- Test - lists.nanog.org

Network Operators Unite Against SORBS
by iHate SORBS 12 Oct '10

12 Oct '10

Network Operators Unite Against SORBS Do you, or have you had problems with SORBS? Tired of being able to do nothing about it? Sick of opening a trouble ticket, only to get delisted weeks later? I am calling on all Network Operators to stand up and stop routing dnsbl.sorbs.net until that time they can commit to making real changes. -Operator

9 8

Hey Leber - you think Melissa is going to issue that refund properly or do we need to escalate this into legal actions against HE
by todd glassey 12 Oct '10

12 Oct '10

Mike Leber - I have been waiting for a response from Melissa in your accounting department since she insisted I sign the VISA release in order to refund our money after your company violated the Co-Lo agreement and shut the power down to ROW 4 in Suite 1200 with no warning or Customer Service Response... How long is this going to take to process? Todd Glassey -- //----------------------------------------------------------------- This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.

13 12

Re: Network Operators Unite Against SORBS
by Brielle Bruns 12 Oct '10

12 Oct '10

How about... Network Operators Against Whiny Mail Operators Who Have Nothing Better To Do With Their Time But Carry Out Personal Vendettas? NOAWMOWHNBTDWTRBCOPV ------Original Message------ From: iHate SORBS To: nanog(a)nanog.org Subject: Network Operators Unite Against SORBS Sent: Oct 12, 2010 6:35 AM Network Operators Unite Against SORBS Do you, or have you had problems with SORBS? Tired of being able to do nothing about it? Sick of opening a trouble ticket, only to get delisted weeks later? I am calling on all Network Operators to stand up and stop routing dnsbl.sorbs.net until that time they can commit to making real changes. -Operator -- Brielle Bruns http://www.sosdg.org / http://www.ahbl.org

1 0

Mobile Operator Connectivity
by Leo Woltz 11 Oct '10

11 Oct '10

I am looking for some guidance from the list. We will soon be deploying wireless payment devices (CDMA/GSM). We are looking at options on where to locate the servers that will run the backend payment gateways; we would like the least amount of latency between the servers and the wireless networks as possible. The wireless networks we will be deploying the devices on are: AT&T Wireless Verizon Wireless Sprint PCS Rogers Wireless Bell Mobility Telus Mobility Vodafone I was thinking we have a few options, to try and peer with the wireless networks directly, buy bandwidth from networks that are directly peered with the wireless operators or the Global Roaming Exchange Peering service that Equinix runs but I have not been able to find out much more then what is on Equinix’s public web site. We also have a need to peer with PayPal and Amazon. I welcome the lists comments and recommendations.

8 14

AT&T/L3 interconnect?
by Deepak Jain 11 Oct '10

11 Oct '10

While jumping on the wagon of poking at a particular 175.x.x.x address, I noticed something in my trace: 10 5 ms 5 ms 5 ms att-level3-30G.washingtondc.level3.net [4.68.62.30] 11 73 ms 72 ms 73 ms cr2.wswdc.ip.att.net [12.122.84.82] 12 74 ms 74 ms 75 ms cr1.cgcil.ip.att.net [12.122.18.21] 13 72 ms 72 ms 72 ms cr2.dvmco.ip.att.net [12.122.31.85] 14 73 ms 72 ms 73 ms cr1.slkut.ip.att.net [12.122.30.25] 15 73 ms 72 ms 72 ms cr2.la2ca.ip.att.net [12.122.30.30] 16 72 ms 72 ms 72 ms cr84.la2ca.ip.att.net [12.123.30.249] 17 73 ms 73 ms 73 ms gar1.lsrca.ip.att.net [12.122.129.121] Does anyone happen to know where the other end of this tunnel is that magically everything from a DC-DC hop to a DC-LA hop are all exactly 73ms? thanks, DJ

3 3

Level3 leaking routes?
by Jon Lewis 11 Oct '10

11 Oct '10

Has anyone else seen this, starting about midnight EDT last Friday night / Saturday morning? I advertise a few [more specific] routes to Level3 tagged with 65000:0 for TE. This is something that's worked for years. Either some of Level3's peers have become customers, or there's something wrong with Level3's route propagation filters that broke last Friday night. customer traffic engineering communities - Suppression -------------------------------------------------------- 64960:XXX - announce to AS XXX if 65000:0 65000:0 - announce to customers but not to peers 65000:XXX - do not announce at peerings to AS XXX ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

iPhone, meet Wireshark...
by kowsik 11 Oct '10

11 Oct '10

If you wanted to see what the apps on your mobile device are up to (especially operators trying to understand the impact of mobile apps on their infrastructure), current instructions on the web involve jail-breaking, setting up access-points and hubs and what not. It's gotta be lot simpler than that. Blog: http://bit.ly/cBFvDd Code: http://github.com/pcapr/l2bridge A couple of things you can do with the packets you capture: . Use http://www.pcapr.net/xtractr to analyze the apps, generate reports and charts and go to town . Be nice and share non-sensitive application traffic back to the pcapr community May the packets be with you! Thanks, The Pcapr Team http://www.pcapr.net/ http://twitter.com/pcapr http://labs.mudynamics.com

1 0

Routeviews
by Mehmet Akcin 10 Oct '10

10 Oct '10

hello, anyone from university of oregon or routeviews project ( routeviews.org ) here ? please contact me off-list please. thanks mehmet

2 1

Equinix MPLS connectivity
by Leo Woltz 10 Oct '10

10 Oct '10

We are looking for some MPLS connectivity between Equinix Ashburn and Equinix San Jose who would the group recommend?

