January 2015 - NANOG - lists.nanog.org

Re: Recommended L2 switches for a new IXP
by Marian Ďurkovič 20 Jan '15

20 Jan '15

Last year we installed four 1RU TRILL switches in SIX - see http://www.six.sk/images/trill_ring.png Our experience after 100 days of production is only the best - TRILL setup is pretty straightforward and thanks to IS-IS it provides shortest-path IP-like "routing" for L2 ethernet packets over any reasonable topology out of the box (without the burden and cost implications of VPLS). Trident ASICs perform deep packet inspection so ECMP loadbalancing based on L3 and L4 headers inside TRILL-encapsulated packets works for both IPv4 and IPv6. Port-security is supported on physical ports as well as on LAGs - and L4 access-lists could be applied at the same time. As most 1RU switches are based on Trident ASICs, you just need to pick a vendor which implements TRILL properly and of course thoroughly test before deployment. We selected Huawei Cloud Engine 6850 boxes. Regards, M. > Dear Nanog community > > We are trying to build a new IXP in some US Metro areas where we have > multiple POPs and I was wondering what do you recommend for L2 switches. I > know that some IXPs use Nexus, Brocade, Force10 but I don't personally have > experience with these switches. It would be great if you can share your > experience and recommendations. There are so many options that I don't know > if it makes sense to start with a modular switch (usually expensive because > the backplane, dual dc, dual CPU, etc) or start with a 1RU high density > switch that support new protocols like Trill and that supposedly allow you > to create Ethernet Fabric/Clusters. The requirements are simple, 1G/10G > ports for exchange participants, 40G/100G for uplinks between switches and > flow support for statistics and traffic analysis. > > Thank you and have a great day. > > Regards

4 6

HTTPS redirects to HTTP for monitoring
by Grant Ridder 20 Jan '15

20 Jan '15

Hi Everyone, I wanted to see what opinions and thoughts were out there. What software, appliances, or services are being used to monitor web traffic for "inappropriate" content on the SSL side of things? personal use? enterprise enterprise? It looks like Websense might do decryption ( http://community.websense.com/forums/t/3146.aspx) while Covenant Eyes does some sort of session hijack to redirect to non-ssl (atleast for Google) ( https://twitter.com/CovenantEyes/status/451382865914105856) Thoughts on having a product that decrypts SSL traffic internally vs one that doesn't allow SSL to start with? -Grant

17 20

gamer "lag" dashboard
by Michael O Holstein 20 Jan '15

20 Jan '15

?Can someone point me in the right direction for something that allows creation of a "dashboard" with current and statistical latency to the various game servers (PC, Xbox, PS4, etc) ? .. I'm in the education space and we get lots of questions/complains about this and would like a way to make the stats public. I could roll something with RRD and Smokeping but with all the packet-shaping crapola (including that which we use here) I need something that emulates the actual game traffic as would be classified by all the network crap that endeavors to mess with it. (not intended to be an argument about QoS and prioritization, responses addressing either --or the politics thereof-- really aren't helpful). TIA, Michael Holstein Network & Data Security Cleveland State University

7 10

2016 IEEE World Congress on Computational Intelligence - Call for Papers
by 2016 IEEE WCCI 20 Jan '15

20 Jan '15

1 0

Re: HTTPS redirects to HTTP for monitoring
by Larry Sheldon 19 Jan '15

19 Jan '15

On 1/18/2015 12:55, John R. Levine wrote: > There are also ISPs that provide intrusive filtering as a feature. I > wouldn't use one, but I know people who do, typically members of > conservative religious groups. Can you provide credible evidence to support "typically members of > conservative religious groups."? Please explain how that contributes to the question at hand. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

2 1

Gmail admin help requested
by Lyle Giese 19 Jan '15

19 Jan '15

I have discovered that some emails are disappearing inside gmail. I have logs of one such email that disappeared. It shows the 250 reply from google, but email doesn't get to inbox or spam filter. Looking for assistance from Gmail. Thanks, Lyle Giese LCR Computer Services, Inc.

1 0

VDSL CPE Mixed Results
by Stetson Blake 19 Jan '15

19 Jan '15

Hey All, We have been deploying Adtran 838(shdsl) and 868(dsl) units in our metro area with mixed results. The devices themselves are reliable and secure it would seem, but the speeds were are able to get are not. ie. we have deployed 'vdsl' and needed 3 lines to get up to 10x10 speeds. We are using an Adtran TA5000 on the other end to terminate our connections. The distance between the site and CO is not great (under 6k feet). What gives? Are we provisioning wrong, using the wrong equipment, or a combination of both? If we were able to get the speeds others have been reporting from VDSL, life would be great. Anyone feel free to contact me off-list or on, this has had me scratching my head for a while now. Thanks, -- Stetson Blake Network Technician DataYard 130 West Second St. Suite 250 Dayton, OH 45402 http://datayardworks.com

