October 2010 - Test - lists.nanog.org

AS22558 - Routing apparently hijacked space
by Ronald F. Guilmette 13 Oct '10

13 Oct '10

I can't take credit for finding this one. Somebody else on another mailing list I'm on actually found it. AS22558 itself _does not_ appear to be hijacked. Rather this is a relatively new (2009) AS, but the AS itself is very odd indeed. It's contact phone number isn't working, it apparently has no web site associated with its domain name (mpgnetworks.com) and although the whois record clearly indicates that the company behind this AS is located in California, the California Secretary of State's web site has no record of any "MPG Networks, LLC" operating legally within California. ===================================================================== ASNumber: 22558 ASName: MPGNET ASHandle: AS22558 RegDate: 2010-01-27 Updated: 2010-01-27 Ref: http://whois.arin.net/rest/asn/AS22558 OrgName: MPG Networks, LLC OrgId: MPGNE Address: 707 Wilshire, suite 411 City: Los Angeles StateProv: CA PostalCode: 90017 Country: US RegDate: 2009-11-03 Updated: 2009-11-03 Ref: http://whois.arin.net/rest/org/MPGNE OrgTechHandle: MNA72-ARIN OrgTechName: MPG Networks Admin OrgTechPhone: +1-213-867-3652 OrgTechEmail: admin(a)mpgnetworks.com OrgTechRef: http://whois.arin.net/rest/poc/MNA72-ARIN ===================================================================== So anyway, this AS appears to currently be routing what looks an awful lot like a whole lot of abandoned legacy IP address space, to wit: 66.119.224.0/20 192.101.208.0/20 192.101.224.0/20 192.112.112.0/22 192.112.116.0/22 192.112.120.0/22 192.112.124.0/22 198.13.0.0/22 198.13.4.0/22 198.13.8.0/22 198.13.12.0/22 198.162.208.0/20 198.178.64.0/22 198.178.68.0/22 198.178.72.0/22 198.178.76.0/22 198.178.80.0/20 206.201.48.0/20 Furthermore, looking at the name server data for these blocks, what I see in them sure as heck looks an awful lot like snowshoe spam domains to me. (See listing attached below.) Last but not least, robtex.com indicates that this entire AS is only connected to the Internet via a single other AS, i.e. AS3491, aka "Beyond The Network America, Inc." And I'd just like to take this opportunity to remind everyone that AS3491 is also still the only connection to the Internet for two other hijacked ASes (and all of the apparently hijacked address space that each of those is announcing), i.e. AS6061 and AS10392. In short, it does appear that the crooks are now officially running the Internet. (And yes, I _did_ properly inform the fine folks at Beyond The Network America, Inc. last week that they were aiding and abetting the effective theft of IP address space by whoever has hijacked AS6061 and AS10392, _and_ I _did_ get an acknowledgement back from them, indicating clearly that some live human there had read my message. But no, apparently they don't give a rat's ass, and they are perfectly fine with aiding & abetting the hijacker(s) in this case... presumably as long as whoever it is keeps on sending them checks every month.) Regards, rfg =============================================================== 66.119.224.2 ns1.reliancethanks.com reliancethanks.com aftermathinformational.com 66.119.224.3 ns2.reliancethanks.com reliancethanks.com aftermathinformational.com 66.119.225.239 ns.uberslinger.org 66.119.230.2 ns1.sectionalplacement.com sectionalplacement.com 66.119.230.3 ns2.sectionalplacement.com sectionalplacement.com 66.119.236.2 ns1.sundayexceeding.com precisionwedge.com printablediscovered.com positivelyrecently.com platinumshall.com productionweekday.com sundayexceeding.com 66.119.236.3 ns2.sundayexceeding.com precisionwedge.com printablediscovered.com positivelyrecently.com platinumshall.com productionweekday.com sundayexceeding.com 192.101.239.253 fwd2.select1media.com fgty232oflyaway.com xswe321oracetrack.com asefo221shortness.com puth123ofreely.com jqtyo313outofbounds.com muiuo332consistent.com mjui332owalked.com etye112olightup.com ukkho121greatwin.com jlkk231believableo.com fthno223majority.com cddgo113longway.com select1media.com hngeo131intouch.com cdtu223leadingo.com zipi121ointhezone.com bhtq222oroadtrip.com sfewo331advantage.com cftho232likely.com qaxs221odarkness.com wefro212permanent.com fwd1.select1media.com fgty232oflyaway.com xswe321oracetrack.com asefo221shortness.com puth123ofreely.com jqtyo313outofbounds.com muiuo332consistent.com mjui332owalked.com etye112olightup.com ukkho121greatwin.com