Did anyone else notice the withdrawal of 205.178.184.0/21? I couldn't reach Network Solutions or any worldnic.com DNS servers for at least 10 minutes from our network or any route server I tried on the Internet. All were on this /21 which was no longer being announced from any perspective I saw.
Vinny Abello
Network Engineer
Server Management
vinny@tellurian.com
(973)300-9211 x 125
(973)940-6125 (Direct)
PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A
Tellurian Networks - The Ultimate Internet Connection
http://www.tellurian.com (888)TELLURIAN
"Courage is resistance to fear, mastery of fear - not absence of fear" -- Mark Twain
We saw it as well this morning, several of our accounts
host DNS through worldnic, and they were down. Appears
up now though.
--tlf
We saw repeated withdrawals of 205.178.184.0/21, and it lasted well over an hour..
#show ip bgp 205.178.190.1
BGP routing table entry for 0.0.0.0/0
5 minutes later:
#show ip bgp 205.178.190.1
BGP routing table entry for 205.178.184.0/21
We were seeing the prefix re-appear for one provider at a time, then withdrawl.
traceroute to ns95.worldnic.com (205.178.190.48), 30 hops max, 38 byte packets
1 aggr1a.lon.rackspace.net (212.100.224.2) 0.267 ms 0.193 ms 0.182 ms
2 g3-16.core1.lon.rackspace.net (83.138.138.66) 0.225 ms 0.217 ms 0.196 ms
3 g1-1.edge2.lon.rackspace.net (83.138.138.33) 0.278 ms 0.238 ms 0.206 ms
4 g1-2.edge3.lon.rackspace.net (83.138.138.34) 0.905 ms 0.818 ms 0.855 ms
5 347.ge5-0.mpr2.lhr1.uk.above.net (213.152.230.106) 0.984 ms !H *
We have been unable to resolve speakeasy.net. Both authoritative nameservers are unresponsive (ns.nyc1.speakeasy.net and ns-sea.speakeasy.net). Anyone else seeing any issues?
Fox,Thomas wrote:
Here is the scoop.
Dear Valued Partner,
This morning our collocation provider suffered a global outage from 7:56
a.m. to 10:02 a.m. (eastern) that impacted the Network Solutions systems.
The provider�s outage affected access to Network Solutions products and
services. The provider has resolved the issues with their systems and
access to our services has been restored.
We appreciate your patience and apologize for the inconvenience. Please
note, you may experience latency today as we continue to restore our
services to full capacity. If you have any questions regarding this
message, please contact your Partner Support Representative or e-mail us
at
Here is the scoop.
Dear Valued Partner,
This morning our collocation provider suffered a global outage from 7:56
a.m. to 10:02 a.m. (eastern) that impacted the Network Solutions systems.
The providers outage affected access to Network Solutions products and
services. The provider has resolved the issues with their systems and
access to our services has been restored.
We appreciate your patience and apologize for the inconvenience. Please
note, you may experience latency today as we continue to restore our
services to full capacity. If you have any questions regarding this
message, please contact your Partner Support Representative or e-mail us
at
Elijah, thanks. We see 205.178.184.0/21 originated by 6245
and generally only advertised via 3561 pretty consistently.
The first withdrawals of 205.178.184.0/21 on 04/04/2006 were seen
around 12:00 UTC and from then until ~12:50 UTC the
prefix is announced sporadically then withdrawn everywhere.
Nothing is seen from them for about an hour and then everything
went back the way it was ~14:03UTC.
Just to be sure we weren't seeing any sort of root attack that
has been being talked about lately, I looked at F, I, and some
others and things looked in order.
Looks like 3561 could be writing the RFO.
-M<
Hi,
"Meanwhile, in the second attack of its kind in the past few days, DNS
servers at Network Solutions were hit by a denial-of-service attack,
resulting in a brief performance degradation for customers, according
to the company."
http://groups.google.com/group/n3td3v/browse_thread/thread/a92bc5b744c99705/31bb362a6ddd0e37#31bb362a6ddd0e37
Regards,
n3td3v
Side note:
Please don't complain about not using a 'real name', you can always
ban me from Nanog, to which I will use another e-mail address the next
time I have something to add to the list. Dog chasing its tail for the
Nanog moderator I guess. However everyone knows who n3td3v is, and to
use any other name would be a great injustice to the list, in the way
it would be misleading and mystifying for people wondering, "is this
n3td3v on a 'real name'?". See you next time as n3td3v, and no other
name will ever be used as far as n3td3v and Nanog are concerned.
The above report may be innacurate.
http://www.computerworld.com/developmenttopics/websitemgmt/story/0,10801,110193,00.html
There are many more reports that are saying it was a technical problem
as we outlined this afternoon.
-M<