Re: cctld server traffic

2006-01-23 Thread Stephane Bortzmeyer
On Sun, Jan 22, 2006 at 10:42:36AM +0900, Randy Bush <[EMAIL PROTECTED]> wrote a message of 4 lines which said: > any cctld ops seeing unusual traffic in the last hours? DSC showed nothing at all on Sunday for the ".fr" nameservers that we directly manage. Some are also secondaries for other

Re: The Backhoe: A Real Cyberthreat? [ & Re: cyber-redundancy ]

2006-01-23 Thread Michael . Dillon
> National Diversity Assurance Initiative. The financial services industry participates in many organizations such as BITS and the Financial Services Roudtable. A couple of extracts from some slides in a BITS presentation slide--- Since 9/11, the financial services industry and government ha

Re: The Backhoe: A Real Cyberthreat?

2006-01-23 Thread Michael . Dillon
> Any idiot terrorist can walk up to a CO or colo and find the entrance > facilities (facility in more cases) and walk down the block looking for > manhole covers with company names or logo's. They would have to be idiots to waste there time hunting for buried telecom lines when they could blow

Re: cctld server traffic

2006-01-23 Thread Kurt Erik Lindqvist
On 22 jan 2006, at 02.42, Randy Bush wrote: any cctld ops seeing unusual traffic in the last hours? Nope. - kurtis -

Re: is this like a peering war somehow?

2006-01-23 Thread Todd Vierling
On Sun, 22 Jan 2006, Mikael Abrahamsson wrote: > If you have an 8meg ADSL line and want to deliver IPTV you need some kind of > preferential treatment to the TV packets on this access line to ensure > quality, for instance in the case of the user doing a file transfer at the > same time they're w

qos on access (Re: is this like a peering war somehow?)

2006-01-23 Thread Mikael Abrahamsson
On Mon, 23 Jan 2006, Todd Vierling wrote: Provided that IPTV or VoIP are the only [large] datagram streams in progress, this is not difficult to do on the CPE end -- in fact, this sort of thing is already available as a QoS option in some home router appliances. It involves scaling back TCP

Re: is this like a peering war somehow?

2006-01-23 Thread Paul Vixie
[EMAIL PROTECTED] (Petri Helenius) writes: > And the real question is if the money is better spent on implementing > preferential treatment or upgrading the infrastructure as a whole. the former, in the current and following quarter. the latter, in the current and following year. (can you all

Re: oof. panix sidelined by incompetence... again.

2006-01-23 Thread Manish Karir
in case some people want to look at routeviews data for themselves, I have archived a couple of pdf file at: http://bgpinspect.merit.edu/reports.php -manish - Re: oof. panix sidelined by incompetence... again. * From: william(at)elan.net * Date: Sun Jan 22 13:34:47 2006 Can th

Re: oof. panix sidelined by incompetence... again. (fwd)

2006-01-23 Thread Manish Karir
I forgot to mention that you can get the RIPE data perspective on this as well by running a prefix-exact query for "166.84.0.0/16" at bgp-inspect-RIPE: http://bgpinspect.merit.edu:9090 If there are enough requests I will probably archive those as well. thanks -manish -- Forwarded m

Re: oof. panix sidelined by incompetence... again.

2006-01-23 Thread Manish Karir
You can easily repeat the queries on the bgpinspect website to generate the same results in html files. I just bundled them up into a single pdf for convenience. thanks manish On Mon, 23 Jan 2006, Fergie wrote: Out of curiousity, why must these be in .pdf format? I mean, what's wrong wi

Re: cctld server traffic

2006-01-23 Thread Mehmet Akcin
On Jan 21, 2006 09:42 PM, Randy Bush <[EMAIL PROTECTED]> wrote: ccTLD .PR doesn't have any unusual traffic at the moment. Mehmet Akcin NOC ccTLD .PR > > any cctld ops seeing unusual traffic in the last hours? > > randy >

preventing future situations like panix

2006-01-23 Thread Josh Karlin
Short of perfect filters, or perfect IRRs combined with PKI, it's a difficult problem to stop prefix hijacks such as we've seen this weekend. Myself, Jennifer Rexford, and Stephanie Forrest have been looking at feasible and incrementally deployable solutions to the problem and we would really li

Re: preventing future situations like panix

2006-01-23 Thread Bill Woodcock
On Mon, 23 Jan 2006, Josh Karlin wrote: > The idea is simply to consider 'suspicious' looking routes as a last > resort in the decision process (~1 day). Thus if no alternative route > for a prefix exists, the suspicious route is used regardless, no harm > done. It seems l

Re: preventing future situations like panix

2006-01-23 Thread Todd Underwood
bill,all, On Mon, Jan 23, 2006 at 12:08:11PM -0800, Bill Woodcock wrote: > > On Mon, 23 Jan 2006, Josh Karlin wrote: > > The idea is simply to consider 'suspicious' looking routes as a last > > resort in the decision process (~1 day). Thus if no alternative route > > for a pre

