February 2010 - Test - lists.nanog.org

about udp 80,8080,0
by 최종훈 10 Feb '10

10 Feb '10

These days, most of ddos attack use udp port 80.8080.0 in our country and our network. Sometimes the traffic volume is up to 100gbps higher. So, we are considering to rate(bps) control about udp port 8,8080,0 in our ISP network. Although such a ports arp not be used commonly... I'm wondering about whether any of problems happen after do that. Is there anyone who have experiences controlling udp port 8,8080,0 ? rate-limiting or block! What does application use 8.8080,0 port for the proper purpose? [chk_receive.html?msgid=1265716670&uniqid=23455&sender=eversuede%40chol .com]

5 4

Re: black listing of web traffic
by Andrey Gordon 10 Feb '10

10 Feb '10

Thanks to all, The problem seems to be fixed by changing the NAT ip to something else and than back. It does seem much like NAT exhaustion even though the f/w claims only 13K session for two dynamic NATs and about 20 static ones. What I don't get is why there is consistency in opening sites. Why does facebook open all the time and store.apple.com barely opens all the time. I'd say if it would be NAT exhaustion, they would all behave the same way meaning open and then not open and then open again. It is solved for the time being. Again, thanks to all. ----- Andrey Gordon [andrey.gordon(a)gmail.com] On Tue, Feb 9, 2010 at 5:34 PM, Andrey Gordon <andrey.gordon(a)gmail.com>wrote: > I don't know, that's true. I don't where to find that info in this > particular firewall would be a more correct statement. and my f/w guy is not > much help either. > It definitely looks to me like a NATting issue, but what I don't understand > is why the same sites (e.g. facebook) loads fine consistently and others > don't. NAT exhaustion would not allow that, imo. > > This is the only relevant info I was able to find in the box: > > andrey.gordon@PA-2050-Bos> show session info > > > > ------------------------------------------------------------------------------- > number of sessions supported: 262143 > number of active sessions: 6799 > number of active TCP sessions: 5906 > number of active UDP sessions: 889 > number of active ICMP sessions: 4 > number of active BCAST sessions: 0 > number of active MCAST sessions: 0 > number of predict sessions: 1884 > session table utilization: 2% > number of sessions created since system bootup: 142823265 > Packet rate: 5920/s > Throughput: 45871 Kbps > > ------------------------------------------------------------------------------- > > > > > ----- > Andrey Gordon [andrey.gordon(a)gmail.com] > > > On Tue, Feb 9, 2010 at 5:31 PM, Nathan Ward <nward(a)daork.net> wrote: > >> You don't know how many NAT sessions are open though, right? >> >> This is where I'd start looking, if you do or not is up to you. >> >> On 10/02/2010, at 11:26 AM, Andrey Gordon wrote: >> >> Well, if I understand NATting right, I should be able to have at least >> 65000 sessions per NAT address to one destination. Am I wrong? the firewall >> is rated for 260K sessions. >> >> ----- >> Andrey Gordon [andrey.gordon(a)gmail.com] >> >> >> On Tue, Feb 9, 2010 at 5:22 PM, Nathan Ward <nward(a)daork.net> wrote: >> >>> 13,000 sessions could be your problem - perhaps you are running out of >>> NAT state table space. >>> >>> On 10/02/2010, at 11:18 AM, Andrey Gordon wrote: >>> >>> Not 100% sure. I have more than one NAT address on that firewall two of >>> which are dynamic: student and business. It's the student one that's broken. >>> Now, with that said, the Palo Alto firewall shows 13,000 session in >>> progress. Even the f/w guy does not know how to check out the session count >>> per NATted IP. >>> >>> ----- >>> Andrey Gordon [andrey.gordon(a)gmail.com] >>> >>> >>> On Tue, Feb 9, 2010 at 5:08 PM, Nathan Ward <nward(a)daork.net> wrote: >>> >>>> How many users do you have behind your NAT? >>>> >>>> On 10/02/2010, at 11:04 AM, Andrey Gordon wrote: >>>> >>>> > Thx to all the folks replying off the list. >>>> > >>>> > The more I trouble shoot the more I'm convinced that it's not the >>>> sites that >>>> > are doing rate-limiting. I went to a website of one of my previous >>>> employers >>>> > (a small company). Chances of them having a fancy reverse proxy with >>>> some >>>> > sort of black list filtering are slim to none, yet their site barely >>>> opens >>>> > up as well. >>>> > >>>> > Must be something that either my firewall device is doing (which is >>>> what is >>>> > doing the NATting) or I don't' know what else. I'm working with my >>>> firewall >>>> > guy since f/w is his domain and I have no clue about that vendor of >>>> the >>>> > firewalls (PaloAlto). >>>> > >>>> > Thanks all for the suggestions. I'll keep digging. >>>> > >>>> > ----- >>>> > Andrey Gordon [andrey.gordon(a)gmail.com] >>>> > >>>> > >>>> > On Tue, Feb 9, 2010 at 4:56 PM, Jay Hennigan <jay(a)west.net> wrote: >>>> > >>>> >> Andrey Gordon wrote: >>>> >> >>>> >>> Can't find my IP on any of the black lists. Don't have any proxies. >>>> Sites >>>> >>> that behave poorly are consistent. That is to say that facebook.com >>>> , >>>> >>> apple.com would always come up without an issue, but cnn.com, >>>> >>> forever21.com(i know, don't ask, students), >>>> >>> store.apple.com would consistently take forever to come up. >>>> >>> >>>> >>> Just wanted to check of rate-limiting web clients is a common >>>> practice >>>> >>> nowdays in the industry. If it's not, it's probably an unlikely >>>> cause of >>>> >>> my >>>> >>> troubles... >>>> >>> >>>> >> >>>> >> It could be that the problem sites have some form of load balancer >>>> that has >>>> >> an issue keeping state on multiple sessions from the same IP. >>>> >> >>>> >> You mentioned that changing the source IP fixed it. Is this a >>>> temporary >>>> >> fix that breaks after several users access the sites from the new IP? >>>> >> >>>> >> -- >>>> >> Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net >>>> >> Impulse Internet Service - http://www.impulse.net/ >>>> >> Your local telephone and internet company - 805 884-6323 - WB6RDV >>>> >> >>>> > >>>> > >>>> > >>>> > >>>> >>>> >>> >>> >> !DSPAM:22,4b71e13583451376319610! >> >> >> >

