- NANOG - lists.nanog.org

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Scott Weeks 18 Jun '15

18 Jun '15

--- rfg(a)tristatelogic.com wrote: From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> *) The Director of the Office of Personnel Management, Ms. Katherine Archueta was warned, repeatedly, and over several years, by her own department's Inspector General (IG) that many of OPM's systems were insecure and should be taken out of service. Nontheless, as reveled during congressional testimony yesterday, she overruled and ignored this advice and kept the systems online. ------------------------------------------- >From personal experience (at a different level) this is SOP, unfortunately. They just don't understand the importance until catastrophic failure. scott

1 0

DMARC in education
by Matthew Black 18 Jun '15

18 Jun '15

Looking at implementing DMARC for my institution. We currently have an SPF record and use DKIM to sign a small subset of messages. Rollout recommendations for DMARC suggest initially creating a "p=none" record to gather information on how a domain is being used. The RUA tag specifies a URI of where to send daily reports. Trying to get an idea of how many reports to expect a day or two after the dust settles. Does anyone use an aggregator to process their feedback (RUA tag) and/or forensic reports (RUF tag)? DMARC information. https://dmarc.org/ See slide 38 of 93 at http://www.slideshare.net/kka7/fighting-email-abuse-with-dmarc?qid=5e90be27… Everyone's first DMARC record V=DMARC1; p=none; rua=mailto:aggregate@example.com; Cheers! matthew black information technology services california state university, long beach

5 4

Re: Google contact?
by Shawn L 17 Jun '15

17 Jun '15

I'm replying on-list since it seems like a lot of people are in the same boat. Here's a summary of what happened to us. Please feel free to jump in if you had a different experience, or have more information. Google sent us a notice in December that as of June 8 they would be discontinuing the Google for ISPs program and that we had to find a different e-mail provider. Unfortunately, they only sent this notice to the account that initially created the service, which was un-monitored. I have heard the same thing from others. They did not include a notice about the discontinuation in their monthly billing, only in e-mail and only to the account that initiated the google service. We actually found out about it some time in February. I spoke with the Google contact listed in the e-mail and was told that they were indeed cancelling the service, but wasn't given a reason. We also asked if it was possible to move to a different Google service, Google Apps for Business for example, but was told that it would be against their terms or service and would result in a cancellation of the service. After a lot of research in Google's forums, it looked like a lot of other people were in the same boat we were. We ended up talking with another e-mail provider and migrating all of our mail. Several weeks ago we asked Google for an extension because the migration was taking longer than expected. We were given until the 16th of June and told that no further extensions would be given. I have spoken to one person who was given until the end of June. Here is the original notice we received from google. I hope this helps others in the same boat December 10, 2014 [ your-domain,com ]( http://baragatelephone.com ) Subject: Notice of Non-Renewal of The Google Apps - ISP Partner Edition Agreement. Dear Administrator, Thank you for being a Google customer and for using Google Apps Partner Edition (collectively, "Partner Edition"). As part of Google's integration plans, we have elected to discontinue providing the Partner Edition Services going forward. As provided in the Agreement between Google Inc. and [ your-domain.com ]( http://baragatelephone.com ), this letter serves as your formal notice that the Services will not be renewed, and our Agreement with you will terminate on June 8, 2015. Any other Google services you have purchased (or resold, if applicable), in addition the Partner Edition product and services, will not be affected by this change. Please also note that this notice of non-renewal does not relieve you of any payment obligations you may have under the current Agreement and that you remain responsible for remitting any such owed payments in full by the applicable invoice due date for the Services. We have prepared an Administrator transition resource website ([ https://support.google.com/appstransition/go/admin ]( https://support.google.com/appstransition/go/admin )) and an End User resource website ([ https://support.google.com/appstransition ]( https://support.google.com/appstransition )) to assist you through the transition. This resource center presents some of the migration options available to you and provides instructions that you can share with your customers. We regret any inconvenience this may cause, and thank you again for your business. If you have any questions, please contact your Account Manager below. Account Manager: John Coull Phone Number: [ 212- 565-3131 ]( tel:212-%20565-3131 ) Email Address: [ johnbc(a)google.com ]( mailto:johnbc@google.com ) Sincerely, Omid Kordestani Chief Business Officer -----Original Message----- From: "Marciano Lopes" <marciano.lopes(a)gsurfnet.com> Sent: Wednesday, June 17, 2015 11:48am To: "Shawn L" <shawnl(a)up.net> Subject: Re: Google contact? Hello Shawn! They cancelled ours as well. What we can do? Thanks! Atenciosamente, Marciano Lopes GSURF Fixo (48) 3254-8700 Ramal 6272 Móvel (48) 9125-5081 Atendimento 24h 0800-644-4833 2015-06-17 12:15 GMT-03:00 Shawn L <[ shawnl(a)up.net ]( mailto:shawnl@up.net )>: Google cancelled their ISP program as of the 8th of June. Feel free to contact me off-list for more info. They cancelled ours as well. -----Original Message----- From: "Christopher Tyler" <[ chris(a)totalhighspeed.net ]( mailto:chris@totalhighspeed.net )> Sent: Wednesday, June 17, 2015 9:28am To: [ nanog(a)nanog.org ]( mailto:nanog@nanog.org ) Subject: Google contact? Need some help.. Does anyone have an email contact at Google that they are willing to pass along? All of our [ mowisp.net ]( http://mowisp.net ) Apps for ISP accounts were disabled last night at about 8-9PM without notice and we are now getting swamped with calls. Possibly several hundred users affected. -- Christopher Tyler MTCRE/MTCNA/MTCTCE/MTCWE Total Highspeed Internet Services [ 417.851.1107 ]( tel:417.851.1107 )

