June 2016 - NANOG - lists.nanog.org

Re: Netflix VPN detection - actual engineer needed
by Baldur Norddahl 14 Jun '16

14 Jun '16

Den 4. jun. 2016 01.26 skrev "Cryptographrix" <cryptographrix(a)gmail.com>: > > The information I'm getting from Netflix support now is explicitly telling > me to turn off IPv6 - someone might want to stop them before they > completely kill US IPv6 adoption. Not allowing he.net tunnels is not killing ipv6. You just need need native ipv6. On the other hand it would be nice if Netflix would try the other protocol before blocking.

44 127

Enough about Netflix banning HE tunnels [really: IPv6 adoption]
by STARNES, CURTIS 14 Jun '16

14 Jun '16

NANOG members; First things first - PLEASE NOTE: This is just an opinion from one old IT guy who used to have to use a dial-up connection from a small town in central Texas to connect to my "ISP" (term used loosely for the very early 1990's) in Dallas, Oklahoma City, and sometimes Shreveport, LA with my trusty Slackware box (with its screaming i386 processor/2MB RAM and 900 BAUD modem) just to get my FidoNet/UUCP email fix (just for those of us who remember the old "bang path" email via UUCP!) via UUNet. This passion grew into running multi-node Wildcat! BBS systems in early 1992 to small ISP's in the mid-1990's until which time my Southwestern Bell phone bills and customer churn killed this hobby quick and I had to turn to a full time IT professional to feed the family. As the Internet continues to grow exponentially with the explosion of the IoT movement, let's see how every one's IPv4 boxes connect to an IPv6 only network (or their refrigerator) without the support of the IT community such as NANOG members to mangle the packets and push their packets through some sort of IPv4 to IPv6 transitional technology. This thread is really getting on my nerves and old eyes as it fills my mailbox daily and I am sure I am not the only one. Between the content providers that are complaining about there is not enough IPv6 traffic to justify the migration, vendors pushing products that do not support IPv6, to the carriers that do not support dual stack to the last mile customer, then the end-user that you hear saying "IPvWhaaaat?" on the end of the phone; it is up to us, the network engineers, network administrators, "Packet Pushers", and whatever title is bestowed upon us, to just make it work. That is what I hear day in and day out; "The sales team said it could be done so what is the problem? Get if fixed or we will find someone who can!" and I am in the public education space! I feel for the network engineers, NOC operators, and cable/fiber teams of our great nation. Just as an FYI: I remember when IPv4 was a "Fad" and took patience of Job (the biblical Job, not job) just to get the Win32's loaded on Windows 3.1 so it would handle a 32-bit address. This is not including the mastery of the AT commands that Trumpet Winsock required since each manufacturer put their own spin in their interpretation of what AT command should do what (I still can remember what "squeals and tones" were negotiating at what speed and the occasional nightmare that ATZ & AT&E1 just sit there with a blank terminal and silent modem). Netflix can ban and block all they want. Carriers can complain "Streaming media is using too much bandwidth", never mind that each and every one pays for transit bandwidth, even public schools! We must remember our technology history; - Ma Bell said that they were too big to be broken up - IBM would always be king - Unix such as System V/BSD/Open Systems/AIX/SCO/HP-UX/Sun Solaris would each rule the world. - and my personal favorite - "No one would want to own a personal PC!" Bottom line, whether we keep pushing onward with what we have, IPv4 and IPv6 or we adopt another protocol to replace the archaic IPv4. The Layer 1-7 technologies which we all work with daily, were never designed with security as the primary concern when RFC 675 was created in 1974 by the Network Working Group with Vince Cerf and others. I do not think Vince Cerf and the other members of the Network Working Group had Cryptolocker, Ransomware, on his mind when TCP/IP was "born" from this RFC. We must keep pressing onward and pushing the envelope of our segment of the modern and some not so modern Internet. Where would we be without the Vince Cerf's, Steve Job's, Bill Gates', Paul Allen's, DARPA, US Military, the fiber tech's that run, fuse, and terminate miles of fiber while others sleep, the network techs, net admins, programmers, and too many others to mention. Where would and would there be IPv4, IPv6, or an Internet at all. Whether we are doing this as our jobs or as a hobby, driven out of passion for technology. We owe the next generation(s) the benefit of our best work so that they have to opportunity to do their best as well. Thank you NANOG community for the platform for me to express this rant/reflections; and the freedoms our country provides so I can do so freely. Curtis Starnes Senior Network Administrator Granbury Independent School District Granbury, Texas IEEE Member since 2012 (Just for the record, these are my opinions and ramblings/rants, not my employers) -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of bzs(a)theworld.com Sent: Friday, June 10, 2016 1:13 PM To: Karl Auer <kauer(a)biplane.com.au> Cc: nanog(a)nanog.org Subject: Re: Netflix banning HE tunnels [really: IPv6 adoption] This is sort of whacky. IPv4 was so successful, let's say post 1990, because it got people from nothing to internet or as some say Internet. IPv6 cannot duplicate that. So continuing to rely on this idea that "hey a coupla billion people went for IPv4, and even that was slow at first, so it's just a matter of time"...is...I'll be kind...unwise. This is no longer engineering. This is marketing. Hand the problem over to a professional marketing organization and go back to what you were trained to do. Give them your phone number and tell them to please call if they think you can help, maybe a product endorsement spot on prime-time TV or to consider some technical improvement. Hi! I'm Barry Shein! I helped invent the internet. But I am about to explain to you a NEW development, IPv6, which is going to improve your internet experience more than you may have thought possible! And stay tuned for a special secret offer we're including for the first 250 million adopters! -- -Barry Shein Software Tool & Die | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*

