November 2011 - Test - lists.nanog.org

Re: Random five character string added to URLs?
by Stefan Fouant 01 Nov '11

01 Nov '11

Is there anything perhaps protecting or intercepting the data on its way to the server, perhaps an Arbor device of some type of load balancer? This type of behavior is quite common when protecting web assets to eliminate zombies and such, but its usually something you would see back to the clients, not tp the server. Also, IIRC, the LOIC DoS tool had this ability to create random strings in the URL, and I believe it did so with 5 characters. Might want to do a packet trace and identify if this is coming from LOIC. Regards, Stefan Fouant Technical Trainer, Juniper Networks GPG Key ID: 0xB4C956EC Sent from my HTC EVO. ----- Reply message ----- From: "Christopher J. Pilkington" <cjp(a)0x1.net> Date: Tue, Nov 1, 2011 3:51 pm Subject: Random five character string added to URLs? To: <nanog(a)nanog.org> This might be off-topic, my apologies if so. I seeing requests against a server with initial GET requests in the form: GET /[a-zA-Z]{5}/pagename.html pagename.html being optional. The 5 character string seems to be random. This GET always results in a 404, as our servers don't have these paths. The second request seems to always the same without the modified path, which results in a 20. I initially suspected this was something from an attack or DOS tool, but the traffic doesn't fit such a pattern. Is anyone familiar with what device/service behaves in this fashion? Clearly something layer 7 is between the clients and the server. Provider is without clue regarding this. Google results in many GoDaddy users complaining of same; the server in question is not hosted with them, but I suspect they may be doing something similar. Thanks, -cjp

1 0

IPV6 6to4 and 6In4 Lab
by Meftah Tayeb 01 Nov '11

01 Nov '11

Hello folks, i'm posting this Message to both nanog and afnog lists preferably if i can get one from afnog to work with me a bit for routing IPV6 prefixs over him using at least static or OSPFv3 or BGP (at you like) i want to anounce my /48 optained from a friend as number) and 2002::/16 (6to4 prefixs=) at least for 10min to see real IPV6 traffic. if someone want to help me, please contact me thank you Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6596 (20111102) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

2 2

Outgoing SMTP Servers
by Dennis Burgess 01 Nov '11

01 Nov '11

I am curious about what network operators are doing with outbound SMTP traffic. In the past few weeks we have ran into over 10 providers, mostly local providers, which block outbound SMTP and require the users to go THOUGH their mail servers even though those servers are not responsible for the domains in question! I know other mail servers are blocking non-reversible mail, however, is this common? And more importantly, is this an acceptable practice? Most of our smaller ISPs that we support; we allow any outbound SMTP connection, however we do watch residential users for 5+ outbound SMTP connections at the same time. But if the ISP has their own mail servers, and users wish to relay though them, we basically tell them to use their mail server that they contract with. What is the best practice? ----------------------------------------------------------- Dennis Burgess, Mikrotik Certified Trainer Link Technologies, Inc -- Mikrotik & WISP Support Services Office: 314-735-0270 <tel:314-735-0270> Website: http://www.linktechs.net <http://www.linktechs.net/> LIVE On-Line Mikrotik Training <http://www.onlinemikrotiktraining.com/> - Author of "Learn RouterOS" <http://routerosbook.com/>

42 95

Random five character string added to URLs?
by Christopher J. Pilkington 01 Nov '11

01 Nov '11

This might be off-topic, my apologies if so. I seeing requests against a server with initial GET requests in the form: GET /[a-zA-Z]{5}/pagename.html pagename.html being optional. The 5 character string seems to be random. This GET always results in a 404, as our servers don't have these paths. The second request seems to always the same without the modified path, which results in a 20. I initially suspected this was something from an attack or DOS tool, but the traffic doesn't fit such a pattern. Is anyone familiar with what device/service behaves in this fashion? Clearly something layer 7 is between the clients and the server. Provider is without clue regarding this. Google results in many GoDaddy users complaining of same; the server in question is not hosted with them, but I suspect they may be doing something similar. Thanks, -cjp

1 0

Verizon ISP mailing list / ATM ports
by Joe Maimon 01 Nov '11

01 Nov '11

Hey All, I am looking for verizon ATM/DSL wholesale DSL ports for NY/NJ latas, and I found some verizon-isp mailing lists, but nothing seems current. Off-list replies are welcome. Thanks, Joe

1 0

OT:Hotmail mail Admin
by Justin Wilson 01 Nov '11

01 Nov '11

Hi all, Sorry for the offtopic post. I have a need to talk to a real person at Hotmail regarding a user account. The normal channels aren't getting me what I need. Thanks, Justin

1 0

Network Asset/Service Track/Management
by Payam Poursaied 01 Nov '11

01 Nov '11

Hi all I'm looking for a system to keep track of network assets and also periodic services in each pop site. Currently we have about 500 pop-sites. In each site we have DSLAMs, Linecards and also some passive equipments including terminals, racks and .. Also each site may have some recurring fees/services. Something like transit link, power, rental space and . Could you please share your experience with me Best Regards Payam Poursaied

6 5

consumer DSL problems
by Mike Reed 01 Nov '11

01 Nov '11

Hi folks, It would seem that my home broadband provider (Orange, formerly known as Wanadoo/Freeserve) have made some networking changes at the weekend. The first I knew of it was when my DSL router refused to connect. It's a vendor-supplied Siemens Gigaset SE572. While it's probably not the best router in the world (most consumer routers are risible), it was generally fine. On complaint, they tell me it's 'old'. Closer inspection reveals it's picking up the DSL carrier signal fine, but failing during LCP negotation Is there a common policy on rendering vendor-supplied CPEs unusable? As a network operator to residential users, would you notify any potentially affected users before making such a change? I am grateful for any insight. Kind regards, Mike

2 1

Manage an enterprise network? Please fill out my survey - for Science! :-)
by Justine Sherry 01 Nov '11

01 Nov '11

Hello! My name is Justine and I am a graduate student at UC Berkeley (http://cs.berkeley.edu/~justine) I'm doing a research project on middlebox appliances such as proxies, WAN optimizers, and firewalls. Middlebox appliances are any networking-related hardware other than routers and switches. I'd like to learn a little bit about how middleboxes are used in real world deployments in enterprises. Vendors often engage in surveys of this type - but the research community knows less than we'd like to about typical concerns in an enterprise network. If you work on network management in an enterprise, I'd love to hear about your experiences through this survey: https://docs.google.com/spreadsheet/viewform?hl=en_US&formkey=dHo1NGZ3eU04S… Some promises: (1) If you give me your email address, I will not give it to anyone else, nor will I add you to any annoying mailing lists. (2) If you mention the name of your organization, I will not share it with anyone else. (3) If I publish any data from this, statistics will be reported in aggregate. (4) I will not share the raw data from this survey with anyone other than my advisor, Professor Sylvia Ratnasamy (sylvia(a)eecs.berkeley.edu) Feel free to skip questions and please provide approximate answers if you have them. Finally, to thank you for your time, we'll enter you in to a lottery for a $100 Amazon gift card; we'll select two people to win and contact them on November 16. Thank you! If you have any questions or concerns, please contact me. Justine PS: The survey is here! Don't miss it! https://docs.google.com/spreadsheet/viewform?hl=en_US&formkey=dHo1NGZ3eU04S…

7 9