Re: iOS 7 update traffic

2013-09-23 Thread John Smith
Picked this off www.jaluri.com (network and Cisco blog aggregator): http://routingfreak.wordpress.com/2013/09/23/ios7s-impact-on-networks-worldwide/ The consensus seems to be for providers to install CDN servers, if they arent able to cope up with an occasional OS update traffic. http://news.id

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Nick Hilliard
On 23/09/2013 00:15, John Curran wrote: > Not being able to use 32-bit ASNs in your network and support systems will > inevitably lead to confusion for those customers who are assigned them. I look forward to the day when we have proper 32 bit BGP community support and ASN32s finally become us

Re: iOS 7 update traffic

2013-09-23 Thread Neil Harris
On 23/09/13 10:32, John Smith wrote: Picked this off www.jaluri.com (network and Cisco blog aggregator): http://routingfreak.wordpress.com/2013/09/23/ios7s-impact-on-networks-worldwide/ The consensus seems to be for providers to install CDN servers, if they arent able to cope up with an occasi

Re: iOS 7 update traffic

2013-09-23 Thread Glen Kent
One of the earlier posts seems to suggest that if iOS updates were cached on the ISPs CDN server then the traffic would have been manageable since everybody would only contact the local sever to get the image. Is this assumption correct? Do most big service providers maintain their own content ser

Re: DNS Reliability

2013-09-23 Thread bmanning
On Mon, Sep 16, 2013 at 06:36:22PM +0200, Niels Bakker wrote: > * bmann...@vacation.karoshi.com (bmann...@vacation.karoshi.com) [Fri 13 Sep > 2013, 22:16 CEST]: > > from where? to where? what % of the Internet is _not_ > > reachable from my DNS service at any given time? why is > >

Re: iOS 7 update traffic

2013-09-23 Thread Ralph J.Mayer
> Perhaps Apple, Microsoft etc. should consider using Bittorrent as a > way of distributing their updates? If ISPs were to run their own > Bittorrent servers (with appropriate restrictions, see below), this > would then create an instant CDN, with no need to define any other > protocols or pay any

Re: iOS 7 update traffic

2013-09-23 Thread Simon Leinen
Glen Kent writes: > One of the earlier posts seems to suggest that if iOS updates were > cached on the ISPs CDN server then the traffic would have been > manageable since everybody would only contact the local sever to get > the image. Is this assumption correct? Not necessarily. I think most of

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Geoff Huston
On 23/09/2013, at 8:01 PM, Nick Hilliard wrote: > On 23/09/2013 00:15, John Curran wrote: >> Not being able to use 32-bit ASNs in your network and support systems will >> inevitably lead to confusion for those customers who are assigned them. > > I look forward to the day when we have proper

Re: iOS 7 update traffic

2013-09-23 Thread Leo Bicknell
On Sep 23, 2013, at 8:10 AM, Simon Leinen wrote: > Not necessarily. I think most of the iOS 7 update traffic WAS in fact > delivered from CDN servers (in particular Akamai). And many/most large > service providers already have Akamai servers in their networks. But > they may not have enough s

Re: iOS 7 update traffic

2013-09-23 Thread Glen Kent
BTW Linux distributions are available to download via bittorrent, so we dont really need Akamai/Limelight here. Is there a reason why Apple has not adopted bit-torrent for distribution? Are there legal/commercial implications using bit-torrent? Glen On Mon, Sep 23, 2013 at 4:29 PM, Neil Harris w

Re: iOS 7 update traffic

2013-09-23 Thread Joe Abley
On 2013-09-23, at 09:10, Simon Leinen wrote: > Glen Kent writes: >> One of the earlier posts seems to suggest that if iOS updates were >> cached on the ISPs CDN server then the traffic would have been >> manageable since everybody would only contact the local sever to get >> the image. Is this a

Re: iOS 7 update traffic

2013-09-23 Thread Carsten Bormann
On Sep 23, 2013, at 15:10, Simon Leinen wrote: > Glen Kent writes: >> One of the earlier posts seems to suggest that if iOS updates were >> cached on the ISPs CDN server then the traffic would have been >> manageable since everybody would only contact the local sever to get >> the image. Is this

Re: iOS 7 update traffic

2013-09-23 Thread Jared Mauch
On Sep 23, 2013, at 9:41 AM, Glen Kent wrote: > BTW Linux distributions are available to download via bittorrent, so we > dont really need Akamai/Limelight here. Is there a reason why Apple has not > adopted bit-torrent for distribution? Are there legal/commercial > implications using bit-torren

Re: iOS 7 update traffic

2013-09-23 Thread Jeroen Massar
On 2013-09-23 15:41 , Glen Kent wrote: > BTW Linux distributions are available to download via bittorrent, I am very sure that you will be happy to see your customer's UPSTREAM links filled with that traffic... next to you having a shiny CDN and then having to do traffic to ISPs who do not have on

Re: iOS 7 update traffic

2013-09-23 Thread Joe Abley
On 2013-09-23, at 09:41, Glen Kent wrote: > BTW Linux distributions are available to download via bittorrent, so we > dont really need Akamai/Limelight here. Is there a reason why Apple has not > adopted bit-torrent for distribution? Are there legal/commercial > implications using bit-torrent?

