- Test - lists.nanog.org

AT&T Hiccup
by J. Oquendo 10 Sep '10

10 Sep '10

Alright, since things are mighty quiet on a Friday (either that or everyone on NANOG is now blacklisted somehow and I'm not getting mail), I'd figure to go the PITA route (as usual) and I'd ask a simple question worthy of the mandatory responses of: "on topic questions are not the topic of this list!", "this is not the outage list", "how is this related to networking operations" Did anyone see AT&T flake off the face of the map within the last 30-40 minutes? I know I did! (Seriously I did I did!) Client: "We has no Internet" Me: thinking to myself... "they need to call their provider... Due diligence tracepath/ping/isitdownforeveryoneorjustme time... Global --> AT&T looks sketchy" # tracepath 12.200.xx.xx 3: so-1-3-1.585.ar1.JFK1.gblx.net (208.48.236.105) asymm 4 3.416ms 4: po3-40G.ar2.ATL2.gblx.net (67.16.131.198) asymm 7 141.179ms 5: no reply 6: no reply NO REPLY 24 more x 31: no reply Too many hops: pmtu 1500 Resume: pmtu 1500 AnotherClient (seconds later): "We has no VoIP" Me: thinking to myself... "Damnit GBLX not again" Another_Nother_Client (like even seconds after the first: "We has no p2p!" Me: "time to tweet this question... No... post it to facebook... No - make sure I update LinkedIn... wait?! NANOG" Common denominator... All were on AT&T. So, was it only me or did one of AT&T's cores take a long (3-5 minute) hiccup. Post WTFH: # tracepath 12.200.xx.xx 3: so-1-3-1.585.ar1.JFK1.gblx.net (208.48.236.105) asymm 4 3.774ms 4: te4-4-10G.ar5.NYC1.gblx.net (67.16.134.158) asymm 7 189.496ms 5: 192.205.37.137 (192.205.37.137) asymm 7 5.979ms 6: cr1.n54ny.ip.att.net (12.122.81.58) asymm 9 20.088ms 7: cr84.n54ny.ip.att.net (12.122.115.94) asymm 9 19.585ms 8: gar1.chsct.ip.att.net (12.122.105.117) asymm 7 10.234ms 9: 12.91.181.170 (12.91.18x.xxx) asymm 8 24.811ms 10: 12.200.42.67 (12.200.xx.xx) asymm 9 29.104ms reached Resume: pmtu 1500 hops 10 back 9 Just wanted to know if someone else saw it. All clients were spread through the 12.x.x.x block not solely on 12.200.x.x -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

2 1

Re: Convenience or slippery slope... or something else?
by Jack Carrozzo 10 Sep '10

10 Sep '10

It's just a bunch of subdomain A records, what's it matter.... there are already thousands of such services in existence. -Jack Carrozzo On Fri, Sep 10, 2010 at 1:05 PM, Reese <reese(a)inkworkswell.com> wrote: > A friend brought this to my attention: > > http://ipq.co/ > > He saw it at http://news.ycombinator.com/item?id=1678324 > > I'm not sure whether to shriek in joy or in pain. Will data from > this service - if it is a worthy service - propagate properly? > Play nicely with or break other people's toys? Is it a gimmick? > > Reese > > > >

1 0

Convenience or slippery slope... or something else?
by Reese 10 Sep '10

10 Sep '10

A friend brought this to my attention: http://ipq.co/ He saw it at http://news.ycombinator.com/item?id=1678324 I'm not sure whether to shriek in joy or in pain. Will data from this service - if it is a worthy service - propagate properly? Play nicely with or break other people's toys? Is it a gimmick? Reese

1 0

Reverse traceroute and spoofing of sources of packets?
by Christopher Morrow 10 Sep '10

10 Sep '10

I missed this meeting/preso when it happened (yes, 5+ meetings ago) <http://www.nanog.org/meetings/nanog45/abstracts.php?pt=MTE4OCZuYW5vZzQ1&nm=…> I note the talks about using spoofed source packets to do some measurement, I didn't see anyone in the video say: "But spoofing is bad, but you want YOU to be able to do this? what? isn't that a little hypocritical?" Isn't it? and why would someone (an isp) disable BCP38 for this sort of activity? -Chris

3 2

largest OSPF core
by lorddoskias 10 Sep '10

10 Sep '10

I'm just curious - what is the largest OSPF core (in terms of number of routers) out there?

