Re: Router and Infrastructure Hacking (CCC conference last week)

2007-01-04 Thread Gadi Evron
On Thu, 4 Jan 2007, JP Velders wrote: > > defcon or CCC "extreme networking". > > For another form of "extreme networking", you could check out what's I "stole" the name from the programming world with "extreme coding". I somehow feel it fits. > built every year for the SC Conference: https://

Re: Router and Infrastructure Hacking (CCC conference last week)

2007-01-04 Thread Mikael Abrahamsson
On Fri, 5 Jan 2007, Gadi Evron wrote: Speaking of IPv4, an interesting thing from the CCC presentation was that the IPV6 space used equaled (if I got this right) the entire EU IPv6 normal use. Would this be that the 100-150 megabit/s of IPv6 used at 23C3 equaled the 100-150 megabit/s of IPv

Re: Router and Infrastructure Hacking (CCC conference last week)

2007-01-04 Thread Gadi Evron
On Thu, 4 Jan 2007, Amar wrote: > > Mattias Ahnberg wrote: > > > We've been given a /16 each time so each visitor has had a fully public IP, > > and the bandwidth has been provided by Telia the last couple of years. On > > the hardware side we've both built it all with Extreme Networks equipment

RIS [Re: AS41961 not seen in many networks]

2007-01-04 Thread Pekka Savola
On Thu, 4 Jan 2007, Jeroen Massar wrote: You could also check http://www.ris.ripe.net/ and use that tool to determine exactly which networks are not seeing you and then contact those operators to fix their setups. And for people not peering with RIS yet, PEER! (info at the url) Well, the undo

Re: Phishing and BGP Blackholing

2007-01-04 Thread Joseph S D Yao
On Thu, Jan 04, 2007 at 02:14:43PM +, [EMAIL PROTECTED] wrote: ... > > Anyway, I wouldn't write a letter with nothing worth reading on the > > first page. I don't write articles with nothing in the first > > paragraph. > > Nor do I, but there is a well-established tradition > in written Engl

Re: Phishing and BGP Blackholing

2007-01-04 Thread Joseph S D Yao
Somewhere in the following confused ramble may actually be the only cogent argument for top-posting I've seen. On Thu, Jan 04, 2007 at 09:52:29AM +, Alexander Harrowell wrote: > > For those of us who read nanog from a mobile device, it's incredibly > annoying to have no content in the first

Re: Routing Loop Strangeness

2007-01-04 Thread Justin M. Streiner
On Thu, 4 Jan 2007, Nachman Yaakov Ziskind wrote: 25 11.11.11.2 44 msec 26 11.11.11.1 48 msec 27 11.11.11.2 48 msec 28 11.11.11.1 48 msec Yep. Way cool. Unfortunately it's not the first time that: 1) someone with enable screwed up a routing design or did something dumb like dueling static

Re: Routing Loop Strangeness

2007-01-04 Thread Nachman Yaakov Ziskind
Elijah Savage wrote (on Thu, Jan 04, 2007 at 03:28:13PM -0500): > > Anyone else see this from their paths? > > vader# whois -h whois.cymru.com " -v 11.11.11.2" > AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name > NA | 11.11.11.2 | NA | US | arin | 1984-01-19 | NA > > #trace > Pro

Routing Loop Strangeness

2007-01-04 Thread Elijah Savage
Anyone else see this from their paths? vader# whois -h whois.cymru.com " -v 11.11.11.2" AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name NA | 11.11.11.2 | NA | US | arin | 1984-01-19 | NA #trace Protocol [ip]: Target IP address: 66.80.187.122 Source address: Numeric disp

Re: AS41961 not seen in many networks

2007-01-04 Thread Chris L. Morrow
On Thu, 4 Jan 2007 [EMAIL PROTECTED] wrote: > > > And aren't seen through gblx. I also think I can't see those prefixes > > through verizon. probably gustavo means verizonbusiness here, and probably vzb-US (as701), it's in 702 though. > > Also not seen via Telia (1299) or Level3 (3356). > > S

Re: AS41961 not seen in many networks

2007-01-04 Thread Jeremy Hanmer
not seeing any routes through Level3 or INAP On Jan 4, 2007, at 5:57 AM, Sebastian Rusek wrote: Hi, Since November 2006 we announce our 3 new prefixes: 194.60.78.0/24 194.60.204.0/24 194.153.114.0/24 from new AS41961. It seems that somewhere our announcements are blocked probably due t

Re: AS41961 not seen in many networks

2007-01-04 Thread Randy Bush
> Since November 2006 we announce our 3 new prefixes: > > 194.60.78.0/24 > 194.60.204.0/24 > 194.153.114.0/24 > > from new AS41961. you may want to use the views from route-views.org and ripe's ris project, as opposed to getting email from the very same folk who contribute to them :). looks to

Re: Router and Infrastructure Hacking (CCC conference last week)

