May 2015 - NANOG - lists.nanog.org

Unified Security Vulnerability Management
by Ryan Shea 19 May '15

19 May '15

Manually setting up and parsing email notifications for security vulnerabilities for all vendors is mighty annoying. It looks like the ICASI CVRF <http://www.icasi.org/cvrf> Working Group thought the same thing back in 2011 when they came up with this handy XML schema. I had not known of this until yesterday and noticed that Cisco does a good job <http://tools.cisco.com/security/center/cvrfListing.x> posting their vulnerabilities in CVRF. Word on the streets is that Juniper <https://twitter.com/junipersirt/status/70627418737610752> was at least partially involved in CVRF as well. Brocade may have looked into it as well. This does not seem like a difficult thing for vendors to do, but the missing piece may be customer interest. I am hoping to drum up some interest here -- maybe a few support requests would entice them to hand this off to an intern and we could collectively do better at managing vendor notifications. A tool <https://github.com/mschiffm/cvrfparse> to parse CVRF is already floating about as well (mschiffm).

1 0

A Canonical answer requested (AS41231)
by Christopher Morrow 19 May '15

19 May '15

if there's a canonical neteng/ops person around it'd be handy to get a contact off-list :) I have a question to ask... about bgp and paths and fun stuff such as that! (probably a traceroute or 'show ip bgp' would suffice from their perspective) -chris

2 3

Usage of Teredo and IPv6 for P2P on Windows 10 and Xbox One
by Darrin Veit 18 May '15

18 May '15

Hi Everyone - We've had very fruitful discussions with members of this community on Xbox One networking behavior, in particular concerning P2P multiplayer gaming activity. In an effort to continue that useful dialogue, we wanted to provide an informational update for Xbox One, but also share relevant details on upcoming Windows functionality in terms of Teredo and IPv6 usage. We also include some observations about IPv4 and IPv6 health that may be broadly interesting, especially as it pertains to network readiness for Xbox multiplayer via IPv6. New Xbox experiences launching on Windows 10 will use Teredo for P2P communications -------------------- Earlier this year we announced some Xbox functionality coming to Windows 10. One key feature of Windows 10 is enabling multiplayer gaming and chat functionality between Xbox One consoles and Windows 10 devices. This functionality on Windows 10 will behave similarly to how multiplayer works today on Xbox One, using Teredo for NAT traversal and IPsec for security. When used for Xbox Live enabled experiences, the Windows 10 Teredo client will prefer originating traffic from the IANA-registered port, 3074, when available. More detailed guidance on Xbox One behavior is linked at the bottom of this email. It also should be noted that Windows supports a broad range of applications and a huge portfolio of great games outside of the Xbox Live ecosystem. In general, Microsoft encourages broad adoption of the recommendations in RFC 4787, RFC 6092, and RFC 6888 to maximize the viability of P2P technologies for all. IPv4's P2P health is degrading -------------------- Qualitative and quantitative evidence available to us indicates that overall availability of functioning P2P connectivity on the IPv4 Internet is decreasing over time. In particular we are concerned that IPv4 address scarcity is forcing many small and medium market network operators to deploy carrier-grade NAT functionality. This often results in end-users being intractably stuck behind "strict" networks with degraded multiplayer experiences as a result. Healthy, standards-compliant IPv6 access is broadly needed, sooner rather than later. However, we have identified a few areas of concern in regard to IPv6 support that will hinder the efficacy of enabling multiplayer on IPv6. IPv6 is being deployed, but not perfectly, jeopardizing IPv6 P2P --------------------- Across the Xbox One customer base, in particular for customers who play multiplayer games, we observe that a substantial minority (around 20%) of devices have native IPv6 configured. This represents a much higher IPv6 penetration rate than Microsoft's other products and services report, as well as public data from other sources. However we have numerous concerns about IPv6's growth. We are often finding that retail customer premise equipment is configured with IPv6 disabled by default, requiring user action to enable. We've also encountered a very small set of reports where IPv6 latency and bandwidth performance are suboptimal compared to IPv4. Reports of this nature have usually focused on streaming media experiences and user concern that IPv6 is slower than IPv4 (i.e. "I get 1080P resolution with IPv4, and 720P with IPv6"). In the rare cases where these reports have been substantiated, the primary culprit has been differences in deployed CDN support. Also, some networking hardware and operators apply firewall policy to the IPv6 path contrary to RFC 6092 recommendations. Of particular concern are configurations where unsolicited inbound IKE/IPsec traffic is not permitted in the default operating mode. Growth of these non-conformant configurations puts the P2P benefit of the next generation Internet in jeopardy. It would be incredibly regrettable if IPv6 necessitated the high level of configuration and inefficiency currently required for IPv4. Deprecating public Teredo servers for Windows Vista and Windows 7 -------------------- On May 4th, 2015, we began deactivating Microsoft's publicly available Teredo servers currently configured as the default servers for Windows Vista and Windows 7 clients. This is a result of limited usage on those platforms and our desire to focus our operations on Xbox One and Windows 10. If you read this far, you are awesome. We will likely request a NANOG presentation slot later in the year to discuss these points, but we want to make sure we have sufficiently interesting and new things to discuss before swallowing up people's time. Network operators and CPE manufactures are encouraged to reach out to our team at xboxteredo(a)microsoft.com with operational questions. Please note that our most common reply will be "better documentation is coming later in the year," but we will try our best to respond to questions quickly. Thanks for your time, Darrin Veit & Christopher Palmer Xbox Platform Networking Operating System Group Current Xbox One Multiplayer Networking Guidance ------------------------- http://download.microsoft.com/download/A/C/4/AC4484B8-AA16-446F-86F8-BDFC49…

