- NANOG - lists.nanog.org

12/8 problems?
by Drew Linsalata 12 Sep '05

12 Sep '05

Apologies for a post of an operational nature, but is anyone else seeing problems with AT&Ts 12/8 block? From a New York router connected to Global Crossing and Peer 1: border-1.nycmny> sh ip bgp 12.xxx.xxx.xxx BGP routing table entry for 12.0.0.0/8, version 86901457 Paths: (2 available, best #1) Not advertised to any peer 3549 12956 26210 64.213.176.97 from 64.213.176.97 (208.50.59.1) Origin incomplete, metric 2602, localpref 100, valid, external, best, ref 2 Community: 232589665 232618104 13768 12956 26210, (received-only) 64.34.84.117 from 64.34.84.117 (216.187.124.10) Origin incomplete, localpref 100, external, ref 2 Route views is showing a 12/8 with a fair amount of dampening/flap penalties in the last 10-12 minutes. -- Drew Linsalata The Gotham Bus Company, Inc. Dedicated Servers and Colocation Solutions Long Island, New York http://www.gothambus.com

5 9

Re: LA power outage?
by Fergie (Paul Ferguson) 12 Sep '05

12 Sep '05

CNN is reporting that power is starting to be restored to some areas afected by the outage. - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: LA power outage?
by prue 12 Sep '05

12 Sep '05

Yep. LA got hit with a power outage that hit downtown and the San Fernando valley according to reports. Power was restored to USC campus which is about 4 miles from downtown at about 1:30 PDT, for an outage of about half an hour. Walt

1 0

DNSSEC in public
by Dan Mahoney, System Admin 12 Sep '05

12 Sep '05

In response to a recent question I saw regarding DNSSEC on RIPE domains, I'd like to ask if there's any sort of draft or standard that anyone knows about for doing DNSSEC in the public, using either a "root" key and/or possibly having master keys pulished in WHOIS? I see a very experimental thing Verisign is doing for the .net zone, and also for some other opt-in zone, but I'm sure that's highly experimental at this point. I guess my question is: is there even something up for discussion at this point? I know it's early in the game. Thanks Dan -- "I can feel it, comin' back again...Like a rolling thunder chasin' the wind..." -Dan Mahoney, JS, JB & SL, May 10th, 1997, Approx 1AM --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------

5 4

DHS Cyber Security Investment Study
by Rowe, Brent 12 Sep '05

12 Sep '05

NANOG members, I am writing to ask for your participation in a study which I am working on for the Department of Homeland Security on IT security investment decisions. My intension is not to upset anyone with an unwanted solicitation, so if you are uninterested in this topic, please disregard the remainder of this email. ------------------------------------------------------------------------ ------------------ My company, RTI, has been contracted by the the Department of Homeland Security to analyze how organizations make investment decisions related to IT security. As part of this project, we are gathering information from organizations in seven different sectors, one of which is Internet Service Providers. I am interested in talking with any individuals representing ISPs about their organizations' IT security decision making practices. Let me be clear that I are not interested in learning the makeup of your IT infrastructure, the IT policies and procedures your organization employs, the number of breaches you have each year, or any other sensitive information related to your organization's IT security. Instead, I am interested in discussing the information you use to decide how much to spend on various IT security-related activities and what information you are collecting (and using) from your IT system operations. If you are interested in participating in this study and/or have questions related to how we plan to use the data we collect, the purpose of the study, or the intended use of the study results, please contact me at browe(a)rti.org or 919-485-2626. Thank you any assistance you can provide. Regards, Brent Brent Rowe Research Economist Technology Economics & Policy RTI International 3040 Cornwallis Road Research Triangle Park, NC 27709 phone: (919) 485-2626 fax: (919) 541-6683 www.rti.org

3 2

Re: Katrina Network Damage Report
by Valdis.Kletnieks＠vt.edu 12 Sep '05

12 Sep '05

On Mon, 12 Sep 2005 12:26:03 EDT, "Howard, W. Lee" said: > Maybe I missed an intermediate post or two, but is the assertion > here that IPv6 is more secure because it's impractical to scan such > a large number of possible host IP addresses? Sort of like zebra > camouflage--it's easy to see the herd, but hard to see a single > zebra. > > There may be other ways to find a host address than random botting. > Phishing, perhaps. The good news here is that although there's "neighbor discovery protocols" that let you find the other zebras on the subnet, they only work if you're already riding a zebra in the herd. If you're riding a giraffe or hippo, or a zebra from another herd, you still can't see the zebras. Now if we could just do some genetic engineering to cull this mutation that causes zebras to spontaneously sprout big neon "Ride Me" signs..... (In other words, yes - we *will* see a shift in tactics from "random scanning" to "find a vulnerable host on the subnet, and use it to enumerate the other hosts". I predict that web bugs and spam variants will be the method of choice for finding that first host.....)

