- NANOG - lists.nanog.org

Re: Did your BGP crash today?
by Nick Olsen 27 Aug '10

27 Aug '10

Well played, Sir. Nick Olsen Network Operations (321) 205-1100 x106 ---------------------------------------- From: Valdis.Kletnieks(a)vt.edu Sent: Friday, August 27, 2010 1:32 PM To: "Kasper Adel" <karim.adel(a)gmail.com> Subject: Re: Did your BGP crash today? On Fri, 27 Aug 2010 19:27:06 +0200, Kasper Adel said: > Havent seen a thread on this one so thought i'd start one. > > Ripe tested a new attribute that crashed the internet, is that true? If it in fact "crashed the internet", as opposed to "gave a few buggy routers here and there indigestion", you wouldn't be posting to NANOG looking for confirmation. :)

1 0

Fwd: Re: [oss-security] CVE Request -- Quagga (bgpd) [two ids] -- 1, Stack buffer overflow by processing crafted Refresh-Route msgs 2, NULL ptr deref by parsing certain AS paths by BGP update request
by Niko Thome 27 Aug '10

27 Aug '10

for those who missed it... kind regards, niko -------- Original Message -------- Subject: Re: [oss-security] CVE Request -- Quagga (bgpd) [two ids] -- 1, Stack buffer overflow by processing crafted Refresh-Route msgs 2, NULL ptr deref by parsing certain AS paths by BGP update request Date: Wed, 25 Aug 2010 10:21:59 -0400 From: Josh Bressers <bressers(a)redhat.com> Reply-To: oss-security(a)lists.openwall.com To: oss-security(a)lists.openwall.com CC: CERT-FI Vulnerability Co-ordination <vulncoord(a)ficora.fi>, Chris Hall <chris.hall(a)highwayman.com>, Denis Ovsienko <infrastation(a)yandex.ru>, "Steven M. Christey" <coley(a)linus.mitre.org> ----- "Jan Lieskovsky" <jlieskov(a)redhat.com> wrote: > Hi Steve, vendors, > > Quagga upstream has released latest vQuagga 0.99.17 version, > addressing two security flaws: > > A, Stack buffer overflow by processing certain Route-Refresh messages > > A stack buffer overflow flaw was found in the way Quagga's bgpd daemon > processed Route-Refresh messages. A configured Border Gateway Protocol > (BGP) peer could send a Route-Refresh message with specially-crafted > Outbound Route Filtering (ORF) record, which would cause the master > BGP daemon (bgpd) to crash or, possibly, execute arbitrary code with > the privileges of the user running bgpd. > > Upstream changeset: > [1] > http://code.quagga.net/?p=quagga.git;a=commit;h=d64379e8f3c0636df53ed08d5b2… > > References: > [2] https://bugzilla.redhat.com/show_bug.cgi?id=626783 > [3] http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100 Use CVE-2010-2948 for this one. > > B, DoS (crash) while processing certain BGP update AS path messages > > A NULL pointer dereference flaw was found in the way Quagga's bgpd > daemon parsed paths of autonomous systems (AS). A configured BGP peer > could send a BGP update AS path request with unknown AS type, which > could lead to denial of service (bgpd daemon crash). > > Upstream changeset: > [4] > http://code.quagga.net/?p=quagga.git;a=commit;h=cddb8112b80fa9867156c637d63… > > References: > [5] https://bugzilla.redhat.com/show_bug.cgi?id=626795 > [6] http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100 > Use CVE-2010-2949 for this one. Thanks. -- JB

1 0

Re: PacketShader
by nanogf . 27 Aug '10

27 Aug '10

--- Joel Jaeggli wrote: > What it really comes down to is packets per watt or packets per > dollar, if it's cheaper to do it this way then people will, if not > BFD. http://docs.google.com/viewer?url=http://ic.ese.upenn.edu/pdf/spice_fpl2009… Performance Comparison of Single-Precision SPICE Model-Evaluation on FPGA, GPU, Cell, and multi-core Processors _____________________________________________________________ Get your own *free* email address like this one from www.OwnEmail.com

1 0

IP characteristics for 3G and WiFi links
by Daniel Migault 26 Aug '10

26 Aug '10

Hi, We are testing protocols on our lab platform and we would like to simulate communication 2 types of communication : - From terminals to service platform using a 3G (HSPA / HSPA+) Access connection - From terminal to service platform using a WiFi Access connection We are using dummyNet to simulate the links so we are interested in IP characteristics layers for Packet loss Rate, bandwidth and latency. Values depends on multiple factors, but we would like to know what mean values are considered when services are deployed. Currently we are considering the following values. Packet Lost Rate for L2 seems 7% for Wifi and 5% for 3G. We are wondering how L3 is affected? Parameter | Wifi (802.11a/g) | 3G (HSDPA) Latency 100 ms 60 ms Bandwidth 5 Mbps 3 Mbps Packet Lost Rate XXX XXX Any comment links will be appreciated. Regards, Daniel -- Daniel Migault Orange Labs / Security Lab +33 (0) 1 45 29 60 52 +33 (0) 6 70 72 69 58

