November 2008 - Test - lists.nanog.org

DOS attack assistance?
by Pete Templin 27 Nov '08

27 Nov '08

One of my customers, a host at 64.8.105.15, is feeling a "bonus" ~130kpps from 88.191.63.28. I've null-routed the source, though our Engine2 GE cards don't seem to be doing a proper job of that, unfortunately. The attack is a solid 300% more pps than our aggregate traffic levels. It's coming in via 6461, but they don't appear to have any ability to backtrack it. Their only offer is to blackhole the destination until the attack subsides. BGP tells me the source is in AS 12322, a RIPE AS that has little if any information publicly visible. Any pointers on what to do next? Thanks, Pete

7 7

Todd Young is out of the office.
by Todd_Young＠unigroupinc.com 27 Nov '08

27 Nov '08

I will be out of the office starting 11/26/2008 and will not return until 12/01/2008. I will respond to your message when I return. If you are having a network issue, please contact Network Operations at 1-800-825-9585, option 3. ######################################################################## The information contained in this message, and any attachments thereto, is intended solely for the use of the addressee(s) and may contain confidential and/or privileged material. Any review, retransmission, dissemination, copying, or other use of the transmitted information is prohibited. If you received this in error, please contact the sender and delete the material from any computer. UNIGROUPINC.COM ########################################################################

1 0

Re: IPv6 routing /48s
by Mark Andrews 26 Nov '08

26 Nov '08

Mark Andrews writes: > > In message <20081126002425.GO78345(a)burnout.tpb.net>, Niels Bakker writes: > > * alh-ietf(a)tndh.net (Tony Hain) [Wed 26 Nov 2008, 01:03 CET]: > > > In any case, content providers can avoid the confusion if they simply put > u > > p > > > a local 6to4 router alongside their 2001:: prefix, and populate DNS with > > > both. Longest match will cause 2001:: connected systems to chose that dst > , > > > while 6to4 connected systems will chose 2002:: as the dst. There is no ne > ed > > > > Huh? Longest match done by web browsers and other applications? Since > > when? > > FreeBSD 6 has is as part of the standard getaddrinfo() implementation. > > % grep -r in6_addrpolicy /usr/src/lib/libc > /usr/src/lib/libc/net/getaddrinfo.c: struct in6_addrpolicy pc_policy; > /usr/src/lib/libc/net/getaddrinfo.c: struct in6_addrpolicy *pol, *ep; > /usr/src/lib/libc/net/getaddrinfo.c: ep = (struct in6_addrpolicy *)(buf + > l); > /usr/src/lib/libc/net/getaddrinfo.c: for (pol = (struct in6_addrpolicy *)b > uf; pol + 1 <= ep; pol++) { > /usr/src/lib/libc/net/getaddrinfo.c: struct in6_addrpolicy *pol; > /usr/src/lib/libc/net/name6.c: struct in6_addrpolicy pc_policy; > /usr/src/lib/libc/net/name6.c: struct in6_addrpolicy *pol, *ep; > /usr/src/lib/libc/net/name6.c: ep = (struct in6_addrpolicy *)(buf + l); > /usr/src/lib/libc/net/name6.c: for (pol = (struct in6_addrpolicy *)buf; pol > + 1 <= ep; pol++) { > /usr/src/lib/libc/net/name6.c: struct in6_addrpolicy *pol; > % And it was added on 30-Oct-03 according to CVS. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews(a)isc.org

2 2

Black Friday or Cyber Monday
by Fisher, Shawn 26 Nov '08

26 Nov '08

To all the service providers out there, do you historically see a significant uptick in internet traffic on "Black Friday" <http://en.wikipedia.org/wiki/Black_Friday_(shopping)> (the Friday after the US Holiday of Thanksgiving, named supposedly due to retail companies going from in the "red" all year to "black", bottom-line, "normally" lots of shopping occurs both online and traditional) and Cyber Monday <http://en.wikipedia.org/wiki/Cyber_Monday> ? I am curious what percentages of change are typically seen? TIA, Shawn Fisher

1 0

ip access-list e no-nanog-bs (Was Re: Public Assertions)
by jamie rishaw 26 Nov '08