3 2

Re: black listing of web traffic
by Andrey Gordon 10 Feb '10

10 Feb '10

Can't find my IP on any of the black lists. Don't have any proxies. Sites that behave poorly are consistent. That is to say that facebook.com, apple.com would always come up without an issue, but cnn.com, forever21.com(i know, don't ask, students), store.apple.com would consistently take forever to come up. Just wanted to check of rate-limiting web clients is a common practice nowdays in the industry. If it's not, it's probably an unlikely cause of my troubles... Thanks, Andrey ----- Andrey Gordon [andrey.gordon(a)gmail.com] On Tue, Feb 9, 2010 at 4:40 PM, Geoffrey Keating <geoffk(a)geoffk.org> wrote: > Andrey Gordon <andrey.gordon(a)gmail.com> writes: > > > Hi list > > > > I have a problem that I can't seem to find a solution to yet. My student > > network is being NATted out and anyone who's on that network had troubles > > accessing random websites. > > For example, going to www.apple.com or www.facebook.com would work > great, > > but store.apple.com would either not load or take forever to open up. > > > > I've had that problem last week and thought I tracked it down to the NAT > ip > > being black listed with one of the span black lists. Even though that IP > is > > not used for mail out, that somehow seemed to affect it. Changing it to a > > different one seemed to solve the problem and I got that original address > of > > the list in the mean time. Changed it back and everything was well, until > > today. > > Same symptoms, but now I don't see us listed anywhere. > > The best description of the symptoms seems to be that that IP is rate > > limited or something. > > > > Anyone seen that? Are there any blacklists for web access? > > Could it be related to the Pushdo botnet SSL traffic generation, > <http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20100129>? > Perhaps you have an infected machine and so your IP is being > blacklisted and/or rate-limited. >

6 7

Data Center recommendations
by Lunch Hound 09 Feb '10

09 Feb '10

Hi, Who do you like for data centers these days? Looking for a site more than 1000 miles from Chicago. Thanks!

