January 2012 - Test - lists.nanog.org

Re: Megaupload.com seized
by Scott Weeks 19 Jan '12

19 Jan '12

On Jan 19, 2012, at 5:41 PM, Ryan Gelobter wrote: > The megaupload.com domain was seized today, has anyone noticed significant > drops in network traffic as a result? > > http://www.scribd.com/doc/78786408/Mega-Indictment > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… ----------------------------------------------------------------- ------------ derek(a)derekivey.com wrote: -------------- From: Derek Ivey <derek(a)derekivey.com> Interesting… it looks like they seized the servers and didn't touch DNS. -bash-3.00$ nslookup megaupload.com Non-authoritative answer: Name: megaupload.com Address: 174.140.154.22 Name: megaupload.com Address: 174.140.154.23 Name: megaupload.com Address: 174.140.154.24 Name: megaupload.com Address: 174.140.154.20 Name: megaupload.com Address: 174.140.154.21 DNS still points to Mega Upload's IPs. --------------------------------------------------------------- Collecting client IP addresses to send notices to? >;-) I notice other IPs in the range ( for example, .223 and .123) say the same thing about UDP/53. scott ku# nmap -P0 -sU -p U:53 174.140.154.22 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.21 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.20 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.223 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.123 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -A 174.140.154.20 All 1000 scanned ports on 174.140.154.20 are filtered Too many fingerprints match this host to give specific OS details

1 0

Whois 172/12
by Ted Fischer 19 Jan '12

19 Jan '12

Hi all, Tearing what's left of my hair out. A customer is getting scanned by a host claiming to be "172.0.1.216". I know this is bogus, but I want to go back to the customer with as much authoritative umph as I can (heaven forbid they just take my word). I'm pretty sure I read somewhere once that 172/12 was "reserved" or something like that. All I can find now is that 172/8 is "administered by ARIN". Lots of information on 172.16/12, but not a peep about 172/12. If anybody could provide some insight as to the allocation/non-allocation of this block, it would be much appreciated. Thanks. Ted Fischer

15 17

US DOJ victim letter
by Jay Hennigan 19 Jan '12

19 Jan '12

We have received three emails from the US Department of Justice Victim Notification System to our ARIN POC address advising us that we may be the victim of a crime. Headers look legit. We have been frustrated in trying to follow the rabbit hole to get any useful information. we've jumped through hoops to get passwords that don't work and attempted to navigate a voice-mail system that resembles the "twisty maze of passages all different" from an old text adventure game. This *seems* to be legit, and I would think that the end result is likely to be a list of IP addresses associated with infected hosts. Has anyone else received the email? Is it legit? If so has anyone successfully navigated the maze, and if so how? Is it worth it? (And why don't they just send the list of infected IPs to the ARIN contact in the first place?) -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

12 11

RIS raw data
by andra.lutu＠imdea.org 19 Jan '12

19 Jan '12

Hi all, I am working on getting a better grasp on what data we have in the RIS project from RIPE. To this end, I am checking the export policies of the ASes peering with RIPE AS12654 at different IXPs. I am wondering if anybody knows what these ASes actually announce to the RIPE repositories? Do they dump their entire routing tables (including their internal routes) ? In some cases I saw the export policy ANNOUNCE ANY, is this consistent with a particular AS behaving like the RIPE AS was its customer? Another type of export policy is for example 'to AS12654: ANNOUNCE AS "YYY" '(where "YYY" is any AS peering with RIPE in the RIS project). How is this policy different from the previous one from the point of view of the routing feed the RIPE repository receives? Thank you for your help! Best regards, Andra

9 10

AlcaLu Adds Security to Routers
by Henry Linneweh 19 Jan '12

19 Jan '12

http://www.lightreading.com/document.asp?doc_id=216514&f_src=lrdailynewslet… -Henry

2 1

Security Contact for PlusServer.de (AS8972)
by Tim Donahue 19 Jan '12

19 Jan '12

Hi all, Sorry for the noise, but I am looking for a contact for PlusServer.de (AS8972) to get a security issue resolved. Email to their abuse@ address has gone unanswered for nearly 24 hours at this point and the malicious traffic has not been stopped yet. Hopefully someone here has a security or noc contact that can I can reach out to. Thank you, Tim

1 0

Skype in the Enterprise
by Mike Gatti 19 Jan '12

19 Jan '12

Hello Everyone, I wanted to get the groups opinions/thought on how you would or currently handle users wanting or using Skype in the enterprise. Recently what has brought this to light was the fact that our firewalls started to deny/shun users randomly from access to the internet. After a couple of dozen packet captures and cross checking software installed on the clients machines we narrowed down the culprit to be Skype, which later we validated in Lab. What we saw was in random intervals all skype clients would send a burst of requests to the internet which would trigger the intrusion detection threshold of our security appliances. Given that there were no changes to those thresholds I am left to ask what caused this behavior to start, a software update or an update to the skype network (if it can be called that)? I am trying to educate myself a little more before facing the lynch mobs when I start advising on a solution. Thanks for taking the time, -- Michael Gatti main. 949.371.5474 (UTC -8)

2 1

bgp question
by Deric Kwok 19 Jan '12

19 Jan '12

Hi all When we get newip, we should let the upstream know to expor it as there should have rule in their side. how about upstream provider, does they need to let their all bgp interconnect to know those our newip? If no, Can I know how it works? If they don't have rules each other, ls it any problems? Thank you so much

5 8

dial-peer authenticaton in ios 12.3?
by Gregory Edigarov 19 Jan '12

19 Jan '12

Hello everybody, Is there a good person who could try to remember how to configure authentication in dial-peer on IOS (tm) MC3810 Software (MC3810-A2ISV5-M), Version 12.3(13), RELEASE SOFTWARE (fc2)? dial-peer voice 1 pots authentication username someuser password somepassword does not seem to be any help as it points an error on "authentication" keyword. Is there anything I could try to do about this before I through it out from my balcony? Thank you. -- With best regards, Gregory Edigarov

1 0

World IPv6 Launch Day - June 6, 2012
by Derek Ivey 19 Jan '12

19 Jan '12

Just saw this new site: http://www.worldipv6launch.org/ Many large companies and ISPs are planning to finally go live with IPv6 by June 6, 2012. I don't see Verizon (my ISP) on the list though :(. I'm glad to see companies moving forward with IPv6! Derek

16 21