July 2013 - NANOG - lists.nanog.org

Revealed: NSA program collects 'nearly everything a user does on the internet'
by Warren Bailey 02 Aug '13

02 Aug '13

Tin foil hat Wednesday, limited supplies. Revealed: NSA program collects 'nearly everything a user does on the internet' http://gu.com/p/3hy4h Sent from my Mobile Device.

8 8

Re: ARIN WHOIS for leads
by Joel M Snyder 01 Aug '13

01 Aug '13

>What about the 2am phone calls from the guy, who did a >nslookup on a website, and then whois on the ip, >who is calling to say his porn site >is partially not working and he's pissed. No amount of changing contacts is going to solve this type of problem. We routinely get support calls, sometimes even in the emergency support line, from people who are pissed off at an ISP 2,000 miles away called "Opus" something-or-another-but-not-Opus-One. Apparently their dialup service is not so hot anymore and when it doesn't work, the one-step-down-from-AOL customer base they attract types "opus" into their browser and then calls whatever phone number comes to the top of whatever search engine their browser vendor chose for them. Changing the nature of WHOIS isn't going to keep the stupid from doing stupid things. However, it might make life harder for the not-stupid trying to solve real problems. Honestly, this seems to me like a non-problem. I liken it to the hypersensitivity of some people to spam, where if they get 1 message through their filters it's somehow a major crisis. Maybe our ACD, which requires the clue-challenged to be able to spell the first or last name of the person their calling, or perhaps read the extension number from a directory listing, screens the worst of the worst out from us... I also don't see the problem of cold calling when it's obviously for a service or product that I am interested in, just as I don't see the problem of cold snail-mailing for the same services. I'm in business, and I expect other businesses to try and market to me. I don't want to hear from window, insurance, and other crap sellers, but if a Cisco reseller or bandwidth seller wants to make contact and say "how can I help you?" that doesn't seem out of line to me. Only in the world of email do we (justifiably) get all weirded out by the prospect of unsolicited sales pitches. It seems to me that if you don't want people to call you, don't give out your phone number (or give out a phone number that makes it hard for anyone but a real person who really wants to talk to you to get to you). How did our little capitalist industry suddenly become a "you must have permission to contact me by any means no matter what" industry? jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

4 3

Hilton proxy issue
by Grant Ridder 31 Jul '13

31 Jul '13

Hi, Anyone from Hilton Hotels NOC or related on here? We are seeing their internet proxy doing weird things to http requests to servers at $DAYJOB. -Grant

3 6

Re: SNMP DDoS: the vulnerability you might not know you have
by Larry Sheldon 31 Jul '13

31 Jul '13

On 7/31/2013 4:29 PM, Blake Dunlap wrote: > It works better to fix the design issues than to play whack a mole > by blocking every imaginable service to your customers that responds > to the public with data larger than a FIN. Like getting their > providers to more proactively police their spew, manufactures to stop > making negligent devices, or implementing more intelligent filter > communication so the only option doesn't begin with calling your > provider and asking them over the phone to block X ip for you since > you're off the internet. > > Maybe even look into liability laws for allowing said attacks to > originate from your customers and not doing anything about it, or > being manufacturer of said devices that harm others through their > lack of due diligence implementing proper security. It's still way > more effective than trying to fix the *last instance* of the problem, > instead of it's reasons for enduring as an issue at a global scale. The first time I became a pariah on NANOG was for postulating precisely that view--that if the originators of problems would stop, we would not have to figure out how to clean up after them. But I am past that now and out of work. But it does occur to me for the first time that I can recall, that maybe the tremendous efforts to Get Control Of The Intertubes could be suckered into doing some good, say be establishing a certification authority to test and certify the safety of designs (is Scott B????? still around) and devise a way to not permit traffic from uncertified devices or configurations. But after years of research I will tell you that there is no way to stop an avalanche once it has been released at the source. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

Revealed: NSA program collects 'nearly everything a user does on the internet'
by Marsh Ray 31 Jul '13

