November 2011 - Test - lists.nanog.org

RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 30 Nov '11

30 Nov '11

Well, sometime yesterday www.centurylink.com removed it AAAA record(s). www.qwest.com still has them. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Monday, October 24, 2011 1:47 PM To: 'nanog(a)nanog.org' Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days Good news: access to the v6 version of www.qwest.com came up at 12:30 pm today -- it redirects to www.centurylink.com, but at least it's working. Only www.savvis.com remains in my list of service provider websites that have non-working IPv6. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Thursday, August 18, 2011 12:35 AM To: nanog(a)nanog.org Subject: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days The IPv6 version of www.qwest.com has been down for 10 days. Wget shows a 301 to www.centurylink.com, but that also fails. Emails to the nocs at both companies have gone unanswered. Unless HE is deployed in a web browser, this behavior leads to a bad end-user experience. If anyone can prod either of these two companies that would be much appreciated. Frank nagios:/home/fbulk# wget -6 www.qwest.com --2011-08-18 00:32:40-- http://www.qwest.com/ Resolving www.qwest.com... 2001:428:b21:1::20 Connecting to www.qwest.com|2001:428:b21:1::20|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: http://www.centurylink.com/ [following] --2011-08-18 00:32:40-- http://www.centurylink.com/ Resolving www.centurylink.com... 2001:428:b21:1::22 Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:02-- (try: 2) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:25-- (try: 3) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:49-- (try: 4) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. Etc...

1 0

Bandwidth prediction tool?
by Luis Palma 30 Nov '11

30 Nov '11

Hi, Does anyone know a good Bandwidth Prediction tool?. We have a DPI solution based on SCE8000 + SM/CM from Cisco and we are looking a tool that can take a data from Collector Manager Database and make traffic Bandwidth prediction and customer behavior prediction. Any idea will be welcome. Regards,

2 1

Equinix
by Keegan Holley 29 Nov '11

29 Nov '11

Assuming it's not owned by the NSA does anyone know the address of the equnix colo in the Denver area? I'm working on pricing access circuits into it. A contact from equinix would be helpful as well. We haven't gotten a response to our queries. Regards, Keegan

3 2

Computer Networks Special Issue on Botnets: Deadline Extended to Dec. 19
by Guofei Gu 29 Nov '11

29 Nov '11

CFP: Special Issue of COMPUTER NETWORS (ELSEVIER) on "Botnet Activity: Analysis, Detection and Shutdown" Apologies for multiple copies of this announcement. ------------------------- Dear Colleagues, Please consider the following opportunity to submit and publish original scientific results to a SPECIAL ISSUE of COMPUTER NETWORKS (ELSEVIER journal) on "Botnet Activity: Analysis, Detection and Shutdown". The submission deadline is extended to December 19, 2011. http://ees.elsevier.com/comnet/ A pdf version of this CFP is available at http://faculty.cse.tamu.edu/guofei/CFP_COMNET-Botnets.pdf Please help distribute. Thanks! ------------------------- Large scale attacks and criminal activities experienced in recent years have exposed the Internet to serious security breaches, and alarmed the world regarding cyber crime. In the center of this problem are the so called botnets -- collections of infected zombie machines (bots) controlled by the botmaster to perpetrate malicious activities and massive attacks. Some recent botnets are composed of millions of infected machines, making use of this attack vector inevitably harmfully. Hence, it is paramount to detect, analyze and shutdown such overlay networks before they become active. Research on botnet activity is mostly related to detection and disruption. Detection of botnets has focused on monitoring bot activities, especially during the spread of malicious software to infect new hosts (initial infection phase) and the communication messages exchanged between bots and botmasters (rallying and updating phases). Some behavioral aspects are common: bots have to signal the botmaster informing they are alive, each time their hosts are started; bots send messages whenever connecting and joining with the botnet; the botmaster has to send commands to each zombie machine before initiating malicious activities. This special issue of Computer Networks is intended to foster the dissemination of high quality research in all aspects regarding botnet activity, detection and countermeasures. The objective of this special issue is to publish papers presenting detection algorithms, traffic monitoring and identification, protocols and architectures, as well as botnet modeling, behavior, simulation, statistics, dissemination, analysis, preventive procedures and possible countermeasures. Only technical papers describing previously unpublished, original, state-of-the-art research, and not currently under review by a conference or journal will be considered. We solicit papers in a variety of topics related to botnet research including, but not limited to: - Traffic Monitoring and Detection Algorithms - Data Collection, Statistics and Analysis - Modeling Behavior and Simulation - Protocols and Architectures (IRC, HTTP, P2P, etc) - Firewalls and IDS - Cyber Crime Case Studies - Reverse Engineering and Automated Analysis of Bots - Honeypots and Honeynets - New Platforms: Cellular and Wireless networks, Mobile devices, TV, etc. - Legal Issues and Countermeasures - Underground Markets, Vulnerability Markets and Zero-day Economics - Mini-Botnets Guest Editors Ronaldo Salles Military Institute of Engineering PraçGeneral Tibú 80, 22290-270, R.J. Brazil salles(a)ieee.org Guofei Gu Texas A&M University 3112 TAMU, HRBB College Station, TX 77843-3112 USA guofei(a)cse.tamu.edu Thorsten Holz Ruhr-University Bochum Universitatsstrasse 150, 44780 Bochum Germany thorsten.holz(a)rub.de Morton Swimmer Trend Micro Deutschland, GmbH Zeppelinstr. 1 85399 Hallbergmoos - Germany swimmer(a)acm.org Paper submission: 19th Dec 2011 Acceptance notification: 19th Mar 2012 Final papers: 19th May 2012 Submission format The submitted papers must be clearly written in excellent English and describe original research which is not published nor currently under review by other journals or conferences. Author guidelines for preparation of manuscript can be found at www.elsevier.com/locate/comnet/ Submission Guideline All manuscripts and any supplementary material should be submitted through the Elsevier Editorial System (EES). The authors must select "Special Issue: Botnets" when they reach the Article Type step in the submission process. The EES website is located at: http://ees.elsevier.com/comnet/ Guide for Authors This site will guide you stepwise through the creation and uploading of you article. The guide for Authors can be found on the journal homepage (www.elsevier.com/comnet/)

