March 2008 - NANOG - lists.nanog.org

spammed by a hardware resale outfit...
by Robert E. Seastrom 03 Mar '08

03 Mar '08

Hi all, Received a spam-and-cold-call-to-my-cell-phone one-two-punch this morning by an unrepentant Michael Andolino from Network Liquidators, Inc. of Oldsmar, FL. Anyone else get an unlucky start to their Monday? I'm beginning to think that nanog.cluepon.net needs "good guys" and "bad guys" pages so that we can all make doubly sure we're not doing business with spammers (and just as importantly, a community resource for reviews of used equipment vendors). Thoughts? ---Rob

6 5

OT: One Wilshire photos.
by Roland Dobbins 03 Mar '08

03 Mar '08

<http://www.wired.com/techbiz/it/multimedia/2008/03/ gallery_one_wilshire> ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)cisco.com> // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcolm Forbes

4 3

NANOG 43 Brooklyn -- Call For Presenatations
by Todd Underwood 03 Mar '08

03 Mar '08

[puts NANOG Program Committee Chair hat on...] [Note the timeline below--this is an extremely compressed schedule]. The NANOG 43 conference will be held in Brooklyn, NY on June 1-3, 2008, to be sponsored by Telx (http://www.telx.com/) This is a particularly exciting NANOG for many attendees because it is the first time that NANOG has been held in New York City. This gives residents of that city (and the surrounding areas) an opportunity to attend NANOG on their home turf, and perhaps the opportunity to suggest content for the conference of particular relevance to the NYC area. It gives the rest of us a great reason to visit a city where mass transit doesn't shut down at night. The NANOG Program Committee (PC) is actively soliciting talks for that event and we have an extremely tight submission schedule. Some (of the many) ideas that we're considering for this NANOG include: * submarine cable systems. optics, phsysics, martime conditions, economics, services * interconnections. IXes, intra-building, MMR, metro-wide connections, peering, transit purchasing tactics and strategies * security. routing security (hijacking), route filtering of large peers/customers. inter-as security and cooperation. * dns. using dns data for network metrics, botnet discovery, geolocation and other fun. * ipv6. real-world deployment challenges. NAT-PT implementations that work and scale. allocation strategies. In general, we are seeking presentations by and for network operators of all sizes. We want to see presentations about difficult problems (and interesting solutions) that you encounter in the course of your job. We know it's always easier to get presentations from people who are paid to do it (vendors, marketing people) but attendees of previous NANOG conferences tell us that the best presentations are frequently by fellow operators. If you think you have an interesting topic but want some feedback or some help working it into a presentation, please email me and I'll make sure that someone on the PC gives you the feedback you need to work your idea into a presenatation worth giving. What do you get if you present? A free pass to NANOG, rock star status among your peers, and a permanent place of fame on the Internet. Also note that NANOG44 will be held in Los Angeles, jointly with ARIN on October 12-14. So mark your calendars. If you cannot present at NANOG43 Brooklyn, the PC is already actively soliciting talks for Los Angeles as well. Key dates for NANOG 43: NOW Web tool open to accept submissions http://www.nanogpc.org/ ***** [Rolling evaluation of talks begins] ***** ***** [Talks submitted earliest have the best chance of acceptance] ***** 14-Mar-08 Deadline for submissions. Talks submitted by the point will receive full consideration for a slot at NANOG43. 31-Mar-08 Draft Agenda Posted 4-Apr-08 Deadline for late submissions. Talks submitted by this deadline may be considered for open spots in the agenda. 24-Apr-08 Last scheduled PC call to finalize agenda. 29-Apr-08 Final agenda posted to NANOG mailing list. [Lighting talk evaluations begins] 01-June-08 - NANOG 43 begins! thanks, t. [that hat was bugging me] -- _____________________________________________________________________ todd underwood +1 603 643 9300 x101 renesys corporation general manager babbledog todd(a)renesys.com http://www.renesys.com/blog

