February 2013 - Test - lists.nanog.org

Ok: this is a targetted attack
by Jay Ashworth 11 Feb '13

11 Feb '13

Clearly, someone has decided to shoot at me specifically, since this latest spam supposedly from me: ===== Received: from lpb01.clearspring.com ([206.165.250.240] helo=lpb01-a.clearspring.local) by sc1.nanog.org with esmtp (Exim 4.80 (FreeBSD)) (envelope-from <email(a)addthis.com>) id 1U4vc3-000Cq4-9q for nanog(a)nanog.org; Mon, 11 Feb 2013 15:48:11 +0000 Received: from lpb01.clearspring.local (localhost [127.0.0.1]) by lpb01-a.clearspring.local (8.14.4/8.14.4) with ESMTP id r1BFm5bG022255 for <nanog(a)nanog.org>; Mon, 11 Feb 2013 10:48:05 -0500 Date: Mon, 11 Feb 2013 10:48:05 -0500 From: jra(a)baylink.com To: nanog(a)nanog.org Message-ID: <57414784.191289.1360597685530.JavaMail.brainiac(a)lpb01.clearspring.local> ===== is also about FTTH. FOR THE RECORD: I don't ever use "send this link to someone", and especially not to a mailing list; this isn't even my tenth rodeo. Cheers, -- jr 'DoS attack? What's that?' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

5 5

Re: Problems for route to 92.43.96.0/21 for Comcast?
by Courtney Smith 11 Feb '13

11 Feb '13

On Feb 11, 2013, at 4:52 PM, nanog-request(a)nanog.org wrote: > ------------------------------ > > Message: 4 > Date: Mon, 11 Feb 2013 13:24:21 -0800 > From: Jim Burwell <jimb(a)jsbc.cc> > To: nanog(a)nanog.org > Subject: Problems for route to 92.43.96.0/21 for Comcast? > Message-ID: <51196185.3050109(a)jsbc.cc> > Content-Type: text/plain; charset=ISO-8859-1 > > Can't seem to get to 92.43.96.0/21 (specifically 92.43.96.130 ... in > Salzburg Austria) from Comcast Business in the Bay Area (traceroute > stops close to provider edge). > > Works from Verizon FiOS down in LA, and a HE.net host in Fremont. > > Comcast folks may want to look at this. :-) > > - Jim > > > Comcast has a route server at route-server.newyork.ny.ibone.comcast.net. From the view there, it appears 92.43.96.130 has been black holed. The IP holder and/or folks at AS49322 may want to contact Comcast Security folks. http://xfinity.comcast.net/constantguard/Support/Contacts route-server.newyork.ny.ibone>show ip bgp 92.43.96.130 BGP routing table entry for 92.43.96.130/32, version 1613615116 Paths: (8 available, best #7, table Default-IP-Routing-Table, not advertised to EBGP peer) Advertised to update-groups: 2 64650, (received & used) 68.86.80.11 (metric 80255) from 68.86.80.11 (68.86.1.11) Origin incomplete, metric 0, localpref 100, valid, internal Community: 64650:50001 no-export 64650, (received & used) 68.86.80.13 (metric 73765) from 68.86.80.13 (68.86.1.13) Origin incomplete, metric 0, localpref 100, valid, internal Community: 64650:50001 no-export 64650, (received & used) 68.86.80.10 (metric 79700) from 68.86.80.10 (68.86.1.10) Origin incomplete, metric 0, localpref 100, valid, internal Community: 64650:50001 no-export 64650, (received & used) 68.86.80.7 (metric 74330) from 68.86.80.7 (68.86.1.7) Origin incomplete, metric 0, localpref 100, valid, internal Community: 64650:50001 no-export 64650, (received & used) 68.86.80.12 (metric 69700) from 68.86.80.12 (68.86.1.12) Origin incomplete, metric 0, localpref 100, valid, internal Community: 64650:50001 no-export 64650, (received & used) 68.86.1.5 (metric 69635) from 68.86.80.6 (68.86.1.6) Origin incomplete, metric 0, localpref 100, valid, internal Community: 64650:50001 no-export Originator: 68.86.1.5, Cluster list: 68.86.1.6 64650, (received & used) 68.86.80.2 (metric 65535) from 68.86.80.2 (68.86.1.2) Origin incomplete, metric 0, localpref 100, valid, internal, best Community: 64650:50001 no-export 64650, (received & used) 68.86.80.0 (metric 66795) from 68.86.80.0 (68.86.1.0) Origin incomplete, metric 0, localpref 100, valid, internal Community: 64650:50001 no-export route-server.newyork.ny.ibone> route-server.newyork.ny.ibone>show ip bgp 92.43.96.131 BGP routing table entry for 92.43.96.0/21, version 1594928908 Paths: (8 available, best #2, table Default-IP-Routing-Table) Advertised to update-groups: 2 1257 8437 3248 49322, (received & used) 68.86.1.42 (metric 66845) from 68.86.80.12 (68.86.1.12) Origin IGP, metric 0, localpref 250, valid, internal Community: 7922:42 7922:3000 Originator: 68.86.1.42, Cluster list: 68.86.1.12, 68.86.1.0 1257 8437 3248 49322, (received & used) 68.86.1.46 (metric 65585) from 68.86.80.2 (68.86.1.2) Origin IGP, metric 0, localpref 250, valid, internal, best Community: 7922:46 7922:3000 Originator: 68.86.1.46, Cluster list: 68.86.1.2 1257 8437 3248 49322, (received & used) 68.86.1.42 (metric 66845) from 68.86.80.11 (68.86.1.11) Origin IGP, metric 0, localpref 250, valid, internal Community: 7922:42 7922:3000 Originator: 68.86.1.42, Cluster list: 68.86.1.11, 68.86.1.0 1257 8437 3248 49322, (received & used) 68.86.1.42 (metric 66845) from 68.86.80.13 (68.86.1.13) Origin IGP, metric 0, localpref 250, valid, internal Community: 7922:42 7922:3000 Originator: 68.86.1.42, Cluster list: 68.86.1.13, 68.86.1.0 1257 8437 3248 49322, (received & used) 68.86.1.46 (metric 65585) from 68.86.80.6 (68.86.1.6) Origin IGP, metric 0, localpref 250, valid, internal Community: 7922:46 7922:3000 Originator: 68.86.1.46, Cluster list: 68.86.1.6, 68.86.1.2 1257 8437 3248 49322, (received & used) 68.86.1.46 (metric 65585) from 68.86.80.10 (68.86.1.10) Origin IGP, metric 0, localpref 250, valid, internal Community: 7922:46 7922:3000 Originator: 68.86.1.46, Cluster list: 68.86.1.10, 68.86.1.2 1257 8437 3248 49322, (received & used) 68.86.1.42 (metric 66845) from 68.86.80.0 (68.86.1.0) Origin IGP, metric 0, localpref 250, valid, internal Community: 7922:42 7922:3000 Originator: 68.86.1.42, Cluster list: 68.86.1.0 1257 8437 3248 49322, (received & used) 68.86.1.46 (metric 65585) from 68.86.80.7 (68.86.1.7) Origin IGP, metric 0, localpref 250, valid, internal Community: 7922:46 7922:3000 Originator: 68.86.1.46, Cluster list: 68.86.1.7, 68.86.1.2 route-server.newyork.ny.ibone> () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