1 0

PPPOE dialer issue on Cisco C2811
by Meftah Tayeb 29 Nov '11

29 Nov '11

Hey folks please can someone see this issue i'm veery stuck on that: i have a C2811 with ADSL line created a dialer interface assigned to a fast ethernet (fe0/0) connected sucsessfully nated my lan network (172.28.0.0/24) the dialer is outside and my fe0/1 is inside but i can access (ONLY) google services! i guess is that a MTU issue? if yes what should i use ? tried 1492 1480 1500 and 1504 same hell at all. here's my config: Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6671 (20111130) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

1 0

DNS 8.8.8.8 was down
by Denys Fedoryshchenko 29 Nov '11

29 Nov '11

Google DNS was down few minutes, at least for few European locations Here is sample traceroute: 4 213.242.116.25 (213.242.116.25) 39.692 ms 39.776 ms 39.774 ms 5 ae-7-7.ebr1.Paris1.Level3.net (4.69.143.238) 50.933 ms 50.792 ms 50.793 ms 6 ae-47-47.ebr1.London1.Level3.net (4.69.143.109) 57.353 ms ae-45-45.ebr1.London1.Level3.net (4.69.143.101) 57.580 ms ae-48-48.ebr1.London1.Level3.net (4.69.143.113) 57.582 ms 7 ae-57-112.csw1.London1.Level3.net (4.69.153.118) 57.577 ms ae-58-113.csw1.London1.Level3.net (4.69.153.122) 57.693 ms ae-57-112.csw1.London1.Level3.net (4.69.153.118) 57.817 ms 8 ae-1-51.edge3.London1.Level3.net (4.69.139.73) 57.654 ms 57.631 ms 57.768 ms 9 unknown.Level3.net (212.113.15.186) 57.958 ms 57.531 ms 57.643 ms 10 209.85.255.78 (209.85.255.78) 57.732 ms 57.598 ms 57.573 ms 11 209.85.253.92 (209.85.253.92) 58.300 ms 209.85.253.196 (209.85.253.196) 57.941 ms 209.85.253.94 (209.85.253.94) 58.002 ms 12 72.14.232.134 (72.14.232.134) 63.726 ms 66.249.95.173 (66.249.95.173) 63.614 ms 72.14.232.134 (72.14.232.134) 63.699 ms After this hop it was dead, now it is working, but seems still there is minor problems 14 216.239.46.117 (216.239.46.117) 64.171 ms * * 15 google-public-dns-a.google.com (8.8.8.8) 63.749 ms 63.729 ms 63.680 ms --- System administrator Denys Fedoryshchenko Virtual ISP S.A.L.

