- Test - lists.nanog.org

Re: Cogent
by Eric Gauthier 08 Feb '06

08 Feb '06

Heya, I'm not sure what's going on, but we were seeing problems on outbound traces on their DC-JFK-BOS stretch (we're connected to them in Boston) but it looks like it might have cleared itself up a few mintues ago. Eric :)

1 0

RE: Cogent
by Jeff Busch 08 Feb '06

08 Feb '06

Fiber cut ... http://status.cogentco.com/ -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Joseph Nuara Sent: Wednesday, February 08, 2006 11:53 AM To: nanog(a)merit.edu Subject: Cogent Can anyone shed some light on the current Cogent latency issues? The scoreboard is lit up like a Tree ... Thanks. Joe Confidentiality Notice: The information contained in this email and any attachments may be legally privileged and confidential. If you are not an intended recipient, you are hereby notified that any dissemination, distribution or copying of this email is strictly prohibited. If you have received this email in error, please notify the sender and permanently delete the email and any attachments immediately. You should not retain, copy or use this email or attachment for any purpose, nor disclose all or any part of the contents to any person.

1 0

Cogent
by Joseph Nuara 08 Feb '06

08 Feb '06

Can anyone shed some light on the current Cogent latency issues? The scoreboard is lit up like a Tree ... Thanks. Joe

3 2

So -- what did happen to Panix?
by Steven M. Bellovin 08 Feb '06

08 Feb '06

It's now been 2.5 business days since Panix was taken out. Do we know what the root cause was? It's hard to engineer a solution until we know what the problem was. --Steven M. Bellovin, http://www.cs.columbia.edu/~smb

27 61

Denial of service Attack.
by Ejay Hire 08 Feb '06

08 Feb '06

Hello. For the last couple of days we have intermittently been experiencing a (>1gbps) denial of service attack. I want to apologize to anyone whose DNS servers have been (ab)used in the attack, and let you know what is occurring. The attacker is forging our source address on dns requests, and the DNS reply is routing to us. I promise, we're not attacking your dns servers. Please take a moment to consider implementing RPF checks to prevent these type of forged packet attacks. Advice is welcomed both on-list and off. Thanks, Ejay Hire ISDN-Net Network Engineer

1 0

ml hacks for goodmail
by Randy Bush 08 Feb '06

08 Feb '06

so, anyone working on the majordomo and mailman hacks for goodmail? "i am sorry, but you can not subscribe to this list from an aol.com address. don't ask us to explain, ask support(a)aol.com." or am i missing something here? clue-bat if so, please. randy

4 5

CAUTION: Potentially Dumb Question...
by Rich Sena 08 Feb '06

08 Feb '06

Not sure how dumb this question is so I'll float it here and beat any flames back with a little Godwin's Law or other Bourseyesque implements of power... I'm trying to cut a few financial corners in our remote site budgets. I have sites that are homed back to the main campus offices via ATM and other leased lines. These sites also currently have dedicated Internet access. I was doing some brain cramming re: MPLS and possibly killing our dependence on ATM by going the MPLS route over a common provider. It struck me to venture a guess as to why I couldn't utilize the same connection for both - Internet transit via the common provider as well as an MPLS mesh between all my sites and my main campuses also via that same connection with the common provider... Can someone swing the clue-by-four for me aiming for what's left of my mullet and learn me - thanks... If you feel this is OT then reply to me direct if there is other interest I will summarize... -- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

4 4

FYI - RFC 4367 on What\'s in a Name: False Assumptions about DNS Names
by william(at)elan.net 08 Feb '06

08 Feb '06

I think some of the people here may want to read this new RFC: http://www.rfc-editor.org/rfc/rfc4367.txt RFC 4367 Title: What\'s in a Name: False Assumptions about DNS Names Author: J. Rosenberg, Ed., IAB Status: Informational Date: February 2006 Mailbox: jdrosen(a)cisco.com Pages: 17 Characters: 41724 -- William Leibzon Elan Networks william(a)elan.net

1 1

Interesting netflow entry
by Wil Schultz 08 Feb '06

08 Feb '06

After setting up netflow this morning I have a of recurring flow that seems bothersome to me. I have an internal host (10.X.X.99) that continually attempts to hit various external hosts (AA, BB, CC, etc...) on seemingly random ports but always sources port udp.1204. In about 2 hours this host has hit 155 different external hosts, some of them once or twice and some of them more than 10 times. Below is a sanitised 10 minute output. 11:41:37.031 0.000 UDP 10.XX.XX.99:1204 -> AA.AA.AA.AA:46299 (RoadRunner, VA US) 11:42:07.032 0.000 UDP 10.XX.XX.99:1204 -> BB.BB.BB.BB:15989 (Comcast, MI US) 11:42:37.096 0.000 UDP 10.XX.XX.99:1204 -> CC.CC.CC.CC:52566 (Comcast, IL US) 11:43:17.204 0.000 UDP 10.XX.XX.99:1204 -> DD.DD.DD.DD:47756 (Adelphia, CA US) 11:45:27.521 0.000 UDP 10.XX.XX.99:1204 -> EE.EE.EE.EE:20797 (Tokyo) 11:46:07.685 0.000 UDP 10.XX.XX.99:1204 -> FF.FF.FF.FF:21363 (Surrey UK) 11:48:47.991 0.000 UDP 10.XX.XX.99:1204 -> GG.GG.GG.GG:48324 (Israel) Interestingly enough, I've checked to see if this seemingly random port was actually listening and each of the 15-20 hosts I've checked are all listening on their port, i.e. AA.AA.AA.AA has udp.46299 open while BB.BB.BB.BB has udp.15989 open. When a host was contacted multiple times the "random" dstport is always the same. Anyone have any clue on to what could be going on here? -Wil

3 8

NANOG36 PGP Key Signing
by Majdi S. Abbas 07 Feb '06

07 Feb '06

The key signing will be on Monday at 3pm in the State room. If you can't make it, feel free to submit keys as there will be a follow-up session during the Wednesday morning break. So get those keys in and I'll see you in Dallas! --msa -snip- Stickers for Your Name Badge When you stop by the registration desk at NANOG36, there will be colored stickers available for your name tag that indicate if you have an interest in signing PGP keys. If people keep trying to peer with you, you've picked up the wrong color sticker and should go back. How the Key Signing Works Those of you who plan to participate should email an ASCII extract of your public key to msa(a)latt.net by 10:00 p.m. CST on Sunday, February 12. Please include 'NANOG PGP KEY' in the subject, and if possible, don't send your key as a MIME attachment. I realize that some MUAs make this difficult, and I will attempt to fix any MIME-attached keys. Instructions for extracting your key to an ASCII file are below. After noon on the 13th, a complete key ring with all of the submitted keys will be available at puck.nether.net/~majdi/nanog36.pgp in binary form, and as an ASCII file at puck.nether.net/~majdi/nanog36.txt. Handouts with the details of each key submitted will be provided. All you should need to bring with you is: * Photo ID (driver's license, passport, etc.) * Your key ID, and its fingerprint * A pen Thank you, and I'm looking forward to seeing you all in Dallas! How to Extract Your Public Key to an ASCII File PGP 2.x: pgp -kxa your_email_address mykey.asc PGP 5.x: pgpk -xa your_email_address > mykey.asc GnuPG: gpg --export --armor your_email_address > mykey.asc PGP on Windows: Start the PGPkeys application, select your key in the list, click on the Keys menu, select Export, name the resulting file, and make sure that Include Private Keys is NOT checked. PGP on a Mac: I assume the procedure is similar to the one for Windows, but cannot confirm this. Hopefully it's easy enough to figure out.

2 1