Re: The curious case of 159.174.0.0/16
- On Feb 1, 2020, at 1:54 PM, Pavel Lunin plu...@plunin.net wrote: Hi Pavel, > On Wednesday, January 29, 2020 5:15 PM, Sabri Berisha > wrote: > >> I'm surprised about the lack of response from FT/DT though. > > And now multiply this by 3, because DT and ARIN are no better. I appreciate your contempt for corporate entities. It seems however, that you forget one important aspect here: most corporations are carefully organized to ensure all assets are properly used to generate revenue. In this case, IP space is an asset which can bring (or secure current) revenue streams. This is the reason why I'm surprised. Thanks, Sabri
Re: The curious case of 159.174.0.0/16
On Wednesday, January 29, 2020 5:15 PM, Sabri Berisha
wrote:
> I'm surprised about the lack of response from FT/DT though.
Side note: sending an email to Orange has a strong chance to never get to the
destination. There is a tiny "if( rand() > 0.2*RAND_MAX )
message.moveto("/dev/null");" somewhere in their corporate e-mail server
config, which makes them do even more conf-calls (what do you want, it's a
phone company before all). If they can't even fix this, you can imagine what it
whould take for a 150k employee corporation to resolve a complex problem like
the one described above.
And now multiply this by 3, because DT and ARIN are no better. I wonder if it's
a coincidence or these two clever Turkish gentlemen have deliberately chosen
the case where FT+DT+ARIN bureaucracies need to agree upon something in order
to act against them together. Infinite number of conf-calls between the three
countries (four, if we count Turkey) on two continents (three if we count
Istanbul) is a 100% guarantee that nobody will ever do anything about this.
--
Pavel
Re: The curious case of 159.174.0.0/16
Could not have worded it better myself. On Wed, 29 Jan 2020 16:30:22 + Mel Beckman wrote: > Then why are you sending email to nanog@nanog.org? > > LOL! > > -mel > > > On Jan 29, 2020, at 12:41 AM, Ronald F. Guilmette > > wrote: > > > > I have a standing policy of never attempting to converse with unaccountable > > anonymized role accounts. Based on past experience, this is without > > exception an utter waste of my time. -- Large Hadron Collider
Re: The curious case of 159.174.0.0/16
Then why are you sending email to nanog@nanog.org? LOL! -mel > On Jan 29, 2020, at 12:41 AM, Ronald F. Guilmette > wrote: > > I have a standing policy of never attempting to converse with unaccountable > anonymized role accounts. Based on past experience, this is without > exception an utter waste of my time.
Re: The curious case of 159.174.0.0/16
> > If you always e-mail j...@telco.com instead of n...@telco.com for your > issues, you may end of in a situation where Jake is gone, on vacation, or > simply moved on to accounting. Plus, Jake hates this. He might pretend to be your friend but he's getting paid to do that. Nothing more annoying than having a customer demand to work with Jake when Jake has 20 other things going on and literally anyone else on the team can help you. Once you're known within the right team, it should be easy to get prompt > responses. Exactly. Show the team that you know what you're talking about and that you're not belligerent and people will be more than happy to work with you. - Mike Bolitho On Wed, Jan 29, 2020 at 9:16 AM Sabri Berisha wrote: > - On Jan 29, 2020, at 12:40 AM, Ronald F. Guilmette > r...@tristatelogic.com wrote: > > Hi, > > > (I have a standing policy of never attempting to converse with > unaccountable > > anonymized role accounts. Based on past experience, this is without > > exception an utter waste of my time.) > > In the real world, this should be the exact opposite. People move teams, > leave companies. If you always e-mail j...@telco.com instead of > n...@telco.com for your issues, you may end of in a situation where Jake > is gone, on vacation, or simply moved on to accounting. Once you're known > within the right team, it should be easy to get prompt responses. > > I'm surprised about the lack of response from FT/DT though. > > Thanks, > > Sabri >
Re: The curious case of 159.174.0.0/16
- On Jan 29, 2020, at 12:40 AM, Ronald F. Guilmette r...@tristatelogic.com wrote: Hi, > (I have a standing policy of never attempting to converse with unaccountable > anonymized role accounts. Based on past experience, this is without > exception an utter waste of my time.) In the real world, this should be the exact opposite. People move teams, leave companies. If you always e-mail j...@telco.com instead of n...@telco.com for your issues, you may end of in a situation where Jake is gone, on vacation, or simply moved on to accounting. Once you're known within the right team, it should be easy to get prompt responses. I'm surprised about the lack of response from FT/DT though. Thanks, Sabri
The curious case of 159.174.0.0/16
[[ Fair warning to newcomers: I write and post longish pieces here
regarding my various investigations of funny business I find going
on within the IPv4 address space and the allocations and uses thereof.
