October 2006 - Test - lists.nanog.org

RE: Collocation Access
by Alex Rubenstein 28 Dec '06

28 Dec '06

> Is this some new trend or have I just gotten lucky in the > past? Wouldn't someone like AT&T be better served by giving > their employees some company issued ID that they can submit > to secure facilities? I know it wouldn't be government I am shocked that the ATT employee did not have an ATT ID. In our facilities, we require all visiting telcos to produce company identification, and between telcove/level 3, Verizon, MCI, and several others, we have never had an issue. I'd be a bit more suspicious that he didn't have ATT ID. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben Net Access Corporation, 800-NET-ME-36, http://www.nac.net

43 77

Cogent now peering with Sprint?
by Ed Ray 17 Nov '06

17 Nov '06

I never thought Sprint would ever renew its relationship with Sprint: Tracing the route to portus.netsecdesign.com (66.6.208.6) 1 sl-bb24-rly-9-0.sprintlink.net (144.232.14.122) 0 msec 0 msec 0 msec 2 sl-st22-ash-6-0.sprintlink.net (144.232.20.189) 0 msec 4 msec 0 msec 3 p15-2.core01.iad01.atlas.cogentco.com (154.54.13.61) [AS 174] 4 msec 4 msec 0 msec 4 v3492-mpd01.iad01.atlas.cogentco.com (154.54.3.222) [AS 174] 16 msec 80 msec 196 msec 5 v3497.mpd01.dca01.atlas.cogentco.com (154.54.5.65) [AS 174] 4 msec 4 msec 4 msec 6 t9-3.mpd01.iah01.atlas.cogentco.com (154.54.2.222) [AS 174] 44 msec 44 msec 48 msec 7 t2-3.mpd01.lax01.atlas.cogentco.com (154.54.3.186) [AS 174] 72 msec 72 msec 72 msec 8 g2-0-0.core01.lax01.atlas.cogentco.com (154.54.2.101) [AS 174] 72 msec 72 msec 72 msec 9 g49.ba01.b002698-1.lax01.atlas.cogentco.com (66.250.12.130) [AS 174] 72 msec 72 msec 72 msec 10 PAJO-Networks.demarc.cogentco.com (38.112.9.190) [AS 174] 72 msec 76 msec 72 msec 11 dcap04.pcap.lax01.tierzero.net (216.31.128.14) [AS 11509] 72 msec 76 msec 72 msec 12 mmic-gw.dcap6.lax.us.tierzero.net (216.31.188.94) [AS 11509] 76 msec 80 msec 80 msec 13 dazedandconfused.netsecdesign.com (66.6.208.4) [AS 11509] 84 msec 84 msec 88 msec 14 portus.netsecdesign.com (66.6.208.6) [AS 11509] 84 msec 84 msec 88 msec Next I will see pigs flying :) Wonder how long it will last based on Cogent's past behavior as noted here. Edward Ray ------------------------------------------------------------- This mail was scanned by BitDefender For more informations please visit http://www.bitdefender.com -------------------------------------------------------------

3 2

CWDM equipment (current favorites)
by Deepak Jain 15 Nov '06

15 Nov '06

A few years ago, NANOG had a discussion regarding various CWDM vendors. Repeatedly MRV was brought up as a good option for metro-area LAN type applications. Since then, I have actually touched some of the MRV product line personally and found it (and their customer support)... less than ideal. (not comparing to anyone else, and no one is really ideal). The bigger problem was that the devices seem to be less than intuitive, but rock solid once they are working. (which is what everyone praised them for). We need to place a new order for some new fiber builds and were considering some other vendors. Especially in the nx2.5G and nx10G (are CWDM x-cievers even available in 10G yet?) range. Anyone have any new favorites? I'll be glad to summarize/commiserate. :) Thanks in advance, DJ

