Re: anybody from Amsterdam Internet Exchange (ams-ix) to help?
Dear Shahab, Please conact me directly kind regards - Henk Steenman, AMS-IX On 19 sep. 2013, at 07:05, Shahab Vahabzadeh wrote: > Hello Everybody, > Is there anybody from Amsterdam IX here? > I have some questions about concept of IXP. > If anybody else have enough information about IXP's please give me message > off the list. > Thanks > > -- > Regards, > Shahab Vahabzadeh, Network Engineer and System Administrator > > Cell Phone: +1 (415) 871 0742 > PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90
anybody from Amsterdam Internet Exchange (ams-ix) to help?
Hello Everybody, Is there anybody from Amsterdam IX here? I have some questions about concept of IXP. If anybody else have enough information about IXP's please give me message off the list. Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: +1 (415) 871 0742 PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90
Re: The block message is 521 DNSRBL: Blocked for abuse
In message <523a6203.8090...@trelane.net>, Andrew D Kirch writes: > On 9/18/2013 9:02 PM, John Levine wrote: > >> This is pathetic. ARIN is supposed to be working as a steward of this > >> IP space. When you have policies that make it more difficult to use the > >> IP space this isn't even remotely close to stewardship. It's pathetic, > > Unfortunately, a surprising number of "new" IP space owners turn out > > to be the sleazy old IP space owners under a differnt fake name. > > > > R's, > > John > or put another way, spammers lie. > > Andrew Which is irrelevent to removing a address block on the basis of a RIR recording that the block has been reallocated. A reallocation already goes through a quarantine period though that may get shorter as time goes on. A transfer on the other hand doesn't. There may be some use in recording whether a address block is transfered or allocated. Note I'm not sure if the allocation date gets updated on a transfer or not. There may be some use in recording when a address block is quarantined. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
Re: The block message is 521 DNSRBL: Blocked for abuse
On 9/18/2013 9:02 PM, John Levine wrote: This is pathetic. ARIN is supposed to be working as a steward of this IP space. When you have policies that make it more difficult to use the IP space this isn't even remotely close to stewardship. It's pathetic, Unfortunately, a surprising number of "new" IP space owners turn out to be the sleazy old IP space owners under a differnt fake name. R's, John or put another way, spammers lie. Andrew
Re: common method to count traffic volume on IX
> you gotta love the amsix hkg charlie foxtrot. and how is that working out financially for the amsix members, the folk in the amsterdam area the amsix purportedly serves, niels? randy
Re: The block message is 521 DNSRBL: Blocked for abuse
>This is pathetic. ARIN is supposed to be working as a steward of this >IP space. When you have policies that make it more difficult to use the >IP space this isn't even remotely close to stewardship. It's pathetic, Unfortunately, a surprising number of "new" IP space owners turn out to be the sleazy old IP space owners under a differnt fake name. R's, John
Re: The block message is 521 DNSRBL: Blocked for abuse
On 9/18/2013 8:16 PM, Tammy Firefly wrote: > On 9/18/13 6:10 PM, David Miller wrote: > > >> On 9/18/2013 7:30 PM, Andrew D Kirch wrote: >>> On 9/18/2013 7:15 PM, Tammy Firefly wrote: On 9/18/13 5:07 PM, Andrew D Kirch wrote: > On 9/18/2013 6:55 PM, Tammy Firefly wrote: >>> I used to run the AHBL and ARIN used to contact us when >>> they recycled IP space. We always removed when contacted >>> by ARIN. >>> >>> Andrew >>> >> ARIN hasnt contacted us for this since i've been involved >> with the ahbl for ~5 years. just a FYI. > Well, it'd seem we found the problem then. > > Andrew > Ive know ARIN is a problem for a lotta years andrew :P When we contacted them and asked them to do it again we got told its against policies blablablabla. >>> (replying to list with Tammy's permission) This is pathetic. >>> ARIN is supposed to be working as a steward of this IP space. >>> When you have policies that make it more difficult to use the IP >>> space this isn't even remotely close to stewardship. It's >>> pathetic, with the policy making a quick turn around of releasing >>> old IP space when you get an allocation, that ARIN is leaving >>> innocent third parties who have paid ARIN large sums of money for >>> this space. ARIN, frankly you can suck it. It's time to grow up >>> and behave how you were intended to. >>> >>> Andrew >>> > >> If only there was a way for anyone to get a daily report of number >> resource allocations... > >> https://lmddgtfy.net/?q=daily%20internet%20number%20resource%20allocation%20report > >> First link. > >> -DMM > > > Those also are statistics not actual IP block numbers being > deallocated/allocated. > > The Status Reports (PDFs) down the page are statistics, updated quarterly. At the top of the page is the delegated-extended daily report. "The file delegated-extended contains a daily updated report of the distribution of Internet number resources. The resources reported are: IPv4 address ranges (IPv4) IPv6 address ranges (IPv6) Autonomous System Numbers (ASNs)" That file is text. The lines for IPv4 look like: apnic|AU|ipv4|1.0.0.0|256|20110811|assigned|A9173591|e-stats apnic|CN|ipv4|1.0.1.0|256|20110414|assigned|A92E1062|e-stats apnic|CN|ipv4|1.0.2.0|512|20110414|assigned|A92E1062|e-stats The Readme file explains the fields: http://www.nro.net/wp-content/uploads/nro-extended-stats-readme5.txt 4th field is start IP 5th field is number of IPs in block 6th field is date of allocation/assignment I would think that file might be parsed, compared to RBL listings, and if listing date (or last bad behavior date) < allocation/assignment date - then remove listing. -DMM signature.asc Description: OpenPGP digital signature
