- Test - lists.nanog.org

IPv6 Security for IPv4 Engineers
by Fernando Gont 14 Mar '19

14 Mar '19

Folks, It is often argued that IPv4 practices should be forgotten when deploying IPv6, as after all IPv6 is a different protocol! But we think years of IPv4 operational experience should be leveraged as much as possible. So we are publishing IPv6 Security for IPv4 Engineers as a roadmap to IPv6 security that is specifically aimed at IPv4 engineers and operators. Rather than describing IPv6 in an isolated manner, it aims to re-use as much of the existing IPv4 knowledge and experience as possible, by highlighting the security issues that affect both protocols in the same manner, and those that are new or different for the IPv6 protocol suite. Additionally, it discusses the security implications arising from the co-existence of the IPv6 and IPv4 protocols. The document is available at: https://www.internetsociety.org/blog/2019/03/ipv6-security-for-ipv4-enginee… Comments are welcome. And if you think we've missed something or the like, please drop me en email -- the document can always be revised. P.S.: If you haven't taken a look at it (yet), we have also published the "IPv6 Security Frequently Asked Questions (FAQ)" at: https://www.internetsociety.org/blog/2019/02/ipv6-security-faq Thanks! Cheers, -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

1 0

Analysing traffic in context of rejecting RPKI invalids using pmacct
by Job Snijders 14 Mar '19

14 Mar '19

Dear all, Whether to deploy RPKI Origin Validation with an "invalid == reject" policy really is a business decision. One has to weigh the pros and cons: what are the direct and indirect costs of accepting misconfigurations or hijacks for my company? what is the cost of deploying RPKI? What is the cost of honoring misconfigured RPKI ROAs? There are a few thousand misconfigured ROAs, what does this mean for me? To answer these questions, Paolo Lucente and myself worked to extend pmacct traffic analysis engine (http://pmacct.net/) in such a way that it can do perform the RFC 6811 Origin Validation procedure and present the outcome as a property in the flow aggregation process. Pmacct has the ability to ingest BGP feeds and correlate the BGP data to the sflow/netflow/ipfix data. This allows for fantastic business intelligence, you can see exactly how much traffic is flowing from what customers to what endpoints for what reason! Pmacct implemented Origin Validation in a cute way: it separates out RPKI invalid BGP announcements into two categories: a) "invalid with no overlapping or alternative route" (aka will be blackholed if 'invalid == reject') b) "invalid but an overlapping unknown/valid announcement also exists" (end-to-end connectivity can still work). Because pmacct separates out the various types kinds of (invalid) BGP announcements, operators don't have to do deploy *anything* in their network to get a good grasp on how their connectivity to the rest of the Internet would look like after deploying a "invalid == reject" policy. No changes to your network configurations are required to make use of this feature, you don't need to tag routes with communities or do other tricks. All the analysis happens inside pmacct. Of course we tested this first in the NTT global backbone AS 2914! At the moment of writing, we're seeing less than a handful of gigabits per second being send towards BGP announcements that are RPKI Invalid and for which no alternative route exists. In context of NTT's backbone that amount of traffic is just statistical noise. This is a very encouraging sign, it may help us move towards the goal of deploying RPKI Origin Validation in AS 2914. Nusenu wrote a great blog post on where these RPKI ROA misconfigurations are located, i recommend reading their posts to develop a better understanding of the problem space: https://medium.com/@nusenu/where-are-rpki-unreachable-networks-located-65c7… Even if you don't intend to deploy RPKI Origin Validation (or are single-homed), pmacct's RPKI capabilities can be useful in forensic investigations. It'll be easier to analyse how much and what kind of traffic for what period of time was sent to a possible hijack. This will help you when writing RFOs! If you want to testdrive this feature, fetch pmacct version 1.7.3-rc1 from https://github.com/pmacct/pmacct/releases/tag/1.7.3-rc1 Documentation on how to configure the feature: https://github.com/pmacct/pmacct/blob/master/QUICKSTART#L1783-#L1833 https://github.com/pmacct/pmacct/blob/master/CONFIG-KEYS#L2626-#L2647 Let us know what you think! Or if you'd like to chat telemetry with Paolo or me about analysing the effects of BGP hijacks and RPKI, we'll both be at the San Francisco NANOG meeting next week! Kind regards, Job ps. Dear Kentik & Deepfield, please copy+paste this feature! We'll happily share development notes with you, you can even look at pmacct's source code for inspiration. :-)

