- Test - lists.nanog.org

First Data Corporation?
by Leo Woltz 01 Oct '10

01 Oct '10

Anyone on the list from First Data Corporation or familar with there network?

2 1

Re: LISP Works - Re: Facebook Issues/Outage in Southeast?
by Job W. J. Snijders 01 Oct '10

01 Oct '10

Dear Cameron, On Wed, Sep 29, 2010 at 3:27 AM, Cameron Byrne <cb.list6(a)gmail.com> wrote: >> The fact that LISP does help in IPv6 Transition solutions (due to its inherent AF agnostic design), is compelling. As you say, real edge 2 edge is the goal - and LISP helps here, regardless of the AF. (you'll will still want to do multi-homing in IPv6, and ingress TE, and mobility, etc.). >> > > Sorry, when i said e2e w.r.t IPv6 i was talking about end to end, not > edge to edge. I think there is a big difference. Oops, i meant end to end too, don't know why I typed edge2edge. :-) > IMHO, ILNP is the more interesting solution and avoids expensive > encapsulation and questionable assumptions about ISP MTU, all my ISP > links are GigE and 10GigE and they are all set to default 1500 bytes > ... good or bad, this is just how they roll off the line from every > ISP in every city i buy transit... and LISP tunnels do not work so > well with 1500 byte MTU. I beg to differ, LISP works excellent with 1500 byte MTU. But you point out a significant aspect of LISP; hosts behind LISP rely a bit on path MTU discovery, with all it's benefits and drawbacks. But that's not a show stopper i've seen on the lisp beta network. We live in a world where PMTUD is daily practice, ILNP will not make PMTUD go away. My major concern with ILNP is that eventually all hosts need to be upgraded/changed to take advantage of ILNP. If we take a hard look at something like SCTP... it never was really populair in the wild even though it's in the Linux kernel. I'd rather load new software on hundreds CPE's then change ten thousands of hosts, with all variations, versions, servicepacks. Another example: the rate at which IPv6 has been adopted in operating systems is horrible, we cannot wait another 10 or so years. So I actually consider it one of the best features of LISP that hosts don't need to be changed and the scope has been reduced to just the 'edge' or 'CPE'. In this sense one might even consider LISP to be more backwards compatible then ILNP. :-) Last, ILNP has no viable plan for IPv4, an address family we cannot easily discard. The critique in draft-irtf-rrg-recommendation-14 on ILNP's hIPv4 is heavy, and can be summerized with: "It appears that hIPv4 involves major practical difficulties which mean that in its current form it is not suitable for IETF development.." Kind regards, Job Snijders

2 3

AS27626, AS6061, AS10392, AS11296 - Hijacks Gone Wild!
by Ronald F. Guilmette 01 Oct '10

