June 2008 - Test - lists.nanog.org

Re: ICANN opens up Pandora's Box of new TLDs
by Martin Hannigan 27 Jun '08

27 Jun '08

Eric; The only reason I would have supported rejecting the proposal is the 'morality' language related to offensive TLD's. . What's your take on that part of the process? Marty ----- Original Message ----- From: Eric Brunner-Williams <brunner(a)nic-naa.net> To: Martin Hannigan Cc: nanog(a)nanog.org <nanog(a)nanog.org>; =?ISO-8859-1?Q?Jean-Fran=E7ois_?=(a)mxa.skyrr.is <=?ISO-8859-1?Q?Jean-Fran=E7ois_?=(a)mxa.skyrr.is> Sent: Fri Jun 27 10:57:15 2008 Subject: Re: ICANN opens up Pandora's Box of new TLDs Martin, I wasn't that impressed with Dave's remarks, but I heard them rather than read them, which may have made a difference. I agree with your views on the substance and spirit of Susan's and Wendy's statements. This -- the new GTLD process -- was originally scheduled to get to completion in 2003 and 2004 -- after the initial 2000 round. Eric Martin Hannigan wrote: >> See pages 17 - 20 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf >> See pages 22 - 25 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf >> > > I think that this is a good read as well, especially the comments by Dave Wodeley, Susan Crawford, and Wendy Seltzer. > > https://par.icann.org/files/paris/BoardMeeting_26June08.txt > > > Best, > > Martin > > > > > >

2 1

Re: ICANN opens up Pandora's Box of new TLDs
by Brandon Butterworth 27 Jun '08

27 Jun '08

> 1. Nobody is FORCING them to do so. scammers, squaters and click collectors > 3. It is somewhat anti-social to do so So are the abusers. If someone is going to it may as well be us (marginally less evil) brandon

5 4

Techniques for passive traffic capturing
by Ross Vandegrift 25 Jun '08

25 Jun '08

Hello everyone, Over the past two years, there's been a trend toward doing more and more analysis and reporting based on passive traffic analysis. We started out using SPAN sessions to produce an extra copy of all of our transit links for these purposes. But the Cisco limits of two SPAN sessions per device (on our platforms) is a major limitation. Does anyone have a better soultion for more flexible data collection? I've been thinking about a move to a system based on optical taps of each of the links. I'd aggregate these links into something like a 3750 and use remote-span VLANs to pass the traffic onto servers that sniffing on their interface on that 3750. Do products like the NetOptics Matrix Switches offer a substantial advantage? Comments or suggestions? -- Ross Vandegrift ross(a)kallisti.us "The good Christian should beware of mathematicians, and all those who make empty prophecies. The danger already exists that the mathematicians have made a covenant with the devil to darken the spirit and to confine man in the bonds of Hell." --St. Augustine, De Genesi ad Litteram, Book II, xviii, 37

5 6

Seeking clue @ Cbeyond / ASN17184 and/or other suggestions
by Mike Lewinski 25 Jun '08

25 Jun '08

We're having some difficulties getting a lame DNS delegation and old email hosting configuration removed from Cbeyond's servers. According to their front line tech support "We cannot work on something we do not host no more". Jared's NOC list doesn't have anything on them, nor do they appear to participate in INOC-DBA. Additional attempts to resolve this are noted below. The specific issues are: 1) lame authority on prosourcedenver.com: $ dig +short ns prosourcedenver.com @beyond.cbeyond.net. beyond.cbeyond.net. infinity.cbeyond.net. to.cbeyond.net. vs: $ dig +short ns prosourcedenver.com @c.gtld-servers.net ns0.rockynet.com. ns1.rockynet.com. ns2.rockynet.com. Front line tech support indicated this is a Registrar problem, and they would open up a ticket with Tucows to get it resolved :( I also tried sending an email to the address in the SOA: $ dig +short soa prosourcedenver.com @beyond.cbeyond.net. prosourcedenver.com. hostmaster.cbeyond.com. 2004042100 86400 1800 604800 3600 $ Unfortunately, that address is invalid :( <hostmaster(a)cbeyond.com>: host mx2.cbeyond.net[64.238.96.58] said: 550 #5.1.0 Address rejected hostmaster(a)cbeyond.com (in reply to RCPT TO command) 2) The invalid MX records that Cbeyond is serving resolve to hosts that apparently believe they are authoritative for the prosourcedenver.com domain, and are in effect creating an email blackhole: $ dig +short mx prosourcedenver.com @to.cbeyond.net. 10 mail.west.cbeyond.com. 20 smtp.atl.cbeyond.com. $ telnet mail.west.cbeyond.com smtp Trying 66.180.96.57... Connected to mail.west.cbeyond.com (66.180.96.57). Escape character is '^]'. 220 mail.east.cbeyond.com ESMTP EHLO me 250-mail.east.cbeyond.com 250-8BITMIME 250-SIZE 20971520 250-STARTTLS 250-AUTH PLAIN LOGIN 250 AUTH=PLAIN LOGIN mail from:<> 250 sender <> ok rcpt to:<MUNGED(a)prosourcedenver.com> 250 recipient <MUNGED(a)prosourcedenver.com> ok ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ rcpt to:<anyone(a)anywhere.com> 550 #5.1.0 Address rejected anyone(a)anywhere.com QUIT 221 mail.east.cbeyond.com Connection closed by foreign host. $ Email to postmaster(a)cbeyond.com hasn't resolved the issue either :( All of the above commands have been sent to their tech support address in an attempt to convince them that the problem is with their servers, but they refuse to accept this. Finally, as an additional note, the whois delegation for their ASN seems to be broken: $ whois -h whois.arin.net 17184 [Querying whois.arin.net] [Redirected to rwhois.cbeyond.net:4321] [Querying rwhois.cbeyond.net] [rwhois.cbeyond.net] %rwhois V-1.5:003eff:00 rwhois.cbeyond.net (by Network Solutions, Inc. V-1.5.9.5) %error 230 No Objects Found $ I'm at a loss of how to proceed now, except to tell people who are suffering from the email blackhole to find another ISP. Does anyone else have any contacts with a clue, or semblance of clue, at Cbeyond? Does anyone have any better ideas for me, short of this lame attempt at public shaming? I won't even get into the issue of what a PITA it is to port DIDs from them.... :(

