May 2007 - Test - lists.nanog.org

RE: qwest backbone
by James Laszko 21 May '07

21 May '07

we are seeing big issues between sbc/at&t and anything connected to level3... James -----Original Message----- From: "Gregori Parker" <Gregori.Parker(a)theplatform.com> Subj: RE: qwest backbone Date: Mon May 21, 2007 1:36 pm Size: 676 bytes To: "NANOG list" <nanog(a)nanog.org> Savvis is also reporting severed fiber, unclear as to whether it's their own or upstream -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of prue Sent: Monday, May 21, 2007 1:12 PM To: davidu(a)everydns.net Cc: nanog Subject: Re: qwest backbone Hi, I believe I can offer some insight into this outage. I have gotten a report which is affecting another network: Level3 fiber cut between Seattle and Olympia Olympia is a city south of Seattle about 50 miles or so, for those who don't know the area. I imagine, based on your reports, that Qwest is also being affected by the fiber cut. Walt

1 0

Re: qwest backbone
by prue 21 May '07

21 May '07

Hi, I believe I can offer some insight into this outage. I have gotten a report which is affecting another network: Level3 fiber cut between Seattle and Olympia Olympia is a city south of Seattle about 50 miles or so, for those who don't know the area. I imagine, based on your reports, that Qwest is also being affected by the fiber cut. Walt

2 1

qwest backbone
by Philip Lavine 21 May '07

21 May '07

Any issues on the qwest backbone ____________________________________________________________________________________Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase. http://farechase.yahoo.com/

4 4

Re: Interesting new dns failures
by Fergie 21 May '07

21 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: >> >> While I agree with you, there are many of us who know that these >> fast-flux hosts are malicious due to malware & malicious traffic >> analysis... > >Oh, so we switched from 'the domain is bad because..' to 'the hosts using >the domain are bad because...' I wasn't assuming some piece of intel at >the TLD that told the TLD that 'hostX that was just named NS for domain >foo.bar is also compromised'. I was assuming a s'simple' system of >'changing NS's X times in Y period == bad'. I admit that's a might naive, >but given the number, breadth, content, operators of lists of 'bad things' >on the internet today I'm not sure I'd rely on them for a global decision >making process, especially if I were a TLD operator potentially liable for >removal of a domain used to process real business :( Well, I don't think I ever implied that, but let's say that there are certainly some fast-flux behavior (fluxing across multiple administratively managed prefix blocks, NS fast-flux) which should immediately raise a red flag. Decisions based on those flags are policy issues -- whether or not someone decides to take action upon only on that information or do further research, is something that has to be determined by the person(s) who detect the behavior, etc. Having said that, most people don't even realize that fast-flux exists... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGUeNhq1pz9mNUZTMRAgC5AJ98cW092rV7ghrlIzjLP89qjiurDACdEFaV qUxEcKgfr42Mh9IQAOmaKr0= =Hrk0 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Interesting new dns failures
by Fergie 21 May '07

21 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: >So, I think that what we (security folks) want is probably not to >auto-squish domains in the TLD because of NS's moving about at some rate >other than 'normal' but to be able to ask for a quick takedown of said >domain, yes? I don't think we'll be able to reduce false positive rates >low enough to be acceptable with an 'auto-squish' method :( Hi Chris, While I agree with you, there are many of us who know that these fast-flux hosts are malicious due to malware & malicious traffic analysis... I completely agree with you, however, on the issue of making assumptions that it will always be malicious -- of course, that will not always be the case. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGUd/7q1pz9mNUZTMRAigSAKDgooaGUsp+GT0sEYcEOivjY0afFwCfWmk6 EaWuXUl9W+3+uQEAEJ1c1SQ= =V6Mu -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

[info@arin.net: [arin-announce] ARIN Board Advises Internet Community on Migration to IPv6]
by bmanning＠karoshi.com 21 May '07

