<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Works via Vocus/HE. Assuming they
aren't using that filter.<br>
<br>
<br>
On 11/04/2013 4:08 PM, Tim Warnock wrote:<br>
</div>
<blockquote
cite="mid:C978DD0EE401174299AA691E12A5025613114792@hermes.timoid.lan"
type="cite">
<pre wrap="">That IP on the Interpol filter?
Doesn’t work on Vodafone network either.
<a class="moz-txt-link-freetext" href="http://delimiter.com.au/2013/03/25/vodafone-sends-interpol-filter-live/">http://delimiter.com.au/2013/03/25/vodafone-sends-interpol-filter-live/</a>
</pre>
<blockquote type="cite">
<pre wrap="">-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a> [<a class="moz-txt-link-freetext" href="mailto:ausnog">mailto:ausnog</a>-
<a class="moz-txt-link-abbreviated" href="mailto:bounces@lists.ausnog.net">bounces@lists.ausnog.net</a>] On Behalf Of Danny O'Brien
Sent: Thursday, 11 April 2013 3:53 PM
To: <a class="moz-txt-link-abbreviated" href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>
Subject: [AusNOG] Understanding lack of Aus connectivity to
melbournefreeuniversity.org.
Hi AusNOG,
Apologies for the interruption -- I work for the Electronic Frontier Foundation
in the US, and usually lurk on the NANOG lists, asking the occasional curious
question about once a decade (Including "Where did Egypt just go?<a class="moz-txt-link-rfc2396E" href="http://seclists.org/nanog/2011/Jan/1416and">"
http://seclists.org/nanog/2011/Jan/1416 and "</a>What happens when Ripe.net
doesn't pay their domain fees?" <a class="moz-txt-link-freetext" href="http://seclists.org/nanog/1998/Apr/50">http://seclists.org/nanog/1998/Apr/50</a> ).
My question to this even more distinguished audience is a little narrower:
We got a message from Melbourne Free University yesterday, whose site
hosted at 198.136.54.104 in the US was unavailable from Optus and Telstra
consumer users.
It looks to me that this specific IP is being patchily blackholed, mostly from
Australian addresses. My working assumption is that this is due to DDOS
mitigation.
The reason why Melbourne Free University got in touch with us, though, was
that when they contacted their own broadband service provider., Exetel, to
complain, their support eventually told them that upstream, AAPT, was
blocking it due to an Australian government request, and could say no more
about it. (The ticket is below.)
MFU is understandably a bit disturbed by such a statement from their ISP, as
are we. I *am* at this stage assuming miscommunication rather than
government action. I've reached out to AAPT and Exetel, and been banging
on BGP looking glasses and traceroutes all day, and not getting much
response, so I thought I'd broaden out the query and ask you all:
1) Is anyone here blackholing 198.136.54.104 or the /20 (though I've seen
people being able to reach .103 and .105 fine, but lose 104) for DDOS or other
operational reasons?
2) Hypothetically, can anyone suggest a Federal court order or government
process that would lead to such a blackhole for *non*-operational reasons?
Thank you for your attention -- I hope your curiousity is as piqued as mine
was.
d.
</pre>
<blockquote type="cite">
<pre wrap=""> Please note that we regret to inform that the IP address has been
</pre>
</blockquote>
<pre wrap="">blocked
</pre>
<blockquote type="cite">
<pre wrap=""> by Australian authority for undisclosed reasons.
As per our supplier, due to the legal department our supplier is unable to
share any information regarding the blocking of the IP address. Therefore
we are not able to provide the details regarding who has blocked the IP
</pre>
</blockquote>
<pre wrap="">or
</pre>
<blockquote type="cite">
<pre wrap=""> why because the supplier wont provide these info.
Also note that our supplier is unable to have this IP unblocked.
Level 1 - Network Support Engineer
Exetel Pty Ltd
</pre>
</blockquote>
<pre wrap="">
Here is the route taken by an Exetel consumer subscriber using the AAPT
network attempting to access the site.
