- Test - lists.nanog.org

APRICOT 2004 : Speakers for Peering and Internet Exchange Track
by William B. Norton 02 Dec '03

02 Dec '03

Hi all - You may have heard that there will be a new one-day track on Peering and Internet Exchanges at the upcoming APRICOT in Kuala Lumpur in February. I'd like to describe the track in brief and solicit a few more Peering Coordinators / Network Architects / Network Engineers as speakers for the track. (See http://www.apricot2004.net/ for information on the broader APRICOT 2004 conference). This Peering and Internet Exchange Track is intended to facilitate regional ISP Peering by providing a forum for Peering Coordinators to meet each other and share information about Asia Pacific peering. We will facilitate this with several panels, each one focused on peering in a particular country. If you are a Peering Coordinator with experience peering in the AP Region, please send me an e-mail answering the questions below. I will use this information to match panelists together into panels focused on certain AP countries. Thanks! Bill --------------------------- Speaker Questionnaire ------------------------------------ If you are able and willing to speak at the Feb 2004 APRICOT Peering and Internet Exchange Track, please fill out the following form and e-mail to William B. Norton at wbn(a)umich.edu: Name: __________________ Title: ___________________ Company: _______________ AS # _________________ In what country do you live? _________________ Email Address: __________________ We will select a set of panelists based on the answers to the questions below: 1) In what countries do you peer? 2) In which AP Country do you have peering experiences that you can share with the audience? 3) Answer as many of the questions below as applicable, as you would present as part of your presentation a) We are looking for speakers that have found interesting or unique country peering ecosystem characteristics. Have you uncovered any unexpected or interesting/unique peering ecosystem characteristics in any of the countries where you peer? Please give a few examples. b) We are also looking for unusual or unexpected traffic patterns. For example, a large amount of Japan traffic is ultimately destined to and from Brazil! Identifying and explaining this type of inter-country traffic would be a good set of data to launch a presentation. Do you have any of this type of data that you can share? c) What are the problems and challenges that you face as you build peering infrastructure into various AP countries? d) If other Peering Coordinators follow your footsteps into regions in which you now peer, what would you tell them: · is information that you would have liked to have had? · Are unexpected problems that you faced? e) What are the emerging trends that you see in the peering ecosystems in which you operate (transit and transport prices going up or down and the implications as you see them). /* William B. Norton <wbn(a)equinix.com> 650.315.8635 Co-Founder and Chief Technical Liaison Equinix, Inc. */

1 0

incorrect spam setups cause spool messes on forwarders
by Randy Bush 02 Dec '03

02 Dec '03

is the following a general problem, or just one i am seeing? note 2821 says 450 Requested mail action not taken: mailbox unavailable (e.g., mailbox busy) 550 Requested action not taken: mailbox unavailable (e.g., mailbox not found, no access, or command rejected for policy reasons) randy From: Randy Bush <randy(a)psg.com> To: foo(a)psg.com Subject: broken mail server Date: Mon, 1 Dec 2003 10:02:34 -0800 you have a .forward on psg.com pointing to foo.user(a)verizon.net. like all mail accounts these days, you get spam. but the forward, as opposed to rejecting it with a 5xx is deferring with a 450 (see below), which is not proper. this means that the spam stays in the queue here, which is just not reasonable. please do one of the following: o see that the verison server is fixed (good luck), o set your forward to a properly working server, or o tell me so i can kill your mail account here. randy 2003-12-01 10:09:05 1APbBa-000Ork-DY == foo.user(a)verizon.net <foo(a)psg.com> R=lookuphost T=remote_smtp defer (0): SMTP error from remote mailer after MAIL FROM:<nikkiadamczyk(a)gerbangmail.com> SIZE=5365: host relay.verizon.net [206.46.170.12]: 450 Requested mail action not taken-Try later:sc004pub.verizon.net

13 24

objective performance tests - broadwing, cogent
by matthew zeier 02 Dec '03

02 Dec '03

Does anyone have some objective performance tests of Cogent and Broadwing? Or any insight into eithers peering and peer relationships or ideas of how they route traffic? Thanks. -- matthew zeier - "Curiosity is a willing, a proud, an eager confession of ignorance." - Leonard Rubenstein

1 0

APNIC delegation change
by Eric Germann 02 Dec '03

02 Dec '03

Just a heads up for those who use http://ftp.apnic.net/stats/apnic/apnic-latest .... It moved. If you have scripts that slurp APNIC ASN or IPv4 allocations, they probably broke this morning. The new correct link is at http://ftp.apnic.net/stats/apnic/new/delegated-apnic-latest ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

