Re: The curious case of 159.174.0.0/16
- On Feb 1, 2020, at 1:54 PM, Pavel Lunin plu...@plunin.net wrote: Hi Pavel, > On Wednesday, January 29, 2020 5:15 PM, Sabri Berisha > wrote: > >> I'm surprised about the lack of response from FT/DT though. > > And now multiply this by 3, because DT and ARIN are no better. I appreciate your contempt for corporate entities. It seems however, that you forget one important aspect here: most corporations are carefully organized to ensure all assets are properly used to generate revenue. In this case, IP space is an asset which can bring (or secure current) revenue streams. This is the reason why I'm surprised. Thanks, Sabri
Re: The curious case of 159.174.0.0/16
On Wednesday, January 29, 2020 5:15 PM, Sabri Berisha wrote: > I'm surprised about the lack of response from FT/DT though. Side note: sending an email to Orange has a strong chance to never get to the destination. There is a tiny "if( rand() > 0.2*RAND_MAX ) message.moveto("/dev/null");" somewhere in their corporate e-mail server config, which makes them do even more conf-calls (what do you want, it's a phone company before all). If they can't even fix this, you can imagine what it whould take for a 150k employee corporation to resolve a complex problem like the one described above. And now multiply this by 3, because DT and ARIN are no better. I wonder if it's a coincidence or these two clever Turkish gentlemen have deliberately chosen the case where FT+DT+ARIN bureaucracies need to agree upon something in order to act against them together. Infinite number of conf-calls between the three countries (four, if we count Turkey) on two continents (three if we count Istanbul) is a 100% guarantee that nobody will ever do anything about this. -- Pavel
Re: The curious case of 159.174.0.0/16
Could not have worded it better myself. On Wed, 29 Jan 2020 16:30:22 + Mel Beckman wrote: > Then why are you sending email to nanog@nanog.org? > > LOL! > > -mel > > > On Jan 29, 2020, at 12:41 AM, Ronald F. Guilmette > > wrote: > > > > I have a standing policy of never attempting to converse with unaccountable > > anonymized role accounts. Based on past experience, this is without > > exception an utter waste of my time. -- Large Hadron Collider
Re: The curious case of 159.174.0.0/16
Then why are you sending email to nanog@nanog.org? LOL! -mel > On Jan 29, 2020, at 12:41 AM, Ronald F. Guilmette > wrote: > > I have a standing policy of never attempting to converse with unaccountable > anonymized role accounts. Based on past experience, this is without > exception an utter waste of my time.
Re: The curious case of 159.174.0.0/16
> > If you always e-mail j...@telco.com instead of n...@telco.com for your > issues, you may end of in a situation where Jake is gone, on vacation, or > simply moved on to accounting. Plus, Jake hates this. He might pretend to be your friend but he's getting paid to do that. Nothing more annoying than having a customer demand to work with Jake when Jake has 20 other things going on and literally anyone else on the team can help you. Once you're known within the right team, it should be easy to get prompt > responses. Exactly. Show the team that you know what you're talking about and that you're not belligerent and people will be more than happy to work with you. - Mike Bolitho On Wed, Jan 29, 2020 at 9:16 AM Sabri Berisha wrote: > - On Jan 29, 2020, at 12:40 AM, Ronald F. Guilmette > r...@tristatelogic.com wrote: > > Hi, > > > (I have a standing policy of never attempting to converse with > unaccountable > > anonymized role accounts. Based on past experience, this is without > > exception an utter waste of my time.) > > In the real world, this should be the exact opposite. People move teams, > leave companies. If you always e-mail j...@telco.com instead of > n...@telco.com for your issues, you may end of in a situation where Jake > is gone, on vacation, or simply moved on to accounting. Once you're known > within the right team, it should be easy to get prompt responses. > > I'm surprised about the lack of response from FT/DT though. > > Thanks, > > Sabri >
Re: The curious case of 159.174.0.0/16
- On Jan 29, 2020, at 12:40 AM, Ronald F. Guilmette r...@tristatelogic.com wrote: Hi, > (I have a standing policy of never attempting to converse with unaccountable > anonymized role accounts. Based on past experience, this is without > exception an utter waste of my time.) In the real world, this should be the exact opposite. People move teams, leave companies. If you always e-mail j...@telco.com instead of n...@telco.com for your issues, you may end of in a situation where Jake is gone, on vacation, or simply moved on to accounting. Once you're known within the right team, it should be easy to get prompt responses. I'm surprised about the lack of response from FT/DT though. Thanks, Sabri
