January 2009 - Test - lists.nanog.org

DNS DDoS Host list
by Andrew Fried 26 Jan '09

26 Jan '09

Based on the logs from the past 48 hours, here are the hosts that appear to be under attack. The count field reflects the individual number of "'./NS/IN' denied" log entries that appeared in my logs. Note that the stats for 206.71.158.30 are under-reported due to the fact that I blackholed that address last night, however packet captures reveal that I'm no longer seeing spoofed packets targeting that address. +----------------+-------------+ | host | count(host) | +----------------+-------------+ | 10.168.69.6 | 18 | | 202.104.106.49 | 84 | | 206.71.158.30 | 34327 | | 210.21.218.138 | 84 | | 63.217.28.226 | 2696 | | 66.230.160.1 | 3541 | | 76.9.16.171 | 1355 | +----------------+-------------+ -- Andrew Fried andrew.fried(a)gmail.com

1 0

Mcast mpeg2 and unicast h.264 for NANOG-45
by Anton Kapela 26 Jan '09

26 Jan '09

List, The DR meeting is now available in HD video format at the following addresses: mcast feed: 25 mbit HDV, mpeg Transport Stream, UDP: 233.0.59.45 port 1234 unicast feeds: ~1mbit HD-Lite h.264, in mpeg TS: HTTP://208.66.134.110:8000 ~3mbit HDV h.264, in mpeg TS: HTTP://208.66.134.110:9000 Enjoy, -tk

11 16

NANOG 45 PGP signing party. (update)
by Joel Jaeggli 26 Jan '09

26 Jan '09

Just a quick note, The thrice annual NANOG pgp key signing party will be making an appearance at NANOG 45. The keysigning sessions are going to be during the morning breaks during the general session, and will be located in the Higuey room on the pool side of the hotel. Monday January 26th 11:00-11:30 Tuesday January 27th 11:00-11:30 It is not to late to add your key to the keyring at: https://biglumber.com/x/web?keyring=9210 Then come to one or both sessions with some form of government issued photo ID. If you have any further questions, feel free to contact me via email. Feel free to add your key to the keyring right up to the time of the last keysigning event. Thanks Joel

1 0

BGP on Mac OS X?
by cayle.spandon＠gmail.com 26 Jan '09

26 Jan '09

Does anyone known which open source BGP implementation I can get running on Mac OS X Leopard with a minimum of fuss? This is for experimentation only (not for a production environment) so I am not too concerned about scaling and performance. If any tweaking is needed to get it to compile / run on OS X, a pointer to a website with instructions would be highly appreciated. -- Cayle.

4 4

inauguration streams review
by Fred Heutte 26 Jan '09

26 Jan '09

Normally I wouldn't do this but given that it's of-the-moment... fh ------------------------- http://www.salon.com/tech/giga_om/online_video/2009/01/20/a_quick_review_of… Tuesday, January 20, 2009 08:02 PST A Quick Review of Obamas Inauguration Streams By Chris Albrecht You may have heard, but Barack Obama gets to ditch the -elect part of his title today as he will be sworn in (shortly) as our new President. Weve already provided an comprehensive list of where to watch the inauguration online, but heres a quick review of what to expect from some of them, so far. C-Spans coverage is not very impressive. The video window was small, and choppy. Avoid. CBS is offering 7 HD streams of the event, and they look awesome. Definitely the best of the lot worth watching. MSNBC, FOX (which is providing Hulus feed) and ABC Newss video is solid, nothing too flashy. They all work just fine (and I love that MSNBC allows embeds). Visit msnbc.com for Breaking News, World News, and News about the Economy I had problems with CNN. It was the only network that asked me to install an update to Flash as well as another plug-in. I skipped the second plug-in and it worked fine. The videos in widescreen, which is nice, and the Facebook integration gives you a running commentary. The Presidential Inauguration Committees stream is pretty dull, offering just imagery and no commentary. If our internal stats are any indication, this is going to be a huge day for live-streaming, and it looks like for the most part, every network involved is holding up and the Internet wont crash (of course, we still have an hour to go).

