September 2015 - NANOG - lists.nanog.org

Script for NAT timeout detection
by Max Tulyev 30 Sep '15

30 Sep '15

Hello All, I have some devices connected under NAT that is not under my control. Is there some software/script to detect NAT session timeout to adjust keepalives? Thank you!

1 0

Re: Experience on Wanguard for 'anti' DDOS solutions
by Ramy Hashish 30 Sep '15

30 Sep '15

> > > Date: Tue, 11 Aug 2015 08:14:54 +0200 > From: "marcel.duregards(a)yahoo.fr" <marcel.duregards(a)yahoo.fr> > To: nanog(a)nanog.org > Subject: Re: Experience on Wanguard for 'anti' DDOS solutions > Message-ID: <55C992DE.3020906(a)yahoo.fr> > Content-Type: text/plain; charset=windows-1252; format=flowed > > anybody from this impressive list ?: > > https://www.andrisoft.com/company/customers > > -- Marcel > > > Anybody here compared Wanguard's performance with the DDoS vendors in the market (Arbor, Radware, NSFocus, A10, RioRey, Staminus, F5 ......)? Another question, have anybody from the reviewers tested the false positives of the box, or experienced any false positive incidents? Thanks, Ramy

4 7

Security release scheduling
by Harlan Stenn 29 Sep '15

29 Sep '15

I'm looking for some general "calendar" help to use for our security release scheduling process. Something that usefully accounts for clients all over the world. By "usefully accounts" I mean that we want to be able to have reasonable confidence that we're not going to pick a public release date that is a national holiday for one country, and we're also not going to avoid a date because it's "let's order pizza" day somewhere else, but the purpose of the holiday is obscured because of language translation issues. I figure this is something others must have solved, and I'm hoping some folks on this list might be able to offer me some pointers. -- Harlan Stenn <stenn(a)nwtime.org> http://networktimefoundation.org - be a member!

3 5

Prefix hijacking by AS20115
by Seth Mattinen 29 Sep '15

29 Sep '15

I've got a problem where AS20115 continues to announce prefixes after BGP neighbors were shutdown. They claim it's a wedged BGP process but aren't in any hurry to fix it outside of a maintenance window. I'm at a loss of what else I can do. They admit the problem but won't take action saying it needs to wait for a maintenance window. Am I out of line insisting that's an unacceptable response to a problem that results in prefix/traffic hijacking? ~Seth

21 33

T1 Availability in Indianapolis
by Stetson Blake 29 Sep '15

29 Sep '15

Hey all, I am wondering if anyone has a contact for T1 availability, CLEC or otherwise. I am looking specifically around: Dividend Drive Indianapolis, IN 46241 Please contact me off list Thanks, ? Stetson Blake Network Administrator Voice: (937) 610-3514 Toll-Free: (800) 982-4539 ext. 3514 DataYard 130 West Second St. Suite 250 Dayton, OH 45402 http://datayardworks.com<http://datayardworks.com/>

1 0

Hummingbird Networks Optics
by Eric C. Miller 29 Sep '15

29 Sep '15

Does anybody have any experience with Hummingbird Networks optics? Thank you! Eric

