- Test - lists.nanog.org

NATting a whole country?
by Steven M. Bellovin 04 Jan '07

04 Jan '07

According to http://www.nytimes.com/aponline/technology/AP-TechBit-Wikipedia-Block.html all of Qatar appears on the net as a single IP address. I don't know if it's NAT or a proxy that you need to use to get out to the world, but whatever the exact cause, it had a predictable consequence -- the entire country was barred from editing Wikipedia, due to abuse by (presumably) a few people. --Steve Bellovin, http://www.cs.columbia.edu/~smb

7 8

Re: NATting a whole country?
by Scott Weeks 04 Jan '07

04 Jan '07

> I wonder what they use the other 241663 addresses for. > > +---------+---------+------+--------------+--------+ > | rir | country | type | descr | num | > +---------+---------+------+--------------+--------+ > | ripencc | QA | ipv4 | 81.29.160.0 | 4096 | > | ripencc | QA | ipv4 | 82.148.96.0 | 8192 | > | ripencc | QA | ipv4 | 86.36.0.0 | 131072 | > | ripencc | QA | ipv4 | 86.62.192.0 | 16384 | > | ripencc | QA | ipv4 | 89.211.0.0 | 65536 | > | ripencc | QA | ipv4 | 212.77.192.0 | 8192 | > | ripencc | QA | ipv4 | 213.130.96.0 | 8192 | > | ripencc | QA | ipv6 | 2001:1a10:: | 32 | > +---------+---------+------+--------------+--------+ Just taking the first two ranges... route-server>sho ip bgp 81.29.160.0 % Network not in table > nmap -sP 82.148.96.0/24 Nmap finished: 256 IP addresses (71 hosts up) For example: Host dialpop01-7300-itn.ispnoc.qa (82.148.96.12) appears to be up. > tcptraceroute 82.148.96.12 ... 5 sl-gw1-prl-8-0-1.sprintlink.net (144.223.63.169) ... 11 sl-bb20-nyc-8-0.sprintlink.net (144.232.7.13) ... 14 sl-gw23-lon-15-0.sprintlink.net (213.206.128.63) 212.552 ms 15 82.195.188.22 (82.195.188.22) 212.058 ms 16 so-0-0-0.0.cjr03.alx001.flagtel.com (62.216.129.206) 282.853 ms 17 ge-3-2-0.0.cjr01.alx001.flagtel.com (62.216.134.30) 283.292 ms 18 80.77.1.182 (80.77.1.182) 359.834 ms ... 20 89.211.0.74 (89.211.0.74) 359.881 ms 21 dialpop01-7300-itn.ispnoc.qa (82.148.96.12) [closed] 325.716 ms Deep inspection ;-) would probably show this to not be completely true... scott

1 0

Re: NATting a whole country?
by Fergie 04 Jan '07

04 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Steven M. Bellovin" <smb(a)cs.columbia.edu> wrote: >According to >http://www.nytimes.com/aponline/technology/AP-TechBit-Wikipedia-Block.html >all of Qatar appears on the net as a single IP address. I don't know >if it's NAT or a proxy that you need to use to get out to the world, >but whatever the exact cause, it had a predictable consequence -- the >entire country was barred from editing Wikipedia, due to abuse by >(presumably) a few people. > Sweet. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFnD+tq1pz9mNUZTMRAo6kAJ9bk/vMGK/uUAZp8mMjbYYCBh0ZTACePN0s ybCrkk82NcUJalY6qrwpY8I= =vAih -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Comcast Routing Issues: Northern NJ: Random Failures
by Matthew 04 Jan '07

