December 2012 - NANOG - lists.nanog.org

Network Latency Measurements
by Tal Mizrahi 05 Dec '12

05 Dec '12

Hi, We are looking for publicly available statistics of network latency measurements taken in large networks. For example, there is FCC's measurements (http://www.fcc.gov/measuring-broadband-america/2012/july) However, we are looking for something more detailed that can show a large number of latency measurements taken periodically (preferably with as small a period as possible). Any help will be appreciated. Thanks, Tal Mizrahi.

7 6

Re: Amazon Abuse contact
by Anne P. Mitchell, Esq. 05 Dec '12

05 Dec '12

> > On Tue, Dec 4, 2012 at 5:40 PM, Mark Keymer <mark(a)viviotech.net> wrote: >> If there is a Amazon Abuse person our there or if someone has a good contact >> to someone at Amazon can you message me off-list. >> >> We have put in some Abuse request a couple of days ago and have not heard >> back. It would be great to talk with someone about an issue effecting one of >> our clients and the use of Amazon. (Cloud instances I believe) Mark, did you get a contact? If not, please ping me off list and I will connect you with our contact. Anne Anne P. Mitchell, Esq CEO/President Institute for Social Internet Public Policy http://www.ISIPP.com Member, Cal. Bar Cyberspace Law Committee How do you protect your inboxes from spam while reducing false positives? SuretyMail! http://www.SuretyMail.com

1 0

Re: [tor-talk] William was raided for running a Tor exit node. Please help if you can.
by Eugen Leitl 04 Dec '12

04 Dec '12

----- Forwarded message from Asad Haider <asad(a)asadhaider.co.uk> ----- From: Asad Haider <asad(a)asadhaider.co.uk> Date: Thu, 29 Nov 2012 19:37:24 +0000 To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] William was raided for running a Tor exit node. Please help if you can. Reply-To: tor-talk(a)lists.torproject.org William will be posting a statement soon which will explain everything that's happened and give a detailed account of events, along with evidence including pictures showing the aftermath of the raid in his apartment, as well as copies of the warrant and inventory of seized items. He runs a large ISP in Austria and is a well respected member of the community, a lot of us have already sent in donations. His blog is https://rdns.im/ and I'm guessing the statement will be posted on there, I'll send everyone a link once it's finished being written. On 29 November 2012 19:22, Eugen Leitl <eugen(a)leitl.org> wrote: > ----- Forwarded message from Emily Ozols <wingar(a)team-metro.net> ----- > > From: Emily Ozols <wingar(a)team-metro.net> > Date: Fri, 30 Nov 2012 01:14:08 +1100 > To: nanog(a)nanog.org > Subject: Re: William was raided for running a Tor exit node. Please help if > you can. > > Hi, > > I gotta ask and I'm sure someone would if I didn't, but how do we know > this guy is legit? > He's jumped up on a forum saying, "Hey, police raided me, help. gib > mone plz" and failed to provide and reason as to how he's real and not > just making it up. > > Maybe if there's a way to know this guy is legit, I'll help out if > possible, but until then I'm just going to watch others with caution > and I suggest others do as well. > > On Fri, Nov 30, 2012 at 12:04 AM, Chris <caldcv(a)gmail.com> wrote: > > I'm not William and a friend pasted a link on IRC to me. I'm going to > > send him a few bucks because I know how it feels to get blindsided by > > the police on one random day and your world is turned upside down. > > > > Source: > http://www.lowendtalk.com/discussion/6283/raided-for-running-a-tor-exit-acc… > > > > From the URL: > > > > Yes, it happened to me now as well - Yesterday i got raided for > > someone sharing child pornography over one of my Tor exits. > > I'm good so far, not in jail, but all my computers and hardware have > > been confiscated. > > (20 computers, 100TB+ storage, My Tablets/Consoles/Phones) > > > > If convicted i could face up to 6 years in jail, of course i do not > > want that and i also want to try to set a legal base for running Tor > > exit nodes in Austria or even the EU. > > > > Sadly we have nothing like the EFF here that could help me in this > > case by legal assistance, so i'm on my own and require a good lawyer. > > Thus i'm accepting donations for my legal expenses which i expect to > > be around 5000-10000 EUR. > > > > If you can i would appreciate if you could donate a bit (every amount > > helps, even the smallest) either by PayPal (any currency is ok): > > > https://paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=2Q4LZNBBD7… > > > > Or by Bank Transfer (EUR only please): > > > > Holder: William Weber > > Bank: EasyBank AG (Vienna, Austria) > > Account: 20011351213 > > Bank sort number: 14200 > > IBAN: AT031420020011351213 > > BIC: EASYATW1 > > > > I will try to pay them back when i'm out of this (or even before) but > > i can obviously not guarantee this, please keep this in mind. > > This money will only be used for legal expenses related to this case. > > > > If you have any questions or want to donate by another way > > (MoneyBookers, Webmoney, Bitcoin, Liberty Reserve, Neteller) feel free > > to send me a mail (william(a)william.si) or a PM, or contact me in LET > > IRC. > > > > Thanks! > > William > > > > > > > > > > -- > > --C > > > > "The dumber people think you are, the more surprised they're going to > > be when you kill them." - Sir William Clayton > > > > > > -- > ~Em > > ----- End forwarded message ----- > -- > Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org > ______________________________________________________________ > ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org > 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE > _______________________________________________ > tor-talk mailing list > tor-talk(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk > _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