Re: The block message is 521 DNSRBL: Blocked for abuse
Quite unfortunate.. These days, when allocated 'new' IPV4 space you really have to do a little homework to make sure it 'clean'. I would suggest that you run your CIDR block through http://multirbl.valli.org/lookup/. IF it's mostly clean and not on hardcore lists such as SpamHaus ROKSO, then there's hope. Whatever lists your netblock is on you will just have to contact thier abuse dept. and explain your predicament and stay on top of it. Sounds like you are well on your way to doing that.. Good luck. Carlos. On Wed, Sep 18, 2013 at 04:07:25PM +, NANOG wrote: > We recently purchased new IP addresses from ARIN, with plans on using one of > them for our external and internal email delivery. We set up a reverse > lookup and a SPF record for the newly purchased IP to prevent being > classified as spam. We tested the functionality of the PTR and SPF record > successfully using varies internet tools like dnsstuff.com, mxtoolbox.com, > and kitterman.com. Unfortunately, when we send emails to any AT&T or Network > Solutions hosted email we are being block as a spam abuser. I checked varies > spam database tools and our IP addresses are not listed, but we are still > being blocked by both AT&T and Network Solution. The block message is 521 > DNSRBL: Blocked for abuse. In an attempt to be proactive, I contacted > Network Solution and was told that each recipient would have to request we be > whitelisted, and AT&T directed me to an online form that I submitted to be > removed from the blacklist. Unfortunately, we are still not able to send > emails to either AT&T or Network Solutions hosted emails. Our mail server IP > address is 74.112.99.25, which resolves to mail.abcsupply.com. Does anyone > have any suggestions on where to turn next? Is it possible they are blocking > us based on old information from the previous IP address block owner? Any > help tracking this down would be appreciated. > > > Derrick Wash > Microsoft Systems Administrator > ABC Supply Company Inc > Office: (608)368-2214 > Fax: (608)363-0214
Re: common method to count traffic volume on IX
>> somehow, a serious case of testosterone poisoning combined with insane >> goal drift has hit a number of the large european exchanges. instead of >> the goal being how well they serve their local communities, they have >> gone wild with sleazy means of having traffic contests, doing really >> sick attempts at techno-colonial expansion into foreign countries and >> continents, ... instead of running a public service, they think they >> are running competitive commercial enterprises. imiho, the members >> should be up in arms. >> >> if you are jealous of commercial expansion, then send your resume to >> equinix. sheesh! > > Wow Randy, you really misunderstand the situation in Europe and the > reasons behind the horizon expansions, and I'm surprised by your > advocacy of American hegemony in a market where that really doesn't > exist (those of independent not-for-profit internet exchanges). yes, the american hegemony in angola, kenya, hong kong, ... you gotta love the amsix hkg charlie foxtrot. trying to open up the us market by going to the states to enter it is a fun adventure. but as it's a rather crowded market, it's not for the faint of heart. but it is a market that would benefit from a bit more competition. and puhleeze get more competition into tokyo, jeez! but i think it is crazy for a local european exchange to take on the white man's burden of exporting freedom to virginia (or wherever), especially without bombing it first. randy
Re: The block message is 521 DNSRBL: Blocked for abuse
On 9/18/2013 8:16 PM, Tammy Firefly wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Those also are statistics not actual IP block numbers being deallocated/allocated. -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.20 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSOkJqAAoJEHJ/lMQe1SM0PlIH/0DXHqPkIaVIh0poaj5w0oDM Y/PrbpMu16D+ga2HR0KQtrWglNacOg+VxDikTJMgYYhDmscVd8Y+inCyQpAW4ok6 2MaZeKMf5PEkkBkWh2M7703ljQ6ajDae+xTKJgXM0A4CaEkKlFgjxJ9t3+Wad+BC c5Xso50sVbeT0PG0Xd/6BHchg6kZUhm0IwPHBaD2RwIbydYiDpDKcu2zehBTNhO+ 0wjxXmysAC5opFdyR9sjpDvlXWyPDNqhG3pikEMwFY2HGPZLoq1h1iUdUA/QW5Hi J1eVi96wuNdywr6Kp8F3w7ADSldaAwUqr9mvYxI4EwbzMzjwmj28+68xYTXWxrE= =cuK7 -END PGP SIGNATURE- http://lists.arin.net/mailman/listinfo/arin-issued -- staticsafe O< ascii ribbon campaign - stop html mail - www.asciiribbon.org Please don't top post. It is not logical. Please don't CC me! I'm subscribed to whatever list I just posted on.
