- NANOG - lists.nanog.org

AWS Elastic IP architecture
by Luan Nguyen 05 Jun '15

05 Jun '15

Hi folks, Anyone knows what is used for the AWS Elastic IP? is it LISP? Thanks. Regards, -lmn

26 101

VPS + BGP session
by Sadiq Saif 05 Jun '15

05 Jun '15

Hi, I am looking for providers that can provide me a VPS with a BGP session so I can announce my PI IP space (v4 + v6). I have looked at other threads on NANOG regarding this and already have sessions up with ARP Networks, Mythic Beasts, and Knightswarm. Host Virtual is unfortunately out of my budget. I am looking for providers in the east coast USA and Asia Pacific regions at this time. Any pointers are appreciated! -- Sadiq Saif (AS393949) https://staticsafe.ca

2 1

Roof space, co-lo...
by Barry Shein 05 Jun '15

05 Jun '15

A company has asked me if I could find anyone who could provide: 1. Roof space for a 1.2m dish 2. About 2U rackspace (i.e., not a whole rack minimum) 3. Modest (5-10mb) bandwith. 4. Cabling between the rackspace and roof dish 5. Power Prefer Boston/Cambridge area but would consider other venues. I don't know a lot more about it but I think the key request here is the roof space for the 1.2m dish and cabling to the boxes. I don't know which way the dish must face or anything like that if you do this for a living I will put you in touch and you can work it out. Respond to me: bzs(a)TheWorld.com (some of you were Bcc'd on this) -- -Barry Shein The World | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

1 0

FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation
by Pavel Odintsov 04 Jun '15

04 Jun '15

Hello, Nanog! I'm very pleased to present my open source DoS/DDoS attack monitoring toolkit here! We have spent about 10 months for development of FastNetMon and could present huge feature list now! :) Stop! What is FastNetMon? It's really very fast toolkit which could find attacked host in your network and block it (or redirect to filtering appliance) This solution could save your network and your sleep :) Our site located here: https://github.com/FastVPSEestiOu/fastnetmon We support following engines for traffic capture: - Netflow (v5, v9 and IPFIX) - sFLOW v5 - port mirror/SPAN (PF_RING and netmap supported) Also we have deep integration with ExaBGP (huge thanks to Thomas Mangin) for triggering blackhole on the Core Router or upstream. Since 1.0 version we have added support for following features: - Ability to detect most popular attack types: syn_flood, icmp_flood, udp_flood, ip_fragmentation_flood - Add support for Netmap for Linux (we have prepared special driver for ixgbe users: https://github.com/pavel-odintsov/ixgbe-linux-netmap) and FreeBSD. - Add support for PF_RING ZC (very fast but need license from ntop folks) - Add ability to collect netflow v9/IPFIX data from multiple devices with different templates set - Basic support for IPv6 (we could receive netflow data over IPv6) - Add plugin support for capture engines - Add support of L2TP decapsulation (important for DDoS attack detection inside tunnel) - Add ability to store attack details in Redis - Add Graphite/Grafana integration for traffic visualization - Add systemd unit file - Add ability to unblock host after some timeout - Introduce support of moving average for all counters - Add ExaBGP integration. We could announce attacked host with BGP to border router or uplink - Add so much details in attack report - Add ability to store attack fingerprint in file We have complete support for following platforms: - Fedora 21 - Debian 6, 7, 8 - CentOS 6, 7 - FreeBSD 9, 10, 11 - DragonflyBSD 4 - MacOS X 10.10 >From network equipment side we have tested solution with: - Cisco ASR - Juniper MX - Extreme Summit - ipt_NETFLOW Linux We have binary packages for this operation systems: - CentOS 6: https://github.com/FastVPSEestiOu/fastnetmon/tree/master/packages/CentOS6 - CentOS 7: https://github.com/FastVPSEestiOu/fastnetmon/tree/master/packages/CentOS7 - Fedora 21: https://github.com/FastVPSEestiOu/fastnetmon/tree/master/packages/Fedora21 - FreeBSD: https://github.com/FastVPSEestiOu/fastnetmon/tree/master/src/FreeBSD_port For any other operation systems we recommend automatic installer script: https://github.com/FastVPSEestiOu/fastnetmon/blob/master/docs/INSTALL.md Please join to our mail list or ask about anything here https://groups.google.com/forum/#!forum/fastnetmon Thank you for your attention! -- Sincerely yours, Pavel Odintsov

5 7

Re: BGP in the Washngton Post
by Scott Weeks 04 Jun '15

04 Jun '15

--- larrysheldon(a)cox.net wrote: From: Larry Sheldon <larrysheldon(a)cox.net> On 6/2/2015 00:27, Scott Weeks wrote: > Great article for the WP and they asked good questions from > the correct people, but I have to take issue with the lack > of network operator's participation comments: > > : But getting network operators to participate is proving > : difficult. > > : Many network operators also are cool to taking the further > : step of adopting a secure new routing protocol called BGPSEC > : to replace BGP. > > : “Unless [network] operators can see that the benefits will > : generally outweigh the costs, they just won’t deploy it.” > > It's more that the managers who have no idea what is going on > are forcing operators to focus their attention elsewhere, rather > than the important things until everyone's behind the 8-ball. > Then, all of the sudden, the mostly clueless managers are all > about it. But, by then it's too late. Farting in a hurricane > and hoping it makes a difference... ;-) Pardon me, (and please forgive me if I am wrong), but I think that from the viewpoints of the Washington Post, its readers, and probably all of humanity save the view on this list, the MANAGEMENT of the several ISP firms and organizations IS "the operators". Folks out on the operating floor don't really exist. -------------------------------------------------- No, looking at it the way you phrase it, you're not wrong. To me, the operators are the folks with the technical know how and the admin password. I guess I have been out on the raggedy edges (likely soon to change...) too long and I am not used to managers that have any understanding of network operations/engineering. But I do understand what you're saying. And I'm on the list. ;-) scott