1 1

Intrustion attempts from Amazon EC2 IPs
by Paul Kelly :: Blacknight 24 Jun '08

24 Jun '08

Hi there, Have any of you recently noticed a lot of ssh scanning coming from amazons EC "cloud" IP blocks? Today alone I've seen approx 4m attempts from EC2 IPs on just 20 nodes on our network. Has anyone any experience with Amazons abuse people? Thanks, Paul Paul Kelly Technical Director Blacknight Internet Solutions ltd Hosting, Colocation, Dedicated servers IP Transit Services Tel: +353 (0) 59 9183072 Lo-call: 1850 929 929 DDI: +353 (0) 59 9183091 e-mail: paul(a)blacknight.ie web: http://www.blacknight.ie Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park, Sleaty Road, Graiguecullen, Carlow, Ireland Company No.: 370845

32 48

easy way to scan for issues with path mtu discovery?
by Darden, Patrick S. 24 Jun '08

24 Jun '08

Hi all, Does anyone know of an easy way to scan for issues with path mtu discovery along a hop path? E.g. if you think someone is ICMP black-holing along a route, or even on the endpoint host, could you use some obscure nmap flag to find out for sure, and also to identify the offending hop/router/host? What tool would you use to test for this, and how would you do such a test? Is there any probing tool that does checks like this automatically? Seems to me this happens often enough that someone has probably already figured it out, so I am trying not to reinvent the wheel. All I can think of would be to handcraft packets of steadily increasing sizes and look for replies from each hop on the route (which would be laborious at best). Google has not been kind to my researches so far. I appreciate any help! --Patrick Darden

5 4

Re: Level3 IPv6 availability?
by Brandon Butterworth 24 Jun '08

24 Jun '08

> > Is anyone at Level3 who is familiar with IPv6, or anyone who is a Level3 > > IPv6 customer lurking here? We are a Level3 BGP customer and our > > contacts are giving us a deer-in-the-headlights stare when we want to > > bring up our /32, claiming that they don't do IPv6 at all. Not native, > > not tunneled, zip, nada. > > We've recently brought up IPv6 with Level3. It's done as an IPv6IP tunnel to > their nearest IPv6 router. I may be able to dig out the form you need... See http://www.bogons.net/dl/level3_ipv6.doc brandon

1 0

Creating demand for IPv6, and saving the planet
by Daniel Senie 24 Jun '08

24 Jun '08

A number of people have bemoaned the lack of any IPv6-only killer-content that would drive a demand for IPv6. I've thought about this, and about the government's push to make IPv6 a reality. What occurred to me is there is a satellite sitting in storage that would provide such content: http://en.wikipedia.org/wiki/Triana_(satellite) Al Gore pushed for this satellite, Triana, to provide those on earth with a view of the planet among its scientific goals. The Republicans referred to it as an "overpriced screen saver," though the effect even of just the camera component on people's lives and how they treat the planet could be considerable. By combining the launch of Triana with feeding the still images and video from servers only connected to native IPv6 bandwidth, the government would provide both a strong incentive for end users to want to move to IPv6, and a way to get the people of this planet to stop from time to time and ponder the future of the earth. Of course getting this done any time soon would require getting the present administration to reverse its bias against Triana and global warming. But it seemed to me an interesting way to advance two goals in synergy. Dan -- ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com "Our lives begin to end the day we become silent about things that matter." -- Martin Luther King, Jr.

26 54

Versaweb abuse contacts
by William Pitcock 24 Jun '08

24 Jun '08

Hi, If someone on this list works for Versaweb and can handle a botnet situation, please contact me off list. William

1 0

Comcast
by Edward A. Trdina III 24 Jun '08

24 Jun '08

Anyone from Comcast on-list? I'm getting hit with phishing emails that have a link to a Wachovia look alike page that's hosted on a comcast HSI account in South Bend Indiana.(At least thats what the SWIP says). Thanks! Ed

1 0