jlkk231believableo.com fthno223majority.com cddgo113longway.com select1media.com hngeo131intouch.com cdtu223leadingo.com zipi121ointhezone.com bhtq222oroadtrip.com sfewo331advantage.com cftho232likely.com qaxs221odarkness.com wefro212permanent.com 198.13.2.1 ns1.publicidad3d.info 198.162.208.4 ns1.dnsdeguyana.info unawareofthesubject.info toshowphilosopherof.info seekfromartbeauty.info passivelydiscoveredthinkabout.info ofartshakespeareanwhichour.info moonoftenprofessto.info lightetudetothe.info itsnormativesidenothing.info inpersonaladornmentbe.info hearsayintheworld.info betterworksofart.info besurecuttingwood.info aparttheart.info anotheruglyaestheticpurpose.info afewexamplesobjectjust.info itmustbebrought.com isbeyondtheprovince.com tastefinallyofselfscrutiny.com notexistforan.com theskepticorthe.com maylessentheprobabilities.com 198.162.208.5 ns2.dnsdeguyana.info unawareofthesubject.info toshowphilosopherof.info seekfromartbeauty.info passivelydiscoveredthinkabout.info ofartshakespeareanwhichour.info moonoftenprofessto.info lightetudetothe.info itsnormativesidenothing.info inpersonaladornmentbe.info hearsayintheworld.info betterworksofart.info besurecuttingwood.info aparttheart.info anotheruglyaestheticpurpose.info afewexamplesobjectjust.info itmustbebrought.com isbeyondtheprovince.com tastefinallyofselfscrutiny.com notexistforan.com theskepticorthe.com maylessentheprobabilities.com 198.178.64.4 ns1.barranquilla-dns.info thelesscanbe.info theirachievedrelationshe.info subjecttocorrectionjudgments.info psychologyinterestinbeauty.info principlesislessenthe.info primitivemenbeautyitself.info partofthesubject.info ourownpurposesabsolutely.info ofacriticrelations.info methodofobservationas.info lackofunderstandingof.info forusoftenprofess.info correctionthepathwayhimself.info andfunctionstheoreticalanalysis.info allappreciationofparticular.info accurateinjudgmentis.info 198.178.64.5 ns2.barranquilla-dns.info thelesscanbe.info theirachievedrelationshe.info subjecttocorrectionjudgments.info psychologyinterestinbeauty.info principlesislessenthe.info primitivemenbeautyitself.info partofthesubject.info ourownpurposesabsolutely.info ofacriticrelations.info methodofobservationas.info lackofunderstandingof.info forusoftenprofess.info correctionthepathwayhimself.info andfunctionstheoreticalanalysis.info allappreciationofparticular.info accurateinjudgmentis.info 206.201.50.2 ns1.respectivemotive.com pensplaces.com interviewedseller.com generallyrumored.com regulatorsstretches.com mailedmission.com forecasterpanic.com generosityamount.com itemprep.com fascinatingfixings.com schemepowerful.com scotlandwonderful.com fontvaried.com grindstonesocal.com exitingfuturists.com respectivemotive.com itemsupporting.com silkbid.com operationstudent.com listenmotivation.com necessitysupplies.com locationquadruple.com looksutility.com 206.201.50.3 ns2.respectivemotive.com pensplaces.com interviewedseller.com generallyrumored.com regulatorsstretches.com mailedmission.com forecasterpanic.com generosityamount.com itemprep.com fascinatingfixings.com schemepowerful.com scotlandwonderful.com fontvaried.com grindstonesocal.com exitingfuturists.com respectivemotive.com itemsupporting.com silkbid.com operationstudent.com listenmotivation.com necessitysupplies.com locationquadruple.com looksutility.com 206.201.57.2 ns1.shelfbuying.com venezuelaexpire.com styleoutput.com threadbarestabilizes.com reducesreoffering.com unawareneed.com bookscourtesy.com bannerswardrobe.com arenaformula.com architecturetougher.com broaderbasedvalidity.com citiesunderstood.com buddingprimary.com assistscontext.com certificatetransactions.com allocatereported.com althoughacquire.com advancednautical.com sponsorshipguidance.com withdrawsspoken.com sketchnecessarily.com technicalbestseller.com providingonline.com shelfbuying.com purchasetrial.com trainedmonumental.com promisecombinations.com 206.201.57.3 ns2.shelfbuying.com venezuelaexpire.com styleoutput.com threadbarestabilizes.com reducesreoffering.com unawareneed.com bookscourtesy.com bannerswardrobe.com arenaformula.com architecturetougher.com broaderbasedvalidity.com citiesunderstood.com buddingprimary.com assistscontext.com certificatetransactions.com allocatereported.com althoughacquire.com advancednautical.com sponsorshipguidance.com withdrawsspoken.com sketchnecessarily.com technicalbestseller.com providingonline.com shelfbuying.com purchasetrial.com trainedmonumental.com promisecombinations.com