1 0

MEDIA: eBay to Acquire Skype
by william(at)elan.net 12 Sep '05

12 Sep '05

Let me play Paul Ferguson for a second ... : (and I wonder if we'll soon be trading voip minutes on ebay :) http://finance.lycos.com/home/news/story.asp?story=51709287 eBay to Acquire Skype - Sep 12, 2005 06:00 AM (BusinessWire) LONDON--(BUSINESS WIRE)--Sept. 12, 2005--eBay Inc. (Nasdaq:EBAY) www.ebay.com) has agreed to acquire Luxembourg-based Skype Technologies SA, the global Internet communications company, for approximately $2.6 billion in up-front cash and eBay stock, plus potential performance-based consideration. The acquisition will strengthen eBay's global marketplace and payments platform, while opening several new lines of business and creating significant new monetization opportunities for the company. The deal also represents a major opportunity for Skype to advance its leadership in Internet voice communications and offer people worldwide new ways to communicate in a global online era. Skype, eBay and PayPal will create an unparalleled ecommerce and communications engine for buyers and sellers around the world. ...

2 1

RE: Katrina Network Damage Report
by Joel Jaeggli 12 Sep '05

12 Sep '05

On Mon, 12 Sep 2005, Howard, W. Lee wrote: > Maybe I missed an intermediate post or two, but is the assertion > here that IPv6 is more secure because it's impractical to scan such > a large number of possible host IP addresses? Sort of like zebra > camouflage--it's easy to see the herd, but hard to see a single > zebra. I didn't assert that it was more secure, rather that scanning as it works now, to collect the ip's of exploitable embedded or other devices is infeasible. Miscreants will of course looks for other ways if they can't feasibly scan. The IETF is full of resource discovery mechanism work and there's no reason to expect that those selfsame mechanisms wouldn't be subverted to other ends. There's no point in conneccting a device to the internet if you can't find it or manange it. As my firewall logs would testify though, host discovery throught probing is one of the low hanging fruit. > There may be other ways to find a host address than random botting. > Phishing, perhaps. > > I suppose the relative security question becomes, "Which is more > secure: address translation or sparseness?" I've heard people say > that NAT provides no security, but dynamic assignment (from the > Internet's point of view) of an address for only the duration of > a session means you can't target a specific host, and have to have > some access already to hijack a session. > > I'm not saying NAT is sufficient security, but it can be part of > a good plan. Obscurity isn't sufficient security, but I'm not > publishing my network map. > > Lee > > > > -- -------------------------------------------------------------------------- Joel Jaeggli Unix Consulting joelja(a)darkwing.uoregon.edu GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2

1 0

Re: Multi-6 [WAS: OT - Vint Cerf joins Google]
by Brandon Butterworth 12 Sep '05

12 Sep '05

> >> 1. Give us a maximum number of multihomers. > > > 4 Million > > So how do you know it's 4 million and not 4.1? Could be 4.1 or even 4.2. I'm assuming those working on 4byte ASs know, if it's more we'll have to migrate again which would be silly so soon So about 4M it must be. > We know that 125k works today That's quite a bit less than current SUP720-3BXL > (I'm being a bit conservative because > in IPv6 the addresses are longer) so the storage requirements should > sort themselves out according to Moore in 7 x 1.5 years, so that > would work in 2013. Processing scales non-linearly, though. If we need it then it will exist, if not then we won't be able to do that and will do something else instead just as V4 users are doing when they discover V6 doesn't do what they want (let's not rehash whether what they want is reasonable or sensible) brandon

2 1

[db-wg] DNSSEC deployment on the reverse tree. (fwd)
by william(at)elan.net 12 Sep '05

12 Sep '05

FYI - RIPE seems to be getting ready to deploy DNSSEC on inaddr (rdns) tree so I thought nanog folks might want to know about it too being the kind operational issue that we don't seem to be discussing here lately quite as much... BTW - are there any plans to deploy DNSSEC for ARIN ip dns tree and if so when are the good people at ARIN planning to tell about it? And perhaps presentation about DNSSEC on ip dns tree and how it is being handled and what we should be ready for maybe good to have at upcoming NANOG meeting. ---------- Forwarded message ---------- Date: Mon, 12 Sep 2005 09:39:48 +0200 From: Henk Uijterwaal <henk(a)ripe.net> To: dns-wg(a)ripe.net, db-wg(a)ripe.net Subject: [db-wg] DNSSEC deployment on the reverse tree. Dear Colleagues, In June, Olaf Kolkman wrote: > The RIPE NCC has been involved with the development of the DNSSEC > protocol. Now that the protocol has become available, we plan to > implement DNSSEC on our domains in the reverse DNS tree. The > deployment of DNSSEC is the second and last phase of the Reverse DNS > restructuring project. [...] > We welcome your feedback on this poposal before 1 August 2005. Please > send your comments to the DNS Working Group Mailing List. The comment period was extended to 1 September and some comments were posted to the list. These have all been incorporated and the new documents are at: > You can find the proposed policy at: > > <http://www.ripe.net/rs/reverse/dnssec/draft-dnssec-policy.html>http://www.ripe.net/rs/reverse/dnssec/draft-dnssec-policy.html. > "DNSSEC Key Maintenance Procedure" > > <http://www.ripe.net/rs/reverse/dnssec/key-maintenance-procedure.html>http://www.ripe.net/rs/reverse/dnssec/key-maintenance-procedure.html > "Procedure for Requesting DNSSEC Delegations" > > <http://www.ripe.net/rs/reverse/dnssec/registry-procedure.html>http://www.ripe.net/rs/reverse/dnssec/registry-procedure.html I'm going to suggest to the chairs of the WG to do a last call on these documents and have them published as RIPE documents. Kind regards, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

1 0