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Job Snijders
On Mon, Sep 23, 2013 at 11:28:58PM +1000, Geoff Huston wrote: > On 23/09/2013, at 8:01 PM, Nick Hilliard wrote: > > > I look forward to the day when we have proper 32 bit BGP community > > support and ASN32s finally become usable on nontrivial networks. > > > > Is there some reference that des

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Geoff Huston
On 24/09/2013, at 12:02 AM, Job Snijders wrote: > On Mon, Sep 23, 2013 at 11:28:58PM +1000, Geoff Huston wrote: > >> On 23/09/2013, at 8:01 PM, Nick Hilliard wrote: >> >>> I look forward to the day when we have proper 32 bit BGP community >>> support and ASN32s finally become usable on nontri

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Nick Hilliard
On 23/09/2013 15:14, Geoff Huston wrote: > I'm sorry, but I'm still confused, as I see your comment as one that relates > to the > size of the payload field here, as distinct from the support for 32 bit AS > numbers > per se. hence my original comment about being usable on nontrivial transit net

RE: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread R. Benjamin Kessler
I'd like to see an option for a larger private ASN block - 1K of private ASNs can be quite a pain in really large organizations. I have seen others mention this in the past - e.g. http://www.gossamer-threads.com/lists/cisco/nsp/158375 But apparently there's not enough traction to cause movement

Re: iOS 7 update traffic

2013-09-23 Thread Blake Dunlap
Bit torrent is a way to lighten the load on the originator, and to increase the speed of the acquisition from the receivers. It is not a tool to decrease network load, if anything it does the opposite most of the time. Every now and then, a client will find a local network peer, but its usually an

RE: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Leo Vegoda
Hi, R. Benjamin Kessler wrote: > I'd like to see an option for a larger private ASN block - > 1K of private ASNs can be quite a pain in really large organizations. > > I have seen others mention this in the past - e.g. > http://www.gossamer-threads.com/lists/cisco/nsp/158375 > > But apparently th

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Nick Hilliard
On 23/09/2013 15:30, R. Benjamin Kessler wrote: > I'd like to see an option for a larger private ASN block - 1K of private ASNs > can be quite a pain in really large organizations. > > I have seen others mention this in the past - e.g. > http://www.gossamer-threads.com/lists/cisco/nsp/158375 >

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Valdis . Kletnieks
On Mon, 23 Sep 2013 23:28:58 +1000, Geoff Huston said: > Is there some reference that describes the problems with the use of RFC5668? > I was not aware that there were residual issues here. I wonder what the correlation is between sites that haven't deployed 5668, sites that haven't deployed IPv6

Re: iOS 7 update traffic

2013-09-23 Thread Jay Ashworth
- Original Message - > From: "Mikael Abrahamsson" > To: "Paul Ferguson" > On Thu, 19 Sep 2013, Paul Ferguson wrote: > > Can someone please explain to a non-Apple person what the hell happened > > that started generating so much traffic? Perhaps I missed it in this > > thread, but I would

Re: d6991.com traffic

2013-09-23 Thread Paul Ferguson
On 9/23/2013 9:55 AM, Christopher Hunt wrote: Beginning about 0900UTC we began seeing about 50x our usual DNS traffic. 75% of the traffic is for d6991.com. Does anyone else see this? Who are these folks (WEBNIC.CC)? Maybe because of this mess? ;; Truncated, retrying in TCP mode. ; <<>

RE: d6991.com traffic

2013-09-23 Thread Meshier, Brent
Could be DNS packet tunneling to China, bad news. https://www.sans.org/reading-room/whitepapers/dns/detecting-dns-tunneling-34152 -Original Message- From: Christopher Hunt [mailto:dharmach...@gmail.com] Sent: Monday, September 23, 2013 11:55 AM To: nanog@nanog.org Subject: d6991.com traf

Re: d6991.com traffic

2013-09-23 Thread Dobbins, Roland
On Sep 24, 2013, at 12:11 AM, Chris Hunt wrote: > That is a problem, but I'm seeing a lot of queries from residential users for > what seems to me an obscure name hostied in Asia. I'm > guessing some kind of bot traffic... They may be open recursors being leveraged for DNS reflection/amplifica

