June 2007 - Test - lists.nanog.org

who was the last legit spammer?
by Travis H. 27 Jun '07

27 Jun '07

Hey, was discussing something from the long distant past recently. Specifically it was my memory of the last legitimate spamhaus, and how (IIRC) their backbone was DDoS'd as an act of pseudo-vigilante justice. I also seem to remember their backbone as spinning it as a content-neutral free-speech kind of thing, but they buckled and the Internet was probably better off. This isn't the kind of thing where one can make an easy google query, but I'll bet you that someone here remembers a name that would lead to a URL that I could forward to the person asking for more info. TIA. -- ``Unthinking respect for authority is the greatest enemy of truth.'' -- Albert Einstein -><- <URL:http://www.subspacefield.org/~travis/> For a good time on my UBE blacklist, email john(a)subspacefield.org.

5 5

XO / Level 3 connectivity issues?
by Patrick Giagnocavo 26 Jun '07

26 Jun '07

Is anyone aware of problems between XO and Level3? I have a VOIP provider telling me that there are problems in Chicago that are affecting VOIP call quality when the IP phone endpoint is on XO and the provider's VOIP switch is on Level3 (symptoms are choppy voice quality with remote caller's voice being garbled or blenderized). --Patrick

1 0

Re: AUP/autoresponders, rehashed
by Martin Hannigan 26 Jun '07

26 Jun '07

On 6/12/07, alex(a)pilosoft.com <alex(a)pilosoft.com> wrote: [ clip ] > > > If you disagree, and think that autoresponders are ok, I'll make sure > > > to set one up just for you ;) > > > > My argument is mostly social, in that we don't need, or want, the admins > > taking punitive positions on anything when the users can do it > > themselves. > Users can't remove others who have autoresponders from mailing list. But they can killfile the most standard error messages "out of office" and sink people who are repeat offenders. But that's if they even post. This means that the vast majority of users are unaffected. All but a few. And some that haven't posted in years. How are they getting these messages? > > To put it bluntly, along with that, don't you have anything better to > > do? > This is the top thing on my todo list. :) How unfortunate. You mischaracterize the original debate you weren't present for, you infer that the SC is holding you back because of the AUP, you received no consensus on any changes, Randy brought this particular issue up at the meeting for about 5 seconds and consensus was challenged in that there was barely anyone in the room _and_ nobody has done any work to get anyone to participate, and you think this is empowerment to act? You act on an issue that affects about 5 people once every 2 years and you ignore the massive overload on the list of off topic posting? This would be called a step backwards. -M<

5 8

Re: Security gain from NAT: Top 5
by Roger Marquis 26 Jun '07

26 Jun '07

Mark Smith wrote: > For all those people who think IPv4 NAT is quite fine, I > challenge them to submit RFCs to the IETF that resolve, without > creating worse or more even more complicated problems, the list > of problems here. All the IPv6 RFCs do ... > <http://www.cs.utk.edu/~moore/what-nats-break.html> These RFCs clearly have an agenda: selling IPv6. It is unfortunate they don't feel it necessary to make a balanced presentation of the pros and cons but instead appear to believe that spreading FUD about NAT is an effective method of promoting IPv6. Problem is that NAT will not go away or even become less common in IPv6 networks for a number of reasons. #1 NAT advantage: it protects consumers from vendor lock-in. Consider the advantage of globally unique public addressing to ISPs and telcos. Without NAT they have a very effective vendor lock-in. Want to change ISPs? It's only as easy as reconfiguring every device and/or DHCP server on your internal network. With NAT you only need to reconfigure a single device, sometimes not even that. #2 NAT advantage: it protects consumers from add-on fees for addresses space. Given the 100 to 10,000% mark-ups many telcos and ISPs already charge for more than a /29 it should come as no surprise they would be opposed to NAT. #3 NAT advantage: it prevents upstreams from limiting consumers' internal address space. Even after full implementation of IPv6 the trend of technology will continue to require more address space. Businesses will continue to grow and households will continue to acquire new IP-enabled devices. Without NAT consumers will be forced to request new netblocks from their upstream, often resulting in non-contiguous networks. Not surprisingly, often incurring additional fees as well. Follow the money and you'll end up with these three reasons why the technical arguments being made against NAT in opinion pieces like Keith Moore's (URL above) are so one sided and overtly biased. But there are still more reasons NAT will continue to increase in popularity regardless of IPv6. #4 NAT advantage: it requires new protocols to adhere to the ISO seven layer model. H.323, SIP and other badly designed protocols imbed the local address in the data portion of IP packets. This trend is somewhat discouraged by the layer-isolation requirements of NAT. #5 NAT advantage: it does not require replacement security measures to protect against netscans, portscans, broadcasts (particularly microsoft's netbios), and other malicious inbound traffic. The vendors of non-NAT devices would love to have you believe that their stateful inspection and filtering is a good substitute for the inspection and filtering required by NAT devices. Problem is the non-NAT devices all cost more, many are less secure in their default configurations, and the larger rulesets they are almost always configured with are less security than the equivalent NAT device. These are just some of the reasons why NAT is, and will continue to be, an increasingly popular technology for much more than address conservation. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

