January 2010 - NANOG - lists.nanog.org

Re: Anyone see a game changer here?
by Sachs, Marcus Hans (Marc) 15 Jan '10

15 Jan '10

The APT is the new game. Old rules, new game. -------------------------- Marcus H. Sachs Verizon +1 202 515 2463 Sent from my Verizon BlackBerry Storm http://www.verizonwireless.com/storm ----- Original Message ----- From: Gadi Evron <ge(a)linuxbox.org> To: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Fri Jan 15 09:21:15 2010 Subject: Re: Anyone see a game changer here? On 1/15/10 4:07 PM, Bruce Williams wrote: > As if the old threat models weren't bad enough... The old threat models were simply not up to date. Gadi. > > > Bruce > > -- Gadi Evron, ge(a)linuxbox.org. Blog: http://gevron.livejournal.com/

2 1

Cogent Outage?
by Joe Johnson 15 Jan '10

15 Jan '10

We just lost Cogent across the country, along with several sister companies. Can't get through to a support person. Any idea what's going on? Joe Johnson Chief Information Officer Riverside Consulting Group, Ltd. Phone: 708.442.6033 x3456 Fax: 708.442.9722 joe(a)riversidecg.com www.riversidecg.com

19 22

ICSI Netalyzr launch #2
by vern＠ee.lbl.gov 14 Jan '10

14 Jan '10

Folks, you may recall that last June we released a beta version of Netalyzr, a Java applet you can run by surfing to netalyzr.icsi.berkeley.edu (or to netalyzr.com) It measures a bunch of the properties of an end user's network access, particularly looking for transparent modifications (e.g., hidden proxies or blocking), connectivity restrictions, DNS modifications, and some security issues (e.g., whether the DNS resolver is vulnerable to the Kaminsky attack). You can see a sample report at: http://netalyzr.icsi.berkeley.edu/restore/id=example-session That launch was fairly successful (~50K users). Since then we've been working on a bunch of improvements, and today we've gone out of beta with an updated version, so you may be hearing about reports your customers have gotten from it. Also, as Netalyzr forms the foundation for a large-scale measurement study of the Internet's edge, to the degree that you pass along the word so that more people run it, that would be highly helpful with us gathering comprehensive data for the project. Thanks, Vern Vern Paxson Associate Professor EECS Department 737 Soda Hall - MC 1776 University of California Berkeley, CA, USA 94720-1776 +1 510 643-4209 vern(a)eecs.berkeley.edu

4 4

vlan translation and stp
by Srg 14 Jan '10

14 Jan '10

Hello: We are going to have the following (simplified scenario): - vlans 101,102 are going to have servers. - vlan 101 uses 10.101.101.0/24 addressing and vlan 102 uses 10.102.102.0/24 addressing. - vlans 101 and 102 doesn't have level 3. - vlans 201,202 are going to have the level3 interfaces corresponding to vlans 101 and 102 respectively, so vlan201 will have the "interface vlan 201" defined as 10.101.101.1/24 and vlan202 will have the "interface vlan 202" defined as 10.102.102.1/24 At this point, if we do not any more things, servers from vlan101 or vlan102 will not be able to reach their default gateway because the default gateway is in another vlan. OK, Then we get two devices (IPS1 & IPS2), each of them having two interfaces. IPS1,interface 1 is connected to switch1 port 1/1. IPS1,interface 2 is connected to switch2 port 2/1. IPS2,interface 1 is connected to switch1 port 1/2. IPS2,interface 2 is connected to switch2 port 2/2. switch1,port 1/1 is a trunk with allowed vlans 101,102. switch1,port 1/2 is a trunk with allowed vlans 101,102. switch2,port 2/1 is a trunk with allowed vlans 201,202. switch2,port 2/2 is a trunk with allowed vlans 201,202. IPS1 will have the following config: Traffic entering interface 1 must be forwarded to interface 2 with the following vlan translations: original_vlan 101 is translated_to_vlan 201 original_vlan 102 is translated_to_vlan 202 Traffic entering interface 2 must be forwarded to interface 1 with the following vlan translations: original_vlan 201 is translated_to_vlan 101 original_vlan 202 is translated_to_vlan 102 Exactly the same config to IPS2. My question is if this is a valid configuration from the spanning-tree point of view, I ask this because we translate de vlan tags and we are thinking that this can affect the correct operation of stp. In other words... with this config will we have a loop or stp will operate OK and put one port (1/1,1/2,2/1 or 2/2) as blocking? Keep in mind that doing an etherchannel between 1/1 and 2/1 and another etherchannel between 2/1 and 2/2 is not an option in this case (remember the explanation is a "simplified scenario" :-) the real one is a lot bigger and is nor possible for us to make the etherchannels). Thanks a lot and best regards

1 0

I don't need no stinking firewall!
by Brian Johnson 14 Jan '10

14 Jan '10

Security Gurus, et al, I have my own idea of what a firewall is and what it does. I also understand what statefull packet inspection is and what it does. Given this information, and not prejudging any responses, exactly what is a firewall for and when is statefull inspection useful? Please respond on-list as I want to have some useful discourse and discussion in the clear. Flamers and Trolls will be disregarded. :) Thank you. - Brian CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, copying, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Thank you.