2 1

neglected route-servers
by Jon Lewis 12 Oct '10

12 Oct '10

Guess what happens when you run a 7206VXR (NPE300) as a route server with 3 full feeds? It took me a minute to figure out why my routes that TWTelecom isn't supposed to see were showing up on route-server.twtelecom.net, but were seemingly randomly alternating between Network not in table and showing up. If anyone from TWTelecom is here, it's probably time to swap out that NPE300 for something with more than 256MB RAM. It's running out of RAM and resetting all the BGP sessions before they finish getting full routes. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 4

Network Operators Unite Against SORBS
by iHate SORBS 12 Oct '10

12 Oct '10

Network Operators Unite Against SORBS Do you, or have you had problems with SORBS? Tired of being able to do nothing about it? Sick of opening a trouble ticket, only to get delisted weeks later? I am calling on all Network Operators to stand up and stop routing dnsbl.sorbs.net until that time they can commit to making real changes. -Operator

9 8

Hey Leber - you think Melissa is going to issue that refund properly or do we need to escalate this into legal actions against HE
by todd glassey 12 Oct '10

12 Oct '10

Mike Leber - I have been waiting for a response from Melissa in your accounting department since she insisted I sign the VISA release in order to refund our money after your company violated the Co-Lo agreement and shut the power down to ROW 4 in Suite 1200 with no warning or Customer Service Response... How long is this going to take to process? Todd Glassey -- //----------------------------------------------------------------- This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.

13 12

Re: Network Operators Unite Against SORBS
by Brielle Bruns 12 Oct '10

12 Oct '10

How about... Network Operators Against Whiny Mail Operators Who Have Nothing Better To Do With Their Time But Carry Out Personal Vendettas? NOAWMOWHNBTDWTRBCOPV ------Original Message------ From: iHate SORBS To: nanog(a)nanog.org Subject: Network Operators Unite Against SORBS Sent: Oct 12, 2010 6:35 AM Network Operators Unite Against SORBS Do you, or have you had problems with SORBS? Tired of being able to do nothing about it? Sick of opening a trouble ticket, only to get delisted weeks later? I am calling on all Network Operators to stand up and stop routing dnsbl.sorbs.net until that time they can commit to making real changes. -Operator -- Brielle Bruns http://www.sosdg.org / http://www.ahbl.org

