September 2008 - Test - lists.nanog.org

About.com/NYTimes admins about?
by Christopher Morrow 01 Oct '08

01 Oct '08

Is there perhaps an about.com/nytimes.com admin around? I was wondering if they perhaps knew that their loadbalancer for www.nytimes.com is fairly broken wrt answering AAAA queries: (who's NS for nytimes.com) dig NS nytimes.com +short ns1t.nytimes.com. nydns2.about.com. nydns1.about.com. (who do they think is the NS for www.nytimes.com) dig www.nytimes.com @ns1t.nytimes.com. NS ;; QUESTION SECTION: ;www.nytimes.com. IN NS ;; AUTHORITY SECTION: www.nytimes.com. 60 IN NS nss1.sea1.nytimes.com. www.nytimes.com. 60 IN NS nss1.lga2.nytimes.com. (what is the AAAA for www.nytimes.com ?? ) dig www.nytimes.com @nss1.sea1.nytimes.com. AAAA ;www.nytimes.com. IN AAAA ;; AUTHORITY SECTION: . 3600000 IN NS k.root-servers.net. . 3600000 IN NS l.root-servers.net. . 3600000 IN NS m.root-servers.net. . 3600000 IN NS a.root-servers.net. . 3600000 IN NS b.root-servers.net. . 3600000 IN NS c.root-servers.net. . 3600000 IN NS d.root-servers.net. . 3600000 IN NS e.root-servers.net. . 3600000 IN NS f.root-servers.net. . 3600000 IN NS g.root-servers.net. . 3600000 IN NS h.root-servers.net. . 3600000 IN NS i.root-servers.net. . 3600000 IN NS j.root-servers.net. ;; ADDITIONAL SECTION: k.root-servers.net. 3600000 IN A 193.0.14.129 l.root-servers.net. 3600000 IN A 198.32.64.12 m.root-servers.net. 3600000 IN A 202.12.27.33 ;; Query time: 89 msec ;; SERVER: 170.149.172.35#53(170.149.172.35) wha??? <ricky voice>Lucy, your loadbalancer is foobar'd</ricky voice> In an effort to make v6 things work a tad better in this hostile world, could the NYTimes folks let us know what sort of LB that is? and why it wants to not be a good Intenet Citizen?? -Chris

4 6

DSL at MAE-East
by George William Herbert 01 Oct '08

01 Oct '08

Is there anyone who has successfully gotten DSL for out of band back channel into the MAE-East building? We're being told it's impossible, and somehow this strikes me as somewhat improbable... Thanks. -george william herbert gherbert(a)retro.com

7 9

rackmount managed PDUs
by Justin M. Streiner 30 Sep '08

30 Sep '08

As much as I hate to tear people away from the Intercage/Atrivo debacle and semi-tangential rants, I'll take one for the team and do it :) I have an opportunity coming up to rebuild an existing machine room space to an extent. It's not a total gut-and-refit, but I'll at least get to put in some new infrastructure. That said, I'd be interested in hearing about peoples' experiences with various rackmountable managed PDUs. I have some Tripp Lite PDUMH30NETs that work well and are reasonably priced, but they have a few quirks (no RS-232 console port, web interface seems to be a little shaky with Firefox, etc) that would become more annoying when scaled up to several rows of new rack footprints. I'm also open to using managed vertically mounted PDUs. The plan is for each footprint to have "A" and B" feeds, so two PDUMH30NETs would take up 4U per footprint, which is a bit much... I don't need to worry about distributing DC power - just AC. This site will be lights-out most of the time, so robust remote management capabilities are a must. Any thoughts/insight are greatly appreciated. jms