3 2

Google contact?
by Christopher Tyler 17 Jun '15

17 Jun '15

Need some help.. Does anyone have an email contact at Google that they are willing to pass along? All of our mowisp.net Apps for ISP accounts were disabled last night at about 8-9PM without notice and we are now getting swamped with calls. Possibly several hundred users affected. -- Christopher Tyler MTCRE/MTCNA/MTCTCE/MTCWE Total Highspeed Internet Services 417.851.1107

3 2

Fkiws with destination port 0 and TCP SYN flag set
by Maqbool Hashim 17 Jun '15

17 Jun '15

Hi, I am doing some flow analysis within our network primarily for understanding application flows to aid in network segregation activity and mainly understand what is going on inside the network. To do this I have been using netflow where the switches/firewalls support it. In some cases I have used a monitor port and fed full packet capture into the nfdump toolset for conversion into flows. There is a portion of our network where the switches only support sflow which is not ideal, but hopefully will be able to gather enough data over time to be useful. One of the things I was trying to identify was flow initiation, i.e. the client and server in the flow- so filtered for TCP packets with SYN flag set. It was at this point that I saw TCP SYN packets with a destination port of 0. I have seen this discussed before in this thread http://www.gossamer-threads.com/lists/nanog/users/155141 It was stated in that thread that netflow reports source/dest port 0 for non-initial fragments. My question was is this what I am seeing here, so any SYN packet with dest port 0 is a non-initial fragment seen by the tool? Therefore should I always see a corresponding response with Ack and Reset flags set? I do see a set of flows with R and A set with a source port of 0, all the dest port 0 flows have the SYN flag set, but it's hard to find ones that match a SYN packet due to only receiving a sample of flows. Some notes on the setup: Capture is from inside one VLAN Switches are sending sflow back to analysis tools, sampling rate of 1/1024 packets Using nfdump suite of tools for analysis. sfcapd as as the collector Thinking about this, is what I am seeing a symptom of the fact that the tools don't see all packets, i.e. the tools don't see the initial fragment due to sampling. However I still don't quite understand it appearing with the SYN flag set? I am starting to think that for these purposes I might be better abandoning sflow and go with setting up collectors on the switches to get full flow information for my purposes. Any clarification/input much appreciated. Regards MH

5 14

Unified Layer contact
by Chuck Church 16 Jun '15

16 Jun '15

Anyone on here from Unified Layer? Having an issue with a small ISP I help out occasionally. Some of their IP Space can reach a hosted web server, but their other prefixes cannot reach the destination. Traceroute from working IP space to destination web server (a bank) : 15 162-144-240-55.unifiedlayer.com (162.144.240.55) [AS 46606] 68 msec 162-144-240-43.unifiedlayer.com (162.144.240.43) [AS 46606] 68 msec 68 msec 16 grandsouth.com (162.144.109.184) [AS 46606] 76 msec 76 msec 72 msec >From non-working IP space: 15 162-144-240-51.unifiedlayer.com (162.144.240.51) [AS 46606] 80 msec 162-144-240-43.unifiedlayer.com (162.144.240.43) [AS 46606] 80 msec 162-144-240-47.unifiedlayer.com (162.144.240.47) [AS 46606] 84 msec 16 * * * 17 * * * 18 * * * We're not a customer of Unified Layer whom the bank uses for hosting, not getting much help via normal channels. Thanks, Chuck

1 0

[NANOG-announce] NANOG On The Road Comes to Herndon!!
by Valerie Wittkop 16 Jun '15

