- Test - lists.nanog.org

Internet Activity in Libya measured by looking at unsolicited traffic
by Mirjam Kuehne 23 Mar '11

23 Mar '11

Dear colleagues, Amidst the recent political unrest in the Middle East, researchers have observed significant changes in Internet traffic and connectivity. In this new article on RIPE Labs, Emile Aben from the RIPE NCC in collaboration with CAIDA, tapped into a previously unused source of data: unsolicited Internet traffic arriving from Libya. http://labs.ripe.net/Members/emileaben/unsolicited-internet-traffic-from-li… Kind Regards, Mirjam Kuehne RIPE NCC

1 0

Power issues at SAVVIS DC3 yesterday?
by Christopher Pilkington 23 Mar '11

23 Mar '11

We saw multiple 110V power feeds drop simultaneously yesterday at SAVVIS DC3, around 10am EDT. Anyone else have an issue, or is someone just playing with our breakers? We didn't lose any of our 208V. -cjp

2 1

Re: OT: Question/Netflix issues?
by Hammer 23 Mar '11

23 Mar '11

So did anyone get a root cause? -Hammer- "I was a normal American nerd." -Jack Herer On Wed, Mar 23, 2011 at 12:05 AM, Roger Marquis <marquis(a)roble.com> wrote: > A probable case of outsourcing core business functionality without a > fully tested plan B... > > < > http://www.computerworlduk.com/news/cloud-computing/3250260/netflix-switche… > > > > <http://blog.reddit.com/2011/03/why-reddit-was-down-for-6-of-last-24.html > > > > < > http://www.reddit.com/r/blog/comments/g66f0/why_reddit_was_down_for_6_of_th… > > > > Roger Marquis > > > We?re sorry, the Netflix website and the ability to instantly watch >> movies >> are both temporarily unavailable.However, our shipping centers are >> continuing to send and receive DVDs so your order is in process as usual. >> Our engineers are working hard to bring the site and ability to watch >> instantly back up as soon as possible. We appreciate your patience and, >> again, we apologize for any inconvenience this may cause. If you need >> further assistance, please call us at 1-877-445-6064. >> > >

1 0

DNSSEC on the resolver-side?
by Marco Davids (Prive) 23 Mar '11

23 Mar '11

Hi, I wonder... How many people here have activated DNSSEC validation on their resolvers? Please let me know off-list when the page below results in a green tick: http://dnssectest.sidn.nl/ Additional details are welcome, like: - The IP-address of the resolver(s) you used (if you know) - Whether this is an 'official' resolver at an ISP or not - You current IP-address, or the ISP you are at (http://ip.sidn.nl might be helpful). Maybe some of you DNS-gurus are even able to tell why DNSSEC validation failed, even when using DNSSEC-enabled resolvers. For example because of some old-school DNS-forwarder in your ADSL modem or something. That would be great information also. The reason for this post is just for me to get a rough understanding of the level of DNSSEC adoption on the resolver-side and the problems that might still exist with DNSSEC validation. The NANOG wiki (http://nanog.cluepon.net) has nothing about DNSSEC yet. Would it be an idea to add something about DNSSEC? I am more than willing to do the kick-off for that. Regards, -- Marco

1 0

SORBS contact?
by Chris Conn 23 Mar '11

23 Mar '11

Hello, We have opened a number of tickets in the SORBS DUHL system to notify them of the use of a former dialup /24 for static assignments to no avail. Anyone from SORBS reading this? Thank you, Chris Conn B2B2C.ca

