44net

44net@mailman.ampr.org

3198 discussions

44/8 allocation
by lleachii.aol.com 04 May '14

04 May '14

John, Lol...you know I meant the major /8's that were handed out long ago that, to date, have never signed an agreement with their RIR. I stand corrected, though, there are Legacy allocations smaller than /8 that exist as well...but they are not listed in RFCs (as fixtures of the 'DARPA Internet'). -KB3VWG

12 35

Fwd: HamWAN DNS update
by John D. Hays 04 May '14

04 May '14

paine-s1.hamwan ADD CNAME ether1.paine-s1.hamwan.net ether1.paine-s1.hamwan ADD A 44.24.240.131 wlan1.paine-s1.hamwan ADD A 44.24.240.145 corvallis-er1.hamwan ADD A 198.178.136.80 seattle-er1.corvallis-er1.hamwan ADD A 44.24.242.20 capitolpark.nq1e.corvallis-er1.hamwan ADD A 44.24.242.0 paine.k7nvh.corvallis-er1.hamwan ADD A 44.24.242.8 corvallis-srv1-kvm.corvallis-er1.hamwan ADD A 44.24.242.25 baldi.corvallis-er1.hamwan ADD A 44.24.242.2 paine.ae7sj.corvallis-er1.hamwan ADD A 44.24.242.4 wlan1.paine-s3.hamwan ADD A 44.24.240.177 ether1.paine-s3.hamwan ADD A 44.24.240.133 wlan1.paine.ae7sj.hamwan ADD A 44.24.242.7 corvallis-er1.hamwan ADD A 198.178.136.80

1 0

Re: [44net] 44Net Digest, Vol 3, Issue 93
by Steve Wright 04 May '14

04 May '14

On Mon, May 5, 2014 at 7:00 AM, <44net-request(a)hamradio.ucsd.edu> wrote: > What are you talking about? Who said anything about professionals, and > why did you bring it up? 44net is for ham radio networks. A "Cell Site", for the uninformed, is a "Cellular Phone site". What he appears to have been working on, in hindsight, appears to be commonly referred to as an "Access Point", or in ham-radio speak, a "Node". A genuine misunderstanding arising from the incorrect placement of a technical term, however I do regret that offence was taken(sic). Reminder to use the correct terminology, and to filter for misunderstandings before unleashing the offence. > I don't see how this has any relation to politics. Bart wants to > identify ISPs that may not work well with 44net due to blocking > tunneling protocols. GRE is just an example, but an ISP could easily > block IPIP, too. > > It would be really helpful to have some software that would tell you > "You're ISP is blocking it" instead of just emailing the 44net list > with "Why don't my tunnels route traffic?" Point taken and conceded. Best way to ask ISPs what they filter, is to simply ASK them. Why would you connect with some ISP and then spend months trying to debug something, when you could simply ASK them beforehand? Perhaps you like your head down such rabbitholes? I do not - I want to plug it in and it works.

4 3

Re: [44net] IP Protocol Filtering
by Jerry Kutche 04 May '14

04 May '14

I'll mess with it when I get home. With no interest when I unplug the linbpq box it stop cycling router when I plug it back in starts immediately. No other PCs on network. On May 4, 2014 12:25 AM, Brian <n1uro(a)n1uro.ampr.org> wrote: > > (Please trim inclusions from previous messages) > _______________________________________________ > Greetings; > > I have noticed that some of the internal routing within comcast hasn't > been as stable lately as it once was, and have especially noticed > extremely high latency between comcast.net and other cable based > networks such as rr.com from doing non-ipencap traces. This of course > would affect any ipencap frames trying to use the same path. > > In regards to the thread that's _unnecessarily_ spawned off from this > same one, there's a huge difference between a protocol and a service. > ISP can filter protocols as most do OSPF, and some may indeed charge for > an OSPF based peer. I've yet, however, to see an ISP charge for a > protocol that a potential VPN would run on... I would think that would > kill corporate-based accounts for them. > -- > 73 de Brian Rogers - N1URO > email: <n1uro(a)n1uro.ampr.org> > Web: http://www.n1uro.net/ > Ampr1: http://n1uro.ampr.org/ > Ampr2: http://nos.n1uro.ampr.org > Linux Amateur Radio Services > axMail-Fax & URONode > AmprNet coordinator for: > Connecticut, Delaware, Maine, > Maryland, Massachusetts, > New Hampshire, Pennsylvania, > Rhode Island, and Vermont. > > _________________________________________ > 44Net mailing list > 44Net(a)hamradio.ucsd.edu > http://hamradio.ucsd.edu/mailman/listinfo/44net >

