May 2009 - Test - lists.nanog.org

MX problems
by Polar Humenn 20 May '09

20 May '09

I'm in Syracuse NY, and I'm having problems getting sendmail to get to MX servers, with the errors of "No Route to Host" or "Connection timed Out". Apparently this is been happening for over 5 days. I can send mail within Syracuse University, but as soon as I venture out nothing. Traceroute seems to loose it after about the 9 or 10th hop. It seems that I can get to almost any website, but tracerouting or pinging these MX servers is not happening. Is there anything going on, or at least something that started 5-7 days ago? I find the same problem from within Syracuse Univeristy to my RoadRunner account at home (which does not pass through the university routers). I only noticed it from the university since thats where I usually send my email through. Like I would no have been able to post to this list >From my home machine: > traceroute s0.nanog.org traceroute to s0.nanog.org (198.108.95.20), 30 hops max, 60 byte packets 1 192.168.99.1 (192.168.99.1) 0.211 ms 0.257 ms 0.302 ms 2 10.217.224.1 (10.217.224.1) 13.754 ms 13.855 ms 14.291 ms 3 gig2-2.syrcnysyr-rtr01.nyroc.rr.com (24.92.231.138) 18.442 ms 22.701 ms 26.908 ms 4 gig1-1-0.syrcnyflk-rtr02.nyroc.rr.com (24.92.231.54) 31.279 ms 31.454 ms 31.591 ms 5 ge-4-3-0.albynywav-rtr03.nyroc.rr.com (24.24.7.53) 37.429 ms 37.604 ms 37.779 ms 6 ae-5-0.cr0.nyc30.tbone.rr.com (66.109.6.74) 41.329 ms 18.241 ms 22.192 ms 7 ae-1-0.pr0.nyc20.tbone.rr.com (66.109.6.163) 27.472 ms 19.542 ms 23.419 ms 8 te1-4.mpd01.jfk05.atlas.cogentco.com (154.54.13.185) 28.070 ms 32.824 ms 35.822 ms 9 te9-3.ccr01.jfk02.atlas.cogentco.com (154.54.3.165) 40.796 ms 40.549 ms te2-4.ccr01.jfk02.atlas.cogentco.com (154.54.6.49) 40.958 ms 10 te2-4.mpd01.bos01.atlas.cogentco.com (154.54.5.249) 48.704 ms 47.549 ms 48.468 ms 11 te2-2.ccr01.ord01.atlas.cogentco.com (154.54.6.154) 57.836 ms te8-8.mpd01.ord01.atlas.cogentco.com (154.54.24.54) 58.063 ms te2-2.mpd01.ord01.atlas.cogentco.com (154.54.6.18) 46.700 ms 12 vl3488.mpd01.ord03.atlas.cogentco.com (154.54.5.26) 56.905 ms te3-4.mpd01.ord03.atlas.cogentco.com (154.54.6.206) 56.144 ms vl3488.mpd01.ord03.atlas.cogentco.com (154.54.5.26) 45.245 ms 13 Merit.demarc.cogentco.com (38.112.7.10) 44.512 ms Merit.demarc.cogentco.com (66.28.21.234) 38.385 ms Merit.demarc.cogentco.com (38.112.7.10) 40.305 ms 14 tenge0-0-0-0x76.aa2.mich.net (198.108.23.10) 43.637 ms 42.601 ms 43.902 ms 15 198.108.22.186 (198.108.22.186) 48.455 ms 51.436 ms 44.070 ms 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * Any ideas? Cheers, -Dr Polar

