Our whole netblock 202.154.64.0/18 seems to be barred from anything
.mil. Domain name resolution, MX, IP traceroute, the lot.
Anyone able to shed any light on this?
Any advice/feedback appreciated.
Regards,
Steve
Our whole netblock 202.154.64.0/18 seems to be barred from anything
.mil. Domain name resolution, MX, IP traceroute, the lot.Anyone able to shed any light on this?
note, I don't work for the DoD (.mil owners) BUT, this isn't the first
time someone has mentioned this kind of problem... normally the 'reason'
is: "Hackers came from there" or "we don't want to allow these folks
access to our network for 'other' reasons" In reality its their little
piece of the pie, if they don't want you to eat it they can keep you outta
the fridge 
Thus spake "Steve Waddington" <stevew@onet.com.au>
Our whole netblock 202.154.64.0/18 seems to be barred from anything
.mil. Domain name resolution, MX, IP traceroute, the lot.Anyone able to shed any light on this?
US DoD has a longstanding policy of blocking all addresses which appear to
be of non-US origin. Your block comes from APNIC, so that's probably what's
happening to you.
S
Stephen Sprunk "God does not play dice." --Albert Einstein
CCIE #3723 "God is an inveterate gambler, and He throws the
K5SSS dice at every possible opportunity." --Stephen Hawking
In recent times, a lot of .mil have thrown up a whole bunch of null routes to large sections of international address space. Good luck getting them removed
In recent times, a lot of .mil have thrown up a whole bunch of null routes
to large sections of international address space. Good luck getting them
removed
as this means they have a different definition of the internet than
the one to which i, and i suspect others, are used, why should i and
others accept their routes?
randy
I don't know. Why should you?
Maybe the rest of the net should return the favor and drop .mil routes
until they decide to get working abuse@ and postmaster@ addresses. They
seem to think its fine that .mil boxes can spam and attack civilian
networks and apparently arent interested in hearing the complaints.
-Dan
Thus spake "Randy Bush" <randy@psg.com>
> In recent times, a lot of .mil have thrown up a whole bunch of null
> routes to large sections of international address space. Good luck
> getting them removedas this means they have a different definition of the internet than
the one to which i, and i suspect others, are used, why should i and
others accept their routes?
For the same reason anyone else accepts their routes -- because they want to
be able to reach them. If they don't want to reach _you_, that's their
choice.
Nothing prohibits any part on the internet from blocking other parties they
believe to be dangerous, whether it be due to warfare, spam, or other
considerations.
S
Stephen Sprunk "God does not play dice." --Albert Einstein
CCIE #3723 "God is an inveterate gambler, and He throws the
K5SSS dice at every possible opportunity." --Stephen Hawking
I can't and won't speak for others, but when i was handling abuse issues
I never once had a problem making contact with responsible people at .mil
sites to get issues addressed. 9 times out of 10 it took all of one phone
call or one email.
If the .MIL network can't provide International Internet service, is it
time to move the g.root-servers.net and h.root-servers.net off their
current .MIL hosts to better locations to serve the entire Internet.
Otherwise .MIL policies reduce the robustness of the overall Internet.
Heck, even when Paul Vixie did his original black-hole lists, he made
certain that even the worst spammers could still use f.root-servers.net.
What email address?
Last time we were smurfed by the army it took 3 months of phone calls to
get them to stop it.
-Dan
From the info supplied in a lookup I'd do a little detective work and
find a working website related to the domain in question and go from
there. It's cheesy but it worked.
I guess you were lucky then, the addresses we were smurfed from had no
related website, and the phone # on the whois was outdated.
When I finally did manage to get a hold of a network engineer they didnt
seem particularly interested in hearing about the problem. Hence it took
3 months of constant calling to get their smurf amps shut down.
And they *still* dont have a working abuse@ or postmaster@ which imho is
simpy irresponsible for such an organization. Someone should get sacked.
-Dan
Precedent, Randy, Precedent !
UUnet and few others a long time ago had a differing definition of
"peering" that most of us thought, at the time...
But were so BIG, we accepted their routes, anyway.
* shrug *
A secret black list is a real bugger if:
No one is allowed to mention it exists.
If you get on it, there is now way off, no "right of redress".
No one can -tell- you you are on it.
No one can tell you if you -aren't-.....
And if you -somehow- figure out your on it,
they can't admit it,
or the -reason- you are on it,
or take you off even if they wanted.
Any and all of the above.
On a lighter note, the US Senate recently
unsealed the American McCarthy Hearing records.
:O :* :}
Randy Bush wrote:
As Sean Donelan pointed out, the fact that 2 of the root name servers are inside their network, there is more to the issue than you suggest.... I for example want people in Australia to be able to reliably lookup DNS info on my domains. The .mil people have decided to hamper this process.
---Mike
I agree. The root servers should have no filtering in place to block any
demographics (unless of course a given node is DoSing them).
The last time I tried to contact a .mil to report an open relay that was
being abused, I was accused of being a spammer that had "hacked" their
server. Since that time I reject .mil mail.
Justin
If the .MIL network can't provide International Internet service, is it
time to move the g.root-servers.net and h.root-servers.net off their
current .MIL hosts to better locations to serve the entire Internet.
Otherwise .MIL policies reduce the robustness of the overall Internet.Heck, even when Paul Vixie did his original black-hole lists, he made
certain that even the worst spammers could still use f.root-servers.net.
Whatever filtering some .MIL sites may or may not be doing, I don't believe that g or h.root-servers.net are affected.
I've tried tracing to them from systems in .uk, .tw, .ru, .kr, .and hk and I get the same results from them as I do from my ARIN allocated US IP blocks. (trace to G with no problem, H has ICMP blocked at gw328-hroot.arl.army.mil, but UDP port 53 seems to get though fine)
To be honest, I'd be rather surprised if .MIL as a whole did ANYTHING jointly. The number of independant networks, AS's, borders and administrators would make it really difficult for any blanket policy to take effect everywhere.
-- Kevin
Suggestion: migrate the current MIL root servers to the DREN
network. Thus they would be easily accessible from DoD's
networks, while residining in front of any MIL filters or
blackhole routers relative to the rest of the Internet.
One already is. The H server resides at the Army Research Lab, which is connected to DREN (AS668).
FWIW there is not a single homogeneous .mil network. There are several DoD networks that provide service to customer organizations, and some of the major public DoD sites are also directly connected to commercial ISP's. Also different services and sites may have different policies as to who they allow access from. So without knowing the destination address, it's hard to be able to tell someone who thinks they are being blocked who to contact. If you can't reach a site directly, try their upstream providers and see if they can help provide a POC. Try looking at the aspath for the destination, and if any of the following show up, try these POC's:
AS668 (DREN) 866-NOC-DREN or noc@dren.net
AS7170 (ATT-DISC) 888-DISC-USA or noc@att-disc.net
AS568 (DISN) DISA GNOSC at 703-607-4001 or the Columbus RNOSC at 800-554-3476
For security related issues, try contacting the DoD CERT (www.cert.mil, 800-357-4231). All of the services have their own CERT as well, however they all coordinate with this organization.
-Mark Ganzer
Space & Naval Warfare Systems Center, San Diego
ganzer@spawar.navy.mil note: this is posted from my personal email account, not my work account).
Mark Borchers wrote:
Cough, bad idea, cough. From past experience I don't think that you'll
find the DREN to be substantially more reliable as far as reachability
and blocking policies go than most of the rest of .mil. It USED to
be more open, but there were some policy changes, some peering arangements,
and voila they are under the same guidelines.