AS6517 - Reliance Globalcom -- routing three more hijacked blocks

2010-10-06 Thread Ronald F. Guilmette
Has anybody ever succeeded at sending any e-mail to the address? It doesn't seem to work for me. I just get undeliverable bounces. I'd like to, you know, at least inform them about all of these hijacked routes that _they_ are announcing, but I guess I need to do that via smoke signal or somethi

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Rich Kulawiec
On Wed, Oct 06, 2010 at 10:14:27PM +, Sven Olaf Kamphuis wrote: > (keep in mind, each sender gets a unique password from the receiver, > this can be stored in the address book along with the email address > itself). I'd like to see the I-D which explains how this is going to work, with particu

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Ben McGinnes
On 7/10/10 6:28 AM, Eric Brunner-Williams wrote: > On 10/6/10 10:34 AM, Owen DeLong wrote: >> >> Number resources are not and should not be associated with domain >> resources at the policy level. This would make absolutely no sense >> whatsoever. > > hmm. ... "are not" ... so the event complained

RE: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread George Bonser
> -Original Message- > From: Heath Jones > Sent: Wednesday, October 06, 2010 3:24 PM > To: nanog@nanog.org > Subject: Re: New hijacking - Done via via good old-fashioned Identity > Theft > > Wouldn't it have to be illegal before punishments could be determined? > Isn't this kind of key

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Randy Bush
> We get people calling our noc numbers pretty often trying to report > abuse for other people's networks... that is always fun >> not directly related, but i get occasional harrassing calls from >> mental/emotional children who are using whois. it's amusing but >> basically pathetic. no, i mean

RE: Facebook down!! Alert!

2010-10-06 Thread John van Oppen
The only way in which I can see facebook as required for operations is when one is hosting apps that must interact with the facbook API. Facebook is a site we keep an eye on from our NOC simply because it is important to a lot our larger transit customers due to them having apps that require

RE: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread John van Oppen
We get people calling our noc numbers pretty often trying to report abuse for other people's networks... that is always fun John van Oppen / AS11404 -Original Message- From: Randy Bush [mailto:ra...@psg.com] Sent: Wednesday, October 06, 2010 3:16 PM To: Matthew Huff Cc: ' (nanog@nanog

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Sven Olaf Kamphuis
- Exactly when and where did RIR whois databases gain any legal status as an authoritive source of information, rather than just an internal tool for network operators? (as far as i see, the rirs are legally nothing more than a collective of network operators, not an authority in any way). - E

Re: Facebook down!! Alert!

2010-10-06 Thread Bret Clark
On 10/06/2010 06:08 PM, Tammy A. Wisdom wrote: This thread proves too me yet again that nanog is the internets equivalent of a giant panty raid. This isn't the outages list& I am rather annoyed that we must discuss junk social media sites such as facebook. Just because you are panicing does

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Heath Jones
>>1) Is spamming from within the US criminal activity? > > Sadly, it appears not. > > In many cases it is however actionable.  (And in other cases involving > actual criminal activity, e.g. as prohibited by 18 USC 1030, `Fraud and > related activity in connection with computers', it may, I think, b

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Randy Bush
not directly related, but i get occasional harrassing calls from mental/emotional children who are using whois. it's amusing but basically pathetic. randy

Los Angeles Internet Exchanges

2010-10-06 Thread Mehmet Akcin
Hello, if you are somewhat involved with technical or non technical operations of IX points within Los Angeles / Orange County area, could you please contact me off-list? thank you. mehmet

Re: Facebook down!! Alert!

2010-10-06 Thread Quinn Kuzmich
Giant Panty Raid. Now I know what I'll be calling my weekend/overnight shifts. Who says being a Network Engineer can't be fun? Q On Wed, Oct 6, 2010 at 4:08 PM, Tammy A. Wisdom wrote: > > > This thread proves too me yet again that nanog is the internets equivalent > of a giant panty raid. Thi

Re: Facebook down!! Alert!

2010-10-06 Thread Tammy A. Wisdom
- Original Message - > From: "david raistrick" > To: "Andrew Kirch" > Cc: nanog@nanog.org > Sent: Wednesday, October 6, 2010 3:05:10 PM > Subject: Re: Facebook down!! Alert! > On Wed, 6 Oct 2010, david raistrick wrote: > > > On Wed, 6 Oct 2010, Andrew Kirch wrote: > > > >> No, the majo

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Ronald F. Guilmette
In message , Heath Jones wrote: >> Certainly, fine folks at Reliance Globalcom Services, Inc. could tell >> us who is paying them to connect these hijacked blocks to their network, >> but I rather doubt that they are actually going to come clean and do >> that. > >Ron, I haven't been following

Re: Facebook down!! Alert!

