- Test - lists.nanog.org

Q9 BGP contact needed, urgently
by James Smith 10 Feb '10

10 Feb '10

Please contact me off list. -- James Smith

1 0

Re: The Internet Revealed - A film about IXPs v2.0: now available
by Larry Sheldon 10 Feb '10

10 Feb '10

On 2/10/2010 9:28 AM, Jay Ess wrote: > So, for example, if i don't like how a car works i must be able to build > a car to be allowed to voice my opinion? How much did you pay for the video? -- "Government big enough to supply everything you need is big enough to take everything you have." Remember: The Ark was built by amateurs, the Titanic by professionals. Requiescas in pace o email Ex turpi causa non oritur actio Eppure si rinfresca ICBM Targeting Information: http://tinyurl.com/4sqczs http://tinyurl.com/7tp8ml

2 1

black listing of web traffic
by Andrey Gordon 10 Feb '10

10 Feb '10

Hi list I have a problem that I can't seem to find a solution to yet. My student network is being NATted out and anyone who's on that network had troubles accessing random websites. For example, going to www.apple.com or www.facebook.com would work great, but store.apple.com would either not load or take forever to open up. I've had that problem last week and thought I tracked it down to the NAT ip being black listed with one of the span black lists. Even though that IP is not used for mail out, that somehow seemed to affect it. Changing it to a different one seemed to solve the problem and I got that original address of the list in the mean time. Changed it back and everything was well, until today. Same symptoms, but now I don't see us listed anywhere. The best description of the symptoms seems to be that that IP is rate limited or something. Anyone seen that? Are there any blacklists for web access? PS. I checked everything under my control and i don't see a bottle neck anywhere or anything like and IPS working up or something.... ----- Andrey Gordon [andrey.gordon(a)gmail.com]

5 5

ip address management
by Pavel Dimow 10 Feb '10

10 Feb '10

Hello, does anybody knows what happend with ipat? http://nethead.de/index.php/ipat http://nanog.cluepon.net/index.php/Tools_and_Resources Any other suggestion for a good foss ip address management app with ipv6 support?

13 18

about udp 80,8080,0
by 최종훈 10 Feb '10

10 Feb '10

These days, most of ddos attack use udp port 80.8080.0 in our country and our network. Sometimes the traffic volume is up to 100gbps higher. So, we are considering to rate(bps) control about udp port 8,8080,0 in our ISP network. Although such a ports arp not be used commonly... I'm wondering about whether any of problems happen after do that. Is there anyone who have experiences controlling udp port 8,8080,0 ? rate-limiting or block! What does application use 8.8080,0 port for the proper purpose? [chk_receive.html?msgid=1265716670&uniqid=23455&sender=eversuede%40chol .com]

5 4

Re: black listing of web traffic
by Andrey Gordon 10 Feb '10

10 Feb '10

Thanks to all, The problem seems to be fixed by changing the NAT ip to something else and than back. It does seem much like NAT exhaustion even though the f/w claims only 13K session for two dynamic NATs and about 20 static ones. What I don't get is why there is consistency in opening sites. Why does facebook open all the time and store.apple.com barely opens all the time. I'd say if it would be NAT exhaustion, they would all behave the same way meaning open and then not open and then open again. It is solved for the time being. Again, thanks to all. ----- Andrey Gordon [andrey.gordon(a)gmail.com] On Tue, Feb 9, 2010 at 5:34 PM, Andrey Gordon <andrey.gordon(a)gmail.com>wrote: > I don't know, that's true. I don't where to find that info in this > particular firewall would be a more correct statement. and my f/w guy is not > much help either. > It definitely looks to me like a NATting issue, but what I don't understand > is why the same sites (e.g. facebook) loads fine consistently and others > don't. NAT exhaustion would not allow that, imo. > > This is the only relevant info I was able to find in the box: > > andrey.gordon@PA-2050-Bos> show session info > > > > ------------------------------------------------------------------------------- > number of sessions supported: 262143 > number of active sessions: 6799 > number of active TCP sessions: 5906 > number of active UDP sessions: 889 > number of active ICMP sessions: 4 > number of active BCAST sessions: 0 > number of active MCAST sessions: 0 > number of predict sessions: 1884 > session table utilization: 2% > number of sessions created since system bootup: 142823265 > Packet rate: 5920/s > Throughput: 45871 Kbps > > ------------------------------------------------------------------------------- > > > > > ----- > Andrey Gordon [andrey.gordon(a)gmail.com] > > > On Tue, Feb 9, 2010 at 5:31 PM, Nathan Ward <nward(a)daork.net> wrote: > >> You don't know how many NAT sessions are open though, right? >> >> This is where I'd start looking, if you do or not is up to you. >> >> On 10/02/2010, at 11:26 AM, Andrey Gordon wrote: >> >> Well, if I understand NATting right, I should be able to have at least >> 65000 sessions per NAT address to one destination. Am I wrong? the firewall >> is rated for 260K sessions. >> >> ----- >> Andrey Gordon [andrey.gordon(a)gmail.com] >> >> >> On Tue, Feb 9, 2010 at 5:22 PM, Nathan Ward <nward(a)daork.net> wrote: >> >>> 13,000 sessions could be your problem - perhaps you are running out of >>> NAT state table space. >>> >>> On 10/02/2010, at 11:18 AM, Andrey Gordon wrote: >>> >>> Not 100% sure. I have more than one NAT address on that firewall two of >>> which are dynamic: student and business. It's the student one that's broken. >>> Now, with that said, the Palo Alto firewall shows 13,000 session in >>> progress. Even the f/w guy does not know how to check out the session count >>> per NATted IP. >>> >>> ----- >>> Andrey Gordon [andrey.gordon(a)gmail.com] >>> >>> >>> On Tue, Feb 9, 2010 at 5:08 PM, Nathan Ward <nward(a)daork.net> wrote: >>> >>>> How many users do you have behind your NAT? >>>> >>>> On 10/02/2010, at 11:04 AM, Andrey Gordon wrote: >>>> >>>> > Thx to all the folks replying off the list. >>>> > >>>> > The more I trouble shoot the more I'm convinced that it's not the >>>> sites that >>>> > are doing rate-limiting. I went to a website of one of my previous >>>> employers >>>> > (a small company). Chances of them having a fancy reverse proxy with >>>> some >>>> > sort of black list filtering are slim to none, yet their site barely >>>> opens >>>> > up as well. >>>> > >>>> > Must be something that either my firewall device is doing (which is >>>> what is >>>> > doing the NATting) or I don't' know what else. I'm working with my >>>> firewall >>>> > guy since f/w is his domain and I have no clue about that vendor of >>>> the >>>> > firewalls (PaloAlto). >>>> > >>>> > Thanks all for the suggestions. I'll keep digging. >>>> > >>>> > ----- >>>> > Andrey Gordon [andrey.gordon(a)gmail.com] >>>> > >>>> > >>>> > On Tue, Feb 9, 2010 at 4:56 PM, Jay Hennigan <jay(a)west.net> wrote: >>>> > >>>> >> Andrey Gordon wrote: >>>> >> >>>> >>> Can't find my IP on any of the black lists. Don't have any proxies. >>>> Sites >>>> >>> that behave poorly are consistent. That is to say that facebook.com >>>> , >>>> >>> apple.com would always come up without an issue, but cnn.com, >>>> >>> forever21.com(i know, don't ask, students), >>>> >>> store.apple.com would consistently take forever to come up. >>>> >>> >>>> >>> Just wanted to check of rate-limiting web clients is a common >>>> practice >>>> >>> nowdays in the industry. If it's not, it's probably an unlikely >>>> cause of >>>> >>> my >>>> >>> troubles... >>>> >>> >>>> >> >>>> >> It could be that the problem sites have some form of load balancer >>>> that has >>>> >> an issue keeping state on multiple sessions from the same IP. >>>> >> >>>> >> You mentioned that changing the source IP fixed it. Is this a >>>> temporary >>>> >> fix that breaks after several users access the sites from the new IP? >>>> >> >>>> >> -- >>>> >> Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net >>>> >> Impulse Internet Service - http://www.impulse.net/ >>>> >> Your local telephone and internet company - 805 884-6323 - WB6RDV >>>> >> >>>> > >>>> > >>>> > >>>> > >>>> >>>> >>> >>> >> !DSPAM:22,4b71e13583451376319610! >> >> >> >