04 Jan '07

Experiencing some random connectivity issues since 5 AM this morning. Some sites work, but other sites fail. For example, the following sites fail: www.xs4all.nl has address 194.109.6.92 www.hyperspin.com has address 70.86.191.106 bgplay.routeviews.org has address 128.223.51.92 www.servermatrix.com has address 70.87.6.12 us.f308.mail.yahoo.com is an alias for f308.mail.mud.yahoo.com. f308.mail.mud.yahoo.com has address 68.142.200.218 www.msn.com is an alias for www.msn.com.nsatc.net. www.msn.com.nsatc.net has address 207.68.173.76 Some of the sites that work: www.yahoo.com is an alias for www.yahoo-ht2.akadns.net. www.yahoo-ht2.akadns.net has address 209.73.186.238 www.theplanet.com has address 70.87.6.11 Tracing the path to www.xs4all.nl (194.109.6.92) on TCP port 80 (www), 30 hops max 3 po-70-ar01.verona.nj.panjde.comcast.net (68.86.209.254) 8.012 ms 8.501 ms 7.217 ms 4 po-10-ar01.plainfield.nj.panjde.comcast.net (68.86.208.5) 16.606 ms 7.172 ms 9.656 ms 5 * * * 6 * * * 7 XS4ALL.so-7-0-0.nar1.AMS1.gblx.net (146.82.33.178) 88.271 ms 88.498 ms 88.779 ms 8 * * * 9 * * * 10 * * www.xs4all.nl (194.109.6.92) [open] 100.272 ms Tracing the path to www.hyperspin.com (70.86.191.106) on TCP port 80 (www), 30 hops max 3 po-70-ar01.verona.nj.panjde.comcast.net (68.86.209.254) 7.877 ms 8.519 ms 11.860 ms 4 po-10-ar01.plainfield.nj.panjde.comcast.net (68.86.208.5) 20.075 ms 8.791 ms 9.354 ms 5 * * * 6 te-3-1.car1.NewYork1.Level3.net (4.71.172.109) 104.601 ms 11.531 ms 76.191 ms 7 * * * 8 ae-3.ebr2.Washington1.Level3.net (4.69.132.93) 27.147 ms * * 9 * * * 10 * * * 11 * * * 12 ae-14-53.car4.Dallas1.Level3.net (4.68.122.80) 50.182 ms 49.508 ms 50.082 ms 13 THE-PLANET.car4.Dallas1.Level3.net (4.71.122.2) 48.236 ms 50.046 ms 50.268 ms 14 te9-2.dsr01.dllstx3.theplanet.com (70.87.253.14) 50.146 ms 49.863 ms 50.350 ms 15 * * * 16 po2.car02.dllstx5.theplanet.com (70.84.160.164) 48.519 ms 54.368 ms 50.494 ms 17 * * w0.monitoringservice.net (70.86.191.106) [open] 51.043 ms Tracing the path to bgplay.routeviews.org (128.223.51.92) on TCP port 80 (www), 30 hops max 3 po-70-ar01.verona.nj.panjde.comcast.net (68.86.209.254) 7.600 ms 7.128 ms 10.339 ms 4 po-10-ar01.plainfield.nj.panjde.comcast.net (68.86.208.5) 11.138 ms 8.922 ms 9.545 ms 5 * * * 6 te-3-1.car1.NewYork1.Level3.net (4.71.172.109) 87.462 ms 209.727 ms 11.884 ms 7 ae-2-54.bbr2.NewYork1.Level3.net (4.68.97.97) 9.474 ms 9.653 ms 12.210 ms 8 * * * 9 ge-11-2.hsa2.Seattle1.Level3.net (4.68.105.167) 78.626 ms 80.986 ms 80.362 ms 10 nero-gw.Level3.net (63.211.200.246) 81.885 ms 82.461 ms 81.300 ms 11 ptck-core2-gw.nero.net (207.98.64.138) 84.448 ms 81.504 ms 83.086 ms 12 eugn-core2-gw.nero.net (207.98.64.1) 94.238 ms 86.005 ms 88.229 ms 13 eugn-car1-gw.nero.net (207.98.64.165) 84.733 ms 84.361 ms 83.977 ms 14 uonet8-gw.nero.net (207.98.64.66) 83.928 ms 85.713 ms 83.830 ms 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * Tracing the path to www.msn.com (207.68.173.76) on TCP port 80 (www), 30 hops max 3 po-70-ar01.verona.nj.panjde.comcast.net (68.86.209.254) 7.646 ms 8.756 ms 7.115 ms 4 po-10-ar01.plainfield.nj.panjde.comcast.net (68.86.208.5) 8.009 ms 9.532 ms 8.718 ms 5 * * * 6 te-9-4.car1.NewYork1.Level3.net (4.71.172.121) 9.849 ms 8.846 ms 9.479 ms 7 * * * 8 * * * 9 ae-3.ebr2.Denver1.Level3.net (4.69.132.61) 56.636 ms * * 10 ae-2.ebr2.Seattle1.Level3.net (4.69.132.53) 86.490 ms 92.519 ms 90.390 ms 11 * * * 12 65.59.235.6 80.052 ms * * 13 ten7-1.tuk-76cb-1a.ntwk.msn.net (207.46.35.17) 82.178 ms 85.146 ms 82.803 ms 14 * * * 15 * * * 16 * * * Tracing the path to www.yahoo-ht2.akadns.net (209.73.186.238) on TCP port 80 (www), 30 hops max 3 po-70-ar01.verona.nj.panjde.comcast.net (68.86.209.254) 8.611 ms 8.480 ms 16.737 ms 4 po-10-ar01.plainfield.nj.panjde.comcast.net (68.86.208.5) 8.106 ms 8.679 ms 9.498 ms 5 * * * 6 * * * 7 64.208.110.122 15.380 ms 16.130 ms 14.143 ms 8 ge-2-1-0-p150.msr2.re1.yahoo.com (216.115.108.21) 17.763 ms 17.784 ms 17.642 ms 9 ge-1-31.bas-a2.re3.yahoo.com (66.196.112.45) 16.932 ms 15.591 ms 16.532 ms 10 f1.www.vip.re3.yahoo.com (209.73.186.238) [open] 14.648 ms 15.150 ms 21.820 ms Tracing the path to us.f308.mail.yahoo.com (68.142.200.218) on TCP port 80 (www), 30 hops max 1 * * * 2 ge-2-1-ur01.narlington.nj.panjde.comcast.net (68.86.220.197) 7.335 ms 6.305 ms 7.131 ms 3 po-70-ar01.verona.nj.panjde.comcast.net (68.86.209.254) 7.631 ms 6.813 ms 8.646 ms 4 po-10-ar01.plainfield.nj.panjde.comcast.net (68.86.208.5) 10.752 ms 11.331 ms 9.550 ms 5 * * * 6 * * * 7 yahoo-2.ar1.DCA3.gblx.net (208.51.74.182) 50.022 ms 16.912 ms 16.820 ms 8 so-0-0-0.pat2.dax.yahoo.com (216.115.101.147) 46.620 ms 46.712 ms 45.851 ms 9 * * * 10 ten-8-1.bas2.mud.yahoo.com (68.142.193.27) 46.818 ms 45.618 ms 53.769 ms 11 * * * 12 * * *