Re: The block message is 521 DNSRBL: Blocked for abuse
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 9/18/13 6:10 PM, David Miller wrote: > > > On 9/18/2013 7:30 PM, Andrew D Kirch wrote: >> On 9/18/2013 7:15 PM, Tammy Firefly wrote: >>> On 9/18/13 5:07 PM, Andrew D Kirch wrote: On 9/18/2013 6:55 PM, Tammy Firefly wrote: >> I used to run the AHBL and ARIN used to contact us when >> they recycled IP space. We always removed when contacted >> by ARIN. >> >> Andrew >> > ARIN hasnt contacted us for this since i've been involved > with the ahbl for ~5 years. just a FYI. Well, it'd seem we found the problem then. Andrew >>> Ive know ARIN is a problem for a lotta years andrew :P When >>> we contacted them and asked them to do it again we got told its >>> against policies blablablabla. >>> >> (replying to list with Tammy's permission) This is pathetic. >> ARIN is supposed to be working as a steward of this IP space. >> When you have policies that make it more difficult to use the IP >> space this isn't even remotely close to stewardship. It's >> pathetic, with the policy making a quick turn around of releasing >> old IP space when you get an allocation, that ARIN is leaving >> innocent third parties who have paid ARIN large sums of money for >> this space. ARIN, frankly you can suck it. It's time to grow up >> and behave how you were intended to. >> >> Andrew >> > > If only there was a way for anyone to get a daily report of number > resource allocations... > > https://lmddgtfy.net/?q=daily%20internet%20number%20resource%20allocation%20report > > First link. > > -DMM > Those also are statistics not actual IP block numbers being deallocated/allocated. -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.20 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSOkJqAAoJEHJ/lMQe1SM0PlIH/0DXHqPkIaVIh0poaj5w0oDM Y/PrbpMu16D+ga2HR0KQtrWglNacOg+VxDikTJMgYYhDmscVd8Y+inCyQpAW4ok6 2MaZeKMf5PEkkBkWh2M7703ljQ6ajDae+xTKJgXM0A4CaEkKlFgjxJ9t3+Wad+BC c5Xso50sVbeT0PG0Xd/6BHchg6kZUhm0IwPHBaD2RwIbydYiDpDKcu2zehBTNhO+ 0wjxXmysAC5opFdyR9sjpDvlXWyPDNqhG3pikEMwFY2HGPZLoq1h1iUdUA/QW5Hi J1eVi96wuNdywr6Kp8F3w7ADSldaAwUqr9mvYxI4EwbzMzjwmj28+68xYTXWxrE= =cuK7 -END PGP SIGNATURE-
Re: The block message is 521 DNSRBL: Blocked for abuse
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 9/18/13 6:10 PM, David Miller wrote: > > > On 9/18/2013 7:30 PM, Andrew D Kirch wrote: >> On 9/18/2013 7:15 PM, Tammy Firefly wrote: >>> On 9/18/13 5:07 PM, Andrew D Kirch wrote: On 9/18/2013 6:55 PM, Tammy Firefly wrote: >> I used to run the AHBL and ARIN used to contact us when >> they recycled IP space. We always removed when contacted >> by ARIN. >> >> Andrew >> > ARIN hasnt contacted us for this since i've been involved > with the ahbl for ~5 years. just a FYI. Well, it'd seem we found the problem then. Andrew >>> Ive know ARIN is a problem for a lotta years andrew :P When >>> we contacted them and asked them to do it again we got told its >>> against policies blablablabla. >>> >> (replying to list with Tammy's permission) This is pathetic. >> ARIN is supposed to be working as a steward of this IP space. >> When you have policies that make it more difficult to use the IP >> space this isn't even remotely close to stewardship. It's >> pathetic, with the policy making a quick turn around of releasing >> old IP space when you get an allocation, that ARIN is leaving >> innocent third parties who have paid ARIN large sums of money for >> this space. ARIN, frankly you can suck it. It's time to grow up >> and behave how you were intended to. >> >> Andrew >> > > If only there was a way for anyone to get a daily report of number > resource allocations... > > https://lmddgtfy.net/?q=daily%20internet%20number%20resource%20allocation%20report > > First link. > > -DMM > Yeah were not gonna wade thru PDF hell to do that. -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.20 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSOkHUAAoJEHJ/lMQe1SM0u7UH/3WtRf+Cmv8+8e5qxleoQkMa EBjQlbNxvcOBTPn6mqqiRMBY43hVPzOgmf7UjbhbtQBmXVD+w/f/2IWtuOSL1S3Z OYroMCQ+3zot4VvQprH0yeIF2byPYbTXKAxlRLjcZaauv+vIty+vuIrXP276ezip 6iGJxzgSL80hfPNtpaqb2MWkxxl3le8BDjAZoBt8WbU8mR1wHrYtDqgY0sSEzC6c vPzpxMuSk/VynKXIn0Tz8+1DWpHdPTbxdurBfXFTMuAcpt5M215odffLUauv88TS TuRcENZhpKnGZnyeyf9xMvZ70sibfAIulIAsm3BTnoqncuz5/112MCpnPUMFhek= =Plpi -END PGP SIGNATURE-
Re: The block message is 521 DNSRBL: Blocked for abuse
On 9/18/2013 7:30 PM, Andrew D Kirch wrote: > On 9/18/2013 7:15 PM, Tammy Firefly wrote: >> On 9/18/13 5:07 PM, Andrew D Kirch wrote: >>> On 9/18/2013 6:55 PM, Tammy Firefly wrote: > I used to run the AHBL and ARIN used to contact us when they > recycled IP > space. We always removed when contacted by ARIN. > > Andrew > ARIN hasnt contacted us for this since i've been involved with the ahbl for ~5 years. just a FYI. >>> Well, it'd seem we found the problem then. >>> >>> Andrew >>> >> Ive know ARIN is a problem for a lotta years andrew :P When we >> contacted them and asked them to do it again we got told its against >> policies blablablabla. >> > (replying to list with Tammy's permission) > This is pathetic. ARIN is supposed to be working as a steward of this > IP space. When you have policies that make it more difficult to use the > IP space this isn't even remotely close to stewardship. It's pathetic, > with the policy making a quick turn around of releasing old IP space > when you get an allocation, that ARIN is leaving innocent third parties > who have paid ARIN large sums of money for this space. > ARIN, frankly you can suck it. It's time to grow up and behave how you > were intended to. > > Andrew > If only there was a way for anyone to get a daily report of number resource allocations... https://lmddgtfy.net/?q=daily%20internet%20number%20resource%20allocation%20report First link. -DMM signature.asc Description: OpenPGP digital signature
Re: common method to count traffic volume on IX
