November 2011 - Test - lists.nanog.org

looking for SixXS administtrator
by Meftah Tayeb 04 Nov '11

04 Nov '11

Hello please could one of the SixXS admin contact me privatly ? thank you Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6600 (20111104) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

3 5

RE: Outgoing SMTP Servers
by Brian Johnson 03 Nov '11

03 Nov '11

Owen, When you stretch an analogy this thin, it always falls apart. I was referring to the poison/pollution not the water/air. A drought/vacuum* would not be possible, but would you want the poisoned water/air? This analogy is bad enough without the nits picked out. I actually mixed two posts to create a stream analogy out of an air analogy. I will not go any further and all further follows on to this analogy should be ignored. :) - Brian J. * a lack of air (for a reasonable deffinition of air) would be a vacuum... right? >-----Original Message----- >From: Owen DeLong [mailto:owen@delong.com] >Sent: Friday, October 28, 2011 12:11 PM >To: Brian Johnson >Subject: Re: Outgoing SMTP Servers > >> >>>> Nor is the data transiting these networks a commons. The air over my >>>> land is a commons. I don't control it. If I pollute it or if I don't, >>>> it promptly travels over someone else's land. >>> >>> If you choose to pollute the air heavily, the value of the air drops for >>> everybody. >>> If you choose to pollute the Net heavily, the value of the Net drops for >>> everybody. >>> >> >> STRIKE 3! Oops got ahead of myself. >> >> I'm attempting to prevent the pollution but I may capture a little good water >(almost nothing) along the way. To say that this is a way of "bad acting" and >causes a loss of value to the Internet as a whole is pure folly. >> > >No, it really isn't. Because the good water that you are catching is actually >causing >a drought downstream. > >Owen

3 5

BGP conf
by Edward avanti 03 Nov '11

03 Nov '11

Halo, First, I accept this might not really right list for request, have use nsp cisco list but only first post to was succeed, sent several other for past 4 day and none appear (verified by list archive) so please excuse request. I am in need of a cisco config for BGP setup, we have a require to include IX peering at new location as well as our Verizon link, we like to take full bgp from Verizon and send to IX what they send us, I spend days reading google, and so many conflict web site example, so many example seem insecure no prefix list so on. end result to date is only sore eyes, would someone who do same (not need be Verizon) be kind to send us off list working running config (yes without your password heh) or at least how to apply to BGP router including access/prefix list and interfaces so we have an idea on what do, if you take two full BGP feed from two transit carrierin load share and IX, that good, because that our stage three plan, but I can work without two transit. I am not ignorant with cisco 7201, but am total newby to BGP. Best Thanks Edwardo

8 13

RE: Performance Issues - PTR Records
by David Hubbard 03 Nov '11

03 Nov '11

From: Matt Chung [mailto:itsmemattchung@gmail.com] > > Historically, there was no compelling reason to create PTR > records for our CPE however more and more applications seem > to be dependent on it. Although we will be assigning a > record for each address, my question is why > is the application (specifically HTTP) dependent on a reverse record ? > What is the purpose? > As a web host, we frequently find customers who have added Apache rules to their ecommerce sites to block undesirable traffic, such as credit card scammers, etc. Not knowing any better, they often do this by just blocking anything that ends in .in to block Indonesia for example. Well, once you choose to block by resolved name, now that site has to do a dns lookup for every incoming request to see if it resolves to a name that should be blocked. Just one example, but I'm sure there are countless others that also impede performance for IP addresses without a PTR record. David

4 3

RE: Performance Issues - PTR Records
by David Hubbard 02 Nov '11

02 Nov '11

From: Matthew Palmer [mailto:mpalmer@hezmatt.org] > > That's even less effective than you'd naively expect, given > that Indonesia's > TLD is .id... > Umm yeah, simple typo, but I appreciate the help.

1 0

Mexico?
by Ryan Finnesey 02 Nov '11

02 Nov '11

If I want to get a block of IP's issued for a network within Mexico who do I talk with? I have been told arin does not cover Mexico. It was my understand arin covers North America. Cheers Ryan

5 4

Colocation providers and ACL requests
by Christopher Pilkington 02 Nov '11

02 Nov '11

Is it common in the industry for a colocation provider, when requested to put an egress ACL facing us such as: deny udp any a.b.c.d/24 eq 80 …to refuse and tell us we must subscribe to their managed DDOS product? -cjp

14 19

Re: Random five character string added to URLs?
by Jeff Kell 02 Nov '11

02 Nov '11

On 11/1/2011 7:05 PM, Stefan Fouant wrote: > Is there anything perhaps protecting or intercepting the data on its way to the server, perhaps an Arbor device of some type of load balancer? > > This type of behavior is quite common when protecting web assets to eliminate zombies and such, but its usually something you would see back to the clients, not tp the server. I have seen this in SEO-poisoning type of webpage defacement. They anchor a javascript in the main website "frame" and it generates optimization "links" using a numeric suffix or ?argument so that they appear as separate links. If the crawler is recognized (e.g., googlebot) then the SEO page is returned. Jeff

1 0

using IPv6 address block across multiple locations
by Dmitry Cherkasov 02 Nov '11

02 Nov '11

Hello, Please advice what is the best practice to use IPv6 address block across distributed locations. Recently we obtained our PI /48 from RIPE. The idea was to assign partial slices from this block to different locations (we have currently 3 offices in Europe and 2 in USA). All locations are interconnected with static VPNs. Each location is supposed to establish BGP session with local ISP. Partial prefix /56 + aggregate /48 (with long AS PATH) are to be announced by each office. The problem we ran across is that ISP in US does not wish to accept prefixes longer then /48 from us. Need your advice: is this normal to distribute /48 by /56 parts across locations or should we obtain separate /48 for each of them? Or maybe we need /32 that can be split into multiple /48? Anyway we are not ISP so /48 looks quite reasonable and sufficient for all our needs. Thank you. Dmitry Cherkasov

12 17

Re: Random five character string added to URLs?
by Stefan Fouant 01 Nov '11

01 Nov '11

Is there anything perhaps protecting or intercepting the data on its way to the server, perhaps an Arbor device of some type of load balancer? This type of behavior is quite common when protecting web assets to eliminate zombies and such, but its usually something you would see back to the clients, not tp the server. Also, IIRC, the LOIC DoS tool had this ability to create random strings in the URL, and I believe it did so with 5 characters. Might want to do a packet trace and identify if this is coming from LOIC. Regards, Stefan Fouant Technical Trainer, Juniper Networks GPG Key ID: 0xB4C956EC Sent from my HTC EVO. ----- Reply message ----- From: "Christopher J. Pilkington" <cjp(a)0x1.net> Date: Tue, Nov 1, 2011 3:51 pm Subject: Random five character string added to URLs? To: <nanog(a)nanog.org> This might be off-topic, my apologies if so. I seeing requests against a server with initial GET requests in the form: GET /[a-zA-Z]{5}/pagename.html pagename.html being optional. The 5 character string seems to be random. This GET always results in a 404, as our servers don't have these paths. The second request seems to always the same without the modified path, which results in a 20. I initially suspected this was something from an attack or DOS tool, but the traffic doesn't fit such a pattern. Is anyone familiar with what device/service behaves in this fashion? Clearly something layer 7 is between the clients and the server. Provider is without clue regarding this. Google results in many GoDaddy users complaining of same; the server in question is not hosted with them, but I suspect they may be doing something similar. Thanks, -cjp

1 0