3 4

Thinking Methodically about building a PoC
by Kasper Adel 13 Jun '16

13 Jun '16

hi, I am asked to build a large lab/test it. I'm provided crazy scale numbers for lots of technologies (L*VPN, IPv*, IGP*, All Tunnels flavors...etc). It took me a lot of time to build this lab, because when I got the request/test plan handed over to me, I did not verify that these scaled numbers are even possible, not to mention the combination. I assumed some thought/research were done before. I'm trying to put together a list of the lessons learned, and the right way to do this for future reference, specially that this project was time critical and I got beaten hard because I did not deliver on time. So my question is, in your extensive experience, what is the right method/approach to this kind of task: 1) Get started immediately (MVP), things will break, tune it along the way. 2) Do some planning and research first. I'd appreciate any references to 'software engineering' or other industries/ Thanks

8 8

Re: Sunday night social?
by Matt Ryanczak 13 Jun '16

13 Jun '16

Remember that social != sociable! ~Matt On Jun 12, 2016 15:22, "Todd Underwood" <toddunder(a)gmail.com> wrote: huh. today we learn that social is subject to particular people's view of social. please author an RFC to explain the scope that counts as social. thanks! t On Sun, Jun 12, 2016 at 6:18 PM, Randy Bush <randy(a)psg.com> wrote: > This may surprise some, but social != frat boys. > > randy, on a phone > >> On Jun 12, 2016, at 15:08, Todd Underwood <toddunder(a)gmail.com> wrote: >> >> surely this is not the same randy bush that loves to point out that >> humans are social animals! >> >> t >> >> On Sun, Jun 12, 2016 at 2:31 PM, Randy Bush <randy(a)psg.com> wrote: >>>>> Is Wednesday night the only social? >>>> Yes. >>> >>> damn! if i had known there was a chance of folk acting more like sober >>> adults than the usual frat boys i might have scheduled chicago. >>> >>> randy

1 0

Fwd: Sunday night social?
by Matthew Petach 12 Jun '16

12 Jun '16

> I just finished registering for NANOG 67, and answered Yes to "Will you be attending the sunday evening social" and booked my flight accordingly...but now i can't seem to find any details on what time it starts on the website. Does anyone know what time it starts? > > Thanks! > > Matt > >

