July 2013 - NANOG - lists.nanog.org

tools and techniques to pinpoint and respond to loss on a path
by Andy Litzinger 17 Jul '13

17 Jul '13

Hi, Does anyone have any recommendations on how to pinpoint and react to packet loss across the internet? preferably in an automated fashion. For detection I'm currently looking at trying smoketrace to run from inside my network, but I'd love to be able to run traceroutes from my edge routers triggered during periods of loss. I have Juniper MX80s on one end- which I'm hopeful I'll be able to cobble together some combo of RPM and event scripting to kick off a traceroute. We have Cisco4900Ms on the other end and maybe the same thing is possible but I'm not so sure. I'd love to hear other suggestions and experience for detection and also for options on what I might be able to do when loss is detected on a path. In my specific situation I control equipment on both ends of the path that I care about with details below. we are a hosted service company and we currently have two data centers, DC A and DC B. DC A uses juniper MX routers, advertises our own IP space and takes full BGP feeds from two providers, ISPs A1 and A2. At DC B we have a smaller installation and instead take redundant drops (and IP space) from a single provider, ISP B1, who then peers upstream with two providers, B2 and B3 We have a fairly consistent bi-directional stream of traffic between DC A and DC B. Both of ISP A1 and A2 have good peering with ISP B2 so under normal network conditions traffic flows across ISP B1 to B2 and then to either ISP A1 or A2 oversimplified ascii pic showing only the normal best paths: -- ISP A1----------------------ISP B2-- DC A--| |--- ISP B1 ----- DC B -- ISP A2----------------------ISP B2-- with increasing frequency we've been experiencing packet loss along the path from DC A to DC B. Usually the periods of loss are brief, 30 seconds to a minute, but they are total blackouts. I'd like to be able to collect enough relevant data to pinpoint the trouble spot as much as possible so I can take it to the ISPs and request a solution. The blackouts are so quick that it's impossible to log in and get a trace- hence the desire to automate it. I can provide more details off list if helpful- I'm trying not to vilify anyone- especially without copious amounts of data points. As a side question, what should my expectation be regarding packet loss when sending packets from point A to point B across multiple providers across the internet? Is 30 seconds to a minute of blackout between two destinations every couple of weeks par for the course? My directly connected ISPs offer me an SLA, but what should I reasonably expect from them when one of their upstream peers (or a peer of their peers) has issues? If this turns out to be BGP reconvergence or similar do I have any options? many thanks, -andy

6 5

RE: Office 365..? how Microsoft handed the NSA access to encrypted messages
by Scott Weeks 16 Jul '13

16 Jul '13

--- rwebb(a)ropeguru.com wrote: From: Robert Webb <rwebb(a)ropeguru.com> At least there are some that try and take a stand for their customer and not just hand over the keys to the palace when the good ole boys ask. ----------------------- Like web search engine startpage.com scott

3 2

The 4th Global IPv6 Deployment Monitoring Survey is underway!
by John Curran 16 Jul '13

16 Jul '13

NANOGers - If you have a moment, it would be helpful if you could complete the 4th annual Global IPv6 Deployment Monitoring Survey. Completion only takes a few minutes, and the data from the survey is useful in tracking progress and hurdles in IPv6 deployment. Thanks! /John John Curran President and CEO ARIN Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] The 4th Global IPv6 Deployment Monitoring Survey is Open Now Date: July 1, 2013 8:00:32 AM EDT To: <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> Dear Community, As in previous years, the Number Resource Organization (NRO) invites you to participate in the 4th consecutive Global IPv6 Deployment Monitoring Survey on the current and future use of IPv6. The IPv6 Deployment Monitoring Survey is now online, and we encourage all members of our community to participate: https://www.surveymonkey.com/s/GlobalIPv6survey2013 The purpose of the survey is to better understand where the Internet community is going, and what can be done to ensure it is ready for the widespread adoption of IPv6. We hope this survey will establish a comprehensive view of current IPv6 penetration and future deployment plans for IPv6. This year's survey is similar to those conducted in previous years (2010, 2011 and 2012), and will enable a comparison of progress. What is clear is that community participation does contribute to a better understanding of how IPv6 is being used. In 2012, 91% of the over 1,500 respondents indicated that they were interested in participating again in the 2013 survey. This survey has a maximum of 30 questions and will take about 20 minutes to complete. For those without IPv6 allocations or assignments, or have not yet deployed IPv6, the questions will be fewer in number. The survey will be open for a month and will close on 31 July 2013. Results of the IPv6 Deployment Monitoring Survey will be presented and discussed widely, with the support of your Regional Internet Registry (RIR). We appreciate your time and interest in completing this survey. If you have any questions concerning the survey, please send an email to info(a)gnksconsult.com. Regards, Susan Hamlin Director, Communications and Member Services American Registry for Internet Numbers (ARIN) _______________________________________________ ARIN-Announce You are receiving this message because you are subscribed to the ARIN Announce Mailing List (ARIN-announce(a)arin.net) Unsubscribe or manage your mailing list subscription at: http://lists.arin.net/mailman/listinfo/arin-announce Please contact info(a)arin.net if you experience any issues.