4 3

TransAtlantic Cable Break
by Roderick S. Beck 26 Jun '07

26 Jun '07

Well, despite all this talk about the Latin fiber break, the real news is that one of the TransAtlantic cables has had one of their two cables severed. Repair is not expected until after the US July 4th holiday. So none of the customers on that well known system have any ring protection at this point nor will they during the next two weeks. This is a lesson for those who put all their eggs in one basket. This cable system is also a major IP backbone player. So it shouldn't be too hard to guess their identity. Regards, Roderick S. Beck. Global Wholesale Bandwidth, LLC Manhattan & Paris email: info(a)globalwholesalebandwidth.com New York Landline: 212-942-3345 Paris Landline: 33-1-4346-3209 GSM Wireless: 1-212-444-8829 This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above. Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited. If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer.

16 26

NZNOG 08 - Call for Participation and Papers
by Simon Lyall 26 Jun '07

26 Jun '07

NZNOG 08 - Call for Participation and Papers The next conference of the New Zealand Network Operators' Group is to be held in Dunedin, New Zealand between 23 January and 25 January 2008. Our host is WIC. NZNOG meetings provide opportunities for the exchange of technical information and discussion of issues relating to the operation and support of network services, with particular emphasis on New Zealand. The conference is low priced and has a strong technical focus with the aim and history of getting a strong turnout of technical personal from New Zealand Internet orientated companies. Conference Overview ------------------- NZNOG 2008 will consist of one day workshop and tutorial day followed by two days of conference presentations. There will also be opportunity for more informal and small lightening talks. These are typically around five minutes long and are organised closer to the actual conference. Important Dates --------------- Call for Papers opens: 25 June 2007 Deadline for speaker submissions: 6 August 2007 Responses to speaker submissions: 24 August 2007 Draft program published: 3 September 2007 Final program published: 1 November 2007 NZNOG 2008 Conference: 23 - 25 January 2008 SIG / Miniconf / Tutorials -------------------------- The first day of the conference will again be a workshop and tutorial day. It is usually run as one or more parallel 'interest group' streams and practical or interactive workshops of interest to Network Operators. This is a call for papers and activities for the first day of conference. Examples of past activities workshops include 'MPLS and fixed access networks for beginners', 'Mikrotik RouterOS Training', 'APNIC Internet Resource Management Essentials', and a System Administrators mini-conference which included talks on 'Using Debian packages for system administration' and '42 hosts in 1U: Using virtual machines'. Conference Presentations ------------------------ The main conference program for 2008 will be made up of two days with a single stream where possible. Presentations don't need to fit any particular fixed length and can be from 30 minutes to 3 hours in length. NZNOG conferences have traditionally spanned the entire operational spectrum, and then some. Proposals for conference presentations are invited for virtually any topic with a degree of relevance to the NZNOG community. Past years' talks have included the following: - Internet exchange operations - Global anycast networks and the building thereof - Peering, peering, and peering - Network security - 10GB ethernet operations - Advanced networks in NZ - Current Internet research in NZ - Wireless networking - QOS over carrier networks - Content distribution networks and media streaming - How we paid the construction guys 18 pints of beer and they gave us a free metro fibre network in Palmy North - Open Source VoIP Platform in Carrier Environments If you are interested in submitting a talk please fill out the questions at then end of this document and email them to prog08(a)nznog.org . Submission Guidelines --------------------- When considering a presentation or SIG, remember that the NZNOG audience is mainly comprised of technical network operators and engineers with a wide range of experience levels from beginners to multi-year experience. There is a strong orientation to offer core skills and basic knowledge in the SIGs and to address issues relevant to the day-to-day operations of ISPs and network operators in the conference sessions. The inclusion of a title, bio, topic, abstract, and slides with proposals is not compulsory but each will help us determine the quality of your proposal and increase the likelihood it will be accepted. Final slides are to be provided by 21 January 2008. Note: While the majority of speaking slots will be submitted by 6 August 2007, a limited number of slots may be available for presentations that are exceptionally timely, important, or of critical operational importance. The NZNOG conference is a TECHNICAL conference so marketing and commercial content is NOT allowed within the program. The program committee is charged with maintaining the technical standard of NZNOG conferences, and will therefore not accept inappropriate materials. It is expected that the presenter be a technical person and not a sales or marketing person. The audience is extremely technical and unforgiving, and expects that the speakers are themselves very knowledgeable. All sessions provide time for questions, so presenters should expect technical questions and be prepared to deliver insightful and technically deep responses. Funding and Support ------------------- NZNOG conferences are community run and funded events that try to keep the cost to attendees as low as possible so generally we are unable to pay the travel costs of speakers. There is a limited amount of funding available to international speakers. Conference presenters will not have to pay any registration fee for the day they are presenting. Discounts for SIG and lightning talk presenters may be available but are not automatic. Lightning talks --------------- Lightning talks are short talks/presentations that last no more than 10 minutes. This is a good opportunity to get your pet topic out there or perhaps to get some experience with presenting without having to go to a full talk. At NZNOG 2008 it is planned that there will be at least one hour long lightning talk session. Sponsors -------- There are opportunities remaining for organisations to sponsor various aspects of the NZNOG meeting. Please contact sponsorship(a)nznog.org for more information Contact ------- Website * http://2008.nznog.org General Enquiries * info(a)nznog.org Talks and Papers * prog08(a)nznog.org Talk Proposals -------------- Please send all talk proposals (including lightning talks) to prog08(a)nznog.org along with the requested information. Questions regarding talks can be sent to the same address. Sponsorship may be available for a limited number of overseas speakers to attend the conference, please indicate if you require assistance with travel and/or accommodation. Author's Full Name: Author's Email Address: Author's affiliation: Author's short biography: Title of Talk: Abstract: Length of talk: Please provide details if a version of this talk has previously been given: Will travel and accommodation assistance be required:

1 0

June 2007 DA Botnet Command and Control
by c2report＠isotf.org 25 Jun '07

25 Jun '07

The drone army (DA) research group surveys, conducted during random time intervals over the past 6 months, associated 3724 unique, apparently active hosts, which were, in some manner, associated with a suspect C&C domain. Naturally, any such association contains peculiarities of measurement such as false positives and attempted "Joe-Jobs" against legitimate hosts. None-the-less, the association is of some interest (probably only to crusty academics) in that unique IP counts combined with DA's monthly rankings reveal a more precise, and likely truer, picture of C&C network demographics. The DA monthly rankings, located on <http://isotf.org/ccreport.html> includes duplicate host reports resulting from multiple domains and ports mapping to a single host. This host duplication tends to inflate estimated host counts within a network. Comparing the "Open" count for a network contained in DA report "Top 20 ASNes by Total suspect domains" with the Uniq IP count contained in the included "Top Forty Unique IP" list should give a better indication of the overall effectiveness of the success of the network's C&C removal efforts. Top forty Unique IP counts within Autonomous System: ASN Uniq IPs Responsible Party 30058 113 FDCSERVERS - FDC Servers.net 25761 86 STAMINUS-COMM - Staminus Communications 23522 85 IPNAP-ES - Ecomdevel (CIT-FOONET) 19318 78 NJIIX-AS-1 - NEW JERSEY INTERN 4837 72 CHINA169-Backbone 4766 69 KIXS-AS-KR Korea Telecom 4134 66 CHINANET-BACKBONE No.31 13301 63 UNITEDCOLO-AS Autonomous System of unitedcolo.de 7132 59 SBC Internet Services 24989 47 IXEUROPE-DE-FRANKFURT-ASN IX Europe Germany AS NA** 43 (No applicable network - Mitigation Address space) 3462 39 HINET Data Communication Business Group 12832 39 LYCOS-EUROPE Lycos Europe GmbH 9318 36 HANARO-AS Hanaro Telecom Inc. 3320 33 DTAG Deutsche Telekom AG 14779 33 INKTOMI-LAWSON - Inktomi Corporation 28753 32 NETDIRECT AS NETDIRECT Frankfurt 8560 31 ONEANDONE-AS 1&1 Internet AG 9121 31 TTNET TTnet Autonomous System 35916 27 Multa 577 26 BACOM - Bell Canada 16265 26 OCOM OCOM AS 3786 25 LGDACOM LG DACOM Corporation 8972 23 INTERGENIA-ASN intergenia autonomous system 14780 21 INKTOMI-LAWSON - Inktomi Corporation 20115 21 CHARTER-NET-HKY-NC - Charter Communications 8376 20 GO-JOR Autonomous System 36420 20 ev1.net 174 19 COGENT Cogent/PSI 3269 19 ASN-IBSNAZ TELECOM ITALIA 10316 19 ABACUS-NET-AS - Abacus America Inc. 22927 19 Telefonica de Argentina 31103 19 KEYWEB-AS Keyweb AG 1668 18 AOL-ATDN - AOL Transit Data Network 2119 18 TELENOR-NEXTEL T.net 3561 18 SAVVIS - Savvis 9155 18 QualityNet AS number 9800 18 UNICOM CHINA UNICOM 19262 18 Verizon Internet Services 1659 17 ERX-TANET-ASN1 Tiawan Academic Network (TANet) Best regards Randy Vaughn gadi evron Randy_Vaughn (at) baylor.edu ge (at) linuxbox.org