6 8

phish platform ?
by Julien T 12 Jun '16

12 Jun '16

Hello, I'm reviewing the process how to manage phish report at a customer and am looking for tools ideally opensource. Recently, OVH released https://github.com/ovh/cerberus-ux and maybe AbuseHelper can do http://abusehelper.be/ I also checked APWG but didn't find reference to such a tool. Quick constraints: multiple types of input+garbage, metrics, API, SIEM integration Any advices of a public tool? or mostly in-house dev? Thanks a lot. Cheers, Jul

1 0

Netflix VPN detection - actual engineer needed
by Matthew Kaufman 12 Jun '16

12 Jun '16

Every device in my house is blocked from Netflix this evening due to their new "VPN blocker". My house is on my own IP space, and the outside of the NAT that the family devices are on is 198.202.199.254, announced by AS 11994. A simple ping from Netflix HQ in Los Gatos to my house should show that I'm no farther away than Santa Cruz, CA as microwaves fly. Unfortunately, when one calls Netflix support to talk about this, the only response is to say "call your ISP and have them turn off the VPN software they've added to your account". And they absolutely refuse to escalate. Even if you tell them that you are essentially your own ISP. So... where's the Netflix network engineer on the list who all of us can send these issues to directly? Matthew Kaufman

31 70

Detecting Attacks
by subashini hariharan 12 Jun '16

12 Jun '16

Hello, I am Subashini, a graduate student. I am interested in doing my project in Network Security. I have a doubt related to it. The aim is to detect DoS/DDoS attacks using the application. I am going to use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log Analytics). My doubt is regarding how do we generate logs for detecting this attack? As I am new to this process, I am not sure about it. Also, if it is possible to do any other attacks similar to this, you can please give a hint about it. Could anyone please help with this, it would be a great help!! -- Thank You. With Regards, H.Subashini

5 4

Detecting Attacks
by subashini hariharan 12 Jun '16

12 Jun '16

Hello, I am Subashini, a graduate student. I am interested in doing my project in Network Security. I have a doubt related to it. The aim is to detect DoS/DDoS attacks using the application. I am going to use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log Analytics). My doubt is regarding how do we generate logs for detecting this attack? As I am new to this process, I am not sure about it. Also, if it is possible to do any other attacks similar to this, you can please give a hint about it. Could anyone please help with this, it would be a great help!! -- Thank You. With Regards, H.Subashini

2 1

intra-AS messaging for route leak prevention
by Sriram, Kotikalapudi (Fed) 12 Jun '16

12 Jun '16

I am a co-author on a route-leak detection/mitigation/prevention draft in the IDR WG in the IETF: https://tools.ietf.org/html/draft-ietf-idr-route-leak-detection-mitigation-… Based on private conversations with a few major ISPs, the following common practice for intra-AS messaging (using Community tagging in iBGP) for prevention of route leaks is described in Section 3.2 of the draft: <begin quote> “Routes are tagged on ingress to an AS with communities for origin, including the type of eBGP peer it was learned from (customer, transit-provider or peer), geographic location, etc. The community attributes are carried across the AS with the routes. Routes that the AS originates directly are tagged with similar origin communities when they are redistributed into BGP from static, IGP, etc. These communities are used along with additional logic in route policies to determine which routes are to be announced to which eBGP peers and which are to be dropped. Route policy is applied to eBGP sessions based on what set of routes they should receive (transit, full routes, internal-only, default-only, etc.). In this process, the ISP's AS also ensures that routes learned from a transit-provider or a lateral peer (i.e. non-transit) at an ingress router are not leaked at an egress router to another transit-provider or peer. Additionally, in many cases, ISP network operators' outbound policies require explicit matches for expected communities before passing routes. This helps ensure that that if an update has made it into the routing table (i.e. RIB) but has missed its ingress community tagging (due to a missing/misapplied ingress policy), it will not be inadvertently leaked.” <end quote> Question: Are there other means of conveying this information in common use today (i.e. for prevention of route leaks)? Also, the following publicly available references can be possibly cited in support of the above: https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf http://showipbgp.com/bgp-tools/bgp-community-list/91-level3-as3356.html Pointers to any other relevant references would be very welcome as well. Thank you. Sriram

8 20