6 6

Enterprise Edge firewalls
by Lasse Birnbaum Jensen 26 Aug '10

26 Aug '10

Hi all We currently run Juniper NetScreen 5200 firewall and are looking for replacements, since these are doomed by Juniper and they are ready to be replaced. Their replacement is the SRX series, but since we need buy some replacements we feel that the rest of the market is worth looking at. Could any of you out there share experiences with other brand, specific models. Our setup will be implemented as described in the Cisco SAFE reference guide, with dedicated border routers and firewall behind those. The functional requirements we have is filtering and nat, ids/ips is a nice-to-have built-in feature. Stability and performance are off course also a demand. We currently have 10G ethernet both as peerings and core network. Contact me off the list if you want to remain anonymous. Thanks in advance Best regards Lasse Birnbaum Jensen Network Administrator University of Southern Denmark Denmark Email: lasse(a)sdu.dk Phone: +45 6550 2873

1 0

Should routers send redirects by default?
by Christopher Morrow 26 Aug '10

26 Aug '10

Polling a little bit here, there's an active discussion going on 6man@ietf about whether or not v6 routers should: o be required to implement ip redirect functions (icmpv6 redirect) o be sending these by default Essentially 12+ years ago in RFC2461 (http://www.ietf.org/rfc/rfc2461.txt) and later in RFC4861 (http://tools.ietf.org/html/rfc4861) there are a set of message types defined and use cases discussed which seem to lead to the idea that: routers should be reqiured to implement redirect logic/functionality routers should by default be enabled to send these redirect messages. In ipv4 there's a relatively widely used practice of disabling ip redirects. secure router and secure host templates disable this functionality, and have for quite some time. There are a host of reasons for this I don't really want to debate them though :) It would be instructive to get a sense of how many folks do NOT disable this sort of thing, or how many folks RELY on these functions working in their network build today. For the 6man discussion though, I presume that in ipv4 we take a set of configs/actions because of somewhat sane reasons, I suspect we would want to have the same config/end-state in v6? One proposal is to do this with: o routers are required to be able to send redirect messages o routers should NOT do this by default With the proviso that some consenting adults may choose to enable by default on certain platforms (cabl/dsl CPE, enterprise-LAN)... if that muddies the waters it'd be nice to just hear about the proposal there and leave the hinkiness of the rest out of the picture :) I hope that folks who currently run v6 network(s) might respond, there are quite a few v6 operators here... I'm looking at you owen/jjb/au-dsl-folk... :) thanks for your time, of couse if you want to chat more directly about this the 6man list is open and at: <http://www.ietf.org/mail-archive/web/ipv6/current/maillist.html> -Chris

21 55

how damp are your routes
by Randy Bush 25 Aug '10

25 Aug '10

a little contest here. what is the largest or most complex (measured in the number of parms) route flap damping confuration in actual use? send yours to me privately, and i will announce the winner in a few days (with their consent), and maybe show the config (with their consent). thanks for playing. and please, let's not get into the [de]merits of using rfd, how you should configure it, etc. this is research, and it is really about rfd parameter config complexity. randy

1 0

[NANOG-announce] PC Nominations are open!
by David Meyer 25 Aug '10

25 Aug '10

Folks, Its time to nominate those folks who you think will help the NANOG program committee continue to deliver great content to the NANOG community. Eligibility is outlined at http://nanog.org/governance/elections/2010elections. Please nominate those folks who you think can add perspective and energy to the PC, and remember that you can self-nominate. Thanks, Dave _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

aol postmaster?
by Matt Kelly 25 Aug '10

25 Aug '10

If there is an AOL postmaster contact available, can you please contact me off list? Thanks. -- Matt

2 1

end-user ipv6 deployment and concerns about privacy
by Hannes Frederic Sowa 24 Aug '10

24 Aug '10

Hello! As the first IPv6 deployments for end-users are in the planning stage in Germany, I realized I have not found any BCP for handling addressing in those scenarios. IPv6 will make it a lot easier for static address deployments but I wonder weather this is in the best sense for the customers. As I normally come from the technical side I prefer static addressing. But in the world of facebook and co. I wonder if it would be a better to let the user have the choice. A major provider of dsl here in Germany recently blogged about this [1]. Their proposal is to serve two subnets, one being a static one while the other one will be dynamically allocated. I have no clue how the user would switch between these subnets (without using some kind of command line tools). This is not about using privacy extensions as the subnet is sufficient for identification. Did you reach any conclusion on this matter? Thanks, Hannes [1] http://translate.google.com/translate?js=y&prev=_t&hl=en&ie=UTF-8&layout=1&…

10 25