January 2006 - Test - lists.nanog.org

RE: Wifi SIP WPA/PSK Support
by Frank Bulk 26 Jan '06

26 Jan '06

I've been tracking the Wi-Fi SIP phone space for some time, and have documented all the phones that I could find here: http://www.mtcnet.net/~fbulk/VoWLAN.doc It's about a 7 MB file because I've included pictures of these devices where I could find them. Because we just installed a SIP proxy server on our switch I took the opportunity to purchase and try out 4 Wi-Fi SIP phones: - Hitachi IPC-5000 - UTStarcom F1000 - Pulver WiSIP/ZyXEL P-2000W v1 - ZyXEL P-2000 v2 The last two offer identical user interface and functionality but a different shell. The Hitachi doesn't offer WPA support, but it does do 802.1X (specifically EAP-MD5, EAP-TLS, PEAP, and EAP-TTLS) with WEP. That probably means it can hand out WEP keys, and perhaps perform dynamic WEP. The only phone to support WPA from that short list is the F1000 with 3.60 or higher firmware, and that's only WPA-PSK. If you look in the Word document you'll see there are other phones that offer WPA support, but there not are readily available in the North American market. Kind regards, Frank -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Leber Sent: Wednesday, January 25, 2006 10:35 PM To: nanog(a)merit.edu Subject: Wifi SIP WPA/PSK Support I'm working on finding a Wifi SIP phone that supports WPA/PSK that we can recommended to VOIP clients. As everybody knows, currently most Wifi SIP phones support WEP which is demonstrably insecure. For banking and financial customers, or companies that are given passwords or credit cards over the phone, this is a serious security issue. We recently bought a Hitachi-Cable Wireless IPC-5000 WiFi SIP Phone from voipsupply.com after finding some web pages that said that phone supported WPA (the pages were in German), yet once we got the phone all it supported was WEP even after updating the firmware to the latest version using the website mentioned in the documentation that came with the phone. I've had a few people say that there was some sort of conspiracy to keep US citizens from using secure phones, however I found that laughable because the potential risk of terrorist or criminal interception from having all Wifi telephone conversations involving credit cards (let alone social security numbers, bank account numbers, passwords, what have you) in the clear would create an attack vector so large as to exceed all other possible attack vectors... I mean why work on cracking anything when you can just listen to everybody in the clear (well virtually in the clear with WEP). So, back in reality, could anybody in the US that bought their Wifi SIP phone in the US share a success story at getting Wifi SIP setup with WPA/PSK? What model of phone did you buy? Where did you get it? Did you have to upgrade it to any special version of firmware or what? Mike. +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +-----------------------------------------------------------------------+

1 0

VeriSign
by Martin Hannigan 26 Jan '06

26 Jan '06

Folks, Since my friend Gadi brought it up, I left VeriSign on January 3 after 3 years of solid employment. It was a good run. I was asked to move to Dulles, VA and I declined for personal reasons. I live in Boston, MA. and was a commuter to the DC area for the most part. I've taken a position at another company working to provide global stability in routing and enhance IP security. Some of you will be customers and I am looking forward to being called 'vendor'. I would like to thank all of you for your support while I worked at VeriSign. Best Regards, -M<

