SV: APNIC dns glitch ?

2008-06-24 Thread Martin Hannigan
APNIC made an announcement on an operator list this morning that is probably relevant to your issue: +++include Some services provided by APNIC were unavailable this morning due to a disruption to our international connectivity. This occurred between 07:00 Australian Eastern Standard Time (

Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-24 Thread Ken Simpson
Source IP blocking makes up a large portion of today's spam arrest approach, so we shouldn't discount the CPU benefits of that approach too quickly. I'm not sure where today's technology is in regards for caching the first 1 to 10kB of a sessiononce enough information is garnered to b

Re: Techniques for passive traffic capturing

2008-06-24 Thread Ross Vandegrift
On Mon, Jun 23, 2008 at 10:00:06PM -0500, Kevin Kadow wrote: > We started out with SPAN ports, then moved on to Netoptics taps. > > Lately we've been using a combination of Cisco Netflow (from remote routers), > and native Argus flows (from local taps) where we need more details. > > Flows are us

easy way to scan for issues with path mtu discovery?

2008-06-24 Thread Darden, Patrick S.
Hi all, Does anyone know of an easy way to scan for issues with path mtu discovery along a hop path? E.g. if you think someone is ICMP black-holing along a route, or even on the endpoint host, could you use some obscure nmap flag to find out for sure, and also to identify the offending hop/r

Re: easy way to scan for issues with path mtu discovery?

2008-06-24 Thread Ingo Flaschberger
Dear Patrick, Does anyone know of an easy way to scan for issues with path mtu discovery along a hop path? E.g. if you think someone is ICMP black-holing along a route, or even on the endpoint host, could you use some obscure nmap flag to find out for sure, and also to identify the offending

Re: Techniques for passive traffic capturing

2008-06-24 Thread Justin Shore
I stumbled across these last night. http://www.dovebid.com/assets/display.asp?ItemID=cne11811 I don't know anything about them and haven't done any research. The auction description would however lead me to believe that they might be useful in this case. There are many of them listed in the

Re: Techniques for passive traffic capturing

2008-06-24 Thread Ross Vandegrift
On Tue, Jun 24, 2008 at 01:19:03PM +1200, Nathan Ward wrote: > I see little point in aggregating tapped traffic, unless you have only > a small amount of it and you're doing it to save cost on monitoring > network interfaces - but is that saved cost still a saving when you > factor in the cos

Re: easy way to scan for issues with path mtu discovery?

2008-06-24 Thread Justin Shore
Darden, Patrick S. wrote: Hi all, Does anyone know of an easy way to scan for issues with path mtu discovery along a hop path? E.g. if you think someone is ICMP black-holing along a route, or even on the endpoint host, could you use some obscure nmap flag to find out for sure, and also to i

RE: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-24 Thread Frank Bulk - iNAME
For the reason you stated, "much to the chagrin of receivers". Easier to sell a service to customers downstream if it's being done in the network, without MX changing. Frank -Original Message- From: Ken Simpson [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 24, 2008 8:38 AM To: [EMAIL PR

RE: easy way to scan for issues with path mtu discovery?

2008-06-24 Thread Frank Bulk - iNAME
Look at mturoute: http://www.elifulkerson.com/projects/mturoute.php Frank -Original Message- From: Darden, Patrick S. [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 24, 2008 9:28 AM To: nanog@nanog.org Subject: easy way to scan for issues with path mtu discovery? Hi all, Does anyone kno

Comcast

2008-06-24 Thread Edward A. Trdina III
Anyone from Comcast on-list? I'm getting hit with phishing emails that have a link to a Wachovia look alike page that's hosted on a comcast HSI account in South Bend Indiana.(At least thats what the SWIP says). Thanks! Ed

Versaweb abuse contacts

2008-06-24 Thread William Pitcock
Hi, If someone on this list works for Versaweb and can handle a botnet situation, please contact me off list. William

Level3 IPv6 availability?

2008-06-24 Thread Jay Hennigan
Is anyone at Level3 who is familiar with IPv6, or anyone who is a Level3 IPv6 customer lurking here? We are a Level3 BGP customer and our contacts are giving us a deer-in-the-headlights stare when we want to bring up our /32, claiming that they don't do IPv6 at all. Not native, not tunneled,

Re: Level3 IPv6 availability?

2008-06-24 Thread Simon Lockhart
On Tue Jun 24, 2008 at 11:37:57AM -0700, Jay Hennigan wrote: > Is anyone at Level3 who is familiar with IPv6, or anyone who is a Level3 > IPv6 customer lurking here? We are a Level3 BGP customer and our > contacts are giving us a deer-in-the-headlights stare when we want to > bring up our /32,

XO contact

2008-06-24 Thread Zaid Ali
Can someone from XO who handles this neighbor 65.46.253.157 help me out with a BGP session going down? This is the second time within a week where a misconfiguration of an ACL on XO end is bringing down my BGP session with you and its frustrating to go through the normal tech support chain.

Re: Level3 IPv6 availability?

2008-06-24 Thread Craig Pierantozzi
Level 3 provides best effort IPv6 support with no SLA to current Internet customers. As mentioned IPv6 is currently being provided via tunnels to the customer's existing router. There is a simple service agreement addendum and form to fill out for relevant config bits. Sorry you get such a res

Re: Level3 IPv6 availability?

2008-06-24 Thread Brandon Butterworth
> > Is anyone at Level3 who is familiar with IPv6, or anyone who is a Level3 > > IPv6 customer lurking here? We are a Level3 BGP customer and our > > contacts are giving us a deer-in-the-headlights stare when we want to > > bring up our /32, claiming that they don't do IPv6 at all. Not native,

Re: easy way to scan for issues with path mtu discovery?

2008-06-24 Thread Bill Owens
On Tue, Jun 24, 2008 at 10:28:12AM -0400, Darden, Patrick S. wrote: > > > Hi all, > > Does anyone know of an easy way to scan for issues with path mtu discovery > along a hop path? E.g. if you think someone is ICMP black-holing along a > route, or even on the endpoint host, could you use some

Re: EC2 and GAE means end of ip address reputation industry? (Re:

2008-06-24 Thread Ken Simpson
One could argue that the "botnets for rent" business model is in more widespread use than either EC2 or gridserver... I'm unclear whether that statement needs a smiley or not... i'd say that since EC2 won't be shut down when it's found out about, that you need a smiley. "widespread use" is

Re: EC2 and GAE means end of ip address reputation industry? (Re:

2008-06-24 Thread Deepak Jain
IMHO, Amazon will eventually be forced to bifurcate their EC2 IP space into a section that is for "newbies" and a section for established customers. The newbie space will be widely black-listed, but will also have a lower rate of abuse complaint enforcement. The only scalable way to deal wit

Re: EC2 and GAE means end of ip address reputation industry? (Re:

2008-06-24 Thread Valdis . Kletnieks
On Tue, 24 Jun 2008 00:03:20 -, Paul Vixie said: > [EMAIL PROTECTED] writes: > > > One could argue that the "botnets for rent" business model is in more > > widespread use than either EC2 or gridserver... > > > > I'm unclear whether that statement needs a smiley or not... > > i'd say that si