September 2010 - Test - lists.nanog.org

just seen my first IPv6 network abuse scan, is this the start for more?
by Igor Ybema 07 Sep '10

07 Sep '10

Hi, Since recently we noticed "Neighbour table overflow" warnings from the kernel on a lot of Linux machines. As this was very annoying for us and our customers I started to dump traffic and tried to find the cause. I discovered a external IPv6 host was doing a (rather useless due to the amount of addresses) IPv6 ICMP scan on our network recurring daily and mostly during the nights, sometimes with speeds of 1000 scans per second. Due to the ammount of IPv6 neighbor discoveries from our routers resulting from this scan the Neighbour table overflow messages appeared on the machines. Are there more people who have seen this behaviour recently? Is this a start of hackers/spammers onto the IPv6 network? This is the first scan I have seen. I already contacted the ISP for the source address. No answer yet. If I have more news I will post them here. regards, Igor Ybema the Netherlands

15 26

whois at rest
by Jon Lewis 07 Sep '10

07 Sep '10

More often than not today the only replies I've been getting back from the ARIN whois servers is: ERROR 503: Unable to service request due to high volume. Is there really high volume today, or is the new restful thing broken again? ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

IPv4 squatters on the move again?
by Tero Toikkanen 07 Sep '10

07 Sep '10

Anyone hear of the SundownGroup? On Thursday we received an interesting RFQ from them and suspect their intentions for requesting an IP assignment isn't exactly what they state. We have already turned them down, but thought others might be interested in their activities as well. RIPE NCC has also been notified of this. In brief they wanted to buy colo form us: "P4 single core @ 2 Ghz, 1 GB RAM, 60 GB HD, Linux CentOS 5x.x, 10 Mbps bandwidth. A single /21 or /20 net block of IP Adresses" Their reason for requesting such a large address block was "As we are currently launching our WholesaleVOIP operation we are in desperate need of this IP space as part of our ARIN process we will need these ranges SWIPd to us and we will in turn renumber with ARIN and return the netblocks to you as soon as ours are allocated and routed." Interesting tidbits about the company we and the networking community have already found out: Compare http://sundowngroup.com/ and http://www.edgecast.com/ (Edgecast has been notified). The contact address is the same as National University Nevada (nu.edu) Sundown Capital Management LLC 2850 Horizon Ridge Parkway Henderson, Nevada 89052 United States of America They also have virtually no Internet presence (http://www.google.com/search?q=%22Sundown+Capital+Management%22) The first result shows them as a franchicing company with contact address in California: http://www.scribd.com/doc/14385124/QFA-Unit-Final-PDF-File-of-32709-FDD-Wit… I'd say this case is pretty obvious... With Kind Regards, -- Tero Toikkanen Nebula Oy Internet Services

7 10

OAM and QinQ
by Serge Vautour 07 Sep '10

07 Sep '10

Hello, We're working on deploying some L2 services over an MPLS network. Our model includes a CPE with OAM capabilities and QinQ from the PE to the CPE. For now we want to do simple OAM functions from CPE-CPE (no MIPs in the MPLS network). Our lab testing has shown some sort of incompatibilities between OAM and QinQ. OAM frames are encapsulated with a single VLAN tag (the SVLAN) on the CPE. When the PEs only perform SVLAN swapping, everything works fine. If we configure the PE to also perform CVLAN manipulation, it drops OAM frames. It likely does not know how to process them because they don't have a CVLAN tag. We're working with 2 CPE vendors and neither of them are able to add 2 VLAN tags to the OAM frames. Has anyone else encountered this problem? How do you get around it? One option we're looking at is to simply not perform CVLAN manipulation on the PE. This means limiting our service to customers. Our PEs are all Juniper MX boxes if it helps. Thanks, Serge

2 1

RE: Re: IPv6 Glue Records at Dotster / Domain.com
by Martin Hotze 06 Sep '10

06 Sep '10

> Date: Sat, 4 Sep 2010 11:17:36 -0400 > From: Jared Mauch <jared(a)puck.nether.net> > Subject: Re: IPv6 Glue Records at Dotster / Domain.com > > Opensrs also suffers from lack of v6 glue disease. Last I saw on their > forums it said "coming soon" for about a year. IBTD. We register our domains with them (Tucows/OpenSRS) and we got the entry, but you have to contact support and it is done manually. Check my domain hotze.com for proving it. #m hotze.com / AS8596

6 5

Re: Juniper to Watchguard IPSEC
by rhsv6＠hushmail.com 06 Sep '10

06 Sep '10

You have not specified what sort of settings you are using (PSK vs CERTS, Algos , route based VPN etc) However something along the following lines is working fine for me: set ike gateway "**************" address 172.16.250.1 Main outgoing- interface "ethernet0/8" preshare "**************" proposal "pre-g2- 3des-sha" set vpn "**************" gateway "**************" replay tunnel idletime 0 proposal "g2-esp-aes128-sha" set vpn "**************" id 0x7 bind interface tunnel.40 set vpn "**************" proxy-id local-ip 192.168.1.0/24 remote-ip 10.1.2.0/24 "ANY" >Anyone have any experience with IPSEC between a WG Firebox and Juniper >SRX/SSG? Running into some problems and beginning to think there might be >some incompatibilities in their IPSEC options. > TIA, > Bryan

1 0

seek cable/dsl provider in Troy MI 48083 USA
by nanog＠ilk.net 04 Sep '10

04 Sep '10

Hi, for a customer at Stephenson Highway Troy, MI 48083 USA we seek an internet access/service provider, cable/xdsl/... would be ok, fixed ip-address prefered. Please answer off-list. Thank you for your kind support, Have a nice weekend, Jürgen Marenda, ILK

4 3

IPv6 Glue Records at Dotster / Domain.com
by Ryan Shea 04 Sep '10

04 Sep '10

Anyone with a contact at Doster with the ability to make things happen? Apparently they do not support v6 glue records and they have been unresponsive to my ticket. This seems a kooky reason to change registrars. The table of registrars over at sixxs who have at least some way to get v6 glue records has been getting greener and greener, but no love from Dotster. http://www.sixxs.net/faq/dns/?faq=ipv6glue -Ryan

6 9

Mailing List Archive
by Henry Qin 04 Sep '10

04 Sep '10

I subscribe Mailing List Archive.

1 0

Re: ISP port blocking practice
by Patrick W. Gilmore 04 Sep '10

04 Sep '10

Composed on a virtual keyboard, please forgive typos. On Sep 3, 2010, at 23:50, Owen DeLong <owen(a)delong.com> wrote: > I think you overestimate the efficacy of this. > > First, why [snip] I think I see the problem here. You are using logic & though experiments, while others have this thing called "data". I'm going to go with data over your assumptions. Call me silly, but that's how I roll. -- TTFN, patrick

1 0