- Test - lists.nanog.org

RE: Class "B" IP BLOCK
by Dan Lockwood 05 May '03

05 May '03

Rob, Your team is tireless! We all appreciate your hard work! Dan -----Original Message----- From: Rob Thomas [mailto:robt@cymru.com] Sent: Saturday, May 03, 2003 16:54 To: NANOG Subject: Re: Class "B" IP BLOCK Hi, NANOGers. ] of IP addresses which have not been allocated to a RIR, I would think ] policing arin or anybody else's allocations is outside the scope of ] what they'd like to do. Actually we do hope to eventually make available bogon lists based on the unallocated prefixes within the RIR allocations. This will be a separate list due to the more dynamic nature of it. It will use a different community on the bogon route-server as well. I don't have an ETA for that portion of the list, however. Thanks, Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

2 1

Software catches DDoS and creates ACL's
by bobjohnson61＠netzero.net 04 May '03

04 May '03

I tried this download. Pain to work up a Linux box but it does what they say. Detects DDoS and worm propagation and suggests ACL's. From there site I see there is an auto mode that if implemented at peering points would stop DoS and superworms auto-magically. >From this site: http://www.securityconfig.com/software/networksecurity/floodguard_alert.html "FloodGuard Alert is designed to detect all forms of flooding and bandwidth attacks, including DDoSes and superworms. The software initially trains on ingress traffic directed at your protection domain that it uses to statistically identify anomalous traffic. It also suggests initial mitigation steps (ACLs/filters) that can be taken to stop the attack while letting legitimate traffic through. It comes with a comprehensive Java-based GUI that facilitates traffic visualization, configuration, control, analysis, report generation, and SYSLOG- and email-based communications" Download at www.reactivenetwork.com/downloads Bob Johnson Juno Sys Admin ________________________________________________________________ The best thing to hit the internet in years - NetZero HiSpeed! Surf the web up to FIVE TIMES FASTER! Only $14.95/ month -visit www.netzero.com to sign up today!

1 0

Re: Class "B" IP BLOCK
by ddragon＠hushmail.com 04 May '03

04 May '03

> There are gweep.net peeps all over the East Coast, including Canada. How are the "peeps" organized? Is "GweepCo" a 501(c)(3) Nonprofit Organization? Or are they a C-corp, S-corp, or Limited Liability Corporation which has not yet obtained a DUNS number? And what is the history behind their IP address assignment? Is the space legit? > If you don't understand what gweeps have done for the community you > just haven't been invited to participate yet. No, I understand and appreciate their contributions to the operational community. At the same time, one can never be too vigilant. It's been demonstrated repeatedly that the same people and providers we respect on the surface are actively engaged in large-scale spamming and Internet abuse behind closed doors. Please understand I'm not trying to single out you, or any of the "gweeps" with whom you associate, in particular. > FWIW, jzp is looking into the Enteract concerns listed below. Thanks for the timely response. And can we assume he's also looking into the concerns of RCN-originated spam listed below, and will be posting to NANAE or SPAM-L in the days to come with a detailed follow-up, including punative action taken against the spamming marketeers and customers on his network? Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Class "B" IP BLOCK
by John Immel 03 May '03

03 May '03

Dear Nanog, I have a class "B" IP block of addresses (IP 143.170.0.0 - 143.170.255.255) for sale / lease and two questions for the group: 1) Are there any resources for buying / selling IP address? 2) Is anyone in the group interested in making an offer? I understand ARIN has made it difficult to sell IP addresses. We have fixed this problem by creating a corporation whose only asset is the block of IP addresses. Sincerely, John Immel isp(a)jimmel.com 617-869-8326 _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

14 16

Re: Question about 223/8
by Michael.Dillon＠radianz.com 03 May '03

03 May '03

>The reason I ask is that I was perusing RFC 3330 and noted that it >specifically stated that the basis for the reservation of >223.255.255.0/24 no longer applied and that the block was subject to >future allocation to a RIR. Yet there was an argument about it. The argument was because it wasn't clear what the original basis was for the reservation nor was it clear how things had changed. Imagine you have a device that uses lots of addresses but considers them to be sequential numbers rather than bit patterns. For instance, this device could be configured with a starting number and then dole out sequential numbers to connections based on that starting number. This is how a lot of terminal servers work. Imagine that you give the terminal server a number like 223.255.255.200 as the starting number to assign to dialup connections and that terminal server has a 32 port card installed. Then one day an engineer installs a second 32 port card. The terminal server continues to function just fine until one day when it tries to assign 223.255.255.255 to an incoming call followed by assigning 224.0.0.0 to the next call. Suddenly you have all kinds of wierdness breaking out with mysterious broadcast traffic and multicast traffic coming from the device. But it only happens for short bursts during the busiest times of the day. What the heck is going on!? Could you debug that? Would you want to debug that? Maybe that's why 223.255.255/24 should be forever reserved. --Michael Dillon