21 May '07

this might be of interest to the operator community. --bill --------- forwarded --------------- ARIN and the other Regional Internet Registries have distributed Internet Protocol version 6, IPv6, alongside IPv4 since 1999. To date, ARIN has issued both protocol versions in tandem and has not advocated one over the other. ARIN has closely monitored trends in demand and distribution for both protocol versions with the understanding that the IPv4 available resource pool would continue to diminish. The available IPv4 resource pool has now been reduced to the point that ARIN is compelled to advise the Internet community that migration to IPv6 is necessary for any applications that require ongoing availability from ARIN of contiguous IP number resources. On 7 May 2007, the ARIN Board of Trustees passed the following resolution: RESOLUTION OF THE BOARD OF TRUSTEES OF ARIN ON INTERNET PROTOCOL NUMBERING RESOURCE AVAILABILITY WHEREAS, community access to Internet Protocol (IP) numbering Resources has proved essential to the successful growth of the Internet; and, WHEREAS, ongoing community access to Internet Protocol version 4 (IPv4) numbering resources can not be assured indefinitely; and, WHEREAS, Internet Protocol version 6 (IPv6) numbering resources are available and suitable for many Internet applications, BE IT RESOLVED, that this Board of Trustees hereby advises the Internet community that migration to IPv6 numbering resources is necessary for any applications which require ongoing availability from ARIN of contiguous IP numbering resources; and, BE IT ORDERED, that this Board of Trustees hereby directs ARIN staff to take any and all measures necessary to assure veracity of applications to ARIN for IPv4 numbering resources; and, BE IT RESOLVED, that this Board of Trustees hereby requests the ARIN Advisory Council to consider Internet Numbering Resource Policy changes advisable to encourage migration to IPv6 numbering resources where possible. Implementation of this resolution will include both internal and external components. Internally, ARIN will review its resource request procedures and continue to provide policy experience reports to the Advisory Council. Externally, ARIN will send progress announcements to the ARIN community as well as the wider technical audience, government agencies, and media outlets. ARIN will produce new documentation, from basic introductory fact sheets to FAQs on how this resolution will affect users in the region. ARIN will focus on IPv6 in many of its general outreach activities, such as speaking engagements, trade shows, and technical community meetings. For more information visit the IPv6 Information Center at: http://www.arin.net/v6/v6-info.html. Regards, Raymond A. Plzak President and CEO American Registry for Internet Numbers (ARIN) ----- End forwarded message -----

1 0

Re: Interesting new dns failures
by Fergie 21 May '07

21 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Roger Marquis <marquis(a)roble.com> wrote: >Nobody's saying that the root servers are responsible, only that they >are the point at which these domains would have to be squelched. In >theory registrars could do this, but some would have a financial >incentive not to. Also I don't believe registrars can update the roots >quickly enough to be effective (correct me if I'm wrong). Why not? The Registrars seem sto being doing a great job of expediting the activation of new domains -- why can't they de-activate them just as quickly when they find out they are being used for malicious purposes? The "business interests" of the registrars, that's why. This is one of the many ways that ICANN, and the registrars in general, are falling down on the job. But I digress... I'll slink back under my rock now. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGUS6Cq1pz9mNUZTMRAtRpAKC0GSrPnj3GRTtZ57sAOQfz4vnraACcDV10 Bp4R0+pkkIWJ5ZvTESy2KUw= =mue1 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: SDH mux question
by Neil J. McRae 21 May '07

21 May '07

Do you know which box is delivering the service? There are a couple of different ways that this could be delivered and lots of incompatabilities between muxes. Cisco 15454 can do this as can Nortel OM and Lucent Metro. The 454 is horrifically expensive though but if you are already a cisco shop it could be the simplest option. Downside to all these devices are the management systems are somewhat not what you'll be used too. :) might be worth asking the carrier to do this for you as for them its could simply be a card in the existing mux (assuming it is a SDH service). Neil -----Original Message----- From: Alexander Koch <efraim(a)clues.de> Sent: 21 May 2007 07:32 To: nanog(a)nanog.org Subject: SDH mux question Folks, I am wondering if anyone of you folks know a box that could take the 4 STM-16 from a STM-64, but with a 4 fiber handoff to a random carrier. Who knows of such a box by any chance? I was looking for the DWDM- type of things (MRV, Transmode) any maybe those do exist. Thanks folks! -ako

1 0

SDH mux question
by Alexander Koch 21 May '07

21 May '07

Folks, I am wondering if anyone of you folks know a box that could take the 4 STM-16 from a STM-64, but with a 4 fiber handoff to a random carrier. Who knows of such a box by any chance? I was looking for the DWDM- type of things (MRV, Transmode) any maybe those do exist. Thanks folks! -ako

2 1

Re: Interesting new dns failures
by Fergie 21 May '07

21 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Roger Marquis <marquis(a)roble.com> wrote: >An odd pattern of DNS failures began appearing in the logs yesterday: > >May 20 15:05:19 PDT named[345]: wrong ans. name (uzmores.com != >ns5.uzmores.com) > Perhaps some fast-flux sticky cruft leftover from abuse? I just looked at the first one on the list [above], and it's certainly tell-tale: http://cert.uni-stuttgart.de/stats/dns-replication.php?query=ns5.uzmores.co m&submit=Query - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGUSmOq1pz9mNUZTMRAjwHAKCotvseQNDwuJ8FScudOW3/lRUzVgCg23ec PtpYE7OtI5J8qRTpvxg0Vp8= =Vl8r -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0