If you're looking for a quick 2 minute read then you are advised to
skip this message now. ]]
I confess that I have been meaning to write about the 159.174.0.0/16
legacy IPv4 block for quite some time now. What can I say? I was busy.
The Present State of 159.174.0.0/16
---
I discovered quite some long time ago that this block was getting routing
from a rather unusual place, and that the ASN in question was also
announcing a few other nice juicy /16 legacy blocks, which by itself
was more than a little suspicious. But that's not imporant now. Please
allow me to just talk about who is routing this block at present, and
who the alleged legitimate registrants are, going by ARIN's relevant
current WHOIS record for this block:
https://pastebin.com/raw/FBWMN9p3
As you can see, this block is registered to an entity located in Wilton,
Connecticut. The block appears to have been originally assigned on
1992-05-11, well before the formation of ARIN. It is thus an unusually
valuable "legacy" block.
The first indication that something might be a bit off about this block
is the contact phone number, +1-407-476-9854. In this modern era of
number portability the area code portion of that may or may not have
any real-world geographical implications at all, but it turns out to
be notable, in this case, that area code 407 corresponds, historically,
to the greater Orlando, Florida area and surrounding Florida counties.
A quick bit of research reveals that there is in fact an entity calling
itself Dunsnet, LLC and that it is located in Winter Park, Florida,
a northern suburb of Orlando:
http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName=Initial=DUNSNET%20L120001007590=flal-l12000100759-15618501-6ea8-4b18-898e-6470337507d1=dunsnet=DUNSNET%20L120001007590
Further research on the Florida Secretary of State's web site confirms that
this entity does exist, that it is "active", and that it has one and only
one manager, that being another corporate entity called Ahosting, Inc.:
http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName=Initial=AHOSTING%20P070001262120=domp-p07000126212-a6386b50-075c-4b07-b36e-ff5a3ba1b33c=ahosting=AHOSTING%20P070001262120
As you can see via the above link, Ahosting, Inc. has only two corporate
directors, i.e. a Mr. Erkan Ozdogan and a Mr. Adnan Canturk, both
apparently residents of Istanbul, Turkey.
At the present time, 100% of the 159.174.0.0/16 legacy block is being routed
by AS54163, aka Ahosting, Inc.:
https://bgp.he.net/AS54163#_prefixes
The question is: Is this proper?
A Brief History of 159.174.0.0/16
-
When the 159.174.0.0/16 block was first allocated and registered, way back
on 1992-05-11 it was assigned at that time to a unit of the famous Dun &
Bradstreet financial information company for use in connection with one
of the company's early forays into the world of the Internet:
Fortune Magazine, August 19, 1985:
https://archive.fortune.com/magazines/fortune/fortune_archive/1985/08/19/66327/index.htm
"Dun & Bradstreet also operates DunsNet, a $20- million private
telecommunications network completed in March, which connects
customers in 155 cities directly to the company's mainframes."
On June 8th, 1994, Dun & Bradstreet's "Dunsnet" operation announced that
it had elected to partner with a European company named Eunetcom SA, which
was itself a partnership between Deutsche Bundespost Telekom and France
Telecom:
https://www.cbronline.com/news/eunetcom_wins_dunsnet_pact/
In August, 1994, Eunetcom apparently elected to buy out its customer,
Dunsnet:
"The Information Superhighway" (Randall L. Carlson - 1996)
https://bit.ly/2O7kV48
"Eunetcom is actively pursuing customers and entry into the North
American market. Its first customer was worth $200 million over
five years and was {subequently} acquired by purchasing the
networking services of Dun & Bradstreet's DunsNet. DunsNet
provides data communications services for the Dun & Bradstreet
companies, a role that Eunetcom now assumes."
https://www.postjobfree.com/resume/pumacu/unix-administrator-technical-analyst-reg-shelton
"In August 1994, DunsNet was acquired by eunetcom, a joint venture
between Deutsche Telekom and France Telecom."
As we all know, unlike the situation today, IPv4 blocks in the 1990s had
essentially no monetary value. And thus the 159.174.0.0/16 block became
forgotten and abandoned by its rightful owners, which is to say Deutsche
Telekom and France Telecom.
Fast forward some 16 years to June 29, 2011, on which