2010-10-06 Thread Dan White
On 06/10/10 17:05 -0400, david raistrick wrote: my point is that facebook has moved beyond being a pure content provider, and (much like, say, google) provide both content AND service. I have dependancies on facebook's (as do many many others who perhaps dont yet hire folks who even know what

RE: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread FEARGAL_LEDWIDGE
From: sc...@doc.net.au [mailto:sc...@doc.net.au] Sent: Wednesday, October 06, 2010 2:26 PM Subject: Re: Scam telemarketers spoofing our NOC phone number for callerid >There were some laws passed recently which makes "faking" caller-id illegal, >although I'm not sure exactly what the details are (

Re: Facebook down!! Alert!

2010-10-06 Thread Valdis . Kletnieks
On Wed, 06 Oct 2010 16:39:03 EDT, Andrew Kirch said: > No, the majority does not define what "operational" means. Facebook is > not a mission critical internet resource (such as a fiber cut, power > loss at a peering point, DoS attack. Yes, but anytime something spikes the number of calls at m

Re: Facebook down!! Alert!

2010-10-06 Thread Andrew Kirch
On 10/6/2010 5:05 PM, david raistrick wrote: > > > to be clear, I could give a damn about if we talk about this on nanog > or not. (and I agree that outages is the right place to announce > outages, and outage-discuss to discuss them). > > > my point is that facebook has moved beyond being a pure

Re: Facebook down!! Alert!

2010-10-06 Thread david raistrick
On Wed, 6 Oct 2010, david raistrick wrote: On Wed, 6 Oct 2010, Andrew Kirch wrote: No, the majority does not define what "operational" means. Facebook is not a mission critical internet resource (such as a fiber cut, power not a mission critical internet resource -to you- to be clear, I

RE: Facebook down!! Alert!

2010-10-06 Thread Nathan Eisenberg
> -Original Message- > From: Guerra, Ruben [mailto:ruben.gue...@arrisi.com] > Sent: Wednesday, October 06, 2010 1:47 PM > To: nanog@nanog.org > Subject: RE: Facebook down!! Alert! > > Passes Andrew the shotgun... Please kill all FB threads with it. :) > > The only thing I noticed being do

Re: Facebook down!! Alert!

2010-10-06 Thread david raistrick
On Wed, 6 Oct 2010, Andrew Kirch wrote: No, the majority does not define what "operational" means. Facebook is not a mission critical internet resource (such as a fiber cut, power not a mission critical internet resource -to you- -- david raistrickhttp://www.netmeister.org/news/lear

RE: Facebook down!! Alert!

2010-10-06 Thread Guerra, Ruben
Passes Andrew the shotgun... Please kill all FB threads with it. :) The only thing I noticed being down last night is battle.net ;). Guess you know where my priorities are. Lol -Rg -Original Message- From: Andrew Kirch [mailto:trel...@trelane.net] Sent: Wednesday, October 06, 2010 3:3

RE: Facebook down!! Alert!

2010-10-06 Thread Adcock, Matt [HISNA]
OpenDNS is my favorite for blocking things like FB and all sorts of other productivity killers. The information in this email and any attachments are for the sole use of the intended recipient and may contain privileged and confidential information. If you are not the intended recipient, any u

Re: Facebook down!! Alert!

2010-10-06 Thread Andrew Kirch
On 10/6/2010 4:33 PM, david raistrick wrote: > > so the majority defines operational now, huh? wow. nice to know that > network service providers outnumber other companies these days... (of > course, those service providers also make their money from facebook > consumers) No, the majority do

Re: Facebook down!! Alert!

2010-10-06 Thread david raistrick
On Wed, 6 Oct 2010, Matt Baldwin wrote: I would imagine more businesses benefit from a FB outage in terms of a tick up in productivity versus businesses harmed by a FB outage, e.g. Perhaps, then, we should instead be discussing the business benefits of blocking facebook so companies can regai

Re: Facebook down!! Alert!

