May 2008 - Test - lists.nanog.org

Re: amazonaws.com?
by Robert Bonomi 26 May '08

26 May '08

> From: "Suresh Ramasubramanian" <ops.lists(a)gmail.com> > Subject: Re: amazonaws.com? > > On Mon, May 26, 2008 at 1:28 PM, Colin Alston <karnaugh(a)karnaugh.za.net> > wrote: [[.. sneck ..]] > With respect, in such cases, amazon is better off firewalling outbound > port 25 (or indeed, outbound anything at all) for accounts that dont > specifically ask for it. Quite a lot of EC2 compute time is for > number crunching and such - not just hosting, or email, or .. I'm hard-pressed to think of a single letigimate use for a _compute_ cluster that requires outgoing access to more than a handful (i.e. an _itemizable_ list) of machines. Am I missing something obvious? If not, such a "block all outgoing, except for listed exceptions" policy could be 'trivially' implemented with an extra list field on the sign-up form, coupled with automated transformation into firewall rules.

1 0

amazonaws.com?
by Barry Shein 26 May '08

26 May '08

10 14

Same AS number from different location and Migration of IP addresses
by devang patel 26 May '08

26 May '08

Hello, Is that okay to use Same AS number for the two different site on different location? as well as any good documentation or link or deployment scenario where I can find the merging of two different AS into one AS? As well as what to do if I have an IP addresses as a service provider dependent block and want to migrate IP addressing to the IANA assigned ip addresses? how can i achieve that? regards Devang Patel

8 10

Re: [NANOG] IOS rootkits
by Paul Ferguson 25 May '08

25 May '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Dragos Ruiu <dr(a)kyx.net> wrote: >The question this presentation begs for me... is how many of the folks >on this list do integrity checking on their routers? > >You can no longer say this isn't necessary :-). > >I know FX and a few others are working on toolsets for this... > >I'll probably have other comments after I see the presentation. >This development has all sort of implications for binary signing >requirements, etc... Yep -- I'd say just wait for the presentation (assuming Cisco doesn't go after this guy like they did Mike Lynn) and then determine the level of seriousness. It would appear to have people very nervous, however. Including Cisco. It will be interesting to see what develops. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFILlgzq1pz9mNUZTMRAtmoAKC3bQLSqJzFDZklPMfdnkBX7fyccwCeN5mc K1QQ9JnTqLmSfcNuj5JZ6Z8= =W5F0 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

15 35

Same AS number from different location
by devang patel 25 May '08

25 May '08

Hello, Is that okay to use Same AS number for the two different site on different location? as well as any good documentation or link or deployment scenario where I can find the merging of two different AS into one AS? As well as what to do if I have an IP addresses as a service provider dependent block and want to migrate IP addressing to the IANA assigned ip addresses? how can i achieve that? regards Devang Patel

2 1

[NANOG] An account of the Estonian Internet War
by Gadi Evron 24 May '08

24 May '08

About a year ago after coming back from Estonia I promised I'd send in an account of the Estonian "war". The postmortem analysis and recommendations I later wrote for the Estonian CERT are not yet public. A few months ago I wrote an article for the Georgetown Journal of International Affairs, covering the story of what happened there, in depth. The journal owns the copyright so I had no way of sending that along either. I wasn't about to email saying "go buy a copy". Mostly silly articles kept popping up with misguided to wrong information about what happened in Estonia, and when an Estonian student was arrested for participating, some in our community even jumped up to say "it was just some student". Ridiculous. This is the "war" that made politicians aware of cyber security and entire countries scared, NATO to "respond" and the US to send in "help". It deserved a better understanding for that alone, whatever actually happened there. I was there to help, but I just deliver the account. The heroes of the story are the Estonian ISP and banking security professionals and the CERT (Hillar Aarelaid and Aivar Jaakson). Apparently the Journal made my article available in PDF form by a third party: Battling Botnets and Online Mobs Estonia's Defense Efforts during the Internet War URL: http://www.ciaonet.org/journals/gjia/v9i1/0000699.pdf It is not technical, I hope you find it useful. Gadi Evron.