2007-01-04 Thread JP Velders
On Wed, 3 Jan 2007, Gadi Evron wrote: > Date: Wed, 3 Jan 2007 17:16:04 -0600 (CST) > From: Gadi Evron <[EMAIL PROTECTED]> > Subject: Router and Infrastructure Hacking (CCC conference last week) > [ ... ] > 4. I do wish the talk on how CCC set up their multiple-uplink GigE network > for the confe

Re: AS41961 not seen in many networks

2007-01-04 Thread Elijah Savage
Not seen from ASN7046

Re: Router and Infrastructure Hacking (CCC conference last week)

2007-01-04 Thread Niels Bakker
* [EMAIL PROTECTED] (Mattias Ahnberg) [Thu 04 Jan 2007, 12:31 CET]: Amar wrote: You forgot to mention that there was also IPv6 connectivity ;-) *grin* How many kilobit IPv6 traffic did we push, you know? :P 23C3 did a few hundred Mbps - check the slides Gadi posted a link to. (Data was based

Re: Phishing and BGP Blackholing

2007-01-04 Thread Bill Nash
On Thu, 4 Jan 2007, Pete Templin wrote: > This "place" is full of people with opinions. Some like it hot, some like it > not. We are never going to agree on top/inline/bottom posting. > Why can't we all just get along and discuss operational issues? > Let's throw preference out the window a

Re: AS41961 not seen in many networks

2007-01-04 Thread Jeff Shultz
Qwest appears not show it (traceroute dies at the first IP in their network) and Cogent and LambdaNET show a jump from 90ms to 170ms between their networks (in two different places depending on IP tracerouted) - but it does go through. -- Jeff Shultz

Re: AS41961 not seen in many networks

2007-01-04 Thread Rick Ernst
Not seeing any of the routes, or any routes from AS41961. UUNET, Sprint, and AT&T connectivity. On Thu, January 4, 2007 05:57, Sebastian Rusek wrote: > > Hi, > > Since November 2006 we announce our 3 new prefixes: > > 194.60.78.0/24 > 194.60.204.0/24 > 194.153.114.0/24 > > from new AS41961. >

Re: AS41961 not seen in many networks

2007-01-04 Thread Andrew - Supernews
> "Sebastian" == Sebastian Rusek <[EMAIL PROTECTED]> writes: Sebastian> Hi, Sebastian> Since November 2006 we announce our 3 new prefixes: Sebastian> 194.60.78.0/24 Sebastian> 194.60.204.0/24 Sebastian> 194.153.114.0/24 Sebastian> from new AS41961. Sebastian> It seems that somewher

Re: AS41961 not seen in many networks

2007-01-04 Thread Jeroen Massar
Sebastian Rusek wrote: > Hi, > > Since November 2006 we announce our 3 new prefixes: [..] > Could you please check your configuration or help us to isolate the problem? You could also check http://www.ris.ripe.net/ and use that tool to determine exactly which networks are not seeing you and then

Re: AS41961 not seen in many networks

2007-01-04 Thread Marshall Eubanks
Yes, I should have made that clear, not received through Level 3 at AS 16517. (But, Cogent has them.) On Jan 4, 2007, at 11:25 AM, [EMAIL PROTECTED] wrote: And aren't seen through gblx. I also think I can't see those prefixes through verizon. Also not seen via Telia (1299) or Level3 (33

Re: AS41961 not seen in many networks

2007-01-04 Thread sthaug
> And aren't seen through gblx. I also think I can't see those prefixes > through verizon. Also not seen via Telia (1299) or Level3 (3356). Steinar Haug, Nethelp consulting, [EMAIL PROTECTED]

Re: AS41961 not seen in many networks

2007-01-04 Thread Gustavo Rodrigues Ramos
And aren't seen through gblx. I also think I can't see those prefixes through verizon. Gustavo. Marshall Eubanks wrote: > > They are seen here, through Cogent : > > *> 194.60.78.0 38.101.161.1164001 0 174 13237 > 41961 i > *> 194.60.204.0 38.101.161.1164001

Re: AS41961 not seen in many networks

2007-01-04 Thread Donald Stahl
now pingable addresses are: 194.60.78.254 194.60.204.254 194.153.114.254 From one location, things die as soon as they hit AT&T, another location things work perfectly. I have a couple of networks off AT&T and I am not seeing these routes in my tables. I do see them off other networks, howeve

Re: AS41961 not seen in many networks

2007-01-04 Thread Josh Cheney
Sebastian Rusek wrote: Dnia czwartek 04 stycznia 2007 15:06, napisałeś: [EMAIL PROTECTED] (Sebastian Rusek) wrote: Since November 2006 we announce our 3 new prefixes: 194.60.78.0/24 194.60.204.0/24 194.153.114.0/24 from new AS41961. It seems that somewhere our announcements are blocked prob

Re: AS41961 not seen in many networks

2007-01-04 Thread sthaug
> now pingable addresses are: > 194.60.78.254 > 194.60.204.254 > 194.153.114.254 > > They should be accessible via LambdaNET. Routes inside LambdaNET can be > diffrent to each address. Everything looks fine from here (AS 2116), prefixes reachable and addresses pingable. Example traceroute below

Re: AS41961 not seen in many networks

2007-01-04 Thread Sebastian Rusek
Dnia czwartek 04 stycznia 2007 15:06, napisałeś: > [EMAIL PROTECTED] (Sebastian Rusek) wrote: > > Since November 2006 we announce our 3 new prefixes: > > > > 194.60.78.0/24 > > 194.60.204.0/24 > > 194.153.114.0/24 > > > > from new AS41961. > > > > It seems that somewhere our announcements are bloc

Re: Phishing and BGP Blackholing

2007-01-04 Thread Michael . Dillon
> (All right then, scroll down for content :-)) It is not necessary to quote an entire message when you are only replying to one specific part of it. > Minority? A mail client has been standard-ish for the last three to > four years of upgrade iterations. There are a LOT of mobiles out > there.

