Did anyone else notice the withdrawal of 205.178.184.0/21? I couldn't reach Network Solutions or any worldnic.com DNS servers for at least 10 minutes from our network or any route server I tried on the Internet. All were on this /21 which was no longer being announced from any perspective I saw. Vinny Abello Network Engineer Server Management vinny@tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN "Courage is resistance to fear, mastery of fear - not absence of fear" -- Mark Twain
We saw it as well this morning, several of our accounts host DNS through worldnic, and they were down. Appears up now though. --tlf -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Vinny Abello Sent: Tuesday, April 04, 2006 10:13 AM To: nanog@merit.edu Subject: Network Solutions outage? Did anyone else notice the withdrawal of 205.178.184.0/21? I couldn't reach Network Solutions or any worldnic.com DNS servers for at least 10 minutes from our network or any route server I tried on the Internet. All were on this /21 which was no longer being announced from any perspective I saw. --- [This E-mail scanned for viruses by Declude Virus]
We have been unable to resolve speakeasy.net. Both authoritative nameservers are unresponsive (ns.nyc1.speakeasy.net and ns-sea.speakeasy.net). Anyone else seeing any issues? Fox,Thomas wrote:
We saw it as well this morning, several of our accounts host DNS through worldnic, and they were down. Appears up now though.
--tlf
-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Vinny Abello Sent: Tuesday, April 04, 2006 10:13 AM To: nanog@merit.edu Subject: Network Solutions outage?
Did anyone else notice the withdrawal of 205.178.184.0/21? I couldn't reach Network Solutions or any worldnic.com DNS servers for at least 10 minutes from our network or any route server I tried on the Internet. All were on this /21 which was no longer being announced from any perspective I saw.
--- [This E-mail scanned for viruses by Declude Virus]
Here is the scoop. Dear Valued Partner, This morning our collocation provider suffered a global outage from 7:56 a.m. to 10:02 a.m. (eastern) that impacted the Network Solutions systems. The providers outage affected access to Network Solutions products and services. The provider has resolved the issues with their systems and access to our services has been restored. We appreciate your patience and apologize for the inconvenience. Please note, you may experience latency today as we continue to restore our services to full capacity. If you have any questions regarding this message, please contact your Partner Support Representative or e-mail us at
Here is the scoop.
Dear Valued Partner,
This morning our collocation provider suffered a global outage from 7:56 a.m. to 10:02 a.m. (eastern) that impacted the Network Solutions systems. The providers outage affected access to Network Solutions products and services. The provider has resolved the issues with their systems and access to our services has been restored.
We appreciate your patience and apologize for the inconvenience. Please note, you may experience latency today as we continue to restore our services to full capacity. If you have any questions regarding this message, please contact your Partner Support Representative or e-mail us at
Elijah, thanks. We see 205.178.184.0/21 originated by 6245 and generally only advertised via 3561 pretty consistently. The first withdrawals of 205.178.184.0/21 on 04/04/2006 were seen around 12:00 UTC and from then until ~12:50 UTC the prefix is announced sporadically then withdrawn everywhere. Nothing is seen from them for about an hour and then everything went back the way it was ~14:03UTC. Just to be sure we weren't seeing any sort of root attack that has been being talked about lately, I looked at F, I, and some others and things looked in order. Looks like 3561 could be writing the RFO. -M< -- Martin Hannigan (c) 617-388-2663 Renesys Corporation (w) 617-395-8574 Member of Technical Staff Network Operations hannigan@renesys.com