5 4

SBL99576 195.191.102.0/24 SR04
by Sven Olaf Kamphuis 23 Mar '11

23 Mar '11

BL99576 195.191.102.0/24 SR04 SBL100272 195.191.102.0/23 SR02 > IDEAR4BUSINESS (trademark fraud replicas spammers) > Trademark fraud replicas & knock-offs advertised in spam. (was SBL99180, > also SBL99576) - trademarks are not valid in china - chinese law applies to the customer's services - no evidence of fraud - no evidence of spamming (also, judistiction thingy). "Partners of "AS34109/AS51787 (CB3ROB)" - not a partner, a downstream transit customer, that just so happens to be on AS34109 for now as they lack their own (for now ;) - the /23 seems to overlap with the /24... there may be 2 reasons for this 1: the customer seems to have added 2 /24 "delegations' on his -PI- space in the RIPE database, which, isn't supposed to be possible with PI space anyway, nontheless, that happened ;) 2: they are indeed announced as 2 seperate /24's most of the time (incoming ddos attack "migitation") -IF- spamming -really- would be going on, from these ranges or to these ranges, you are ofcourse free to list those, and only those: 195.191.102.0/23 IDEAR4BUSINESS 84.22.98.8/29 Media Entertainment Guide 84.22.98.16/29 Media Entertainment Guide 84.22.98.24/29 Media Entertainment Guide and whatever is behind AS56512 (no idea, several prefixes on several ASNs)) these are the only listings for which spamhaus seems to have -any- reason whatsoever, despite that for these listings as well, all the evidence is lacking and there are merely a few unbased claims and some whois outputs to "support" them. (and usually they even got the whois/prefix lenght wrong, or added it to the wrong company's "case"... ;) All of the above listings are ISPs themselves, and usually don't have anything to do with the hosted content. as for the AS56512 thingy, no idea what your problem is with them, its not like we can make it up from your listings besides you calling everyone 'spammers' and 'frauders' and replica rolex sellers or partners thereof (including us!), none of which is supplied with any evidence, police reports, or court convictions. Now, its really quite easy, we WILL NOT DISCONNECT any customers just because spamhaus tries to blackmail us into doing so by adding: SBL105802 205.189.71.0/24 (PCCF, a company in which the cyberbunker-group holds the majority of shares) SBL105804 205.189.72.0/23 (PCCF, a company in which the cyberbunker-group holds the majority of shares) SBL105803 91.209.12.0/24 ZYZTM research #10 B.V. (part of the cyberbunker-group) These ranges are used solely for research and development of new internet protocols. (including one to replace that dusty old spam-infested smtp crap of yours ;) SBL99505 84.22.96.0/19 (entire PA space of ours) SBL105813 84.22.96.0/32 (?) SBL105806 84.22.96.0/32 (?) No idea why you'd list the entire PA space while all customers are clearly marked in whois, it's PA space, you're SUPPOSED to delegate it to different customers, after which, its up to the customers. well, except for that you clearly are trying to blackmail us into disconnecting customers without getting a court order or even providing evidence of any of your claims. if blacklisting won't work if you do it for the actual prefix that's "causing" it (according to your claims) it also won't work for larger prefixes or completely non-related prefixes, therefore, thats nothing more or less than just blackmail, and very childish. let's just say that port 25/tcp traffic is mainly incoming... ;) except for the occasional invoice going out... spamhaus is ofcourse absolutely free to list spammers, spamhaus is not free to "make things up" and blackmail carriers and calling third parties 'criminals' and what not. as a european provider, we have no liability whatsoever for what customers do or do not do, all or most of our customers are ISPs themselves, go bug them... if they don't do what you want, they probably have their reasons for it (really i don't see why we even reply to third parties like spamhaus either ;) wherever the customers have their office, there probably are courts, should you think the customer is breaking the law, feel free to have some attorneys or the cops do something about it, but the moment you start to claim things without any evidence, spamhaus is clearly in the wrong. any carriers/peers that could potentially drop prefixes due to spamhaus listings are well advised to review their terms and conditions and contracts as i'm quite sure it doesn't mention "spamhaus listing" in there as a "reason" to filter prefixes anywhere... therefore, if you're a paid transit, and receive prefixes, you're gonna have to relay them, with or without spamhaus listings. spamhaus is no authority whatsoever, and clearly, for very valid reasons. i'm not "for spamming" but frankly, i no longer give a shit about that rusty old protocol without a friends list, as far as i'm concerned, it's dead and replaced by skype ages ago. we expect this matter to be resolved. until that time, we advise everyone not to resolve spamhaus'es blocklists, as clearly, 99% of it, is just there to attempt to blackmail. -- Greetings, Sven Olaf Kamphuis, CB3ROB Ltd. & Co. KG ========================================================================= Address: Koloniestrasse 34 VAT Tax ID: DE267268209 D-13359 Registration: HRA 42834 B BERLIN Phone: +31/(0)87-8747479 Germany GSM: +49/(0)152-26410799 RIPE: CBSK1-RIPE e-Mail: sven(a)cb3rob.net ========================================================================= <penpen> C3P0, der elektrische Westerwelle http://www.facebook.com/cb3rob ========================================================================= Confidential: Please be advised that the information contained in this email message, including all attached documents or files, is privileged and confidential and is intended only for the use of the individual or individuals addressed. Any other use, dissemination, distribution or copying of this communication is strictly prohibited.