8 10

securelogin.arubanetworks.com AAAA ::1 <--- someone from Aruba who can fix that?
by Jeroen Massar 04 Dec '12

04 Dec '12

Hi folks, For quite a few folks here on the list travel is a common thing, going into foreign wireless networks is too. Likely your laptop/tablet comes with IPv6 enabled per default, it is 2012 after all almost going 2013. And then you get to a silly hotspot and it does not work as the connection fails (or you get the website you host on your laptop and go 'huh?' ;). Thus you check and you see: 8<------------------------------------------------------------------------ $ dig securelogin.arubanetworks.com aaaa ; <<>> DiG 9.8.3-P1 <<>> securelogin.arubanetworks.com aaaa ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25608 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;securelogin.arubanetworks.com. IN AAAA ;; ANSWER SECTION: securelogin.arubanetworks.com. 5 IN AAAA ::1 ;; Query time: 19 msec ;; SERVER: 66.28.0.45#53(66.28.0.45) ;; WHEN: Tue Dec 4 10:12:33 2012 ;; MSG SIZE rcvd: 75 ------------------------------------------------------------------------>8 I am fairly sure somebody technical and high enough up at Aruba knows how to get this resolved, sooner or later... thus please do, it will start hurting more and more people every day. Oh, and btw, it has an A record too, but even though Happy Eyeballs exists in a magical form inside OSX, ::1 is a very close route thus will always win over the IPv4 address. Of course, temp disabling IPv6 on the link is a way to circumvent it, but heck, why is that DNS server publishing ::1 at all!? Greets, Jeroen

2 1

GMAIL Contact
by Sabo, Eric 04 Dec '12

04 Dec '12

To all: Does anyone know of a email or phone contact to get Gmail to get my domain off their RBL list? Thanks, Eric Sabo

1 0

carping about CARP
by Robert E. Seastrom 03 Dec '12

03 Dec '12

I can't seem to recall anyone griping about this here on our august little list but google finds that I'm by no means the first to have been burned by an unholy interaction between VRRP and CARP. Let's skip the protocol discussions (same protocol number and uses multicast) [*] and go straight to the behavioral observations. I turned on VRRP this evening on a pair of routers. All of a sudden a CARP instance between a pair of pfSense boxes in the rack (which I didn't even know was there) invited itself to the party and started flailing all over the place and causing oscillating packet loss for anything that was going off-segment. Note that the Ciscos didn't exhibit any untoward behavior, and there were "passwords" on the VRRP sessions too. Meanwhile, the pfSense box spazzed out and filled its dmesg logs with stuff like: arp: 192.0.2.1 moved from 00:00:0c:xx:xx:01 to 00:00:5e:xx:xx:01 on em1 arp: 192.0.2.1 moved from 00:00:5e:xx:xx:01 to 00:00:0c:xx:xx:01 on em1 (no other hosts on the segment were logging such activity) Looks like CARP is a bit loose about believing stuff coming in over the wire. Seems a bit out of character for OpenBSD, but maybe these days it's considered all good so long as such a malfunction only causes an outage, not a core dump. Anyway, word to the wise, CARP and VRRP is a bit of a dangerous mixture. -r [*] The OpenBSD side of the story can be read at http://en.wikipedia.org/wiki/Common_Address_Redundancy_Protocol#No_official… Seems that there is a lesson to be learned here: "o hai, we wrote this software but can not be bothered to follow your process or formally write up the protocol, plz to be giving us a protocol number" ain't gonna fly.