1 0

Re: BGP in the Washngton Post
by Larry Sheldon 04 Jun '15

04 Jun '15

On 6/2/2015 00:27, Scott Weeks wrote: > Great article for the WP and they asked good questions from > the correct people, but I have to take issue with the lack > of network operator's participation comments: > > : But getting network operators to participate is proving > : difficult. > > : Many network operators also are cool to taking the further > : step of adopting a secure new routing protocol called BGPSEC > : to replace BGP. > > : “Unless [network] operators can see that the benefits will > : generally outweigh the costs, they just won’t deploy it.” > > It's more that the managers who have no idea what is going on > are forcing operators to focus their attention elsewhere, rather > than the important things until everyone's behind the 8-ball. > Then, all of the sudden, the mostly clueless managers are all > about it. But, by then it's too late. Farting in a hurricane > and hoping it makes a difference... ;-) Pardon me, (and please forgive me if I am wrong), but I think that from the viewpoints of the Washington Post, its readers, and probably all of humanity save the view on this list, the MANAGEMENT of the several ISP firms and organizations IS "the operators". Folks out on the operating floor don't really exist. -- sed quis custodiet ipsos custodes? (Juvenal)

1 0

BGP offloading (fixing legacy router BGP scalability issues)
by Frederik Kriewitz 03 Jun '15

03 Jun '15

Hello, We've a lot of customers with Cisco 6500 routers (mostly with SUP720 supervisors) in operation. They are very popular with smaller ISPs in Africa/middle east due to their cheap price on the used marked and their fully sufficient routing performance for the given tasks. In practice the biggest problem with them is their poor BGP scalability due to the CPU/memory limitations. We're looking into options for a cheap fix for this problem. The idea is to offload BGP IPv4/IPv6 RIB calculation from the router to a standard server. All BGP sessions will be handled by the server. The server takes care of the RIB calculation and aggregates the result as much as possible (the aggregation potential of the global tables should be very high if it can completely ignore the AS path and only care about the next hop). The final optimized RIB is then pushed to the Router via an iBGP session (the only BGP session configured on the router). If there's room in the transfer net for the server and the router, the setup is simple (eBGP session is established with the server and next-hop is set to the router). In other peering situations the setup might be more challenging. E.g. with typical IXP constrains (only a single MAC address/IP address allowed) the session would have to be a multihop session and an additional static route (host route for the server) on the peer router should be installed. Another way to make the server appear completely transparent for other peers (no special configuration on the peer side) might be NAT for the BGP port to the server or proxy ARP. But we would like to avoid doing NAT with a SUP720 and proxy ARP would make us the default gateway for any incorrectly configured IXP participant router and a configuration error on our side might cause severe harm to the IXP. And of course both ideas won't work for IPv6 (SUP720 doesn't support NAT for IPv6 or proxy NDP). The only solution to make it fully transparent for IPv4 and IPv6 we came up with it is to configure the IXP router interface as unnumbered + static route for the IXP nets + host routes for the assigned IXP IPs to the server. In that case the server would have to monitor the IXP vlan and take care of responding to ARP and Neighbor Solicitation requests for the IXP IPs (using the MAC of the router). Additionally it might be necessary to inject the ARP/IPv6 neighbors into the cisco using static entries (to avoid sending ARP/NS requests with a non IXP IP). We're wondering if anyone has experience with such a setup? Best Regards, Freddy

25 56

nanog website down
by Eric Oosting 03 Jun '15

03 Jun '15

This morning we suffered a hardware failure in our production environment. The outage affected nanog mail and web services. While mail services have recovered, web services are still down. We apologize for the inconvenience. -e

1 1

nanog.org Website down ?
by Bob Evans 03 Jun '15

03 Jun '15

Not sure what's up - however I see what's down this AM. From the hotel nanog.org was not reachable. Soooo, I tunneled out of the hotel to my office, still not reachable at 6:15 AM nanog.org (50.31.151.73) www.nanog.org (50.31.151.73) Bob Evans CTO Fiber Internet Center

2 1

Re: Password Decryption Methods?
by Bacon Zombie 03 Jun '15

03 Jun '15

Grab the firmware and run it through BinWalk. Your should be able to pull out the firmware and see what it does to the password before storing it. On 2 Jun 2015 22:03, "Landon Stewart" <landonstewart(a)gmail.com> wrote: On Jun 2, 2015, at 9:23 AM, Michael O Holstein <michael.holstein(a)csuohio.edu> wrote: > If you can share the other details (make, model, firmware revision, processor type, etc.) .. whatever you know and can share) .. it would be more helpful. Also, how'd you get the hash? .. from a config file backup or from another device that used it to access this one? If so, what software, etc. Serial # too. :-D

1 0