Re: iOS 7 update traffic

2013-09-23 Thread John Smith
Picked this off www.jaluri.com (network and Cisco blog aggregator): http://routingfreak.wordpress.com/2013/09/23/ios7s-impact-on-networks-worldwide/ The consensus seems to be for providers to install CDN servers, if they arent able to cope up with an occasional OS update traffic.

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Nick Hilliard
On 23/09/2013 00:15, John Curran wrote: Not being able to use 32-bit ASNs in your network and support systems will inevitably lead to confusion for those customers who are assigned them. I look forward to the day when we have proper 32 bit BGP community support and ASN32s finally become

Re: iOS 7 update traffic

2013-09-23 Thread Neil Harris
On 23/09/13 10:32, John Smith wrote: Picked this off www.jaluri.com (network and Cisco blog aggregator): http://routingfreak.wordpress.com/2013/09/23/ios7s-impact-on-networks-worldwide/ The consensus seems to be for providers to install CDN servers, if they arent able to cope up with an

Re: iOS 7 update traffic

2013-09-23 Thread Glen Kent
One of the earlier posts seems to suggest that if iOS updates were cached on the ISPs CDN server then the traffic would have been manageable since everybody would only contact the local sever to get the image. Is this assumption correct? Do most big service providers maintain their own content

Re: DNS Reliability

2013-09-23 Thread bmanning
On Mon, Sep 16, 2013 at 06:36:22PM +0200, Niels Bakker wrote: * bmann...@vacation.karoshi.com (bmann...@vacation.karoshi.com) [Fri 13 Sep 2013, 22:16 CEST]: from where? to where? what % of the Internet is _not_ reachable from my DNS service at any given time? why is that

Re: iOS 7 update traffic

2013-09-23 Thread Ralph J.Mayer
Perhaps Apple, Microsoft etc. should consider using Bittorrent as a way of distributing their updates? If ISPs were to run their own Bittorrent servers (with appropriate restrictions, see below), this would then create an instant CDN, with no need to define any other protocols or pay any

Re: iOS 7 update traffic

2013-09-23 Thread Simon Leinen
Glen Kent writes: One of the earlier posts seems to suggest that if iOS updates were cached on the ISPs CDN server then the traffic would have been manageable since everybody would only contact the local sever to get the image. Is this assumption correct? Not necessarily. I think most of the

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Geoff Huston
On 23/09/2013, at 8:01 PM, Nick Hilliard n...@foobar.org wrote: On 23/09/2013 00:15, John Curran wrote: Not being able to use 32-bit ASNs in your network and support systems will inevitably lead to confusion for those customers who are assigned them. I look forward to the day when we

Re: iOS 7 update traffic

2013-09-23 Thread Leo Bicknell
On Sep 23, 2013, at 8:10 AM, Simon Leinen simon.lei...@switch.ch wrote: Not necessarily. I think most of the iOS 7 update traffic WAS in fact delivered from CDN servers (in particular Akamai). And many/most large service providers already have Akamai servers in their networks. But they

Re: iOS 7 update traffic

2013-09-23 Thread Glen Kent
BTW Linux distributions are available to download via bittorrent, so we dont really need Akamai/Limelight here. Is there a reason why Apple has not adopted bit-torrent for distribution? Are there legal/commercial implications using bit-torrent? Glen On Mon, Sep 23, 2013 at 4:29 PM, Neil Harris

Re: iOS 7 update traffic

2013-09-23 Thread Joe Abley
On 2013-09-23, at 09:10, Simon Leinen simon.lei...@switch.ch wrote: Glen Kent writes: One of the earlier posts seems to suggest that if iOS updates were cached on the ISPs CDN server then the traffic would have been manageable since everybody would only contact the local sever to get the

Re: iOS 7 update traffic

2013-09-23 Thread Carsten Bormann
On Sep 23, 2013, at 15:10, Simon Leinen simon.lei...@switch.ch wrote: Glen Kent writes: One of the earlier posts seems to suggest that if iOS updates were cached on the ISPs CDN server then the traffic would have been manageable since everybody would only contact the local sever to get the

Re: iOS 7 update traffic

2013-09-23 Thread Jared Mauch
On Sep 23, 2013, at 9:41 AM, Glen Kent glen.k...@gmail.com wrote: BTW Linux distributions are available to download via bittorrent, so we dont really need Akamai/Limelight here. Is there a reason why Apple has not adopted bit-torrent for distribution? Are there legal/commercial implications

Re: iOS 7 update traffic

2013-09-23 Thread Jeroen Massar
On 2013-09-23 15:41 , Glen Kent wrote: BTW Linux distributions are available to download via bittorrent, I am very sure that you will be happy to see your customer's UPSTREAM links filled with that traffic... next to you having a shiny CDN and then having to do traffic to ISPs who do not have