15 22

Re: When an ISP should run their own IRR for customers
by Courtney Smith 02 Dec '12

02 Dec '12

On Dec 2, 2012, at 5:18 AM, nanog-request(a)nanog.org wrote: > > Message: 4 > Date: Sat, 01 Dec 2012 20:20:51 -0500 > From: ML <ml(a)kenweb.org> > To: nanog(a)nanog.org > Subject: When an ISP should run their own IRR for customers > Message-ID: <50BAACF3.4040204(a)kenweb.org> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > I'm querying the community on the feasibility of running my own IRR on > behalf of customers whom probably aren't/won't register their own > objects. I'm going down this path since I don't believe RADB or ARIN > would let me register objects on behalf of my customers. > > I know I'm going to need this in the near future once my AS starts to > peer. Conservatively I would be proxy registering about 100 customers. > > Would a potential upstream/peer NOT want to query my IRR because I'm not > RADB, ARIN, etc (Essentially not a well known registry)? If not, is it > likely my IRR could get mirrored by RADB so other networks can retrieve > good info via RADB. > > If I was to run my own IRR is Merit's IRRd they way to go or is there > something better? > > > Thanks > > > > I do not think running your own IRR is worth it for 100 customers. Unless it's something you want to do for your own experience and knowledge. Maintain the objects under your maintainer for customers who, for whatever reason, are unable to maintain their own objects. Just make sure your internal processes address deleting objects when customers leave. Deleting seems to be something folks forget about. Courtney Smith courtneysmith(a)comcast.net () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

1 0

Re: DDOS hardware appliances for network security - Arbor Pravail APS vs nsFocus ADS 6020 - Reviews - Feedback
by Dennis Usle 02 Dec '12

02 Dec '12

Checkout Radware Defense Pro. It offers some very innovative approaches to network and application attack mitigation. I particularly like the NBA and real time signatures. James Braunegg <james.braunegg(a)micron21.com> wrote: >Dear Nanog > > > >I would like to start a discussion on network security DDOS hardware appliances, mainly compairing the Arbor Pravail APS device vs the nsFocus ADS6020 device as I am looking at investing in such a product and would love to hear some industry feedback, reviews, information and from vendors etc. > > > >To provide some background information we are looking at a device for inline filtering to clean / filter out unwanted traffc inbound towards our network automaticaly. > > > >That being said I'm also happy to hear from other suppliers of appliances (not sure who else there is) or recomendations. > > > >For those who don't know much about either device the Arbor Pravail fact sheet can be found here > > > >http://www.arbornetworks.com/component/docman/doc_download/498-pravail-aps-… > > > >Like wise the fact sheet for the nsFocus ADS product can be found here > > > >http://www.nsfocus.com/en/uploadfile/Product/ADS/Datasheet/NSFOCUS%20ADS%20… > > > >Until recently I was only aware of the Arbor device, although after doing some research I quicky came up with another options, I'm sure many other people have asked / looked into the same questions before so let the debate begin... > > > >Kindest Regards > >James Braunegg >W: 1300 769 972 | M: 0488 997 207 | D: (03) 9751 7616 >E: james.braunegg(a)micron21.com<mailto:james.braunegg@micron21.com> | ABN: 12 109 977 666 > >[Description: Description: Description: Description: M21.jpg] > >This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer. > > >

2 1

William was raided for running a Tor exit node. Please help if you can.
by b.g. white 02 Dec '12

02 Dec '12

>I think if they took the cash registers too the >Starbucks lawyer would be in court an hour later >with a motion to quash in one hand and an offer of >full cooperation in the other. >Regards, Bill Herrin The standard, in the U.S., is "any electronic device capable of storing data".

8 9

DDOS hardware appliances for network security - Arbor Pravail APS vs nsFocus ADS 6020 - Reviews - Feedback
by James Braunegg 02 Dec '12

02 Dec '12

Dear Nanog I would like to start a discussion on network security DDOS hardware appliances, mainly compairing the Arbor Pravail APS device vs the nsFocus ADS6020 device as I am looking at investing in such a product and would love to hear some industry feedback, reviews, information and from vendors etc. To provide some background information we are looking at a device for inline filtering to clean / filter out unwanted traffc inbound towards our network automaticaly. That being said I'm also happy to hear from other suppliers of appliances (not sure who else there is) or recomendations. For those who don't know much about either device the Arbor Pravail fact sheet can be found here http://www.arbornetworks.com/component/docman/doc_download/498-pravail-aps-… Like wise the fact sheet for the nsFocus ADS product can be found here http://www.nsfocus.com/en/uploadfile/Product/ADS/Datasheet/NSFOCUS%20ADS%20… Until recently I was only aware of the Arbor device, although after doing some research I quicky came up with another options, I'm sure many other people have asked / looked into the same questions before so let the debate begin... Kindest Regards James Braunegg W: 1300 769 972 | M: 0488 997 207 | D: (03) 9751 7616 E: james.braunegg(a)micron21.com<mailto:james.braunegg@micron21.com> | ABN: 12 109 977 666 [Description: Description: Description: Description: M21.jpg] This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.

1 0