16 Jun '15

We are very excited to be holding the next NOTR event in the great city of Herndon, VA next Tuesday, and we invite you to join us! Are you interested in Internet networking/peering? Do you work at a colocation, hosting or data center facility? Are you a provider of hardware/software solutions for the Internet industry? If so, the NANOG On The Road <https://www.nanog.org/meetings/road7/home> Herndon event is perfect for you! Date: June 23, 2015 Time: Registration Desk opens at 8:30am and Program is from 9:00 AM - 5:00 PM Location: Westin Dulles Airport Hotel <https://www.nanog.org/meetings/road7/hotel> - 2520 Wasser Terrace, Herndon, VA 20171 The FREE to attend event is open for registration. Register Now! <https://www.cvent.com/events/notr-herndon-va/registration-8c87c541134e4d2eb…> The agenda <https://www.nanog.org/meetings/road7/agenda> is posted - topics to be discussed include: - Recent & Future Developments in DNS Security - International Network Supply, Traffic & Pricing - DNSSEC & RPKI - High fibre-coaxial networks - Optical Networking Tutorial - IPv6 Tutorial - BGP Tutorial If you are, or will be, in the Herndon area, we invite you to attend. And don’t forget to share the invitation with your colleagues or others you feel may benefit from attending. Make NANOG On The Road your first step toward learning how you can take the wheel and steer the future of the Internet. Learn more about On The Road events here <https://www.nanog.org/meetings/road/home>. Feel free to contact us at nanog-support(a)nanog.org <mailto:nanog-support@nanog.org> if you have any questions. Regards, Valerie Valerie Wittkop NANOG Program Director Tel: +1 866 902 1336, ext 103 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

RE: Greenfield ISP (In January)
by Nicholas Warren 16 Jun '15

16 Jun '15

Does anyone beside Cisco do MAP? Brocade, Juniper, Huawei? Thank you, - Nich Warren -----Original Message----- From: Tore Anderson [mailto:tore@fud.no] Sent: Friday, June 12, 2015 12:15 AM To: Baldur Norddahl Cc: Nicholas Warren; nanog(a)nanog.org Subject: Re: Greenfield 464XLAT (In January) * Baldur Norddahl <baldur.norddahl(a)gmail.com> > The high tech solution is stuff like MAP where you move the cost out > to the CPE. But then you need to control the CPE - if you have that > then great. You would still want to sell a non-NAT (and MAP is NAT) to > users that require a public IPv4 address, so you still need to go dual > stack or use some tunnelling for that. Hi Baldur, MAP is *not* NAT; that's what's so neat about it. The users do get a public IPv4 address (or prefix!) routed to their CPE's WAN interface, towards which they can accept inbound unsolicited connections. The public IPv4 address could be port-restricted if the operator wants address sharing, but it does not have to be. You could do both at the same time, e.g., giving your "premium" users a /32 or /28, while the standard subscription includes a /32 with 4k ports. I will grant you that MAP-T performs NAT (i.e., protocol translation) internally, but the translations that happens when a packet enters the MAP domain are reversed when it exits. So the IPv4 addresses are transparent end-to-end. MAP-E (and lw4o6 for that matter), on the other hand, has no form of NAT anywhere. (Unless you count the NAPT44 that sits between the subscriber's RFC1918 LAN segment and the CPE's WAN interface, but that's not exactly something that's unique to MAP.) Nicholas: If I were you, before going down the 464XLAT route, I'd first look closely at these technologies, in the order given: 1) MAP (because it is fully stateless) 2) lw4o6 (because it is mostly stateless, i.e., no session tracking) 3) DS-Lite (which, like 464XLAT, is stateful, but you'll have way more CPEs to choose from than with 464XLAT, which is mostly for mobile) Tore

1 0

ZTE GPON Configuration
by DJ Anderson 16 Jun '15

16 Jun '15

Good Morning All, I am not sure if this is the right place to ask this question or not, so here it goes. I am looking for someone that has experience programming a ZTE GPON OLT and setting up some ONU profiles to go with it. I have just about everything figured out except some issues with the sip configuration and updating things like the country code so that it plays the right dial tone. I guess really I am looking for a ZTE GPON expert. I am willing to pay for anyone's time I really just either need some CLI examples or just to pick someone's brain. Any help that could be provided is greatly appreciated. Please contact me off list. Thanks! DJ Anderson Techwebhosting.com dj at techwebhosting.com

1 0

2.4Ghz 40Mhz 802.11n wifi and Apple Macbook
by Anurag Bhatia 15 Jun '15

15 Jun '15

Hello everyone, I am running a TP Link TL-WR1043N which (as TP Link says is a) 802.11n router working on 2.4Ghz (no support for 5Ghz). I am running it with flashed OpenWRT. While using option to pick 40Mhz, I see my Mac only gets 20Mhz to use and speed is always 130Mbps. There's no other SSID nearby and I am sitting next to router for testing. This brings me to question - Has anyone successfully used 40Mhz with 2.4Ghz on 802.11n standard with Apple Macbook? I wonder if it's limitation on the chipset or something else. Thanks. -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter <https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2

8 9