01 Oct '10

[[ NOTE: This information is being made available to information content providers, or others, as part of the technical means to restrict access to material with may be deemed by some to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, in accordance with 47 USC 230(c)(2)(B). ]] Whew! Now that I got THAT out of the way... I _had_ planned on dribbling out this info, one AS at a time, because I thought that might yield a slightly more ponderous effect, but since another big batch of this info was already made (semi-)public today on another mailing list I'm on, there doesn't seem to be any real point in dragging this out anymore. So here is the whole enchalada... at least with respect to THIS whole interconnected mess. (Yes, there are others. We'll get to them. Be patient.) AS27626, aka Joytel of Jacksonville, Florida, would appear to be at the heart of a rather sizable AS and IP block hijacking campaign, the likes of which, in my experience, the net has never before seen. I mean the total amount of IP space that's been jacked may be smaller than some past big-time hijacks, but this one takes the cake, I think, for the number of separate different IP blocks involved... a number which has actually even been growing stedily over the past week. (These turkeys appear to be in a race to corner the market on abandoned IP blocks. Jeeeesh!) In addition to a metric buttload of jacked blocks being announced by Joytel ltself, AS27626, (see below) there are _three_ other ASes that also appear to be jacked, and each of these also appears to be separately announcing routes to yet more jacked IP blocks. But all of these machinations appear to be to be tied together, if in no other way, then at least by the common thread of the same single common snowshoe spamming company (in Victoria, BC) being the primary (but probably not the only) ultimate beneficiary of all of this hijacking. I have already reported here on two of these other ASes, i.e. AS11296 and AS10392. I now report on a third apparently hijacked AS, i.e. AS6061. See details below. Note that the routes that were being announced by AS11296 have already been withdrawn, but the old route announcements are still listed below, for the sake of completeness. Additionally, I am reporting here on three somewhat stealthy IP blocks that appear to have been legitimately obtained by Joytel... two on Level3 and one on Cogent... all of which appear to me to be infested with/by _some_ snowshoe spammer. (Perhaps someone or something other than the previously mentioned company in Victoria, BC. I haven't actually checked that yet, one way or the other.) As indicated below, the various blocks that I've annotated as "jacked" are in fact, and exclusively, very old, and most probably abandoned IP blocks. That's why they were chosen, specifically, i.e. because it was thought that nobody would miss them, and nobody would even notice that they had been ``liberated''. And that probably would have been true, if it were not for the fact that some of them were then filled up with snowshoe spam domains. As I mentioned previously, spamming is THE most public of crimes. It's hard to make any money at it unless you are annoying millions of people at a time, and thus alerting them to your presence. And when you do that, you are going to draw attention to yourself, big time. I'm not going to even make any sort of suggestion to people, this time, as to what they might want to do with all of the information below, since people gave me a hard time when I did that before. So I'll just leave it as this: You are all clever people here. Use your imagination. I have included below a very partial NS dump for one of the blocks being announced by AS10392 that shows some of the snowshoe pattern there. If people want to see the complete NS dumps for all of the blocks listed below, so that they can independently verify the snowshoey-ness of all this stuff, then ask and you shall receive. One last thing... AS11296 (Interpath) was (is?) only connected to the net via AS27524 (Xeex). Since it is no longer announcing any routes, this is moot, and a non-issue at this time. Everything else you see below all represents open issues. I would like to especially beg, plead, and cajole any customers of AS3491, aka Beyond The Network America, Inc. who may be reading this to PLEASE contact your provider and demand an answer to this simple question: WTF do they think they are doing by peering with AS6061 and AS10392, and who the bleep is actually writing them monthly checks for that? Beyond The Network America, Inc. needs to answer for this too, since they are unambiguously facilitating this ongoing