1 0

Re: Prefix hijacking by AS20115
by Hank Nussbacher 29 Sep '15

29 Sep '15

At 23:11 28/09/2015 -0400, Josh Luthman wrote: >Start announcing their prefixes? Contact the upstreams of AS20115 - Cogent, Level3, HE and XO. -Hank >Josh Luthman >Office: 937-552-2340 >Direct: 937-552-2343 >1100 Wayne St >Suite 1337 >Troy, OH 45373 >On Sep 28, 2015 11:09 PM, "Seth Mattinen" <sethm(a)rollernet.us> wrote: > > > On 9/28/15 18:30, William Herrin wrote: > > > >> On Mon, Sep 28, 2015 at 9:01 PM, Seth Mattinen <sethm(a)rollernet.us> > >> wrote: > >> > >>> I've got a problem where AS20115 continues to announce prefixes after BGP > >>> neighbors were shutdown. They claim it's a wedged BGP process but aren't > >>> in > >>> any hurry to fix it outside of a maintenance window. > >>> > >> > >> If they weren't lying to you, they'd fix it now. That's not the kind > >> of problem that waits. > >> > >> Thing is: they lied to you. Long ago they "helpfully" programmed their > >> router to announce your route regardless of whether you sent a route > >> to them. They want to wait for a maintenance window to remove that > >> configuration. > >> > >> > >> I'm at a loss of what else I can do. They admit the problem but won't take > >>> action saying it needs to wait for a maintenance window. Am I out of line > >>> insisting that's an unacceptable response to a problem that results in > >>> prefix/traffic hijacking? > >>> > >> > >> Try dropping the link entirely. If they still announce your addresses, > >> bring it back up but report it as emergency down, escalate, and call > >> back every 10 minutes until the junior tech understands that it's time > >> to call and wake up the guy who makes the decision to fix it now. > >> > >> > > > > I'm at the tail end here almost 8 hours later since the hijacking started. > > Their NOC is just blowing me off now and they're happy to continue the > > hijacking until it's convenient for them to have a maintenance window. And > > that's apparently the final decision. > > > > ~Seth > >

3 2

Facebook - IP Engineering Contact
by Erik Sundberg 29 Sep '15

29 Sep '15

Can an IP Engineer from facebook please contact me off list. I have routing issue getting to your mai1 (Miami, FL) pop. Unrelated to the issue earlier today. Erik Sundberg Sr. Network Engineer p: 773.661.5532 c: 708.710.7419 866.892.0915 24/7 NOC 1101 W. Lake Street, 6th Floor | Chicago, IL 60607 esundberg(a)nitelusa.com<mailto:esundberg@nitelusa.com> | www.nitelusa.com<http://www.nitelusa.com/> ________________________________ CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must destroy the original transmission and its attachments without reading or saving in any manner. Thank you.

1 0

Re: Question re session hijacking in dual stack environments w/MacOS
by John Schimmel 29 Sep '15

29 Sep '15

I can¹t speak to every case, but I ran into a similar issue with our WAF product, so I can explain what was happening there. Most Web application firewalls have cross-site request forgery protection. When a form is downloaded, the firewall inserts a hidden field or cookie that contains the IP address of the request. When the form is submitted, the firewall then verifies that the post is sent from the same address. If the client does a get via IPv6, and the form contains a form action for a URL that is better reached via IPv4 then the firewall sees the post coming from a different IP address and refuses the request. This is nothing specifically to do with MacOS, it is true of any multi-homed system. The options are either to rewrite the client to guarantee that the address in a post always matches the corresponding get; to maintain different URLs on the server such that requests from IPv6 clients always return action URLs that will go to an IPv6 hostname, and vice-versa for IPv4; or to disable CSRF protection. Later, John > From: David Hubbard <dhubbard(a)dino.hostasaurus.com> > > Hey all, as we've slowly deployed IPv6 to our end users, it has begun to > cause some issues for those on Mac's specifically. Apple apparently has > an algorithm at some point in the network stack to decide whether IPv4 > or IPv6 is, perhaps, 'better' or 'faster' at any given point in time > during an ongoing session. This allows a computer talking to a dual > stack remote website to flip flop between v4 and v6 as activity is > conducted. > > Websites that require some type of authentication that is handled via > session cookies have been booting our users out randomly with "your ip > address has changed" type message. This occurs when their Mac decides > to switch between protocols because the site views it as a session > hijacking attempt when Joe User with session ID xyz switches from > 192.0.2.10 to 2001:db8::1:1:a or vice versa. > > Has anyone run into this? Our users on other platforms don't seem to > have this issue; linux and MS desktops seem to just use v6 if it's > available and v4 if not. > > Thanks, > > David

2 1

Facebook invisible in Italy
by Marco Paesani 28 Sep '15

28 Sep '15

Hi, some issues from FB network ?? Do you have some info ? Regards, -- Marco Paesani MPAE Srl Skype: mpaesani Mobile: +39 348 6019349 Success depends on the right choice ! Email: marco(a)paesani.it

13 12