10 12

Re: Are we really this helpless? (Re: isprime DOS in progress)
by a.harrowell＠gmail.com 25 Jan '09

25 Jan '09

-original message- Subject: Re: Are we really this helpless? (Re: isprime DOS in progress) From: Michael Dillon <wavetossed(a)googlemail.com> Date: 25/01/2009 10:16 pm > > I think each point above is true -- BCP38 is indeed a technique, but > failure to universally implement it defaults to (almost) a tragedy of the > commons. > > After ~10 years, it is surreal to me that we, as a community, are still > grappling with issues where it could be beneficial for the Internet > community at-large. I mean, it _is_ a BCP. > The community isn't grappling with the issue. For the most part the NANOG community has implemented BCP 38. The problem is that there are lots of ISPs that are not part of the community and I get the sense that the this number continues to grow. In a sense NANOG has a problem with dwindling market-share. A shrinking percentage of ISPs are part of the NANOG community, and NANOG participants have less and less influence on decisions in the ISPs that they work for, probably because most of them do not work for ISPs but work for telephone companies which have expanded into the ISP business. And yes, I too work for a telco that is now also a major ISP in its telco market area. p.s. Even when Dan Senie and I drafted RFC2827/BCP38, we were doing nothing more than documenting what everyone (well, maybe not everyone) already knew > anyway -- that we all need to bite the bullet and just do it. > Personally, I think that the network operations community represented in NANOG needs to do more outreach to forums where the telecoms community gather rather than ghettoizing Internet ops and engineering. It's all well and good to have NANOG lists and meetings, but once things like BCP-38 reach consensus, how many NANOG members would consider going to something like FutureNet Expo and presenting on the topic? --Michael Dillon Both to telcos and to non-NA operators. Remember that everything is going to IP. All the interesting voice applications seem to be based on Asterisk in the end, China Mobile is apparently building a flat-IP net with media servers. And there are plenty of clever innovative people outside NA.

1 0

NANOG45 Attendees - Tonight's Dominican Fiesta Party!
by Joshua Snowhorn 25 Jan '09

25 Jan '09

All NANOG45 Attendees! Don't miss tonight's Dominican Fiesta Party sponsored by the Dominican Government for NANOG attendees in Santo Domingo. Buses will be outside the lobby starting 7 p.m. and leaving the hotel promptly at 7:30 p.m. If you miss the bus you can take a taxi (~US$10) to: Restaurant Pate Palo Alcazar de Colon Plaza Espana See you there! Josh Snowhorn as Host and for the NANOG Program Committee

