- Test - lists.nanog.org

Verisign deep-hacked. For months.
by Jay Ashworth 06 Feb '12

06 Feb '12

Oh, my. http://finance.yahoo.com/news/Key-Internet-operator-rb-2857339070.html Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

8 9

Thanks & Let's Prevent this in the Future.
by Kelvin Williams 06 Feb '12

06 Feb '12

First off, I'd like to thank everyone on this list who have reached out today and offered us help with our hijacked network space. It's so refreshing to see that there are still so many who refuse to leave a man/woman down. I'm not going to place any blame, its useless. There were lies, there were incompetencies, and there was negligence but that is now water under the bridge. However, I think that we as network operators have a duty to each other to make sure we don't allow a downstream customer wreck the operations of another entity who has been rightfully allocated resources. A few months ago, when establishing a new peering relationship I was encouraged (actually required) to utilize one of the IRRs. I took the time to register all of my routes, ASNs, etc. However, as I learned today, this was probably done in vain. Too many people won't spend the extra 30-seconds to verify the information listed there or in ARINs WHOIS. I don't care what a customer tells me, too many times I've found they aren't 100% honest either for malicious/fraudulent reasons or they are unknowing. So, for our networks or the networks we manage, we want to verify what a customer is saying to prevent what happened to us today. I'd like to get a conversation going and possibly some support of an initiative to spend that extra 30-seconds to verify ownership and authorization of network space to be advertised. Additionally, if someone rings your NOC's line an industry-standard process of verifying "ownership" and immediately responding by filtering out announcements. There's no sense in allowing a service provider to be impaired because a spammer doesn't want to give up clean IP space. Do you protect a bad customer or the Internet as a whole? I pick the Internet as a whole. How can we prevent anyone else from ever enduring this again? While we may never stop it from ever happening, spammers (that's what we got hit by today) are a dime a dozen and will do everything possible to hit an Inbox, so how can we establish a protocol to immediate mitigate the effects of an traffic-stopping advertisement? I thought registering with IRRs and up-to-date information in ARINs WHOIS was sufficient, apparently I was wrong. Not everyone respects them, but then again, they aren't very well managed (I've got several networks with antiquated information I've been unable to remove, it doesn't impair us normally, but its still there). What can we do? Better yet, how do we as a whole respond when we encounter upstream providers who refuse to look at the facts and allow another to stay down? kw -- Kelvin Williams Sr. Service Delivery Engineer Broadband & Carrier Services Altus Communications Group, Inc. "If you only have a hammer, you tend to see every problem as a nail." -- Abraham Maslow

8 7

Re: Hijacked Network Ranges
by John Schneider 06 Feb '12

06 Feb '12

Another interesting thing that I noticed, is that AS33611 is not advertising any prefixes other than yours. Either they do not have any of their own (unlikely) or they are advertising their own legitimate prefixes from another AS however I doubt that is the case. It sounds like you were able to verify that this is indeed a malicious attack. If that is truly the case, I would certainly be in contact with your lawyers as this is certainly causing you financial loss and since it is easily verifiable, you would have a solid case i would think. I am no attorney but it seems like a no-brainer to me. So, it does look like you are finally announcing your prefixes as a /24 and that most traffic is again coming to your AS. that probably helped quite a bit right? Regards, John

3 2

Super Sunday
by Jay Ashworth 06 Feb '12

06 Feb '12

What, no whacky weekend thread? NBC and the NFL are, for the first time, televising the Super Bowl and its preshow on the Internet... using a Silverlight app (so I hope you Linux people don't enjoy football). It's supposed to be available to tablets too, as a second-screen cast with selectable angles and such, but Verizontal has an exclusive on mobile, so the target page should bounce cellphones, unless a) they lie or b) they weren't smart enough to IP block the carrier ranges. http://mashable.com/2012/02/04/watch-super-bowl-xlvi-online/ It will be interesting to see how this works out. Enjoy the game. Especially if you have a Big Wall to watch it on. Cheers, -- jr 'we want pictures' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