> $ traceroute <a class="moz-txt-link-abbreviated" href="http://www.melbournefreeuniversity.org">www.melbournefreeuniversity.org</a>
> traceroute to melbournefreeuniversity.org (198.136.54.104), 64 hops
max, 40
> byte packets
> 1 XXXXXXXXXXXXX (192.168.1.254) 1 ms 1 ms 1 ms
> 2 XXX.XXX.96.58.static.exetel.com.au (58.96.XXX.XXX) 18 ms 19 ms 18
ms
> 3 33.2.96.58.static.exetel.com.au (58.96.2.33) 19 ms 18 ms 19 ms
> 4 pe-5017370-mburninte01.gw.aapt.com.au (203.174.186.73) 24 ms 20
ms
> 20 ms
> 5 te3-3.mburndist01.aapt.net.au (203.131.61.30) [MPLS: Label 190 Exp
1]
> 35 ms 35 ms 31 ms
> 6 te0-3-4-0.mburncore01.aapt.net.au (202.10.12.15) [MPLS: Label 17412
Exp
> 7 bu2.sclarcore01.aapt.net.au (202.10.10.74) [MPLS: Label 16702 Exp 1]
> More labels 49 ms More labels 32 ms More labels 31 ms
> 8 te2-2.sclardist01.aapt.net.au (202.10.12.2) [MPLS: Label 895 Exp 1] 31
> ms 32 ms 33 ms
> 9 * po6.sclarbrdr01.aapt.net.au (202.10.14.3) 30 ms *
> 10 * * *
> 11 * * *
Here is the route taken by a Telstra subscriber in Brisbane.
> $ traceroute to <a class="moz-txt-link-abbreviated" href="http://www.melbournefreeuniversity.org">www.melbournefreeuniversity.org</a>
<a class="moz-txt-link-rfc2396E" href="http://www.melbournefreeuniversity.org"><http://www.melbournefreeuniversity.org></a> (198.136.54.104), 30 hops max,
60 byte packets
> 1 10.205.XX.XX (10.205.XX.XX) 8.936 ms 8.989 ms 8.977 ms
> 2 58.160.XX.XX (58.160.XX.XX) 9.349 ms 9.425 ms 9.482 ms
> 3 58.160.XX.XX (58.160.XX.XX) 9.705 ms 9.765 ms 9.753 ms
> 4 172.18.241.105 (172.18.241.105) 12.691 ms 12.817 ms 12.705 ms
> 5 bundle-ether10-woo10.brisbane.telstra.net (110.142.226.13) 15.426
ms 15.482 ms 14.644 ms
> 6 bundle-ether3.woo-core1.brisbane.telstra.net (203.50.11.52) 17.872
ms 12.953 ms 13.940 ms
> 7 bundle-ether11.chw-core2.sydney.telstra.net (203.50.11.70) 25.653
ms 26.135 ms 26.054 ms
> 8 bundle-ether1.pad-gw1.sydney.telstra.net (203.50.6.25) 27.017 ms
27.078 ms 27.072 ms
> 9 gigabitethernet0-2.pad-service2.sydney.telstra.net (203.50.6.70)
24.064 ms 24.129 ms 24.111 ms
> 10 * *
> 11 *
> 12 *
> 13 *
</pre>
</blockquote>
<pre wrap="">
_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title></title>
<img src="cid:part1.07060401.01050906@delion.com.au" alt=""><br>
<p class="MsoNormal" style="margin-bottom: 0.0001pt;"><b style=""><span
style="font-size: 8pt; line-height: 115%; font-family:
"Arial","sans-serif"; color: gray;">Delion
Pty Ltd<br>
<a class="moz-txt-link-abbreviated"
href="http://www.delion.com.au">www.delion.com.au</a><br>
</span></b></p>
<b style=""><span style="font-size: 8pt; line-height: 115%;
font-family: "Arial","sans-serif"; color:
gray;">1300 576 369<br>
(02) 8061 4502<br>
<a class="moz-txt-link-abbreviated"
href="mailto:brad@delion.com.au">brad@delion.com.au</a></span></b>
</div>
</body>
</html>