October 2011 - Test - lists.nanog.org

RADB/RIR Scraper
by Kate Gerry 05 Oct '11

05 Oct '11

I'm looking for a good utility that I can run locally to scrape RADB, ARIN, other RIRs to add to my or customer prefix lists... Anybody have a good tool for this? I currently end up visiting https://www.dan.me.uk/filtergen and creating one off that. Thoughts? -- Kate QuadraNet, Inc 530 W 6th Street #901 Los Angeles, CA 90014 kate(a)quadranet.com<mailto:kate@quadranet.com>

10 12

DNSSEC in China
by Michael Sinatra 05 Oct '11

05 Oct '11

The thread on f-root reminded my of an anecdotal datum regarding DNSSEC in China. I was in China back in August, staying at the Green Lake Hotel in Kunming, Yunnan Provence. When connecting to the hotel in-room network (there was no wireless but a wired connection), I was able to properly validate DNSSEC for names like www.es.net and berkeley.edu, both of which are part of signed zones with a chain of trust from the root. I was able to do the validation on my caching resolver (BIND 9.8.x) running on my laptop. If a site was blocked by authorities, I couldn't resolve it at all, but that was also the case even if I wasn't doing validation on my laptop resolver, but instead using the resolver provided by DHCP. (FYI, I "stumbled" upon an expat bar later in my trip near Yunnan Provincial University and the folks there--Europeans and Americans--all said that the number of sites they can get to has expanded in recent months. One Finn was accessing the Guardian to get the latest on the London riots.) Another anecdote from NANOG 52: At the Denver Sheraton, I was unable to validate or resolve any name using my local laptop resolver. I couldn't even validate TLDs or dlv.isc.org, so *all* of my name resolution broke. In the end, I had to disable my local resolver entirely and use those provided by DHCP. I have nothing to say about hypocrisy or the relative level of oppression between the Chinese government versus the Starwood Group (although it's humorous to think about). What I will say is that DNSSEC made it very clear in the case of the Sheraton that they were messing with DNS because DNSSEC made the handcuffs so obviously tight. michael

2 1

Email administrator for Comcast Philadelphia region?
by Eric Tykwinski 05 Oct '11

05 Oct '11

If there is anyone lurking on the list, we are having some strange issues with one of your clients. Please contact offlist. (support(a)truenet.com) Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300 F: 610-429-3222

1 0

Nxdomain redirect revenue
by Cameron Byrne 04 Oct '11

04 Oct '11

Just an fyi for anyone who has a marketing person dreaming up a big nxdomain redirect business cases, the stats are actually very very poor... it does not make much money at all. It is very important to ask the redirect partners about yields... meaning, you may find that less than 5% of nxdomain redirects can be actually served an ad page because 95%+ of nxd are printer lookups and such that cannot be served an ad page. Then from that less than 5% pool, the click through rates are around 1% Net net, no free money of any meaningful value. But, ymmv... but I don't think by much. Cb

22 44

Re: Over a decade of DDOS--any progress yet?
by alvaro.sanchez＠adinet.com.uy 04 Oct '11

04 Oct '11

A very common action is to blackhole ddos traffic upstream by sending a bgp route to the next AS with a preestablished community indicating the traffic must be sent to Null0. The route may be very specific, in order to impact as less as possible. This needs previous coordination between providers. Regards. >----Mensaje original---- >De: rdobbins(a)arbor.net >Fecha: 08/12/2010 10:53 >Para: "North American Operators' Group"<nanog(a)nanog.org> >Asunto: Re: Over a decade of DDOS--any progress yet? > > >On Dec 8, 2010, at 7:28 PM, Arturo Servin wrote: > >> One big problem (IMHO) of DDoS is that sources (the host of botnets) may be completely unaware that they are part of a DDoS. I do not mean the bot machine, I mean the ISP connecting those. > >The technology exists to detect and classify this attack traffic, and is deployed in production networks today. > >And of course, the legitimate owners of the botted hosts are generally unaware that their machine is being used for nefarious purposes. > >> In the other hand the target of a DDoS cannot do anything to stop to attack besides adding more BW or contacting one by one the whole path of providers to try to minimize the effect. > >Actually, there're lots of things they can do. > >> I know that this has many security concerns, but would it be good a signalling protocol between ISPs to inform the sources of a DDoS attack in order to take semiautomatic actions to rate-limit the traffic as close as the source? Of course that this is more complex that these three or two lines, but I wonder if this has been considerer in the past. > >It already exists. > >----------------------------------------------------------------------- >Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> > > Sell your computer and buy a guitar. > > > > > >