3 2

Re: black listing of web traffic
by Andrey Gordon 10 Feb '10

10 Feb '10

Can't find my IP on any of the black lists. Don't have any proxies. Sites that behave poorly are consistent. That is to say that facebook.com, apple.com would always come up without an issue, but cnn.com, forever21.com(i know, don't ask, students), store.apple.com would consistently take forever to come up. Just wanted to check of rate-limiting web clients is a common practice nowdays in the industry. If it's not, it's probably an unlikely cause of my troubles... Thanks, Andrey ----- Andrey Gordon [andrey.gordon(a)gmail.com] On Tue, Feb 9, 2010 at 4:40 PM, Geoffrey Keating <geoffk(a)geoffk.org> wrote: > Andrey Gordon <andrey.gordon(a)gmail.com> writes: > > > Hi list > > > > I have a problem that I can't seem to find a solution to yet. My student > > network is being NATted out and anyone who's on that network had troubles > > accessing random websites. > > For example, going to www.apple.com or www.facebook.com would work > great, > > but store.apple.com would either not load or take forever to open up. > > > > I've had that problem last week and thought I tracked it down to the NAT > ip > > being black listed with one of the span black lists. Even though that IP > is > > not used for mail out, that somehow seemed to affect it. Changing it to a > > different one seemed to solve the problem and I got that original address > of > > the list in the mean time. Changed it back and everything was well, until > > today. > > Same symptoms, but now I don't see us listed anywhere. > > The best description of the symptoms seems to be that that IP is rate > > limited or something. > > > > Anyone seen that? Are there any blacklists for web access? > > Could it be related to the Pushdo botnet SSL traffic generation, > <http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20100129>? > Perhaps you have an infected machine and so your IP is being > blacklisted and/or rate-limited. >

6 7

Data Center recommendations
by Lunch Hound 09 Feb '10

09 Feb '10

Hi, Who do you like for data centers these days? Looking for a site more than 1000 miles from Chicago. Thanks!

6 5

Re: Data Center recommendations
by Scott Weeks 09 Feb '10

09 Feb '10

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> On Tue, Feb 9, 2010 at 2:24 PM, Lunch Hound <lunchhound9999(a)gmail.com> wrote: > Who do you like for data centers these days? > Looking for a site more than 1000 miles from Chicago. DR Fortress in Honolulu. Especially in February. And wouldn't you know it, ORD has direct flights... -------------------------------------------------------- They're good and they peer with HIX. Good surf on the North Shore in Feb, too: http://www.prh.noaa.gov/hnl/pages/SRF.php ;-) scott "Surf along north facing shores will be near 5 feet this morning rising to near 8 feet by late afternoon. Early Wednesday surf will be near 25 feet to as high as 30 feet on outer reefs."

1 0

AT&T Metro E in Atlanta
by Raleigh Apple 09 Feb '10

09 Feb '10

Anybody have any idea whats going on with AT&T metro E in Atlanta? r

2 1