4 4

Should Netflix and Hulu give you emergency alerts?
by Sean Donelan 13 Mar '19

13 Mar '19

https://www.cnn.com/2019/03/08/tech/emergency-alert-netflix-hulu-streaming/… New York (CNN Business) The federal emergency alert program was designed decades ago to interrupt your TV show or radio station and warn about impending danger — from severe weather events to acts of war. But people watch TV and listen to radio differently today. If a person is watching Netflix, listening to Spotify or playing a video game, for example, they might miss a critical emergency alert altogether. "More and more people are opting out of the traditional television services," said Gregory Touhill, a cybersecurity expert who served at the Department of Homeland security and was the first-ever Federal Chief Information Security Officer. "There's a huge population out there that needs to help us rethink how we do this." [...]

24 59

ICMPv6 "too-big" packets ignored (filtered ?) by Cloudflare farms
by Jean-Daniel Pauget 13 Mar '19

13 Mar '19

hello, I confess using IPv6 behind a 6in4 tunnel because the "Business-Class" service of the concerned operator doesn't handle IPv6 yet. as such, I realised that, as far as I can figure, ICMPv6 packet "too-big" (rfc 4443) seem to be ignored or filtered at ~60% of ClouFlare's http farms as a result, random sites such as http://nanog.org/ or https://www.ansible.com/ are badly reachable whenever small mtu are involved ... support@cloudflare answered me that because I'm not the owner of concerned site, and because of security reasons, they wouldn't investigate further. are there security concerns with ICMP-too-big ? regards, -- Jean-Daniel Pauget http://rezopole.net/ Rezopole/LyonIX +33 (0)4 27 46 00 50

19 38

Free Open Source Network Operating Systems
by Colton Conor 13 Mar '19

13 Mar '19

What free, opensouce, network operating systems currently exist that run on whitebox broadcom or other merchant silicon switches? I know Cumulus is very popular, but I don't believe they have a free version that runs on whitebox switches right? Only on a virtual machine from what I can tell. I think if one of these vendors would release a free and truly opensource network operating system, with the option for paid support if needed, then whitebox switching would really take off. This would be similar to the Redhat model, but for the networking world. Right now, the cost of the whitebox plus a paid network operating system seems to equal the same cost as a discounted Juniper, Cisco, or Arista. I am not seeing the savings on paper. If we could just buy the whitebox hardware, and have a free operating system on there, then financially whitebox switches would be half the cost of a similar Cisco switch after discount. Am I missing something?

8 9

Re: Should Netflix and Hulu give you emergency alerts?
by Scott Weeks 12 Mar '19

12 Mar '19

--- mike(a)mtcc.com wrote: From: Michael Thomas <mike(a)mtcc.com> But if you're about to be incinerated in real life -- Paradise -- you want the alert. -------------------------------------- So you can toss your children in the storm drain? http://www.hawaiinewsnow.com/story/37259815/biggest-fright-of-my-life-many-… "One video on social media showed an adult putting children into a storm drain; other social media images showed residents huddling in bathtubs." Or like me and this guy, just stay out in the ocean and watch it all happen... "We didn't know what to do except paddle [our surfboards] in and do as best we could. We debated whether we should just stay out" :) scott

3 2

GPS rollover
by Stephen Satchell 11 Mar '19

11 Mar '19

So far as I can tell with NTP, there was no issue with time sources becoming false-tickers, including my local GPS appliance. FWIW.