1 0

Re: [44net] 44Net Digest, Vol 3, Issue 92
by Steve Wright 03 May '14

03 May '14

On Sun, May 4, 2014 at 7:00 AM, <44net-request(a)hamradio.ucsd.edu> wrote: > During some cell site work last night, I seem to have experienced > Comcast dropping packets from point A to point B simply based on the > fact that their IP protocol was GRE (IP protocol 47). I also found some > posts on the Internet that claim Comcast wishes to charge more money to > transport GRE packets. I'm not sure if this is true, or if I made a > mistake somehow in my traffic handling. Therefore... If you really WERE working in a professional role on such equipment, and you ACTUALLY DID notice GRE packets missing, I would hazard a guess that you were perfectly capable of scripting up nc, nmap etc, with some bash or python to do as you ask, instead of trolling this networking group with your political goals. On topic though, I do recall some recent amendments to law (actually rules of a corporation, not real law) where it was specifically forbidden that any ISP rate-limit any service whatsoever, and then charge to un-limit it, so likely the govt is ahead of you on this one. Perhaps an email to the company concerned with a polite request for the same information, and an implied threat to write some network discovery tool might net you dividends you seek, or at least a straight answer - rare as they are.

2 1

Request for Software - IP Protocol Filtering Measurement
by Bart Kus 03 May '14

03 May '14

Hi, During some cell site work last night, I seem to have experienced Comcast dropping packets from point A to point B simply based on the fact that their IP protocol was GRE (IP protocol 47). I also found some posts on the Internet that claim Comcast wishes to charge more money to transport GRE packets. I'm not sure if this is true, or if I made a mistake somehow in my traffic handling. Therefore... Would someone be willing to create software instruments to measure this claim in general? I'd like to see a transmitter and a receiver piece of software that can run on Linux to generate and record a sweep of IP packets carrying all possible protocol numbers (0-255). The protocol payloads themselves don't need to be well-formatted, just the protocol number in the IP header needs to be set. Your software will be considered successful if it measures 100% of all protocols as available over an unfiltered (eg: LAN) link. The results of such a measurement would be useful in gauging the ISP quality of any given carrier. It seems we're moving closer to Selective Protocol Service Providers (SPSP) and away from true Internet Service Providers (ISP) if this GRE finding turns out to be right. --Bart

1 0

spam
by Steve Wright 02 May '14

02 May '14

> On Mon, Apr 28, 2014 at 7:00 AM, <44net-request(a)hamradio.ucsd.edu> wrote: > > BTW, your emails trigger gmail's spam filter -- I'm surprised any of this weeks' postings got past the spam filter whatsoever.... Can we get some tech content please, people? Enough of this rules and politics crap.