8 10

RE: MX problems
by Skywing 19 May '09

19 May '09

Firewalling based on a static port number is now DPI? - S -----Original Message----- From: Warren Bailey <wbailey(a)gci.com> Sent: Tuesday, May 19, 2009 16:25 To: gmclean(a)xilogix.net <gmclean(a)xilogix.net>; polar.humenn(a)gmail.com <polar.humenn(a)gmail.com> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Subject: Re: MX problems Or... His provider is using dpi to drop packets destined for non provider mx servers. This would certainly reduce spam from compromised hosts. ----- Original Message ----- From: Gregory McLean <gmclean(a)xilogix.net> To: Polar Humenn <polar.humenn(a)gmail.com> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Tue May 19 15:19:23 2009 Subject: Re: MX problems On Tue, 2009-05-19 at 19:02 -0400, Polar Humenn wrote: > >From my mail log. Geez, I can't even get to Cornell, which is just down the > friggin road! (Yeah, I know, but really). > What is going on? > > May 19 18:58:26 greene postfix/smtp[5895]: connect to > mailin-01.mx.AOL.COM[205.188.159.57]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5904]: connect to > penguin.cs.cornell.edu[128.84.96.11]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5899]: connect to > mx.vgs.untd.com[64.136.52.37]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5919]: connect to > incoming3.american.edu[147.9.1.250]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5904]: connect to > iago.cs.cornell.edu[128.84.96.10]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5904]: 0992D8DDE: to=< > simeon(a)cs.cornell.edu>, relay=none, delay=371744, status=deferred (connect > to iago.cs.cornell.edu[128.84.96.10]: No route to host) > May 19 18:58:30 greene postfix/smtp[5919]: connect to > incoming2.american.edu[147.9.1.249]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5919]: 5F6AC8C0E: to=<drshow(a)wamu.org>, > relay=none, delay=116954, status=deferred (connect to > incoming2.american.edu[147.9.1.249]: > No route to host) > May 19 18:58:33 greene postfix/smtp[5901]: connect to > cisbec.net.s6a1.psmtp.com[64.18.5.10]: No route to host (port 25) > May 19 18:58:33 greene postfix/smtp[5913]: connect to > smtp-mx6.mac.com[17.148.20.69]: > No route to host (port 25) > May 19 18:58:35 greene postfix/smtp[5895]: connect to > mailin-01.mx.AOL.COM[205.188.156.248]: > No route to host (port 25) > May 19 18:58:36 greene postfix/smtp[5899]: connect to > mx.dca.untd.com[64.136.44.37]: > No route to host (port 25) > May 19 18:58:36 greene postfix/smtp[5899]: D3A158876: to=<becward(a)JUNO.COM>, > relay=none, delay=183359, status=deferred (connect to > mx.dca.untd.com[64.136.44.37]: > No route to host) > May 19 18:58:42 greene postfix/smtp[5901]: connect to > cisbec.net.s6a2.psmtp.com[64.18.5.11]: No route to host (port 25) > May 19 18:58:45 greene postfix/smtp[5901]: connect to > cisbec.net.s6b1.psmtp.com[64.18.5.13]: No route to host (port 25) > May 19 18:58:45 greene postfix/smtp[5910]: connect to > hrndva-smtpin01.mail.rr.com[71.74.56.243]: No route to host (port 25) > May 19 18:58:48 greene postfix/smtp[5901]: connect to > cisbec.net.s6b2.psmtp.com[64.18.5.14]: No route to host (port 25) > May 19 18:58:48 greene postfix/smtp[5901]: 0992D8DDE: to=< > arahant1(a)cisbec.net>, relay=none, delay=371762, status=deferred (connect to > cisbec.net.s6b2.psmtp.com[64.18.5.14]: No route to host) > I smell a port blocking going on... Or a mis config on a firewall. (A firewall/router set to reject with icmp-host-prohibited) That would be my guess.