31 Jul '13

Chris Boyd cboyd at gizmopartners.com Wed Jul 31 15:50:09 UTC 2013 > > I would guess that it's becasuse many VPN services still support PPTP which can be attacked as outlined here: > http://www.schneier.com/paper-pptpv2.html > > --Chris That link doesn't even mention the worst vulnerability in PPTP/MS-CHAPv2. Strangely, it's only in the PDF version http://www.schneier.com/paper-pptpv2.pdf at the bottom of page 6: > Note also that the MS-CHAP response generation algorithm is also a weak > link, even when passwords contain adequate entropy. It is clear that the NT > hash can be recovered with just two DES exhaustive keysearches (about 256 > trial DES decryptions on average) In other words, PPTP/MS-CHAPv2 is equivalent to encrypting your password with *single DES* and sending it over the untrusted network. It doesn't matter how strong your plaintext password is. Not only can the passive eavesdropper decrypt your VPN-tunneled data, he can obtain the NT hash which is a password-equivalent credential allowing him to impersonate the user to log into any other network services. Moxie Marlinspike and David Hulton described the exploit for it at Defcon 20 last summer: Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2 http://www.youtube.com/watch?v=vWXP3DvH8OQ Moxie's Cloudcracker online service will decrypt your PPTP packet captures using an FPGA cluster from Pico Computing. Last I heard, the price was a flat fee of $200, although it sometimes goes on sale. http://www.h-online.com/security/features/A-death-blow-for-PPTP-1716768.html http://h-online.com/-1716768 So it's not just the NSA, it's any passive observer with a budget of $200 for a one-off or ~$10K for their own hardware capability. PPTP is old and busted, don't let your friends use it! If you've ever used it, change your password. IMHO, if there's any other protocol more deserving of the "internet kill switch" I don't know what it is. - Marsh (sorry for not threading properly, I just subscribed to reply)

1 0

GTT/Inteliquent/nLayer
by Tim Durack 31 Jul '13

31 Jul '13

Any experience/comments on the GTT Global eXpress service? Looks interesting but odd. Why would I use a virtual IXP? Who participates? Comments on-list or off-list are fine. -- Tim:>

2 1

Re: File transfer speed between Hong Kong and Johannesburg, South Africa
by Larry Sheldon 31 Jul '13

31 Jul '13

On 7/11/2013 10:32 AM, Clayton Zekelman wrote: > > It all depends on the air speed velocity of an unladen swallow, and > varies if it is African or Eurpoean. > > In all seriousness, you need to know the speed and latency of the link > before that question can be answered. > > At 10:04 AM 11/07/2013, Luan Nguyen wrote: >> Hello folks, >> >> Does anyone know what's the average speed for windows file transferring >> (SMB2) between Hong Kong and Johannesburg? >> Any guide on how to calculate/estimate this? An old-timers-uncalibrated-guess" If you are going to do large transfers using a protocol designed (for want of a term) for local area networks with near-fault free performance over a long multihop network, you are not going to like it. What criteria drive the selection of such an unlikely protocol? -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

vodafone contact
by ryanL 31 Jul '13

31 Jul '13

anyone hanging out from vodafone in europe? or anyone know someone over at vodafone? we are having goofy issues with mobile clients on your LTE network. we're having to dump mtu and advmss a whole bunch to make things work. wondering if you'd be willing to chat offline. appreciated. r

3 3

Brighthouse issues
by Jared Geiger 31 Jul '13

31 Jul '13

We are seeing that all our customers in the Brighthouse Orlando, FL market that would make outbound connections on TCP port 3306 suddenly can't connect to us now. This happened suddenly mid day today. Other ISPs can still make the same outbound connections. VPN connections on Brighthouse into the same IP block work fine, just outbound port 3306 is being blocked now. If anyone has details as to an emergency maintenance or change that occurred, I'd like to be able to pass it along to our customers. Thanks, Jared

3 3

Contacts at ISPs in Mexico?
by Anne P. Mitchell, Esq. 30 Jul '13

30 Jul '13

Are there any Mexico ISPs on the list or does anybody here have any contacts at any Mexican ISPs? Thank you, Anne Anne P. Mitchell, Attorney at Law Author: Section 6 of the CAN-SPAM Act of 2003 CEO/President: Institute for Social Internet Public Policy Providers: SuretyMail Email Accreditation Member: California Bar Cyberspace Law Committee

2 1