- NANOG - lists.nanog.org

L3 Contact
by Kenny Kant 02 Aug '13

02 Aug '13

Will an IP engineer from Level3 contact me off list. We having trouble routing traffic through.. Possible bogon update issue ? Thanks Sent from my iPhone

1 0

BGP related question
by Shah, Parthiv 01 Aug '13

01 Aug '13

My apology if I am asking for a repeat question on the list. On 7/29/13 I read an incident about accidental BGP broadcast see article here https://isc.sans.edu/diary/BGP+multiple+banking+addresses+hijacked/16249 or older 2008 incident http://www.renesys.com/2008/02/pakistan-hijacks-youtube-1/ My questions: 1) I would like to understand how can we detect and potentially prevent activities like this? I understand native BGP was not design to authenticate IP owners to the BGP broadcaster. Therefore, issues like this due to a human error would happen. How can activities like this be detected as this is clearly a threat if someone decides to broadcast IP networks of an organization and knock the real org. off the Net. 2) In reference to prevention, I recall there were discussions about secure BGP (S-BGP), Pretty Good BGP, or Secure Original BGP but I don't remember if any one of them was finalized (from practicality viewpoint) and if any one of them is implementable/enforceable by ISPs (do anyone have any insight)? 3) If I was to ask for an opinion, from your viewpoint which one is better and why and which one is not doable and why not? Thank you in advance, Parthiv This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and notify us immediately.

4 3

[NANOG-announce] NANOG on The Road
by Betty Burke <betty＠nanog.org> 01 Aug '13

01 Aug '13

NANOGers, You are invited to attend NANOG's first one-day meeting, "NANOG on the Road"joint with ARIN on September 10, 2013 in Portland, OR. ARIN + NANOG on the Road Portland will provide an opportunity to network with colleagues, access to a day's worth of professional education and current Internet operations. Content will be provided by speakers from both ARIN and NANOG. ** ** Complete Event details are available on the NANOG website: ARIN + NANOG on the Road in Portland, Oregon<http://www.nanog.org/meetings/road1/home> **** will be held at the Courtyard by Marriott Portland Downtown/Convention Center. **** * * Registration is free but required, so make sure to register now<https://www.arin.net/participate/meetings/on-the-road/portland.html> ! Spend the morning getting up to speed on the history of the Regional Registry System, Internet Governance, and ARIN technical services. Find out the latest about Internet number resource management – including IPv4 transfers and IPv6 adoption, and current ARIN policy developments. Then spend some time networking with fellow attendees over lunch. **** ** ** Kick off the afternoon with tutorials from ARIN on RPKI, NANOG on DNSSEC, and additional NANOG educational content. NANOG will host a session on its role in the network operator community and ways to engage with and take part in its lively professional community of Internet engineers and architects. The day will conclude with an Open Microphone / Q&A session, followed by a networking Happy Hour where conversation can continue in a more relaxed setting. **** ** ** Attendees who complete a short survey about the event will be eligible to win one of two $100 Amazon gift cards. *Register today*<https://www.arin.net/participate/meetings/on-the-road/portland.html> !**** ** ** Please feel free to forward this invitation to friends and colleagues who may be interested in attending this ARIN + NANOG on the Road event. Contact us at nanog-support(a)nanog.org if you have any questions. **** ** ** Regards, **** ** ** ARIN + NANOG on the Road Team**** American Registry for Internet Numbers (ARIN) <https://www.arin.net/>**** North American Network Operators Group (NANOG) <http://www.nanog.org/> -- Betty Burke NANOG Executive Director 48377 Fremont Boulevard, Suite 117 Fremont, CA 94538 Tel: +1 510 492 4030 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Feds snooping and FCC 477 and FCC 499 forms and 214 licenses
by sam＠wwcandt.com 01 Aug '13

01 Aug '13

Good Morning Nanog List, I'm not normally the tinfoil hat type howerver I do want to know other operators opinions on the FCC 477, 499 and the 214 license requirements in light of the recent revealations. Do you think the info is actually for the stated purposes? I'm trying hard not to become a member of the tin foil club but it's getting hard each day. Thanks. Sam * Moderators please delete the copy of this I sent from sam(a)circlenet.us.

1 0

FCC 477 and FCC499 forms
by Sam Moats 01 Aug '13

01 Aug '13

Good Morning Nanog List, I'm not normally the tinfoil hat type howerver I do want to know other operators opinions on the FCC 477, 499 and the 214 license requirements in light of the recent revealations. Do you think the info is actually for the stated purposes? I'm trying hard not to become a member of the tin foil club but it's getting hard each day. Thanks. Sam