2 1

Focal Issues?
by Mike Callahan 26 Jan '06

26 Jan '06

Any one else experiencing packet loss on the Focal/Broadwing Network? ============================================= Target: 192.5.6.30 Date: 1/26/2006 (Thursday), 12:23:23 PM Nodes: 20 Node Data Node Net Reg IP Address Location Node Name <Private Addresses Above> 5 3 - 207.148.192.67 Warren 6 3 - 207.148.192.181 Warren 7 4 1 66.114.196.169 Detroit 66-114-196-169.focaldata.net 8 4 1 66.114.196.2 Detroit core2.dtw.focaldata.net 9 - 1 66.114.196.50 Detroit 66-114-196-50.focaldata.net 10 5 - 216.140.15.145 Chicago 11 - 2 216.140.15.18 Chicago g2-3.rp0.chcg.broadwing.net 12 6 3 157.130.109.1 Chicago gigabitethernet2-0.gw2.chi13.alter.net 13 7 3 152.63.71.218 Cleveland 0.so-2-1-0.xl2.chi13.alter.net 14 7 3 152.63.38.150 WASHINGTON D.C. 0.so-6-0-0.xl2.dca5.alter.net 15 7 3 152.63.39.65 WASHINGTON D.C. pos7-0.gw1.dca5.alter.net 16 8 3 65.207.91.246 WASHINGTON D.C. verisign-gw11.customer.alter.net 17 9 - 65.205.32.138 39.333N, 77.844W 18 10 - 65.205.32.42 39.333N, 77.844W 19 11 - 198.41.3.253 38.983N, 77.378W 20 12 4 192.5.6.30 39.333N, 77.844W a.gtld-servers.net Packet Data Node High Low Avg Tot Lost 1 0 0 0 1 0 2 6 0 1 55 0 3 32 0 2 54 0 4 32 0 1 54 0 5 171 0 58 54 0 6 157 0 3 54 0 7 37 0 4 54 0 8 35 0 4 54 0 9 231 19 28 54 0 10 74 20 46 64 10 11 203 22 31 55 3 12 48 17 25 54 2 13 49 16 23 55 3 14 77 40 51 57 6 15 76 41 54 55 6 16 175 44 59 56 6 17 255 43 64 55 5 18 ---- ---- ---- 98 98 19 150 44 65 50 2 20 87 44 74 52 4 ============================================= Target: yahoo.com Date: 1/26/2006 (Thursday), 12:24:18 PM Nodes: 19 Node Data Node Net Reg IP Address Location Node Name <Private Addresses Above> 5 3 - 207.148.192.67 Warren 6 3 - 207.148.192.181 Warren 7 4 1 66.114.196.169 Detroit 66-114-196-169.focaldata.net 8 4 1 66.114.196.2 Detroit core2.dtw.focaldata.net 9 - 1 66.114.196.50 Detroit 66-114-196-50.focaldata.net 10 5 - 216.140.15.145 Chicago 11 6 2 216.140.15.141 Indianapolis p5-0.gnwd.broadwing.net 12 7 2 216.140.15.129 Fort Worth p4-0.c0.ftwo.broadwing.net 13 8 2 216.140.4.226 Dallas s2-2-0.a1.dlls.broadwing.net 14 9 2 216.140.5.66 Austin ge-3-1.rp0.dlls.broadwing.net 15 10 - 67.99.65.2 Unknown 16 11 3 216.115.101.134 Sunnyvale so-5-1-0.pat2.pao.yahoo.com 17 11 3 216.115.106.207 San Jose ge-4-0-0-p451.msr2.scd.yahoo.com 18 12 3 66.218.82.217 San Jose ten-1-3-bas1.scd.yahoo.com 19 13 3 66.94.234.13 San Jose w2.rc.vip.scd.yahoo.com Packet Data Node High Low Avg Tot Lost 1 0 0 0 1 0 2 2 0 0 89 0 3 34 0 32 89 0 4 34 0 0 89 0 5 201 0 0 89 0 6 65 0 0 88 0 7 63 0 0 88 0 8 37 0 0 89 1 9 60 19 36 96 9 10 65 21 44 93 7 11 58 23 51 92 7 12 74 40 64 92 9 13 84 41 73 88 4 14 222 40 131 92 9 15 96 38 65 90 7 16 150 74 99 93 12 17 154 75 96 90 8 18 136 76 94 89 8 19 147 77 98 90 9

1 0

Re: BlackWorm infected IP's reporting
by Brandon Butterworth 26 Jan '06

26 Jan '06

> In addition, if anyone has any problems with the > trustworthiness of <whoever> > then they should raise that issue with the FIRST secretariat and on the > FIRST mailing lists where we can counter any claims to the otherwise. Trust is earned, it cannot be gained by shouting brandon