On 18/09/2013 23:55, Niels Bakker wrote: > Ding ding ding! And that's why honest IXPs graph both, to show that they > have no packet loss on their inter-switch links. If in > out, it's not necessarily inter-switch packet loss. The difference between the two will also include packet loss for same-switch egress traffic on customer ports. Nick
Re: The block message is 521 DNSRBL: Blocked for abuse
On 9/18/2013 7:15 PM, Tammy Firefly wrote: On 9/18/13 5:07 PM, Andrew D Kirch wrote: On 9/18/2013 6:55 PM, Tammy Firefly wrote: I used to run the AHBL and ARIN used to contact us when they recycled IP space. We always removed when contacted by ARIN. Andrew ARIN hasnt contacted us for this since i've been involved with the ahbl for ~5 years. just a FYI. Well, it'd seem we found the problem then. Andrew Ive know ARIN is a problem for a lotta years andrew :P When we contacted them and asked them to do it again we got told its against policies blablablabla. (replying to list with Tammy's permission) This is pathetic. ARIN is supposed to be working as a steward of this IP space. When you have policies that make it more difficult to use the IP space this isn't even remotely close to stewardship. It's pathetic, with the policy making a quick turn around of releasing old IP space when you get an allocation, that ARIN is leaving innocent third parties who have paid ARIN large sums of money for this space. ARIN, frankly you can suck it. It's time to grow up and behave how you were intended to. Andrew
Re: common method to count traffic volume on IX
> Ding ding ding! And that's why honest IXPs graph both, to show that > they have no packet loss on their inter-switch links. It depends on what is being measured. At TorIX we'll see deviations between in/out on our aggregate graph. As we combine all peer ports to form the aggregate graph, any large deviations are almost always due to peers who have reached capacity limits on their port (which is not always port speed, btw, always include their transport behind the port). Another common reason is the difference in measurement times across all ports. http://www.torix.ca/stats.php -- Stephen On 18/09/2013 6:55 PM, Niels Bakker wrote: * bickn...@ufp.org (Leo Bicknell) [Wed 18 Sep 2013, 19:23 CEST]: On Sep 17, 2013, at 3:15 PM, Niels Bakker wrote: I don't know of any IXP that does this. Industry standard is as you and others wrote before: the 5-minute counter difference on all customer-facing ports, publishing both input and output bps and pps. I guess MRTG is to 'blame' for these values more than anything. Serious question, at an IXP shouldn't IN = OUT nearly perfectly? Ding ding ding! And that's why honest IXPs graph both, to show that they have no packet loss on their inter-switch links. (Or, much more likely, measurement errors due to wrong config for the grapher) -- Niels.
Re: The block message is 521 DNSRBL: Blocked for abuse
On 9/18/2013 6:55 PM, Tammy Firefly wrote: I used to run the AHBL and ARIN used to contact us when they recycled IP space. We always removed when contacted by ARIN. Andrew ARIN hasnt contacted us for this since i've been involved with the ahbl for ~5 years. just a FYI. Well, it'd seem we found the problem then. Andrew
Re: common method to count traffic volume on IX
* ra...@psg.com (Randy Bush) [Wed 18 Sep 2013, 04:39 CEST]: somehow, a serious case of testosterone poisoning combined with insane goal drift has hit a number of the large european exchanges. instead of the goal being how well they serve their local communities, they have gone wild with sleazy means of having traffic contests, doing really sick attempts at techno-colonial expansion into foreign countries and continents, ... instead of running a public service, they think they are running competitive commercial enterprises. imiho, the members should be up in arms. if you are jealous of commercial expansion, then send your resume to equinix. sheesh! Wow Randy, you really misunderstand the situation in Europe and the reasons behind the horizon expansions, and I'm surprised by your advocacy of American hegemony in a market where that really doesn't exist (those of independent not-for-profit internet exchanges). If only you worked for a company that allowed you input into the decision processes of all these member-driven associations! -- Niels.
Re: common method to count traffic volume on IX
On 18/09/2013 18:23, Leo Bicknell wrote: > Serious question, at an IXP shouldn't IN = OUT nearly perfectly? if you host multicast on your unicast peering lan, then this will be affected by the unicast:multicast ratio and the number of recipient ports. Most networks which support multicast will also support multicast pruning, so in reality this counts for very little. Most IXPs rely on unicast flooding to determine forwarding paths, which adds a little to the outbound numbers. So on these IXPs, outbound aggregate is usually a tiny amount larger than inbound aggregate. The larger the network, the smaller this effect. And on networks which precompute forwarding paths, the in and out aggregate figures will be equal +/- counter entropy. Nick
Re: The block message is 521 DNSRBL: Blocked for abuse
On 9/18/13 4:46 PM, Andrew D Kirch wrote: > On 9/18/2013 6:41 PM, Timothy Metzinger wrote: >> Here's a thought. Would it be possible to set up a process where >> ARIN, as >> part of reselling IP addresses, either issues a certificate of >> transfer that >> the new owner can use to prove to the ISPs that he's a new owner and >> not the >> old evil spammer, or ARIN publishes a list of IP assignments that can be >> used by ISPs to provisionally remove them from blocked lists? >> >> I sympathize with the original poster, it's sort of like buying a used >> car, >> only to find out the previous owner was the drunk driver who ran over >> your >> next door neighbor's dog. >> >> > I used to run the AHBL and ARIN used to contact us when they recycled IP > space. We always removed when contacted by ARIN. > > Andrew > ARIN hasnt contacted us for this since i've been involved with the ahbl for ~5 years. just a FYI.