6 6

Lucent GBE (4 x VC4) clues needed
by Saku Ytti 15 Nov '06

15 Nov '06

(oops technical question in nanog, wearing my asbestos suit) Consider this topology GSR - 3750 --(GE over 4xVC4) - NSE100 - NSE100 --(GE over 4xVC4) -- 3550 - GSR All other fibres are dark fibres, except marked. When we ping either NSE100 <-> GSR leg, when there is no background traffic there is no packet loss. If there is even few Mbps, lets say 10Mbps of background traffic we get 1-5% packet loss on 1500 bytes, and bit less packet loss on small packets. As background traffic increases packet loss quickly increases. We tried to replace (GSR-3750) with 7600, but same issue persisted. We've measured both Lucent GBE legs with having loop in other end and pushing tests from EXFO and Smartbits gear through the loop, no errors can be detected in RFC tests. There isn't very much that can be configured in the Lucent, and we've tried pretty much every setting. We've tried to set autonego on and off in every gear in the path, without any changes to observed behaviour. We've also tried to use use 1xVC4, without any changes to the behaviour. All VC4's in given leg are using same path. Even though we test the packet loss pinging from router link to router link, same packet loss is experienced for transit traffic also. We've tried to turn PXF off in NSE100. Packets between NSE100 <-> NSE100 over dark fibre are not lost. We're pretty much utterly without clues. All I can think off is some obscure IFG issue, that is, NSE100 would have less than perfect timing for IFG which would confuse Lucent regarding what is part of which frame. Does stuff like this really happen? NSE100 drops bad IP packets in PXF and there is only shared counter, so I can't tell if I get CRC for IP, I just loose the packets. But IS-IS is not handled in PXF, and I get %CLNS-4-LSPCKSUM and %CLNS-3-BADPACKET messages over both Lucent legs, but not between the NSE100's. So I assume the packets are not dropped, but broken. I swear next time I'll complain about some political issue, thanks, -- ++ytti

3 6

Re: CWDM equipment (current favorites) (fwd)
by alex＠pilosoft.com 03 Nov '06

03 Nov '06

On Mon, 30 Oct 2006, Deepak Jain wrote: > A few years ago, NANOG had a discussion regarding various CWDM vendors. > Repeatedly MRV was brought up as a good option for metro-area LAN type > applications. There's been some discussions more recently, such as (coauthored by yours truly): http://www.nanog.org/mtg-0606/pdf/lightning-talks/4-pilosov.pdf http://www.nanog.org/mtg-0610/presenter-pdfs/pilosov.pdf > Since then, I have actually touched some of the MRV product line > personally and found it (and their customer support)... less than ideal. > (not comparing to anyone else, and no one is really ideal). > > The bigger problem was that the devices seem to be less than intuitive, > but rock solid once they are working. (which is what everyone praised > them for). Passive CWDM gear is pretty much all created equal as far as intuitiveness in how to connect it (assuming gear is non-broken). You have muxes, you have SFPs/GBICs, and you plug GBIC output into the mux input. :) As far as the SFP/GBIC quality, I think MRV is very good. At one point, (maybe even still) Cisco OEM'd MRV gbics under their brand (and with attendant 1000% markup). You can also look at cubo and infineon optics, good quality at reasonable price. Be wary about chiwanese vendors - quality is questionable: high DOA rate, output light level and input sensitivity vary from one module to another. Pricewise, you might find that cubo isn't *that* much more expensive than chiwanese gear. Also, there's market (like, again, from yours truly) of the new-in-box MRV gear, which may also be an option. > We need to place a new order for some new fiber builds and were > considering some other vendors. Especially in the nx2.5G and nx10G (are > CWDM x-cievers even available in 10G yet?) range. Anyone have any new > favorites? 2.5G are only slightly more expensive than 1G - if you have OC48 gear that is SFP-capable, by all means, use that. 10G CWDM is *rumoured* to exist, but I don't think there are any production ones yet. Feel free to correct me. 10G is all DWDM, and so far very pricy.