4 4

Re: OT: Question/Netflix issues?
by Roger Marquis 23 Mar '11

23 Mar '11

A probable case of outsourcing core business functionality without a fully tested plan B... <http://www.computerworlduk.com/news/cloud-computing/3250260/netflix-switche…> <http://blog.reddit.com/2011/03/why-reddit-was-down-for-6-of-last-24.html> <http://www.reddit.com/r/blog/comments/g66f0/why_reddit_was_down_for_6_of_th…> Roger Marquis > We?re sorry, the Netflix website and the ability to instantly watch movies > are both temporarily unavailable.However, our shipping centers are > continuing to send and receive DVDs so your order is in process as usual. > Our engineers are working hard to bring the site and ability to watch > instantly back up as soon as possible. We appreciate your patience and, > again, we apologize for any inconvenience this may cause. If you need > further assistance, please call us at 1-877-445-6064.

1 0

Re: SORBS contact?
by Chris Conn 22 Mar '11

22 Mar '11

Hello, Thank you to all that answered, all helpful info. Surprisingly minutes after my Nanog post, a couple of my tickets saw action and the /24 was finally removed a short while later. Thanks again, Chris

6 7

ATT Maro
by Don.DuQuette＠fngp.com 22 Mar '11

22 Mar '11

Does anyone have information regarding the AT&T MARO product for redundancy? What technology are they using? Is it simply being done via BGP? Any information would be greatly appreciated Don DuQuette

1 0

DWDM Metro Access Design
by Livio Zanol Puppim 22 Mar '11

22 Mar '11

Hello, I don't know if this is the appropriate list for this kind of subject, so if anyone knows another specific list, please tell me... I'm analysing several DWDM designs to implement at my city, but I'm still a bit confusing about the Metro acess design. I'm supposed to build a physical ring topology with 6 pairs of fiber with an hub-and-spoke logical topology. The ring will have about 40Km. At the HUB we'll install our point-of-presence with a MPLS equipment, and at the spokes we'll use only IP routers. We need an flexible design where we can add or remove spokes as needed with the minimum effort possible. We are planning to have, at a initial deployment, about 200 hundred spokes, and all these spokes are talking only with the HUB site. Everything should work like in an FTTH or FTTB design, no other type of transportation is allowed (wireless and copper). We can't use SONET/SDH. The solution must be only IPoDWDM or complemented with TDMoIP at the access equipment. The problem, is that all documents that I'm reading specifies that we should be worried with faults scenarios at the spokes, so that the optical network does not stops. For example, if the OADM equipment at the spoke is down, the lambda dropped at that site will be down too... Or at least, if we use a lot of lambdas, we need to keep and eye at the points where we have regenerators. We need bandwidth from 10Mbps to 1000Mbps at these spokes. My question is: Is it possible to make such a network in a way that we don't need to worry about faults (electrical or others) at the spokes? If so, how can I do this? I don't want the spokes sites interfering directly at the operation for the whole network. Thanks for your help. -- []'s Lívio Zanol Puppim

3 3