2010-10-06 Thread david raistrick
On Wed, 6 Oct 2010, Greg Whynott wrote: just because you don't want to play facebook games doesn't make a facebook outage any less operationally relevant than, say, an akamai or limelight outage. IMO which may be way off base, when akamai goes off the air, people lose potential sales/revenu

Re: Facebook down!! Alert!

2010-10-06 Thread Jeff Harper
> From: "Mark" > It's back up. There goes that short burst of productivity. > > > On Oct 6, 2010, at 12:49 PM, Mark Hofman wrote: > > > Ditto In AU and from other reports US. > > Guess productivity will go up ;-) The irony is that the short burst of productivity was spent troubleshooting if F

Re: Facebook down!! Alert!

2010-10-06 Thread Greg Whynott
> just because you don't want to play facebook games doesn't make a facebook > outage any less operationally relevant than, say, an akamai or limelight > outage. IMO which may be way off base, when akamai goes off the air, people lose potential sales/revenue. when facebook goes off the

Re: Mobile Looking Glass?

2010-10-06 Thread axs8091
I've use the app "Traceroute" before which aggregates most of the major ISP's looking glass sites and seems to be pretty good about keeping on top of it to clean up the broken ones. http://remarkablepixels.com/traceroute On Wed, Oct 6, 2010 at 3:32 PM, Mike O'Connor wrote: > :Anyone know of an

Re: Facebook down!! Alert!

2010-10-06 Thread Matt Baldwin
I would imagine more businesses benefit from a FB outage in terms of a tick up in productivity versus businesses harmed by a FB outage, e.g. Zygna. So, net net a FB outage could be seen as a positive thing in the course of a work day. -matt On Wed, Oct 6, 2010 at 12:31 PM, david raistrick wrote

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread J. Oquendo
Scott Howard wrote: > On Wed, Oct 6, 2010 at 8:55 AM, Jon Lewis wrote: > > >> Some do. Anyone with control of a phone system with digital lines (i.e. >> asterisk with PRI) can trivially set callerID to whatever they want. There >> are perfectly legitimate, and not so legitimate uses for this.

Re: Mobile Looking Glass?

2010-10-06 Thread Mike O'Connor
:Anyone know of an iPhone application for checking public Looking Glass servers? : :Boss called me in a panic when I was out for lunch to check on something and would make my life much easier but searching for stuff on iTunes is awful. If you have an AIM or Jabber client on your iPhone, there's b

Re: Facebook down!! Alert!

2010-10-06 Thread david raistrick
On Wed, 6 Oct 2010, Bret Clark wrote: I have to agree on this as well. I can understand when a service provider is you've forgotten that facebook (and indeed twitter too) are service providers that provide business-critical services. just because you don't want to play facebook games doesn

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Eric Brunner-Williams
On 10/6/10 10:34 AM, Owen DeLong wrote: On Oct 6, 2010, at 6:35 AM, Ben McGinnes wrote: On 7/10/10 12:08 AM, Eric Brunner-Williams wrote: so ... should domains associated with asn(s) and addr block allocations be subject to some expiry policy other than "it goes into the drop pool and one of

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Scott Howard
On Wed, Oct 6, 2010 at 8:55 AM, Jon Lewis wrote: > Some do. Anyone with control of a phone system with digital lines (i.e. > asterisk with PRI) can trivially set callerID to whatever they want. There > are perfectly legitimate, and not so legitimate uses for this. > You don't even need the PRI.

Re: Facebook down!! Alert!

2010-10-06 Thread Greg Whynott
Especially for Facebook alerts.. You are propagating a false perception that everyone cares. -g On Oct 6, 2010, at 2:20 PM, christian koch wrote: > +1 > > > > On Wed, Oct 6, 2010 at 12:57 AM, Zaid Ali wrote: > >> I think the Outages mailing list is more appropriate for this. >> >>

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Graham Beneke
On 06/10/2010 17:15, William Herrin wrote: I had my unpublished asterisk box up for all of two days before getting half a megabit per second worth of false SIP registration attempts. The script kiddies and botnets seem to by trying hard. I started announcing a brand new RIR allocation about 4

Re: Facebook down!! Alert!

2010-10-06 Thread Bret Clark
I have to agree on this as well. I can understand when a service provider is having problems and people questioning it since that can affect many of us who depend on backbone connections, but sites like facebook and twitter being down should not be posted here but on the "sitesemployeeswastetim

Re: Mobile Looking Glass?