15 16

RE: [nanog] Advice in dealing with BGP prefix hijacking
by mack 29 Sep '08

29 Sep '08

First I would contact them, you have obviously done this and it didn't work since it happened again. Second I would contact their major transit providers, assuming they aren't a major transit provider themselves. If you share mutual transit providers then you will be most likely to get satisfactory results. If you aren't a customer of their transit provider then you may not get anywhere. Third you can contact ARIN to talk to the perpetrator and/or their transit providers. This is one of their primary functions. The final option is legal. IANAL (usual disclaimer) CMU probably has a legal department that may be able to request an injunction or file suit for damages. People tend to forget that when prefixes are hijacked there is legal recourse after the fact. Of course with the international nature of the internet legal recourse may be difficult or impossible. In this case with a US based ISP, the legal remedy might be feasible. This is long slow and doesn't help at all during an incident, but it will probably keep it from happening again. ISPs are businesses and when it hits the pocket book they pay attention. -- LR Mack McBride Network Administrator Alpha Red, Inc. > > Message: 2 > Date: Mon, 29 Sep 2008 11:10:48 -0400 > From: "L. Gabriel Somlo" <mikebenden(a)gmail.com> > Subject: Advice in dealing with BGP prefix hijacking > To: nanog(a)nanog.org > Message-ID: <20080929151048.GA19783(a)hedwig.net.cmu.edu> > Content-Type: text/plain; charset=us-ascii > > Hi, > > I'm looking for advice on how to deal with a US ISP (names withheld to > protect the guilty) which seems to repeatedly fat-finger our IP space > into their BGP announcements, and then gives us the run-around when we > call them on the phone, since we're not their clients... > > Happened twice already, took several hours to fix each time, and I'm > looking for any ideas, opinions, and war stories that would help me > figure out how to discourage them from repeating this type of thing > in the future... > > Thaks much, > > Mike > >

1 0

Re: BGP for disaster recovery site
by Scott Weeks 29 Sep '08

29 Sep '08

Inline... --- CHRISTINE.M.BERNS(a)sargentlundy.com wrote: We currently have a routable block (class B) of IP addresses. We are in the process of designing a disaster recovery site. Our main site is already dual homed to two different Internet service providers via BGP. ------------------------------------------------ First, unless the first two bits of the first octet are "10" it's not a "Class B". It's a /16, which is the same size as a "Class B" but the first two bits of the first octet are not necessarily "10". Are these two sites (main and DR) in the same ASN? ------------------------------------------------- A consultant told us that in order to allow us to test access to the DR site without affecting the production environment, we should get another block of addresses from ARIN and advertise those addresses out the DR site's Internet connection. Can we even expect to get another block from ARIN if we already have a class B... ------------------------------------------------- I would consider another consultant if you have not used 80% of your current allocation. ARIN will not allocate anymore space until you hit 80% utilization ------------------------------------------------- ...and could we not accomplish the same thing by advertising a subnet of our existing Class B at the DR site? I would actually prefer to advertise a subnet of our class B, but am wondering if there are any reasons why this is not a good idea. ------------------------------------------------- If the two sites are not in the same AS it's not a good idea unless you're experienced with such things. See past posts in the archives about the subject. ----------------------------------------------- Also, I have seen reference to some Internet service providers possibly not accepting /24 BGP routes and either dropping them or aggregating them to a /21 or /20 or /19. Are there recommendations as to what is the longest prefix that we should advertise to guarantee that the prefix will be advertised throughout the Internet? --------------------------------------------------- Nothing is ever guaranteed WRT routing certain prefix sizes on the internet, but you should have no problems with a /24. Any longer (a /25) and you will not have good connectivity on the internet. scott

1 0

Re: Advice in dealing with BGP prefix hijacking
by Scott Weeks 29 Sep '08

29 Sep '08

--- mikebenden(a)gmail.com wrote: From: "L. Gabriel Somlo" <mikebenden(a)gmail.com> I'm looking for advice on how to deal with a US ISP (names withheld to protect the guilty) which seems to repeatedly fat-finger our IP space into their BGP announcements, and then gives us the run-around when we call them on the phone, since we're not their clients... ------------------------------------------ Talk to their upstream(s) and ask them to filter the ISP properly. Show the upstreams evidence of the ISPs wrongful announcements from router commands, bgplay or other tools. scott

