- Test - lists.nanog.org

vote now, please
by Todd Underwood 14 Oct '08

14 Oct '08

apologies if this is off-topic, but the elections are really important and many people on the list are not at the conference so i thought a short reminder might be useful: nanog is holding elections for steering committee members right now and charter ammendments right now. more information: http://nanog.org/governance/elections/2008elections/ go vote: https://nanog.merit.edu/election/ if you can't remember your password: https://nanog.merit.edu/registration/password.epl this election matters. the steering committee selects the program committe and the mailing list committee. they guide the selection of conference locations. they should be people with good judgement who you respect. elections close at 1300PDT/1600EDT/2000UTC which is in approximately two hours. so vote right now! canada is voting today too, so if you're canadian, vote here and then vote there. thanks :-) t. -- _____________________________________________________________________ todd underwood +1 603 643 9300 x101 renesys corporation todd(a)renesys.com http://www.renesys.com/blog

1 0

Eircom connectivity issue
by Philip L. 14 Oct '08

14 Oct '08

Hello. I've ran into a puzzling scenario and I thought I'd ask around to see if anyone else has an idea. I have a customer who operates a server on our network who informed me that a customer of his out of Ireland is having connectivity issues to it. The ISP in question is Eircom, and the block that seems unreachable is 86.40.0.0/13. Any trace to an IP in that block drops off the Earth at the edge of the Tier 1 provider that we connect with, such as AT&T and Sprint. I've also tried Level3, but the traffic goes over to AT&T in the end anyhow. I've checked Level3 and Sprint's looking glass and performs a traceroute from there, and I get the same result, so it doesn't appear to be an issue with our network. I'm at a loss and my customer told me that his customer has already contacted Eircom and they are at a loss to explain the disconnect as well. Does anyone have some insight into this? -- Philip L.

1 0

[NANOG-announce] NANOG 2008 Voting
by Betty Burke 14 Oct '08

14 Oct '08

Current status........... 102 votes cast as of Merit Network Inc. Merit/NANOG Project Manager _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

peeringdb admin contact?
by matthew zeier 13 Oct '08

13 Oct '08

Been trying to get someone from admin@peeringdb to get back to me but haven't had any luck. Anyone?

4 3

Study on Minium Route Advertisement Interval ..
by Abhishek Verma 13 Oct '08

13 Oct '08

Hi, I am studying the MRAI timer and its effects on BGP - how it affects the overall BGP convergence, route flap damping, persistent oscillations, etc. It is wrt this that i would like to know the default setting that most service providers use? Do they use the default value as provider by their vendor, or do they disable it, or do they explictly set it to a value lower than the default? Please feel free to unicast me your responses. I would summarize the results and send it out on the list, without the specifics of who uses what kind of timer values. Thanks in advance, Abhishek

