February 2011 - NANOG - lists.nanog.org

Re: Weekend Gedankenexperiment - The Kill Switch
by andrew.wallace 08 Feb '11

08 Feb '11

On Tue, Feb 8, 2011 at 4:11 AM, <Valdis.Kletnieks(a)vt.edu> wrote: > On Mon, 07 Feb 2011 17:49:36 EST, Josh Smith said: > >> even if it was I suspect any service available via satellite might >> suffer from similar problems if the methods used to disrupt >> connectivity in Egypt were employed here. > > The real question isn't "If they shut you down, can you restart?". > > The real question is "If they shut you down, can you restart in a way that > avoids them attempting a second shutdown with a bullet?" > > > May I suggest - A bunker built for Scottish Office staff in the event of a nuclear attack is up for sale. The complex at Cultybraggan Camp near Comrie, Perthshire, was completed in 1990 and is believed to be one of the most advanced structures of its kind. It was built to house 150 people and protect them from nuclear, biological and electromagnetic attacks. http://www.bbc.co.uk/news/uk-scotland-tayside-central-12311164 Andrew

1 0

I've joined NEWNOG
by Owen DeLong 08 Feb '11

08 Feb '11

OK... They got the IPv6 issues resolved, the page is working great now. Yes, Paypal broke when I clicked the pay now button with IPv4 turned off. However, everything else worked. I've now paid my fee and joined NEWNOG. Thanks to the technical crew for addressing this issue so promptly and showing leadership in this area. Welcome NEWNOG to the NEW NET. Owen

1 0

BGP Looking glass and monitoring
by Bret Palsson 08 Feb '11

08 Feb '11

I'm interested to know what tools everyone uses for the following: Looking Glass server. BGP Monitoring BGP Management, ie. cost/preferred path management. Does anyone use tools to make changes to configurations? For example svn. How do you push changes? Manually, approval process, scripts? Currently the only thing we use is subversion to track changes in configurations. Now that we are up to around 20 routers and growing we are looking for better methods to manage our infrastructure. Thanks guys! -Bret

2 1

And so it ends...
by Scott Howard 08 Feb '11

08 Feb '11

102/8 AfriNIC 2011-02 whois.afrinic.net ALLOCATED 103/8 APNIC 2011-02 whois.apnic.net ALLOCATED 104/8 ARIN 2011-02 whois.arin.net ALLOCATED 179/8 LACNIC 2011-02 whois.lacnic.net ALLOCATED 185/8 RIPE NCC 2011-02 whois.ripe.net ALLOCATED

39 87

Membership model
by Owen DeLong 07 Feb '11

07 Feb '11

I'll happily join Newnog/NANOG and pay my dues when I can reach the web site to do so on IPv6 rather than legacy IPv4. Owen

7 8

Web Server and Firewall Hellp
by Joshua William Klubi 07 Feb '11

07 Feb '11

Hi, I run a web-server based on ubuntu server and the LAMP stack. I used Ubuntu's UFW firewall model and have enabled only Web and SSH ports. Namely port 80 and port 22 only. Unfortunately once a while some guys get to inject some content onto our web pages. Now managements are looking at getting a well proven infrastructure to counter that. But I also think i can fall on this community to help me get the right stuff done. Where i can protect the server from such attack. I want to know what measure i can do on the server to get it protected which mysql protection I should implement. since i can see that it might be a php or mysql injection that is been used. Currently I run these security measures on it. Ubuntu UFW Fail2ban PHP model security Apache security Joshua

4 3

Root Zone DNSSEC KSK Ceremony 4 (UTC correction)
by Joe Abley 07 Feb '11

07 Feb '11

> KSK CEREMONY 4 > > The fourth KSK ceremony for the root zone will take place in El > Segundo, CA, USA on Monday 2011-02-07. The ceremony is scheduled > to begin at 1300 local time (1700 UTC) and is expected to end by > 1900 local time (2300 UTC). Apologies for the time zone miscalculation. El Segundo is in the Pacific time zone, UTC-8. The ceremony is scheduled to begin at 1300 local time (2100 UTC) and is expected to end by 1900 local time (2011-02-08 0300 UTC). Joe

