)atrivo.com> wrote: | Officially I am declaring surrender and victory to | the people that have chosen to cause so much harm. Currently I am still seeing your routes being announced via NLayer. In view of all the information provided to you here, I am amazed that you continued to announce IP ranges which you now know are not yours. | Hopefully Atrivo and myself are not blacklisted in this group, | since we caused nobody any harm. People will of course make up their minds individually as to whether what you did caused harm. You may assist them greatly in coming to their decisions, by answering the following questions truthfully: [1] who precisely was it that you claim gave or sold you the rights to use the netblock 170.208.0.0/16? [2] who initially entered your details - including your contact e-mail address - against that netblock on ARIN's database? -- Richard Cox

3 2

Re: The in-your-face hijacking example, was: Re: Who is announcing bogons?
by Hank Nussbacher 03 May '03

03 May '03

At 06:09 AM 30-04-03 +0000, Christopher L. Morrow wrote: >That may be true, but what does a provider do when they are presented with >written 'authority to use address space' from a customer? Certianly if the >customer provides 'proper' documentation that the ip space is available >for them to route, and that they have authority from the 'owner' to do >this... what is an ISP to do? Aside from route the blocks? A very valid question and one that all too few ISPs handle. How many ISPs have as part of their implementation/provisioning process an item called "check IP address space against IRRs"? I would suggest that written proof of ownership is not enough and that part of the legal framework each ISP has customers complete that it state something to the effect "IP address space and ASNs announced by the customer must be properly registered in one of the online IRRs such as ARIN, RADB, APNIC or RIPE and must reflect the name of the organization placing the request." -Hank

16 20

Re: Interesting Announcements
by miltonningis＠hushmail.com 03 May '03

03 May '03

On Sat, 03 May 2003 06:45:50 -0700 Matthew McGehrin <mcgehrin(a)reverse.net> wrote: >I think the problem is with ARIN, even if you 'transfer' your IP >space to >another owner, the original Date still appears on the whois information. > I think the problem is that you don't understand what "stealing" means, and that you/your employer is actively engaged in doing it. >My point was, if you have enough money, for a fee, anything is possible >from >Arin. > >-- Matthew > >----- Original Message ----- >From: <miltonningis(a)hushmail.com> >To: <mcgehrin(a)reverse.net> >Sent: Saturday, May 03, 2003 9:41 AM >Subject: Re: Interesting Announcements > > >> I didn't get the annoucement from ARIN that you can just get as >much >> IP space as you want, so that you have extra... > > > Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

2 1

Re: Interesting Announcements
by miltonningis＠hushmail.com 03 May '03

03 May '03

Matthew McGehrin wrote: > I think your barking up the wrong tree on this paranoid rant. > > I did some consulting for this company, and I find it hard to believe with > 14 racks of equipment that they would have a 'stolen' /16 > > http://www.vmxnetworks.com/ You actually believe "14 racks of equipment" can justifiably use 65025 ips? Did you read william(a)elan.net's comments on this? I don't know it for fact, but I believe he's correct, and in the case that he's right, these IP's are the property of Lucent and are, in fact, stolen. Also, perhaps Internap (AS10910) might explain the story behind seemingly stolen ASN 8143 and their many seemingly stolen IP blocks... Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Interesting Announcements
by Jeffrey Race 02 May '03

02 May '03

On Sat, 03 May 2003 05:15:35 -0400, Phil Rosenthal wrote: >Not only that, but this design is STOLEN from my company! >www.isprime.com > >Stolen so poorly, they even say "ISPrime" in a few places. You are going to file a police report, I trust? Jeffrey Race

1 0

It's Friday evening (in North America) so you know what to expect
by Richard Cox 02 May '03

02 May '03

This evening it appeared that AS 9929 (China Netcom Corporation) had started to BGP announce the netblock "HCV": 152.147.0.0/16 That netblock is assigned by ARIN to OrgName: Housing and Construction Victoria OrgID: HCV Address: GPO Box 1670N Address: Melbourne, Victoria 3001 Country: AU NetRange: 152.147.0.0 - 152.147.255.255 CIDR: 152.147.0.0/16 NetName: HOUSINGVIC NetHandle: NET-152-147-0-0-1 Parent: NET-152-0-0-0-0 NetType: Direct Assignment RegDate: 1991-08-23 Updated: 1991-08-23 TechHandle: TL152-ARIN TechName: Lewis, Terry TechPhone: +61 3 669 1028 Housing and Construction Victoria are most certainly not in China. Given the timing, the intention here hardly needs spelling out. Roland Verlander, who lives in Australia, very helpfully tells me: "The contact information is outdated, so I unfortunately cannot attempt to contact the original owner. I searched AUNIC for POCs with the name Terry Lewis but I only found other people named Terry Lewis. APNIC has no results on Terry Lewis." "The phone number isn't valid, all phone #s in Oz were changed to 8 digits a few years ago (that one's 7 digits) and old 7 digit numbers don't work anymore; +61 3 669 1028 would have been converted to either +61 3 8669 1028 or +61 3 9669 1028." (I checked - neither of those possibilities is a working number) "No entry in the phone book (white pages) for the name Terry Lewis. The organisation is not legally registered and I can't find a website for it, so I guess it no longer exists" From: http://www.cidr-report.org/cgi-bin/as-report?as=9929 Upstream Adjacent AS list for AS9929: AS4637 REACH Reach Network Border AS AS1 GNTY-1 Genuity AS7018 ATT-INTERNET4 AT&T WorldNet Services AS2516 KDDI KDDI CORPORATION AS3549 GBLX Global Crossing AS3356 LEVEL3 Level 3 Communications, LLC AS1239 SPRINTLINK Sprint AS3561 CWUSA Cable & Wireless USA AS701 ALTERNET-AS UUNET Technologies, Inc. Ladies and gentlemen, you may wish to adjust your routing. Richard Cox

3 3