1 0

Problems for route to 92.43.96.0/21 for Comcast?
by Jim Burwell 11 Feb '13

11 Feb '13

Can't seem to get to 92.43.96.0/21 (specifically 92.43.96.130 ... in Salzburg Austria) from Comcast Business in the Bay Area (traceroute stops close to provider edge). Works from Verizon FiOS down in LA, and a HE.net host in Fremont. Comcast folks may want to look at this. :-) - Jim

2 1

AS 58400 announcing 118.0.0.0/8
by Anurag Bhatia 11 Feb '13

11 Feb '13

Seems like AS 58400 is announcing 118.0.0.0/8. Seems like HE's bgp.he.net is getting it in their collected data http://bgp.he.net/net/118.0.0.0/8#_bogon Overall it's just being ignored everywhere but for some strange reason my ISP in India picked less specific announcement for sometime and few sites in one of its /24 chuck for net4india went down. 118.67.249.0/24 is allocated prefix to Net4 by APNIC and they are announcing it at IXP as well as upstream transit. Anyone saw issues with this prefix ever? I hope I am not missing some test or so with prefix at University in this case. Also, as per HE's collected data, the AS path is AS28289 <http://bgp.he.net/AS28289> AS53131 <http://bgp.he.net/AS53131> AS10429 <http://bgp.he.net/AS10429> AS12956 <http://bgp.he.net/AS12956> AS701 <http://bgp.he.net/AS701> AS6762 <http://bgp.he.net/AS6762> AS7713<http://bgp.he.net/AS7713> AS58400 <http://bgp.he.net/AS58400> So is AS6762 Telecom Itlia not filtering their Indonesian customer ? -- (Sent from my iPad) Anurag Bhatia http://anuragbhatia.com Twitter: @anurag_bhatia Skype: anuragbhatia.com

1 0

Looking for US East Coast KVM Swap
by Pete Ashdown 11 Feb '13

11 Feb '13

I'm looking for a KVM guest swap on the US eastern coast for a tertiary DNS server. Must have a minimum of 1GB RAM, 4 CPUs, and be IPv6 capable. I am willing to swap the same here in Salt Lake City, Utah. Thanks in advance!