26 Nov '08

These guys need to get a room already. It's clear that the two bills have forgotten that "No U r !!!1" arguments happen on efnet; nanog@ is reserved strictly for "Are any engineers from [insert_company_who_blacklisted_my_company_here] around?" pages. All three of these boys are acting like drama queens[1] : dash-bill, dash-dash-bill and macgyver too for taking a picture of a piece of snail mail so you could post it on a nerdlist. | Bill Woodcock / 5:52 PM | On Tue, 25 Nov 2008, Dean Anderson wrote: | > A photo of Bill Woodcock's refused letter is at [irrelevant] | | Oh my god... What _is_ that sitting on? Is your desk upholstered with the hides of your victims? Soo.. How do I configure my rooter for that? gw(config)#ip drama enable ^ % Invalid input detected at '^' marker. Computer says no........... -j [1] professional history and credentials upon request On Tue, Nov 25, 2008 at 7:18 PM, Jim Popovitch <yahoo(a)jimpop.com> wrote: > On Tue, Nov 25, 2008 at 18:52, Bill Woodcock <woody(a)pch.net> wrote: > > On Tue, 25 Nov 2008, Dean Anderson wrote: > > > A photo of Bill Woodcock's refused letter is at > > > http://www.av8.net/BillWoodcock.jpg > > That's not a refused letter, that's a certified letter that hasn't yet > been mailed. When refused, the item is signed and stamped (in red > ink) by the postal delivery agent. It would be very interesting to > see the image of the other side of the envelope (where postage > stamp/payment info would appear). > > That said... this whole thing has an air of childishness associated with > it. > > -Jim P. > > -- Jamie Rishaw // .com.arpa@j <- reverse it. ish. [Impressive C-level Title Here], arpa / arpa labs

1 0

Re: Public Assertions
by Bill Woodcock 25 Nov '08

25 Nov '08

On Tue, 25 Nov 2008, Dean Anderson wrote: > A photo of Bill Woodcock's refused letter is at > http://www.av8.net/BillWoodcock.jpg Oh my god... What _is_ that sitting on? Is your desk upholstered with the hides of your victims? Also, I suggest you consult a dictionary. The word "refused" does not mean what you think it does. Amusing as this may be, I'm not sure that you need to bother the vast herd of NANOG co-conspirators with it. -Bill

2 1

The DDOS problem & security BOF: Am i mistaken?
by Scott Doty 25 Nov '08

25 Nov '08

First, the good news: so far, the NANOG conference has been very valuable and content-rich, covering a lot of issues that need to be discussed. For that, I am grateful. But now, the bad news(?): Maybe it's just me & my paranoia, but do I detect an inkling of "murk spam" going on with some presentations? Because there seems to be a fundamental misunderstanding, either on my part, or the part of certain vendors: I'm hear to discuss ideas & freely share them, and they are here to discuss (it would seem) their products. Sometimes both goals coincide, and that is fine...but... When a vendor at the security BOF starts showing documents that are "company confidential", and trying to whip up a climate of fear, that we should all deploy their product in front of our recursive name servers, i get this funny feeling that I am being "murk spammed". Perhaps that is my own perspective (& paranoia?), but I found the CERT gentleman's call to monitor icmp backscatter on our authoritative nameservers far more informative -- and open. But I was disappointed with two vendors and their presentations: the first had the tactic of saying "DNSSEC is the actual solution" when asked about why their product would be necessary...completely ignoring the fact that their proprietary "interim solution" was by no means the only way to prevent cache poisoning attacks. Indeed, I would daresay it isn't the best, either by a BCP perspective, or a cost analysis perspective. To put a finer point on this, i should say that i found myself discomforted by a presentation suggesting that I should put their proprietary appliances between my recursive name servers & the Net, and I am grateful that Mr. Vixie stood up and said that there are other ways of dealing with the problem. Then there was the gentleman with the DDOS detection/mitigation appliance, who flipped through several graphs, which were intended to show the number of each type of attack. It's unfortunate that there wasn't more time for questions, because I really wanted to ask why "http GET" and "spidering" attacks weren't listen on their graphs...more on that in a second. Fortunately, said vendor had a table at "beer and gear", so I was able to talk with one of their representatives -- and learned that they have just as much trouble with automatic detection of attacks designed to look like a "slashdotting"...which cleared up the mystery as to why it wasn't on the graphs. Because this is a real problem: anybody, with sufficient knowledge & preparation can vandalize _anybody's_ network. Showing me a graph that ping floods happen all the time doesn't impress me -- what would impress me is going over the actual methods, algorithms (and heuristics?) used in these attack mitigation appliances. Because, the "best" attack mitigation appliance vendor would seem to have 100% of their market, and thus, charge exhorbant prices for their product(s). When I brought this up with Mr. Vendor, his first reaction was to point out that the cost was less than a home-grown solution. When I raised the question of open source software to do the same thing, his reaction was to ask: "oh? who's going to write it?" And that right there would seem to be a bit of bravado, perhaps fueled by a misunderstanding of the role that FOSS has played on the Net. Fortunately -- and again, I am grateful for this -- the ISC was represented in the security BOF, presenting the SIE concept...as well as what applications _already exist_ to detect and mitigate various attacks. One demonstration that blew me away: detecting a botnet being set up for a phishing attack...and preventing the attack before it even started. So in conclusion, I'll say this: the last NANOG I attended was NANOG 9 -- and i remember that being a more challenging environment for vendors. Probably the biggest problem discussed back then was head-of-line blocking on a vendor's switches. _That_ is the kind of content that i have found valuable, both on this list, and at a conference. And so: If I weren't so knock-kneed in public venues, I would probably be doing what i would like to call on conference participants to do: if someone gives a presentation that includes their own proprietary black-box "solution", I think the best benefit for NANOG would be to point out alternatives. -Scott p.s. sorry for the long post.