14 16

eBGP Multihop
by Graham Beneke 10 Sep '10

10 Sep '10

I have been asked to investigate moving an entire network to multi-hop on all the eBGP sessions. Basically all upstreams, downstreams and peers will eBGP with a route reflector located in the core. This RR will be some kind of quagga or similar box. The dev guys want to be able to poke at the BGP feeds directly and do *magic* that standard router aren't capable of. My gut feel is that this is a bad idea. Besides anything else it makes sane link state detection very challenging - especially where we have multiple sessions with a peer. Is their any BCP or operational experience that agrees or disagrees with my gut. ;-) -- Graham Beneke

7 6

Sustaining the Internet with hyperbolic mapping
by Eugen Leitl 10 Sep '10

10 Sep '10

http://www.nature.com/ncomms/journal/v1/n6/full/ncomms1063.html Sustaining the Internet with hyperbolic mapping Marián Boguñá, Fragkiskos Papadopoulos & Dmitri Krioukov Nature Communications 1 , Article number: 62 doi:10.1038/ncomms1063 Received 06 April 2010 Accepted 06 August 2010 Published 07 September 2010 Abstract The Internet infrastructure is severely stressed. Rapidly growing overheads associated with the primary function of the Internet—routing information packets between any two computers in the world—cause concerns among Internet experts that the existing Internet routing architecture may not sustain even another decade. In this paper, we present a method to map the Internet to a hyperbolic space. Guided by a constructed map, which we release with this paper, Internet routing exhibits scaling properties that are theoretically close to the best possible, thus resolving serious scaling limitations that the Internet faces today. Besides this immediate practical viability, our network mapping method can provide a different perspective on the community structure in complex networks. [full text snipped] -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

4 3

Re: Copyright Enforcement DoS/DDoS Attacks
by khatfield＠socllc.net 10 Sep '10

10 Sep '10

He mentioned doing work (for hire) in AU and such. I think he may be in for a rude awakening since our past experience with the Australian authorities is they are more active chasing ddos/cyber-crimes than the U.S. Those guys pull out all the stops to prosecute. (Which I am happy to see) Sadly, here in the U.S. you have little to no chance of getting assistance unless the client is a bank or very public company. In fact, that doesn't always work. (Even with direct FBI contacts in multiple field offices) Kind of a shame.. We are likely already tracking his botnets so I almost welcome it as well. Out of curiosity, I did pull some stats over the last 60 days and we have seen more attacks originating from the India area than we have seen in the past 12 months. Maybe it's a coincidence. I would almost bet this guy has never carried out an attack in his life and simply trying to gain some publicity. *shrug* ------Original Message------ From: Jeffrey Lyon To: Beavis Cc: nanog(a)nanog.org Subject: Re: Copyright Enforcement DoS/DDoS Attacks Sent: Sep 9, 2010 11:43 AM He may get some business out of it, now that he has effectively put out a DDoS for hire ad. Jeff On Thu, Sep 9, 2010 at 8:56 PM, Beavis <pfunix(a)gmail.com> wrote: > man.. this guy is retarded.. good luck posing your company, face and such. lol > > -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions

2 1

Cogent issues
by Charles Mills 09 Sep '10

09 Sep '10

Anyone notice any issues with Cogent? Internet Health Report showing some high latency to Verizon and a couple of other carriers.

3 3

Re: Copyright Enforcement DoS/DDoS Attacks
by Eric Katanich 09 Sep '10

09 Sep '10

He mentioned doing work (for hire) in AU and such. I think he may be in for a rude awakening since our past experience with the Australian authorities is they are more active chasing ddos/cyber-crimes than the U.S. Those guys pull out all the stops to prosecute. (Which I am happy to see) Sadly, here in the U.S. you have little to no chance of getting assistance unless the client is a bank or very public company. In fact, that doesn't always work. (Even with direct FBI contacts in multiple field offices) Kind of a shame.. We are likely already tracking his botnets so I almost welcome it as well. Out of curiosity, I did pull some stats over the last 60 days and we have seen more attacks originating from the India area than we have seen in the past 12 months. Maybe it's a coincidence. I would almost bet this guy has never carried out an attack in his life and simply trying to gain some publicity. *shrug* ------Original Message------ From: Jeffrey Lyon To: Beavis Cc: nanog(a)nanog.org Subject: Re: Copyright Enforcement DoS/DDoS Attacks Sent: Sep 9, 2010 11:43 AM He may get some business out of it, now that he has effectively put out a DDoS for hire ad. Jeff On Thu, Sep 9, 2010 at 8:56 PM, Beavis <pfunix(a)gmail.com> wrote: > man.. this guy is retarded.. good luck posing your company, face and such. lol > > -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions

1 0