February 2012 - NANOG - lists.nanog.org

Fwd: IPv6 RA-Guard: Advice on the implementation (feedback requested)
by Fernando Gont 02 Feb '12

02 Feb '12

Folks, Not sure if I had posted on this list about RA-Guard evasion issues. Anyway...nowadays most implementations remain vulnerable. If you care to get this fixed, please provide feedback about this I-D on the IETF *v6ops* mailing-list <v6ops(a)ietf.org>, and CC me if possible (please see below). Thanks! Best regards, Fernando -------- Original Message -------- Subject: RA-Guard: Advice on the implementation (feedback requested) Date: Wed, 01 Feb 2012 21:44:29 -0300 From: Fernando Gont <fgont(a)si6networks.com> Organization: SI6 Networks To: IPv6 Operations <v6ops(a)ietf.org> Folks, We have just published a revision of our I-D "Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)" <http://tools.ietf.org/id/draft-gont-v6ops-ra-guard-implementation-01.txt>. In essence, this is the problem statement, and what this I-D is about: * RA-Guard is essential to have feature parity with IPv4. * Most (all?) existing RA-Guard implementations can be trivially evaded: if the attacker includes extension headers in his packets, the RA-Guard devices fail to identify the Router Advertisement messages. -- For instance, THC's "IPv6 attack suite" (<http://www.thc.org/thc-ipv6/>) contains tools that can evade RA-Guard as indicated. * The I-D discusses this problem, and provides advice on how to implement RA-Guard, such that the aforementioned vulnerabilities are eliminated, we have an effective RA-Guard device, and hence feature-parity with IPv4. We'd like feedback on this I-D, including high-level comments on whether you support the proposal in this I-D. Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

AS8300 - Swisscom hijacking.. Just what are you testing?
by Schiller, Heather A 02 Feb '12

02 Feb '12

AS8300 started announcing one of the Rove Digital dns changer IP ranges. (The IP ranges the FBI is sending 'you are infected' letters about) Swisscom's announcement is less specific than the prefixes being announced by ISC during the remediation effort, so it's not impacting traffic... But AS8300 seems to announce less specifics a lot. Last fall they announced 63/8 and half of that is allocated to 701. AFAIK, we weren't notified they were going to announce a less specific of our space. As long as folks have pullup routes, and don't have an outage that withdraws their announcements, then Swisscom should only be getting darknet traffic. The record for AS8300 says 'Test' and the entry for it in CIDR report says "This AS is not currently used to announce prefixes in the global routing table, nor is it used as a visible transit AS." .. But their announcements certainly do show up in the global routing table, whether they are transiting for someone or not, they could get traffic for anything that doesn't have a more specific. Given the recent YAHT (yet another hijack thread) it's worth pointing out that hijacking more specifics is bad, but less specifics can be bad as well. (Not suggesting that is the case here..) I searched around and couldn't find any mention of what they might be testing. Anyone know? route-views>sh ip bgp 85.255.112.0/20 BGP routing table entry for 85.255.112.0/20, version 2177063753 Paths: (11 available, no best path) Not advertised to any peer 6079 3303 8300 (history entry) 207.172.6.20 from 207.172.6.20 (207.172.6.20) Origin IGP, metric 85, localpref 100, external Dampinfo: penalty 495, flapped 2 times in 00:24:37 3277 3267 174 3303 8300 (history entry) 194.85.102.33 from 194.85.102.33 (194.85.4.4) Origin IGP, localpref 100, external Community: 3277:3267 3277:65321 3277:65323 3277:65330 Dampinfo: penalty 501, flapped 2 times in 00:24:22 .... --Heather

5 5

Extra Westin reservation
by Patrick W. Gilmore 01 Feb '12

01 Feb '12

Apparently I accidentally made two hotel reservations for the Westin Gas Lamp. Made one, then thought I changed it, but just got confirmation I have two. I have until 6 PM to cancel. If you want it, ping me before 5 PM PST. -- TTFN, patrick

1 1

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)
by Hal Murray 01 Feb '12

01 Feb '12

>> Where is Milo Medin when we need him? > how would he be helping? He would have pulled the plug. The story is from the very early days of the internet, probably long before NANOG existed. Milo worked at NASA and found a cracker from Finland on one of NASAs machines. The link from Finland to the rest of the world went through Norway to NASA. (That's THE link, there was only one link connecting all of Scandinavia to the rest of the net.) So Milo called the guy in Finland and said "Please fix it". The reply was "We can't do anything. We respect civil liberties." Soon he got the message because he wasn't connected to the net any more. If anybody has a good URL for the story, please let me know. I found one reference in google-books that said 1988. ----- > AFAIK there's no law covering the use of what party X considers their 32 bit > numbers (assigned by party A) by party Y. Do contracts cover that? I'd expect that the paperwork for peer-peer, customer-ISP and ISP-backbone links would include some nice broad legalese about not doing nasty things. > Besides, how would that work? Say ARIN assigns US company X (operating only > in the US) a block, but German company Y (with no US operations) starts > announcing the same block. How are US or German laws going to help, when > the parties have no common jurisdiction? The law could be written to apply to the company bringing the bogus announcements across the US border. -- These are my opinions, not necessarily my employer's. I hate spam.