1 0

RE: tools and techniques to pinpoint and respond to loss on a path
by Andy Litzinger 16 Jul '13

16 Jul '13

> From: Blake Dunlap [mailto:ikiris@gmail.com] > While any provider will attempt to fix peer / upstream issues as they can, any > SLA you would have is between two points on their private network, not > from point A to point Z that they have no control over across multiple peers > and the public internet itself. makes sense- thanks for confirming > The much more common design is using a single > provider for each thread between sites. Then at least you have an end-to- > end SLA in effect, as well as a single entity that is responsible for the entire > link in question. > > This sounds like you're trying to achieve private link IGP / FRR level site to site > failover/convergence across the public internet. Perhaps you should rethink > your goals here or your design? Kind of- I can actually tolerate the blips, but I want to be able to measure and track them in such a way that I know where the loss is occurring. If a particular path is reconverging more often than should be reasonably expected I want to be able to prove it within reason. We also have a customer who happens to host at DC B with the same connectivity. Every time there is one of these blips their alerting fires off a thousand messages and they open a ticket with us. I'd like to be able to show them some good data on the path during the blip so we back a discussion along the lines of "live with it, or pay to privately connect to us". -andy > -Blake > > On Mon, Jul 15, 2013 at 4:18 PM, Andy Litzinger > <Andy.Litzinger(a)theplatform.com> wrote: > Hi, > > Does anyone have any recommendations on how to pinpoint and react to > packet loss across the internet? preferably in an automated fashion. For > detection I'm currently looking at trying smoketrace to run from inside my > network, but I'd love to be able to run traceroutes from my edge routers > triggered during periods of loss. I have Juniper MX80s on one end- which I'm > hopeful I'll be able to cobble together some combo of RPM and event > scripting to kick off a traceroute. We have Cisco4900Ms on the other end and > maybe the same thing is possible but I'm not so sure. > > I'd love to hear other suggestions and experience for detection and also for > options on what I might be able to do when loss is detected on a path. > > In my specific situation I control equipment on both ends of the path that I > care about with details below. > > we are a hosted service company and we currently have two data centers, > DC A and DC B. DC A uses juniper MX routers, advertises our own IP space > and takes full BGP feeds from two providers, ISPs A1 and A2. At DC B we > have a smaller installation and instead take redundant drops (and IP space) > from a single provider, ISP B1, who then peers upstream with two providers, > B2 and B3 > > We have a fairly consistent bi-directional stream of traffic between DC A and > DC B. Both of ISP A1 and A2 have good peering with ISP B2 so under normal > network conditions traffic flows across ISP B1 to B2 and then to either ISP A1 > or A2 > > oversimplified ascii pic showing only the normal best paths: > > -- ISP A1----------------------ISP B2-- DC A-- > | |--- ISP B1 ----- DC B > -- ISP A2----------------------ISP B2-- > > > with increasing frequency we've been experiencing packet loss along the > path from DC A to DC B. Usually the periods of loss are brief, 30 seconds to a > minute, but they are total blackouts. > > I'd like to be able to collect enough relevant data to pinpoint the trouble > spot as much as possible so I can take it to the ISPs and request a > solution. The blackouts are so quick that it's impossible to log in and get a > trace- hence the desire to automate it. > > I can provide more details off list if helpful- I'm trying not to vilify anyone- > especially without copious amounts of data points. > > As a side question, what should my expectation be regarding packet loss > when sending packets from point A to point B across multiple providers > across the internet? Is 30 seconds to a minute of blackout between two > destinations every couple of weeks par for the course? My directly > connected ISPs offer me an SLA, but what should I reasonably expect from > them when one of their upstream peers (or a peer of their peers) has > issues? If this turns out to be BGP reconvergence or similar do I have any > options? > > many thanks, > -andy