6 6

http://cisco.com 403 Forbidden
by James Baldwin 03 Jan '07

03 Jan '07

Anyone else getting a 403 Forbidden when trying to access http:// cisco.com? James Baldwin

10 12

Quick BGP peering question
by James Blessing 03 Jan '07

03 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Very simply : Would you accept traffic from a customer who insists on sending 0 prefixes across a BGP session? J - -- COO Entanet International T: 0870 770 9580 http://www.enta.net/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFm6S6R+KszLBLUT8RAm1zAJ0Tvm7yaw/3tMrYWbsbEVZTxgSYpACfWuZ8 bdI+Wum4MI+2MkwA6R0clxQ= =I/xW -----END PGP SIGNATURE-----

5 7

Re: on a different "manners" topic, was Re: Phishing...
by Brandon Butterworth 03 Jan '07

03 Jan '07

> Some say that top-posting reverses the conversation, but if you > are thumbing through the archives of top-posted threads, each > contribution is on the first screen and you can navigate message > to message in time-order Don't include the email you're responding to then it's no longer top posting, plus you can still read the archive easily. Bottom posting is just as bad as top posting when you include the entire message Usually there is no need to include previous emails, it's a waste of space. The only time including the previous emails automatically is good is when you want to see a previous conversation thread before they included you. I see lots of information leakage from Outlook users this way. Is this done now? > As far as the HTML, I don't think I use it, but I fail to see why it's rude. Next thread, red or blue text? brandon

4 3

Re: Phishing and BGP Blackholing
by Scott Weeks 03 Jan '07

03 Jan '07

: It also says 'If you are not the intended recipient...' : Since the post is being made to NANOG, : ... so I fail to see why a big deal should be made out of it Because it's bad manners in a public forum. It's impolite in the same way SHOUTING! is. scott --- blakjak(a)blakjak.net wrote: From: Mark Foster <blakjak(a)blakjak.net> To: Randy Bush <randy(a)psg.com> Cc: "Joy, Dylan" <DJoy(a)becu.org>, nanog(a)nanog.org Subject: Re: Phishing and BGP Blackholing Date: Wed, 3 Jan 2007 17:44:28 +1300 (NZDT) I have to ask. The 'stock' disclaimer message says 'may'. It also says 'If you are not the intended recipient...' Key words - 'if' and 'may'. Since the post is being made to NANOG, we can assume the NANOG Audience (defined as anyone whos on the list _or_ who can read the web archive; ala; everyone) is infact the intended recipient, and we can ignore the rest of it. ... so I fail to see why a big deal should be made out of it. Especially when they're generally enforced on large companies by their lawyers, and the Network Operators likely have very little to do with it. So why the big deal? (Personally I still vote for the use of non-corporate mail addresses on mailing lists. Tends to filter out the roge out-of-office notices too...) Mark. On Tue, 2 Jan 2007, Randy Bush wrote: > > you have sent a message to me which seems to contain a legal > warning on who can read it, or how it may be distributed, or > whether it may be archived, etc. > > i do not accept such email. my mail user agent detected a legal > notice when i was opening your mail, and automatically deleted it. > so do not expect further response. > > yes, i know your mail environment automatically added the legal > notice. well, my mail environment automatically detected it, > deleted it, and sent this message to you. so don't expect a lot > of sympathy. > > and if you choose to work for some enterprise clueless enough to > think that they can force this silliness on the world, use gmail, > hotmail, ... > > randy > >

1 0

Re: Phishing and BGP Blackholing
by Fergie 03 Jan '07

03 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 One more thing: If anyone thinks that fast-flux hosting isn't a problem, then you haven't dealt with it. I cannot imagine inject a /32 continuously into a BGP community-set. That just sounds... insane. More: http://www.spamhaus.org/faq/answers.lasso?section=ISP%20Spam%20Issues#164 Cheers! - - ferg - -- "Fergie" <fergdawg(a)netzero.net> wrote: Instead of quoting earlier submissions, let me just add two thoughts to this Bad Idea (tm): (1) Proxy bypasses; and (2) Fast-Flux place-shifters... These are two hard problems, by themselves, although not impossible. Having said that, injecting candidate host-routes into BGP (given the already intolerable churn) is a horribly worse idea. Good luck with all that... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFm1dTq1pz9mNUZTMRAgN2AJ0ZvWf0ikxt8dpmzdVjuRX5MmcEagCg668t NNFPoVJlAH1cNvSaiY+DmT4= =3zHg -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Phishing and BGP Blackholing
by Fergie 03 Jan '07

03 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Instead of quoting earlier submissions, let me just add two thoughts to this Bad Idea (tm): (1) Proxy bypasses; and (2) Fast-Flux place-shifters... These are two hard problems, by themselves, although not impossible. Having said that, injecting candidate host-routes into BGP (given the already intolerable churn) is a horribly worse idea. Good luck with all that... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFm1DNq1pz9mNUZTMRAqyxAJwOrUTIs1Olrj8Gt2jB+Uc9557WqgCfQO+R LSsa8HsYTOkZPi4sjtQFUyY= =HvaD -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0