- Test - lists.nanog.org

RE: 72/8 friendly reminder
by Hannigan, Martin 23 Mar '05

23 Mar '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Christopher L. Morrow > Sent: Wednesday, March 23, 2005 2:12 PM > To: Randy Bush > Cc: nanog(a)merit.edu > Subject: Re: 72/8 friendly reminder > > > > > On Wed, 23 Mar 2005, Randy Bush wrote: > > > > > >> We were recently assigned a 72.244/16 allocation from > ARIN. Friendly > > >> reminder that ARIN started allocating 72/8 since Aug. If > you have a > > >> static bogon filters, can you please make sure they are > updated. Thank > > > if you are really worried about this, and i can understand your > > > being so, then make it easy for the busy folk here (not those > > > pontificating on law and morals in the rocky mountains) to test. > > > give us an address we can ping. > > > > a bit more coffee made me realize that what might best occur would > > be for the rir, some weeks BEFORE assigning from a new block issued > > by the iana, put up a pingable for that space and announce it on > > the lists so we can all test BEFORE someone uses space from that > > block. > > So, it's probably a multifaceted problem: > 1) acls (router) > 2) firewalls (host) > 3) route acceptance (routers) > > Some can be audited 'easily' some are 'set and forget' (or forgot :( ) > > Ping might just be dropped to destinations, before any idea > of 'ip space' > filters (think www.sun.com filters). You really have to test with the > protocols your main user base might be using (http/https). I believe this would have to be an RIR policy, though. ARIN is holding an open mic to present a few blurbs on potential policy at the Orlando meeting. It might be an idea for some operators to hook up at the meeting prior to the open mic and talk more. It's too late to make a proposal for this upcoming meeting, but not the next one. And that's a joint NANOG/ARIN meeting, IIRC. -M<

2 1

Re: Utah governor signs Net-porn bill
by David Barak 23 Mar '05

23 Mar '05

--- Daniel Senie <dts(a)senie.com> wrote: > Anyone want to publish a definitive list of IP > addresses for Utah? A week > of null-routing all such traffic by many web sites > would, I think, would be > a measured response to idiot legislators. It could > be "give Utah the Finger > Day" or some such. Wouldn't you then be guilty of doing the exact thing which the legislature is doing? Besides any discussion regarding collusion or anticompetitive behavior, how does this type of action improve free speech? Personally, I WANT everyone in Utah to get to my content. -David Barak need Geek Rock? Try The Franchise! http://www.listentothefranchise.com __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

2 1

Re: Utah governor signs Net-porn bill
by Daniel Senie 23 Mar '05

23 Mar '05

At 08:41 PM 3/22/2005, Steven J. Sobol wrote: >On Tue, 22 Mar 2005, Owen DeLong wrote: > > > Were I running an ISP of which Utah subscribers were not a large portion > > of my customer base, I would probably seriously consider simply > > disconnecting > > all of my Utah customers. > >Of course, you're making sure none of the web servers under your purview >are reachable from Utah either. Anyone want to publish a definitive list of IP addresses for Utah? A week of null-routing all such traffic by many web sites would, I think, would be a measured response to idiot legislators. It could be "give Utah the Finger Day" or some such.

4 3

Weird Cisco Behavior
by Joel Perez 23 Mar '05

23 Mar '05

Hey Guys, I was wondering if any of you are seeing anything weird going on with any Cisco gear you may have? It started earlier today. I have some AS5850's in remote pop's around the US and all of a sudden they all started to drop packets at the same time. Some of them actually rebooted themselves and when this happened it made several other ones also either reboot themselves or drop packets. None of my other non-cisco gear was affected by this. I dont see any weird activity except some probing going on on port 445. I have a call in to Cisco-Tac but wanted to know if anybody is seeing the same thing. Thanks, Joel Perez ntera.net

1 0

Resolution -> RE: Known communities for AS174?
by David Hubbard 23 Mar '05

23 Mar '05

Talked with Cogent IP Engineering today, was doing my own prepending in the meantime. I received a number of replies on and off list with quite a bit of conflicting info from Cogent doesn't support any communities other than do not announce to they support this or that to references of RIPE and RADb both of whom seem to have some outdated info. It turns out they do support a bunch of communities, including path prepending of one, two and three times which are what I was looking for, and for at least the US market, they're all in the customer user guide which I hadn't received; no I really didn't receive it not just didn't read it. :-) The person I spoke with was going to have someone update RADb with current information as what's there is about eight months old I think. I ended up having to clear the peer session hard but then my community was applied and is functioning as intended. Only thing missing that would be really nice would be something like Level 3 where you can selectively prepend to a specific peer AS of theirs. :-) But they were very responsive as soon as got in touch with the right group. David