18 46

[NANOG-announce] NANOG 53 Last Agenda and Registration Reminder
by Betty Burke 04 Oct '11

04 Oct '11

Everyone, The last update regarding NANOG 53 Registration and Agenda ! Do not miss out. - Late Registration starting October 4, 2011 (non-member $600, member $575, student $100) - On-Site Registration starting October 9, 2011 (non-member $675, member $650, student $100) - Submit your lightning talk proposal at http://pc.nanog.org starting October 3, 2011. Lightning Talks: A lightning talk is a very short presentation or speech by any attendee on any topic relevant to the NANOG audience. These are limited to ten minutes; this will be strictly enforced. - topic that are timely, interesting, or even a crackpot idea you want to share, we encourage you to consider presenting it. The Program Committee will vote on all Lightning Talk submissions onsite at the meeting, and a submitter will be notified about his or her submission one day prior to the scheduled talk time. See you in Philly! All best. Betty -- Betty Burke NewNOG/NANOG Executive Director Office (810) 214-1218 NANOG Direct (510) 492-4030 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: Synology Disk DS211J
by Nick Olsen 04 Oct '11

04 Oct '11

It's updates, I've got a 1511+ here and at the office. It phones home to check for updates. I noticed this the day I got it. Blocked the dst IP and that was the only thing that "broke". Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Pierre-Yves Maunier" <nanog(a)maunier.org> Sent: Friday, September 30, 2011 8:32 AM To: "Jones, Barry" <BEJones(a)semprautilities.com> Subject: Re: Synology Disk DS211J 2011/9/29 Jones, Barry <BEJones(a)semprautilities.com> > Hey all. > A little off topic, but wanted to share... I purchased a home storage > Synology DS1511+. After configuring it on the home net, I did some captures > to look at the protocols, and noticed that the DS1511+ is making outgoing > connections to 59.124.41.242 (www) and 59.124.41.245 (port 81 & 89) on a > regular basis. These addresses are owned by Synology and Chungwa Telecom in > Taiwan. > > So far, I've not been able to find much information on their support sites, > or Synology's wiki, but I wanted to put it out there. > > > Maybe it's for checking new firmware update availability... -- Pierre-Yves Maunier

2 1

he.net down?
by Aiden Sullivan 04 Oct '11

04 Oct '11

www.he.net seems to be down on both IPv4 and IPv6 -- does anyone know what is going on? -- Aiden

11 10

FW: [arin-announce] Whois Query Behavior is Updated
by Mark Kosters 04 Oct '11

04 Oct '11

Hi Apologies for the cross post from ARIN-Announce. Thought that many of you would be interested in hearing about the recent ARIN Whois change given the recent discussion on NANOG. Regards, Mark Kosters ARIN CTO On 10/2/11 8:51 PM, "ARIN" <info(a)arin.net> wrote: >ARIN has changed the Whois query behavior on port 43. A query for an IP >address in the ARIN region will return only that assignment/allocation >within the ARIN region, and will no longer included ARIN's parent record >(the /8). > >Both the Whois web interface and Whois-RWS behavior were not affected by >this configuration change. > >Regards, > >Mark Kosters >Chief Technical Officer >American Registry for Internet Numbers (ARIN)

3 2

Re: he.net down?
by Michael J McCafferty 03 Oct '11

03 Oct '11

Our session with them is up and down at Any2 at OWB. ------Original Message------ From: Aiden Sullivan To: nanog(a)nanog.org Subject: he.net down? Sent: Oct 3, 2011 3:35 PM www.he.net seems to be down on both IPv4 and IPv6 -- does anyone know what is going on? -- Aiden Sent from my Verizon Wireless BlackBerry

7 6