May 2012 - Test - lists.nanog.org

eircom.net contact
by Christopher Singhaus 11 May '12

11 May '12

Not sure if this is the right list to send this out to, but I figured I'd give it a try. I'm looking for anyone with a contact at Eircom.net. Customers on their network are continually trying to brute force RDP machines on our network. Fail2ban does automatically null route them and send them an email, however all I get is a rfc-ignorant auto reply stating to fill out a form on their website. In fact, they have been listed as rfc ignorant since 2006. http://www.rfc-ignorant.org/tools/detail.php?domain=eircom.net&submitted=11… I've also sent emails to noc(a)eircom.net but received no reply whatsoever. Just looking for a human to talk to at this point or any other advice. -- Christopher Singhaus, Systems Administrator / Abuse Dept HopOne Internet Corp. - AS 14361 - www.hopone.net "Yesterday's weirdness is tomorrow's reason why." -Hunter S Thompson

5 6

VPN over satellite
by Rens 10 May '12

10 May '12

Dear, Could anybody recommend any hardware that can build a VPN that works well over satellite connections? (TCP enhancements) I want to setup a L3 VPN between 2 satellite connections Even additionally if that hardware would also support WAN bonding even better because I also have a scenario to connect 2 times 2 satellites to have more capacity for my L3 VPN Regards, Rens

8 8

Question about peering
by Anurag Bhatia 10 May '12

10 May '12

Hello everyone I am curious to know how small ISPs plan peering with other interested parties. E.g if ISP A is connected to ISP C via big backbone ISP B, and say A and C both have open peering policy and assuming the exist in same exchange or nearby. Now at this point is there is any "minimum bandwidth" considerations? Say if A and C have 1Gbps + of flowing traffic - very likely peering would be good idea to save transit costs to B. But if A and C have very low levels - does it still makes sense? Does peering costs anything if ISPs are in same exchange? Does at low traffic level it makes more sense to keep on reaching other ISPs via big transit provider? Thanks. -- Anurag Bhatia anuragbhatia.com or simply - http://[2001:470:26:78f::5] if you are on IPv6 connected network! Twitter: @anurag_bhatia <https://twitter.com/#!/anurag_bhatia> Linkedin: http://linkedin.anuragbhatia.com

10 13

Re: Looking for W7 whois freeware
by Hank Nussbacher 10 May '12

10 May '12

At 12:54 10/05/2012 +0530, Suresh Ramasubramanian wrote: >Did you try this one Hank? > >http://www.mcafee.com/us/downloads/free-tools/trout.aspx That is not a whois client. Doesn't come close to what I need. Thanks anyway. -Hank >On Thu, May 10, 2012 at 12:19 PM, Hank Nussbacher <hank(a)efes.iucc.ac.il> >wrote: > > I am looking for a Window 7 GUI utility that does raw whois - not the > > standard domain lookup, but rather allows me to specify and change the > whois > > server I am talking to and allows me to customize the whois search string > > for IPs or ASNs or anything else a whois server will accept, like: > > "-B -G as378". > > > > I know of ezwhois but am looking for something better (for example - they > > don't have whois.ripe.net listed - one can add it but not save it). > > > > Thanks, > > Hank > > > > > >-- >Suresh Ramasubramanian (ops.lists(a)gmail.com)

2 1

ICMP Redirects from residential customer subnets?
by ML 09 May '12

09 May '12

Last night I was troubleshooting a strange issue where Apple products (So far just MacOS and Airports) were losing internet connectivity sporadically. Originally I thought it was an IPv6 transition technology causing the problem but the customer couldn't even ping their default GW via v4. To rule out the customer mistyping/giving us wrong information on what they were seeing I attempted to verify IP connectivity from my DHCP server to them. I pinged the IP they had retrieved via DHCP earlier. What I got back were ICMP redirects interspersed with echo replies from the customer I was pinging. The redirects were of the form: "Redirect Host(New nexthop: x.y.z.23)" The nexthop being an IP of the customer I was troubleshooting. Thinking that was very odd I setup an ACL on the vlan serving that subnet to log ICMP redirects. What I found was one IP x.y.z.56 sending redirects to IPs on my network as well as several IPs outside my network. As far as I know there is no legitimate reason for a residential PC or home gateway to send ICMP redirects. There were also a few dozen other IPs on that subnet sending ICMP redirects. A majority of them had 68:7f:74 (Cisco-Linksys) OUIs. There were also some Belkins and one ASUStek OUIs. The 68:7f:74 source MACs were dispersed amongst many customers not all from the same customer. Which leads me to believe there is either a bugged Linksys firmware or an exploited Linksys home gateway causing trouble. Has anyone ever seen something like this before? Is there any reason to see ICMP redirects on a single homed residential subnet? I'm considering adding ICMP redirects to my customer edge ACL unless there is a legitimate purpose for these packets. Thanks -ML