1 0

Mobile Operator Connectivity
by Leo Woltz 11 Oct '10

11 Oct '10

I am looking for some guidance from the list. We will soon be deploying wireless payment devices (CDMA/GSM). We are looking at options on where to locate the servers that will run the backend payment gateways; we would like the least amount of latency between the servers and the wireless networks as possible. The wireless networks we will be deploying the devices on are: AT&T Wireless Verizon Wireless Sprint PCS Rogers Wireless Bell Mobility Telus Mobility Vodafone I was thinking we have a few options, to try and peer with the wireless networks directly, buy bandwidth from networks that are directly peered with the wireless operators or the Global Roaming Exchange Peering service that Equinix runs but I have not been able to find out much more then what is on Equinix’s public web site. We also have a need to peer with PayPal and Amazon. I welcome the lists comments and recommendations.

8 14

AT&T/L3 interconnect?
by Deepak Jain 11 Oct '10

11 Oct '10

While jumping on the wagon of poking at a particular 175.x.x.x address, I noticed something in my trace: 10 5 ms 5 ms 5 ms att-level3-30G.washingtondc.level3.net [4.68.62.30] 11 73 ms 72 ms 73 ms cr2.wswdc.ip.att.net [12.122.84.82] 12 74 ms 74 ms 75 ms cr1.cgcil.ip.att.net [12.122.18.21] 13 72 ms 72 ms 72 ms cr2.dvmco.ip.att.net [12.122.31.85] 14 73 ms 72 ms 73 ms cr1.slkut.ip.att.net [12.122.30.25] 15 73 ms 72 ms 72 ms cr2.la2ca.ip.att.net [12.122.30.30] 16 72 ms 72 ms 72 ms cr84.la2ca.ip.att.net [12.123.30.249] 17 73 ms 73 ms 73 ms gar1.lsrca.ip.att.net [12.122.129.121] Does anyone happen to know where the other end of this tunnel is that magically everything from a DC-DC hop to a DC-LA hop are all exactly 73ms? thanks, DJ

3 3

Level3 leaking routes?
by Jon Lewis 11 Oct '10

11 Oct '10

Has anyone else seen this, starting about midnight EDT last Friday night / Saturday morning? I advertise a few [more specific] routes to Level3 tagged with 65000:0 for TE. This is something that's worked for years. Either some of Level3's peers have become customers, or there's something wrong with Level3's route propagation filters that broke last Friday night. customer traffic engineering communities - Suppression -------------------------------------------------------- 64960:XXX - announce to AS XXX if 65000:0 65000:0 - announce to customers but not to peers 65000:XXX - do not announce at peerings to AS XXX ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

iPhone, meet Wireshark...
by kowsik 11 Oct '10

11 Oct '10

If you wanted to see what the apps on your mobile device are up to (especially operators trying to understand the impact of mobile apps on their infrastructure), current instructions on the web involve jail-breaking, setting up access-points and hubs and what not. It's gotta be lot simpler than that. Blog: http://bit.ly/cBFvDd Code: http://github.com/pcapr/l2bridge A couple of things you can do with the packets you capture: . Use http://www.pcapr.net/xtractr to analyze the apps, generate reports and charts and go to town . Be nice and share non-sensitive application traffic back to the pcapr community May the packets be with you! Thanks, The Pcapr Team http://www.pcapr.net/ http://twitter.com/pcapr http://labs.mudynamics.com

1 0

Routeviews
by Mehmet Akcin 10 Oct '10

10 Oct '10

hello, anyone from university of oregon or routeviews project ( routeviews.org ) here ? please contact me off-list please. thanks mehmet

2 1