1 0

Proofpoint
by just me 23 Mar '05

23 Mar '05

If you are running Proofpoint appliances or software in a relatively high (25k to 30k messages per hour) traffic environment, I would love to hear from you regarding your experiences. I will summarize to the list if there is aany interest; until then, please reply to me directly. thanks much, matt ghali --matt(a)snark.net------------------------------------------<darwin>< The only thing necessary for the triumph of evil is for good men to do nothing. - Edmund Burke

1 0

Re: sorbs.net
by Robert Bonomi 22 Mar '05

22 Mar '05

> From owner-nanog(a)merit.edu Tue Mar 15 12:53:30 2005 > Date: Tue, 15 Mar 2005 10:53:22 -0800 > From: Micah McNelly <micah(a)style.net> > Subject: Re: sorbs.net > > > Actually I got a response quickly from a list member who represent sorbs > at some level. Do you really think opinion has a place in mail > delivery? *MY* opinion on that matter doesn't count for sh*t. Neither does yours. The _only_ opinion that matters is that of the *owner* of the destination mail-server. As in "My server, *my* rules." Quite obviously, the server operator at the place you were trying to mail _to_ *DOES* believe that 'opinion' has a place in e-mail delivery. Like I said, the _first_ place you should take your 'problem' is to *them*. *NOBODY* is 'forced' to use SORBS, or any othe blocklist. The mail-system owners/administrators that *CHOOSE* to do so, have made a voluntary decision to restrict incoming mail to their system on that basis. THEY did it, nobody else.

11 15

Known communities for AS174?
by David Hubbard 22 Mar '05

22 Mar '05

Hello, I'm looking for a way to do path prepending for my prefix as it leaves AS174 (Cogent), one of my upstreams. The following: http://www.radb.net/cgi-bin/radb/whois.cgi?obj=AS174 suggests that at least as recently as last May they might have accepted: 3. Communities controlling Cogents AS path prepending for customer routes on egress: community effect 174:3000 do not announce 174:3001 prepend 174 1 time 174:3002 prepend 174 2 times 174:3003 prepend 174 3 times But I've tried setting each of those and it doesn't seem to have any effect. Anyone know if that info is out of date or maybe has something else to try? Thanks, David

5 4

RE: IRC bots...
by Hannigan, Martin 22 Mar '05

22 Mar '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Bill Nash > Sent: Saturday, March 12, 2005 4:40 PM > To: Fergie (Paul Ferguson) > Cc: nanog(a)merit.edu > Subject: Re: IRC bots... > > > > On Sat, 12 Mar 2005, Fergie (Paul Ferguson) wrote: > > > Somewhat related to operational issues... > > > > It was interesting to read the "daily handler" log at > > the ISC which related their experiences with detecting > > (and disabling/disinfecting) a machine/network infected > > with several IRCbot drone computers. As someone who has > > had to deal with with this issue on several customer > > networks, it is sometimes intriguing at the length at > > which some of the developers of these damned things > > go through to accomplish their feats. :-) > > A fun solution to mitigating this problem: NAT or PBR to funnel all > standard outbound IRC traffic to an internal ircd of your choice. [ SNIP ] Who's got time for all that? Chase the controller, shut down the user until they buy some AV software. We've gone beyond "I didn't know" for endusers in most regions. This problem turned into the spam problem faster than the spam problem did. -M<

6 7

IBM to offer service to bounce unwanted e-mail back to the computers that sent them
by Andreas Ott 22 Mar '05

22 Mar '05

http://money.cnn.com/2005/03/22/technology/ibm_spam/ And I thought they knew better by now that a hijacked windows pc won't accept mail. I still consider it silly to absorb the sender's bandwidth like this (and all transits' bandwidth until someone is smart enough to put a filter up). -andreas -- Andreas Ott andreas(a)naund.org

5 5