3 5

advise on network security report
by Rick Wesson 01 Nov '06

01 Nov '06

I would appreciate a bit of advise on a service I am about to deploy. I've spoken at different venues (including nanog) on global infection rates of bots and the general degradation of well behaved hosts. I now track around 2.2M abuse events per day and now have the capability to produce reports for the community on which networks have the largest problems. I am prepared to make reports monthly to the community ordering networks by their volume of issues. I'd like some hints of which might be the most valuable to the community. o are hosts counts or issue counts more important o is a 7 or 30 day window sufficient for aggregation? o I'm not repaired for graphs yet so don't go there. o should I post sub-reports for regions, by RIR? o which kinds of abuse are more interesting. I'm expecting to post a weekly report once a month to nanog, would this be disruptive? We have a mailing list set up for weekly reports, once finalized I'll post the location for its list manager. The global report usually has about 6,000+ networks, the top 100 from last week are below. again, thanks for your feedback. -rick Table 1. Networks with abuse, ordered by #incidents +-------+-----------+------+-------------------------------------+ | asn | incidents | cc | left(asname,35) | +-------+-----------+------+-------------------------------------+ | 4134 | 517830 | CN | CHINANET-BACKBONE | | 9121 | 331955 | EU | TTNet | | 4837 | 289984 | CN | CHINA169-Backbone | | 3320 | 231516 | DE | Deutsche Telekom AG | | 3352 | 211504 | ES | TELEFONICA-DATA-ESPANA Internet Acc | | 5617 | 194685 | PL | TPNET | | 3215 | 181686 | FR | AS3215 | | 3269 | 175858 | EU | ASN-IBSNAZ | | 4766 | 129722 | KR | KIXS-AS-KR | | 19262 | 125003 | US | Verizon Internet Services | | 8551 | 116014 | EU | ISDN-NET-AS | | 3209 | 94981 | DE | UNSPECIFIED | | 3462 | 82089 | TW | HINET | | 9829 | 80538 | IN | BSNL-NIB | | 8151 | 79223 | EU | Uninet S.A. de C.V. | | 8359 | 73640 | RU | MTUONLINE | | 5486 | 65757 | EU | Euronet Digital Communications | | 12322 | 65638 | FR | PROXAD AS for Proxad ISP | | 4788 | 53863 | MY | TMNET-AS-AP | | 9116 | 53375 | IL | Goldenlines main autonomous system | | 4814 | 52712 | CN | CHINA169-BBN | | 22927 | 51899 | AR | Telefonica de Argentina | | 4812 | 46462 | CN | CHINANET-SH-AP | | 1680 | 45848 | IL | NETVISION | | 9105 | 44450 | UK | TISCALI-UK | | 15557 | 42792 | FR | LDCOMNET | | 9498 | 42774 | IN | BBIL-AP | | 8584 | 41914 | US | Barak AS | | 2856 | 41820 | EU | BT-UK-AS | | 13184 | 41688 | DE | HANSENET HanseNet Telekommunikation | | 9318 | 40930 | KR | HANARO-AS | | 12479 | 39009 | EU | UNI2-AS Uni2 Autonomous System | | 6147 | 38716 | US | Telefonica del Peru S.A.A. | | 3243 | 38586 | PT | RIPE NCC ASN block | | 6713 | 35777 | EU | IAM-AS | | 12876 | 35068 | FR | AS12876 | | 6739 | 32639 | ES | ONO-AS | | 8228 | 32352 | FR | CEGETEL-AS CEGETEL ENTREPRISES | | 1267 | 31869 | IT | ASN-INFOSTRADA Infostrada S.p.A. | | 7418 | 30221 | EU | Terra Networks Chile S.A. | | 5462 | 28861 | UK | CABLEINET Telewest Broadband | | 8708 | 28236 | EU | RDSNET | | 5430 | 27245 | DE | FREENETDE | | 7470 | 24729 | TH | ASIAINFO-AS-AP | | 5610 | 24279 | CZ | CZECHTELECOM CZECH TELECOM, a.s | | 16338 | 23956 | ES | AUNA_Telecom-AS | | 4713 | 23650 | JP | OCN NTT Communications Corporation | | 12424 | 22932 | ES | JAZZASN Autonomous System | | 5089 | 21322 | EU | NTL NTL Group Limited | | 17813 | 20792 | IN | MTNL-AP Mahanagar Telephone Nigam L | | 5483 | 20511 | EU | HTC-AS Hungarian Telecom | | 4755 | 19673 | UK | VSNL-AS | | 8764 | 19571 | LT | TELECOMLT-AS | | 28725 | 18369 | CZ | CZ-EUROTEL-AS AS of Eurotel Praha | | 6830 | 18360 | HU | UPC | | 12542 | 17893 | PT | TVCABO Autonomous System | | 9299 | 17854 | PH | IPG-AS-AP | | 18101 | 17325 | IN | RIL-IDC Reliance Infocom Ltd Intern | | 3257 | 16918 | DE | TISCALI-BACKBONE | | 1257 | 16418 | FI | TELE2 AB | | 8881 | 15944 | DE | VERSATEL | | 5713 | 15566 | XX | Telkom SA Ltd. | | 6855 | 15420 | SK | SK SLOVAK TELECOM, AS6855 | | 9304 | 15311 | HK | HUTCHISON-AS-AP | | 5391 | 14937 | EU | T-HT T-Com Croatia Internet network | | 9583 | 14785 | IN | SIFY-AS-IN | | 209 | 14678 | US | Qwest | | 22047 | 14499 | XX | VTR BANDA ANCHA S.A. | | 6849 | 14419 | EU | UKRTELNET | | 24863 | 13616 | EU | LINKDOTNET-AS LINKdotNET AS number | | 8167 | 13184 | BR | TELESC - Telecomunicacoes de Santa | | 20838 | 12898 | ES | YIF-AS | | 6400 | 12563 | XX | Codetel | | 2860 | 12467 | PT | NOVIS Novis Telecom, S.A. | | 13285 | 12347 | UK | OPALTELECOM-AS | | 18403 | 12230 | VN | FPT-AS-AP The Corporation for Finan | | 7132 | 12031 | US | SBC Internet Services | | 20115 | 11683 | US | Charter Communications | | 8452 | 11507 | EU | TEDATA TEDATA | | 4230 | 11385 | BR | Embratel | | 5384 | 10946 | EU | EMIRATES-INTERNET | | 1221 | 10629 | AU | ASN-TELSTRA | | 28573 | 10475 | BR | NET Servicos de Comunicao S.A. | | 8866 | 10434 | BG | BTC-AS | | 9506 | 10126 | SG | MAGIX-SG-AP | | 8997 | 10123 | RU | ASN-SPBNIT SPBNIT-RU Autonomous Sys | | 8404 | 9941 | EU | CABLECOM | | 7693 | 9719 | TH | COMNET-TH | | 12880 | 9663 | IR | DCI-AS | | 6057 | 9432 | XX | Administracion Nacional de Telecomu | | 8402 | 9224 | RU | CORBINA-AS | | 6478 | 8943 | XX | AT&T WorldNet Services | | 5603 | 8913 | SI | SIOL-NET SiOL Internet d.o.o. | | 6327 | 8912 | CA | Shaw Communications Inc. | | 3303 | 8823 | CH | SWISSCOM | | 7552 | 8770 | VN | VIETEL-AS-AP Vietel Corporation | | 11427 | 8757 | XX | Road Runner | | 5466 | 8736 | IE | EIRCOM Eircom | | 6799 | 8634 | GR | OTENET-GR OTEnet S.A. Multiprotocol | | 10318 | 8526 | XX | CABLEVISION S.A. | +-------+-----------+------+-------------------------------------+