3 2

Network device command line interfaces
by Jonathon Exley 28 Nov '11

28 Nov '11

Does anyone else despair at the CLIs produced by networking vendors? Real routers use a CLI that is command based, like IOS, TiMOS or Junos. These interfaces work well over low bandwidth connections (unlike web interfaces), can work with config backup systems like RANCID, have a (mostly) consistent structure and good show commands. However vendors of low cost routers/switches/muxes seem to take a stab in the dark and produce some really nasty stuff. I have a personal hate of text based menus and binary config backup files. Doe this p*** off anyone else? The business part of the company says "This device is great! It's cheap and does everything." However the poor sap who is given the task to make it work has to wrestle with a badly designed user interface and illogical syntax. Maybe the vendors need some sort of best practices guide for what manageability features their kit needs to support to make them acceptable to the market. Does anyone know if there is anything along these lines? Jonathon. This email and attachments: are confidential; may be protected by privilege and copyright; if received in error may not be used, copied, or kept; are not guaranteed to be virus-free; may not express the views of Kordia(R); do not designate an information system; and do not give rise to any liability for Kordia(R).

18 23

Water Utility SCADA 'Attack': The, um, washout
by Jay Ashworth 28 Nov '11

28 Nov '11

Not an attack: an already failing pump, and an employee of a contractor to the utility who was ... wait for it ... traveling in Russia on personal business. WaPo via Lauren @ Privacy: http://j.mp/rrvMXR Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

10 14

Re: Looking for a Tier 1 ISP Mentor for career advice.
by Scott Weeks 26 Nov '11

26 Nov '11

--- tyler.haske(a)gmail.com wrote: From: Tyler Haske <tyler.haske(a)gmail.com> I'd love to have varied experience with a bunch of different companies, but first I'm trying to guarantee my first network engineering job out of college. ----------------------------------------------- You've already taken the first step. That step being you becoming more motivated than many of the other soon-to-be-graduates around you. This motivation will carry you a long way in your career. Who knows, you may be applying to someone here on this list one day... scott

