July 2005 - Test - lists.nanog.org

RE: SORBs
by Sanfilippo, Ted 06 Jul '05

06 Jul '05

It belonged to some Canadian ISP, I believe it was a cable company. Regarding the aggregation/deaggregation mess. This is due to the fact that ARIN is rather strict with IP assignements and how we route internally. Because ARIN wants us to use 80% of our ip blocks, before we can request new assignments from them we have to dole out addresses in /22's to each city we have, in order to use them up appropriately. Its been a bit of a nightmare trying to meet ARIN's policies and also try to meet the Internet Communities policies. Believe me, I would much rather advertise a /16 prefix out to the Internet, rather then a /22. We have not been able to accommodate this unfortunately. -----Original Message----- From: Jon Lewis [mailto:jlewis@lewis.org] Sent: Wednesday, July 06, 2005 10:31 AM To: Sanfilippo, Ted Cc: nanog(a)merit.edu Subject: Re: SORBs On Wed, 6 Jul 2005, Sanfilippo, Ted wrote: > Does anyone know of an easier way to remove IP blocks from a blacklist? > We received a /16 from ARIN in May and have been trying to get SORB's > to remove the blacklist association on these addresses. They seem to > take forever to remove the blacklist association. --- 06Jul05 --- ASnum NetsNow NetsAggr NetGain % Gain Description AS15270 311 59 252 81.0% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. Any chance of this deaggregation mess getting cleaned up? I've contacted sorbs on your behalf, assuming the /16 concerned is 63.138.0.0/16. This raises a question that interests me as someone who had to deal with recently bogon space last time I got ARIN space. 63/8 was assigned to ARIN in 1997. Much of it appears to have been assigned to ARIN members in the late 90s and very early 2000's. How did Paetec happen to get a /16 from 63/8 in 2005? Was this recently reclaimed from some defunct company (which could explain the sorbs dul listing), and Paetec just got lucky? ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

6 6

RE: SORBs
by Sanfilippo, Ted 06 Jul '05

06 Jul '05

We have been asking them to fix it for over a month now. -----Original Message----- From: Suresh Ramasubramanian [mailto:ops.lists@gmail.com] Sent: Wednesday, July 06, 2005 9:51 AM To: Sanfilippo, Ted Cc: nanog(a)merit.edu Subject: Re: SORBs On 06/07/05, Sanfilippo, Ted <Ted.Sanfilippo(a)paetec.com> wrote: > > Does anyone know of an easier way to remove IP blocks from a blacklist? > We received a /16 from ARIN in May and have been trying to get SORB's > to remove the blacklist association on these addresses. They seem to > take forever to remove the blacklist association. > If it is a whole /16 you probably bought some old dynamic IP space that was recycled - and then reassigned it to a datacenter, probably? SORBS does respond, eventually. -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

2 1

RE: SORBS & deaggregation
by Hannigan, Martin 06 Jul '05

06 Jul '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > David Barak > Sent: Wednesday, July 06, 2005 6:51 PM > To: nanog(a)merit.edu > Subject: SORBS & deaggregation > > > > > > --- Alex Rubenstein <alex(a)nac.net> wrote: > > > > > [ SNIP ] I would've made this a private note to y'all except: Would you mind using "Was:" if you're going to change the subject? I'd appreciate it. I bet others would too... Hint: killfiles..... -M<

1 0

Enable BIND cache server to resolve chinese domain name?
by Joe Shen 06 Jul '05

06 Jul '05

Hi, Some of our customer complaint they could not visit back to their web site, which use chinese domain name. I google the net and found some one recommend to use public-root.com servers in hint file. I found domain name like xn--8pru44h.xn--55qx5d could not be resolved either. Our cache server runs BIND9.3.1 with root server list from rs.internic.net. Do I need to modify our cache server configuration to enable it? regards Joe __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

16 22

Re: Need BOGIES list
by william(at)elan.net 06 Jul '05

06 Jul '05

On Wed, 6 Jul 2005, Geoff White wrote: > Hello All. > I'm having trouble with Cracking Attempts and DoS attacks from a lot of > places in China :) > My client doesn't do any business in that region so they don't mind If I > block the entire sub-continent :) > Does anyone have a bad-guy list (or part of one) that I can use to get > started? > I'm using pf under OpenBSD 3.7 as a firewall box. IP blocks allocated to organizations in various countries (updated daily): http://www.completewhois.com/statistics/data/ips-bycountry/rirstats/ Configuring firewall (openbsd way on the buttom, replace bogon example with appropriate other list you want): http://www.completewhois.com/bogons/using_bogon_lists.htm#firewall_examples CIDR -> firewall scripts for some systems (not needed for openbsd which accepts cidr ip block list directly with ph): http://www.completewhois.com/bogons/data/scripts/ P.S. Still looking for somebody to document and if necessary provide scripts on how to do it with netbsd, aix, hpux. Volunteers? (and I'll do solaris myself if I ever get around to it...) -- William Leibzon Elan Networks william(a)elan.net