17 22

AS34012 Contact
by Seth Mattinen 25 Nov '08

25 Nov '08

I'm looking for a contact within AS34012 (Parc Productions Webdesign) in regards to reachability issues from AS11170. The problem feels like 34012 is not seeing a route back to me. I can see 217.195.112.0/20, but as soon as any of my traffic hits 34012, it goes into a black hole. ~Seth

1 0

BCP for Private OUI / address assignments?
by mike 25 Nov '08

25 Nov '08

With the increasing use of virtual machines in my environment, I am needing more and more unique mac addresses to assign to the many virtual Ethernet devices I have attached and visible to my non-virtual physical network. The problem of course is that I don't have an IEEE OUI and therefore can't generate guaranteed to be unique addresses, and while the possible address space is quite large, it occurs to me that there should be something - ala rfc 1918 - for this kind of situation. For now however, I just want to know if anyones got something better than 'pick an oui out of the air' or 'pick an old dead manufacturer oui', or worse, 'pick old 10base2 network cards and destroy them, saving the mac'. In the future however, I think there's going to need to be some sort of extension or modification to dhcp to accomodate virtual machines in this regard (of not having a manufacturer assigned addresses for the virtual ethernets). Mike-

6 5

Last 3 days: 1st Workshop LMPCNA in ICNS 2009 | April 21-25, 2009 - Valencia, Spain
by LMPCNA Advisory Committee 25 Nov '08

25 Nov '08

INVITATION Please consider to contribute to and/or forward to the appropriate groups the following opportunity to submit and publish original scientific or educational results. ============== LMPCNAP 2009 | Call for Papers =============== CALL FOR PAPERS, TUTORIALS, PANELS The first International Workshop on Learning Methodologies and Platforms used in the Cisco Networking Academy (CNA), LMPCNA 2009 will be held during ICNS 2009 in April 21-25, 2009 - Valencia, Spain General page: http://www.iaria.org/conferences2009/LMPCNAP.html Submission deadline: November 28, 2008 Submissions will be peer-reviewed, published by IEEE CPS, posted in IEEE Digital Library, and indexed with the major indexes. Extended versions of selected papers will be published in IARIA Journals: http://www.iariajournals.org Workshop Special Areas, but not limited to, are (details in the CfP on site): New learning methodologies Blended learning Online laboratories Virtual laboratories Remote laboratories Learning strategies to enhance online courses Learning content adaptation for blended learning Learning platforms and their compatibility with cisco.netacad.net ================= LMPCNA Advisory Committee Emma Bluck, Cisco Systems, Inc./Cisco Networking Academy, Europe Giuseppe Cinque, Consorzio Elis, Italy Marco Cobb, Cisco Systems, Inc., Switzerland Petre Dini, Cisco Systems, Inc., USA / Concordia University, Canada Dennis C. Frezzo, Network Academy Learning Systems Development / Cisco Systems, Inc., USA Elaine Lawrence, University of Technology - Sydney, Australia Bernardo Leal, Universidad Sim�n Bol�var, Venezuela Jaime Lloret Mauri, Polytechnic University of Valencia, Spain Kerry-Lynn Thomson, Cisco Academy Training Centre/Nelson Mandela Metropolitan University, South Africa Donna Wright, Cisco Systems, Inc./Cisco Networking Academy, USA LMPCNA 2009 General Chair Rafael Tomas, Cisco Academy Training Center (CATC), Spain LMPCNA 2009 Technical Program Committee Chair: Tomeu Serra, Universitat de les Illes Balears, Spain Carlos Alves, Instituto Politecnico de Castelo Branco, Portugal Joan Arnedo, Universitat Oberta de Catalunya, Spain Emma Bluck, Cisco Systems, Inc./Cisco Networking Academy, Europe Doina Bucur, University of Aarhus, Denmark Giuseppe Cinque, Consorzio Elis, Italy Marco Cobb, Cisco Systems, Inc., Switzerland Kristen Dicerbo, Cisco Learning Institute, USA Dennis C. Frezzo, Network Academy Learning Systems Development / Cisco Systems, Inc., USA Michael Furminger, Cisco Networking Academy, Cisco Systems, Inc., UK Gabriel Fuster, Cisco Networking Academy Program, Spain Feher Gyula, Budapest Polytechnic, Hungary Kevin Johnston, Cisco Networking Academy Program, USA Elaine Lawrence, University of Technology - Sydney, Australia Bernardo Leal, Universidad Sim�n Bol�var, Venezuela Thomas Meuser, IT-Bildungsnetz e.V., Germany Josep Prieto, Universitat Oberta de Catalunya, Spain Osama Saleh, National Telecommunication Institute, Egypt Mihai Stanciu, Cisco Networking Academy Program / UPB, Romania Edward Swenson, Cisco Systems, Inc., USA Kerry-Lynn Thomson, Cisco Academy Training Centre/Nelson Mandela Metropolitan University, South Africa Donna Wright, Cisco Systems, Inc./Cisco Networking Academy, USA ==================

1 0