1 0

Secure Tunneling. Only with more Control!!!
by Nick Khamis 16 Jul '13

16 Jul '13

Not having to hijack http://seclists.org/nanog/2013/Jul/251, and without further ado, On 7/12/13, ryangard(a)gmail.com <ryangard(a)gmail.com> wrote: > It wouldn't be. When the endpoint in question is compromised, there isn't > any amount of tunneling or obscurity between point a and point b that will > resolve it. Only thing you can do is change to a solution that you have more > control over. > Sent on the TELUS Mobility network with BlackBerry This just got very interesting. Given that we do not own any Microsoft products here, and still able to function like any other corporation, I am more interested in a "solution that you have more control over" secured connections. We currently are using OpenVPN and PKI, coupled with a company policy of key updates every 3 months this will only get incrementally more complex as the number of clients increase. Not to mention one only needs a 3 minutes.... Question: What other options do we have to maintain a secure connection between client and server that gives us more control over traditional OpenVPN+PKI. It would be nice to be able to deploy private keys automatically to the different clients however, seems like a disaster waiting to happen. I would really appreciate some of your takes on this matter, what types of technology, policies are being employed out there for secure connections. Kind Regards, Nick.

2 1

One of our own in the Guardian.
by Bill Woodcock 15 Jul '13

15 Jul '13

http://www.guardian.co.uk/world/2013/jul/09/xmission-isp-customers-privacy-… -Bill

20 32

[NANOG-announce] Announcing the October 2013 NANOG Elections
by Sylvie LaPerriere 15 Jul '13

15 Jul '13

Hello NANOGers! This message is to encourage you, as a participant of this community, to become NANOG members and to consider standing for a leadership position at our upcoming October elections. The call for Board members nominations will be from August 9 to September 20 and for committee members from September 12 to October 8. We wanted to provide you now with the election process preview. It’s posted at http://www.nanog.org/governance/elections/2013 and we’ll make announcements at every step. Why should you become a NANOG member? One Member = One Voter = One Eligible Candidate Candidate and Voter eligibility are opened to every ‘member in good standing’. You may never have attended a conference but as an active reader and poster on our mailing lists, you contribute to the knowledge of this community. Becoming a NANOG member gives you the right to stand for a position and to vote in October. You can join at http://www.nanog.org/membership/join. What is expected of Committee Candidates? How many vacant positions? In New Orleans, we reminded the community of the documented set of roles, responsibilities and expectations placed on each position. We trust you will find the following useful. Candidates will be appointed Committee members by the newly elected Board next October. * 3 vacancies: Communications Committee Member - Refer to CC Responsibilities <http://nanog.org/governance/cc/member_responsibility> * 3 vacancies: Development Committee Member - Refer to DC Responsibilities<http://nanog.org/governance/dev/member_responsibility> * 8 vacancies: Program Committee Member - Refer to PC Responsibilities<http://nanog.org/governance/pgm/member_responsibilities> What is expected of a Board Candidate? How many vacant positions? Read the Board Member Responsibilities and NANOG by-laws for a complete understanding of the expectations placed on Board Members. Board Member Responsibilities<http://nanog.org/governance/bod/member_responsibility> NANOG By-laws<https://www.nanog.org/governance/documents/NANOG-Bylaws-October2011.pdf> To ensure continuity on the Board, three seats out of six become open each year due to the expiration of 2-year terms. The Board members whose terms are expiring in October are: * Steve Gibbard * Sylvie LaPerriere * Duane Wessels Sylvie and Duane have served two 2-year terms and cannot be considered for re-election until October 2014 (one year leave). Steve is completing his first two year term and he can stand for re-election. How do you Nominate? You can self-nominate. You care about NANOG’s governance and want to take a turn at volunteering your time and expertise to help make it better. 1. Make sure you are a NANOG member in good standing 2. Submit your Declaration of Candidacy to elections(a)nanog.org. You can nominate others. 1. Send their contact information to elections(a)nanog.org 2. If they accept the nomination, they will be asked to become a NANOG member in good standing 3. They will have to submit their Declaration of Candidacy to elections(a)nanog.org. As NANOG continues to evolve, our Board and our Committees will continue to play an increasingly important role in our success. We thank you in advance for becoming NANOG members and taking an active part in our governance. Best regards, Sylvie, on behalf of the NANOG Board of Directors _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Ruxcon 2013 Final Call For Papers
by cfp＠ruxcon.org.au 15 Jul '13

