September 2015 - NANOG - lists.nanog.org

correlation between ingress and egress traffic in case of volume-based DDoS
by Martin T 23 Sep '15

23 Sep '15

Hi, volume-based DDoS attacks should often result with following bandwidth graphs: http://s12.postimg.org/gy3eps10t/volume_based_DDo_S_graph.png This is a fabricated bps graph for 100GigE port facing an uplink provider. As seen on the image, outgoing traffic drops at the time when incoming traffic increases. I could see following reasons for this: 1) large portion of traffic uses TCP protocol and in case of congestion(even in one direction), ACK messages are lost and TCP congestion avoidance kicks in and as a result it will reduce the cwnd which in effect reduce the data TCP sender can send 2) certain router platforms share some hardware resources both with Tx and Rx traffic Are those assumptions correct? Are there any other reasons which cause outgoing traffic to drop if incoming traffic is very high or the other way around? thanks, Martin

4 3

Cisco Security Advisory: Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 23 Sep '15

23 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability Advisory ID: cisco-sa-20150923-iosxe Revision 1.0 For Public Release 2015 September 23 16:00 UTC (GMT) +------------------------------------------------------------------------------- Summary ======= A vulnerability in the processing of IPv4 packets that require Network Address Translation (NAT) and Multiprotocol Label Switching (MPLS) services of Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4300 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers could allow an unauthenticated, remote attacker to cause a reload of the affected device. The vulnerability is due to improper processing of IPv4 packets that require NAT and MPLS processing. An attacker could exploit this vulnerability by sending an IPv4 packet to be processed by a Cisco IOS XE device configured to perform NAT and MPLS services. A successful exploit could allow the attacker to cause a reload of the affected device. Cisco has released software updates that address these vulnerabilities. There are no workarounds to mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep15.html -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWAWwjAAoJEIpI1I6i1Mx38DAP/RFsW3ytyddAsop+FKs1wOMR 5lecyURmnDItcgbmAFcQIOZDV076aFznVDHKniGZQBsW54nh4YGV1pfq1YNU3ikz XVPY22XNgfnJQVGmzypxkL/hCYJlWF+RWMEQ+5sDMKb2LZP3WNNMtjNBOW4oac3r dP9sYgKBT8GcA4gVlsWEpaaFlMTs90jizkjjm2V1JcGiEn0aoL3+Uq5epJ0mRajI Kx/Dl7DdtiyDONNycABntHena6GtBVu+QvDqTbjpL8VV7XMeLmmCeOtZgGQQ/bTr UgZrRd+skLs+phSREk4x/GwcksRAGYu19pq5fNNAnWOYUBD2dhlfNET4GVKQ++1b h/DfHMXS++Ztj4aEA2VEU1WlFeTA5qRVjWtr6nxxfJoixaf6b0teeXMeWFJh9rRt C3LsSWvTp+X4L8vvVwWRV/Ij5vlMcN2aHp9SCealJzFDRr7r1B1cj/bGq+Cf4Ozc e9+8Y/F5NFe4+Epdm0SwdbYnwAvi6NxR1HGlzhpJWv2fkVZO+uCZajRwjAsceYmI si1mgpMJNgWyLitsRPbFVjnjtJaVdTb9AIUotvWqgHAmm6aaaGt1zRWDoJxZEQq3 r1JVXHd5Jm/jeTUeQApZF4QqIcDxP3vGvpdEdFJbHZGAQobia8TXX2vjagjomZwU IH8hUmuxOjKmeSFIP7oy =W9mD -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability
by Cisco Systems Product Security Incident Response Team 23 Sep '15