Re: preventing future situations like panix

2006-01-23 Thread Bill Woodcock
On Mon, 23 Jan 2006, Todd Underwood wrote: > > It seems like most of the routers which would need to make this decision > > wouldn't have adequate information upon which to do so... > not necessarily. the decision could be made in "near real time" by > building prefix fi

Re: preventing future situations like panix

2006-01-23 Thread Thor Lancelot Simon
On Mon, Jan 23, 2006 at 12:47:38PM -0700, Josh Karlin wrote: > > Suspicious routes are those that originate at an AS that has not > originated the prefix in the last few days and those that introduce > sub-prefixes. Sub-prefixes are always considered suspicious (~1 day) > and traffic will be rou

Re: preventing future situations like panix

2006-01-23 Thread Joe Abley
On 23-Jan-2006, at 14:47, Josh Karlin wrote: Short of perfect filters, or perfect IRRs combined with PKI, To what extent does the route object validation in the RIPE database (for routes covering RIPE-allocated space), together with maintainer object authentication, provide a "perfect IR

Re: cctld server traffic

2006-01-23 Thread Gustavo Lozano
At 10:42 AM 1/22/2006 +0900, Randy Bush wrote: any cctld ops seeing unusual traffic in the last hours? Nope at .mx. Gustavo randy gus

Re: cctld server traffic

2006-01-23 Thread william(at)elan.net
Maybe I'm ignorant, but isn't there [cc]tld operations mail list somewhere? On Mon, 23 Jan 2006, Gustavo Lozano wrote: At 10:42 AM 1/22/2006 +0900, Randy Bush wrote: any cctld ops seeing unusual traffic in the last hours? Nope at .mx. Gustavo randy gus

Domain name hijack?

2006-01-23 Thread Wil Schultz
Hey all, probably not the best place to ask this but thought that I would give it a shot. At my company I manage 30 or so domain names through various registrars, they existed before I came on board. Today I received an email from a person claiming ownership of one of our valuable ones, valu

Re: cctld server traffic

2006-01-23 Thread bmanning
i am aware of at least 10 of them, 11 if you count NANOG. --bill On Mon, Jan 23, 2006 at 01:48:19PM -0800, william(at)elan.net wrote: > > > Maybe I'm ignorant, but isn't there [cc]tld operations mail list somewhere? > > On Mon, 23 Jan 2006, Gustavo Lozano wrote: > > >At 10:42 AM 1

Re: Domain name hijack?

2006-01-23 Thread Fred Baker
Are they in .org? If so, I would call PIR. More generally, I would suggest you contact the registrar, not ICANN. http://www.icann.org/registrars/accredited-list.html On Jan 23, 2006, at 2:55 PM, Wil Schultz wrote: Hey all, probably not the best place to ask this but thought that I would

Re: preventing future situations like panix

2006-01-23 Thread Josh Karlin
> > It seems like most of the routers which would need to make this decision > > wouldn't have adequate information upon which to do so... > > not necessarily. the decision could be made in "near real time" by > building prefix filters based on the algorithms that josh and co have > worked on and

Re: preventing future situations like panix

2006-01-23 Thread Josh Karlin
> To what extent does the route object validation in the RIPE database > (for routes covering RIPE-allocated space), together with maintainer > object authentication, provide a "perfect IRR", according to your > research? > > (I realise the step from "useful, authenticated source of data" to > "un

Re: Domain name hijack?

2006-01-23 Thread Wil Schultz
The domain in question is a .com I've spoken with our current registrar and they cannot assist since it isn't in their database, so I'm dealing with the registrar that the domain shows at this point. I've asked her to make sure that no changes would be made until this is resolved, she seemed

Re: Domain name hijack?

2006-01-23 Thread Mehmet Akcin
Try to go http://www.archive.org/ and use way back machine to see if there was any page with some contact information or anything like that on the pages that were cached, might help, or might not.. dunno sometimes it helps me. Mehmet Akcin On Jan 23, 2006 07:43 PM, Wil Schultz <[EMAIL PROTECTED]

Re: preventing future situations like panix

2006-01-23 Thread Josh Karlin
For those prefixes announced by ConEd within the last 3 days that it no longer owns, correct, it would not of helped. But saving some is certainly better than none. For the second statement things get a little more subtle. We have considered allowing the trusted originator of a prefix to split

Router upgrade for small colo provider

2006-01-23 Thread josh harrington
Hello, hope this isn't too far offtopic here but being a troller for a long time here I've realized there is a great knowledge base so I wanted to at least see if i could get some tips. I help run a small colocation company in California and I am in the middle of recommending a new 'core router'