Re: iOS 7 update traffic

2013-09-23 Thread Joe Abley
On 2013-09-23, at 09:41, Glen Kent glen.k...@gmail.com wrote: BTW Linux distributions are available to download via bittorrent, so we dont really need Akamai/Limelight here. Is there a reason why Apple has not adopted bit-torrent for distribution? Are there legal/commercial implications

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Job Snijders
On Mon, Sep 23, 2013 at 11:28:58PM +1000, Geoff Huston wrote: On 23/09/2013, at 8:01 PM, Nick Hilliard n...@foobar.org wrote: I look forward to the day when we have proper 32 bit BGP community support and ASN32s finally become usable on nontrivial networks. Is there some reference

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Geoff Huston
On 24/09/2013, at 12:02 AM, Job Snijders job.snijd...@atrato.com wrote: On Mon, Sep 23, 2013 at 11:28:58PM +1000, Geoff Huston wrote: On 23/09/2013, at 8:01 PM, Nick Hilliard n...@foobar.org wrote: I look forward to the day when we have proper 32 bit BGP community support and ASN32s

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Nick Hilliard
On 23/09/2013 15:14, Geoff Huston wrote: I'm sorry, but I'm still confused, as I see your comment as one that relates to the size of the payload field here, as distinct from the support for 32 bit AS numbers per se. hence my original comment about being usable on nontrivial transit

RE: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread R. Benjamin Kessler
I'd like to see an option for a larger private ASN block - 1K of private ASNs can be quite a pain in really large organizations. I have seen others mention this in the past - e.g. http://www.gossamer-threads.com/lists/cisco/nsp/158375 But apparently there's not enough traction to cause

Re: iOS 7 update traffic

2013-09-23 Thread Blake Dunlap
Bit torrent is a way to lighten the load on the originator, and to increase the speed of the acquisition from the receivers. It is not a tool to decrease network load, if anything it does the opposite most of the time. Every now and then, a client will find a local network peer, but its usually

RE: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Leo Vegoda
Hi, R. Benjamin Kessler wrote: I'd like to see an option for a larger private ASN block - 1K of private ASNs can be quite a pain in really large organizations. I have seen others mention this in the past - e.g. http://www.gossamer-threads.com/lists/cisco/nsp/158375 But apparently there's

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Nick Hilliard
On 23/09/2013 15:30, R. Benjamin Kessler wrote: I'd like to see an option for a larger private ASN block - 1K of private ASNs can be quite a pain in really large organizations. I have seen others mention this in the past - e.g. http://www.gossamer-threads.com/lists/cisco/nsp/158375 But

Re: 32-bit ASN acceptance by ISPs in ARIN region

2013-09-23 Thread Valdis . Kletnieks
On Mon, 23 Sep 2013 23:28:58 +1000, Geoff Huston said: Is there some reference that describes the problems with the use of RFC5668? I was not aware that there were residual issues here. I wonder what the correlation is between sites that haven't deployed 5668, sites that haven't deployed IPv6,

Re: iOS 7 update traffic

2013-09-23 Thread Jay Ashworth
- Original Message - From: Mikael Abrahamsson swm...@swm.pp.se To: Paul Ferguson fergdawgs...@mykolab.com On Thu, 19 Sep 2013, Paul Ferguson wrote: Can someone please explain to a non-Apple person what the hell happened that started generating so much traffic? Perhaps I missed it

Re: d6991.com traffic

2013-09-23 Thread Paul Ferguson
On 9/23/2013 9:55 AM, Christopher Hunt wrote: Beginning about 0900UTC we began seeing about 50x our usual DNS traffic. 75% of the traffic is for d6991.com. Does anyone else see this? Who are these folks (WEBNIC.CC)? Maybe because of this mess? ;; Truncated, retrying in TCP mode. ;

RE: d6991.com traffic

2013-09-23 Thread Meshier, Brent
Could be DNS packet tunneling to China, bad news. https://www.sans.org/reading-room/whitepapers/dns/detecting-dns-tunneling-34152 -Original Message- From: Christopher Hunt [mailto:dharmach...@gmail.com] Sent: Monday, September 23, 2013 11:55 AM To: nanog@nanog.org Subject: d6991.com

Re: d6991.com traffic

2013-09-23 Thread Dobbins, Roland
On Sep 24, 2013, at 12:11 AM, Chris Hunt wrote: That is a problem, but I'm seeing a lot of queries from residential users for what seems to me an obscure name hostied in Asia. I'm guessing some kind of bot traffic... They may be open recursors being leveraged for DNS