2 1

Blackworm hunbers [Was: Re: Martin Hannigan]
by Fergie 26 Jan '06

26 Jan '06

Well, let's hope we can watch the Super Bowl in peace -- I'm turning my pager & cell phone off anyways. :-) In any event, as Alex Eckelberry writes over on the Sunbelt Software blog, "...were now seeing infestations for the Blackworm worm (aka KamaSutra) getting close to 2 million. "Yesterday it was at close to 700k. "Of course, its possible that this URL has gotten out to the public, which would increase the count (simply hitting the website increments the count by one). However, to my knowledge, this URL is only known in the security community. "Remember that this worm has a very destructive payload. Even if you discount the number here, youre still looking at a significant number of people who will suffer potentially devastating data loss." I couldn't agree more. Cheers, - ferg ps. http://sunbeltblog.blogspot.com/2006/01/blackworm-worm-over-18-million.html -- Martin Hannigan <hannigan(a)world.std.com> wrote: > > http://isc.sans.org/blackworm > Further, our reports lead to a SANS ISC temporary URL's for each AS. The last time SANS felt something was so serious they needed all of NANOG to dance, they came out and said so. That's their handlers diary. I read it. A lot of people read it. It's well balanced and usually on target. Just like that. It's not alarmist. It seems fairly certain that as long as Symantec et. al. do their thing, we will be able to watch the superbowl in peace. [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

darknet people - ddos detection
by Gadi Evron 25 Jan '06

25 Jan '06

Can we all please take a look at RCN.COM/.NET to see if they are being DDoS'd as retribution for the massive SP and LEO operations going to mitigate this risk of fast becoming millions of infected machines about to be destroyed? We'd appreciate any help given, thanks. Gadi.

1 0

Re: BGP route flap damping
by Kotikalapudi Sriram 25 Jan '06

25 Jan '06

1 0

Split flows across Domains
by Glen Kent 25 Jan '06

25 Jan '06

Hi, Are there any ISPs that do, or desire, splitting traffic across different ASes for prefixes learnt via an exterior gateway protocol (say BGP)? For example, an ISP can learn two different equal cost routes to a foo.com server via two different autonomous domains. It can thus split different flows (based on src-dest IP, src-dest Port, TOS, etc) across these two paths. Do operators currently do this? Folks can send me replies offline in case this constitues a "trade secret"! Thanks, Glen

7 13

NANOG 36 (Dallas)
by Carol Wadsworth 25 Jan '06

25 Jan '06

If you are planning to attend NANOG 36, hosted by Yahoo! in Dallas, Feb. 12-15, please note the upcoming deadlines: Friday, January 27: the discounted group room rate at the Fairmont Hotel-Dallas expires. Monday, January 30: the meeting registration fee will increase $50. For additional meeting details, please see www.nanog.org See you there!

1 0

Terminal server problem
by Kim Onnel 25 Jan '06

25 Jan '06

Hi, I got a CCM1650 Avocent terminal server, if i use windows to login to their console, upon hitting enter, the password prompt is bypassed because another enter is also hit, so i get a wrong password everytime. But if i do the same from a linux machine, that doesnt happen and i get to log in fine, which tells me that windows telnet is the problem, but i dont know which knob i need to fix ? Microsoft Telnet> set ? bsasdel Backspace will be sent as delete crlf New line mode - Causes return key to send CR & LF delasbs Delete will be sent as backspace escape x x is an escape charater to enter telnet client prompt localecho Turn on localecho. logfile x x is current client log file logging Turn on logging mode x x is console or stream ntlm Turn on NTLM authentication. term x x is ansi, vt100, vt52, or vtnt Avocent CCM1650 S/W Version 2.1 Username: noc Password: ************ Authentication Complete (DEC-VT100) Connected to Port: 1 9600,8,N,2,NONE Login: cisco password: login incorrect Login: cisco password: login incorrect Login:

2 1