1 0

Re: Renesys Blog Article [Was: Re: the Intercage mess]
by Henry Linneweh 29 Sep '08

29 Sep '08

If a consensus can be reached here, we have seen a rise in this, that does raise concerns of a RIAA/MPAA type of mindset, which is detrimental vigilante Definition vigi·lante (vij′ə lan′tē, -län′-) noun 1. a member of a vigilance committee 2. any individual who acts outside of legal authority, often violently, to punish or avenge a crime, right a perceived wrong, etc. vigi·lan·tism (vij′ə lan′tiz′əm, -län′-; vij′ə lən tiz′əm) noun the lawless, violent methods, spirit, etc. of vigilantes vigilantism Related Forms vig′i·lan′·tist adjective vigilantism Usage Examples Noun used with modifier * 'Internet: But this has come under fire from many who see it as an example of 'Internet vigilantism ' that could destabilize Internet trading. Adjective modifier * self-appointed: We must, moreover, take action which is firm enough to pre-empt action by self-appointed vigilantes. ========================================================================= ----- Original Message ---- From: Gadi Evron <ge(a)linuxbox.org> To: Paul Ferguson <fergdawgster(a)gmail.com> Cc: nanog(a)nanog.org; nanog-post(a)rsuc.gweep.net Sent: Wednesday, September 24, 2008 6:02:21 PM Subject: Re: Renesys Blog Article [Was: Re: the Intercage mess] On Wed, 24 Sep 2008, Paul Ferguson wrote: > Just a side-note: Rensys has an interesting blog article up today on this > Atrivo/Intercage "mess": > > http://www.renesys.com/blog/2008/09/internet_vigilantism_1.shtml > > FYI, I have but one comment. There is a difference between Vigilantism as it is perceived today and Vigilantism as it is in the dictionary. It means neighborhood watch. When the Police is not around, that is something you need. "It's for the children". All in all, very nice blog post. While I feel I can not yet fully comment on the whole Atrivo / Intercage depeering movement, there is an underlying strategy to consider. I will comment at a later date. Gadi.

7 6

BGP for disaster recovery site
by CHRISTINE.M.BERNS＠sargentlundy.com 29 Sep '08

29 Sep '08

We currently have a routable block (class B) of IP addresses. We are in the process of designing a disaster recovery site. Our main site is already dual homed to two different Internet service providers via BGP. A consultant told us that in order to allow us to test access to the DR site without affecting the production environment, we should get another block of addresses from ARIN and advertise those addresses out the DR site's Internet connection. Can we even expect to get another block from ARIN if we already have a class B, and could we not accomplish the same thing by advertising a subnet of our existing Class B at the DR site? I would actually prefer to advertise a subnet of our class B, but am wondering if there are any reasons why this is not a good idea. Also, I have seen reference to some Internet service providers possibly not accepting /24 BGP routes and either dropping them or aggregating them to a /21 or /20 or /19. Are there recommendations as to what is the longest prefix that we should advertise to guarantee that the prefix will be advertised throughout the Internet? Chris

2 1

Advice in dealing with BGP prefix hijacking
by L. Gabriel Somlo 29 Sep '08

29 Sep '08

Hi, I'm looking for advice on how to deal with a US ISP (names withheld to protect the guilty) which seems to repeatedly fat-finger our IP space into their BGP announcements, and then gives us the run-around when we call them on the phone, since we're not their clients... Happened twice already, took several hours to fix each time, and I'm looking for any ideas, opinions, and war stories that would help me figure out how to discourage them from repeating this type of thing in the future... Thaks much, Mike

1 0

Live.com admin
by Childs, Aaron 29 Sep '08

29 Sep '08

If there is an admin/postmaster for live.com on this list could you please contact me off-list? Thank you, Aaron ------------- Aaron Childs Assistant Director, Networking Westfield State College http://www.wsc.ma.edu/it/ "I would rather write 10,000 notes than one letter of the alphabet." -- Beethoven

1 0