3 2

ARO Security
by Nicholas Schmidt 18 May '15

18 May '15

I cant find a way to reach out to whoever manages ARO directly so I figure it would be best to publish this to the list. We are a group of network operators who are failing at enforcing extremely basic security in our own applications. 1.) Retrieving an ARO password sends a plain text email of your current password. Im sure this is minor as its just ARO and none of us would ever re-use a password in more critical systems. 2.) The SSL cert for secretariat.nanog.org is invalid. It looks to be trying to use the wildcard for amsl.com $ openssl s_client -showcerts -connect secretariat.nanog.org:443 CONNECTED(00000003) depth=0 /OU=Domain Control Validated/CN=*.amsl.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /OU=Domain Control Validated/CN=*.amsl.com verify error:num=27:certificate not trusted verify return:1 depth=0 /OU=Domain Control Validated/CN=*.amsl.com verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/OU=Domain Control Validated/CN=*.amsl.com i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU= http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2

5 6

Re: Visualware/Speedtest self-hosting alternatives
by Rich Brown 18 May '15

18 May '15

> Hi, > Are there any turn key solutions out there like Visualware's MCS which you can install in a datacenter and let customers check overall throughput/latency and other metrics from their locations to the datacenter? I think someone also mentioned M-LAB but I didn't see the URL. They're at: http://www.measurementlab.net/tests This one isn't self-hosted, but I like it a lot: DSL Reports Speed Test http://dslreports.com/speedtest Rich

1 0

Visualware/Speedtest self-hosting alternatives
by Durga Dash 18 May '15

18 May '15

Hi, Are there any turn key solutions out there like Visualware's MCS which you can install in a datacenter and let customers check overall throughput/latency and other metrics from their locations to the datacenter? Thanks Durga.

5 4

survey on performance measurement platforms and related standards
by Bajpai, Vaibhav 18 May '15

18 May '15

Dear NANOG, I would like to share something with you today. As you know, IETF LMAP [1] is making efforts to standardize large-scale measurements to allow divergent measurement platforms to converge towards interoperability. Early discussions within this group often lead to folks asking for feature sets and possibilities of each contemporary performance measurement platform. So we started digging literature work in this space and found that although there were surveys on topology-based measurement platforms (such CAIDA Ark et al.); literature work on performance measurement platforms (such as RIPE Atlas, SamKnows et al.) was missing. Therefore, we started writing such a survey in 2013 to plug this gap and also complement this with current state of IETF standardization efforts happening within the LMAP and IPPM working groups. This work got published and came online recently. I thought would share this with you: ----------------8<-----------------8<-----------------8<-----------------8< A Survey on Internet Performance Measurement Platforms and Related Standardization Efforts Vaibhav Bajpai, Jürgen Schönwälder IEEE Communications Surveys & Tutorials April, 2015 A number of Internet measurement platforms have emerged in the last few years. These platforms have deployed thousands of probes at strategic locations within access and backbone networks and behind residential gateways. In this paper we provide a taxonomy of these measurement platforms on the basis of their deployment use-case. We describe these platforms in detail by exploring their coverage, scale, lifetime, deployed metrics and measurement tools, architecture and overall research impact. We conclude the survey by describing current standardization efforts to make large-scale performance measurement platforms interoperable. Author Copy: http://vaibhavbajpai.com/documents/papers/proceedings/lsmp-comst-2015.pdf DOI: http://dx.doi.org/10.1109/COMST.2015.2418435 ----------------8<-----------------8<-----------------8<-----------------8< Thanks! [1] https://datatracker.ietf.org/wg/lmap Best, Vaibhav ===================================================== Vaibhav Bajpai Research I, Room 91 Computer Networks and Distributed Systems (CNDS) Lab School of Engineering and Sciences Jacobs University Bremen, Germany www.vaibhavbajpai.com =====================================================

1 0

IP Geolocation
by Ben Perkins 18 May '15

18 May '15

Hi, Last year we purchased a /22 IPv4 block through RIPE. Although most sites (including RIPE https://stat.ripe.net/185.57.92.0%2F22#tabId=at-a-glance) have updated the IP Geolocation for them to London, a few sites have yet to change and are blocking access to their sites based on this. The 2 main sites that we are having issues with are Amex and Paypal. We have opened tickets with them but are just being passed around and not really getting anywhere. Has anyone had experience of this before or know of a good contact at either to help get this resolved? Thanks in advance, Ben

1 0

Hulu and HBO
by Mike Hammett 18 May '15

18 May '15

When I fire up their streams, they come from Level3 IPs. Can anyone confirm that Hulu and HBO come from Level 3 and not just someone that has the box I was talking to on Level3's network? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

4 4

Re: Fixing Google geolocation screwups
by Pedro Cavaca 16 May '15

16 May '15

https://support.google.com/websearch/answer/873?hl=en On 7 April 2015 at 23:26, John Levine <johnl(a)iecc.com> wrote: > A friend of mine lives in Alabama and has business service from at&t. > But Google thinks he's in France. We've checked for various > possibilities of VPNs and proxies and such, and it's pretty clear that > the Goog's geolocation for addresses around 99.106.185.0/24 is screwed > up. Bing and other services correctly find him in Alabama. > > Poking around I see lots of advice about how to use Google's > geolocation data, but nothing on how to update it. Anyone > know the secret? TIA > > Regards, > John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for > Dummies", > Please consider the environment before reading this e-mail. http://jl.ly > > >

9 11