1 0

Console Server Recommendation
by Ray Soucy 01 Feb '12

01 Feb '12

What are people using for console servers these days? We've historically used retired routers with ASYNC ports, but it's time for an upgrade. OpenGear seems to have some nice stuff, anyone else? -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-3526 Networkmaine, a Unit of the University of Maine System http://www.networkmaine.net/

26 35

ATT, IPv6 and 6RD
by Bill Merriam 01 Feb '12

01 Feb '12

I now have ATT IPv6 over their residential ADSL broadband. They deployed using 6RD which means every time your IPv4 address changes your IPv6 address changes also. Does anybody have a clue why they chose to use 6RD instead of the much more fully-assed TR-187 for their deployment? Saying they're dimwits doesn't count. Bill

2 1

Fiber outage in Miami
by Jimmy Changa 01 Feb '12

01 Feb '12

Was anyone impacted by a botched fiber move in Miami this weekend? I lost 2 pieces of dark fiber for over almost 24 hours due to a fiber move being performed by FiberLight. I'm curious if anyone else was impacted. Sent from mobile device

6 12

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)
by Hal Murray 01 Feb '12

01 Feb '12

I'm not a lawyer nor an operator. > Imagine that instead of www.google.com, it was www.whitehouse.gov > At some point, I suspect that this gets service to get it fixed RIGHT NOW. > At some point, the guys informing you it's RIGHT NOW show up with badges. Where is Milo Medin when we need him? > The question is, when is it badges? It can be construed as a denial of > service attack on the addresses' rightful owners. They will respond to any > major government site being hijacked. Probably to Apple or Google. Likely > to a Tier-1 ISPs internal infrastructure. How long should it take to fix a problem like this? Why didn't one of the players upstream from the bad guy pull their plug or drop the bogus announcement? Why didn't any of the players between the first upstream and the tier 1s apply pressure? Do existing contracts cover this case? If not, what needs to be fixed? Is a RFC needed so the lawyers have something to reference? Would a session to discuss this at a NANOG gathering help? > a) law enforcement doesn't understand the problem. and b) the law moves > very slowly. It might be a good idea to make sure that somebody in law enforcement does understands what happened here so they can think about what who needs to do what the next time something like this happens. (Make sure that operators know how to get in touch with somebody who knows.) -- These are my opinions, not necessarily my employer's. I hate spam.

2 1

Re: IP KVM suggestions
by Chris Hunt 01 Feb '12

01 Feb '12

On 1/30/2012 11:05 AM, nanog-request(a)nanog.org wrote: > ------------------------------ > > Message: 8 > Date: Mon, 30 Jan 2012 12:09:16 -0600 > From: "Express Web Systems" <mailinglists(a)expresswebsystems.com> > To: "'NANOG'" <nanog(a)nanog.org> > Subject: RE: IP KVM suggestions > Message-ID: <033601ccdf7a$481d0f90$d8572eb0$@com> > Content-Type: text/plain; charset="us-ascii" > >> > I have a need for a small, portable, web based IP kvm with decent >> > features that doesn't break the bank. Preferably something that >> > supports ISO mounting from http or ftp and USB connectivity. Would >> > also prefer something browser independent. Small plugin like the >> > Raritan devices would be acceptable too. It will be used internally for >> > Remote access while building devices pre deployment to customers. Any >> > suggestions? >> > >> > Thanks! >> > >> > Blake > Lantronix Spider is a small, portable, affordable and web enabled IP KVM. > Supports ISO mounting and has USB connections. > > http://www.lantronix.com/it-management/kvm-over-ip/securelinx-spider.html > > It is a single server unit. So if you want to connect many servers at the > same time, it might not be the best option as the price quickly escalates. > However, if you buy one and just move it from server to server (which is > what I got from your email), then it is a pretty good fit. Java based web > interface, not the greatest, but it works. > > For multiple server access from a single unit, look at the Dell 2161DS > (rebranded Avocent units) line. They are abundant on ebay, and relatively > inexpensive, and can expand to up to 128 servers (via add on PEM modules - > the unit has 16 ports and you connect a PEM to one of the ports and you can > connect up to 8 servers to the PEM 16 x 8 = 128). The 2161DS-2 also supports > ISO mounting when using USB dongles (the 2161DS does not). Java based client > software... Dell isn't supporting the 2161DS software any more apparently > and won't install natively on Windows 7, I have it running on Windows7, but it has to be "Run As Administrator" > but the software can be installed > on an XP machine and then copied, this also works for linux, etc. > > Tom Walsh > If security is a concern, then you will probably want to only use the 2161-DS behind a VPN, if at all. The session authentication is fairly weak and supports no ACLs. It does support lock-out on multiple bad authentication attempts though. -Chris

2 1

Re: Thanks & Let's Prevent this in the Future.
by Hank Nussbacher 01 Feb '12

01 Feb '12

At 03:58 01/02/2012 -0500, Kelvin Williams wrote: Those ISPs that are good network citizens have done it already. Those who don't care and who haven't done it yet - won't do it in the future. The only recourse you have is exactly what you have done. -Hank >How can we prevent anyone else from ever enduring this again? While we may >never stop it from ever happening, spammers (that's what we got hit by >today) are a dime a dozen and will do everything possible to hit an Inbox, >so how can we establish a protocol to immediate mitigate the effects of an >traffic-stopping advertisement? > >I thought registering with IRRs and up-to-date information in ARINs WHOIS >was sufficient, apparently I was wrong. Not everyone respects them, but >then again, they aren't very well managed (I've got several networks with >antiquated information I've been unable to remove, it doesn't impair us >normally, but its still there). > >What can we do? Better yet, how do we as a whole respond when we encounter >upstream providers who refuse to look at the facts and allow another to >stay down? > >kw > >-- >Kelvin Williams >Sr. Service Delivery Engineer >Broadband & Carrier Services >Altus Communications Group, Inc. > > >"If you only have a hammer, you tend to see every problem as a nail." -- >Abraham Maslow

1 0