6 6

BGP Update Report
by cidr-report＠potaroo.net 25 Nov '11

25 Nov '11

BGP Update Report Interval: 17-Nov-11 -to- 24-Nov-11 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS29049 79965 2.6% 207.2 -- DELTA-TELECOM-AS Delta Telecom LTD. 2 - AS9829 49222 1.6% 90.5 -- BSNL-NIB National Internet Backbone 3 - AS8402 41347 1.3% 18.3 -- CORBINA-AS OJSC "Vimpelcom" 4 - AS34875 33439 1.1% 227.5 -- YANFES OJSC "Uralsviazinform" 5 - AS5434 31214 1.0% 251.7 -- NURSAT-ALA-AS Nursat-Almaty 6 - AS19743 29751 0.9% 4958.5 -- 7 - AS7552 27656 0.9% 19.8 -- VIETEL-AS-AP Vietel Corporation 8 - AS41440 25577 0.8% 216.8 -- SIBIRTELECOM-AS OJSC Rostelecom 9 - AS32528 24172 0.8% 4834.4 -- ABBOTT Abbot Labs 10 - AS9198 22845 0.7% 83.1 -- KAZTELECOM-AS JSC Kazakhtelecom 11 - AS20632 21072 0.7% 540.3 -- PETERSTAR-AS PeterStar 12 - AS6828 20101 0.6% 223.3 -- USI Uralsviazinform 13 - AS12772 19947 0.6% 127.1 -- ENFORTA-AS Enforta Autonomous System 14 - AS21487 18021 0.6% 212.0 -- SAKHATELECOM-AS OJSC Rostelecom 15 - AS27738 16872 0.5% 49.6 -- Ecuadortelecom S.A. 16 - AS24689 16727 0.5% 223.0 -- ROSINTEL-AS Rosintel Network 17 - AS12332 16581 0.5% 221.1 -- PRIMORYE-AS OJSC Rostelecom 18 - AS15723 16072 0.5% 206.1 -- AZERONLINE Azeronline Information Services 19 - AS3 15463 0.5% 213.0 -- GUGIK Glowny Urzad Geodezji i Kartografii 20 - AS31148 14783 0.5% 35.9 -- FREENET-AS FreeNet ISP TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS19743 29751 0.9% 4958.5 -- 2 - AS32528 24172 0.8% 4834.4 -- ABBOTT Abbot Labs 3 - AS16916 7281 0.2% 3640.5 -- NETLOGIC-WEST - INFINIPLEX LLC DBA NETLOGIC 4 - AS38528 3476 0.1% 3476.0 -- LANIC-AS-AP Lao National Internet Committee 5 - AS17408 3301 0.1% 3301.0 -- ABOVE-AS-AP AboveNet Communications Taiwan 6 - AS38960 2827 0.1% 2827.0 -- INGBANK-UKRAINE Joint-stock bank ING BANK UKRAINE 7 - AS42041 2093 0.1% 2093.0 -- INGOUA-AS CJSC Joint Stock Insurance Company INGO Ukraine 8 - AS11943 909 0.0% 909.0 -- GLOBE - Globe Wireless 9 - AS21271 858 0.0% 858.0 -- SOTELMABGP 10 - AS19223 10937 0.3% 781.2 -- NTEGRATED-SOLUTIONS - Ntegrated Solutions 11 - AS6072 10164 0.3% 726.0 -- UNISYS-6072 For routing issues, email hostmaster(a)unisys.com 12 - AS37115 675 0.0% 675.0 -- TMP-UG 13 - AS57405 655 0.0% 655.0 -- MIHAN-NOC2 MIHAN COMMUNICATION SYSTEMS CO.,LTD 14 - AS48068 567 0.0% 567.0 -- VISONIC Visonic Ltd 15 - AS52140 562 0.0% 562.0 -- UNHCR-IR-AS United Nations High Commissioner for Refugees 16 - AS20632 21072 0.7% 540.3 -- PETERSTAR-AS PeterStar 17 - AS57282 498 0.0% 498.0 -- SOPREX-AS SOPREX D.o.o. 18 - AS52196 487 0.0% 487.0 -- TREC-AS Tehran Regional Electricity Joint Stock Company 19 - AS53362 465 0.0% 465.0 -- MIXIT-AS - Mixit, Inc. 20 - AS10445 1792 0.1% 448.0 -- HTG - Huntleigh Telcom TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 84.204.132.0/24 19391 0.6% AS20632 -- PETERSTAR-AS PeterStar 2 - 130.36.35.0/24 12080 0.4% AS32528 -- ABBOTT Abbot Labs 3 - 130.36.34.0/24 12079 0.4% AS32528 -- ABBOTT Abbot Labs 4 - 67.97.156.0/24 10812 0.3% AS19223 -- NTEGRATED-SOLUTIONS - Ntegrated Solutions 5 - 66.248.104.0/21 10779 0.3% AS6316 -- AS-PAETEC-NET - PaeTec Communications, Inc. 6 - 202.92.235.0/24 10070 0.3% AS9498 -- BBIL-AP BHARTI Airtel Ltd. 7 - 206.80.93.0/24 7271 0.2% AS16916 -- NETLOGIC-WEST - INFINIPLEX LLC DBA NETLOGIC 8 - 65.122.196.0/24 6944 0.2% AS19743 -- 9 - 72.164.144.0/24 4567 0.1% AS19743 -- 10 - 66.238.91.0/24 4560 0.1% AS19743 -- 11 - 65.162.204.0/24 4560 0.1% AS19743 -- 12 - 66.89.98.0/24 4560 0.1% AS19743 -- 13 - 65.163.182.0/24 4560 0.1% AS19743 -- 14 - 203.110.64.0/20 3476 0.1% AS38528 -- LANIC-AS-AP Lao National Internet Committee 15 - 202.153.174.0/24 3301 0.1% AS17408 -- ABOVE-AS-AP AboveNet Communications Taiwan 16 - 195.144.28.0/24 2827 0.1% AS38960 -- INGBANK-UKRAINE Joint-stock bank ING BANK UKRAINE 17 - 213.16.48.0/24 2743 0.1% AS8866 -- BTC-AS Bulgarian Telecommunication Company Plc. 18 - 85.223.211.0/24 2093 0.1% AS42041 -- INGOUA-AS CJSC Joint Stock Insurance Company INGO Ukraine 19 - 14.102.50.0/24 1677 0.1% AS18002 -- WORLDPHONE-IN AS Number for Interdomain Routing 20 - 217.52.130.0/24 1478 0.1% AS15475 -- NOL AS36992 -- ETISALAT-MISR Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0