Re: common method to count traffic volume on IX
* bickn...@ufp.org (Leo Bicknell) [Wed 18 Sep 2013, 19:23 CEST]: On Sep 17, 2013, at 3:15 PM, Niels Bakker wrote: I don't know of any IXP that does this. Industry standard is as you and others wrote before: the 5-minute counter difference on all customer-facing ports, publishing both input and output bps and pps. I guess MRTG is to 'blame' for these values more than anything. Serious question, at an IXP shouldn't IN = OUT nearly perfectly? Ding ding ding! And that's why honest IXPs graph both, to show that they have no packet loss on their inter-switch links. (Or, much more likely, measurement errors due to wrong config for the grapher) -- Niels.
RE:The block message is 521 DNSRBL: Blocked for abuse
On Wed, 18 Sep 2013, Timothy Metzinger wrote: Here's a thought. Would it be possible to set up a process where ARIN, as part of reselling IP addresses, either issues a certificate of transfer that the new owner can use to prove to the ISPs that he's a new owner and not the old evil spammer, or ARIN publishes a list of IP assignments that can be used by ISPs to provisionally remove them from blocked lists? That sounds like a great idea! We should make it an electronic certificate, though, so that anyone who wants to know can look it up online. And it should show the contact info of the new owner and the date the record was created/updated. It would be a great way to find out WHOIS using a particular address block. -- Brandon Ross Yahoo & AIM: BrandonNRoss +1-404-635-6667ICQ: 2269442 Schedule a meeting: https://doodle.com/brossSkype: brandonross
Re: The block message is 521 DNSRBL: Blocked for abuse
On 9/18/2013 6:41 PM, Timothy Metzinger wrote: Here's a thought. Would it be possible to set up a process where ARIN, as part of reselling IP addresses, either issues a certificate of transfer that the new owner can use to prove to the ISPs that he's a new owner and not the old evil spammer, or ARIN publishes a list of IP assignments that can be used by ISPs to provisionally remove them from blocked lists? I sympathize with the original poster, it's sort of like buying a used car, only to find out the previous owner was the drunk driver who ran over your next door neighbor's dog. I used to run the AHBL and ARIN used to contact us when they recycled IP space. We always removed when contacted by ARIN. Andrew
RE:The block message is 521 DNSRBL: Blocked for abuse
Here's a thought. Would it be possible to set up a process where ARIN, as part of reselling IP addresses, either issues a certificate of transfer that the new owner can use to prove to the ISPs that he's a new owner and not the old evil spammer, or ARIN publishes a list of IP assignments that can be used by ISPs to provisionally remove them from blocked lists? I sympathize with the original poster, it's sort of like buying a used car, only to find out the previous owner was the drunk driver who ran over your next door neighbor's dog.
Re: iOS 7 update traffic
On Wed, 18 Sep 2013, Tassos Chatzithomaoglou wrote: We also noticed an interesting spike (+ ~40%), mostly in akamai. The same happened on previous iOS too. I see it here, too. At its peak, our traffic levels were roughly double what we would see on a normal weekday. jms Zachary McGibbon wrote on 18/9/2013 20:38: So iOS 7 just came out, here's the spike in our graphs going to our ISP here at McGill, anyone else noticing a big spike? [image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - TenGigabitEthernet0/7] Zachary McGibbon
Re: iOS 7 update traffic
We also noticed an interesting spike (+ ~40%), mostly in akamai. The same happened on previous iOS too. -- Tassos Zachary McGibbon wrote on 18/9/2013 20:38: > So iOS 7 just came out, here's the spike in our graphs going to our ISP > here at McGill, anyone else noticing a big spike? > > [image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - > TenGigabitEthernet0/7] > > Zachary McGibbon >
Re: iOS 7 update traffic
Do you guys not have a local akamai node?? Seems like maybe @gilmore could help you out, that's a pretty intense surge for software updates. Our stuff gets hit, but nothing like this (our networks usually don't exceed 40mbps over satellite). The MSO I used to work at had a fairly large akamai cache in Anchorage, AK. May be worth looking into if you guys haven't already. On 9/18/13 11:32 AM, "Phil Bedard" wrote: >Large US MSO. > >Our overall traffic is up about 20% compared to this time yesterday, which >equates to ~120Gbps. Mostly Akamai. > >-Phil > > > > > > >On 9/18/13 1:38 PM, "Zachary McGibbon" >wrote: > >>So iOS 7 just came out, here's the spike in our graphs going to our ISP >>here at McGill, anyone else noticing a big spike? >> >>[image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - >>TenGigabitEthernet0/7] >> >>Zachary McGibbon > > >
Re: iOS 7 update traffic
Various EU IXPs are showing spikes of various sizes at the moment LINX: http://cl.ly/image/3n1521432S1R LONAP: http://cl.ly/image/0W2K0q3p3f2h AMS-IX: http://cl.ly/image/0r0J2b331E2A DE-CIX: http://cl.ly/image/0D1B181N103A Akamai (who I believe Apple use for at least some of their CDN delivery) are also showing a nice hotspot in Europe at the moment: http://www.akamai.com/html/technology/dataviz1.html (screenshot for posterity: http://cl.ly/image/0f3W2g3P2D3g) Edward Dore Freethought Internet On 18 Sep 2013, at 18:53, Zachary McGibbon wrote: > Hmm.. seems my image was stripped. I'm trying imgur for the first time so > here's our graph: > > http://i.imgur.com/OrtjJXF.jpg > > > On Wed, Sep 18, 2013 at 1:38 PM, Zachary McGibbon < > zachary.mcgibbon+na...@gmail.com> wrote: > >> So iOS 7 just came out, here's the spike in our graphs going to our ISP >> here at McGill, anyone else noticing a big spike? >> >> [image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - >> TenGigabitEthernet0/7] >> >> Zachary McGibbon >>
