Fwd: RE: [EXT] Fwd: Re: problems sending to prodigy.net hosted email

2018-03-20 Thread Stephen Satchell
Linux systems have the ability, given enough RAM, to associate almost any number of IP addresses to a given interface. Our IP allocation database kept track of who was using what IP address. I wrote some queries to collect all unassigned IP addresses, and to construct the appropriate shell co

Contacts at AS42624 Simple Carrier LLC ?

2018-03-20 Thread Sascha Pollok
Hi people! Did anyone have any encounter with AS42624 Simple Carrier LLC? They send some abusive and spoofed traffic. Looking at the usual databases it seems a bit unclear to me where the actually come from and how to reach them. Thanks & buh bye Sascha

Last call for presentations and Draft programme for RIPE 76

2018-03-20 Thread Benno Overeinder
Colleagues, A list of currently accepted RIPE 76 presentations is now published at: https://ripe76.ripe.net/programme/meeting-plan/plenary/ There are still plenary, BoF, tutorial and workshop slots remaining for the final RIPE 76 programme and RIPE Programme Committee will accept new proposals u

Re: hijacking of 128.255.192.0/22

2018-03-20 Thread Tim Evens
Looks like this incident didn't start today. I show it starting back on 2/22 at 00:31:38 UTC. It then persisted till 3/19 where it started to get withdrawn by most peers. It wasn't until 3/20 at 19:10:10 UTC when it was globally withdrawn from all peers that were advertising it. I'll be like Jo

Re: hijacking of 128.255.192.0/22

2018-03-20 Thread Sandra Murphy
You are pointing out that 138.255.192.0/22 is the likely cause of the hijack of 128.255.192.0/22, right? (No need to be privately told - that’s straight from the LACNIC Whois) —Sandy > On Mar 20, 2018, at 3:40 PM, Alejandro Acosta > wrote: > > Hello, > > Someone in Lacnog privately told m

Managing ARP traffic [ was Re: [EXT] Fwd: Re: problems sending to prodigy.net hosted email ]

2018-03-20 Thread Hugo Slabbert
On Tue 2018-Mar-20 17:15:25 +, Charles Bronson wrote: If this isn't pertinent to the list, feel free to answer privately. How did you implement the server that got rid of ARP storms? Perhaps something like an ARP sponge? https://ams-ix.net/technical/specifications-descriptions/controll

Re: hijacking of 128.255.192.0/22

2018-03-20 Thread Alejandro Acosta
Hello,   Someone in Lacnog privately told me this: aut-num: AS263971 owner: FaleMais Comunicações LTDA responsible: Paulo Henrique Mem Pereira owner-c: LEVAL5 routing-c: LEVAL5 abuse-c: LEVAL5 created: 20150831 changed: 20150831 inetnum: 138.255.192.0/22 inetnum: 2804:28a0::/32 inetnum: 170.254.

Re: hijacking of 128.255.192.0/22

2018-03-20 Thread João Butzke
I contacted the company and forwarded this email to them. Best regards, João Butzke. Em 20/03/2018 16:32, Job Snijders escreveu: On Tue, 20 Mar 2018 at 19:26, Ken Chase wrote: A reason to de-aggregate down to /24s, to make hijacks more difficult/less effective? Or perhaps something less cos

Re: hijacking of 128.255.192.0/22

2018-03-20 Thread Job Snijders
On Tue, 20 Mar 2018 at 19:26, Ken Chase wrote: > A reason to de-aggregate down to /24s, to make hijacks more difficult/less > effective? Or perhaps something less costly for everyone: a reason for HE to implement prefix-based EBGP filters? At any given moment there appear to be roughly 5500 pr

Re: hijacking of 128.255.192.0/22

2018-03-20 Thread Ken Chase
A reason to de-aggregate down to /24s, to make hijacks more difficult/less effective? /kc On Tue, Mar 20, 2018 at 04:20:47PM -0300, Alejandro Acosta said: >Hi Jay, > >?? Please note that there is Lacnog mailing list.., I will forward your >message. Not sure if it will work but worth givi

Re: hijacking of 128.255.192.0/22

2018-03-20 Thread Alejandro Acosta
Hi Jay,   Please note that there is Lacnog mailing list.., I will forward your message. Not sure if it will work but worth giving it a try. Regards, Alejandro, El 20/3/18 a las 2:35 p. m., Jay Ford escribió: > Something apparently in Brazil is hijacking 128.255.192.0/22, part of > 128.255.0.

hijacking of 128.255.192.0/22

2018-03-20 Thread Jay Ford
Something apparently in Brazil is hijacking 128.255.192.0/22, part of 128.255.0.0/16 which is held by the University of Iowa. AS 263971 is announcing 128.255.192.0/22 which Hurricane Electric is accepting & propagating. None of that has any authorization. I can't find any decent contact info

RE: [EXT] Fwd: Re: problems sending to prodigy.net hosted email

2018-03-20 Thread Charles Bronson
If this isn't pertinent to the list, feel free to answer privately. How did you implement the server that got rid of ARP storms? Charles Bronson -Original Message- From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Stephen Satchell Sent: Monday, March 19, 2018 9:31 PM To: nanog

Re: Spiffy Netflow tools?

2018-03-20 Thread Rick Coloccia
Also +1 for plixer scrutinizer. On 3/19/2018 10:16 AM, Gustavo Santos wrote: +1 for Plixer Scrutinizer 2018-03-17 19:42 GMT-03:00 Michael Krygeris : Disclaimer: Am Plixer engineer. If you want to take it for a spin, you can download a fully functional OVA/QCOW2 30 day eval from the plixer we