- NANOG - lists.nanog.org

incoming smtp from v6 addresses
by Randy Bush 06 Jan '12

06 Jan '12

for incoming mail that is *accepted*, i.e. not stuff like 2012-01-04 00:37:28 REJECT because 118.39.80.118 listed in rbl-plus.mail-abuse.org 2012-01-04 00:37:28 H=(nexo.es) [118.39.80.118] F=<pedrom(a)nexo.es> rejected RCPT <owner-radiusext(a)ops.ietf.org>: blocked because 118.39.80.118 is in blacklist at rbl-plus.mail-abuse.org: Mail from 118.39.80.118 blocked using Trend Micro Email Reputation database. Please see <http://www.mail-abuse.com/cgi-bin/lookup?118.39.80.118> 2012-01-04 00:37:28 no host name found for IP address 118.39.80.118 2012-01-04 00:37:29 REJECT 118.39.80.118 too many bad recip 2012-01-04 00:37:29 REJECT because 118.39.80.118 listed in rbl-plus.mail-abuse.org 7.8% is over ipv6 transport but only 2% of outgoing deliveries are over ipv6. what do other folk see? randy

12 13

Router Assessment Tool
by Green, Timothy 06 Jan '12

06 Jan '12

Happy New Year All!!! I'm trying to perform STIG compliancy on various Cisco equipment. Has anybody used the Router Assessment Tool (RAT) for routers and switches? Any cheap (free) recommendations? As a last ditch effort I could use NMAP. Thanks, Tim

3 2

looking for traffic sources aimed at 192.153.154.124
by Alan Clegg 06 Jan '12

06 Jan '12

If anyone has some spare cycles and wants to help disrupt a DDoS, if you can look for traffic sourced within your network, destination 192.153.154.124 port 80, I'd appreciate it. I've been under attack for about the last 12 hours. Other pointers to resources to trace the miscreants responsible would also be appreciated. Thanks, AlanC -- alan(a)clegg.com | aclegg(a)infoblox.com 1.919.355.8851

2 1

Re: SSL Certificates
by graham＠g-rock.net 06 Jan '12

06 Jan '12

We use rapidssl. Seems to be ok across the board. No reports otherwise. Sent from my HTC on the Now Network from Sprint! ----- Reply message ----- From: "Michael Carey" <mcarey(a)kinber.org> Date: Fri, Jan 6, 2012 8:15 am Subject: SSL Certificates To: <nanog(a)nanog.org> Looking for a recommendation on who to buy affordable and reputable SSL certificates from? Symantec, Thawte, and Comodo are the names that come to mind, just wondering if there are others folks use. Thanks, -- Michael D. Carey KINBER Network Engineer mcarey(a)kinber.org M: 814.777.5027 GV: (814) 205-6773 <https://www.google.com/voice#phones> Skype: KINBER.Mike.Carey KINBER - Keystone Initiative for Network Based Education and Research - www.kinber.org PennREN - Pennsylvania's Research and Education Network

1 0

question regarding US requirements for journaling public email (possible legislation?)
by Eric J Esslinger 06 Jan '12

06 Jan '12

Hope yall had an 'eventless' holiday. (I.e. no pages at 2 am on a holiday morning). Sorry to drop what is possibly just someone misunderstanding something or pulling my leg on the list, but over the holidays I ran into one of my buddies that is also a network admin type and he was griping about mail journalling, which I already do for our corporate email accounts. However, his discussion was in terms of all customer email... Which I said was probably a bad thing to do. His response was there is legislation being pushed in both House and Senate that would require journalling for 2 or 5 years, all mail passing through all of your mail servers. I've seen nothing, and my google fu has turned up nothing other than corporate requirements, so I ask here. Has anyone heard of such a bill working it's way through either side of congress? (I am speaking specifically of full email journaling, not just logs, which I do archive for significant amounts of time.) I also don't want to discuss the pros, cons, merits, costs, goods, or evils of such a requirement, just wanted to know if this is something I should be looking forward towards maybe needing to implement. Thanks for your attention and may you have a low incident new year. __________________________ Eric Esslinger Information Services Manager - Fayetteville Public Utilities http://www.fpu-tn.com/ (931)433-1522 ext 165 This message may contain confidential and/or proprietary information and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited.

8 11

anycast load balancing issue
by Måns Nilsson 06 Jan '12

06 Jan '12

Hi, I'm in the process of deploying an anycast DNS service internally. We're on a pretty provider-like network, where we run MPLS to provide several network overlays for different services. iBGP is used to distribute routing information, and ISIS is used as IGP. In one of the VRFen we would like to place name servers using a common IP address. To get speedy network updates when outages occur we'll be using OSPF on the name servers to inject the routes into the IGP. The P/E router then redistributes the route into the right VRF. (the name server OSPF process is not aware of MPLS; it just talks to a router.) So far so good. This works. Trouble is, we find that (untweaked) cost and metric are such that all nodes are equal. The last resort (peer router ID) gets invoked and all traffic goes to one single instance. Of course, when that instance falls off the net recalculation takes place and another node steps in, but I'd like true path lengths (IGP hop count) to influence more than iBGP (route-reflector-style) selection. Any clues? Oh, all-cisco, all ASR1000 series. All links GE. ~90 routers in IGP. -- Måns Nilsson primary/secondary/besserwisser/machina MN-1334-RIPE +46 705 989668 ... this must be what it's like to be a COLLEGE GRADUATE!!

4 5

"Non-vendor neutral" hosting/colocation
by Christopher J. Pilkington 06 Jan '12

06 Jan '12

We are experiencing an issue in NYCMNY where the hosting facility's owner, a large IXC and CLEC, is being less than cooperative in allowing the ILEC delivering a private circuit to the hosting facility. They will allow ILEC to deliver the circuit elsewhere in the building, but will not provide us a cross connect to this facility. Hosting provider will however gladly use their own CLEC to provide us the service and provide cross connect to same. I have no details on whether this is contractually permitted or not. Another circuit from a third IXC/CLEC ran into a similar problem. This carrier "resolved it" by using the hosting company's CLEC for local loop, even though third carrier has lit facilities elsewhere in said facility. We have concerns for future issues involving the merger of a previous vendor-neutral hosting facility company and another telco provider. Any experiences or advice, on or off list, would be helpful. Also, comments from regulatory geeks would be interesting as well. -cjp

3 2

Trouble accessing www.nanog.org
by Ronald Bonica 05 Jan '12

05 Jan '12

Is anyone else having trouble accessing www.nanog.org. I can ping the site but don't get any response from HTTP requests. -------------------------- Ron Bonica vcard: www.bonica.org/ron/ronbonica.vcf

13 17

AD and enforced password policies
by Jones, Barry 05 Jan '12

05 Jan '12

Hello all. Happy New Year. I have a requirement to enforce password policies on AD (a tacacs and windows domain). I don't have a great deal of Windows AD knowledge - so a newbie ;-) this is a little off topic, but I thought I'd ask... Specifically, I need to enforce the use of length, special characters, and be able to validate the enforcement of such. Looking at Nfront, Quest, etc..., and wanted to see if anyone out there had thoughts? Thank you.

15 24

Comcast Postmaster...
by Matt Kelly 05 Jan '12

05 Jan '12

Would a comcast postmaster be so kind as to contact me off list? Thanks. -- Matt

1 0