Re: iOS 7 update traffic
We are seeing Akamai traffic up about 100-300% since noon CDT. Seeing similar increased from our participants - colleges and universities mainly. AS32440 -ben On Wed, Sep 18, 2013 at 12:59 PM, Tassos Chatzithomaoglou < ach...@forthnetgroup.gr> wrote: > We also noticed an interesting spike (+ ~40%), mostly in akamai. > The same happened on previous iOS too. > > -- > Tassos > > Zachary McGibbon wrote on 18/9/2013 20:38: > > So iOS 7 just came out, here's the spike in our graphs going to our ISP > > here at McGill, anyone else noticing a big spike? > > > > [image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - > > TenGigabitEthernet0/7] > > > > Zachary McGibbon > > > > >
Re: iOS 7 update traffic
Large US MSO. Our overall traffic is up about 20% compared to this time yesterday, which equates to ~120Gbps. Mostly Akamai. -Phil On 9/18/13 1:38 PM, "Zachary McGibbon" wrote: >So iOS 7 just came out, here's the spike in our graphs going to our ISP >here at McGill, anyone else noticing a big spike? > >[image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - >TenGigabitEthernet0/7] > >Zachary McGibbon
Re: iOS 7 update traffic
We are seeing Akamai traffic up about 100-300% since noon CDT. Seeing similar increased from our participants - colleges and universities mainly. Ours is not so much Akamai as Limelight. Spiked to about 7 times normal. sam
Re: iOS 7 update traffic
Our local Akamai cluster has pegged it's 1G uplink a few times, and we are hitting our 1G Equinix IX link pretty hard as well. On Wed, Sep 18, 2013 at 1:10 PM, Ben Bartsch wrote: > We are seeing Akamai traffic up about 100-300% since noon CDT. Seeing > similar increased from our participants - colleges and universities mainly. > > AS32440 > > -ben > > > On Wed, Sep 18, 2013 at 12:59 PM, Tassos Chatzithomaoglou < > ach...@forthnetgroup.gr> wrote: > >> We also noticed an interesting spike (+ ~40%), mostly in akamai. >> The same happened on previous iOS too. >> >> -- >> Tassos >> >> Zachary McGibbon wrote on 18/9/2013 20:38: >> > So iOS 7 just came out, here's the spike in our graphs going to our ISP >> > here at McGill, anyone else noticing a big spike? >> > >> > [image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - >> > TenGigabitEthernet0/7] >> > >> > Zachary McGibbon >> > >> >> >>
Re: The block message is 521 DNSRBL: Blocked for abuse
I would say the first step is to find an immediate workaround for your end users - maybe bring up a VM on AWS or some other cloud provider to use as an SMTP relay while you work out the blacklist issue. If you run into blacklist issues after that, you may want to take a very close look at your outbound mailflow to make sure your organization isn't sending out messages that could be categorized as spam. Getting IPs removed from a provider blacklist can be time consuming. You may be lucky enough to reach a clueful contact at the providers you mentioned on this list - but if you don't, you will have to navigate the removal process with each provider that has blacklisted you. On Wed, Sep 18, 2013 at 11:07 AM, NANOG wrote: > We recently purchased new IP addresses from ARIN, with plans on using one > of them for our external and internal email delivery. We set up a reverse > lookup and a SPF record for the newly purchased IP to prevent being > classified as spam. We tested the functionality of the PTR and SPF record > successfully using varies internet tools like dnsstuff.com, mxtoolbox.com, > and kitterman.com. Unfortunately, when we send emails to any AT&T or > Network Solutions hosted email we are being block as a spam abuser. I > checked varies spam database tools and our IP addresses are not listed, but > we are still being blocked by both AT&T and Network Solution. The block > message is 521 DNSRBL: Blocked for abuse. In an attempt to be proactive, I > contacted Network Solution and was told that each recipient would have to > request we be whitelisted, and AT&T directed me to an online form that I > submitted to be removed from the blacklist. Unfortunately, we are still > not able to send emails to either AT&T or Network Solutions hosted emails. > Our mail server IP address is 74.112.99.25, which resolves to > mail.abcsupply.com. Does anyone have any suggestions on where to turn > next? Is it possible they are blocking us based on old information from > the previous IP address block owner? Any help tracking this down would be > appreciated. > > > Derrick Wash > Microsoft Systems Administrator > ABC Supply Company Inc > Office: (608)368-2214 > Fax: (608)363-0214 > >
Re: iOS 7 update traffic
Hmm.. seems my image was stripped. I'm trying imgur for the first time so here's our graph: http://i.imgur.com/OrtjJXF.jpg On Wed, Sep 18, 2013 at 1:38 PM, Zachary McGibbon < zachary.mcgibbon+na...@gmail.com> wrote: > So iOS 7 just came out, here's the spike in our graphs going to our ISP > here at McGill, anyone else noticing a big spike? > > [image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - > TenGigabitEthernet0/7] > > Zachary McGibbon >
Re: The block message is 521 DNSRBL: Blocked for abuse
> > Our mail server IP address is 74.112.99.25. Is it possible they > are blocking us based on old information from the previous IP > address block owner? > > Quite likely, yes. https://www.arin.net/resources/whowas/ Found it to be of use for this type of question. Registration required. Geolocation information often needs updating for these "recycled" ranges. /JF
Re: [liberationtech] Brazil Looks to Break from U.S.-Centric Internet
