February 2010 - Test - lists.nanog.org

troll (was: Spamhaus...)
by Randy Bush 19 Feb '10

19 Feb '10

[ subject: changed and refs headers removed ] >> So you should think that its ok for blacklists to charge money for >> things they got for free? why not? apnic, arin, ripe, ... do! <giggle> randy

1 0

Re: Spamhaus...
by Larry Sheldon 19 Feb '10

19 Feb '10

On 2/19/2010 12:53 PM, Dean Anderson wrote: > So you should think that its ok for blacklists to charge money for > things they got for free? Well, in the interest of staying on topic..... I don't think Spamhaus is selling the data (as you spammers in do do). So far as I know, the data are supplied by volunteers and voluntary offerings of victims of spam. What the charge is for is to support the high-volume capable servers and data links required to support commercial enterprises (like Barracuda) who make money off of those data. Somebody who actually knows what they are talking about can correct my errors for me. People in the gored-ox group can remain silent. -- "Government big enough to supply everything you need is big enough to take everything you have." Remember: The Ark was built by amateurs, the Titanic by professionals. Requiescas in pace o email Ex turpi causa non oritur actio Eppure si rinfresca ICBM Targeting Information: http://tinyurl.com/4sqczs http://tinyurl.com/7tp8ml

1 0

40G/100G options at this time
by Rubens Kuhl 19 Feb '10

19 Feb '10

Hi. Are there solutions already available implementing 40GBASE-LR4, 100GBASE-LR4 and 100GBASE-ER4 draft standards ? By solutions it means both switches with CFP-MSA/QSFP/CXP ports and the modules. Rubens

1 0

Recommendations for router with routed copper gig-e ports?
by Lorell Hathcock 19 Feb '10

19 Feb '10

All: I'm involved in a project where we are cutting over a WISP from being a single broadcast domain into the grownup real world of routing between tower nodes. Of course the equipment is all Mikrotik and the single broadcast domain was easy to implement, so that's why it was done this way. My problem on the redesign is I want to provide routed, copper gig-e ports at a reasonable price per port. My thought is to provide one copper gig-e port for all of the APs at a tower and a copper gig-e port for each backhaul to other towers (typically 2 to 4). On the core nodes, I want to have one fiber gig-e port for the internet connection. BGP would be implemented on the routers that connect to the internet. OSPF would be implemented on all of the backhaul ports. So number of routed, copper gig-e ports at each tower would be: 1 - AP network (need suggestion for cost effective gig-e switch) 2 to 4 - back haul ports 1 - internet port (on one out of every 4 towers or so) (and most likely fiber instead of copper) Does anyone have any suggestions? Sincerely, Lorell Hathcock OfficeConnect.net | 832-665-3400 x101 (o) | 713-992-2343 (f) | lorell(a)officeconnect.net Texas State Security Contractor License | ONSSI Certified Channel Partner Axis Communications Channel Partner | BICSI Corporate Member Leviton Authorized Installer

12 13

MLFR Differential Delay Problems
by R. Benjamin Kessler 19 Feb '10

19 Feb '10

Hello NANOGers - I'm working on a project to migrate a customer from one "Tier 1" provider to another at 50+ locations (all domestic US sites). Most of these connections are 4xT1 multi-link bundles. The old router configuration was MLPPP which was rock-solid for 3 years (save for the typical "last-mile" circuit issues, fiber-cuts, etc.). The new carrier uses FRF.16 multi-link Frame Relay vs. MLPPP. We've completed the migration on 10+ sites and all of them are now reporting errors like the following: Feb 17 21:01:39 /kernel: MFR bundle ls-0/0/0:0 link t1-1/0/0 differential 91.7 ms over yellow differential delay 75 ms Feb 17 21:01:50 /kernel: MFR bundle ls-0/0/0:0 link t1-1/0/0 differential 115.9 ms over yellow differential delay 75 ms Feb 17 21:01:50 /kernel: MFR bundle ls-0/0/0:0 link t1-1/0/1 differential 79.0 ms over yellow differential delay 75 ms Feb 17 21:01:50 /kernel: MFR bundle ls-0/0/0:0 link t1-2/0/1 differential 79.1 ms over yellow differential delay 75 ms Feb 17 21:01:50 /kernel: MFR bundle ls-0/0/0:0 link t1-1/0/1 differential 97.4 ms over yellow differential delay 75 ms Feb 17 21:01:50 /kernel: MFR bundle ls-0/0/0:0 link t1-2/0/0 differential 97.5 ms over yellow differential delay 75 ms Feb 17 21:01:50 /kernel: MFR bundle ls-0/0/0:0 link t1-2/0/1 differential 97.5 ms over yellow differential delay 75 ms Feb 17 21:01:52 /kernel: MFR bundle ls-0/0/0:0 link t1-1/0/1 differential 97.4 ms over yellow differential delay 75 ms Feb 17 21:01:52 /kernel: MFR bundle ls-0/0/0:0 link t1-2/0/0 differential 97.5 ms over yellow differential delay 75 ms Feb 17 21:01:52 /kernel: MFR bundle ls-0/0/0:0 link t1-2/0/1 differential 97.5 ms over yellow differential delay 75 ms Feb 17 21:01:53 /kernel: MFR bundle ls-0/0/0:0 link t1-1/0/1 differential 90.0 ms over yellow differential delay 75 ms Feb 17 21:01:53 /kernel: MFR bundle ls-0/0/0:0 link t1-2/0/1 differential 100.0 ms over yellow differential delay 75 ms The customer routers are all Juniper J6350; I believe the Carrier's routers are all Cisco GSRs. Advanced JTAC says that our configurations are solid and that there are no known bugs that would exhibit behavior like this. The carrier is insisting on performing physical-level tests of the circuits (even though they're running error free) before they'll engage higher-level engineers so I'm currently in a holding pattern awaiting those results. My Google-foo is failing me and I'm not able to find any documents that help explain what may be causing this and how to troubleshoot and find an eventual solution. I would really appreciate any tips or suggestions from anyone on the list that may have seen issues like this in the past. Thanks, Ben