23 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability Advisory ID: cisco-sa-20150923-sshpk Revision 1.0 For Public Release 2015 September 23 16:00 UTC (GMT) +------------------------------------------------------------------------------- Summary ======= A vulnerability in the SSH version 2 (SSHv2) protocol implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass user authentication. Successful exploitation could allow the attacker to log in with the privileges of the user or the privileges configured for the Virtual Teletype (VTY) line. Depending on the configuration of the user and of the vty line, the attacker may obtain administrative privileges on the system. The attacker cannot use this vulnerability to elevate privileges. The attacker must know a valid username configured for RSA-based user authentication and the public key configured for that user to exploit this vulnerability. This vulnerability affects only devices configured for public key authentication method, also known as RSA-based user authentication feature. Cisco has released software updates that address this vulnerability. Workarounds for this vulnerability are not available; however administrators could temporarily disable RSA-based user authentication to avoid exploitation. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep15.html -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWAWwoAAoJEIpI1I6i1Mx3ZX8P/2w1PAyuoJbNS6i5ESErJBX8 EM18LXLdOuy+qe5Ag2V6ztDBpLGpp2AdaR4EYeaRnRyqBjL5gqdyXLYotIKk3IY0 4DLG/IEiLoSJql51Fx8GXvuomqr4S3Its3MfSjfkre2fEvVV6NpXaCaBZKsowiw+ e+pu4D1qPZm30+kwO7QUIN0lGwCIboZa7OiRLjItRyixiKbA7LADsCijCNy6FIF+ G8shRD/mSkyBoetF1MjvAN18d+z+Kuy9YOGViM8oWSV20/Z9PXlSujkVdRjaxW4Y +dPp5Fk1ot6zqSXQahZZRBY8glIkqE8gsTSJT9qhfD+8Q3XXY1eUNvlKuNmv3HDg ftlJYTq7Ye5gjbvd2ro7/IAoKf/jaC2CM6pTgegDsXCCarzUMVj6ZjXiP1XqjRS4 4yaX7v9z3qPVid8W8niJscFVdXMG4YGhHqNdriDirUmvF+a5XDa0OGCi40xO8rsV HG1PishidpaMXFgklJPCWzzuwmwWDu6GKvpJkTTSRNYWttzWV+/aMNQzzyGjTSIY ePzDeRctHfaeZyaVCiAVvv6Pj2NP0PGbLmtsr5K5UqoTEbVTy0CIte1iLuu8zzhs HzyoWlqziOq9+0NfvcM5/0J64wekiOUiQehKzyYOa+F3F54KzyDJxNhToezkLhdQ VcGcN1w0HOwRLvd7LWN6 =hXl+ -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS and IOS XE Software IPv6 First Hop Security Denial of Service Vulnerabilities
by Cisco Systems Product Security Incident Response Team 23 Sep '15

23 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS and IOS XE Software IPv6 First Hop Security Denial of Service Vulnerabilities Advisory ID: cisco-sa-20150923-fhs Revision 1.0 For Public Release 2015 September 23 16:00 UTC (GMT) +------------------------------------------------------------------------------- Summary ======= Two vulnerabilities in the IPv6 first hop security feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. Cisco has released software updates that address these vulnerabilities. There are no workarounds to mitigate these vulnerabilities. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep15.html -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWAWwcAAoJEIpI1I6i1Mx3wYkQAJU+71c6l6BRNwQ65d7XucdS r64mrlpga6Mud4jxqsbatCM76W+DDcSE1xtz2lqWN8L3Aqndq/ZmsysZPID81lr/ kPWpVaNbOjr/BgXe8K8f/xYS6ExIMs7jcLSOcB5obdQaHXOvOf8yPOP4SuHodILO i5JJ+kjE22dmRw1srBCtZF0HdNUFa+aXYuR0OSrqHwaPARMsRPQbsAF7djBVDdRU 1XB4YH5zVXG0q3yMpdlJLdVkPtQesC+BSka66qcSJBnC6tqQ/KEMkUkt+Uk1Yh9s Qpuh9UcIB78/oBy/VZI8IGsTL4uVLczRhonQe5KFP3uvM0LJvMXAn+dTXXBZJXlm 9NEHrOuoxZjPlMYntaY3xE9Ocl3ObA4Y12H1S+E1djhVogdNjW4qN8dorqIq10g5 jAi0o8qhM7o5vRjDt8os0UnuAHPaqtY0C5oaTruZN28N7Hzey4mdM9wkOL/oY+rq Lgd9BT+BHAO+Yop0cgpmPAs2EXYzVz7zN5euYzuFywQOfQvko84YFfzxt6Y+ofIH SbAHZ1tdtw059IQk6Q6nlK3rE9jk+vO7wQ8MW39OXCgjEMlXn7kWQ3gctXz0Qesj li2+OFzXVhLBk3JDiqBQJ08FYoyuH25e58MumDLxZnoQi4jS5YqJcSQjSfnRLn2n eU9LswAcnFiAlRAE34PP =pjAl -----END PGP SIGNATURE-----