2010-10-06 Thread Jon Lewis
googling iphone bgp, this result looked promising, but don't waste your time. It appears to be more or less totally broken. http://grid5.wordpress.com/2009/02/04/bgp-released/ On Wed, 6 Oct 2010, Jared Mauch wrote: I have found the iSSH application (iPhone + iPad) works well. You can ssh tun

Re: Facebook down!! Alert!

2010-10-06 Thread christian koch
+1 On Wed, Oct 6, 2010 at 12:57 AM, Zaid Ali wrote: > I think the Outages mailing list is more appropriate for this. > > > On 10/5/10 9:46 PM, "Mike Lyon" wrote: > > > Same here in SF Bay Area > > > > On Tue, Oct 5, 2010 at 9:44 PM, James Smith >wrote: > > > >> At 1:20am here in Canada,

Re: Facebook down!! Alert!

2010-10-06 Thread Thomas Habets
On Wed, 6 Oct 2010, Mark Hofman wrote: Guess productivity will go up ;-) You'd think so, but my experience is that when Facebook goes down the whole company will leave their desks and go to the networking people to get them to fix the Facebook. And they won't leave until Facebook is back. -

Re: Mobile Looking Glass?

2010-10-06 Thread Jared Mauch
I have found the iSSH application (iPhone + iPad) works well. You can ssh tunnel for things (eg: VNC) with ssh keys, etc.. - Jared link: http://itunes.apple.com/us/app/issh-ssh-vnc-console/id287765826?mt=8 On Oct 6, 2010, at 1:44 PM, St. Onge,Adam wrote: > Anyone know of an iPhone application

Mobile Looking Glass?

2010-10-06 Thread St. Onge,Adam
Anyone know of an iPhone application for checking public Looking Glass servers? Boss called me in a panic when I was out for lunch to check on something and would make my life much easier but searching for stuff on iTunes is awful.

Re: 2010.10.06 NANOG50 day 3, Wednesday morning notes

2010-10-06 Thread jim deleskie
+1 On Wed, Oct 6, 2010 at 1:49 PM, Guerra, Ruben wrote: > Thanks for the notes Matt! :) > > > > -Original Message- > From: Matthew Petach [mailto:mpet...@netflight.com] > Sent: Wednesday, October 06, 2010 10:54 AM > To: nanog@nanog.org > Subject: 2010.10.06 NANOG50 day 3, Wednesday mornin

RE: 2010.10.06 NANOG50 day 3, Wednesday morning notes

2010-10-06 Thread Guerra, Ruben
Thanks for the notes Matt! :) -Original Message- From: Matthew Petach [mailto:mpet...@netflight.com] Sent: Wednesday, October 06, 2010 10:54 AM To: nanog@nanog.org Subject: 2010.10.06 NANOG50 day 3, Wednesday morning notes Thanks to everyone for a wonderful conference--this wraps the l

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread J. Oquendo
William Herrin wrote: > On Wed, Oct 6, 2010 at 10:37 AM, Dan White wrote: > >> If your PBX is SIP based, you might be victim of a SIP registration hijack, >> which are on the rise, based on traffic we've been seeing in our network. >> > > I had my unpublished asterisk box up for all of two

Re: 2010.10.06 NANOG50 day 3, Wednesday morning notes

2010-10-06 Thread David Conrad
On Oct 6, 2010, at 5:53 AM, Matthew Petach wrote: > Thanks again for a wonderful conference!! :) Thanks very much for the notes! Regards, -drc

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Joe Greco
> On Wed, 6 Oct 2010, Matthew Huff wrote: > > > Digital all the way through. No sip. No outside access to the PBX subnet > > either. Just a mininute ago our telco has verified that the calls are > > not orginating from out phone system. It's a simple caller id spoofing. > > People don't realize

RE: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Jon Lewis
On Wed, 6 Oct 2010, Matthew Huff wrote: Digital all the way through. No sip. No outside access to the PBX subnet either. Just a mininute ago our telco has verified that the calls are not orginating from out phone system. It's a simple caller id spoofing. People don't realize that caller id can

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Brielle Bruns
On 10/6/10 9:43 AM, Matthew Huff wrote: Digital all the way through. No sip. No outside access to the PBX subnet either. Just a mininute ago our telco has verified that the calls are not orginating from out phone system. It's a simple caller id spoofing. People don't realize that caller id can be