9 11

New hijacking - Done via via good old-fashioned Identity Theft
by Ronald F. Guilmette 10 Oct '10

10 Oct '10

[[ Note: There are three more apparently hijacked blocks that are related to the 75 specific blocks I am reporting on herein. I'll be reporting on those other three blocks later on, but right now I just want to keep it simple and report on just the ones relating to directnet.net. ]] So anyway, presented below, as Rod Serling would have said, "... for your approval..." you will find a collection of 75 separate IP blocks, all of which appear to have been hijacked in one big gulp. One /21, plus seventy four /24s. This case was done, quite neatly, the good old fashioned way.... apparently by trivial identity theft. (And I should say that no fault whatsoever accrues in any way to ARIN in this case. They were not even involved in the slightest, since all of the relevant WHOIS records have remained utterly unchanged throughout this entire hijacking.) The identity theft: A company that was responsible for one /21 block and 74 separate /24 blocks (all of the latter of which had been originally allocated for various U.S. elementary schools, middle schools, and high schools) apparently went out of business. In due time, the company's domain name (directnet.net) came up for sale. It was purchased for $4,000, sometime between May 31, 2010 and June 13, 2010: http://www.dnjournal.com/archive/domainsales/2010/20100623.htm Subsequently, the domain name was transferred to an anonymizing registrar in the Cayman Islands. Sometime before or after that purchase, whoever had purchased the directnet.net domain convinced the fine folks at Reliance Globalcom Services, Inc., (AS6517) to announce routes to 100% of this rather cleverly hijacked IP space. (See complete IP block list attached below.) Sometime after that, the IP blocks in question began to fill up with snowshoe name servers and snowshoe spam domains. The entire set of relevant ARIN WHOIS records for the hijacked IP blocks, along with the new WHOIS record for the newly re-registered directnet.net domain, and also a listing of the snowshoe domains and name servers that have been created in, or moved into these hijacked IP blocks are all avaliable here: http://www.47-usc-230c2.org/hijacked-schools/ Although it is impossible to be absolutely certain who engineered this clever hijacking, some of the evidence available to me at this time suggests that a particular company listed on Spamhaus' ROKSO list may possibly have either either had a hand in engineeering the hijacking, or else may possibly have benefitted from it, after the fact, i.e. obtaining IP space which they could then sub-lease to their space-hungry customers. Certainly, fine folks at Reliance Globalcom Services, Inc. could tell us who is paying them to connect these hijacked blocks to their network, but I rather doubt that they are actually going to come clean and do that. Regards, rfg Hijacked blocks: 204.194.184.0/21 205.196.1.0/24 205.196.14.0/24 205.196.28.0/24 205.196.29.0/24 205.196.30.0/24 205.196.31.0/24 205.196.32.0/24 205.196.33.0/24 205.196.34.0/24 205.196.35.0/24 205.196.36.0/24 205.196.37.0/24 205.196.38.0/24 205.196.40.0/24 205.196.41.0/24 205.196.42.0/24 205.196.43.0/24 205.196.44.0/24 205.196.45.0/24 205.196.46.0/24 205.196.47.0/24 205.196.49.0/24 205.196.51.0/24 205.196.52.0/24 205.196.53.0/24 205.196.54.0/24 205.196.55.0/24 205.196.56.0/24 205.196.57.0/24 205.196.58.0/24 205.196.59.0/24 205.196.60.0/24 205.196.61.0/24 205.196.62.0/24 205.196.67.0/24 205.196.68.0/24 205.196.69.0/24 205.196.71.0/24 205.196.72.0/24 205.196.73.0/24 205.196.75.0/24 205.196.76.0/24 205.196.96.0/24 205.196.97.0/24 205.196.99.0/24 205.196.100.0/24 205.196.101.0/24 205.196.102.0/24 205.196.103.0/24 205.196.104.0/24 205.196.105.0/24 205.196.106.0/24 205.196.107.0/24 205.196.108.0/24 205.196.109.0/24 205.196.111.0/24 205.196.112.0/24 205.196.113.0/24 205.196.114.0/24 205.196.115.0/24 205.196.116.0/24 205.196.161.0/24 205.196.162.0/24 205.196.163.0/24 205.196.164.0/24 205.196.165.0/24 205.196.192.0/24 205.196.193.0/24 205.196.194.0/24 205.196.196.0/24 205.196.197.0/24 205.196.198.0/24 205.196.199.0/24 205.196.200.0/24

12 21