The curious case of 159.174.0.0/16
[[ Fair warning to newcomers: I write and post longish pieces here regarding my various investigations of funny business I find going on within the IPv4 address space and the allocations and uses thereof. If you're looking for a quick 2 minute read then you are advised to skip this message now. ]] I confess that I have been meaning to write about the 159.174.0.0/16 legacy IPv4 block for quite some time now. What can I say? I was busy. The Present State of 159.174.0.0/16 --- I discovered quite some long time ago that this block was getting routing from a rather unusual place, and that the ASN in question was also announcing a few other nice juicy /16 legacy blocks, which by itself was more than a little suspicious. But that's not imporant now. Please allow me to just talk about who is routing this block at present, and who the alleged legitimate registrants are, going by ARIN's relevant current WHOIS record for this block: https://pastebin.com/raw/FBWMN9p3 As you can see, this block is registered to an entity located in Wilton, Connecticut. The block appears to have been originally assigned on 1992-05-11, well before the formation of ARIN. It is thus an unusually valuable "legacy" block. The first indication that something might be a bit off about this block is the contact phone number, +1-407-476-9854. In this modern era of number portability the area code portion of that may or may not have any real-world geographical implications at all, but it turns out to be notable, in this case, that area code 407 corresponds, historically, to the greater Orlando, Florida area and surrounding Florida counties. A quick bit of research reveals that there is in fact an entity calling itself Dunsnet, LLC and that it is located in Winter Park, Florida, a northern suburb of Orlando: http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName&directionType=Initial&searchNameOrder=DUNSNET%20L120001007590&aggregateId=flal-l12000100759-15618501-6ea8-4b18-898e-6470337507d1&searchTerm=dunsnet&listNameOrder=DUNSNET%20L120001007590 Further research on the Florida Secretary of State's web site confirms that this entity does exist, that it is "active", and that it has one and only one manager, that being another corporate entity called Ahosting, Inc.: http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName&directionType=Initial&searchNameOrder=AHOSTING%20P070001262120&aggregateId=domp-p07000126212-a6386b50-075c-4b07-b36e-ff5a3ba1b33c&searchTerm=ahosting&listNameOrder=AHOSTING%20P070001262120 As you can see via the above link, Ahosting, Inc. has only two corporate directors, i.e. a Mr. Erkan Ozdogan and a Mr. Adnan Canturk, both apparently residents of Istanbul, Turkey. At the present time, 100% of the 159.174.0.0/16 legacy block is being routed by AS54163, aka Ahosting, Inc.: https://bgp.he.net/AS54163#_prefixes The question is: Is this proper? A Brief History of 159.174.0.0/16 - When the 159.174.0.0/16 block was first allocated and registered, way back on 1992-05-11 it was assigned at that time to a unit of the famous Dun & Bradstreet financial information company for use in connection with one of the company's early forays into the world of the Internet: Fortune Magazine, August 19, 1985: https://archive.fortune.com/magazines/fortune/fortune_archive/1985/08/19/66327/index.htm "Dun & Bradstreet also operates DunsNet, a $20- million private telecommunications network completed in March, which connects customers in 155 cities directly to the company's mainframes." On June 8th, 1994, Dun & Bradstreet's "Dunsnet" operation announced that it had elected to partner with a European company named Eunetcom SA, which was itself a partnership between Deutsche Bundespost Telekom and France Telecom: https://www.cbronline.com/news/eunetcom_wins_dunsnet_pact/ In August, 1994, Eunetcom apparently elected to buy out its customer, Dunsnet: "The Information Superhighway" (Randall L. Carlson - 1996) https://bit.ly/2O7kV48 "Eunetcom is actively pursuing customers and entry into the North American market. Its first customer was worth $200 million over five years and was {subequently} acquired by purchasing the networking services of Dun & Bradstreet's DunsNet. DunsNet provides data communications services for the Dun & Bradstreet companies, a role that Eunetcom now assumes." https://www.postjobfree.com/resume/pumacu/unix-administrator-technical-analyst-reg-shelton "In August 1994, DunsNet was acquired by eunetcom, a joint venture between Deutsche Telekom and France Telecom." As we all know, unlike the situation today, IPv4 blocks in the 1990s had essentially no monetary value. And thus the 159.174.0.0/16 block became forgotten and abandoned