crime. As regards to the ongoing situation with AS27626, aka Joytel, you can readily see here who is keeping _them_ alive and connected: http://www.robtex.com/as/as27626.html#graph AS3356 -- Level3 AS33132 -- FPL FiberNet, LLC If you are a customer of either of these providers, or even a peer, I do encourage you to contact them, and ask them WTF they are thinking. I, for one, sure would like to know. Regards, rfg ============================================================================= AS27626 (Joytel.net, Jacksonville, FL): 24.230.0.0/19 NET-24-230-0-0-1 jacked - empty 68.67.64.0/20 NET-68-67-64-0-1 legit -- GoRack, LLC (Jacksonville, FL) 192.100.5.0/24 NET-192-100-5-0-1 jacked - empty 192.100.88.0/24 NET-192-100-88-0-1 jacked - empty 192.100.134.0/24 NET-192-100-134-0-1 jacked - empty 192.100.143.0/24 NET-192-100-143-0-1 jacked - empty 192.101.177.0/24 NET-192-101-177-0-1 jacked - empty 192.101.187.0/24 NET-192-101-187-0-1 jacked - empty 192.235.32.0/19 NET-192-235-32-0-1 jacked - empty 198.13.16.0/20 NET-198-13-16-0-1 jacked - empty 198.14.16.0/20 NET-198-14-16-0-1 jacked - empty 198.143.128.0/19 NET-198-143-128-0-1 jacked - empty 198.183.32.0/19 NET-198-183-32-0-1 jacked - mucho snowshoe ns 198.210.32.0/19 NET-198-210-32-0-1 jacked - empty 198.241.64.0/18 NET-198-241-64-0-1 jacked - mucho snowshoe ns 198.252.64.0/18 NET-198-252-64-0-1 jacked - empty 199.34.128.0/18 NET-199-34-128-0-1 jacked - empty 199.46.32.0/19 NET-199-46-32-0-1 jacked - empty 199.84.64.0/19 NET-199-84-64-0-1 jacked - empty 199.198.160.0/19 NET-199-198-140-0-1 jacked - empty 204.48.64.0/19 NET-204-48-64-0-1 jacked - empty 204.107.208.0/24 NET-204-107-208-0-1 jacked - just two spammer ns'es 205.144.0.0/20 NET-205-144-0-0-1 jacked - mucho snowshoe ns 206.224.160.0/19 NET-206-224-160-0-1 jacked - empty 206.227.64.0/18 NET-206-227-64-0-1 jacked - empty 208.93.220.0/22 NET-208-93-220-0-1 Actually does belong to Joytel! 216.49.0.0/18 NET-216-49-0-0-1 jacked - empty 216.245.64.0/18 NET-216-245-64-0-1 jacked - empty ============================================================================= AS6061 (Datalytics, Inc - connected only via AS3491 -- Hijacked AS?): 198.187.64.0/18 NET-198-187-64-0-1 198.187.64.0/20 jacked - mucho snowshoe ns 198.187.80.0/20 jacked - mucho snowshoe ns 198.187.96.0/20 jacked - empty 198.187.112.0/20 jacked - empty 209.201.128.0/17 NET-209-201-128-0-1 209.201.128.0/20 jacked - empty 209.201.144.0/20 jacked - empty 209.201.160.0/20 jacked - empty 209.201.176.0/20 jacked - empty 209.201.192.0/20 jacked - empty 209.201.208.0/20 jacked - empty 209.201.224.0/20 jacked - empty 209.201.240.0/20 jacked - empty ============================================================================= AS10392 (GlassCity Internet, Inc. - connected only via AS3491): 192.171.64.0/19 NET-192-171-64-0-1 jacked - some snowshoe 204.137.224.0/19 NET-204-137-224-0-1 jacked - empty 205.164.0.0/18 NET-205-164-0-0-1 205.164.0.0/20 jacked - mucho snowshoe ns 205.164.16.0/20 jacked - empty 205.164.32.0/20 jacked - empty 205.164.48.0/20 jacked - empty 192.171.64.156 1 ns1.carnhamandassochaddel.info 6 youworkinginternationalco.info topgunandinmcb.info picallilyaframeco.info peacondeliverycopcogas.info chillonagabrainpower.info enabledsearchingforcrossco.net 192.171.64.157 1 ns2.carnhamandassochaddel.info 6 youworkinginternationalco.info topgunandinmcb.info picallilyaframeco.info peacondeliverycopcogas.info chillonagabrainpower.info enabledsearchingforcrossco.net ... ============================================================================= AS11296 (Interpath - Routed only via AS27524 Xeex aka NR Software/Nishant Ramachandran): http://www.thefreelibrary.com/USi+Completes+Restructuring,+Receives+$81+Mil… http://www.att.com/gen/press-room?pid=5097&cdvn=news&newsarticleid=22973 63.247.160.0/19 NET-63-247-160-0-1 jacked - empty -- popularfh.com -- all MXes DoA 199.241.64.0/19 NET-199-241-64-0-1 jacked - snowshoe ns @ 199.241.95.253 -- no email! 206.226.64.0/18 NET-206-226-64-0-1 jacked - snowshoe ns @206.226.96.{2,3} seikotsi.com -- Grand Cayman 11-20-2009 206.226.64.0/24 206.226.65.0/24 206.226.66.0/24 206.226.67.0/24 206.226.68.0/24 206.226.69.0/24 206.226.70.0/24 206.226.71.0/24 206.226.72.0/24 206.226.73.0/24 206.226.74.0/24 206.226.75.0/24 206.226.76.0/24 206.226.77.0/24 206.226.78.0/24 206.226.79.0/24 206.226.96.0/19 ============================================================================= Legitimate semi-stealth allocations: Joytel on Level3: 8.22.200.0/21 (snowshoe) Joytel on Level3: 8.24.224.0/20 (snowshoe) Joytel on Cogent: 38.124.176.0/20 (snowshoe) =============================================================================