3 7

Superbowl traffic.
by jamie rishaw 05 Feb '12

05 Feb '12

(yeah, i used a (C) term , so sue me) akam reporting ~17M hits/sec.. anyone seeing clearly identifiable traffic spikes (presumably due to sb)? reply offlist if you want to submit data but don't want to be outed as divulging corp info, but graphs and/or raw datars would be awesome sauce. data will be aggregated/anonymized unless requested otherwise. ^^ yes, you can configure your router for awesomesauce. so HDICMRFT flak will be nulled. :-p -j -- "sharp, dry wit; brash in his dealings" - Forbes X-Ob-Zing: "it's very hard not to be condescending when you're explaining..to an idiot." -BMaher /* - teh jamie. ; uri -> http://about.me/jgr */

1 0

[NANOG-announce] Tutorials starting today, some available via webcast!
by Dave Temkin 05 Feb '12

05 Feb '12

For the first time, NANOG will be webcasting (and archiving) some of our tutorials. Beginning at 2PM PT, you can see John Kristoff give an Introduction to Shell and Perl Scripting for Network Operators, with a break from 3:30-4 and then starting back at 4PM PT with Intermediate Perl Scripting for Network Operators. Both tutorials will be available later for review. You may see all streaming options at http://www.nanog.org/streaming.php -Dave Temkin For the NANOG Program Committee _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

bgp history lookup tool?
by Mike 04 Feb '12

04 Feb '12

Hi, I am trying to diagnose an event yesterday where our provider appears to have dropped our routes and we were inaccessible from outside our provider. I thought somewhere someone was keeping a searchable database of bgp announce/withdrawals and it would be useful to have a peek and see if any such event concerning our prefix/as was seen anywhere. Mike-

3 2

Please help our simple bgp
by Ann Kwok 04 Feb '12

04 Feb '12

Hello Our router is running simple bgp. "one BGP router, two upstreams (each 100M from ISP A and ISP B) We are getting full feeds tables from them We discover the routes is going to ISP A only even the bandwidth 100M is full Can we set the weight to change to ISP B to use ISP B as preference routes? Can the following configuration work? What suggest to this weight no. too? neighbor 1.2.3.4 description ISP B neighbor 1.2.3.4 remote-as 111 neighbor 1.2.3.4 weight 2000 If this works, how is ISP B upstream connection is down? Can it still be failover to ISP A automatically? If it won't work, Do you have any suggestion? Thank you for your help

7 6

Some Smokeping doubts
by Grupo IPv6 04 Feb '12

04 Feb '12

Hi all, I’m using Smokeping (http://oss.oetiker.ch/smokeping/) and I have some doubs that maybe you can answer: - Why Smokeping needs to be connected to internet even when I have only one Target to a host in my LAN ? - What is exactly the Standard deviation calculated at the bottom right of the graphs? Can it be interpreted as Jitter? Or is there another way to know the jitter? - Why sometimes when I add a new host, for the first minute I get a list of errors saying that the RDD file doesn’t exist? This happens commonly? Is there any way to solve this problem? Many thanks, Gabriel

1 0

Question about prefix list
by Ann Kwok 04 Feb '12

04 Feb '12

Hi I read this prefix list. Can I know why there is "le 24" after network block in /22 and /21 Why don't have "le 24" after /24? I also saw another prefix list before. They use "le 32" instead of "le 24" What are their different? ip prefix-list prefix-filter-as100 seq 10 permit 202,168.136.0/22 le 24 ip prefix-list prefix-filter-as100 seq 20 permit 202,22.92.0/22 le 24 ip prefix-list prefix-filter-as100 seq 30 permit 202,21.148.0/22 le 24 ip prefix-list prefix-filter-as100 seq 40 permit 203,178.88.0/21 le 24 ip prefix-list prefix-filter-as100 seq 50 permit 178.88.74.0/24 Thank you so much

5 4