December 2009 - Test - lists.nanog.org

AT&T blocking individual IP addresses
by Scott Howard 09 Dec '09

09 Dec '09

As of about an hour ago AT&T appear to have started blocking access to a few of our IP addresses. This is being done at a /32 level, and the IP addresses above and below are still allowed through. Has anyone seen them do this before, or know who I need to contact to get it fixed? AT&T won't talk to me as I'm not a customer... Traceroute to the blocked IPs from AT&T all end at : 5 cr2.phlpa.ip.att.net (12.122.3.226) [MPLS: Labels 20559/17406 Exp 0] 116 msec 20 msec 20 msec 6 cr2.cl2oh.ip.att.net (12.122.2.209) [MPLS: Labels 20527/17406 Exp 0] 24 msec 20 msec 20 msec 7 cr1.cl2oh.ip.att.net (12.122.2.125) [MPLS: Labels 0/17406 Exp 0] 24 msec 20 msec 20 msec 8 cr82.dtrmi.ip.att.net (12.123.139.154) [MPLS: Label 16623 Exp 0] 24 msec 20 msec 20 msec 9 gar4.dtrmi.ip.att.net (12.122.102.89) 20 msec 20 msec 20 msec 10 12.87.238.238 [AS 7018] 24 msec 20 msec 24 msec 11 12.87.238.237 [AS 7018] !A * * Traceroute to the neighboring IP addresses don't go anywhere near the above path, so it's apparently a blackhole of sorts. Scott.

3 5

ARIN/RIPE NCC Joint Statement on ASN Assignment Discrepancies
by John Curran 09 Dec '09

09 Dec '09

ARIN and the RIPE NCC have worked together to research the issues with the Autonomous System Number (ASN) range AS1707-AS1726. Below is our analysis of what happened and a plan to resolve these issues. It appears that prior to 1993, Renater was issued AS1707 with an AS name of "ASNBLOCKA". This is the name format used to assign a block of ASNs, but the DDN NIC (the Defense Data Network Network Information Center, which was responsible for ASN assignments until 1993) recorded only a single assignment of AS1707, rather than the entire block of 20 ASNs (AS1707-AS1726), as would have been expected. AS1712 was never registered in the DDN NIC database. Since the proper registration was never recorded, this mistake carried over from the InterNIC database into ARIN's database at ARIN’s inception in 1997. The ASN range was not transferred to the RIPE NCC along with AS1707 because AS1708-AS1726 appeared to be unassigned, and thus remained with ARIN. Because this is simply an error in registry data and Renater is the actual registrant of this entire range of ASNs (AS1707-AS1726), ARIN will work with its customers who received ASNs from this range in July and August of 2009 to provide them with replacement ASNs. While we understand that this may cause some difficulty for these customers, we feel that this is the best path forward given the circumstances. RIPE NCC and ARIN will update their respective databases and work with the IANA to ensure that the ASN registry data is properly updated for this range. To prevent future issues, ARIN and RIPE NCC will implement two new processes for issuing new ASNs: checking all other RIR databases to ensure that the ASN is not previously registered, and checking BGP routing tables to ensure the ASN is not already found in an announced AS-path. ASNs that fail either of these conditions will not be issued until the discrepancy has been addressed. Regards, John Curran, President and CEO, ARIN Axek Pawlik, Managing Director, RIPE NCC

1 1

Earthlink SMTP Admin Contact?
by Ryan Gelobter 09 Dec '09

09 Dec '09

Any chance there's someone from Earthlink on nanog or anyone that has contact information? We have a large IP block that is being listed as dynamic by Earthlink's mail servers causing mail to be returned and have gotten nowhere with the normal procedures or the abuse mailbox at (866) 525-8194. Feel free to contact me off-list. Thanks, Ryan G IT Assistant/Support Technician Limestone Networks, Inc. r.gelobter(a)limestonenetworks.com<mailto:r.gelobter@limestonenetworks.com> www.limestonenetworks.com<http://www.limestonenetworks.com> Simple. Solid. Superior.

4 4

"Cool" ISPs
by Steven Bellovin 09 Dec '09

09 Dec '09

Some folks on this list may be interested in Ars Technica's take on "cool" ISPs: http://arstechnica.com/tech-policy/news/2009/12/the-coolest-isp-in-the-worl… (note: I neither endorse nor condemn any of the ideas, ISPs, etc. In other words, don't blame me if you disagree...) --Steve Bellovin, http://www.cs.columbia.edu/~smb

2 1

RE: SPF Configurations
by Jeffrey Negro 08 Dec '09

08 Dec '09

Thanks for your input on this. My main concern is mail filters at the end users side thinking that our mail servers are spoofing our customer's domain. I'll check into MAAWG as well Jeffrey Negro, Network Engineer Billtrust - Improving Your Billing, Improving Your Business www.billtrust.com 609.235.1010 x137 jnegro(a)billtrust.com -----Original Message----- From: Joe St Sauver [mailto:joe@oregon.uoregon.edu] Sent: Friday, December 04, 2009 11:25 AM To: Jeffrey Negro Subject: Re: SPF Configurations #Some customers insist on #making the FROM address use their domain name, but the emails leave our #mail servers on our domain. Then your IPs or outbound mail servers should be listed on the customer's SPF record... assuming they also send their own mail, they obviously also want to list their own mail servers. #SPF seems to be the way we could possibly avoid more spam filters, SPF only provides a way of avoiding spoofing, it does not necessarily enhance your IP reputation or your domain reputation #and delivery rate is very important to our company. Are you involved with MAAWG? (see www.maawg.org) Regards, Joe

