May 2018 - NANOG - lists.nanog.org

Re: SD-WAN Solutions
by Scott Weeks 24 May '18

24 May '18

--- sabina(a)auxes.is wrote: From: "Sabina M." <sabina(a)auxes.is> Additionally, is anyone familiar with what RFC Alcatel/Nokia is implementing for the VXLAN part of the solution? It looks a bit non-standard but I can't find any clear documentation regarding this anywhere ------------------------------------------- You might try over on alcatel-nsp(a)puck.nether.net. Alcatel folks used to (still do?) hang out over there to answer questions. scott

2 1

BGP Battleships
by Scott Weeks 24 May '18

24 May '18

I saw the below on SWINOG and thought it might add some fun in the middle of all this General Data Protection Regulation conversation. :) scott --- Begin forwarded message: From: Gregor Riepl <onitake(a)gmail.com> To: swinog(a)lists.swinog.ch Subject: [swinog] BGP Battleships Date: Tue, 22 May 2018 23:18:51 +0200 Some good ol' fun with BGP: https://blog.benjojo.co.uk/post/bgp-battleships Please (don't?) try this at home!

3 2

SD-WAN Solutions
by Sabina M. 24 May '18

24 May '18

Has anyone worked with Nuage from around here? Additionally, is anyone familiar with what RFC Alcatel/Nokia is implementing for the VXLAN part of the solution? It looks a bit non-standard but I can't find any clear documentation regarding this anywhere Cheers, S.

1 0

VPN Filter: botnet of routers
by Scott Weeks 24 May '18

24 May '18

Kaboom! https://www.thedailybeast.com/exclusive-fbi-seizes-control-of-russian-botnet "FBI agents armed with a court order have seized control of a key server in the Kremlin’s global botnet of 500,000 hacked routers..." "The FBI counter-operation goes after “VPN Filter,” a piece of sophisticated malware linked to the same Russian hacking group, known as Fancy Bear, that breached the Democratic National Committee and the Hillary Clinton campaign during the 2016 election." https://blog.talosintelligence.com/2018/05/VPNFilter.html "The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues. The behavior of this malware on networking equipment is particularly concerning, as components of the VPNFilter malware allows for theft of website credentials and monitoring of Modbus SCADA protocols." scott

1 0

Re: Whois vs GDPR, latest news
by Owen DeLong 23 May '18

23 May '18

How is it false? If you don’t do business in the EU or with EU persons, then you are not included in the class of organizations which GDPR says are subject to GDPR. Owen > On May 23, 2018, at 4:36 PM, K. Scott Helms <kscott.helms(a)gmail.com> wrote: > > Owen, > > That's false, please don't spread misinformation. > > Scott Helms > > On Wed, May 23, 2018, 7:34 PM Owen DeLong <owen(a)delong.com <mailto:owen@delong.com>> wrote: > > > > On May 23, 2018, at 9:29 AM, Anne P. Mitchell Esq. <amitchell(a)isipp.com <mailto:amitchell@isipp.com>> wrote: > > > > > > > >> On May 23, 2018, at 10:21 AM, Daniel Brisson <dbrisson(a)uvm.edu <mailto:dbrisson@uvm.edu>> wrote: > >> > >>> Also, don't forget the private right of action. Anyone can file anything in the U.S. courts... you may get it dismissed (although then again you may not) but either way, it's going to be time and money out of your pocket fighting it. MUCH better to just get compliant than to end up a test case. > >> > >> Isn't "better" a factor of how much it costs to become compliant with GPDR? I'm no expert, but some of the things I've heard sounded not trivial to implement (read potentially BIG investment). > >> > >> -dan > > > > In our experience, orgs that are already following all industry best practices are, generally, at least 70% of the way to becoming compliant already. Where it can get expensive for the ones who aren't is in hardening their systems to provide for better security/privacy. U.S. companies are used to being able to drink at the firehose of data that is collected here in the U.S., and use it however they want.. this is the real major change. I suppose you could say it's expensive in that it is reducing the ways they can monetize that data. > > Of course a perfectly valid alternative is to refuse to do business with EU persons. Then GDPR compliance becomes entirely unnecessary. > > Owen > > > > > Anne > > > > Anne P. Mitchell, > > Attorney at Law > > CEO/President, > > SuretyMail Email Reputation Certification and Inbox Delivery Assistance > > GDPR Compliance Consultant > > GDPR Compliance Certification > > http://www.SuretyMail.com/ <http://www.suretymail.com/> > > http://www.SuretyMail.eu/ <http://www.suretymail.eu/> > > > > Attorney at Law / Legislative Consultant > > Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law) > > Author: The Email Deliverability Handbook > > Legal Counsel: The CyberGreen Institute > > Legal Counsel: The Earth Law Center > > Member, California Bar Cyberspace Law Committee > > Member, Colorado Cybersecurity Consortium > > Member, Board of Directors, Asilomar Microcomputer Workshop > > Member, Advisory Board, Cause for Awareness > > Member, Elevations Credit Union Member Council > > Former Chair, Asilomar Microcomputer Workshop > > Ret. Professor of Law, Lincoln Law School of San Jose > > > > Available for consultations by special arrangement. > > amitchell(a)isipp.com <mailto:amitchell@isipp.com> | @AnnePMitchell > > Facebook/AnnePMitchell | LinkedIn/in/annemitchell > > >