1 0

Re: MX problems
by Warren Bailey 19 May '09

19 May '09

Or... His provider is using dpi to drop packets destined for non provider mx servers. This would certainly reduce spam from compromised hosts. ----- Original Message ----- From: Gregory McLean <gmclean(a)xilogix.net> To: Polar Humenn <polar.humenn(a)gmail.com> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Tue May 19 15:19:23 2009 Subject: Re: MX problems On Tue, 2009-05-19 at 19:02 -0400, Polar Humenn wrote: > >From my mail log. Geez, I can't even get to Cornell, which is just down the > friggin road! (Yeah, I know, but really). > What is going on? > > May 19 18:58:26 greene postfix/smtp[5895]: connect to > mailin-01.mx.AOL.COM[205.188.159.57]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5904]: connect to > penguin.cs.cornell.edu[128.84.96.11]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5899]: connect to > mx.vgs.untd.com[64.136.52.37]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5919]: connect to > incoming3.american.edu[147.9.1.250]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5904]: connect to > iago.cs.cornell.edu[128.84.96.10]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5904]: 0992D8DDE: to=< > simeon(a)cs.cornell.edu>, relay=none, delay=371744, status=deferred (connect > to iago.cs.cornell.edu[128.84.96.10]: No route to host) > May 19 18:58:30 greene postfix/smtp[5919]: connect to > incoming2.american.edu[147.9.1.249]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5919]: 5F6AC8C0E: to=<drshow(a)wamu.org>, > relay=none, delay=116954, status=deferred (connect to > incoming2.american.edu[147.9.1.249]: > No route to host) > May 19 18:58:33 greene postfix/smtp[5901]: connect to > cisbec.net.s6a1.psmtp.com[64.18.5.10]: No route to host (port 25) > May 19 18:58:33 greene postfix/smtp[5913]: connect to > smtp-mx6.mac.com[17.148.20.69]: > No route to host (port 25) > May 19 18:58:35 greene postfix/smtp[5895]: connect to > mailin-01.mx.AOL.COM[205.188.156.248]: > No route to host (port 25) > May 19 18:58:36 greene postfix/smtp[5899]: connect to > mx.dca.untd.com[64.136.44.37]: > No route to host (port 25) > May 19 18:58:36 greene postfix/smtp[5899]: D3A158876: to=<becward(a)JUNO.COM>, > relay=none, delay=183359, status=deferred (connect to > mx.dca.untd.com[64.136.44.37]: > No route to host) > May 19 18:58:42 greene postfix/smtp[5901]: connect to > cisbec.net.s6a2.psmtp.com[64.18.5.11]: No route to host (port 25) > May 19 18:58:45 greene postfix/smtp[5901]: connect to > cisbec.net.s6b1.psmtp.com[64.18.5.13]: No route to host (port 25) > May 19 18:58:45 greene postfix/smtp[5910]: connect to > hrndva-smtpin01.mail.rr.com[71.74.56.243]: No route to host (port 25) > May 19 18:58:48 greene postfix/smtp[5901]: connect to > cisbec.net.s6b2.psmtp.com[64.18.5.14]: No route to host (port 25) > May 19 18:58:48 greene postfix/smtp[5901]: 0992D8DDE: to=< > arahant1(a)cisbec.net>, relay=none, delay=371762, status=deferred (connect to > cisbec.net.s6b2.psmtp.com[64.18.5.14]: No route to host) > I smell a port blocking going on... Or a mis config on a firewall. (A firewall/router set to reject with icmp-host-prohibited) That would be my guess.

1 0

Fore ATM PCI cards
by Joe Greco 19 May '09

19 May '09

I've poked around trying to figure out how not to just dump these in the trash. isp-equipment seems to be dead, etc. They're obscure and NANOG's about the only group I would think of where ATM guys might still hang out. :-) Free to a good home: a small supply of Fore ATM OC3 fiber and copper cards, mostly PCA-200. Looks like about a dozen, more fiber than copper. Replies to me only. If you know of anyone who'd be interested, let me know. ... JG -- Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net "We call it the 'one bite at the apple' rule. Give me one chance [and] then I won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN) With 24 million small businesses in the US alone, that's way too many apples.

1 1

We will pricematch any watch that you find online
by nanog-announce＠nanog.org 17 May '09

17 May '09

The time is NOW to get YOUR rep1ica watches that are famous around the world. These affordable imitations make you look rich at a fraction of the cost. Choose from any of the following replica watches Eberhard & Co, Breitling, Bvlgari, Cartier, Chopard, IWC, Panerai, Patek Philippe, TAG Heuer and Vacheron. Visit us: http://mewaqimid.cn/ Best Regards Lucas Stanley www.mewaqimid.cn

1 0

another brick in the wall[ed garden]
by Robert E. Seastrom 17 May '09

17 May '09

Dear Sprint EVDO people, Your man-in-the-middle hijacking of UDP/53 DNS queries against nameservers that I choose to query from my laptop on Sprint EVDO is not appreciated. Even less appreciated is your complete blocking of TCP/53 DNS queries. Queries from my lab: rs@click [14] % dig +short @192.148.252.10 version.bind. chaos txt "Just send your damn query already..." rs@click [15] % dig +tcp +short @192.148.252.10 version.bind. chaos txt "Just send your damn query already..." rs@click [16] % dig +tcp +short @192.148.252.10 hostname.bind. chaos txt "bifrost" rs@click [17] % Queries from my laptop: Superfly:~ rs$ dig +short @192.148.252.10 version.bind. chaos txt "9.6.0-P1" Superfly:~ rs$ dig +tcp +short @192.148.252.10 version.bind. chaos txt ;; connection timed out; no servers could be reached Superfly:~ rs$ dig +tcp +short @192.148.252.10 hostname.bind. chaos txt "ns1-kscymar06.spcsdns.net" Superfly:~ rs$ Guys, I send you money each month to deliver packets for me, not to invent new ways of being annoying (and breaking TSIG signed updates to dynamic DNS). Less is more. Please stop dinking with 10-minute-idle TCP sessions (which I complained about a year and a half ago) and knock it off with offering DNS service that I did not ask for. Sincerely, Your Disgruntled Customer, RS PS: No, I don't expect that this open letter will get you to fix the misbehavior, but if some Swedish guy comes along swinging a clue-bat at you guys I hope he whacks you a couple of times for me.

