March 2012 - Test - lists.nanog.org

Planet-Lab.org traffic
by Drew Linsalata 23 Mar '12

23 Mar '12

At about 17:40 EDT today we started seeing traffic from planet-lab.orgnodes at 25+ US universities all directed at one of our hosting boxes. Its all ICMP and high port UDP stuff. Nothing terrible from what we can tell, but its triggering a constant stream of IDS alerts and auto-blocks. Not easy to configure for since the traffic originates from subnets all over the place, and the list of originating nodes is growing every few minutes. Its horribly annoying, and trying to determine the source using the tools provided on the planet-lab.org site is pretty much impossible as the search tool returns nothing at all times. Yes, we've opened a ticket with support(a)planet-lab.org already. Has anyone else had to deal with this, or is anyone connected to that particular project listening? Im all for academic projects, but the approach here is rubbing me the wrong way.

2 2

Looking for advice - Auditing zones on a set of name servers
by Landon Stewart 22 Mar '12

22 Mar '12

Hi Everyone, I'm looking for some advice here. I'm attempting to clean up a set of name servers and have a list of domain names that should not actually be hosted on those name servers. In some cases there are issues where there are actually no NS records in a domain but it should be hosted on those name servers. In some cases the name servers just aren't authoritative and the domain should be removed. The name servers are all djbdns, not that it matters a whole lot. I'm wondering if anyone knows of some tools that I can use other than homegrown ones that are a little more robust in terms of thinking of every little possible issue for or against a domain than I can think of. Of a list of domains that I marked for deletion some of them simply had little problems but should not be deleted (rather just have their NS records fixed). I also don't' want to pound on someone else's recursive name servers or even the root name servers trying to audit ours since that's not very nice. If anything I guess I could spread out the queries if I had the right tools. I wrote a quick script that looks up the NS records for a zone, then the A records for those NS records and checks the resulting IP addresses against a list of IP addresses that are our name servers. It's not quite doing all I need it to do since sometimes we are authoritative but there are no NS records or they are wrong. I'm also not sure beating on google's name servers is a good idea either so you should fill in your OWN recursive name servers instead f 8.8.8.8 and 8.8.4.4. Thanks for reading! :-D #!/usr/bin/perl # No warranty or guarantee of fitness for any purpose or use. Do not use # if you don't know what it does. # use strict; use Net::Nslookup; die ("Usage: $0 <zone list file>\n") if !$ARGV[0]; # Array of the IP addresses of YOUR name servers my @goodns = ( "10.10.0.5", "10.10.1.5", ); open(F,"<$ARGV[0]") or die("Cannot open file: $ARGV[0]\n"); my @zonelist = <F>; close(F); chomp(@zonelist); ##### # Cycle through each zone to find out if we are authoritative on one of the IPs listed # above in @goodns. ##### foreach my $zone (@zonelist) { # Sub 8.8.8.8 and 8.8.4.4 for your own recursive name server IP addresses to # avoid being rude to google's name servers if you are doing a lot of lookups. # # Find the NS records for the zone my @pns = nslookup(domain => $zone, type => "NS", server => [ '8.8.8.8', '8.8.4.4'] ); # Cycle through each NS record and store an IP address for each my @dns_a_records = (); foreach my $ns (@pns) { my $arr = nslookup(domain => $ns, type => "A", server => [ '8.8.8.8', '8.8.4.4'] ); push(@dns_a_records,$arr); } ##### # If @dns_a_records contains stuff that's also in @goodns then it means # we are probably authoritative in some way. ##### my %goodns=map{$_ =>1} @goodns; my %dns_a_records=map{$_=>1} @dns_a_records; my @isect = grep( $goodns{$_}, @dns_a_records ); if (!@isect) { @dns_a_records[0] = "NONE" if (!@dns_a_records); # We are not authoritative - print the zone and ns record information with a - print "-:$zone: ".join(",",@pns)."\[".join(",", @dns_a_records)."\]\n"; } else { # We are authoritative print it with a + print "+:$zone: ".join(",",@pns)."\[".join(",", @dns_a_records)."\]\n"; } } # END --- Landon Stewart <lstewart(a)superb.net <mailto"LStewart(a)Superb.Net>> Sr. Administrator Systems Engineering Superb Internet Corp - 888-354-6128 x 4199 Web hosting and more "Ahead of the Rest": www.superb.net