4 3

Manhole fire, Pittsburgh PA
by Justin M. Streiner 09 May '12

09 May '12

There was a manhole/electrical vault fire this morning in Pittsburgh on Fifth Ave in the Oakland area. Numerous telcos/dark fiber providers affected (Level3, Verizon, DQE Communications, Fibertech Networks, possibly others). Initial outage accurred at about 03:15 EDT today. Current restoration estimate is 15:00-16:00 EDT today. jms

1 0

Operation Ghost Click
by Jeroen van Aart 09 May '12

09 May '12

Excuse the horrible subject :-) Anyone have anything insightful to say about it? Is it just lots of fuss about nothing or is it an actual substantial problem? http://www.fbi.gov/news/stories/2011/november/malware_110911 "Update on March 12, 2012: To assist victims affected by the DNSChanger malicious software, the FBI obtained a court order authorizing the Internet Systems Consortium (ISC) to deploy and maintain temporary clean DNS servers. This solution is temporary, providing additional time for victims to clean affected computers and restore their normal DNS settings. The clean DNS servers will be turned off on July 9, 2012, and computers still impacted by DNSChanger may lose Internet connectivity at that time." -- Earthquake Magnitude: 5.5 Date: Thursday, April 26, 2012 19:21:45 UTC Location: off the west coast of northern Sumatra Latitude: 2.6946; Longitude: 94.5307 Depth: 26.00 km

42 93

Network Solutions IPv6 DNS Admin needed
by Jeff Fisher 09 May '12

09 May '12

Hi, I've been sending e-mails to IPV6Req(a)networksolutions.com; however, it's been months now and my IPv6 glue records have not been changed. If anyone knows somebody at Network Solutions who can help, please send me an off-list reply. Thanks, Jeff

1 0

Anyone have a layman's guide to writing an rwhois daemon?
by Landon Stewart 08 May '12

08 May '12

Hi All, I just wrote a perl daemon that seems to be a working rwhois server but the RFC is quite difficult to read for me. When talking about the protocol it mentions a bunch of requirements and describes them quite strangely (see rfc2167 section 3.1.9). Is there a layman's guide around somewhere or can anyone lend some advice here? Is what I wrote acting like a real rwhois server - at least partially? $ whois -h sirt.hopone.net -p rwhois 66.235.162.21 %rwhois V-1.5:00ffff:00 rwhois.hopone.net (HopOne Internet Corp) servername:sls-cf7p17 domain:rac13a.com ipaddress:66.235.162.21 ipaddress:66.235.166.15 ipaddress:66.235.179.110 abusename:Abuse Department abusephone:206-438-5909 abusemail:abuse@hopone.net %ok (If you try running the command above it may or may not be running and may not succeed) If anyone knows where to get an rwhois daemon that has hooks for looking up the data in an external database (not a .cdb database or flat file) I'd appreciate it a great deal. I won't want to waste too much time on this if I can help it but I want a functioning rwhois server. Our rwhoisd at rwhois.hopone.net has been broken for a while and for the life of me I cannot figure out what's wrong with the data formatting it's using. I attempted to join the mailing list for ISC's rwhoisd daemon but it's dead (no volume on the list). -- Landon Stewart <LStewart(a)Superb.Net> Sr. Administrator Systems Engineering Superb Internet Corp - 888-354-6128 x 4199 Web hosting and more "Ahead of the Rest": http://www.superbhosting.net

2 2

Cisco Nexus 2k EPLD upgrades question.
by Sarpreet Basi 08 May '12

08 May '12

Hello All, Looking to deploying 3 x N2K-C2248TP-1GE (2ps 1fan) 4 x10GE slot and 48 x 10/100/1000, Rather than a 6509. I'm hesitant with those is the maintenance aspect. While ISSUs don't necessarily impact the 2248, EPLD upgrades would. Do you know how upgrades are implemented on the 2248s? Is it via the host N7K's own epld process? Any help on this would be much appreciated. -- Thank You, Sarpreet Basi Knowledge Computers Email: sar(a)knowledgecomputers.net Toll-free: 800.967.6609 x102 International: 250.748.0818 x102 Fax: 250.748.3388 Mobile: 250.709.0336 --------------------------- AOL IM: sarpreetb MSN: sarpreet(a)hotmail.com www.knowledgecomputers.net We Do Maintenance on All EOL Network Product.

1 0