2 1

Last minute DDoS attackers
by Gustavo Ponza 29 Apr '14

29 Apr '14

... as per information. gus i0ojj ------------- com. 0 IN SOA a.gtld-servers.net. nstld.verisign-grs.com. 1398772092 1800 900 604800 86400 dnsscan.shadowserver.org. 0 IN A 184.105.143.133 fema.gov. 0 IN NS asia2.akam.net. fema.gov. 0 IN NS eur2.akam.net. fema.gov. 0 IN NS use3.akam.net. fema.gov. 0 IN NS usw4.akam.net. fema.gov. 0 IN NS usc2.akam.net. fema.gov. 0 IN NS usw3.akam.net. fema.gov. 0 IN NS use1.akam.net. . 0 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2014042800 1800 900 604800 86400 com. 0 IN NS f.gtld-servers.net. com. 0 IN NS j.gtld-servers.net. com. 0 IN NS g.gtld-servers.net. com. 0 IN NS e.gtld-servers.net. com. 0 IN NS l.gtld-servers.net. com. 0 IN NS k.gtld-servers.net. admin.wilyee.com. 0 IN A 216.187.94.181 130.99.20.198.IN-ADDR.ARPA. 0 IN PTR census4.shodan.io. 1000.e920862c.dnsr.if-is.net. 0 IN A 134.147.203.115 ddosforums.pw. 0 IN SOA dina.ns.cloudflare.com. dns.cloudflare.com. 2014945315 10000 2400 604800 3600 ddosforums.pw. 0 IN NS dina.ns.cloudflare.com. ddosforums.pw. 0 IN NS ian.ns.cloudflare.com. ianawww.vip.icann.org. 0 IN A 192.0.32.8 www.iana.org. 0 IN CNAME ianawww.vip.icann.org. openresolvertest.net. 0 IN A 204.42.254.5 65cf69a0.openresolvertest.net. 0 IN CNAME openresolvertest.net. 1x1.cz. 0 IN A 46.234.99.18 114.70.20.198.IN-ADDR.ARPA. 0 IN PTR census3.shodan.io. isc.org. 0 IN NS ns.isc.afilias-nst.info. isc.org. 0 IN NS ord.sns-pb.isc.org. dnsamplificationattacks.cc. 0 IN SOA a.dns.gandi.net. hostmaster.gandi.net. 1349871047 10800 3600 604800 10800 dnsamplificationattacks.cc. 0 IN MX 10 spool.mail.gandi.net. dnsamplificationattacks.cc. 0 IN MX 50 fb.mail.gandi.net. dnsamplificationattacks.cc. 0 IN A 217.70.184.38 dnsamplificationattacks.cc. 0 IN NS c.dns.gandi.net. dnsamplificationattacks.cc. 0 IN NS b.dns.gandi.net. dnsamplificationattacks.cc. 0 IN NS a.dns.gandi.net. shodan.io. 0 IN NS b.dns.gandi.net. shodan.io. 0 IN NS a.dns.gandi.net. shodan.io. 0 IN NS c.dns.gandi.net. openresolverproject.org. 0 IN A 204.42.254.5 65cf69a0.openresolverproject.org. 0 IN CNAME openresolverproject.org. ietf.org. 0 IN NS ns1.yyz1.afilias-nst.info. ietf.org. 0 IN NS ns1.ams1.afilias-nst.info. ietf.org. 0 IN NS ns1.mia1.afilias-nst.info. ietf.org. 0 IN NS ns0.amsl.com. ietf.org. 0 IN NS ns1.sea1.afilias-nst.info. ietf.org. 0 IN NS ns1.hkg1.afilias-nst.info. iorr.ru. 0 IN SOA ns1.reg.ru. hostmaster.ns1.reg.ru. 1397802273 14400 3600 604800 43200 iorr.ru. 0 IN A 123.123.123.26 iorr.ru. 0 IN A 123.123.123.70 iorr.ru. 0 IN A 123.123.123.17 iorr.ru. 0 IN A 123.123.123.41 iorr.ru. 0 IN A 123.123.123.158 iorr.ru. 0 IN A 123.123.123.67 iorr.ru. 0 IN A 123.123.123.137 iorr.ru. 0 IN A 123.123.123.101 iorr.ru. 0 IN A 123.123.123.61 iorr.ru. 0 IN A 123.123.123.119 iorr.ru. 0 IN A 123.123.123.79 iorr.ru. 0 IN A 123.123.123.190 iorr.ru. 0 IN A 123.123.123.229 iorr.ru. 0 IN A 123.123.123.237 iorr.ru. 0 IN A 123.123.123.4 iorr.ru. 0 IN A 123.123.123.66 iorr.ru. 0 IN A 123.123.123.224 iorr.ru. 0 IN A 123.123.123.183 iorr.ru. 0 IN A 123.123.123.110 74.69.20.198.IN-ADDR.ARPA. 0 IN PTR census1.shodan.io. -----------------

1 0

chargen service
by Brian Kantor 29 Apr '14

29 Apr '14

You should check to make sure that you have the 'chargen' service disabled on your hosts, and block it in your routers if you can. I've already contacted the people whose system was involved in this attack. - Brian ----- Forwarded message ----- Subject: Exploitable chargen service used for an attack: 44.x.x.x. It appears that a public "chargen" service on your network, running on IP address 44.x.x.x, participated in a large-scale attack against a customer of ours today, generating large UDP responses to spoofed probes that claimed to be from the attack target. chargen is an old testing service that generates large quantities of traffic with only a small request required. It is commonly enabled by default on old printers and other connected appliances, but it has no useful purpose over the open internet. Please block UDP port 19 (inbound and outbound) at your network edge, as this should stop these chargen attacks without blocking legitimate traffic. If the endpoint device that generated this traffic is configurable, please further investigate whether it is running a chargen service (and disable it, if so) -- commonly exploited devices include Cisco hardware that has "udp small servers" mistakenly enabled, old printers, old UNIX boxes with "chargen" running under inetd, and Windows boxes with the "Simple TCP/IP services" package installed. Also, it is worth checking if it is a machine that has been compromised, as some malware directly generates port 19 traffic, simulating chargen, and in this way masks its presence. If you are an ISP, please also look at your network configuration and make sure that you do not allow spoofed traffic (that pretends to be from external IP addresses) to leave the network. Hosts that allow spoofed traffic make possible this type of attack. ----- End forwarded message -----

2 1

Re: [44net] chargen service
by kb9mwr＠gmail.com 29 Apr '14

29 Apr '14

Jerry, Stick this in the DD-WRT administration command shell box: /sbin/iptables -A OUTPUT -p udp --dport 19 -j DROP

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net