6 5

Re: Data Center recommendations
by Scott Weeks 09 Feb '10

09 Feb '10

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> On Tue, Feb 9, 2010 at 2:24 PM, Lunch Hound <lunchhound9999(a)gmail.com> wrote: > Who do you like for data centers these days? > Looking for a site more than 1000 miles from Chicago. DR Fortress in Honolulu. Especially in February. And wouldn't you know it, ORD has direct flights... -------------------------------------------------------- They're good and they peer with HIX. Good surf on the North Shore in Feb, too: http://www.prh.noaa.gov/hnl/pages/SRF.php ;-) scott "Surf along north facing shores will be near 5 feet this morning rising to near 8 feet by late afternoon. Early Wednesday surf will be near 25 feet to as high as 30 feet on outer reefs."

1 0

AT&T Metro E in Atlanta
by Raleigh Apple 09 Feb '10

09 Feb '10

Anybody have any idea whats going on with AT&T metro E in Atlanta? r

2 1

.ve WHOIS Down?
by Crist Clark 09 Feb '10

09 Feb '10

For want of a better place to ask, I'm wondering if anyone monitoring this list might know what is up with the registro.nic.ve web site. The WHOIS at www.nic.ve refers to that site, and it appears to be down (for me and downforeveryoneorjustme.com too). Doing old fashioned native WHOIS isn't working any better.

3 4

Re: Connectivity problems to google via openDNS
by Mark 09 Feb '10

09 Feb '10

It's over a vpn from Asia to US. I wouldn't worry about that 280ms latency. :) Kind regards, Mark On Feb 9, 2010, at 10:41 PM, Joachim Tingvold wrote: > On 9. feb. 2010, at 15.32, Mark wrote: >> Just wondering if anyone is experiencing the same problem with >> google and openDNS on their end or knows what's going on there with >> openDNS. The problem just occurred about 20 minutes ago. >> >> Trace is as follows: http://inetpro.org/pastebin/2418 > > I'd say ~280 ms to your first hop sound's more disturbing then not > being able to reach Google (-: > > > -- > Joachim Tingvold > joachim(a)tingvold.com

2 2

FW: Yahoo abuse
by Blake Pfankuch 09 Feb '10

09 Feb '10

It's almost as much fun as getting them to recognize that my home mail server is not a bulk sender, however even after filling out their form they still continue to block me. In all seriousness my only suggestion is to fill this form out repeatedly. My general experience is that they read 1 of 10 abuse reports... so... http://help.yahoo.com/l/us/yahoo/smallbusiness/abuse.html Also found they respond quicker (if at all) if you flag it as "illegal activity". Good luck! -----Original Message----- From: John Peach [mailto:john-nanog@johnpeach.com] Sent: Tuesday, February 09, 2010 5:55 AM To: nanog(a)nanog.org Subject: Yahoo abuse Does anyone know how to get Yahoo abuse to recognize that they're hosting a phishing site? All I can ever get back from them is boilerplate telling me they know how frustrating it is to get spam, that it did not originate from them and how to read the headers. Not half as frustrating as their ignorance. -- John

1 0

NorthStar IP Management System
by Hitesh Patel 09 Feb '10

09 Feb '10

Hello all, It has been a while since I posted anything to NANOG. A long time ago (in a galaxy far far away ;) ) I wrote and maintained a software package called NorthStar (http://www.brownkid.net/NorthStar) to administrate IP space and various other things. Life got busy and the project fell off my list of priorities. Long story short I am looking to see if anyone is still using NorthStar? Would people like to see development start up again? -- Hitesh Patel

4 4