- Test - lists.nanog.org

SORBS contact
by Mark Scholten 13 Jan '10

13 Jan '10

Hello, I did try to reach someone at SORBS using their contact forms on the website. Somehow no action was taken and I also didn't get a response. Could someone from SORBS contact me? I need an issue to be resolved. With kind regards, Mark Scholten SinnerG BV

1 0

Senderbase contact
by Drew Weaver 13 Jan '10

13 Jan '10

Any Senderbase contacts on list? I am having problems getting some questions answered through normal channels. thanks, -Drew

2 1

Baidu Contact
by Greg Schwimer 12 Jan '10

12 Jan '10

I'm looking for a technical contact at Baidu.com. Please contact me off list if you can help. Thanks! Greg Schwimer

1 0

Re: SORBS on autopilot?
by Joel M Snyder 12 Jan '10

12 Jan '10

Just a couple of corrections to two of the posts in this thread: >I simply have some problems > with /this/ current incarnation of a best practice, and I was querying whether > it had applicability outside of the SORBS/Trend Micro world. I think you are mixing/confusing SORBS and MAPS. MAPS was bought by Trend and is run as a service based on subscription fees. SORBS is whatever it is. If you don't like SORBS, that's great, but don't tar Trend with that brush. >2) Your reply to Dave's post is not useful. It's not even useful if >you consider it pure hyperbole for effect. There are many ways to >reduce spam, the "single most effective" does not stop even 50%. Actually, that's not true. I don't want to get into an argument about "single most effective," but I can guarantee that using a good reputation service will block more than 50% of the incoming spam to your network. The leading ones normally hit the 80% range. In fact, many of the popular anti-spam appliances are completely miserable at the content filter end which is applied post-reputation service; without reputation filtering, they wouldn't be worth using. (My information is based on monthly testing of anti-spam appliances we have conducted for the past 5 years. For example, this month we are looking at 43 different appliances and 25 reputation sevices) jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

2 1

Is FRR protection good enough?
by Ye Wang 12 Jan '10

12 Jan '10

Hi, I am doing some research on the backup routing issue. I know Fast ReRoute bypass routing such as MPLS FRR is used by many networks. You may have experienced with this thing pretty well, and can teach me a little bit. My question is: current FRR scheme seems only guarantee network reachability under link/node failure, but not bandwidth (say, if my primary link is carrying 1Gbps, but my bypass path has a capacity of only 100Mbps, then the bandwidth for the traffic under failure is limited). Do you think the reachability level of protection is good enough? Has anyone here encountered any issues with FRR (say, bypass routing could not save your network service during unexpected accident, e.g., concurrent failures of multiple devices)? Is there any example case (or any news and reports regarding this question) I can study? Another thing I want to understand is: if I want to protect a lot of links/nodes (in addition to a few major ones), is the configuration job easy of difficult? My knowledge so far tells me that it is not easy at all. I don't know what is going on in practice. If you can share your experience with me, it will be great. Many Thanks, sando

2 1

DNS queries for . IN A return rcode 2 SERVFAIL from windows DNS recursing resolvers
by Joe Maimon 12 Jan '10

12 Jan '10

Hey all, This must be old news for everyone else. While looking at a dns monitor on a load balancer that defaulted to . A queries to check liveliness on DNS resolvers, it became quite clear that windows 2000/2003 DNS server appears to return rcode=2 for queries looking for an A record for the root. The resolvers appear to work properly in all other regards. So the monitors were switched to localhost. A (Is this a bad idea?) A little testing later and the results for . A are: Windows NT 4, ancount=0, authority=1, rcode=0 Windows 2000, rcode=2 Windows 2003, rcode=2 bind, ancount=0, authority=1, rcode=0 To my (inexpert) eyes that doesnt seem quite right. I cant seem to find any online information regarding this difference of behavior. Enlightenment appreciated. Joe Here is the output. fpdns -c -s 64.95.32.34 && dig @64.95.32.34 . a 64.95.32.34 Microsoft Windows DNS NT4 ; <<>> DiG 9.6.1-P2 <<>> @64.95.32.34 . a ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35180 ;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;. IN A ;; AUTHORITY SECTION: . 86400 IN SOA A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. 2010010500 1800 900 604800 86400 ;; Query time: 114 msec ;; SERVER: 64.95.32.34#53(64.95.32.34) ;; WHEN: Tue Jan 5 07:40:33 2010 ;; MSG SIZE rcvd: 92 fpdns -c -s 216.222.144.16 && dig @216.222.144.16 . a 216.222.144.16 ISC BIND 9.2.3rc1 -- 9.6.1-P1 [recursion enabled] id: "9.5.1-P2" ; <<>> DiG 9.6.1-P2 <<>> @216.222.144.16 . a ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49220 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;. IN A ;; AUTHORITY SECTION: . 2314 IN SOA A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. 2010010500 1800 900 604800 86400 ;; Query time: 38 msec ;; SERVER: 216.222.144.16#53(216.222.144.16) ;; WHEN: Tue Jan 5 07:42:08 2010 ;; MSG SIZE rcvd: 92 fpdns -c -s joe.jmaimon.com && dig @joe.jmaimon.com . a 216.222.150.100 ISC BIND 9.2.3rc1 -- 9.6.1-P1 [recursion enabled] id: "9.5.0-P2-W2" ; <<>> DiG 9.6.1-P2 <<>> @joe.jmaimon.com . a ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39125 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;. IN A ;; AUTHORITY SECTION: . 10800 IN SOA A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. 2010010500 1800 900 604800 86400 ;; Query time: 40 msec ;; SERVER: 216.222.150.100#53(216.222.150.100) ;; WHEN: Tue Jan 5 07:57:52 2010 ;; MSG SIZE rcvd: 92 fpdns -c -s 64.95.32.130 && dig @64.95.32.130 . a 64.95.32.130 Microsoft Windows DNS 2000 ; <<>> DiG 9.6.1-P2 <<>> @64.95.32.130 . a ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 30535 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;. IN A ;; Query time: 35 msec ;; SERVER: 64.95.32.130#53(64.95.32.130) ;; WHEN: Tue Jan 5 07:43:51 2010 ;; MSG SIZE rcvd: 17 fpdns -c -s 72.26.241.205 && dig @72.26.241.205 . a 72.26.241.205 No match found ; <<>> DiG 9.6.1-P1 <<>> @72.26.241.205 . a ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12807 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;. IN A ;; Query time: 0 msec ;; SERVER: 72.26.241.205#53(72.26.241.205) ;; WHEN: Tue Jan 5 08:13:06 2010 ;; MSG SIZE rcvd: 17