Re: d6991.com traffic

2013-09-23 Thread Chris Hunt
That is a problem, but I'm seeing a lot of queries from residential users for what seems to me an obscure name hostied in Asia. I'm guessing some kind of bot traffic... -chris On 9/23/2013 10:09 AM, Paul Ferguson wrote: > On 9/23/2013 9:55 AM, Christopher Hunt wrote: > >> Beginning about 0900UTC

d6991.com traffic

2013-09-23 Thread Christopher Hunt
Beginning about 0900UTC we began seeing about 50x our usual DNS traffic. 75% of the traffic is for d6991.com. Does anyone else see this? Who are these folks (WEBNIC.CC)? -chris

Re: d6991.com traffic

2013-09-23 Thread Chris Adams
Once upon a time, Chris Hunt said: > That is a problem, but I'm seeing a lot of queries from residential > users for what seems to me an obscure name hostied in Asia. I'm > guessing some kind of bot traffic... Any of the affected users have open resolvers (on DSL routers for example)? -- Chris

Re: d6991.com traffic

2013-09-23 Thread Jared Mauch
On Sep 23, 2013, at 1:25 PM, Chris Adams wrote: > Once upon a time, Chris Hunt said: >> That is a problem, but I'm seeing a lot of queries from residential >> users for what seems to me an obscure name hostied in Asia. I'm >> guessing some kind of bot traffic... > > Any of the affected users

Re: d6991.com traffic

2013-09-23 Thread Alain Hebert
Well, There is a lot of those popping up in the past 6 months. I'm still running bindguard 0.71 and caught about 1300 targets of reflection DDoS in the past 24h. Beside using ". IN ANY" a lot are using "isc.org IN ANY" and some more that I won't list here =D Which should be

spam to nanog folks from qualisystems.com?

2013-09-23 Thread Scott Weeks
Did anyone else on this list get spam from qualisystems.com? It looks like they scraped technical mailing list addresses and I am trying to find out where. scott Received: from sjmda14.webex.com (sjmda14.webex.com [64.68.124.162])by dm0208.mta.everyone.net (EON-INBOUND) with ESMTP

NIH.gov

2013-09-23 Thread Eric Davis
Did anyone notice a problem getting to NIH.gov today? It seemed inaccessible from a lot of ISP's. Our grant writers were a little nervous about deadlines. Eric

Re: d6991.com traffic

2013-09-23 Thread fire-eyes
It's DNS reflection attack noise: http://dnsamplificationattacks.blogspot.com/2013/09/domain-d6991com.html This is a good blog for observing the domains and frequent correlation of items in whois and other traits that indicate much of this is done by the same actors. On 09/23/2013 12:55 PM,

Re: d6991.com traffic

2013-09-23 Thread Paul Ferguson
On 9/23/2013 5:01 PM, fire-eyes wrote: It's DNS reflection attack noise: http://dnsamplificationattacks.blogspot.com/2013/09/domain-d6991com.html This is a good blog for observing the domains and frequent correlation of items in whois and other traits that indicate much of this is done by the

Re: iOS 7 update traffic

2013-09-23 Thread Octavio Alvarez
That's just the typical Bittorrent /client/, but the idea of using Bittorrent means the /protocol/. A special Bittorrent client could be written for ISPs with uploads disabled and Apple could also disable them on the update-downloading Bittorrent client for the phones. The clients (be it Bittorren

Re: iOS 7 update traffic

2013-09-23 Thread Joe Greco
> That's just the typical Bittorrent /client/, but the idea of using > Bittorrent means the /protocol/. A special Bittorrent client could be > written for ISPs with uploads disabled and Apple could also disable them > on the update-downloading Bittorrent client for the phones. > > The clients (be

Re: iOS 7 update traffic

2013-09-23 Thread Jeff Kell
On 9/23/2013 9:36 PM, Joe Greco wrote: > So then all the networks that have done $things to BitTorrent to > demote it to second-rate traffic will suddenly have a bunch of very > angry Apple fans whose downloads are mysteriously having issues. Just ask the Blizzard fans (World of Warcraft) about th

Re: iOS 7 update traffic

2013-09-23 Thread Randy Bush
>> So then all the networks that have done $things to BitTorrent to >> demote it to second-rate traffic will suddenly have a bunch of very >> angry Apple fans whose downloads are mysteriously having issues. > Just ask the Blizzard fans (World of Warcraft) about this > phenomenon... i love the busi

Re: iOS 7 update traffic

2013-09-23 Thread Jay Ashworth
- Original Message - > From: "Randy Bush" > i love the business plan of preventing the users from getting what > they want. i think all my competitors should follow it. Strawman, Randy. Clearly, the Internet is *not* up to the task of 1) updating several dozen million devices 2) on l

Re: iOS 7 update traffic

2013-09-23 Thread Octavio Alvarez
On 09/23/2013 08:36 PM, Joe Greco wrote: >> That's just the typical Bittorrent /client/, but the idea of using >> Bittorrent means the /protocol/. A special Bittorrent client could be >> written for ISPs with uploads disabled and Apple could also disable them >> on the update-downloading Bittorrent