1 0

Root Zone DNSSEC KSK Ceremony 4
by Joe Abley 07 Feb '11

07 Feb '11

KSK CEREMONY 4 The fourth KSK ceremony for the root zone will take place in El Segundo, CA, USA on Monday 2011-02-07. The ceremony is scheduled to begin at 1300 local time (1700 UTC) and is expected to end by 1900 local time (2300 UTC). Video from Ceremony 4 will be recorded for audit purposes. Video and associated audit materials will be published 1 to 2 weeks after the ceremony, and will be available as usual by following the "KSK Ceremony Materials" link at <https://www.iana.org/dnssec/>. ICANN will operate a separate camera whose video will not be retained for audit purposes, but which will instead be streamed live in order to provide remote observers an opportunity to watch the ceremony. The live stream will be provided on a best-effort basis. The live video stream will be available at <http://dns.icann.org/ksk/stream/>. Ceremony 4 will include processing of a Key Signing Request (KSR) generated by VeriSign, and the resulting Signed Key Response (SKR) will contain signatures for Q2 2011, for use in the root zone between 2011-04-01 and 2011-07-05. CONTACT INFORMATION We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org.

1 0

Re: "Leasing" of space via non-connectivity providers
by Peter Maccauley 07 Feb '11

07 Feb '11

All this talk of ARIN's power and rights versus others is rather despairing. I will now explain what we, a 'non-connectivity' ISP, are providing as useful service. Many of customers value anonymity/pseudonymity. We can provide these things. Sure, there is a great potential for abuse, but we take steps to prevent this, such as careful control over port 25. Our customers can appear on the net from one of several IPv4 addresses in various places, which can be used for testing location-based services. Yes, this could be abused. We can aggregate broadband connections at our router, or provide instant switchover. This is useful for various people and organizations which have to use low-grade broadband (consumer quality, or often consumer quality relabeled 'business' and sold at a higher price). We find a way for people to use their legacy space. A few hobbyist types with their legacy Class Cs are customers. We've managed to get around some censorship blocks. Private http proxies to facebook/youtube and other less-known sites have an IP in some of our space. This is not saying these named organizations are our customers (nor am I saying they are not). We remain quiet at the moment because we do not have the infrastructure in place to handle any more traffic than the people who have found out about us by word-of-mouth. Maintaining a low profile also allows us to escape being added to lists of those censors of one type or another. It has allowed us to avoid spammers, thieves and crackers as customers I hope that many of you will see our use of IP space as a legitimate one. Like many of the rest of you, we provide services which may be valuable to spammers/crackers, but this doesn't mean we're in bed with them. If ARIN/RIPE etc ever decide to edit their databases in a way that interferes with our valuable services, I hope that some of you will raise an alarm in our defense.

1 0

New IPv4 block allocated to RIPE NCC
by Andrea Cima 07 Feb '11

07 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Apologies for duplicate mails] Dear Colleagues, The RIPE NCC has received the IPv4 address range 185/8 from the IANA. This is the final allocation of IPv4 address space that the RIPE NCC will receive from the IANA as stated in ripe-436, "Global Policy for the Allocation of the Remaining IPv4 Address Space". The minimum allocation size for this /8 has been set at /22. You may wish to adjust any filters you have in place accordingly. More information on the IP address space administered by the RIPE NCC can be found on our website at: https://www.ripe.net/ripe/docs/ripe-ncc-managed-address-space.html Additionally, please note that three "pilot" prefixes will be announced from this /8. The prefixes are: 185.0.0.0/16 185.1.0.0/21 185.1.24.0/24 They all originate in AS12654. The pingable addresses will be: 185.0.0.1 185.1.0.1 185.1.24.1 More information on this activity is available in the document "De-Bogonising New Address Blocks", which can be found at: http://www.ripe.net/ripe/docs/ripe-351.html Kind regards, Andrea Cima Registration Services Manager RIPE NCC -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAk1Pu9kACgkQXOgsmPkFrjM9FgCgsaT8cFxK0YKTFUFzj41L0PQT N1AAoIgmL1zUY8JjkCSa05xt0t8oppgP =woX5 -----END PGP SIGNATURE-----

1 0