1 0

OT: Moment of silence for Rod Beck
by Paul Reubens 25 Jun '07

25 Jun '07

I think we should now wind up the discussion on transoceanic bandwidth and extend our thoughts and prayers to the family in this time of need. >From CNN: Beck was discovered by police officers responding to a call to his home in suburban Phoenix, police department spokesman Andy Hill said Sunday. Foul play is not suspected, though the cause of death might not be known for several days.

2 1

Vietnam arrests alledged fiber-optic cable thieves
by Sean Donelan 25 Jun '07

25 Jun '07

http://www.thanhniennews.com/society/?catid=3&newsid=29347 Police arrested two more people Saturday for stealing undersea fiber-optic cables off the southern coast of Vietnam, including the group.s suspected leader. Ten have been apprehended in the case so far. [...] Eleven kilometers of the TVH (Thailand-Vietnam-Hong Kong) line and 32 km of the APCN (Asia Pacific Cable Network), linking nine Asian countries, have been stolen.

1 0

it was damp in belleview
by Randy Bush 24 Jun '07

24 Jun '07

the network at the belleview meeting was fantastic, thanks to the host, xkl, and the usual suspects (merit, tony, ...). but there was one outage. as best i know, that outage was caused by one of the two upstream transit isps bouncing (at least) the nanog prefix on one of their routers far over the water in seattle. of course, that is why we had two upstreams. but, flap amplification and dear old route flap damping caused our prefix to be damped by a number of global isps. yes, our prefix, not just the path. for those who want to read up on route flap damping and why this caused problems, please see <http://www.nanog.org/mtg-0210/flap.html> "Route Flap Damping: Harmful?" from the 2002 nanog eugene meeting. for those wishing historical perspective on route flap damping, document ripe-378 (may 2006) says 1.1 Background In the early 1990s the accelerating growth in the number of prefixes being announced to the Internet (often due to inadequate prefix-aggregation), the denser meshing through multiple inter-provider paths, and increased instabilities started to cause significant impact on the performance and efficiency of the Internet backbone routers. Every time a routing prefix became unreachable because of a single line-flap, the withdrawal was advertised to the whole core Internet and handled by every single router that carried the full Internet routing table. It was soon realized that the increasing routing churn created significant processing load on routing engines, sometimes sufficiently high load to cause router crashes. To overcome this situation RFD was developed in 1993 and has since been integrated into most router BGP software implementations. RFD is described in detail in RFC 2439. RFD is now used in many service provider networks in the Internet. for reasons described in the 2002 preso cited above, and demonstrated by the network outage in belleview, ripe-378 goes on to conclude 4.0 Recommendation This Routing Working Group document proposes that with the current implementations of BGP flap damping, the application of flap damping in ISP networks is NOT recommended. The recommendations given in ripe-229 and previous documents [2] are considered obsolete henceforth. i.e., it's time to turn it off. you are damaging your customers and others' customers. randy

3 3