1 0

Re: NANOG Digest, Vol 32, Issue 119
by DMFH 01 Oct '10

01 Oct '10

Thu, 30 Sep 2010 14:22:07 +0000 nanog-request(a)nanog.org fuream loqour : >If your network is of a scale where it exceeds the utility of static, >then, it is almost certainly of a scale >and topology where it exceeds the utility of RIP. I'd agree that RIP is old, aged, and we all can probably go on with personal horror stories of how a broadcast-only-based routing protocol created a small or large pocket of disaster alone or combined with some other technology below or above its layer in the stack. However, like some other speakers in this thread mentioned, situation + simplicity + engineering = success. RIP certainly has it's place in small pockets now, I still use it in places mostly just to float a few loopbacks or statics around with old equipment, or firewalls I don't trust doing a more robust routing protocol. I see routing protocols, operating systems too, as different tools. If the tool works, fits, and rarely breaks where it's used, cool - I like simple & predictable, which includes predictable failure as well as predictable success. RIP also has the advantage of being around for a long while, so most devices will "get it right" - more complex routing protocol code, found in other IGPs, etc. - exceptions / vendor implementations still rule. I've never done a multicast network with RIP though... *winks* =) /dmfh -- __| |_ __ / _| |_ 01100100 01101101 / _` | ' \| _| ' \ 01100110 01101000 \__,_|_|_|_|_| |_||_| dmfh(-2)dmfh.cx

1 0

Re: L3 Issues this Morning?
by Khurram Khan 30 Sep '10

30 Sep '10

Learn something new everyday, that's awesome. We've got several data centers between San Diego, Denver, Tulsa, Chicago, Washington DC. All of the circuit's between those POP's , and all are L3, just dropped traffic. On Thu, Sep 30, 2010 at 11:35 AM, James Smith <james(a)smithwaysecurity.com> wrote: > None Down here in Canada > > Sent from my iPhone > > On Sep 30, 2010, at 2:32 PM, Khurram Khan <brokenflea(a)gmail.com> wrote: > >> Hello All, >> >> This is my first time writing to this list and wanted to check if >> anyone experienced issues with L3 circuits between 12:50 ET and 13:05 >> ET. All our core backbone circuits re-converged and we saw a >> significant drop in traffic. >> >> Regards, >> >> Khurram >> > -- Please use the following public key for encrypted transport. —–BEGIN PGP SIGNATURE—– Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGZO+K6ECuipL6LVERAjSvAJsFslrQU61la+yCqD2bfDSW/OGKigCg0QOK LQTWZQDmFma6eh7onZfi99A= =LlU0 —–END PGP SIGNATURE—–

2 1

Cogent security contact for non-BGP issue?
by Neal Rauhauser 30 Sep '10

30 Sep '10

Can someone from Cogent responsible for security contact me? I'm seeing some troubles that appear to originate within Cogent itself. What I am seeing does not effect global BGP at all, it's some other area. Thanks in advance ...

