- Test - lists.nanog.org

Re: Proof of ownership; when someone demands you remove a prefix
by Naslund, Steve 13 Mar '18

13 Mar '18

The fact that it is a newer customer would make me talk to the RIR direct and verify that a dispute is really in progress. I would also look at some looking glasses and see if the prefix is being announced elsewhere, if so that might indicate that your customer is indeed stepping on a legit owner. I would also make it clear to the new customer that they are on thin ice here to light a fire under their process. Let them know that it is up to them to convince you that they are the legit owner. No one wants to lose a customer but they are threatening your business and putting you in legal jeopardy if they are not legit. Steven Naslund Chicago IL >-----Original Message----- >From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Sean Pedersen >Sent: Tuesday, March 13, 2018 12:39 PM >To: nanog(a)nanog.org >Subject: RE: Proof of ownership; when someone demands you remove a prefix > >This is more or less the situation we're in. We contacted the customer and they informed us the matter is in dispute with the RIR and that their >customer (the assignee) is in the process of resolving the issue. We have to allow them time to accomplish this. I've asked for additional information >to help us understand the nature of the dispute. In that time we received another request to stop announcing the prefix(s) in addition to a new set of >prefixes, and a threat to contact our upstream providers as well as ARIN - which is not the RIR the disputed resources are allocated to. > >This is a new(er) customer, so there is some merit to dropping the prefix and letting them sort it out based on the current RIR contact(s). However, >there is obvious concern over customer service and dropping such a large block of IPs. > >I'm definitely leaning toward "let the customer (or customer's customer) and the RIR sort it out" if the POC validates the request weighed responsibly >against customer age. However, from a customer service perspective, I think we owe it to our customers to make sure a request is legitimate before we >knock them offline. With a limited toolset to validate that information, I can't help but feel conflicted. > >I appreciate all the feedback this thread has generated so far!

3 3

Re: Centurylink SOC contact?
by Wentworth, Brett 13 Mar '18

13 Mar '18

I responded off list. Brett -----Original Message----- From: NANOG <nanog-bounces(a)nanog.org> on behalf of Brian Rak <brak(a)gameservers.com> Date: Tuesday, March 13, 2018 at 12:08 PM To: "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: Centurylink SOC contact? Does anyone have a contact for the SOC at centurylink? I've tried soc@centurylink and noc@centurylink, with no answer. For whatever reason, they're mangling IP address in abuse reports, which requires us to manually review every report. We'd really like them to stop, and just include the IP address in the body of the report. They seem to be the only ones that do this, pretty much all the other reports we get list a normal IP address. This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

1 0

Proof of ownership; when someone demands you remove a prefix
by Sean Pedersen 13 Mar '18

13 Mar '18

We recently received a demand to stop announcing a "fraudulent" prefix. Is there an industry best practice when handling these kind of requests? Do you have personal or company-specific preferences or requirements? To the best of my knowledge, we've rarely, if ever, received such a request. This is relatively new territory. In this case we have a signed LOA on file for that prefix and I've reached out to our customer to verify the validity of the sender's request. The sender claims to have proof that they are authorized to speak on behalf of the owner. I will wait until I hear from our customer before I consider a response to the sender. I don't get a real sense of legitimacy from the sender making the request. No one else announces the prefix. Nothing about the request appears to be legitimate, especially considering the sender. I thought about requesting they make changes to their RIR database objects to confirm ownership, but all that does is verify that person has access to the account tied to the ORG/resource, not ownership. Current entries in the database list the same ORG and contact that signed the LOA. When do you get to the point where things look "good enough" to believe someone? Has anyone gone so far as to make the requestor provide something like a notarized copy stating ownership? Have you ever gotten legal departments involved? The RIR?

