- NANOG - lists.nanog.org

Test email
by hank＠interall.co.il 22 Jun '22

22 Jun '22

Hello, Checking Email Functionality. Hosting Support Thank you,

7 6

Re: Scanning the Internet for Vulnerabilities
by J. Hellenthal 22 Jun '22

22 Jun '22

To what extent and to whom will you authorize to do that? 100 random college students? X number of new security firms? At some point it will break. -- J. Hellenthal The fact that there's a highway to Hell but only a stairway to Heaven says a lot about anticipated traffic volume. > On Jun 20, 2022, at 17:04, bzs(a)theworld.com wrote: > > > It seems to me there's vulnerability testing and there's vulnerability > testing and just lumping them all together motivates disparate > opinions. > > For example it's one thing to perhaps see if home routers > login/passwords are admin/admin or similar, or if systems seem to be > vuln to easily exploitable bugs and reporting such problems to someone > in charge versus, say, hammering at some network to see when/if DDoS > mitigation kicks in. > > For example I've gotten email in the past that some of my servers were > running ntp in a way which makes them vuln to being used for DDoS > amplification and, I believe, fixed that. I didn't mind. > > Anyhow, you all probably get my point without further hypotheticals or > examples. > > Scanning for known vulns and reporting can be ok, testing to > destruction? Not so much. > > -- > -Barry Shein > > Software Tool & Die | bzs(a)TheWorld.com | http://www.TheWorld.com > Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD > The World: Since 1989 | A Public Information Utility | *oo*

3 2

(no subject)
by Glenn Kelley 21 Jun '22

21 Jun '22

Good Monday Morning Everyone. Quick Question: What is everyone's favorite software for running a looking glass. A friend asked me this over the weekend - and while there are others available on the internet to use - it would be helpful for them to run one within their own network. It has been a while since i have played setting one up so figured might as well ask *Glenn S. Kelley, *Connectivity.Engineer Text and Voice Direct: 740-206-9624

7 7

cf is down?
by Dmitry Sherman 21 Jun '22

21 Jun '22

Dmitry Sherman Interhost Networks T: +972.74.702.9881 M: +972.54.318.1182 E: dmitry(a)interhost.net<mailto:dmitry@interhost.net> W: interhost.co.il<https://www.interhost.co.il/> [Logo]<https://www.interhost.co.il/>

6 7

Re: Scanning the Internet for Vulnerabilities
by Mel Beckman 21 Jun '22

21 Jun '22

Carsten, No, it’s more like 50,000 furnace guys who show up several times a day to rattle doorknobs, attempt to push slim Jim’s into window latches, hack your garage door opener, sneak into your back garden, and fly drones around your home to see what valuables you might have. Yes, some of them are altruistic, but some are self-righteous officious boobs, and the vast majority are career criminals that will rob your house, drain your retirement account, and kill your family with a spoofed SWAT raid. -mel beckman > On Jun 20, 2022, at 4:20 AM, Carsten Bormann <cabo(a)tzi.org> wrote: > On 2022-06-20, at 04:18, Mel Beckman <mel(a)beckman.org> wrote: >> >> When researchers, or whoever, claim their scanning an altruistic service, I ask them if they would mind someone coming to their home and trying to open all the doors and windows every night. > > Well, it is more like the guy who comes once a year and checks that your central heating is not going to blow up. > > (Disclaimer: I have supervised students who designed and executed benign mass-scans of the IPv4 Internet in order to validate hypotheses about market penetration of certain security updates, and I definitely would do that again if there is a good reason to perform such a scan.) > > Grüße, Carsten