14 18

Broken RIPE-entry
by Andreas Plesner Jacobsen 17 May '09

17 May '09

I thought this may be of interest to anybody who uses the RIPE db for automated purposes. Somebody seems to have done a friday slip-up and entered this in the RIPE db: inetnum: 93.169.24.0 - 193.169.25.255 netname: CENTRSVYAZ-NET descr: Centrsvyaz CJSC country: RU -- Andreas

3 2

Managing your network devices via console
by Mehmet Akcin 16 May '09

16 May '09

Hello, It's always cool to have console access to routers/switches and nowadays they are going from RS-232 to RJ-45 as a standart. I have got Avocent DSR 2035 which is a KVM+Serial console (all in one).. but while I was able to have it work against servers via KVM or/and Serial , I was unable to make it work properly against any network device. I am wondering if anyone had experience on DSR or similar boxes to configure them against network devices console ports. Making suggestions for alternative ways of centralizing network device console management is also more than welcome, I guess the old fashioned server attached usb-serial console is one of the most preferred way, but feel free to provide if you have good ideas cheers -- Mehmet

12 13

Re: NPE-G2 vs. Sup720-3BXL
by Adam LaFountain 16 May '09

16 May '09

> We need true full routes and more CPU horsepower for crunching BGP > (+12 smaller peers + ISIS). OC3 interfaces are going to be mandatory, > one each at two locations. Oh yeah, we're still a larger startup > without endless pockets. Power, rack space, and SmartNet are not > concerns at any location (on-site cold spares). We may need an > upstream OC12 in the future but that's a ways out and not a concern > here. > > Our engineering team has settled on three $20k/node options: > - Sup720-3BXLs with PS and fan upgrades > - Sup2s as switches + ISIS + statics and no BGP, push BGP edge routing > off to NPE-G2s across a 2-3Gbps port-channel > - Sup2s as switches + ISIS + statics and no BGP, push BGP edge routing > off to a 12008 with E3 engines across a 2-3Gbps port-channel. > > Ideas and constructive opinions welcome, especially software and > stability-related. > For about $6k all in, you could pickup a monster dual Xeon server with a few 10GE PCI line cards and run a subscription service of the Vyatta open source router. With high end machine specs, we've been able to run 5 full tables and a solid amount of peers with about 6.5Gbps sustained to the net without any stress. For access, we just trunk one of the PCI cards down to a 6506 or a 3750 and it runs nice and clean. The only downside to this setup is the lack of cisco proprietary software features which it sounds like you might need. If anything you might be able to keep your existing setup and uplink everything to one of these routers as an edge device. Adam _______________ Adam LaFountain

7 6

[NANOG-announce] NANOG46 Update
by Joe Provo 16 May '09

16 May '09

Greetings! There are just four weeks left until NANOG46, and if you are planning to attend don't delay - register! While the Early-bird registration period has ended, if you don't register before June 8 you will face the on-site price of $600. The NANOG group hotel rate will expire May 29, within two weeks (http://nanog.org/meetings/nanog46/hotel.php) Registered NANOG46 attendees will get further updates sent to the attendee mailing list (<nanog-attendee(a)nanog.org>), so please do subscribe if you had opted out at the time of registration. Either visit http://mailman.nanog.org/mailman/listinfo/nanog-attendee or send email to <nanog-attendee-request(a)nanog.org>. The NANOG Program Committee has once again provided an excellent agenda (http://nanog.org/meetings/nanog46/agenda.php) for the conference. While we already have the support of several sponsors for both the conference and some socials (http://nanog.org/meetings/nanog46/sponsors.php) there are still opportunities for your organization to get exposure to the NANOG audience. See http://www.nanog.org/meetings/nanog46/sponsorships.php for more details. If you are entering the United States and have not yet determined if you need a visa, check the US Department of State site, notably http://travel.state.gov/visa/visa_1750.html and http://travel.state.gov/visa/temp/without/without_1990.html. Paper entrance forms can be bypassed for many countries; see details at http://cbp.gov/xp/cgov/travel/id_visa/esta/. Should you require a formal Letter of Invitation, please contact Merit staff by email to <nanog-support(a)nanog.org>. As always, we encourage you to send any questions or concerns via email, or by voice at Merit (1.734.527.5700). Come join your colleagues in Philadelphia! Joe Provo, SC Chair -- RSUC / GweepNet / Spunk / FnB / Usenix / SAGE _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0