1 0

Re: Report: Major Newspaper Sites Hobbled by Power Woes
by MARLON BORBA 06 Jul '05

06 Jul '05

This leads us to the old fact that several ISPs and hosting providers protect their servers with every network perimeter security resource (firewalls, IPSs, virus-and-spam-appliances etc) but forget that "availability" as a security principle requires adequate physical and utility safeguards also (backup site, automated failover, redundant communication links between sites and backbones, capable UPS, air-conditioning, fire-extinguishing...). Not all, as you see, are computer-related "per se", but they are "sine-qua-non" for 24x7 availability. Abraços, Marlon Borba, CISSP. -- Nova campanha: Centro de Resposta a Incidentes de Segurança da Justiça Federal - Vamos criar! -- >>> "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> 07/06/05 1:12 PM >>> Netcraft reports that: [snip] A power outage at an Advance Internet hosting facility has hobbled the web sites for the company's chain of more than 30 newspapers, including many large metropolitan dailies. [...]

3 2

IANA IPv4 allocations and bogon updates: 89/8, 90/8 and 91/8
by Rob Thomas 06 Jul '05

06 Jul '05

-----BEGIN PGP SIGNED MESSAGE----- [ Apologies to those of you who receive this note in multiple forums. ] Hi, team. The numerous Team Cymru bogon projects have been updated as of 30 JUN 2005 to reflect the following IANA allocation made on 30 JUN 2005: 089/8 Jun 05 RIPE NCC (whois.ripe.net) 090/8 Jun 05 RIPE NCC (whois.ripe.net) 091/8 Jun 05 RIPE NCC (whois.ripe.net) IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-template.htm> Secure JUNOS BGP Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-bgp-template.htm> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix- Filter-Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-loose.htm> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-strict.htm> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> RIPE NCC fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#ripe> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Bogus ASN monitoring - <http://www.cymru.com/BGP/asnbogusrep.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thank you for your continued support. Thanks! Rob. - -- Rob Thomas http://www.cymru.com Shaving with Occam's razor since 1999. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQswL+1kX3QAo5sgJAQHcQgP/RDehEvRBiaN0nFApyeQroJzb6NfOmd88 VScVbNj08xn7jkovVjXndQ8roQzDEVhLZyhHa0+dp8cLEETnjVYXNd6Ir9/bajRj 3mybhQefzaPlKJjLOhjWmoU3maUMN8oTrWGkE5YQOe+6Ef8HDrI0inT+mhhyqdhF V/I5kb6mNBw= =qVJI -----END PGP SIGNATURE-----

1 0

Re: Recall: SORBs
by Gregory Hicks 06 Jul '05

06 Jul '05

> Date: Wed, 6 Jul 2005 21:20:10 +0530 > From: Suresh Ramasubramanian <ops.lists(a)gmail.com> > > On 06/07/05, Alex Rubenstein <alex(a)nac.net> wrote: > > What is scarier -- > > > > a) microsoft providing this feature > > > > b) someone with the ability to type "conf t, router bgp", > > connected to the global internet, and thinking > > that recalling a message would work? > > [b] most assuredly > > [a] has its uses, when used internally in an exchange groupware > environment Yeah BUT! A message can only be "recalled" if it has NOT been read. If the message goes to a 'list' of people, the ones that have NOT read the message will not see it. Those that HAVE read it, get to keep the original message. So it really doesn't do what one would think it does. Regards, Gregory Hicks > > -- > Suresh Ramasubramanian (ops.lists(a)gmail.com) > --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

2 1

Report: Major Newspaper Sites Hobbled by Power Woes
by Fergie (Paul Ferguson) 06 Jul '05

06 Jul '05

Netcraft reports that: [snip] A power outage at an Advance Internet hosting facility has hobbled the web sites for the company's chain of more than 30 newspapers, including many large metropolitan dailies. The Advance newspapers have switched to text-based sites to continue publishing, but are currently unable to display advertising, making the outage a potentially costly event. Affected sites include NJ.com, Michigan Live, Cleveland.com, The Portland Oregonian and the online classifieds site BestLocalJobs.com and Best LocalAutos.com. One of the affected papers, The New Orleans Times-Picayune, is in the midst of covering the impact of Tropical Storm Cindy, which hit the New Orleans area yesterday and has left more than 240,000 local residents without power as well. [snip] http://news.netcraft.com/archives/2005/07/06/major_newspaper_sites_hobbled_… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Recall: SORBs
by Sanfilippo, Ted 06 Jul '05

06 Jul '05

Sanfilippo, Ted would like to recall the message, "SORBs".

3 2