9 10

Re: Scanning the Internet for Vulnerabilities
by J. Hellenthal 20 Jun '22

20 Jun '22

Yeah that's another thing, "research" cause you need to learn it let's have them do it too, multiply that by every university \o/ -- J. Hellenthal The fact that there's a highway to Hell but only a stairway to Heaven says a lot about anticipated traffic volume. > On Jun 20, 2022, at 06:22, Carsten Bormann <cabo(a)tzi.org> wrote: > > On 2022-06-20, at 04:18, Mel Beckman <mel(a)beckman.org> wrote: >> >> When researchers, or whoever, claim their scanning an altruistic service, I ask them if they would mind someone coming to their home and trying to open all the doors and windows every night. > > Well, it is more like the guy who comes once a year and checks that your central heating is not going to blow up. > > (Disclaimer: I have supervised students who designed and executed benign mass-scans of the IPv4 Internet in order to validate hypotheses about market penetration of certain security updates, and I definitely would do that again if there is a good reason to perform such a scan.) > > Grüße, Carsten >

5 6

Fwd: Congrats to AS701
by Christopher Morrow 20 Jun '22

20 Jun '22

Looks like FIOS customers may be getting ipv6 deployed toward them, finally: ifconfig snippet from local machine: inet6 2600:4040:2001:2200:73d2:6bcc:1e6b:43a1 prefixlen 64 scopeid 0x0<global> inet6 2600:4040:2001:2200:e87:bf36:b6cb:6ce1 prefixlen 64 scopeid 0x0<global> ping attempt: 64 bytes from bh-in-f106.1e100.net (2607:f8b0:4004:c09::6a): icmp_seq=1 ttl=59 time=8.71 ms 8ms from mclean, va to ashburn, va isn't wondrous, but at least it's ipv6 (and marginally faster than ipv4) Congrats to the 701 folk for deploying more widely! (note: I don't know exactly when this started, nor how wide it really is, but progress here is welcomed by myself at least :) ) -chris

3 2

Dell Enterprise OS10 'aaa authorization'
by Drew Weaver 20 Jun '22

20 Jun '22

Hello, Happy holiday. I am sure that I will eventually figure this out on my own but if anyone has already gone through the effort to figure it out I would appreciate any notes you can give me. I am using tac_plus to AAA against a S5248F-ON running Dell OS10E 10.5.0.1P1 I noticed that when configuring this switch I see: 5248(config)# aaa accounting Configure AAA accounting authentication To configure AAA Authentication There doesn't appear to be any understanding of the authorization mechanism (you know, to control which commands users can run once they connect to the device). Does anyone off-hand know how you configure the authorization mechanism in OS10E? If for whatever reason this is impossible, how did you create a user that can *only* do what is required by RANCID to back up the configuration on these devices? Thanks, -Drew

1 0

irrd or ...?
by Randy Bush 20 Jun '22

20 Jun '22

i have been running irrd for some years. am about to dump that (virtual) server and move from freebsd to bullseye. is there anything more modern, and _simpler_, than irrd at which i should take a look? randy

5 9

Serious Juniper Hardware EoL Announcements
by Mark Tinka 18 Jun '22

18 Jun '22

So Juniper have gone ahead and announced the EoL of some key devices that, IMHO, are nowhere near past their prime: - MX204 (to be replaced by the MX304) - MX10003 (to be replaced by the MX304) - PTX1000 (to be replaced by the PTX10001) Re: the PTX1000, I know it is a component issue that Juniper have mentioned is the reason for EoL'ing this. We bought a fair bit in the past 2 years, and technically, there is nothing wrong with them. We are going ahead with the PTX10001 as a replacement, because it works technically and otherwise. Having both the MX10003 and MX304 in the same portfolio did not make any sense to me, and I did challenge Juniper on this over the past several weeks as to what their strategy for both platforms is. I guess we now have an answer :-\. Pity - we started buying the MX10003 last year, but I have no problem with the MX304 as long as the price continues to work. The MX204 is pure shocker! Unless the MX304 will come with a license-based approach to run at MX204 pricing, that is Juniper shooting themselves in the foot. This chip shortage issue is, I think, being used as a crutch to take the p*ss. Mark.

14 20