1 0

Hostexploit report/Intercage/Esthost
by Konstantin Poltev 13 Oct '08

13 Oct '08

Hello, My name is Konstantin Poltev and I'm with Esthost. I'd like to ask you to read through this email before hastily replying. As you are probably aware, Esthost has been accused of pretty much every mortal sin - from cybercrime to being KGB-sponsored part of Russian Business Network involved in information warfare against Georgia [R1]. However, that's just one side of the story. I'd like to present our side, in this email, and in person - I am right here at NANOG, ready to answer your questions. I've initially planned to make a short presentation during security BOF, but decided against it - I believe tempers are still too hot to hear our side of the story, also, my English is not quite as good to be able to stand up before 1000 people. However, I'll be around, in the hotel bar, should anyone want to ask me any questions in person - or should any law enforcement officer wish to arrest me :) Now, on to the story: First, few words on the "community police" that is accusing us of all the misdeeds. The accusations initially were made by (anonymous) John Reid from Spamhaus, then continued with anonymous rbnexploit blog, then by Jart Armin from the "hostexploit". All of those are (to my knowledge) are very much anonymous. I'd love to debate the report and their accusations, in public, but, regretfully, I don't see this happening anytime soon - while I'm very much willing to travel to US and subject myself to US jurisdiction, my accuser John Reid in Spamhaus is anonymous, and Spamhaus itself claims not to be subject to any US laws, where it clearly does business. It begs the question - how come the alleged "criminals" are so brazen, and alleged "community police" so anonymous? One possible conclusion is that there's no evidence of a crime, and "community police" is nothing short of a lynch mob, that needs no evidence, heeds no laws, and acts as a judge, jury and executioner. However, more on spamhaus later. Finally, the last point was the publication of an article in Washington Post by Brian Krebs. Brian, as it appears, has commissioned the hostexploit report, and it makes a wonderful media story - you have full-on thriller, with cybercriminals out of Estonia being aided by corporations small and large in US - it doesn't get any better than that. Unfortunately, said report is full of unsubstantiated allegations - in fact, not just unsubstantiated, but clearly known to be false to anyone who is actually in the industry (more on this later). Brian has attempted to ask us for our side of the story. However, the questions asked were "How many EstHost employees have graduated the KGB military public information school?", "How often does KGB/GRU/FSB ask Esthost to implement special measures against Western visitors", "Does Esthost provide GRU/SVR with information about Western visitors", "What percentage of Est's revenue is reinvested by FSB into Est's infrastructure". I'm dead serious - those were the questions - I can't make this up. You can draw your own conclusions on Brian's bias and the desire of a sensational story. I'd like to point out that Esthost doesn't hide behind anonymity - names of the owners of Esthost are well known, and we live in Estonia, which, despite what you think, is as much of a Western-world country with rule of law as, say, France or Germany - with criminal police, extradition treaties, Interpol membership, etc. What is the truth? We have no affiliation with "Russian Business Network" (if there ever was such a thing). We have no affiliation with Emil or Atrivo (other than being an ex-customer). We have no affiliation with HostFresh. We don't know what *they* do with their network, or their abuse complaints - we can only speak for ourselves. Onto the discussion of the "hostexploit report" itself: I am surprised that it appears that nobody actually have taken time to read the report - as inaccuracies are glaring enough to be immediately noticable. Report is hardly "unbiased" - it is a very beautifully typeset piece whose purpose is to smear our company (and our vendors' vendors' vendors, and our customers, and just about anyone else, maybe short of the guys who deliver pizza to our office). As I point out flaws in the report, I'd like to again emphasize, we are not atrivo. I believe Emil and Atrivo were unfairly smeared, and as much as Esthost, they deserve fairness, although I can't speak for the rest of Atrivo's customers, not affiliated with Esthost. Report itself is located at: http://hostexploit.com/downloads/Atrivo%20white%20paper%20082808ac.pdf First part of report is fluff - using spamhaus pages as evidence of wrongdoing. Let's start with obvious: ****** Page 16 - the page with the actual data: Google has 4 times more infections than Atrivo, and approximately same infection rate. Are they also cyber-criminals? Chinanet-backbone - has 48 times number of Atrivo's infections - they are here at NANOG, are they being asked what are *they* doing about the abuse? INETWORK-AS, twice the infections in quarter of Atrivo's space, 65% infection rate - what about them? Theplanet and Softlayer, *three* times the number of infections? EV1, twice the number of infections, and similar infection rate as Atrivo? The only pattern that I can draw is all the other companies are large businesses - who wouldn't take kindly to being smeared. It is far easier to scapegoat a small Estonian company and blame it on them. ****** Page 17: Claims that Broadwing is AS3356 (...!), and is "Atrivo - directly controlled /managed". Claims that Nlayer has control of 5,916,928 IP addresses. While I'm sure this is unintentional copy-paste thing, it shows lack of technical review of this report. ****** Page 13: Claims that "Atrivo requires internet connectivity from ThePlanet". Again, I'm not Emil, but I'd find it unlikely that he'd buy from his direct competitor. Claims that 1546 of privacyprotect sites are "ThePlanet sponsored" - I assume they meant hosted at ThePlanet. How does it demonstrate Planet's complicity, I don't know. ****** Page 6: Claims that "AS 4657 Singapore based providing collocation for Atrivo". That's a naked assertion, and fails the "oh really" test. (Again, not speaking for Emil, he *might* have colocation in China, but that's pretty damn unlikely!) ****** Page 7: "AS 36445 a newer Autonomous Server apparently used by Cernal". I assume the author meant "Autonomous System", just another questionable "technical" moment. Claims that "Estdomains is an anonymous registrar and "Esthost" is anonymous hosting" - I don't really know where to start. We don't provide anonymous hosting, any more than Yahoo! does. ****** Page 26: "It should be further noted some of the adult sites hosted are either border line or are within known blacklists of pedo-pornographic web sites (Note: this topic is outside the remit of this study, however details have been passed to appropriate third parties)". This is a very serious accusation - and it seems to be thrown very lightly with disregard for possible consequences. If it is actual child pornography, knowingly hosted by Atrivo, it has very direct consequences for Emil. Across the entire report, Hostexploit has made allegations of Esthost being affiliated with DirectI, and of DirectI being a willing participant in our "crimes". Within a week, Hostexploit had to withdraw those claims - I can only presume due to pressure from DirectI and its lawyers. Regarding "cybercriminals" and calls for community to "take action" against those who allegedly "provide transit" to cybercriminals - I'd like to point note that neither we, nor any of our customers, have been convicted (or even accused) in any court of law of any misdeeds. Spamhaus made claims [1] that: "We assume that every law enforcement agency with a cyber-crimes division has a dossier bursting at the seams on Atrivo/Intercage and its tentacles such as Esthost, Estdomains, Cernel, Hostfresh". Well, I'm right here in LA - if there's actual evidence, I have no doubt that law enforcement will act. However, I think this is highly unlikely. I won't deny that we *did* have abuse issues - that is the problem when your customers are mostly located in Eastern Europe - there are quite a few bad apples. Payment systems used in Eastern Europe tend to favor anonymity - which, obviously is also favored by criminals. However, it's the exception and not a rule. We've stopped accepting all anonymous payment systems quite awhile ago, and have new arrangement with one of Russia's largest payment systems where, if we report abuse, they will lock the criminal's account and accounts linked to it. We've always reacted expediously against abuse - every email that we received we've reacted to. We've implemented a anti-fraud system that links billing accounts to hosting accounts to domains, and if one domain is involved in abuse, everything "linked" to it is investigated and suspended/terminated. This is hard for a small company to do - due to intense competition in the registrar arena, profit margins are very slim. I'd like to finish with this - cybercrime is our common enemy. We'd like to be a part of a solution - and we are playing our part, as much as a small organization can do. If anyone wishes to discuss any of the above, or give us suggestions on what more could we do to fight spam/etc, I'll be around later on in the hotel bar area, just look for my nametag. However, I won't be there at all the time, in case you want to talk, kindly drop me an email and we'll figure out a time to meet. Thanks for reading so far, I know it's a long email. I hope to see you later at the conference. Kind regards, Konstantin [R1] http://rbnexploit.blogspot.com/2008/08/rbn-georgia-cyberwarfare-continuation .html [1] http://www.spamhaus.org/news.lasso?article=636