LOL, we'll move the taps one layer down ... -J On Wed, Sep 18, 2013 at 11:37 AM, Eugen Leitl wrote: > - Forwarded message from Bill Woodcock - > > Date: Wed, 18 Sep 2013 09:25:13 -0700 > From: Bill Woodcock > To: liberationtech > Subject: Re: [liberationtech] Brazil Looks to Break from U.S.-Centric > Internet > X-Mailer: Apple Mail (2.1508) > Reply-To: liberationtech > > > On Sep 18, 2013, at 8:28 AM, David Johnson > wrote: > > > Interesting ... but is this even possible? > > > http://world.time.com/2013/09/18/brazil-looks-to-break-from-u-s-centric-internet/ > > Well, there are a bunch of different concepts being discussed. The > primary one is localization of routing, which isn't just possible, it's > best-practice, and something Brazil has been doing an excellent job of > already for quite a few years. If you look at > https://pch.net/applications/ixpdir/summary/ you'll see that they've got > 23 active exchanges, which puts them second in the world after the U.S., > with 77% annualized growth, compared to 10% in the U.S. If you look at the > Brazil section of https://pch.net/ixpdir you'll see that almost all of > that growth has been occurring since they made it an explicit policy goal > in 2008, and began aggressively implementing IXP best-practices. > > At a governance level, Brazil is divided. The CGI, which decides and > implements domestic Internet policy, is the agency responsible for all this > growth and best-practices-following. As such, they've been largely aligned > with OECD-country and Internet interests. The Brazilian federal > government, on the other hand, sets foreign policy, interacts with the ITU, > et cetera. And so although it has no appreciable influence over what > happens _within_ the country, it's what's seen by other national > governments in diplomatic circles. In Internet governance, Brazil tends > toward this Brazil-India-South Africa axis, which doesn't particularly > align with the Internet or OECD countries, unless by accident. This is the > area that Internet folks are most worried about, since those three > countries are second-tier thought-leaders in the ITU, and can swing a lot > of developing-country votes in their respective regions. So Brazil is, in > many ways, the U.S.' opposite: they do the right thing domestically, but > say the wrong thing internationally. > > -Bill > > > > > > > -- > Liberationtech is public & archives are searchable on Google. Violations > of list guidelines will get you moderated: > https://mailman.stanford.edu/mailman/listinfo/liberationtech. > Unsubscribe, change to digest, or change password by emailing moderator at > compa...@stanford.edu. > > > - End forwarded message - > -- > Eugen* Leitl http://leitl.org";>leitl http://leitl.org > __ > ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org > AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5 >
Re: The block message is 521 DNSRBL: Blocked for abuse
My experience in the past is that it can take a good amount of time for ATT to remove you from their black list. It's been as short as 24 - 48 hours and as long as a couple weeks and required follow up contact with support. They're a big company and they get a lot of requests. I've not dealt with Network Solutions or their RBL list as far as how to get whitelisted. But it sounds like they manage it in a way where the recipient has to accept email from you. It's probably not practical but can you contact the recipients on Network Solutions via another method to have them whitelist you? >From the sounds of t the IP address you purchased was previously used by a >spammer and now you're paying the price for it. Perhaps there are contacts on >this list from ATT/Network Solutions that can contact you off list to help you >resolve that. Good luck! Mike Schuler a guy On Sep 18, 2013, at 11:07 AM, NANOG wrote: > We recently purchased new IP addresses from ARIN, with plans on using one of > them for our external and internal email delivery. We set up a reverse > lookup and a SPF record for the newly purchased IP to prevent being > classified as spam. We tested the functionality of the PTR and SPF record > successfully using varies internet tools like dnsstuff.com, mxtoolbox.com, > and kitterman.com. Unfortunately, when we send emails to any AT&T or Network > Solutions hosted email we are being block as a spam abuser. I checked varies > spam database tools and our IP addresses are not listed, but we are still > being blocked by both AT&T and Network Solution. The block message is 521 > DNSRBL: Blocked for abuse. In an attempt to be proactive, I contacted > Network Solution and was told that each recipient would have to request we be > whitelisted, and AT&T directed me to an online form that I submitted to be > removed from the blacklist. Unfortunately, we are still not able to send > emails to either AT&T or Network Solutions hosted emails. Our mail server IP > address is 74.112.99.25, which resolves to mail.abcsupply.com. Does anyone > have any suggestions on where to turn next? Is it possible they are blocking > us based on old information from the previous IP address block owner? Any > help tracking this down would be appreciated. > > > Derrick Wash > Microsoft Systems Administrator > ABC Supply Company Inc > Office: (608)368-2214 > Fax: (608)363-0214 > > >
iOS 7 update traffic
So iOS 7 just came out, here's the spike in our graphs going to our ISP here at McGill, anyone else noticing a big spike? [image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - TenGigabitEthernet0/7] Zachary McGibbon
Re: The block message is 521 DNSRBL: Blocked for abuse