1 0

Fw: important
by Gisele Kamanou 23 Sep '15

23 Sep '15

Hey! Important message, please visit <http://majorinvesting.com/hope.php?i> Gisele Kamanou

1 0

Verizon Wireless LTE/4G and SIP Header Manipulation
by Mark Stevens 22 Sep '15

22 Sep '15

Hi All, Has anyone seen that something (most likely an alg) on Verizon's LTE/4G network is rewriting SIP headers,in particular From Tag identifiers? We cannot make a SIP call from our cellphones (using cellular data) beyond 30 seconds because the TAGs are rewritten and the destination Asterisk server drops the call because of this. Thanks Mark

6 9

Re: Verizon Wireless LTE/4G and SIP Header Manipulation
by Dovid Bender 22 Sep '15

22 Sep '15

We have this every now and then. Mainly with traffic from the middle east. Switching the port to something other than 5060 seems to help most of the time. Every so often we need to go the vpn route. I know that yealink, snim and possibly polycom have vpn clients built into them. ------Original Message------ From: Mark Stevens Sender: NANOG To: nanog(a)nanog.org Subject: Verizon Wireless LTE/4G and SIP Header Manipulation Sent: Sep 22, 2015 12:03 Hi All, Has anyone seen that something (most likely an alg) on Verizon's LTE/4G network is rewriting SIP headers,in particular From Tag identifiers? We cannot make a SIP call from our cellphones (using cellular data) beyond 30 seconds because the TAGs are rewritten and the destination Asterisk server drops the call because of this. Thanks Mark Regards, Dovid

1 0

IX Peering - BGP Session Filtering Best Practice
by Erik Sundberg 22 Sep '15

22 Sep '15

Just wondering how far everyone is going on filtering BGP sessions when peering with other content providers and carriers over an internet exchange. What are you doing. 1. Just filtering out IPv4 Reserved Space, RFC 1918, and Default Routes. 2. AS Path Filtering. Only filtering by the AS's that are present in the IRR Record. 3. Filtering by IP Prefix based on the IRR Record for the Peer. (Yes some Prefix Filter list can be a couple thousand lines) 4. Doing both #3 and 4 listed above. Besides Peering DB is there any software to help keep track of IX and Peering info. So far I have only found IXP-MANGER ________________________________ CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must destroy the original transmission and its attachments without reading or saving in any manner. Thank you.

2 1

Academic Paper - ISPs Sharing Long Haul Infrastructure in the USN
by Rod Beck 21 Sep '15

21 Sep '15

This might of interest to network engineers seeking to ensure their upstreams are physical diverse. http://pages.cs.wisc.edu/~pb/tubes_final.pdf Roderick Beck Sales - Europe and the Americas Hibernia Networks http://www.hibernianetworks.com Budapest and New York This e-mail and any attachments thereto is intended only for use by the addressee(s) named herein and may be proprietary and/or legally privileged. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this email, and any attachments thereto, without the prior written permission of the sender is strictly prohibited. If you receive this e-mail in error, please immediately telephone or e-mail the sender and permanently delete the original copy and any copy of this e-mail, and any printout thereof. All documents, contracts or agreements referred or attached to this e-mail are SUBJECT TO CONTRACT. The contents of an attachment to this e-mail may contain software viruses that could damage your own computer system. While Hibernia Networks has taken every reasonable precaution to minimize this risk, we cannot accept liability for any damage that you sustain as a result of software viruses. You should carry out your own virus checks before opening any attachment.

6 8

cisco.com unavailable
by Murat Kaipov 21 Sep '15

21 Sep '15

Hi folks! Is cisco.com <http://cisco.com/> unavailable or it is affected just for Rostelecom?

16 18