15 24

Websurfing trouble to .gov and .il.us
by Sam Kretchmer 13 Mar '18

13 Mar '18

Nanog, I am part of a small ISP based in Chicago. We have several clients complaining of an inability to hit a couple specific government websites, specifically http://tierii.iema.state.il.us/TIER2MANAGER/Account/Login.aspx and https://www.deadiversion.usdoj.gov/. It does seem to be related to the IP's they use, specifically parts of 213.159.132/22. They can surf any other site we can think of, do email, IPSec tunnels, anything apparently but surf these sites. The listed sites show "loading" then "connecting" then back to "loading" and so on. I have checked all the blacklist sites I can get out of google. and they all show all green. I am at a loss as to what else might be contributing to the issue. Is there anyone on list here from either of those sites who might be able to help who can hit me off list, or anyone at all who might have some advice? It would be appreciated. All I need to do is to assign different IP's to the client and it works fine (hopefully eliminating Layer 1 and Layer 2, i.e. routers, circuits, etc..) My apologies if this is not the correct forum for this kind of question. Thanks Sam

5 4

Centurylink SOC contact?
by Brian Rak 13 Mar '18

13 Mar '18

Does anyone have a contact for the SOC at centurylink? I've tried soc@centurylink and noc@centurylink, with no answer. For whatever reason, they're mangling IP address in abuse reports, which requires us to manually review every report. We'd really like them to stop, and just include the IP address in the body of the report. They seem to be the only ones that do this, pretty much all the other reports we get list a normal IP address.

1 0

contact for www.upack.com (http 403)
by Matthew Dittmer 13 Mar '18

13 Mar '18

Is there a contact at upack.com that can help us? All of our subscribers receive an error 403 access denied. Thank you, Matt Dittmer AS20298

1 0

[NANOG-announce] NANOG 73 Call for Presentations is open
by Ryan Woolley via NANOG-announce 13 Mar '18

13 Mar '18

This message has been wrapped due to the DMARC policy setting to prevent NANOG subscribers from being unsubscribed due to bounces. _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: Proof of ownership; when someone demands you remove a prefix
by Scott Weeks 13 Mar '18

13 Mar '18

>> On Mar 12, 2018, at 4:11 PM, Randy Bush <randy(a)psg.com> wrote: >> >> it's a real shame there is no authorative cryptographically verifyable >> attestation of address ownership. > On Mar 12, 2018, at 21:20, George William Herbert <george.herbert(a)gmail.com> wrote: > > Ownership?... > > (Duck) --- jhellenthal(a)dataix.net wrote: From: Jason Hellenthal <jhellenthal(a)dataix.net> : shouldn’t that be proof enough of ownership of the ASN ? ------------------------------------------------- You don't own the ASN. And that was a special, friendly poke at randy... :-) scott

2 1

LCD KVM console pullout that supports display port ???
by Matthew Huff 12 Mar '18

12 Mar '18

Anyone have any recommendations for a 16-17" LCD keyboard/mouse combo pull-out tray that supports DisplayPort/USB as an input? ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039

1 0

Re: BCP 38 addendum
by Fabien VINCENT (NaNOG) 11 Mar '18

11 Mar '18

Le 2018-03-06 19:39, Barry Greene a écrit : >> On Mar 2, 2018, at 1:53 PM, Fabien VINCENT (NaNOG) <list-nanog(a)beufa.net> wrote: >> Hope one day the 3rd mode of uRPF will be something else than a plan ... >> uRPF is not very usefull when multi homed. And as far as I know, multi >> homed networks are increasing as fast as PNI development ;) > > This was working microcode code when I left in 2008. Several operators tested, but none deployed (no pushing or pulling). Yep, but saw only reference of it, but no real CLI implementation (especially on Cisco), so I guess it's not a killer feature to sell routers ;) In 2005 : https://www.cisco.com/c/dam/en_us/about/security/intelligence/urpf.pdf "A third phase is currently under way that will create a way to have strict enforcement of the uRPF check on individual ISP-ISP edges. Here, external BGP (eBGP) peer sessions will send specific prefixes to a dedicated Virtual routing and forwarding (VRF) table. This will allow uRPF to query the VRF table that contains all the routes for that specific eBGP peering session over the interface, thus verifying (authorizing) the source addresses of packets matching the advertised routes from the peered ISP" That's obviously not so sexy, but I guess the problem is on hardware performance, as the prefer method should to have a look on BGP tables, and uRPF is done on FIB / ASIC level. Sadly, seems not possible right ? -- FABIEN VINCENT _@beufanet_

3 4