8 10

rbnnetwork.org
by Alexander Harrowell 01 Nov '06

01 Nov '06

Is hosting a phishing site and bouncing abuse reports.. ---------- Forwarded message ---------- From: Alexander Harrowell <a.harrowell(a)gmail.com> Date: Oct 31, 2006 2:38 PM Subject: Phisher To: abuse(a)rbnnetwork.org We're receiving large volumes of comments spam advertising a site hosted in your network. http://onlineinvestmentworld.com is located at 81.95.146.166, which is your netblock: inetnum: 81.95.144.0 - 81.95.147.255 netname: RBNET descr: Russian Business Network admin-c: RBNR-ORG tech-c: RBNR-ORG mnt-by: RBN-MNT status: ASSIGNED PA country: RU remarks: INFRA-AW changed: noc(a)rbnnetwork.com 20060 Tracert: 1 0 1 1 0.6 ms 66.36.240.2 AS14361 HOPONE-DCA c-vl102-d1.acc.dca2.hopone.net. 255 US Unix: 14:38:16.496 2 0 2 6 0.6 ms [+0ms] 66.36.224.232 AS0 IANA-RSVD-0 gec2.core1.dca2.hopone.net. 0 miles [+0] 254 US Unknown: 833f257b 3 0 0 1 0.7 ms [+0ms] 66.36.224.233 AS0 IANA-RSVD-0 gec2.core2.dca2.hopone.net. 0 miles [+0] 254 US Unix: 14:07:58.580 4 6 8 6 6.5 ms [+5ms] 198.32.160.102 AS0 IANA-RSVD-0 gi3-0.nyc-002-inter-1.interoute.net. 0 miles [+0] 253 US Unix: 14:37:46.936 5 * 75 77 74 ms [+67ms] 212.23.43.177 AS8928 INTEROUTE gi0-0.nyc-002-inter-1.interoute.net. 0 miles [+0] 248 GB Unix: 14:37:47. 45 6 * 75 75 74 ms [+0ms] 212.23.43.150 AS8928 INTEROUTE po3-0.lon-wal-core-2.interoute.net. 0 miles [+0] 250 GB Unix: 14:37:47.128 7 * 74 74 74 ms [+0ms] 217.118.119.26 AS8928 INTEROUTE te9-1.lon-wal-access-4.interoute.net. 0 miles [+0] 250 GB Unix: 14:37:47.162 8 * 85 78 78 ms [+3ms] 84.233.231.138 AS8928 INTEROUTE unknown.net.uk 0 miles [+0] 248 GB Unknown: 8100e8e2 9 * 124 125 124 ms [+46ms] 81.95.156.34 AS0 IANA-RSVD-0 gbit-eth-34-uk.sbttel.com. 0 miles [+0] 247 RU Unix: 14:37:16.972 10 * 125 124 124 ms [+0ms] 81.95.156.58 AS0 IANA-RSVD-0 oc-3-sbttel.rbnnetwork.com. 0 miles [+0] 55 RU Unix: 14:35:47.772 11 * 143 149 143 ms [+19ms] 81.95.146.166 ASN=40989[Destination Unreachable] ip-146-166.rbnnetwork.com.