We saw repeated withdrawals of 205.178.184.0/21, and it lasted well over an hour.. #show ip bgp 205.178.190.1 BGP routing table entry for 0.0.0.0/0 5 minutes later: #show ip bgp 205.178.190.1 BGP routing table entry for 205.178.184.0/21 We were seeing the prefix re-appear for one provider at a time, then withdrawl. traceroute to ns95.worldnic.com (205.178.190.48), 30 hops max, 38 byte packets 1 aggr1a.lon.rackspace.net (212.100.224.2) 0.267 ms 0.193 ms 0.182 ms 2 g3-16.core1.lon.rackspace.net (83.138.138.66) 0.225 ms 0.217 ms 0.196 ms 3 g1-1.edge2.lon.rackspace.net (83.138.138.33) 0.278 ms 0.238 ms 0.206 ms 4 g1-2.edge3.lon.rackspace.net (83.138.138.34) 0.905 ms 0.818 ms 0.855 ms 5 347.ge5-0.mpr2.lhr1.uk.above.net (213.152.230.106) 0.984 ms !H * == traceroute to ns95.worldnic.com (205.178.190.48), 30 hops max, 38 byte packets 1 aggr1a.lon.rackspace.net (212.100.224.2) 0.268 ms 0.329 ms 0.178 ms 2 g3-16.core1.lon.rackspace.net (83.138.138.66) 91.638 ms 207.230 ms 0.374 ms 3 g1-1.edge2.lon.rackspace.net (83.138.138.33) 0.256 ms 0.204 ms 0.200 ms 4 POS6-3.GW1.LND9.ALTER.NET (146.188.67.81) 0.785 ms !H * * == traceroute to 205.178.190.48 (205.178.190.48), 30 hops max, 38 byte packets 1 aggr1a.lon.rackspace.net (212.100.224.2) 0.282 ms 0.204 ms 0.184 ms 2 g3-16.core1.lon.rackspace.net (83.138.138.66) 0.271 ms 0.201 ms 0.188 ms 3 g1-2.edge3.lon.rackspace.net (83.138.138.34) 0.841 ms 0.823 ms 0.826 ms 4 ae0-11.lon11.ip.tiscali.net (213.200.77.69) 0.867 ms 0.877 ms 0.881 ms 5 so-1-0-0.sjc10.ip.tiscali.net (213.200.82.134) 145.669 ms 145.686 ms 146.763 ms !N 6 ae0-11.lon11.ip.tiscali.net (213.200.77.69) 0.887 ms !N 0.885 ms !N 0.836 ms !N Vinny Abello wrote:
Did anyone else notice the withdrawal of 205.178.184.0/21? I couldn't reach Network Solutions or any worldnic.com DNS servers for at least 10 minutes from our network or any route server I tried on the Internet. All were on this /21 which was no longer being announced from any perspective I saw.
Vinny Abello Network Engineer Server Management vinny@tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A
Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN
"Courage is resistance to fear, mastery of fear - not absence of fear" -- Mark Twain
-- ------------------------------------------------------ Tom Sands Chief Network Engineer Rackspace Managed Hosting (210)447-4065 ------------------------------------------------------
On 4/4/06, Vinny Abello <vinny@tellurian.com> wrote:
Did anyone else notice the withdrawal of 205.178.184.0/21? I couldn't reach Network Solutions or any worldnic.com DNS servers for at least 10 minutes from our network or any route server I tried on the Internet. All were on this /21 which was no longer being announced from any perspective I saw.
Vinny Abello Network Engineer Server Management vinny@tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A
Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN
"Courage is resistance to fear, mastery of fear - not absence of fear" -- Mark Twain
Hi, "Meanwhile, in the second attack of its kind in the past few days, DNS servers at Network Solutions were hit by a denial-of-service attack, resulting in a brief performance degradation for customers, according to the company." http://groups.google.com/group/n3td3v/browse_thread/thread/a92bc5b744c99705/... Regards, n3td3v Side note: Please don't complain about not using a 'real name', you can always ban me from Nanog, to which I will use another e-mail address the next time I have something to add to the list. Dog chasing its tail for the Nanog moderator I guess. However everyone knows who n3td3v is, and to use any other name would be a great injustice to the list, in the way it would be misleading and mystifying for people wondering, "is this n3td3v on a 'real name'?". See you next time as n3td3v, and no other name will ever be used as far as n3td3v and Nanog are concerned.
participants (7)
-
Elijah Savage -
Fox,Thomas -
Jim Nelson -
Martin Hannigan -
n3td3v -
Tom Sands -
Vinny Abello