2 1

Re: incorrect spam setups cause spool messes on forwarders
by Suresh Ramasubramanian 02 Dec '03

02 Dec '03

" John Brown (CV)" <jmbrown(a)chagresventures.com> wrote: > telling spammers 4xx or 5xx doesn't matter, they don't listen. The goal is to keep your spool clear, and your mailservers operational. At least, that is, if you are running a production server and not a hobbyist / family and friends type setup. -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

1 0

Re: incorrect spam setups cause spool messes on forwarders
by Michael.Dillon＠radianz.com 02 Dec '03

02 Dec '03

>Also imagine your domain being joe-jobbed. You, as an innocent bystander, >then get hammered by Verizon as they try to do a lookup on possibly >millions of incoming mails. Why on earth would Verizon need to do the lookup once per incoming email? If they need to verify that a given MX does indeed exist and is reachable and is running an SMTP server, then why not cache that info for some reasonable time period, say an hour, to avoid disrupting everyone else's Internet. Coupled with that caching, they could reasonably make a few tries over the space of 3 to 5 minutes before giving up on the incoming email by sending 450s. And if they are going to do something like this which imposes a requirement on other ISPs, i.e. your MX must point to a live SMTP server, and which impacts other ISP's mail operations, i.e. we will send you 450s, then why can't they *PUBLISH* what they are doing. NANOG seems an appropriate place for this. --Michael Dillon

1 0

Re: TAT 14 failure
by garrett.allen＠comcast.net 02 Dec '03

02 Dec '03

still seeing decent ping times. anyone detect an actual outage or issue? thanks. > > I saw that link when I googled for TAT-14. I was looking more for a "see, I > told you so" link that I can forward to management that provides proof that > this is why our UK office is down...if you know what I mean. > > Here's an interesting explanation of undersea cabling: > http://davidw.home.cern.ch/davidw/public/SubCables.html > > > -Jack > > > --- Jared Mauch <jared(a)puck.nether.net> wrote: > > > > This is a basic map of the fiber path for those > > that haven't found one yet. > > > > http://www.kddiscs.co.jp/e/business/02_15.html > > > > - jared > > > > On Tue, Nov 25, 2003 at 10:32:16AM -0800, Jack McCarthy wrote: > > > > > > Anyone have additional info regarding this outage? Links? Besides > > tat-14.com > > > - it seems to be down or just flooded with requests. > > > > > > > > > -Jack > > > > > > > > > --- jmalcolm(a)uraeus.com wrote: > > > > > > > > The northern leg of TAT14 seems to have just taken an outage about an > > > > hour ago. As the southern leg was already down due to other faults, > > > > this will probably be an exciting time for many providers. > > > > > > > > > > > > > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > > > > > >

7 6

port 1026-1031 traffic
by Johannes B. Ullrich 02 Dec '03

02 Dec '03

Well, for the last week there has been an odd increase in port 1026-1031 traffic. While everything points to popup spam, there are a few issues that are 'odd': - increase in sources that cause this traffic. - "natural" source ports vs. crafted source port which is typical for popup spam - 2-byte '00 00' payload (more details: http://isc.sans.org/diary.html ) As it very much looks like that the origin are compromised Windows systems (some appear to be behind NAT routers), I posted a list with IPs at http://feeds.dshield.org/port1026.dat The list is sorted by IP. If any of these systems live on your network, your help in tracking down the root cause of all this traffic is appreciated. Its (not yet) a big deal. But maybe its one of the few times we can stay ahead of the problem. Also, at this point it shouldn't be too hard to track these systems (its only about 5,000 unique sources) the columns of the data file: - ip address - first time seen on this day (GMT) - last time seen on this day (GMT) - number of packets detected - date The filter applied to the list: - the hosts sent traffic to port 1026-1031 - the source port was not 666 or 4177 - it happened today or yesterday (today: Dec. 2nd). -- CTO SANS Internet Storm Center http://isc.sans.org phone: (617) 786 1563 fax: (617) 786 1550 jullrich(a)sans.org

1 0

TAT 14 failure
by jmalcolm＠uraeus.com 02 Dec '03

02 Dec '03

The northern leg of TAT14 seems to have just taken an outage about an hour ago. As the southern leg was already down due to other faults, this will probably be an exciting time for many providers.

5 5

Google-jacking?
by Dave Temkin 01 Dec '03

01 Dec '03

Has anyone seen a situation on their internal networks where going to a (non-Google) page "Hijacks" them and they end up with either the Google front page or a broken link page? This happens on machines both with the toolbar and without, and we've seen it on machines on different networks/running different OS's. Just curious. Thanks, -Dave

2 2