15 Jul '13

Ruxcon 2013 Final Call For Papers Melbourne, Australia, October 26th-27th CQ Function Centre http://www.ruxcon.org.au/call-for-papers/ The Ruxcon team is pleased to announce the final call for papers for Ruxcon. This year the conference will take place over the weekend of the 26th and 27th of October at the CQ Function Centre, Melbourne, Australia. The deadline for submissions is the 31st of August. .[x]. About Ruxcon .[x]. Ruxcon is ia premier technical computer security conference in the Australia. The conference aims to bring together the individual talents of the best and brightest security folk in the region, through live presentations, activities and demonstrations. The conference is held over two days in a relaxed atmosphere, allowing attendees to enjoy themselves whilst networking within the community and expanding their knowledge of security. For more information, please visit the http://www.ruxcon.org.au .[x]. Important Dates .[x]. August 31 - Call For Presentations Close October 26-27 - Ruxcon Conference .[x]. Topic Scope .[x]. o Topics of interest include, but are not limited to: o Mobile Device Security o Virtualization, Hypervisor, and Cloud Security o Malware Analysis o Reverse Engineering o Exploitation Techniques o Rootkit Development o Code Analysis o Forensics and Anti-Forensics o Embedded Device Security o Web Application Security o Network Traffic Analysis o Wireless Network Security o Cryptography and Cryptanalysis o Social Engineering o Law Enforcement Activities o Telecommunications Security (SS7, 3G/4G, GSM, VOIP, etc) .[x]. Submission Guidelines .[x]. In order for us to process your submission we require the following information: 1. Presentation title 2. Detailed summary of your presentation material 3. Name/Nickname 4. Mobile phone number 5. Brief personal biography 6. Description of any demonstrations involved in the presentation 7. Information on where the presentation material has or will be presented before Ruxcon * As a general guideline, Ruxcon presentations are between 45 and 60 minutes, including question time. If you have any enquiries about submissions, or would like to make a submission, please send an email to presentations(a)ruxcon.org.au The deadline for submissions is the 31st of August. .[x]. Contact .[x]. o Email: presentations(a)ruxcon.org.au o Twitter: @ruxcon

1 0

Re: Friday Hosing
by ryangard＠gmail.com 14 Jul '13

14 Jul '13

To add to that, I think the interesting point was brought up earlier anyways -- this doesn't stop midstream intercepts from catching traffic in transmission. You can have a secure endpoint, but if the email has to traverse, it's open to being sniffed. ------Original Message------ From: Patrick W. Gilmore To: NANOG list Subject: Re: Friday Hosing Sent: Jul 14, 2013 6:22 PM On Jul 12, 2013, at 19:22 , Nick Khamis <symack(a)gmail.com> wrote: > Set up your own email server, host your own web pages, maintain your own > cloud, breath your own oxygen FTW. That's simply not realistic for many companies and essentially all people (to a first approximation). -- TTFN, patrick Sent on the TELUS Mobility network with BlackBerry

1 0

Re: Open Resolver Problems
by Jay Ashworth 13 Jul '13

13 Jul '13

----- Original Message ----- > From: "Roland Dobbins" <rdobbins(a)arbor.net> > On Apr 1, 2013, at 11:18 PM, Patrick W. Gilmore wrote: > > Of course, since users shouldn't be using off-net name servers > > anyway, this isn't really a problem! :) > > ;> > > It's easy enough to construct ACLs to restrict the broadband consumer > access networks from doing so. Additional egress filtering would catch > any reflected attacks, per your previous comments. So, how would Patrick's caveat affect me, whose recursive resolver *is on my Linux laptop*? Would not that recursor be making queries he advocates blocking? Or don't I remember DNS well enough? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

16 27