2010.10.06 NANOG50 day 3, Wednesday morning notes

2010-10-06 Thread Matthew Petach
Thanks to everyone for a wonderful conference--this wraps the last of NANOG50--see you all in Miami! Notes from this morning's session are posted at http://kestrel3.netflight.com/2010.10.06-NANOG50-morning-notes.txt sorry about the gaps, I kinda nodded off now and then--only got 2 hours of sleep

RE: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Matthew Huff
Digital all the way through. No sip. No outside access to the PBX subnet either. Just a mininute ago our telco has verified that the calls are not orginating from out phone system. It's a simple caller id spoofing. People don't realize that caller id can be spoofed and therefore are 100% sure th

RE: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Jon Lewis
On Wed, 6 Oct 2010, Matthew Huff wrote: Our system is PRI based, not sip. PRI for origination and termination...but what are your phones? Old school or VOIP/SIP? If your phone system supports SIP clients, it really ought to be IP restricted to only allow your phones access, or use somethi

RE: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Matthew Huff
Our system is PRI based, not sip. Matthew Huff   | One Manhattanville Rd OTA Management LLC | Purchase, NY 10577 http://www.ox.com | Phone: 914-460-4039 aim: matthewbhuff  | Fax:   914-460-4139 > -Original Message- > From: wher...@gmail.com [mailto:wher...@gmail.com] On Behalf

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread William Herrin
On Wed, Oct 6, 2010 at 10:37 AM, Dan White wrote: > If your PBX is SIP based, you might be victim of a SIP registration hijack, > which are on the rise, based on traffic we've been seeing in our network. I had my unpublished asterisk box up for all of two days before getting half a megabit per se

Re: Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Dan White
On 06/10/10 10:29 -0400, Matthew Huff wrote: We have recently gotten complaints of harrassing and high pressure sales scams orginating from our NOC's phone number. Since the number is a virtual number on the PBX, it can't be used for outgoing calls. I assume the scammers choose the number from

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Owen DeLong
On Oct 6, 2010, at 6:35 AM, Ben McGinnes wrote: > On 7/10/10 12:08 AM, Eric Brunner-Williams wrote: >> so ... should domains associated with asn(s) and addr block allocations >> be subject to some expiry policy other than "it goes into the drop pool >> and one of {enom,pool,...} acquire it (and t

Scam telemarketers spoofing our NOC phone number for callerid

2010-10-06 Thread Matthew Huff
We have recently gotten complaints of harrassing and high pressure sales scams orginating from our NOC's phone number. Since the number is a virtual number on the PBX, it can't be used for outgoing calls. I assume the scammers choose the number from the whois db. Anyone else seen this happening?

Re: Anyone can share the Network card experience

2010-10-06 Thread Joel Jaeggli
On 10/5/10 10:01 AM, Deric Kwok wrote: > Hi > > Anyone can share the Network card experience > > ls onborad PCI Expresscard better or Plug in slot PCI Express card good? both are likely to be pci-e x1 interfaces if it's a single or dual port chipset. > How are their performance in Gig transfer

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Ben McGinnes
On 7/10/10 12:08 AM, Eric Brunner-Williams wrote: > so ... should domains associated with asn(s) and addr block allocations > be subject to some expiry policy other than "it goes into the drop pool > and one of {enom,pool,...} acquire it (and the associated non-traffic > assets) for any interested

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Eric Brunner-Williams
so ... should domains associated with asn(s) and addr block allocations be subject to some expiry policy other than "it goes into the drop pool and one of {enom,pool,...} acquire it (and the associated non-traffic assets) for any interested party at $50 per /24"? Eric

Re: New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Heath Jones
> Certainly, fine folks at Reliance Globalcom Services, Inc. could tell > us who is paying them to connect these hijacked blocks to their network, > but I rather doubt that they are actually going to come clean and do > that. Ron, I haven't been following this anti-spam stuff much since it went po

New hijacking - Done via via good old-fashioned Identity Theft

2010-10-06 Thread Ronald F. Guilmette
[[ Note: There are three more apparently hijacked blocks that are related to the 75 specific blocks I am reporting on herein. I'll be reporting on those other three blocks later on, but right now I just want to keep it simple and report on just the ones relating to directnet.net. ]] S