On Sep 18, 2013, at 9:07 AM, NANOG wrote: > We recently purchased new IP addresses from ARIN No, actually, you didn't. You were assigned the use of the addresses, based on need. Just as a radio station does not "purchase" spectrum. https://www.arin.net/policy/nrpm.html#four3 > Our mail server IP address is 74.112.99.25. Is it possible they are blocking > us based on old information from the previous IP address block owner? Quite likely, yes. John LeCoque's suggestions seemed quite sound: > I would say the first step is to find an immediate workaround for your end > users - maybe bring up a VM on AWS or some other cloud provider to use as > an SMTP relay while you work out the blacklist issue. If you run into > blacklist issues after that, you may want to take a very close look at your > outbound mailflow to make sure your organization isn't sending out messages > that could be categorized as spam. -Bill signature.asc Description: Message signed with OpenPGP using GPGMail
Re: common method to count traffic volume on IX
On Sep 17, 2013, at 3:15 PM, Niels Bakker wrote: > I don't know of any IXP that does this. Industry standard is as you and > others wrote before: the 5-minute counter difference on all customer-facing > ports, publishing both input and output bps and pps. > I guess MRTG is to 'blame' for these values more than anything. Serious question, at an IXP shouldn't IN = OUT nearly perfectly? Most exchanges do everything possible to eliminate broadcast packets, and they don't allow multicast on the unicast VLAN's. So properly behaved you have a bunch of routers speaking unicast to each other. The only way to get a difference is if there is packet loss, IN - loss = OUT. -- Leo Bicknell - bickn...@ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/
Re: [liberationtech] Brazil Looks to Break from U.S.-Centric Internet
- Forwarded message from Bill Woodcock - Date: Wed, 18 Sep 2013 09:25:13 -0700 From: Bill Woodcock To: liberationtech Subject: Re: [liberationtech] Brazil Looks to Break from U.S.-Centric Internet X-Mailer: Apple Mail (2.1508) Reply-To: liberationtech On Sep 18, 2013, at 8:28 AM, David Johnson wrote: > Interesting ... but is this even possible? > http://world.time.com/2013/09/18/brazil-looks-to-break-from-u-s-centric-internet/ Well, there are a bunch of different concepts being discussed. The primary one is localization of routing, which isn't just possible, it's best-practice, and something Brazil has been doing an excellent job of already for quite a few years. If you look at https://pch.net/applications/ixpdir/summary/ you'll see that they've got 23 active exchanges, which puts them second in the world after the U.S., with 77% annualized growth, compared to 10% in the U.S. If you look at the Brazil section of https://pch.net/ixpdir you'll see that almost all of that growth has been occurring since they made it an explicit policy goal in 2008, and began aggressively implementing IXP best-practices. At a governance level, Brazil is divided. The CGI, which decides and implements domestic Internet policy, is the agency responsible for all this growth and best-practices-following. As such, they've been largely aligned with OECD-country and Internet interests. The Brazilian federal government, on the other hand, sets foreign policy, interacts with the ITU, et cetera. And so although it has no appreciable influence over what happens _within_ the country, it's what's seen by other national governments in diplomatic circles. In Internet governance, Brazil tends toward this Brazil-India-South Africa axis, which doesn't particularly align with the Internet or OECD countries, unless by accident. This is the area that Internet folks are most worried about, since those three countries are second-tier thought-leaders in the ITU, and can swing a lot of developing-country votes in their respective regions. So Brazil is, in many ways, the U.S.' opposite: they do the right thing domestically, but say the wrong thing internationally. -Bill -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. - End forwarded message - -- Eugen* Leitl http://leitl.org";>leitl http://leitl.org __ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5 signature.asc Description: Digital signature
mlb.com Geolocation clue/contact needed
Anyone have a contact at mlb.com that could help resolve an ip geolocation issue? (Networking, db.. or someone who can help find the right folks) Alternatively, anyone know who mlb.com buys geolocation data from? It's related to their baseball game streaming/subscription service. Whitelisting individual users is not a scalable solution. offline answers are welcome too -- Thanks, --Heather
The block message is 521 DNSRBL: Blocked for abuse
We recently purchased new IP addresses from ARIN, with plans on using one of them for our external and internal email delivery. We set up a reverse lookup and a SPF record for the newly purchased IP to prevent being classified as spam. We tested the functionality of the PTR and SPF record successfully using varies internet tools like dnsstuff.com, mxtoolbox.com, and kitterman.com. Unfortunately, when we send emails to any AT&T or Network Solutions hosted email we are being block as a spam abuser. I checked varies spam database tools and our IP addresses are not listed, but we are still being blocked by both AT&T and Network Solution. The block message is 521 DNSRBL: Blocked for abuse. In an attempt to be proactive, I contacted Network Solution and was told that each recipient would have to request we be whitelisted, and AT&T directed me to an online form that I submitted to be removed from the blacklist. Unfortunately, we are still not able to send emails to either AT&T or Network Solutions hosted emails. Our mail server IP address is 74.112.99.25, which resolves to mail.abcsupply.com. Does anyone have any suggestions on where to turn next? Is it possible they are blocking us based on old information from the previous IP address block owner? Any help tracking this down would be appreciated. Derrick Wash Microsoft Systems Administrator ABC Supply Company Inc Office: (608)368-2214 Fax: (608)363-0214
