January 2004 - Test - lists.nanog.org

Sales Droid from SBC?
by Drew Weaver 12 Jan '04

12 Jan '04

Any sales droids from SBC lurking? I'm having some problems with our usual reseller, thinking about going direct this time. Thanks, -Drew

1 0

comcast abuse/admin?
by Mark Jeftovic 12 Jan '04

12 Jan '04

If anyone from comcast is here, we would like to talk to someone on your end about abuse from your network (mainly inbound spam from a lot of your netblocks to our mail pool.) Basically we would just like to blot out a number of netblocks in your space from our mailservers that just feed us a constant spew of spam, but we welcome dialog from your side to ensure legit email is unimpeded (by telling us where your outbound mailhubs are, etc) -mark -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

1 0

pending renumbering for "B"
by bill 12 Jan '04

12 Jan '04

we believe we are ready to make the addressing change for b.root-servers.net. the old address is: 128.9.0.107 the new address is: 192.228.79.201 The formal requests have been submitted and there have been no negative comments in those venues. Before the offical changes are made, it would be helpful to have any substantive comments. I expect ICANN to publish a transition date shortly so timely replies are most useful. --bill <bmanning(a)karoshi.com> +1.310.322.8102

1 0

RE: updating bogon filters for 83/8 and 84/8
by Michel Py 11 Jan '04

11 Jan '04

> Sean Donelan wrote: > Don't forget about the other half of the problem. > ISPs need to verify the network announcements by > their downstream BGP networks. Indeed, and it is clear to me that the future solution is some kind of a certificate or something that can authenticate the block being advertised. However, we're not there yet. > Eventually most of the current "bogons" will be assigned, > and bogon filters will continue to be less and less useful. Indeed. I will point out two things though: 1. This is in 10+ years, likely. Nobody really knows when, one of the reasons being: 2. As we allocate new blocks, part of them is for new use and part of them is used to replace existing assignments. In this very case, at least one of the ISPs concerned is getting a single new block and releasing a bunch of other smaller blocks to RIPE. So we are actually seing defragmentation of the routing table, which is good for everyone. This leads to pushing back even further the exhaustion of space, because we are allocating new space now but the space being freed by new allocations that consolidate several blocks will be made available only later. Since everyone is gaining routing table size reduction in this deal, we must encourage all that are willing to consolidate, and part of this is removing the current inconvenience brought by slow updates of the bogon filters, which in turn means more automation. > On the other hand, positive verification will continue > to improve the stability of the network. Which is why the mechanism we are recommending is not limited to bogons but targeted at more generic prefix filtering. http://arneill-py.sacramento.ca.us/draft-py-idr-redisfilter-01.txt Michel.

1 0

Looking for T-Mobile contact, pref. NYC area, (not urgent)
by Paul Wouters 11 Jan '04

11 Jan '04

Hi people, Is there anyone from T-Mobile on this list? I'd like to talk to someone about the New York City network for an event in July. Cheers, Paul

1 0

updating bogon filters for 83/8 and 84/8
by Frans ter Borg 10 Jan '04

10 Jan '04

hello, On November 15th 2003, IANA allocated 83/8 and 84/8 to RIPE. RIPE has started allocating prefixes from these blocks to LIRs around Europe. We received 83.116.0.0/14 and have started connecting domestic users with these IP addresses. Unfortunately, quite a few ISPs and corporates out there, have not yet updated their bogon filters to allow for these ranges to pass. These are including sites like cnn.com, yahoo.com and excite.com. I'd like to ask everyone to doublecheck whether you are currently allowing these addresses to pass your prefix filters and that you're no longer nullrouting them... Many thanks, Frans -- Quanza Engineering B.V. Elandsstraat 44 Frans ter Borg 1016 SG Amsterdam E: frans(a)quanza.net www.quanza.net

3 2

RE: updating bogon filters for 83/8 and 84/8
by Michel Py 10 Jan '04

10 Jan '04

> Frans ter Borg wrote: > On November 15th 2003, IANA allocated 83/8 and > 84/8 to RIPE. Unfortunately, quite a few ISPs > and corporates out there, have not yet updated > their bogon filters to allow for these ranges > to pass. The inconvenience of this would be greatly lessened if more people used automated ways to propagate bogon filters. The authors welcome comments on the work currently underway to facilitate automation. If you find this of interest, please help with lobbying your router vendor to implement the very small changes required. http://arneill-py.sacramento.ca.us/draft-py-idr-redisfilter-01.txt Michel.

1 0

Rogers Cable Contact
by manolo＠dialtone.com 10 Jan '04

10 Jan '04

Could someone from Rogers Internet contact me offlist? Thanks,

1 0

RE: interesting new virus, maybe???
by Hank Nussbacher 10 Jan '04

10 Jan '04

At 11:16 AM 09-01-04 -0800, Brennan_Murphy(a)NAI.com wrote: >Send it in to AVERT. It's free analysis and will give you >recommendations for how to deal with it: > >https://www.webimmune.net/default.asp > >...does require registration but again, it's free. > >or email it in per instructions here: > >http://vil.nai.com/vil/submit-sample.asp > >other vendors may have similar mechanisms. If you get a new virus here are some addresses: Command Software <virus(a)commandcom.com> Computer Associates (US) <virus(a)ca.com> Computer Associates (Vet/EZ) <ipevirus(a)vet.com.au> DialogueScience (Dr. Web) <Antivir(a)dials.ru> Eset (NOD32) <sample(a)nod32.com> F-Secure Corp. <samples(a)f-secure.com> Frisk Software (F-PROT) <viruslab(a)f-prot.com> Grisoft (AVG) <virus(a)grisoft.cz> H+BEDV (AntiVir): <virus(a)antivir.de> Kaspersky Labs <newvirus(a)kaspersky.com> Network Associates (McAfee) <virus_research(a)avertlabs.com> Norman (NVC) <analysis(a)norman.no> Sophos Plc. <support(a)sophos.com> Symantec (Norton) <avsubmit(a)symantec.com> Trend Micro (PC-cillin) <virus_doctor(a)trendmicro.com> -Hank >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >Scott Granados >Sent: Friday, January 09, 2004 12:43 PM >To: nanog(a)merit.edu >Subject: interesting new virus, maybe??? > > > >I'm not sure if anyone has seen this or if its just to early but. > >While opening mail, <not with a microsoft outlook product> I found >something which looked different. The message was from pgp-public-key >and >said "Here is my key". When you look at the attachment its called >youremail.doc.com obviously something meant to be executed. What struck > >me as different from the top was it wasn't from a support@microsoft or >some such address it specifically mentioned pgp_public_key. Also, I >obviously didn't try to run the code or do anything with it, it is 76 K >in >size and again called youremail.doc.com. > >I haven't tried a virus scanner against it yet but will later. > >Thanks > >Scott

1 0

Looking for Abovenet/NetAccess contact
by Dick Cocks 10 Jan '04

10 Jan '04

3 2