1 0

L3 Issues this Morning?
by Khurram Khan 30 Sep '10

30 Sep '10

Hello All, This is my first time writing to this list and wanted to check if anyone experienced issues with L3 circuits between 12:50 ET and 13:05 ET. All our core backbone circuits re-converged and we saw a significant drop in traffic. Regards, Khurram

1 0

Re: RIP Justification
by Tim Franklin 30 Sep '10

30 Sep '10

> I think BGP is better for that job, ultimately because it was > specifically designed for that job, but also because it's now > available > in commodity routers for commodity prices e.g. Cisco 800 series. +1 - for me, if I need a dynamic routing protocol between trust / administrative domains, it's BGP unless there's a good reason not to. I find it more straightforward to work with (albeit slightly more up-front to configure it and get it right) than anything else - the information available is a very clear "who am I talking to?" / "what routes do I send them?" / "what routes do they send me?". Plus I can work through the route-selection process by hand from the information displayed, and have it make sense. Regards, Tim.

1 0

What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 30 Sep '10

30 Sep '10

I realize that this is somewhat OT, but I'm sure that others on the list encounter the same issues and that at least some folks might have useful comments. An increasingly large number of our customers are using Gmail or Google Apps and almost all of our OSS/BSS mail is getting spam filtered by Google. Among others, these e-mails include invoices, order confirmations, payment notifications, customer portal logins, and tickets. Almost anything we send to customers on Google ends up in their spam folder. This results in a lot of calls and makes much of our automation pointless, never mind all the lost sales. The problem is compounded by those who use mail clients and do not log in to the webmail at all, since they would never see the contents of the Google spam folder. We have proper A+PTR records on the edge MTAs, proper SPF records for the originating domain, proper Return-Path and other headers, and so on. There isn't anything that I can think of other than the content itself which would be abnormal, and obviously the content is repetitive and can't be changed much. Is there something obvious which we've missed? Aside from the following clearly impractical solutions, what can we do? 1. Asking everyone (including those we don't even know yet) to whitelist all of our addresses, to check their spam folders, and to click on "this is not spam" 2. Providing our own free e-mail service to everyone (including those we don't even know yet) and putting up "don't use Google" ads on all of our customer-facing systems At least this isn't Hotmail where mail is just silently deleted with no NDR after it's accepted by their MTAs. The call volume has been going up instead of down lately and it's gotten to the point where we're sending MTA log extracts to people to prove to them that we really did e-mail them. Would greatly appreciate any advice. Erik