3 2

Experiences on Cable Advisory Commissions
by Howard C. Berkowitz 11 Mar '19

11 Mar '19

I've designed services for cable and other residential broadband, and evaluated vendor proposals for WAN services. Now, though, I have a new responsibility: being on the Cable Advisory Committee for my small Cape Cod town od Chatham, MA. We're the easternmost point on the continental US, have been around for 300 years, and even was the original Marconi transmitter site and a WWII SIGINT intercept base. We have, however, more Great White Sharks than technologists. The town has a blue-collar fishing population that is dwarfed by summer vacationers/summer home residents. Has anyone else been in such a civic role? Can we share experience? Its first role is evaluating performance of Comcast, the incumbent, and deciding whether to recommend renewal or make a preliminary denial. This gets into an overall "ascertainment of needs" requirements process, possibly for new features to be built into the renewed contract. There are other issues to examine, such as subscribers cutting the cable or getting other digital access. Since the municipality gets revenue from the franchise fees, this may mean a drop in funding for Public Access, Education, and Government video channels. While it's not within the original committee charter, we may well look at overall communications architecture, including municipal fiber and Wifi, cellular infrastructure, emergency communications, etc. -- Howard C. Berkowitz 95 George Ryder Rd. Chatham, MA 02633 sy(a)netcases.net (508)241-1362 cell (866)262-6579 fax

2 1

Re: Should Netflix and Hulu give you emergency alerts?
by Scott Weeks 10 Mar '19

10 Mar '19

--- beecher(a)beecher.cc wrote: From: Tom Beecher <beecher(a)beecher.cc> Business ask to create near real time, location aware notification system to increase user engagement and refine ad tracking : "That's a a great idea, we can do that!" Government ask to create near real time, location aware notification system for public safety warnings : "THAT IS A BRIDGE TOO FAR, THIS IS OUTRAGEOUS GOVERNMENT OVERREACH!" ------------------------------------------------------- No, it is overreach and Doing The Wrong Thing (AKA we do evil now even though we said we wouldn't in the beginning) for businesses as well. scott

2 1

SLAAC in renumbering events
by Fernando Gont 10 Mar '19

10 Mar '19

Folks, If you follow the 6man working group of the IETF you may have seen a bunch of emails on this topic, on a thread resulting from an IETF Internet-Draft we published with Jan Žorž about "Reaction of Stateless Address Autoconfiguration (SLAAC) to Renumbering Events" (Available at: https://github.com/fgont/draft-slaac-renum/raw/master/draft-gont-6man-slaac… ) Short version of story: There are a number of scenarios where SLAAC hosts may end up using stale configuration information. For example, a typical IPv6 deployment scenario is that in which a CPE router requests an IPv6 prefix to an ISP via DHCPv6-PD, and advertises a sub-prefix of of the leased prefix on the LAN-side, via SLAAC. In such scenarios, if the CPE router crashes and reboots, it may loose all information about the previously-leased prefix. Upon reboot, the CPE router may be leased a new prefix that will result in a new sub-prefix being advertised on the LAN-side of the CPE router. As a result, hosts will normally configure addresses for the newly-advertised prefix, but will normally also keep (and use) the previously-configured (and now stale!) IPv6 addresses, leading to interoperability problems. The RIPE-690 BCOP document had originally tried to address this problem by recommending operators to lease stable IPv6 prefixes to CPE routers. However, for a variety of reasons ISP may not be able (or may not want) to lease stable prefixes, and may instead lease dynamic prefixes. Most of the voices on the 6man wg mailing-list fell into one of the following camps: * "ISPs should be leasing stable prefixes -- if they don't, they are asking for trouble!" * "CPE routers should record leased prefixes on stable storage, such that they can 'deprecate' such prefixes upon restart -- if they don't, they are asking for trouble!" * "No matter whose fault is this (if there is any single party to blame in the first place), we should improve the robustness of IPv6 deployments" Our Internet-Draft tries to improve the current state of affairs via the following improvements: * Allow hosts to gracefully recover from stale network configuration information -- i.e., detect and discard stale network configuration information * Have SLAAC routers employ more appropriate timers, such that information is phased-out in a timelier manner -- unless it is actively refreshed by Router Advertisement messages * Specify the interaction between DHCPv6-PD and SLAAC -- which was rather under-specified * Require CPE routers to store leased prefixes on stable storage, and deprecate stale prefixes (if necessary) upon restart We are looking forward to more input on the document (or any comments on the issue being discussed), particularly from operators. So feel free to send your comments on/off list as you prefer Thanks! Cheers, -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

4 4