1 0

massive routes hijack at AS48400, up to 6000 AS affected?
by AKK 25 Jan '09

25 Jan '09

Hi all, Jan 24 23:20 - Jan 25 01:45 UK time, from LINX peers I have seen major performance degradation on unusually strange route to some eastern Europe countries - see MTR at the bottom of this email. If this is true, it is exactly what few people told us(and we knew) last year. Probably AS48400, which is defined as two ISP multihomed non-transit at RIPEDB, announced various prefixes it had from their ISP.. actually from one ISP to another becoming a transit ISP. I am sure this was not the only faulty point in this failure, but it took quite a while for ISPs to fix it.. It would be interesting to know whether that was unintentional... I know that at least two countries in that way were almost taken internationally offline. I wonder if some sort of action should/will be taken.. Unfortunately ripe's asinuse doesn't tell the story about 48400, but you would find that in raw update logs and bgpplay where I counted around 6k AS were affected. AS PATH 8468 8732 12389 48400 48400 48400 48400 20485 1299 20965 2847 4. te5-1.telehouse-east.core.enta.net 0.1% 2991 1.0 12.1 0.9 282.4 37.5 5. te5-1.telecity-hex.core.enta.net 0.1% 2991 1.2 3.5 0.9 218.9 17.7 6. te5-3.frankfurt.core.enta.net 0.0% 2991 18.0 22.7 17.8 224.9 25.0 7. decix.comcor.ru 0.0% 2991 64.5 64.1 63.6 92.6 0.9 8. 213.171.44.10 90.5% 2991 113.6 115.9 111.9 193.5 8.6 9. 87.226.137.162 99.4% 2991 107.0 106.0 104.4 107.8 0.9 10. 92.50.194.254 98.9% 2991 121.0 123.2 120.4 135.1 2.7 11. vgd15.transtelecom.net 90.4% 2991 114.8 113.4 111.2 117.6 1.1 12. adm-b1-link.telia.net 88.9% 2991 103.7 104.4 102.1 108.0 1.1 13. adm-bb2-link.telia.net 89.9% 2991 105.8 104.5 102.3 119.3 1.5 14. hbg-bb2-pos7-0-0.telia.net 89.8% 2991 116.4 115.7 112.9 122.0 1.2 15. kbn-bb2-pos1-2-0.telia.net 90.7% 2986 120.6 120.7 117.9 137.1 1.7 kbn-bb2-link.telia.net kbn-bb2-link.telia.net 16. kbn-b2-pos5-0.telia.net 89.7% 2986 121.0 124.7 118.4 257.9 16.1 kbn-b2-link.telia.net 17. dante-ic-125712-kbn-b2.c.telia.net 89.2% 2985 127.1 123.2 119.3 207.3 8.9 18. so-0-0-0.rt1.tal.ee.geant2.net 89.4% 2984 135.2 136.8 133.9 162.7 2.8 19. so-1-0-0.rt1.rig.lv.geant2.net 89.2% 2984 145.4 144.7 142.2 170.9 2.1 20. 62.40.112.169 90.0% 2981 151.1 152.1 149.8 171.6 1.8 21. litnet-gw.rt1.kau.lt.geant2.net 90.8% 2981 152.4 152.3 149.6 158.7 1.2 22 .. Regards, Andrius KK

2 1

RE: Tracking the DNS amplification attacks (was: isprime DOS in progress)
by Roger Marquis 25 Jan '09

25 Jan '09

Frank Bulk wrote: > I would not recommend sucking in your dns log into array, rather, read line > by line and iterate over the file, line by line. Agreed. Python and Pytailer <http://code.google.com/p/pytailer/> are particularly good tools for this application, running as a daemon and implementing IP filters as needed. This is all, however, treating symptoms. The root cause would be far better fixed with a named patch implementing Chris Paul's recommendation to NANOG back in August: >Chris Paul wrote >> Sorry if this is real stupid for some reason because I don't think about >> DNS all day (I'm the ldap dude) but since we have faster networks and >> faster cpus today, what would be the harm in switching to use TCP for >> DNS clients? The latency on the web isn't dns anymore ever it seems to >> me..... > > That's the best idea I've read so far. You wouldn't want to toggle > protocols on the first mismatch, but maybe the 10th or 50th. Would also be > worthwhile to factor in some rate limiting and an algorithm for timing the > toggle-back. Stir in some simple statefulness via btree and voila. Roger Marquis

1 0

NetSol / WorldNIC nameservers continue to be down, for a couple days.
by David Ulevitch 24 Jan '09

24 Jan '09

Does anyone have any contact at NetSol / WorldNIC? Their nameservers (all hundred+ of them) have been down or severely degraded in service over the last 48 hours. TTLs are starting to expire and the only evidence we've found that NETSOL is aware is this thread: http://forums.networksolutions.com/announcements-f4-dns-issues-possible-imp… Is there anyone here who can provide an update to the ISPs and SPs on this list? NetSol still (amazingly) manages to do DNS for a few hundred thousand domains... -David

3 2