Re: AS41961 not seen in many networks

2007-01-04 Thread Marshall Eubanks
They are seen here, through Cogent : *> 194.60.78.0 38.101.161.1164001 0 174 13237 41961 i *> 194.60.204.0 38.101.161.1164001 0 174 13237 41961 i *> 194.153.114.038.101.161.1164001 0 174 13237 41961 i Regards Marsha

Re: Phishing and BGP Blackholing

2007-01-04 Thread Pete Templin
Alexander Harrowell wrote: Anyway, I wouldn't write a letter with nothing worth reading on the first page. I don't write articles with nothing in the first paragraph. Why should over a billion users of the English language, etc, etc.. We're not talking about a letter or an article. We're tal

Re: AS41961 not seen in many networks

2007-01-04 Thread Elmar K. Bins
Hi Sebastian, [EMAIL PROTECTED] (Sebastian Rusek) wrote: > Since November 2006 we announce our 3 new prefixes: > > 194.60.78.0/24 > 194.60.204.0/24 > 194.153.114.0/24 > > from new AS41961. > > It seems that somewhere our announcements are blocked probably due to bogon > lists. To make it ea

AS41961 not seen in many networks

2007-01-04 Thread Sebastian Rusek
Hi, Since November 2006 we announce our 3 new prefixes: 194.60.78.0/24 194.60.204.0/24 194.153.114.0/24 from new AS41961. It seems that somewhere our announcements are blocked probably due to bogon lists. Our ASN is is in AS block allocated by RIPE on 13 April 2006 then somebody can have it

Re: Phishing and BGP Blackholing

2007-01-04 Thread Alexander Harrowell
(All right then, scroll down for content :-)) On 1/4/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > For those of us who read nanog from a mobile device, it's incredibly > annoying to have no content in the first few bytes - a lot of mobile > e-mail clients (all MS Windows Mobile 5 devices

Re: NATting a whole country?

2007-01-04 Thread Iljitsch van Beijnum
On 4-jan-2007, at 14:37, [EMAIL PROTECTED] wrote: all of Qatar appears on the net as a single IP address. I wonder what they use the other 241663 addresses for. To address the many machines and networks in Qatar. The existence of a NAT gateway to one portion of the Internet does not remov

Re: Phishing and BGP Blackholing

2007-01-04 Thread Michael . Dillon
> For those of us who read nanog from a mobile device, it's incredibly > annoying to have no content in the first few bytes - a lot of mobile > e-mail clients (all MS Windows Mobile 5 devices and every Blackberry > I've seen) pull the first 0.5KB of each message, i.e. the header, > subject line an

Re: NATting a whole country?

2007-01-04 Thread Michael . Dillon
> > all of Qatar appears on the net as a single IP address. > > I wonder what they use the other 241663 addresses for. Same as you. To address the many machines and networks in Qatar. The existence of a NAT gateway to one portion of the Internet does not remove the need for registered IP addres

Re: Router and Infrastructure Hacking (CCC conference last week)

2007-01-04 Thread Mattias Ahnberg
Amar wrote: > You forgot to mention that there was also IPv6 > connectivity ;-) *grin* How many kilobit IPv6 traffic did we push, you know? :P -- /ahnberg.

Re: Router and Infrastructure Hacking (CCC conference last week)

2007-01-04 Thread Amar
Mattias Ahnberg wrote: We've been given a /16 each time so each visitor has had a fully public IP, and the bandwidth has been provided by Telia the last couple of years. On the hardware side we've both built it all with Extreme Networks equipment and Cisco (and a mix of both). You forgot to m

Re: Router and Infrastructure Hacking (CCC conference last week)

2007-01-04 Thread Mattias Ahnberg
Gadi Evron wrote: > 4. I do wish the talk on how CCC set up their multiple-uplink GigE network >for the conference was filmed, I call this type of "create an ISP in 24 >hours", in a very very hostile and busy environment such as at >defcon or CCC "extreme networking". We do the same f

Re: Phishing and BGP Blackholing

2007-01-04 Thread Alexander Harrowell
For those of us who read nanog from a mobile device, it's incredibly annoying to have no content in the first few bytes - a lot of mobile e-mail clients (all MS Windows Mobile 5 devices and every Blackberry I've seen) pull the first 0.5KB of each message, i.e. the header, subject line and the fir