13 18

Historical traceroute logging
by Justin Shore 07 Dec '09

07 Dec '09

Does anyone know of any tools that can do repeated traceroutes over time to a remote IP and log the results for later viewing/comparison? I'd like to do a traceroute several times a day and store the details in CVS or somewhere accessible down the road. Alerting to major path changes would be nice but not critical. The ability to compare traceroute output down the road would also be nice but also not critical. I'm more interested in the path than the individual hops' RTTs. What's prompting this is a major change in RTTs for several hours yesterday to an ITSP with a site in the south. We share a common upstream (L3) and have in the past always transited that provider to get to each other. I showed a route change for the specific /23 in question in my border routers' RIBs. The adjacent /23 originating from the same ITSP but in a different part of the country did not change (and neither did RTTs to the hosts we monitor in that /23). The site claimed nothing changed on their end and that they know of no changes upstream. BGP Play shows a route change from Level3 to Internap during the time in question (thought the times don't line up exactly) which most likely caused the more than double RTTs we were seeing. My Cacti Advanced Ping graphs caught the problem in all its glory. Nagios alerted me to the high RTT times as well. What I didn't get during that period of time was a traceroute to the site in question. I'd like to run a traceroute several times a day and find some way to store the output and work with it later if needed. I'd prefer OSS but commercial apps would be considered too. I'm sure I'm not the first to have a need to check traceroutes like that. How do the rest of you handle it? Thanks Justin

6 5

Remote hands requested near sherman oaks LA [urgent]
by Suresh Ramasubramanian 07 Dec '09

07 Dec '09

Sorry for the noise .. Got me a (personal) box that has a borked grub after an OS upgrade. Need to get somebody there who can just go in, probably fix /boot/grub/menu.lst to say the right thing, run grub (maybe boot in with a live cd, mount and run grub.. you know the drill) Is anybody in or near Sherman Oaks LA who can help fix this? Please email ASAP, I'll hook you up with the person who can get you access. Sorry for the urgent - that box has been down for over 24 hrs now. gave up waiting for root device common problem: boot args (cat/proc/cmdline) check root delay = (did the system wait long enough?) check root = (did the system wait for the right device?0 missing modules (cat/pro/modules;ls/dev) alert! /dev/disk/by-uuid/42b8599e-f7bc-4626-ad08-4ba6427513d1 does not exist. dropping to a shell busybox v1.13.3(ubuntu 1:1.13.3-1ubuntu7 built in shell (ash) enter 'help' for a list of commands (initramfs): -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 1

Sherman Oaks CA - Re: Remote hands requested near sherman oaks LA [urgent]
by Suresh Ramasubramanian 06 Dec '09

06 Dec '09

Too damn early (5:23 AM) .. the box is at Sherman Oaks CA - near Los Angeles LA. Sigh. >> ------Original Message------ >> From: Suresh Ramasubramanian >> To: nanog(a)nanog.org >> Subject: Remote hands requested near sherman oaks LA [urgent] >> Sent: Dec 6, 2009 15:42 >> >> Sorry for the noise .. Got me a (personal) box that has a borked grub >> after an OS upgrade.

1 0

ASA5580-20 with IOS software
by frogmanclay＠gmail.com 06 Dec '09

06 Dec '09

Does anyone have experience using an ASA5580-20 with IOS software? On top of that, using it as a headend for an Easy VPN solution? I am trying to figure out how many sites it can safely support, also are there any major problems with it? All of the documentation on Cisco's site only talks about using it with ASA software, but then it only supports Legacy Easy VPN and not Enhanced Easy VPN. In order to support Enhanced you have to run IOS. Thanks for your time, Clay

2 1

Re: AW: SPF Configurations
by John R. Levine 05 Dec '09

05 Dec '09

>> Right. The only major mail system that pays attention to SPF is >> Hotmail, but there are enough small poorly run MTAs that use it that >> an SPF record which lists your outbounds and ~all (not -all) can be >> marginally useful to avoid bogus rejections of your mail. > > For example : > [ various large ISPs that publish SPF ] Perhaps this is a language problem. In English, "publishes" is not a synonym for "pays attention to." As I said, you need to publish SPF to get mail into Hotmail. That's why people do it. > I know there is a problem so far with forwarded emails but there is also a > solution : > [ hoary SRS proposal to change every SMTP server in the world to make them > match what SPF does ] Sigh. > Every time a mail arrives that is an SRS address the password and timestamp > could be checked, and faked or outdated recipients could be rejected. You might want to look at BATV, which has nothing to do with SPF, but I have found is quite useful for recognizing spam blowback. R's, John PS: > This message (including any attachments) is the property of FHE3 and may > contain confidential or privileged information. Unauthorized use of this > communication is strictly prohibited and may be unlawful. If you have > received this communication in error, please immediately notify the sender > by reply e-mail and destroy all copies of the communication and any > attachments. Our policy is to send messages with confidentiality notices to all of your competitors.

2 1