RE: Blackholes and IXs and Completing the Attack.

2008-02-02 Thread Tomas L. Byrnes
You could achieve the exact same result simply by not advertising the network to your peers, or by advertising a bogus route (prefixing a known bogon AS for the addresses you want null-routed). I realize you would have to subnet/deaggregate your netblocks, and therefore could wind up with a prefix

RE: Blackholes and IXs and Completing the Attack.

2008-02-02 Thread Tomas L. Byrnes
IANAL, but I have filed some patents, and reviewed a bunch more. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Christopher Morrow > Sent: Saturday, February 02, 2008 12:58 PM > To: Tomas L. Byrnes > Cc: Ben Butler; Paul Vixie; na

RE: Blackholes and IXs and Completing the Attack.

2008-02-02 Thread Tomas L. Byrnes
al Message- > From: Ben Butler [mailto:[EMAIL PROTECTED] > Sent: Saturday, February 02, 2008 2:42 PM > To: Tomas L. Byrnes; nanog@merit.edu > Subject: RE: Blackholes and IXs and Completing the Attack. > > "If you're trying to do it on a /32 basis, I doubt you&

RE: Blackholes and IXs and Completing the Attack.

2008-02-03 Thread Tomas L. Byrnes
happy to stand corrected. If I've offended anyone, I'm sorry. Best wishes to all. May your packets flow, your sessions connect, and your pagers remain silent. > -Original Message- > From: Ben Butler [mailto:[EMAIL PROTECTED] > Sent: Sunday, February 03, 2008 5:31 AM &g

RE: [admin] Re: Fourth cable damaged in Middle Eest (Qatar to UAE)

2008-02-04 Thread Tomas L. Byrnes
My experience is that a lot of the BB providers route through NAPs/MAEs when they have local peering. The Internet IS more brittle than it needs to be, because routing seems to be a lot more static than it should be. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTE

RE: YouTube IP Hijacking

2008-02-24 Thread Tomas L. Byrnes
Pakistan is deliberately blocking Youtube. http://politics.slashdot.org/article.pl?sid=08/02/24/1628213 Maybe we should all block Pakistan. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Will Hargrave > Sent: Sunday, February 24, 2008 12:39 P

RE: YouTube IP Hijacking

2008-02-24 Thread Tomas L. Byrnes
r [mailto:[EMAIL PROTECTED] > Sent: Sunday, February 24, 2008 1:01 PM > To: Tomas L. Byrnes > Cc: Will Hargrave; nanog@merit.edu > Subject: Re: YouTube IP Hijacking > > While they are deliberately blocking Youtube nationally, I > suspect the wider issue has no malice, and

RE: YouTube IP Hijacking

2008-02-24 Thread Tomas L. Byrnes
; To: [EMAIL PROTECTED]; Tomas L. Byrnes > Cc: [EMAIL PROTECTED]; nanog@merit.edu > Subject: Re: YouTube IP Hijacking > > Exactly... They inadvertently made the details of their > oppression more readily apparent... > > > - Original Message - > From: [EMAIL PROTE

RE: YouTube IP Hijacking

2008-02-24 Thread Tomas L. Byrnes
ger-prefix hijacking (especially problematic with things like MS update sites). > -Original Message- > From: Simon Lockhart [mailto:[EMAIL PROTECTED] > Sent: Sunday, February 24, 2008 2:07 PM > To: Tomas L. Byrnes > Cc: Michael Smith; [EMAIL PROTECTED]; [EMAIL PROTECTED]; > n

Some ideas on how to protect against longer-prefix hijacking

2008-02-24 Thread Tomas L. Byrnes
Fundamentally, this is a policy issue, and the implementation details will need to be worked out, but today's event with YouTube is an exclamation point on a problem many of us have been wrestling with for some time: the advertising of unused but non-bogon address space by cybercriminals. Whether

RE: YouTube IP Hijacking

2008-02-24 Thread Tomas L. Byrnes
ould have considered 17557, as a national telco, a trusted route source. > -Original Message- > From: Randy Epstein [mailto:[EMAIL PROTECTED] > Sent: Sunday, February 24, 2008 4:15 PM > To: Tomas L. Byrnes; 'Simon Lockhart' > Cc: 'Michael Smith'; [EMAI

RE: YouTube IP Hijacking

2008-02-24 Thread Tomas L. Byrnes
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Patrick W. Gilmore > Sent: Sunday, February 24, 2008 5:43 PM > To: nanog@merit.edu > Cc: Patrick W. Gilmore > Subject: Re: YouTube IP Hijacking > > > On Feb 24, 2008, at 7:36 PM, Tomas L. Byrnes wrote: > >

RE: YouTube IP Hijacking

2008-02-24 Thread Tomas L. Byrnes
public domain). It's also something that can be built using the existing infrastructure, and rough consensus. > -Original Message- > From: Owen DeLong [mailto:[EMAIL PROTECTED] > Sent: Sunday, February 24, 2008 8:25 PM > To: Tomas L. Byrnes > Cc: Simon Lockhar

RE: YouTube IP Hijacking

2008-02-25 Thread Tomas L. Byrnes
This is a very interesting site. However, I notice that, in the "all in the last 24 hours" it doesn't show the YouTube hijack. It does have a lot of entries for 17557, most recently on 2/17. How reliable is this system? > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PRO

RE: YouTube IP Hijacking

2008-02-26 Thread Tomas L. Byrnes
Since the US has no jurisdiction over 17557, other than for the US govt. to force ISPs to refuse to accept any advertisements with 17557 or any other AS that didn't meet some regulatory requirements in the path, how would you propose that the regulatory environment you envision work? American Air

RE: Scan traffic from 121.8.0.0/16

2008-03-06 Thread Tomas L. Byrnes
Have you queried the DShield database for the hosts you are seeing? http://www.dshield.org/ipinfo.html?ip= add the IP after the = > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Rich Sena > Sent: Thursday, March 06, 2008 12:02 PM > To: NANOG >

RE: NXDOMAIN data needed for survey

2008-03-20 Thread Tomas L. Byrnes
What's even more interesting is that googling Ray Demain shows nothing, except this message. I'd say that M. Demain does not exist, and his money will be as real as his on-line presence. I always love commissions promised from entities whose revenues you can't audit. Never mind that the purpo

RE: NXDOMAIN data needed for survey

2008-03-28 Thread Tomas L. Byrnes
What's more funny is that googling "Ray Demain" only brings up lots of posts from you looking for NXDOMAIN data. What's your real name? Who do YOU work for? Who funds that company? Before you go accusing others of subterfuge and conspiracy, be up front about who you are, what you're about, and