2 1

RE: Help needed - Cisco Netflow
by Lee, Steven (NSG Malaysia) 13 Oct '08

13 Oct '08

Hi all, the LC on 12000 series is 12000-SIP-601 (engine 5) with multiple STM-1 SPA card. As far as I know the engine 5 card cannot do 450Kpps on netflow. Since the STM-1 is mainly for NB-AMR traffic (95%), do you recommend the sampled netflow instead? Does anyone aware of the sampled netflow accuracy? -----Original Message----- From: Julio Arruda [mailto:jarruda-cnsp@jarruda.com] Sent: Saturday, October 11, 2008 12:43 AM To: Lee, Steven (NSG Malaysia) Subject: Re: Help needed - Cisco Netflow Lee, Steven (NSG Malaysia) wrote: > Hi all, I have a customer who has a MPLS network for E/// Media Gateway (MGW) NB-AMR VoIP traffic. The packet size for the NB-AMR traffic is fixed size 110 bytes. During the high load period, it can reaches 450Kpps on a STM-1 link. The router platform is Cisco 12000 series, can the router generate 100% netflow data with such traffic load? Also can someone suggest a carrier class netflow collector for mobile service provider environment. Just a quick note.. You may want to post the Line Cards they have...Distinct LC have distinct Netflow capabilities (and impact).

3 2

BGP (hijack) prefix monitoring
by Andree Toonk 13 Oct '08

13 Oct '08

Hi All, Given the recent interest in prefix monitoring (hijack) systems I decided to make my monitoring system publicly accessible for those who would like to use it. The original software was written over the course of 1.5 years, mainly for private use to monitor the stability of our prefixes. After some requests of others I've extended it to make it usable for different users and added some extra features. It has most of the functionality that other alternatives offer, these include: * Prefix hijack detection * support for aspath regex checks (including auto generate regex) * 4byte ASN support * support for auo discovery of prefixes for a specific Origin AS (useful for bulk entries) * Flexible email alerting system * Historical overview of "Interesting" updates * Support for multiple AS's per user * BGP updates (ipv4&ipv6) from over 120 peers, (several RIPE-RIS data sources) * Alert on "mass" withdraw of your prefix I documented most of the features as well as some background info in a FAQ at http://bgpmon.net/faq.php Anyway, for those of you who want to use it, please go ahead and try it. You can create a personal account and add your own prefixes, or browse around using the demo account. The url is: http://bgpmon.net Other things you will find there are the 'BGP weathermap' and some basic bogon detection. Hope you'll find it useful. Cheers, Andree

1 0

[NANOG-announce] NANOG Voting now open!
by Philip Smith 12 Oct '08

12 Oct '08

Hi everyone, Voting for the 2008 NANOG SC and Charter amendments is now open. Please refer to http://www.nanog.org/governance/elections/2008elections/ for full details. The actual voting URL is https://nanog.merit.edu/election/. You will need to use your NANOG id and password to cast your vote. Eligible voters are listed at http://www.nanog.org/governance/elections/2008elections/2008_voters.php. The ballot will close on Tuesday at 1pm PDT and the results will be announced by the end of the day. philip (for the SC) -- _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Help needed - Cisco Netflow
by Lee, Steven (NSG Malaysia) 12 Oct '08

12 Oct '08

Hi all, I have a customer who has a MPLS network for E/// Media Gateway (MGW) NB-AMR VoIP traffic. The packet size for the NB-AMR traffic is fixed size 110 bytes. During the high load period, it can reaches 450Kpps on a STM-1 link. The router platform is Cisco 12000 series, can the router generate 100% netflow data with such traffic load? Also can someone suggest a carrier class netflow collector for mobile service provider environment. Thanks in advance. Regards, Steven Lee

4 3