3 2

Re: Interesting Announcements
by miltonningis＠hushmail.com 03 May '03

03 May '03

Replying to myself is stupid, but... On Sat, 03 May 2003 05:45:53 -0700 miltonningis(a)hushmail.com wrote: >Also, perhaps Internap (AS10910) might explain the story behind >seemingly >stolen ASN 8143 and their many seemingly stolen IP blocks... > > Perhaps Internap (AS10910) can ALSO explain the seemingly jacked IP space being announced by seemingly legitimately registered, but rogue AS27255... And if you traceroute from something that goes over their internap (say a verio customer, perhaps), it looks like they come from the SAME internap router, one port away... interesting.... (Perhaps AS8143 and AS27255 have something in common) Hello? Internap? Are you out there? Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

4 4

Re[3]: The in-your-face hijacking example, was: Re: Who is announcing bogons?
by Richard Cox 03 May '03

03 May '03

On 3 May 2003 01:18 UTC Emil Kacperski <emil(a)atrivo.com> wrote: | Officially I am declaring surrender and victory to | the people that have chosen to cause so much harm. Currently I am still seeing your routes being announced via NLayer. In view of all the information provided to you here, I am amazed that you continued to announce IP ranges which you now know are not yours. | Hopefully Atrivo and myself are not blacklisted in this group, | since we caused nobody any harm. People will of course make up their minds individually as to whether what you did caused harm. You may assist them greatly in coming to their decisions, by answering the following questions truthfully: [1] who precisely was it that you claim gave or sold you the rights to use the netblock 170.208.0.0/16? [2] who initially entered your details - including your contact e-mail address - against that netblock on ARIN's database? -- Richard Cox

3 2

Re: The in-your-face hijacking example, was: Re: Who is announcing bogons?
by Hank Nussbacher 03 May '03

03 May '03

At 06:09 AM 30-04-03 +0000, Christopher L. Morrow wrote: >That may be true, but what does a provider do when they are presented with >written 'authority to use address space' from a customer? Certianly if the >customer provides 'proper' documentation that the ip space is available >for them to route, and that they have authority from the 'owner' to do >this... what is an ISP to do? Aside from route the blocks? A very valid question and one that all too few ISPs handle. How many ISPs have as part of their implementation/provisioning process an item called "check IP address space against IRRs"? I would suggest that written proof of ownership is not enough and that part of the legal framework each ISP has customers complete that it state something to the effect "IP address space and ASNs announced by the customer must be properly registered in one of the online IRRs such as ARIN, RADB, APNIC or RIPE and must reflect the name of the organization placing the request." -Hank

16 20

Re: Interesting Announcements
by miltonningis＠hushmail.com 03 May '03

03 May '03

On Sat, 03 May 2003 06:45:50 -0700 Matthew McGehrin <mcgehrin(a)reverse.net> wrote: >I think the problem is with ARIN, even if you 'transfer' your IP >space to >another owner, the original Date still appears on the whois information. > I think the problem is that you don't understand what "stealing" means, and that you/your employer is actively engaged in doing it. >My point was, if you have enough money, for a fee, anything is possible >from >Arin. > >-- Matthew > >----- Original Message ----- >From: <miltonningis(a)hushmail.com> >To: <mcgehrin(a)reverse.net> >Sent: Saturday, May 03, 2003 9:41 AM >Subject: Re: Interesting Announcements > > >> I didn't get the annoucement from ARIN that you can just get as >much >> IP space as you want, so that you have extra... > > > Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

2 1

Re: Interesting Announcements
by miltonningis＠hushmail.com 03 May '03

03 May '03

Matthew McGehrin wrote: > I think your barking up the wrong tree on this paranoid rant. > > I did some consulting for this company, and I find it hard to believe with > 14 racks of equipment that they would have a 'stolen' /16 > > http://www.vmxnetworks.com/ You actually believe "14 racks of equipment" can justifiably use 65025 ips? Did you read william(a)elan.net's comments on this? I don't know it for fact, but I believe he's correct, and in the case that he's right, these IP's are the property of Lucent and are, in fact, stolen. Also, perhaps Internap (AS10910) might explain the story behind seemingly stolen ASN 8143 and their many seemingly stolen IP blocks... Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0