1 0

Geolocation issue with a twist
by Clay Stewart 23 May '18

23 May '18

Can someone point me for help with the following issue? I purchased a /24 late last year on auction which was originally owned by Cox communications in Europe. It had Geolocation in a lot of bad places, and Cox got it 'cleared' up for me. But there is still one issue, an ISP in Spain has it in a Geo database which is pointed to my correct location, but because it is a Spain ISP, the block has lots of issues in block apps and redirects to spam sites. Attach is a snapshot with the incorrect ISP highlight and Geo database. I cannot get any info from the Geo database. I am new to this list, so I hope this is an appropriate question.

4 6

Curiosity about AS3356 L3/CenturyLink network resiliency (in general)
by David Hubbard 23 May '18

23 May '18

I’m curious if anyone who’s used 3356 for transit has found shortcomings in how their peering and redundancy is configured, or what a normal expectation to have is. The Tampa Bay market has been completely down for 3356 IP services twice so far this year, each for what I’d consider an unacceptable period of time (many hours). I’m learning that the entire market is served by just two fiber routes, through cities hundreds of miles away in either direction. So, basically two fiber cuts, potentially 1000+ miles apart, takes the entire region down. The most recent occurrence was a week or so ago when a Miami-area cut and an Orange, Texas cut (1287 driving miles apart) took IP services down for hours. It did not take point to point circuits to out of market locations down, so that suggests they even have the ability to be more redundant and simply choose not to. I feel like it’s not unreasonable to expect more redundancy, or a much smaller attack surface given a disgruntled lineman who knows the routes could take an entire region down with a planned cut four states apart. Maybe other regions are better designed? Or are my expectations unreasonable? I carry three peers in that market, so it hasn’t been outage-causing, but I use 3356 in other markets too, and have plans for more, but it makes me wonder if I just haven't had the pleasure of similar outages elsewhere yet and I should factor that expectation into the design. It creates a problem for me in one location where I can only get them and Cogent, since Cogent can't be relied on for IPv6 service, which I need. Thanks

16 26

Re: Whois vs GDPR, latest news
by Roger Marquis 23 May '18

23 May '18

Dan Hollis wrote: > How about the ones with broken contact data - deliberately or not? > A whois blacklist sounds good to me. DNS WBL? Many sites are already doing this locally. It's just a matter of time before Spamhaus or an up-and-coming entity has an RBL for it. The data is perhaps not precise enough for a blacklist but obfuscated whois records are certainly useful in calculating the reputation of ingress/egress SMTP, HTTP and other services. This is not a new idea and similar to the (unmaintained?) whois.abuse.net contact lookup service, razor/pyzor, and other useful SIEM and Spamassassin inputs. Roger Marquis

1 0

IX's and DC's in Denver
by Emily Scarlett 23 May '18

23 May '18

Hey all, We're currently looking at expanding our presence in H5 in Denver, one question on our mind is what our options are for IX connectivity around the area, and if anyone has any experience dealing with them. Any info is useful, thanks! -- ~ Em

2 1

How to leak aggregate/generated routes into another VRF
by Joe Yabuki 23 May '18

23 May '18

Hey all, Is there a method of leaking aggregate/generated routes to other VRFs so that the next-hop is modified to actually point to table where the agg/gen routes where created ? One way to do this, is to create a Null0 route and redistribute it into the BGP VRF process, but I would like to know if there is another way to do this ? Many thanks, Joe

2 1