3 3

Looking for direct # for AT&T translations
by Jason Baugher 22 Mar '12

22 Mar '12

Our Central Office has been going around in circles trying to open a trouble with AT&T regarding the inability to make outbound 800 number calls. Anyone have a good number we can use? Thanks

1 1

FYI: [Argus] 12.231.155/24 is 'hijacked' by anomalous origin 'AS13490'
by Yang Xiang 22 Mar '12

22 Mar '12

Hi, Just now we found a hijacking, as shown below. Is it a real prefix hijacking, or a false alarm made by us? Hope someone in this list, maybe the admin of those ASes listed below, can give me a reply :-) The feedback can help us improve Argus and provide more valuable information. BRs. ---------- Forwarded message ---------- From: argus-alarm <argus-alarm(a)csnet1.cs.tsinghua.edu.cn> Date: 2012/3/23 Subject: [Argus] 12.231.155/24 is 'hijacked' by anomalous origin 'AS13490' To: argus <argus(a)csnet1.cs.tsinghua.edu.cn> Prefix hijacking alarm: Start Time(UTC): Mar-22-2012 16:29:07 IP Prefix: 12.231.155/24 Origin AS change: AS7018 -> AS13490 Details: http://argus.csnet1.cs.tsinghua.edu.cn/fingerprints/207340/ _______________________________________________ Argus mailing list Argus(a)csnet1.cs.tsinghua.edu.cn http://csnet1.cs.tsinghua.edu.cn/mailman/listinfo/argus -- _________________________________________ Yang Xiang. Ph.D candidate. Tsinghua University Argus: argus.csnet1.cs.tsinghua.edu.cn

2 1

New AS Number Blocks allocated to the RIPE NCC
by Andrea Cima 22 Mar '12

22 Mar '12

Dear Colleagues, The RIPE NCC has received the following AS Number Blocks from the IANA in March 2012. 59392-60415 60416-61439 198656-199679 You may want to update your records accordingly. Best regards, Andrea Cima Registration Services Manager RIPE NCC

1 0

Huawei WiFi = Ruckus OEM?
by Rogelio 22 Mar '12

22 Mar '12

Is it just me? Or do these Huawei wireless APs look like Ruckus APs? http://enterprise.huawei.com/ilink/enenterprise/support/documents/base-netw… Looks specifically at the A603DE and WA653DE. Even the GUIs look very similar. -- Also on LinkedIn? Feel free to connect if you too are an open networker: scubacuda(a)gmail.com

1 0

Microsoft/Hotmail forgot to set reverse DNS pointers?
by Michiel Klaver 22 Mar '12

22 Mar '12

Today I received some notices about Hotmail users who couldn't send e-mail messages to various receipients due to spamfilters blocking them at the receiving mailservers. Seems like Microsoft/Hotmail staff forgot to set some reverse DNS pointer records: Diagnostic-Code: smtp;450 4.7.1 Client host rejected: cannot find your reverse hostname, [157.55.1.150] (Verified this using various public DNS servers, to exclude potential local issues) Anyone here who has proper contacts to give them the clue-bat? -- Michiel Klaver IT Professional

5 5

Comcast help in N Illinois
by Lyle Giese 21 Mar '12

21 Mar '12

Have a customer that is having problems webbrowsing and need some offline assistance from someone at Comcast. First glance, it looks like a proxy/web accelerator problem at Comcast. Thanks, Lyle Giese LCR Computer Services, Inc.