1 0

PLDT contact and overseas submarine cables in southern Philippines
by Joseph Chin 11 Feb '13

11 Feb '13

Hi, Anyone from PLDT on this list? I am looking for information about the availability of overseas submarine cable connectivity from Cebu and southern Philippines in general. I am researching the feasibility of locating a DR operations (e.g. contact centre) in that region. From the submarine cable maps I have seen (e.g. http://asia-pacific-map-2012.telegeography.com/ ) all the overseas cables land in the northern Philippines islands. Thanks. Regards, Joe

1 0

jra@baylink.com has shared something with you
by jra＠baylink.com 11 Feb '13

11 Feb '13

http://advanced-television.com/2013/02/11/eu-shuns-future-proof-broadband-s… --- This message was sent by jra(a)baylink.com via http://addthis.com. Please note that AddThis does not verify email addresses. To stop receiving any emails from AddThis, please visit: http://www.addthis.com/privacy/email-opt-out?e=q1HYPdgz0RzYPdgz0XLZLtE

2 1

JoeJobbed, I think
by Jay Ashworth 11 Feb '13

11 Feb '13

Here are the relevant headers as I saw them from the list: """ Received: from benjamin.baylink.com ([127.0.0.1]) by localhost (benjamin.baylink.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rv7Ib4bfEtWx for <jra(a)baylink.com>; Sun, 10 Feb 2013 19:55:34 -0500 (EST) Received: from sc1.nanog.org (sc1.nanog.org [50.31.151.68]) by benjamin.baylink.com (Postfix) with ESMTPS id 280D91F0012A for <jra(a)baylink.com>; Sun, 10 Feb 2013 19:55:34 -0500 (EST) Received: from localhost ([::1] helo=sc1.nanog.org) by sc1.nanog.org with esmtp (Exim 4.80 (FreeBSD)) (envelope-from <nanog-bounces(a)nanog.org>) id 1U4hg5-0007zX-6D; Mon, 11 Feb 2013 00:55:25 +0000 Received: from smtp.mnginteractive.com ([63.147.64.243]) by sc1.nanog.org with esmtp (Exim 4.80 (FreeBSD)) (envelope-from <jra(a)baylink.com>) id 1U4hfD-00074r-27 for nanog(a)nanog.org; Mon, 11 Feb 2013 00:54:31 +0000 Date: 10 Feb 2013 18:02:46 -0700 X-SBRS: None X-HAT: Message received through Sender Group RELAYLIST, Policy $RELAYED applied. Received: from atglive19.medianewsgroup.com ([10.148.16.99]) by smtp.mnginteractive.com with ESMTP; 10 Feb 2013 18:02:46 -0700 Message-ID: <31513948.1360544065374.JavaMail.atgservice(a)atglive19.medianewsgroup.com> """ Unless I'm very much mistaken, I believe that last Received before the date (combined with absence of the static IP of my mailserver) is evidence of an envelope-level forgery. If whomever is babysitting the list this quarter pings me direct, I'll give them that static (assuming they can't already see it themselves), and they can double check, but it doesn't look like it came through my server; no appearances of nanog.org in my lots between 1720 and 1855EDT. I note also that I can't see a message body either in the copies I got from the list, or the ones I was forwarded. Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

2 3

Multicast Ethernet frames not bridging between wired and wireless, Netgear CPE
by Christopher J. Pilkington 11 Feb '13

11 Feb '13

I've a Netgear 7550 B90 provided by Frontier. (Yes, it's my only choice other than VSAT. Rural US. Yes, I am already looking into getting my own CPE, but humor me.) Since Frontier doesn't support IPv6, I've linux box on the LAN building an AYIYA tunnel, and doing the usual router thing on the wired Ethernet. Everything on the wired side works splendid. Wireless clients didn't seem to want to play. Further digging indicates that RA and NS don't cross the bridge from wired to wireless. Manually assigning IPv6 address and nailing NDP entries allows ICMPv6 echo request to work. Has anyone seen this class of device drop multicast between the wireless radio and the wired ethernet switch? Or am I brain dead this morning and missing something obvious? Heck, I even tried disabling WPA2 thinking it was some wonky encryption thing. Thanks, -cjp

3 3

Level3 worldwide emergency upgrade?
by Ray Wong 10 Feb '13

10 Feb '13

Does anyone have details on tonight's apparent worldwide emergency router upgrade? All I managed to get out of the portal was 30 minutes, "Service Affecting" (no kidding?) and the NOC line gave me the recording about it and disconnected me. -R>

25 32