2 1

New botnet launch?
by Drew Weaver 19 Feb '10

19 Feb '10

All, We noticed at around midnight for a brief period of time and around 6AM EST for an extended period that several hosted customer servers (4 completely different customers) launched quite a campaign doing 100Mbps during these times (on 100Mbps ports). The thing I find 'suspicious' is that all of the machines connected Interfaces said they were sending out 200Mbps (on 100Mbps links) and that they all had the same exact traffic profile (MRTG, etc). 5 minute input rate 213353000 bits/sec, 18516 packets/sec 5 minute output rate 583000 bits/sec, 855 packets/sec Anyone else see this or am I just very lucky? thanks, -Drew

2 2

AS33259 leaking
by Matsuzaki Yoshinobu 19 Feb '10

19 Feb '10

Hi, Does anyone know a contact for AS33259? It seems the AS33259 is leaking a bunch of prefixes in error, and this caused reachability problems. ----- Matsuzaki Yoshinobu <maz(a)iij.ad.jp> - IIJ/AS2497 INOC-DBA: 2497*629

3 3

multicast beacon group seeing extremely high traffic
by Antonio Querubin 19 Feb '10

19 Feb '10

Any multicast networks seeing a large amount of traffic for the beacon group 233.4.200.18? Starting approximately 0730 GMT, we started receiving more than 12 Mbps for that group which normally is far less. Group: 233.4.200.18, (?) Source: 64.251.63.189 (mcast.cen.ct.gov) Rate: 1095 pps/606 kbps(1sec), 567 kbps(last 30 secs), 631 kbps(life avg) Source: 128.105.40.15 (mbone-test.cs.wisc.edu) Rate: 1020 pps/553 kbps(1sec), 405 kbps(last 40 secs), 450 kbps(life avg) Source: 128.109.1.249 (ws-beacon.ncren.net) Rate: 846 pps/364 kbps(1sec), 349 kbps(last 40 secs), 384 kbps(life avg) Source: 128.109.3.228 (wil-beacon.ncren.net) Rate: 786 pps/339 kbps(1sec), 203 kbps(last 40 secs), 241 kbps(life avg) Source: 128.109.16.117 (gb-beacon.ncren.net) Rate: 758 pps/326 kbps(1sec), 306 kbps(last 40 secs), 328 kbps(life avg) Source: 128.109.58.21 (ecu-beacon.ncren.net) Rate: 509 pps/221 kbps(1sec), 297 kbps(last 40 secs), 331 kbps(life avg) Source: 128.135.122.108 (g217display.bsd.uchicago.edu) Rate: 840 pps/495 kbps(1sec), 376 kbps(last 40 secs), 442 kbps(life avg) Source: 128.182.160.60 (arsenal.psc.edu) Rate: 1084 pps/595 kbps(1sec), 280 kbps(last 40 secs), 366 kbps(life avg) Source: 129.78.221.17 (crayon.ucc.usyd.edu.au) Rate: 9 pps/4 kbps(1sec), 4 kbps(last 40 secs), 5 kbps(life avg) Source: 129.96.120.11 (?) Rate: 9 pps/4 kbps(1sec), 3 kbps(last 40 secs), 4 kbps(life avg) Source: 129.127.96.120 (beacon.sapac.edu.au) Rate: 10 pps/5 kbps(1sec), 5 kbps(last 40 secs), 5 kbps(life avg) Source: 130.102.78.179 (vv2.vislab.uq.edu.au) Rate: 10 pps/5 kbps(1sec), 6 kbps(last 40 secs), 6 kbps(life avg) Source: 130.207.166.66 (pulsar.noc.gatech.edu) Rate: 843 pps/364 kbps(1sec), 346 kbps(last 40 secs), 360 kbps(life avg) Source: 130.220.64.249 (dawn.ml.unisa.edu.au) Rate: 8 pps/4 kbps(1sec), 4 kbps(last 50 secs), 5 kbps(life