1 0

spammers trying to "lease" IP space?
by Michael Holstein 21 Mar '12

21 Mar '12

I know this tactic isn't exactly new .. just thought I'd pass this along. Text below is exact with exception of our ARIN information and ranges (which any of you could figure out anyway). Cheers, Michael Holstein Cleveland State University --snip-- Description: ABC Widgets *Greetings, NOC or IP Admin at (our ARIN NetName)* ** We would like to Lease or even Purchase some of your IPv4 Ranges like (our/16) “Why do You want to lease our IPs?” Very Simply: Our Business is the delivery of Opted In Marketing Email. The key to this business is good stewardship of IP assets to ensure deliverability, and even more importantly; *Sustainability. *Many of our IP leases last years due to our investment in our network before we ever even mail. As a result it takes Several months before a subnet is profitable for us after recouping our initial infrastructure expenses. So to Hit and Run simply does not make good business sense, after all maybe if we are good to our word you will offer us additional IPs! ** there are two core requirements in any Major League Mail Campaign ? a. _Having a solid list_ with real recipients and records to prove their Sign up is vital to delivery but also to settling any complaints registered with an ISP. b. _Using Multiple IP addresses_. If having a good list is a good defense then using Multiple Static IP addresses is a proactive measure. ISPs, Backbone Carriers, Software Makers, and more all use (among other means) Algorithms to shape traffic across their networks and to their clients. Using an MTA to spread our traffic across thousands of IP addresses from then thousands of ‘C-Blocks’ we mitigate the footprint of our traffic originating from any one network range. ?/It should be noted here that this email is a Request for Pricing (RFP) and its recipients have in no way requested it, they have instead been identified through research, and therefore this email should not be thought of as characteristic of our normal mailings./ Precision Management of Texas (USA) offers on-demand solutions for brand marketers and website promotion chiefly through email marketing. Currently PM is seeking to expand its network capability both overseas and here in the US with the addition of several points of presence (PoP) in geographically diverse locations. Precision Management makes no attempt to conceal identity or intentions as a show of good faith on our part that we will be good customers with an eye on building a relationship beyond this installation. It should go without saying that our use of your network will be totally AUP Compliant and any complaints will be handled in 12 hours or less. We only mail to Top Level Domain’s and do no General Internet mailing. Also i want you to be aware that we are an American Company with verifiable references who can attest to how we conduct our email business. Description: C:\Users\BLEAUH~1\AppData\Local\Temp\~ed_sb_i\~files\3.gif Description: Content Image InlinePM seeks to obtain as much diversity in the allocated IP space as possible, however the most important thing is the Subnets need to have no abuse history. We can take the IPs via GRE or BGP or other such tunneling solution to where you have them announced. Alternatively we can advertise them ourselves on our network, saving you the back-haul. As a third solution we can take a server on your network with the following specs One Virtual (or Dedicated) Server – Dual Cores 1 GB RAM 100 GB HDD? 3 Mbps dedicated - burstable to 100 Term period minimum of 6-12 months I hope you have read this far and will seriously consider this opportunity to generate additional revenue for your company. If this email has found you in error please fwd it to the right person and cc me. Otherwise hit the un-sub at the bottom! Thanks, Edward Wootan Chief Technical Officer Precision Management LLC <http://www.precision-management.net/> 3030 LBJ Freeway Dallas, TX 75234 If you are interested in working with a *Legitimate Marketer * please reply to this email or call me Direct at *(704)286-6098* anytime. The information contained within the referenced, linked, or directed email communication is intended to be a confidential communication between the original sender and recipient, and is to be treated as confidential. All works, ideas, or copy within are copyrighted by precision management llc., and are not to be used in any manner other by which they were intended by precision management llc... If you believe you have received this or any other email in error, please contact cto(a)precision-management.info <mailto:cto@precision-management.info>

4 3

Hands with Cisco Clue in/near Fort Lauderdale?
by chris 21 Mar '12

21 Mar '12

Hello, I have a small project where I could use someone onsite who has general working cisco knowledge to help transition a site to new isp and make basic changes in a cisco router. Of course this was dropped in my lap with short notice so clients wants it done "asap" which in reality is something I'd like to get done this week. Please contact me offlist if you think this is within your realm and you are available. Thanks, chris

1 0