44 101

RE: Anyone having issues updating RADB tonight?
by Courtney Smith 14 Jan '10

14 Jan '10

My update completed eventually. Not sure if the delay had any relation to the URL issues. Sorry for top post. Haven't figured how to put inline when using my Droid. Joe Blanchard <jbfixurpc(a)gmail.com> wrote: > > >Looks like someone messed up permissions on the directories and/or files. >Even the images for the buttons don't appear to work.. > >http://www.radb.net/images/navbar_bottom_off_02.jpg > > >403 permission denied... Game over. :o > > >-Joe > > > >> -----Original Message----- >> From: courtneysmith(a)comcast.net [mailto:courtneysmith@comcast.net] >> Sent: Wednesday, January 13, 2010 10:51 PM >> To: nanog(a)nanog.org >> Subject: Anyone having issues updating RADB tonight? >> >> Anyone having issues updating RADB tonight? I am getting 403 >> message from URL to web form. No response from two updates I >> submitted this evening via email. I noticed a few other URL's >> are also giving a 403 message. >> >> http://www.radb.net/cgi-bin/radb/irr-web.cgi >> >> http://www.radb.net/faq.html >> >> http://www.radb.net/emailupdates.html >> >> >> >

2 1

Anyone having issues updating RADB tonight?
by courtneysmith＠comcast.net 14 Jan '10

14 Jan '10

Anyone having issues updating RADB tonight? I am getting 403 message from URL to web form. No response from two updates I submitted this evening via email. I noticed a few other URL's are also giving a 403 message. http://www.radb.net/cgi-bin/radb/irr-web.cgi http://www.radb.net/faq.html http://www.radb.net/emailupdates.html

2 1

Default Passwords for World Wide Packets/Lightning Edge Equipment
by Nathan Eisenberg 13 Jan '10

13 Jan '10

Greetings, LONG VERSION: I have recently inherited the management of an undocumented network (failed FTTH provider) which utilizes World Wide Packets' LightningEdge 427 (16 port GBIC switch) and 311v (24/4 port Ethernet/GBIC switch) switches. We've swapped out a 427 so that we can rebuild it, push it back into the network, and repeat, until everything is under our control. Trouble is, the lack of documentation extends to passwords, the nature of which preclude any hope of getting in to the switch without resetting to defaults. Fortunately, I can do this without issue, since it is not in active service. I reset a spare 311v to defaults, but cannot log in to it with any of the logical default passwords. I can only assume the same will be true of the 427. Sadly, it seems World Wide Packets is now owned by a new company, who will not provide simple documentation without a full support contract. I got them to grudgingly provide the documentation for the customer premise devices (LightningEdge 47's), but my pleas for the switch documentation (and the management software that I believe WWP provided for free) has fallen on deaf ears. I don't have the budget to blow on a support contract just to get one default password (Who would?). SHORT VERSION: Does anyone know the default passwords for World Wide Packets 427 and 311v switches? I will most definitely owe anyone with an answer a beer or four next time they visit Seattle. By the way, the default username/password for the LightningEdge 47 and other WWP CPEs is su/pureethernet. Hopefully that will save someone else some pain. :-) Best Regards, Nathan Eisenberg

31 61

cable provider problems yesterday around 1pm EST?
by Rich Casto 13 Jan '10

13 Jan '10

Is anyone aware of any routing problems with any cable providers yesterday around 1pm EST? Thanks! -- Rich

5 5

RE: Re: SORBS on autopilot?
by Martin Hotze 13 Jan '10

13 Jan '10

Oh well, there's an approach where one splits users into "residential" and "business", meaning that "residential" is only downloading, surfing, ... without need of providing any services "back" to the 'net. At least with IPv6 one has to rethink this position as there finally is end-to-end communication and everybody with a limited upload bandwidth can multicast his content to half of the world (crossing fingers). inetnum: 82.150.208.0 - 82.150.208.255 netname: AT-HOTZE-NET descr: hotze.com GmbH descr: DSL wholesale country: AT Our position is that we sell internet access at the IP level, a pure IP pipe - nothing less and nothing more. The customer can have his own PTR-record with a name matching his domain, he can set up a server or not. All IPs are static (no need to hassle with DHCP pools, matching IP to time&date to user for law enforcment). Every customer is served the same according to his service plan. And we don't make any decisions wether the customer is "residential" or "business" - simple as that. I won't feel happy with an ISP who wants to make this decision for me. greetings, martin AS8596 / hotze.com GmbH / Austria > -----Original Message----- > Date: Tue, 12 Jan 2010 12:42:58 -0500 > From: Steven Champeon <schampeo(a)hesketh.com> > Subject: Re: SORBS on autopilot? > To: nanog(a)nanog.org (...) > just to pick a few. At the very least, customer-assigned blocks ought to > have a SWIP and a comment showing whether they're dynamic or static, > residential or business class, and so forth. A surprising example, given > the paucity of such examples in the .pl TLD, is dialog.net.pl, which does > exactly that: > > inetnum: 87.105.24.0 - 87.105.24.255 > netname: DIALOGNET > descr: Static Broadband Services > descr: Telefonia Dialog S.A. - Dialog Telecom > country: PL > > inetnum: 62.87.215.0 - 62.87.215.255 > netname: DIALOGNET > descr: Dynamic Broadband Services > descr: Telefonia Dialog S.A. - Dialog Telecom > country: PL > > So, if the Poles (well, some Poles) can do it, why can't we simply end > the endless back and forth over why SORBS is evil, and start adopting > sane and clear naming conventions for PTRs? Given how easy it is to > modify a $GENERATE statement, I should think you've spent far more > energy on arguing about why you're being wronged than it would have > taken to fix your problem.

2 1