- Test - lists.nanog.org

easy way to scan for issues with path mtu discovery?
by Darden, Patrick S. 24 Jun '08

24 Jun '08

Hi all, Does anyone know of an easy way to scan for issues with path mtu discovery along a hop path? E.g. if you think someone is ICMP black-holing along a route, or even on the endpoint host, could you use some obscure nmap flag to find out for sure, and also to identify the offending hop/router/host? What tool would you use to test for this, and how would you do such a test? Is there any probing tool that does checks like this automatically? Seems to me this happens often enough that someone has probably already figured it out, so I am trying not to reinvent the wheel. All I can think of would be to handcraft packets of steadily increasing sizes and look for replies from each hop on the route (which would be laborious at best). Google has not been kind to my researches so far. I appreciate any help! --Patrick Darden

5 4

Re: Level3 IPv6 availability?
by Brandon Butterworth 24 Jun '08

24 Jun '08

> > Is anyone at Level3 who is familiar with IPv6, or anyone who is a Level3 > > IPv6 customer lurking here? We are a Level3 BGP customer and our > > contacts are giving us a deer-in-the-headlights stare when we want to > > bring up our /32, claiming that they don't do IPv6 at all. Not native, > > not tunneled, zip, nada. > > We've recently brought up IPv6 with Level3. It's done as an IPv6IP tunnel to > their nearest IPv6 router. I may be able to dig out the form you need... See http://www.bogons.net/dl/level3_ipv6.doc brandon

1 0

Creating demand for IPv6, and saving the planet
by Daniel Senie 24 Jun '08

24 Jun '08

A number of people have bemoaned the lack of any IPv6-only killer-content that would drive a demand for IPv6. I've thought about this, and about the government's push to make IPv6 a reality. What occurred to me is there is a satellite sitting in storage that would provide such content: http://en.wikipedia.org/wiki/Triana_(satellite) Al Gore pushed for this satellite, Triana, to provide those on earth with a view of the planet among its scientific goals. The Republicans referred to it as an "overpriced screen saver," though the effect even of just the camera component on people's lives and how they treat the planet could be considerable. By combining the launch of Triana with feeding the still images and video from servers only connected to native IPv6 bandwidth, the government would provide both a strong incentive for end users to want to move to IPv6, and a way to get the people of this planet to stop from time to time and ponder the future of the earth. Of course getting this done any time soon would require getting the present administration to reverse its bias against Triana and global warming. But it seemed to me an interesting way to advance two goals in synergy. Dan -- ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com "Our lives begin to end the day we become silent about things that matter." -- Martin Luther King, Jr.

26 54

Versaweb abuse contacts
by William Pitcock 24 Jun '08

24 Jun '08

Hi, If someone on this list works for Versaweb and can handle a botnet situation, please contact me off list. William

1 0

Comcast
by Edward A. Trdina III 24 Jun '08

24 Jun '08

Anyone from Comcast on-list? I'm getting hit with phishing emails that have a link to a Wachovia look alike page that's hosted on a comcast HSI account in South Bend Indiana.(At least thats what the SWIP says). Thanks! Ed

1 0

Re: Cloud service [was: RE: EC2 and GAE means end of ip addressreputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]
by Ken Simpson 24 Jun '08

24 Jun '08

> On Mon, Jun 23, 2008 at 6:01 PM, Frank Bulk - iNAME <frnkblk at > iname.com> wrote: > > Is there a vendor that makes a product that perform spam/malware > filtering > > literally in the network, i.e. as a service provider, can I > provide spam > > filtering for the enterprises in my customer base by adding a > piece of > > network gear? I'm not aware of one today except those who provide > > enterprise-oriented gateways like SonicWall. > > Symantec Mail Security / Turntide > Mailchannels Traffic Control > > --srs BTW, we CAN do "in the cloud" email traffic shaping - on EC2, ironically. But also on your own equipment if that's your preference. Regards, Ken -- Ken Simpson CEO MailChannels - Reliable Email Delivery http://mailchannels.com 604 685 7488 tel