4 3

RE: Cogent now peering with Sprint?
by Bob Collie 01 Nov '06

01 Nov '06

That looks like a transit connection that Cogent bought at Ashburn, VA, not SFI peering connection. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Ed Ray Sent: Tuesday, October 31, 2006 12:11 AM To: nanog(a)merit.edu Subject: Cogent now peering with Sprint? I never thought Sprint would ever renew its relationship with Sprint: Tracing the route to portus.netsecdesign.com (66.6.208.6) 1 sl-bb24-rly-9-0.sprintlink.net (144.232.14.122) 0 msec 0 msec 0 msec 2 sl-st22-ash-6-0.sprintlink.net (144.232.20.189) 0 msec 4 msec 0 msec 3 p15-2.core01.iad01.atlas.cogentco.com (154.54.13.61) [AS 174] 4 msec 4 msec 0 msec 4 v3492-mpd01.iad01.atlas.cogentco.com (154.54.3.222) [AS 174] 16 msec 80 msec 196 msec 5 v3497.mpd01.dca01.atlas.cogentco.com (154.54.5.65) [AS 174] 4 msec 4 msec 4 msec 6 t9-3.mpd01.iah01.atlas.cogentco.com (154.54.2.222) [AS 174] 44 msec 44 msec 48 msec 7 t2-3.mpd01.lax01.atlas.cogentco.com (154.54.3.186) [AS 174] 72 msec 72 msec 72 msec 8 g2-0-0.core01.lax01.atlas.cogentco.com (154.54.2.101) [AS 174] 72 msec 72 msec 72 msec 9 g49.ba01.b002698-1.lax01.atlas.cogentco.com (66.250.12.130) [AS 174] 72 msec 72 msec 72 msec 10 PAJO-Networks.demarc.cogentco.com (38.112.9.190) [AS 174] 72 msec 76 msec 72 msec 11 dcap04.pcap.lax01.tierzero.net (216.31.128.14) [AS 11509] 72 msec 76 msec 72 msec 12 mmic-gw.dcap6.lax.us.tierzero.net (216.31.188.94) [AS 11509] 76 msec 80 msec 80 msec 13 dazedandconfused.netsecdesign.com (66.6.208.4) [AS 11509] 84 msec 84 msec 88 msec 14 portus.netsecdesign.com (66.6.208.6) [AS 11509] 84 msec 84 msec 88 msec Next I will see pigs flying :) Wonder how long it will last based on Cogent's past behavior as noted here. Edward Ray ------------------------------------------------------------- This mail was scanned by BitDefender For more informations please visit http://www.bitdefender.com -------------------------------------------------------------

7 6

(OT)MSN/hotmail postmaster contact
by Edward F. Klimowicz 01 Nov '06

01 Nov '06

Is there a postmaster from MSN/Hotmail out there? Mail from my domain to any of yours is being junked and randomly blackholed. No progress has been made yet with the normal tech support. Please reply off list if you can help. -- Edward F. Klimowicz Voicenet Systems Administration edwardk(a)voicenet.com 215.259.2131

5 5

Reciprocal billing by independent LECs
by Ashe Canvar 31 Oct '06

31 Oct '06

Hi all, I am investigatng the reciprocal compensation model in use today between the ILECs and some independents. Specifically, many companies are offering multi party conferencing for free as a side effect of of this reciprocity fee. Seems like there were some disputes about it in the past : http://telephonyonline.com/mag/telecom_draining_incumbent_us/ So is this still a valid business model or is a crackdown by the ILECs in the cards ? All info appreciated. Thanks, Ashe Canvar.

1 0