6 5

Re: HTTPS redirects to HTTP for monitoring
by Larry Sheldon 19 Jan '15

19 Jan '15

On 1/18/2015 12:41, Teleric Team wrote: > Honestly, don't do this. Neither option.You can still have some > control over SSL access with ordinary domain based filtering getting > proxied, via CONNECT method or sorta. You don't need filtering > capabilities over full POST/DELETE/UPDATE HTTP methods, and if you > believe you need it, you just have a bigger problem that MITMing > won't solve at all. It's just like believing a data leak prevention > system will really prevent data leaking. Or believing a Palo Alto > NGFW policy that allows gmail but won't allow gmail attachments of > mime-type XYZ will be effective. If someone is really interested, > there are clever ways to bypass it, more clever than your options to > filter it. Forcing http fallback for https communication is not only > wrong, it's a general regression regarding security policy and best > practices. You are risking privacy, or "confidentiality" and > "integrity" if you prefer 27002 buzzwords. Not to mention the > "availability" breakage since many applications won't just work (aka, > you will break 'em). On the other hand, adding a MITM strategy, be > using Squid, Fortinet, pfSense, Palo Alto, Sonicwall, EndianFW, is > just worse. You are adding you own an attack vector on your company. > You are doing the difficult part of the attack for the attacker, > installing a custom root cert in your client stations. So you will > have much more to worry about, from "who has access", "how > vulnerable" and "how to deploy" until "what is deployed", "what is > revogated", "how's renegotiation, CRIME, etc like". You will have > more problem root and vectors to care about. Not only how safe is the > remote destination SSL server, but how save is the client to local > proxy doing MITM and local proxy doing MITM to remote SSL server. You > are attacking, cracking and breaking your own network. If someone > raise your squid log levels, you will have to respond for that, and > respond for what was copied before you noticed it. Same goes for > Fortinet, Websense, Sonicwall, or whatever open source or proprietary > solution you pick. You are still breaking "confidentiality" and > "integrity" but now without allowing for ordinary users or > applications to notice it. Back to the beginning: you can still do > some level of HTTPS filtering and per domain controlling without > having to fully MITM and inspect the payload. Don't add OWASP Top 10 > / SANS Top 25 facilitation vectors to your company. Do the usual > limited but still "safe" (oh no, not counting that unknown openssl > zero-day NSA and people on IRC know about but industry stills ignore, > or any other conspirator theory/fact), filtering... do just whatever > can be filtered without MITMing https and HTTP redirection. And don't > be seduced by the possibility of filtering more than that. It's a > trap, for both your users and your responsibilities as organization > regarding users' privacy not to mention possible ACTs and other laws > on your state/contry. > > >> Date: Sun, 18 Jan 2015 04:29:56 -0800 Subject: HTTPS redirects to >> HTTP for monitoring From: shortdudey123(a)gmail.com To: >> nanog(a)nanog.org >> >> Hi Everyone, >> >> I wanted to see what opinions and thoughts were out there. What >> software, appliances, or services are being used to monitor web >> traffic for "inappropriate" content on the SSL side of things? >> personal use? enterprise enterprise? >> >> It looks like Websense might do decryption ( >> http://community.websense.com/forums/t/3146.aspx) while Covenant >> Eyes does some sort of session hijack to redirect to non-ssl >> (atleast for Google) ( >> https://twitter.com/CovenantEyes/status/451382865914105856) >> >> Thoughts on having a product that decrypts SSL traffic internally >> vs one that doesn't allow SSL to start with? >> >> -Grant I have been "off-line" for several days and I have to say that this is one of the most depressing thread I have seen _anywhere_ in a while and reading it on NANOG multiplies the depression. But I am heartened to see this response (and one or two others so far)--there is still hope. For what it is worth (and this reflects at most two people's thinking here), I go to some considerable effort to identify handlers-of-my-data that betray my trust and on the merest hint I take considerable effort the avoid the betrayer and anybody who relies on the betrayer. Yes, I know that there is no way that I can stop everybody, but I try very hard. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

1 0

Peering Track for NANOG 63
by Patrick W. Gilmore 19 Jan '15

19 Jan '15

Everyone: I have been asked to moderate the Peering Track for NANOG 63. Time is short, and I need to fill a couple hours. If you have interesting ideas on how to do it, or better yet, would like to present something yourself, please ping me off-list. See you San Antonio! -- TTFN, patrick

1 0

Recommended readings on Network Monitoring and Anomaly Detection.
by Spyridon Mastorakis 18 Jan '15

18 Jan '15

Dear all, I am interested in conducting a survey on Network Monitoring and Anomaly Detection. I would really appreciate any recommendations for papers/readings that would help me on my survey. I am not really familiar with these areas, so I would appreciate to receive recommendations about papers/readings that elaborate on the basics as well. Thank you in advance for your time and your recommendations! Kind regards. -- Spyridon Mastorakis Personal Website: http://cs.ucla.edu/~mastorakis/ Internet Research Laboratory PhD Computer Science UCLA

2 1