Re: d6991.com traffic

2013-09-23 Thread Chris Hunt
That is a problem, but I'm seeing a lot of queries from residential users for what seems to me an obscure name hostied in Asia. I'm guessing some kind of bot traffic... -chris On 9/23/2013 10:09 AM, Paul Ferguson wrote: On 9/23/2013 9:55 AM, Christopher Hunt wrote: Beginning about 0900UTC we

d6991.com traffic

2013-09-23 Thread Christopher Hunt
Beginning about 0900UTC we began seeing about 50x our usual DNS traffic. 75% of the traffic is for d6991.com. Does anyone else see this? Who are these folks (WEBNIC.CC)? -chris

Re: d6991.com traffic

2013-09-23 Thread Chris Adams
Once upon a time, Chris Hunt dharmach...@gmail.com said: That is a problem, but I'm seeing a lot of queries from residential users for what seems to me an obscure name hostied in Asia. I'm guessing some kind of bot traffic... Any of the affected users have open resolvers (on DSL routers for

Re: d6991.com traffic

2013-09-23 Thread Jared Mauch
On Sep 23, 2013, at 1:25 PM, Chris Adams c...@cmadams.net wrote: Once upon a time, Chris Hunt dharmach...@gmail.com said: That is a problem, but I'm seeing a lot of queries from residential users for what seems to me an obscure name hostied in Asia. I'm guessing some kind of bot traffic...

Re: d6991.com traffic

2013-09-23 Thread Alain Hebert
Well, There is a lot of those popping up in the past 6 months. I'm still running bindguard 0.71 and caught about 1300 targets of reflection DDoS in the past 24h. Beside using . IN ANY a lot are using isc.org IN ANY and some more that I won't list here =D Which should be

spam to nanog folks from qualisystems.com?

2013-09-23 Thread Scott Weeks
Did anyone else on this list get spam from qualisystems.com? It looks like they scraped technical mailing list addresses and I am trying to find out where. scott Received: from sjmda14.webex.com (sjmda14.webex.com [64.68.124.162])by dm0208.mta.everyone.net (EON-INBOUND) with ESMTP

NIH.gov

2013-09-23 Thread Eric Davis
Did anyone notice a problem getting to NIH.gov today? It seemed inaccessible from a lot of ISP's. Our grant writers were a little nervous about deadlines. Eric

Re: d6991.com traffic

2013-09-23 Thread fire-eyes
It's DNS reflection attack noise: http://dnsamplificationattacks.blogspot.com/2013/09/domain-d6991com.html This is a good blog for observing the domains and frequent correlation of items in whois and other traits that indicate much of this is done by the same actors. On 09/23/2013 12:55 PM,

Re: d6991.com traffic

2013-09-23 Thread Paul Ferguson
On 9/23/2013 5:01 PM, fire-eyes wrote: It's DNS reflection attack noise: http://dnsamplificationattacks.blogspot.com/2013/09/domain-d6991com.html This is a good blog for observing the domains and frequent correlation of items in whois and other traits that indicate much of this is done by the

Re: iOS 7 update traffic

2013-09-23 Thread Octavio Alvarez
That's just the typical Bittorrent /client/, but the idea of using Bittorrent means the /protocol/. A special Bittorrent client could be written for ISPs with uploads disabled and Apple could also disable them on the update-downloading Bittorrent client for the phones. The clients (be it

Re: iOS 7 update traffic

2013-09-23 Thread Joe Greco
That's just the typical Bittorrent /client/, but the idea of using Bittorrent means the /protocol/. A special Bittorrent client could be written for ISPs with uploads disabled and Apple could also disable them on the update-downloading Bittorrent client for the phones. The clients (be it

Re: iOS 7 update traffic

2013-09-23 Thread Jeff Kell
On 9/23/2013 9:36 PM, Joe Greco wrote: So then all the networks that have done $things to BitTorrent to demote it to second-rate traffic will suddenly have a bunch of very angry Apple fans whose downloads are mysteriously having issues. Just ask the Blizzard fans (World of Warcraft) about this

Re: iOS 7 update traffic

2013-09-23 Thread Randy Bush
So then all the networks that have done $things to BitTorrent to demote it to second-rate traffic will suddenly have a bunch of very angry Apple fans whose downloads are mysteriously having issues. Just ask the Blizzard fans (World of Warcraft) about this phenomenon... i love the business

Re: iOS 7 update traffic

2013-09-23 Thread Jay Ashworth
- Original Message - From: Randy Bush ra...@psg.com i love the business plan of preventing the users from getting what they want. i think all my competitors should follow it. Strawman, Randy. Clearly, the Internet is *not* up to the task of 1) updating several dozen million devices

Re: iOS 7 update traffic

2013-09-23 Thread Octavio Alvarez
On 09/23/2013 08:36 PM, Joe Greco wrote: That's just the typical Bittorrent /client/, but the idea of using Bittorrent means the /protocol/. A special Bittorrent client could be written for ISPs with uploads disabled and Apple could also disable them on the update-downloading Bittorrent client