1 1

Re: ARIN WHOIS for leads
by Joel M Snyder 01 Aug '13

01 Aug '13

>What about the 2am phone calls from the guy, who did a >nslookup on a website, and then whois on the ip, >who is calling to say his porn site >is partially not working and he's pissed. No amount of changing contacts is going to solve this type of problem. We routinely get support calls, sometimes even in the emergency support line, from people who are pissed off at an ISP 2,000 miles away called "Opus" something-or-another-but-not-Opus-One. Apparently their dialup service is not so hot anymore and when it doesn't work, the one-step-down-from-AOL customer base they attract types "opus" into their browser and then calls whatever phone number comes to the top of whatever search engine their browser vendor chose for them. Changing the nature of WHOIS isn't going to keep the stupid from doing stupid things. However, it might make life harder for the not-stupid trying to solve real problems. Honestly, this seems to me like a non-problem. I liken it to the hypersensitivity of some people to spam, where if they get 1 message through their filters it's somehow a major crisis. Maybe our ACD, which requires the clue-challenged to be able to spell the first or last name of the person their calling, or perhaps read the extension number from a directory listing, screens the worst of the worst out from us... I also don't see the problem of cold calling when it's obviously for a service or product that I am interested in, just as I don't see the problem of cold snail-mailing for the same services. I'm in business, and I expect other businesses to try and market to me. I don't want to hear from window, insurance, and other crap sellers, but if a Cisco reseller or bandwidth seller wants to make contact and say "how can I help you?" that doesn't seem out of line to me. Only in the world of email do we (justifiably) get all weirded out by the prospect of unsolicited sales pitches. It seems to me that if you don't want people to call you, don't give out your phone number (or give out a phone number that makes it hard for anyone but a real person who really wants to talk to you to get to you). How did our little capitalist industry suddenly become a "you must have permission to contact me by any means no matter what" industry? jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

4 3

Hilton proxy issue
by Grant Ridder 31 Jul '13

31 Jul '13

Hi, Anyone from Hilton Hotels NOC or related on here? We are seeing their internet proxy doing weird things to http requests to servers at $DAYJOB. -Grant

3 6

Re: SNMP DDoS: the vulnerability you might not know you have
by Larry Sheldon 31 Jul '13

31 Jul '13

On 7/31/2013 4:29 PM, Blake Dunlap wrote: > It works better to fix the design issues than to play whack a mole > by blocking every imaginable service to your customers that responds > to the public with data larger than a FIN. Like getting their > providers to more proactively police their spew, manufactures to stop > making negligent devices, or implementing more intelligent filter > communication so the only option doesn't begin with calling your > provider and asking them over the phone to block X ip for you since > you're off the internet. > > Maybe even look into liability laws for allowing said attacks to > originate from your customers and not doing anything about it, or > being manufacturer of said devices that harm others through their > lack of due diligence implementing proper security. It's still way > more effective than trying to fix the *last instance* of the problem, > instead of it's reasons for enduring as an issue at a global scale. The first time I became a pariah on NANOG was for postulating precisely that view--that if the originators of problems would stop, we would not have to figure out how to clean up after them. But I am past that now and out of work. But it does occur to me for the first time that I can recall, that maybe the tremendous efforts to Get Control Of The Intertubes could be suckered into doing some good, say be establishing a certification authority to test and certify the safety of designs (is Scott B????? still around) and devise a way to not permit traffic from uncertified devices or configurations. But after years of research I will tell you that there is no way to stop an avalanche once it has been released at the source. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

Revealed: NSA program collects 'nearly everything a user does on the internet'
by Marsh Ray 31 Jul '13

31 Jul '13

Chris Boyd cboyd at gizmopartners.com Wed Jul 31 15:50:09 UTC 2013 > > I would guess that it's becasuse many VPN services still support PPTP which can be attacked as outlined here: > http://www.schneier.com/paper-pptpv2.html > > --Chris That link doesn't even mention the worst vulnerability in PPTP/MS-CHAPv2. Strangely, it's only in the PDF version http://www.schneier.com/paper-pptpv2.pdf at the bottom of page 6: > Note also that the MS-CHAP response generation algorithm is also a weak > link, even when passwords contain adequate entropy. It is clear that the NT > hash can be recovered with just two DES exhaustive keysearches (about 256 > trial DES decryptions on average) In other words, PPTP/MS-CHAPv2 is equivalent to encrypting your password with *single DES* and sending it over the untrusted network. It doesn't matter how strong your plaintext password is. Not only can the passive eavesdropper decrypt your VPN-tunneled data, he can obtain the NT hash which is a password-equivalent credential allowing him to impersonate the user to log into any other network services. Moxie Marlinspike and David Hulton described the exploit for it at Defcon 20 last summer: Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2 http://www.youtube.com/watch?v=vWXP3DvH8OQ Moxie's Cloudcracker online service will decrypt your PPTP packet captures using an FPGA cluster from Pico Computing. Last I heard, the price was a flat fee of $200, although it sometimes goes on sale. http://www.h-online.com/security/features/A-death-blow-for-PPTP-1716768.html http://h-online.com/-1716768 So it's not just the NSA, it's any passive observer with a budget of $200 for a one-off or ~$10K for their own hardware capability. PPTP is old and busted, don't let your friends use it! If you've ever used it, change your password. IMHO, if there's any other protocol more deserving of the "internet kill switch" I don't know what it is. - Marsh (sorry for not threading properly, I just subscribed to reply)

1 0

GTT/Inteliquent/nLayer
by Tim Durack 31 Jul '13

31 Jul '13

Any experience/comments on the GTT Global eXpress service? Looks interesting but odd. Why would I use a virtual IXP? Who participates? Comments on-list or off-list are fine. -- Tim:>

2 1