3 5

APNIC dns glitch ?
by Danny Thomas 24 Jun '08

24 Jun '08

I thought I'd sent this a couple of hours ago APNIC are aware of the problem and things have partially recovered though the arin and ripe name-servers still SERVFAIL the second run of our delegation-checking script this morning started complaining about our 203.in-addr zones and it seems there is an issue with apnic.net the delegation shows 4 entries spread across 3 domains which is good, albeit all are under the same registry. Sometimes cumin.apnic.net and innie.apnic.net. are not reachable, or give a REFUSED response, or give a response with no A records nor any additional section. Unfortunately both tinnie.arin.net and ns-sec.ripe.net return SERVFAIL, as if they had not been able to perform a zone transfer for a while (assuming AXFR is the replication mechanism). I don't have ipv6 connectivity, but that's not likely to help. I don't think this will significantly impact reverse dns lookups as I think the dns is spread across other RIR's seems there was a different type of issue in May http://www.bauani.org/thinkings/2008/05/issue-with-apnic-dns-nameservers.ht… Danny Thomas # dig @I.GTLD-SERVERS.net apnic.net +norec ; <<>> DiG 9.4.2 <<>> @I.GTLD-SERVERS.net apnic.net +norec ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5460 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 5 ;; QUESTION SECTION: ;apnic.net. IN A ;; AUTHORITY SECTION: apnic.net. 172800 IN NS cumin.apnic.net. apnic.net. 172800 IN NS ns-sec.ripe.net. apnic.net. 172800 IN NS tinnie.apnic.net. apnic.net. 172800 IN NS tinnie.arin.net. ;; ADDITIONAL SECTION: cumin.apnic.net. 172800 IN A 202.12.29.59 ns-sec.ripe.net. 172800 IN A 193.0.0.196 ns-sec.ripe.net. 172800 IN AAAA 2001:610:240:0:53::4 tinnie.apnic.net. 172800 IN A 202.12.29.60 tinnie.arin.net. 172800 IN A 168.143.101.18 dig @202.12.29.59 apnic.net any +norec ; <<>> DiG 9.4.2 <<>> @202.12.29.59 apnic.net any +norec ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 33930 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 # dig @202.12.29.59 apnic.net any ; <<>> DiG 9.4.2 <<>> @202.12.29.59 apnic.net any ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40744 ;; flags: qr aa rd; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;apnic.net. IN ANY ;; ANSWER SECTION: apnic.net. 3600 IN SOA cumin.apnic.net. dns-admin.apnic.net. 2008062101 3600 1800 604800 3600 apnic.net. 3600 IN NS cumin.apnic.net. apnic.net. 3600 IN NS ns-sec.ripe.net. apnic.net. 3600 IN NS tinnie.arin.net. apnic.net. 3600 IN NS tinnie.apnic.net. apnic.net. 3600 IN MX 10 kombu.apnic.net. apnic.net. 3600 IN MX 25 karashi.apnic.net. apnic.net. 3600 IN MX 35 fennel.apnic.net. ;; Query time: 3 msec ;; SERVER: 202.12.29.59#53(202.12.29.59) ;; WHEN: Tue Jun 24 10:35:13 2008 ;; MSG SIZE rcvd: 235 dig @193.0.0.196 apnic.net any +norec ; <<>> DiG 9.4.2 <<>> @193.0.0.196 apnic.net any +norec ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 37668 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;apnic.net. IN ANY # dig @168.143.101.18 apnic.net ns ; <<>> DiG 9.4.2 <<>> @168.143.101.18 apnic.net ns ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 41014 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;apnic.net. IN NS

2 1

Australian Co-Lo
by Bernard Becker 24 Jun '08

24 Jun '08

Looking for recommendations for carrier neutral co-lo facility for Melbourne Australia. Our searches so far seem to turn up sites either on Telstra or Optus affiliated co-lo facilities. We need to be in a carrier neutral space with access to any of the major providers. Searching for co-lo space in Australia from Toronto is somewhat challenging. Websites make lots of claims that can't be validated without going and seeing the place. Bernard Becker Senior Network Architect Filogix - A Davis & Henderson Company. Tel: 416-360-1777 x3341 Fax: 416-847-5816 Toll Free: 1-866-435-6165