15 19

AS11296 -- Hijacked?
by Ronald F. Guilmette 30 Sep '10

30 Sep '10

I confess that I find it somewhat tedious to try to answer all criticisms, individually, on a mailing list when people start ``piling on'', so I hope you'll all forgive me if I just try to to do this in one go. First, as regards to the lack of detail and/or specific in my reports, I was specifically insructed, by a gentleman who has far more experience participating here, on the NANOG mailing list, that I do, that I should NOT include too much lengthy elaboration and/or detail because (rough quote) ``... those folks in NANOG really only much care about routers and stuff like that, so don't even digress into topics like spam and such, or give a whole lot of lengthy details, because their eyes will just glaze over and/or you'll be accused of being off-topic. Many of them probably don't even know what the term `snowshoe spamming' refers to anyway.'' I'll be happy to provide all of the abundant evidence I've collected to anyone I can verify as being a legitimate network op offlist. I do need to say however that much of the relevantevidence can be ob- tained quite easily, and without any spoon feeding from me, i.e. directly in the form of applicable/relevant ARIN whois records, all of which are available to anyone. Other evidence, specifically the routes that _were_ being announced by AS11296 (and those that still are, currently, by AS10392) is also freely and publically available from you local friendly looking glass server. I have additional evidence... not so much of hijacking, but more relating to possible/probable snowshoe spamming activity... that is derived, indirectly, from public data sources, upon which I perform additional crunching with personally-developed, proprietary software... and that is stuff that I'll be happy to make available to anybody who can convince me that they are not playing for the other team. To the gentleman who wished me good luck in ``getting assistance from the list in the future'', I thank you for the generosity implied by your sentiment, and would only like to point out that on this occasion, at least (and on none others that I can remember off the top of my head) did I or have I requested assistance from the NANOG mailing list. On this occasion, I believe (and believed) that I was _offering_ my help to NANOG, rather than the other way 'round.) But again, I thank you for your concern anyway. To the gentleman who asked (with respect to the widespread... but certainly not universal... use of freemail accounts) whether or not ``the general population are all doing it wrong'', I would answer in the affirmative, generally, and not specifically with respect to the use of freemail accounts. As supporting evidence, I ask that you please begin reading here: http://en.wikipedia.org/wiki/Financial_crisis_of_2007%E2%80%932010 (I have a small mountain of documentation available to support the view that ``the general population are all doing it wrong'' with respect to almost anything you can name, and will be only too happy to provide more links as required/requested.) To the gentleman who suggested that my un-acceptance of e-mail from gmail, specifically, might be a black mark aganist my credibility, that's fine, I have no problem with that. I certainly never expected nor hoped that anybody would take any action of any kind based either on my perceived ephemeral and transitory credibility, or the perceived lack therof. For the two recent reports I have made here, and others I may make in future, the publically available evidence speaks for itself, and my personal credibility, or lack thereof, is neither here nor there, as a practical matter. I am not running for office, and I'm not tring to sell aluminum siding. What you think of me personally doesn't affect whether a given AS or IP block either is or isn't hijacked. Facts are facts... in this case mostly publically available... and thankfully are not dependant upon any one person for validation, least of all me. To the gentleman who quoted "A decent respect to the opinions of mankind requires that they should declare the causes.", the beauty and elegance of that sentiment, and its formulation, while undeniable and holding great appeal for any and all who call these United States home, actually applied to a rather different and more serious situation, I think, i.e. the dis- solution of political bands... dissolution which, I think everyone knew at the time, was highly likely to lead to a costly and bloody war... a rather more serious outcome than any likely to derive from a mere NANOG posting. Still, you make a reasonable point, and my only response is to reiterate what I have said above, i.e. that most of the substantiating documentation is readily and freely available from various public sources, and requires only the most modest amounts of motivation to independently obtain. To the gentleman who suggested that one could perpetrate what amounted to a DDoS attack, simply by making a derogatory posting about a given network on the NANOG mailing list, I can only ask ``Does that really work??'' If it does, then I'll have to remember to try it sometime, when I'm bored. (There are lots of naughty people on the Internet I'd like to spank, but I think that if I was really of a mind to seriously spank some of them, I might try route injection first. More effective and far more 31337. Plus I think the Russians are having a half price sale on that service next month. :-) To the gentleman who pointed out that a so-called ``appeal to authority'' is a lousey way to try to support any given claim, yea, you're absolutely right. I try never to do it myself. Personally, I find facts much more persuasive that anybody's rep. That same gentleman apparently took issue with my original post, apparently asserting that it wasn't ``...written in a way that recognizes that clued, skeptical individuals are going to carefully analyze it.'' All I can say is that in my own humble opinion, it actually _was_ written in _precisely_ that way. (The fact that it was witten that way partly explains why it was so terse.) To the gentleman who suggested that I was "Joe Blow", I can only say "Yea? So? Even if I am, what's yer point?" Just as nobody should evaluate important claims based only on somone's positive reputation alone, likewise, in my view, nobody should evaluate important claims exclusively on the basis of anyones negative or non-existant reputation either. I _am_ Joe Blow, and proud of it! To paraphrase an old TV commercial ``Don't hate me because I'm pretty. Don't believe me because I'm "somebody". Don't dis-believe me because I'm "nobody". You've got a keybord and eyes of your own. May I respectfully suggest that you use them?'' Regards, rfg

1 0