2 1

Re: OT: problems getting to our net in maroc
by Randy Bush 24 May '08

24 May '08

thanks all. MT seems to have fixed it. randy

1 0

OT: problems getting to our net in maroc
by Randy Bush 24 May '08

24 May '08

apologies for operational content. pfs and i are debugging access to/from the afnog class network in rabat. the net is 196.200.216.0/21. for example route-views.oregon-ix.net>traceroute 196.200.216.102 Type escape sequence to abort. Tracing the route to 196.200.216.102 1 vl-51.uonet1-gw.uoregon.edu (128.223.51.2) [AS 3582] 0 msec 0 msec 4 msec 2 0.ge-0-1-0.uonet8-gw.uoregon.edu (128.223.3.8) [AS 3582] 0 msec 0 msec 0 msec 3 eugn-car1-gw.nero.net (207.98.64.65) [AS 3701] 4 msec 0 msec 0 msec 4 eugn-core1-gw.nero.net (207.98.64.168) [AS 3701] 0 msec 0 msec 4 msec 5 eugn-core1-gw.nero.net (207.98.64.168) [AS 3701] !H * * route-views.oregon-ix.net>sh ip bg 196.200.216.102 | i 3701 i.e. nero net does not have our prefix. but others do, for example, from the net here i can ping home no prob. rmac.psg.com:/Users/randy> ping psg.com PING psg.com (147.28.0.62): 56 data bytes 64 bytes from 147.28.0.62: icmp_seq=0 ttl=46 time=257.398 ms 64 bytes from 147.28.0.62: icmp_seq=1 ttl=46 time=285.779 ms --- psg.com ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 257.398/271.589/285.779/14.191 ms rmac.psg.com:/Users/randy> traceroute psg.com traceroute to psg.com (147.28.0.62), 64 hops max, 40 byte packets 1 196.200.217.254 (196.200.217.254) 3.040 ms 1.686 ms 1.720 ms 2 ll81-2-205-33-192-81.ll81-2.iam.net.ma (81.192.33.205) 2.875 ms 3.049 ms 4.112 ms 3 172.20.2.31 (172.20.2.31) 4.497 ms 4.195 ms 2.973 ms 4 ppp-17-3-217-212.dialup.iam.net.ma (212.217.3.17) 5.700 ms 3.043 ms 3.012 ms 5 pal9-maroc-telecom-15.pal.seabone.net (195.22.197.161) 83.778 ms 82.221 ms 86.066 ms 6 ash2-new11-racc3.new.seabone.net (195.22.216.205) 145.379 ms 281.139 ms 146.080 ms 7 nttverio-1-us-ash2.ash.seabone.net (195.22.206.30) 162.111 ms * * 8 ae-2.r20.asbnva01.us.bb.gin.ntt.net (129.250.2.56) 152.031 ms 148.205 ms * 9 as-0.r20.snjsca04.us.bb.gin.ntt.net (129.250.4.21) 224.672 ms 224.431 ms 229.258 ms 10 p64-0-0-0.r20.sttlwa01.us.bb.gin.ntt.net (129.250.4.22) 245.879 ms 247.197 ms 242.687 ms 11 p16-0-0-0.r05.sttlwa01.us.bb.gin.ntt.net (129.250.3.11) 241.235 ms 242.230 ms 241.175 ms 12 p1-0.psg.sttlwa01.us.bb.gin.ntt.net (129.250.11.42) 246.562 ms 241.192 ms 246.050 ms 13 psg.com (147.28.0.62) 232.241 ms * * we suspect multiple bugs, bad filters within maroc telcom and poor propagation of announcements of our prefix. a pingable target here is 196.200.216.102 until i leave in three hours or so. randy

1 0

Re: Hauling gear around a NANOG meeting
by Martin Hannigan 24 May '08

24 May '08

We're in the Marriot, not a crack house. And it's NYC, not Sao Paolo. I think my friend Dave needs to actually spend some time in New York City. :). Don't buy any bridges. And if you're driving, stay off the cross Bronx Expresseway. It's moidah during rush hour. -M< ----- Original Message ----- From: Paul Wall <pauldotwall(a)gmail.com> To: Joe Maimon <jmaimon(a)ttec.com> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Thu May 22 18:07:48 2008 Subject: Re: Hauling gear around a NANOG meeting I've not been to the conference myself, but I hear laptop and charger is a good plan. Following the advice of our host, David Diaz (Telx), care should be exercised to make sure your laptop bag does not have the text "LAPTOP" printed on it, as that would make it a target for thieves. Additionally, don't wear white iPod earbuds, as that will likely lead to you getting mugged on the subway, or zapped by lightning in Central Park. Paul On Thu, May 22, 2008 at 1:07 PM, Joe Maimon <jmaimon(a)ttec.com> wrote: > Looking for some advice for a first-timer. > > What are your recommendation regarding gear? > > - laptop and charger only > > - laptop with small bag > > - the whole normal kit&caboodle, wheeled backpack thing > > Thanks, > > Joe > >

16 18

[NANOG] Limiting ICMP
by Drew Weaver 23 May '08

23 May '08

Hi there, I'm wondering if anyone else has run into this/has heard of/(is responsible for)/knows the reason behind large IP providers limiting ICMP on outbound connections to the same amounts regardless of the size of the circuit? Apparently after one of our upstream providers switched to Juniper for some of their equipment their engineers recommended that they limit ICMP on all customer facing connections to 5mbps. I understand that preventing DDoS is important but why A) would they apply the same rule to our OC-48 that they apply to someone else's T1/DS-3 and B) why is that a requirement for Juniper gear? (do people still DDoS with ICMP these days? I see a lot of what looks like udp.pl and hardly any ICMP attack traffic anymore) Sorry as usual if i'm off-topic. -Drew

5 4