avg) Source: 134.129.95.122 (netmenderx.cc.ndsu.NoDak.edu) Rate: 1094 pps/608 kbps(1sec), 314 kbps(last 50 secs), 342 kbps(life avg) Source: 138.23.2.53 (kaon.ucr.edu) Rate: 20 pps/13 kbps(1sec), 10 kbps(last 50 secs), 10 kbps(life avg) Source: 139.86.2.226 (?) Rate: 11 pps/7 kbps(1sec), 5 kbps(last 50 secs), 6 kbps(life avg) Source: 141.142.2.55 (jhereg.ncsa.uiuc.edu) Rate: 999 pps/670 kbps(1sec), 360 kbps(last 50 secs), 400 kbps(life avg) Source: 144.174.29.10 (accessgrid.sc.fsu.edu) Rate: 1158 pps/730 kbps(1sec), 531 kbps(last 50 secs), 553 kbps(life avg) Source: 144.174.29.11 (ag1.sc.fsu.edu) Rate: 878 pps/637 kbps(1sec), 487 kbps(last 50 secs), 532 kbps(life avg) Source: 144.174.29.12 (ag2.sc.fsu.edu) Rate: 232 pps/102 kbps(1sec), 411 kbps(last 50 secs), 428 kbps(life avg) Source: 152.2.255.225 (beacon.net.unc.edu) Rate: 853 pps/619 kbps(1sec), 413 kbps(last 50 secs), 459 kbps(life avg) Source: 155.98.194.254 (ebc.mc-beacon.utah.edu) Rate: 1074 pps/658 kbps(1sec), 447 kbps(last 50 secs), 447 kbps(life avg) Source: 155.101.3.100 (multicast.chpc.utah.edu) Rate: 476 pps/333 kbps(1sec), 339 kbps(last 50 secs), 388 kbps(life avg) Source: 161.45.190.10 (ns-beacon.mtsu.edu) Rate: 947 pps/534 kbps(1sec), 474 kbps(last 50 secs), 439 kbps(life avg) Source: 192.17.24.169 (faranth.ci.uiuc.edu) Rate: 939 pps/591 kbps(1sec), 426 kbps(last 50 secs), 442 kbps(life avg) Source: 192.43.244.8 (npad.ucar.edu) Rate: 1157 pps/716 kbps(1sec), 574 kbps(last 50 secs), 612 kbps(life avg) Source: 192.65.130.134 (black.ivec.org) Rate: 11 pps/7 kbps(1sec), 7 kbps(last 0 secs), 5 kbps(life avg) Source: 192.88.114.244 (nic.3rox.net) Rate: 962 pps/548 kbps(1sec), 548 kbps(last 0 secs), 453 kbps(life avg) Source: 205.127.87.150 (zoot.uen.net) Rate: 1100 pps/611 kbps(1sec), 611 kbps(last 0 secs), 512 kbps(life avg) Antonio Querubin 808-545-5282 x3003 e-mail/xmpp: tony(a)lava.net

1 0

Tahiti's OPT ASN?
by Scott Weeks 19 Feb '10

19 Feb '10

Anyone got the ASN of Office des Postes et Télécommunications in French Polynesia? I'm having a heck of a time looking for it in APNIC. scott

2 1

Re: several messages
by Michelle Sullivan 19 Feb '10

19 Feb '10

Dean Anderson wrote: > [Damn. spit out my coffee on keyboard.] > > Levine and Vixie are partners in Whitehat. Whitehat is a commercial bulk > mailer that offers listwashing services (removing spam-traps). MAPS > employees were involved in listwashing. MAPS, Spamhaus, SORBS do not > block Whitehat, suggesting that the spamtraps removed come from > MAPS/Spamhaus/SORBS > LOL Dean's really lost it finally (if he hadn't before.) SORBS does not 'not block' anyone (many on here will attest to that) no one is to big or too small to get listed in SORBS. ..but more importantly, and almost on topic unlike Dean's entire post... I thought Dean was banned for his off continual off topic posts and all the attacks on other people and organisations? Michelle

4 4