5 4

Re: Cloud service [was: RE: EC2 and GAE means end of ip
by Joel M Snyder 24 Jun '08

24 Jun '08

> Date: Mon, 23 Jun 2008 20:47:17 -0700 > From: Joel Jaeggli <joelja(a)bogus.com> > Subject: Re: Cloud service [was: RE: EC2 and GAE means end of ip > address reputation industry? (Re: Intrustion attempts from Amazon EC2 > IPs)] > To: frnkblk(a)iname.com > Cc: nanog(a)merit.edu > Message-ID: <48606E45.8000100(a)bogus.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > the argument in this thread however (which I more or less subcribe to) > is that in the future an ip address is insufficient granularity for mail > /badness filtering. Frankly it's not just computer clouds but also > address pressure, a million hosts behind a /24 are going to be rather > hard to pick out one at a time. ultimately the ability blackhole based > on something as gross as the source ip address is going to be > insufficiently fine grained for devices that must accept connections > from the internet at large. Ummm, probably not as big of a problem as you might think it is. From the point of view of an email administrator, those million hosts behind the /24 are all going to be on the Spamhaus PBL (policy block list) and it doesn't matter whether there are 10 or 10,000 or 10,000,000 hosts if the ISP has said "these are residential subscribers and they shouldn't be sending mail." Whether you believe in PBL or not, generally, it's going to be end users who are clustered behind those NATs more so than MTAs. Similarly, I don't see a huge incentive for someone to move their MTA to services like EC2--although anti-spam services 'in the cloud' like Postini are very popular, but that's a different issue. In our month-by-month anti-spam testing over the past 3 years, the number of unique email senders (MTAs, not individuals mind you) has actually dropped a bit; if you use the domain name as exposed in HELO/EHLO, it's dropped even more. While there will always be small MTAs out there handling small numbers of people, the trend has been to throttle that mail through larger systems. Sometimes this is done transparently/semi-transparently by the ISP ("you will send your mail through our SMTP server") using either a simple port 25 block or something like transparent destination NAT/WCCP. In other cases, this happens because small companies are discovering that their oh-so-exciting Exchange server is more of a pain in the ass than using commercial Gmail or whatever. SMTP is a special case in this discussion, I'll immediately admit. The number of hosts offering up web pages (assuming you want to filter for malware of some sort) is going nothing but up. Reputation services will be more challenged in that environment than in the SMTP environment. > >> I don't know if spammers are going to be using TLS in a big way soon, though >> I'll admit I've not measured. > > A couple years ago, when my former employer turned on tls support on the > outwardly facing mta's about 10% of our incoming smtp connections > immediately started using it after ehlo. That's not something I've kept > track of but I imagine it's an issue. Today's number for delivery using SSL by our mail cluster is 7% of just shy of 80K messages. Goes up, goes down, but definitely non-zero. > >> As long TLS usage is low, examining TCP port >> 25 traffic would likely be effective without redirecting SMTP traffic and >> making it effective for all customers downstream. That actually turns out to be a non-problem from the SMTP point of view. A "mean" ISP could simply intercept the response to EHLO and drop out the TLS capability string. A "nice" ISP could simply make up a certificate on the fly. Since SMTP senders don't have a GUI box to click during the SMTP transaction when a certificate doesn't check out, most (read as: all configured with default settings) of them simply send anyway even if the certificate smells like week-old fish. Put it another way: I ran (accidentally) for two years with an expired certificate on one of our mail servers and didn't get a single peep about misbehaving mail. But most of this discussion has been about reputation services, and of course those operate beautifully with or without TLS in the SMTP case. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

1 0

Happy 25th birthday for DNS
by Hank Nussbacher 24 Jun '08

24 Jun '08

http://www.wired.com/science/discoveries/news/2008/06/dayintech_0623 June 23, 1983: DNS Test Sets Stage for Internet Growth 1983: Paul Mockapetris and Jon Postel run the first successful test of the automated, distributed Domain Name System. DNS will lay the foundation for the massive expansion, popularization and commercialization of the internet. ... Thanks Paul & Jon! -Hank

1 0