2 1

d000::/8 from AS28716
by Chuck Anderson 12 Jan '10

12 Jan '10

Anyone know why this ISP from Italy is advertising d000::/8 to the IPv6 Internet? > show route d000::/8 inet6.0: 2446 destinations, 5143 routes (2445 active, 0 holddown, 1 hidden) Restart Complete + = Active Route, - = Last Active, * = Both d000::/8 *[BGP/170] 01:08:26, MED 760, localpref 200 AS path: 30071 6762 28716 I > to 2001:4830:e1:10::1 via ge-0/0/0.593 aut-num: AS28716 as-name: EPLANET-AS export: to AS49772 announce ANY descr: ePLANET SPA descr: Internet Service Provider descr: Via G.Vida 19 20127 Milano - ITALY - admin-c: GU29-RIPE tech-c: MF8125-RIPE mnt-by: EPLANET-MNT mnt-routes: EPLANET-MNT changed: hostmaster(a)ripe.net 20080208 source: RIPE

7 7

Question about how to define network equipments
by GIULIANO (UOL) 12 Jan '10

12 Jan '10

People, I have seen a discussion about DDoS Mitigation in this list. Someone reference Juniper SRX equipments like good equipments to prevent DDoS attacks. Like Juniper SRX, other players like fortinet has some hardware based ( FORTIGATE) Appliances to provide great throughput, ddos mitigation, UTM Features, etc. Ex. Recent Fortigate 1240B My question about this products is related to a combination of performance parameters that I really does not understand. Lets use Juniper SRX as an example: Juniper SRX has (from Juniper's web site): Firewall performance (max) 1.5 Gbps Maximum concurrent sessions 64 K (512 MB DRAM) / 128 K (1 GB DRAM) New sessions/second (sustained, TCP, 3-way) 9,000 Lets suppose that we have a client with 100 Mbps total full duplex throughput in a SRX-240 interfaces. If this client has 6000 users ... how is possible to combine: 1.5 Gbps (100 Mbps) x 128K sessions x 9000 new sessions/second Supposing 5000 users x 100 sessions per user ... the box will not support it , right ? How is the correct way to calculate with accuracy this ? Every player looks like to have a way to calculate it. Every player said something about sessions. What is the correct parameter about sessions ? How many sessions per second a normal user (FTP, E-mail, HTTP, SSL, SSH, Telnet) can generate ? Why the number 9000 new sessions/second is important ? How can I sum to all of this 3 parameters ... the DDoS mitigation ? How much performance I will consume, under a DDoS attack ? It is possible to measure it ? Thanks a lot, Giuliano

2 1

he.net down/slow?
by Brian Johnson 12 Jan '10

12 Jan '10

Has anyone noticed that accessing http://www.he.net or http://ipv6.he.net is either slow or inaccessible? Please let me know if you have a different experience currently. Thanks - Brian CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, copying, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Thank you.

22 30

D/DoS mitigation hardware/software needed.
by Rick Ernst 11 Jan '10

11 Jan '10

Looking for D/DoS mitigation solutions. I've seen Arbor Networks mentioned several times but they haven't been responsive to literature requests (hint, if anybody from Arbor is looking...). Our current upstream is 3x GigE from 3 different providers, each landing on their own BGP endpoint feeding a route-reflector core. I see two possible solutions: - Netflow/sFlow/***Flow feeding a BGP RTBH - Inline device Netflow can lag a bit in detection. I'd be concerned that inline devices add an additional point of failure. I'm worried about both failing-open (e.g. network outage) and false-positives. My current system is a home-grown NetFlow parser that spits out syslog to our NOC to investigate potential attacks and manually enter them into our RTBH. Any suggestions other than Arbor? Any other mechanisms being used? My idea is to quash the immediate problem and work additional mitigation with upstreams if needed. I could probably add some automation to my NetFlow/RTBH setup, but I still need to worry about false-positives. I'd rather somebody else do the hard work of finding the various edge-cases. Thanks, Rick

16 34