2 2

RE: YouTube IP Hijacking
by Tomas L. Byrnes 03 Mar '08

03 Mar '08

Which means that, by advertising routes more specific than the ones they are poisoning, it may well be possible to restore universal connectivity to YouTube. > -----Original Message----- > From: Michael Smith [mailto:msmith@internap.com] > Sent: Sunday, February 24, 2008 1:23 PM > To: neil.fenemor(a)fx.net.nz; Tomas L. Byrnes > Cc: will(a)harg.net; nanog(a)merit.edu > Subject: Re: YouTube IP Hijacking > > Exactly... They inadvertently made the details of their > oppression more readily apparent... > > > ----- Original Message ----- > From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> > To: Tomas L. Byrnes <tomb(a)byrneit.net> > Cc: Will Hargrave <will(a)harg.net>; nanog(a)merit.edu <nanog(a)merit.edu> > Sent: Sun Feb 24 16:00:35 2008 > Subject: Re: YouTube IP Hijacking > > > While they are deliberately blocking Youtube nationally, I > suspect the wider issue has no malice, and is a case of > poorly constructed/ implemented outbound policies on their > part, and poorly constructed/ implemented inbound polices on > their upstreams part. > > On 25/02/2008, at 9:49 AM, Tomas L. Byrnes wrote: > > > > > Pakistan is deliberately blocking Youtube. > > > > http://politics.slashdot.org/article.pl?sid=08/02/24/1628213 > > > > Maybe we should all block Pakistan. > > > > > > > >> -----Original Message----- > >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > On Behalf > >> Of Will Hargrave > >> Sent: Sunday, February 24, 2008 12:39 PM > >> To: nanog(a)nanog.org > >> Subject: Re: YouTube IP Hijacking > >> > >> > >> Sargun Dhillon wrote: > >> > >>> So, it seems that youtube's ip block has been hijacked by a more > >>> specific prefix being advertised. This is a case of IP > >> hijacking, not > >>> case of DNS poisoning, youtube engineers doing something > >> stupid, etc. > >>> For people that don't know. The router will try to get the most > >>> specific prefix. This is by design, not by accident. > >> > >> You are making the assumption of malice when the more > likely cause is > >> one of accident on the part of probably stressed NOC staff > at 17557. > >> > >> They probably have that /24 going to a gateway walled garden box > >> which replies with a site saying 'we have banned this', > and that /24 > >> route is leaking outside of their AS via PCCW due to dodgy > >> filters/communities. > >> > >> Will > >> > > Neil Fenemor > FX Networks > > >

38 67

The Router Hacking Challenge is Over! (fwd)
by Gadi Evron 02 Mar '08

02 Mar '08

For those interested. ---------- Forwarded message ---------- Date: Sat, 1 Mar 2008 22:08:29 +0000 From: Petko D. Petkov <pdp.gnucitizen(a)googlemail.com> To: full-disclosure(a)lists.grok.org.uk, bugtraq(a)securityfocus.com Subject: The Router Hacking Challenge is Over! http://www.gnucitizen.org/projects/router-hacking-challenge/ The Router Hacking Challenge is Over! We've got some very interesting results which prove that routers', and in general embedded devices', security is poor. There is definitely more room for further development and we urge security researchers and hobbyists to keep the challenge alive with new submissions. I hope that the challenge was as educational and entertaining as practical and useful to all of us. Here is a quick summary, in no particular order, of the types of vulnerabilities we are exhibiting: * authentication bypass * a-to-c attacks * csrf (cross-site request forgeries) * xss (cross-site scripting) * call-jacking - like making your phone dial numbers or even survey room's sound where the phone resides * obfuscation/encryption deficiencies * UPnP, DHCP and mDNS problems - although not officially reported, most devices are affected * SNMP injection attacks due to poor SNMP creds. * memory overwrites - well it is possible to overwrite the admin password while being in memory and therefore be able to login as admin * stealing config files * cross-file upload attacks - this is within the group of csrf attacks * remote war-driving - way cool * factory restore attacks * information disclosure * etc, etc, etc Please check the project page for more information and be sure that we will continue posting interesting info on that subject in the future. Also, if you have some findings on your own, pls let us know as we are very interested to learn about. pdp -- http://www.gnucitizen.org http://www.gnucitizen.com http://www.hakiri.org GNUCITIZEN

1 0

AboveNet Global Routing issue
by Ross Vandegrift 01 Mar '08

01 Mar '08

Hi Everyone, Just received a light-up of calls about general connectivity, a call to AboveNet got us the answer that they are having "global routing issues". Has anyone received any more details? -- Ross Vandegrift ross(a)kallisti.us "The good Christian should beware of mathematicians, and all those who make empty prophecies. The danger already exists that the mathematicians have made a covenant with the devil to darken the spirit and to confine man in the bonds of Hell." --St. Augustine, De Genesi ad Litteram, Book II, xviii, 37

8 8

Prefix filtering for Cisco SUP2
by Henry Futzenburger 01 Mar '08

01 Mar '08

I am hoping to help an ISP keep a couple of Cisco 6500's with SUP2's in production for a while longer. They are currently just about at the FIB limit of 250,000 entries, mostly composed of BGP routes. I'm considering two alternatives to reduce the number of entries. 1. Accept only default and partial routes from upstream. a. Accept directly-connected routes, reject everything else and rely on the default route. b. Assume a reduction to about 30,000 unique routes per upstream ISP (currently 3). 2. Accept only default and RIR minimum routes from upstream. a. Filter based on RIR minimums, rely on default for unaggregated routes. b. Assume a reduction of about 50,000-100,000 total routes. Does anyone have any opinions as to whether one option is better than the other? Are there options that would be better than either of these? Are there serious risks to either option? My sense is that either of these would be a fairly benign change, only having a marginal impact on routing efficiency in either case. It seems like the better option is the one that retains the greater number of routes within some margin of safety. What do you think?

4 3