April 2009 - Test - lists.nanog.org

Re: AS6079
by Colin Alston 07 Apr '09

07 Apr '09

On 2009/04/07 03:33 PM Chris Jackman wrote: > On Tue, Apr 07, 2009 at 11:53:07AM +0200, Colin Alston wrote: >> I've reported spam to this AS before, and I don't recall ever getting a >> response. >> >> I'm wondering how many others see spam from it? Is it worth while >> continuing or should I just stop accepting SMTP from there? >> >> They seem to have some dubious customers hosted on there, a large amount >> seems to come from the domain mailiz.biz and out of idealhosting.com > > > I've replied offlist. This is being addressed. > Thank you Chris. Apologies for my assumption based on the silence :)

1 0

shipping pre-built cabinets vs. build-on-site
by Joe Abley 07 Apr '09

07 Apr '09

Hi all, Anybody here have experience shipping pre-built cabinets, with ~20U of routers and servers installed, connected and tested, to remote sites for deployment? The idea is to increase the consistency of the deployments by having them all built in one place by the same set of people, and to reduce the amount of time required by warm bodies on-site (bodies that would otherwise have to receive individual components and install/cable them). We've located a few vendors who sell shock-tolerant cabinets, but they're expensive and seem to me to be aimed at people who need to ship a set of equipment frequently (e.g. to support movie shoots, outside broadcasts, etc), rather than people who want to ship just once. The destination in all cases would be a commercial, modern data centre. The equipment would be shipped from LA. Do I even need to spend time wondering about shock-tolerant cabinets, or should I instead be concentrating on finding the right company to wrap the cabinets for shipping, and to do the shipping itself? Joe

15 16

AS6079
by Colin Alston 07 Apr '09

07 Apr '09

I've reported spam to this AS before, and I don't recall ever getting a response. I'm wondering how many others see spam from it? Is it worth while continuing or should I just stop accepting SMTP from there? They seem to have some dubious customers hosted on there, a large amount seems to come from the domain mailiz.biz and out of idealhosting.com

1 0

Re: shipping pre-built cabinets vs. build-on-site
by Chaim Rieger 06 Apr '09

06 Apr '09

Hergo (1) did this for me a few times, they are out of ny though, and ship freight only. YMMV 1 www.hergo.com Sent via BlackBerry from T-Mobile

1 0

eGLOP and/or 232/8 question (SSM)
by Ryan Landry 06 Apr '09

06 Apr '09

i apologize if this has been discussed...searching mboned/nanog/ietf/arin/etc archives doesn't give me the clarification i hoped for. is there a defined method to request eGLOP space? does anyone really care what people use internally for mcast? i see mr. eubanks submitted a proposal back in 2007 for eGLOP assignment process and ARIN shot it down, but i can't seem to find current status. i've exhausted my 233/8 space and i'm moving to SSM (iptv). SSM is defined as 232/8, but is using that really necessary (technicalities aside)? if i do indeed move to 232/8, would it make the most sense to have my sources live in publicly assigned space for possible advertising in the future? mostly looking for what others have done as best-practice and future-proofing here... thanks kindly for on/off-list replies. ryanL iptv guy

2 1

Postel Network Operator's Scholarship nominations now open
by Robert Seastrom 06 Apr '09

06 Apr '09

[Sent to multiple lists; apologies for the duplicates] On behalf of the North American Network Operators Group (NANOG) and the American Registry for Internet Numbers (ARIN), I would like to take this opportunity to draw your attention to the 2009 Postel Network Operator's Scholarship. The Postel Network Operator's Scholarship targets personnel from developing countries who are actively involved in Internet development, in any of the following roles: * Engineers (Network Builders) * Operational and Infrastructure Support Personnel * Educators and Trainers Successful applicants will be provided with transportation to and from the NANOG/ARIN joint meeting in autumn, and a reasonable (local host standard) allowance for food and accommodation. In addition, all fees for participation in the conferences, tutorials, and social events will be waived. The final grant size is determined according to final costs and available funding. Successful applicants will be advised at least 2 months prior to the fall meeting date. Applications from qualified individuals are now being accepted. The deadline for application is 1 June 2009, and the awardees will be informed by 3 July 2009. To apply for the fellowship please read http://www.nanog.org/scholarships/postel.php and submit your application via email to PostelNOS(a)nanog.org. Kind regards, -Rob Seastrom, on behalf of the Postel Scholarship Selection Committee

1 0

ISC DLV
by Marcelo Gardini do Amaral 05 Apr '09

05 Apr '09

Guys, are you having problems to validate DNSEC using ISC DLV? Regards, -- Marcelo Gardini do Amaral www.spin.blog.br -- $>cd /pub $>more beer

7 8

Wow, just when you though big government was someone else's problem
by Jeff Young 05 Apr '09

05 Apr '09

This comes from Lauren Weinstein's list and it's worth a read. It's a bill introduced into legislation, who knows where and when and if it will become law but, wow. http://lauren.vortex.com/Cyber-S-2009.pdf I'll just give you a teaser: SEC. 9. SECURE DOMAIN NAME ADDRESSING SYSTEM. 3 (a) INGENERAL.—Within 3 years after the date of 4 enactment of this Act, the Assistant Secretary of Com- 5 merce for Communications and Information shall develop 6 a strategy to implement a secure domain name addressing 7 system. The Assistant Secretary shall publish notice of the 8 system requirements in the Federal Register together with 9 an implementation schedule for Federal agencies and in- 10 formation systems or networks designated by the Presi- 11 dent, or the President’s designee, as critical infrastructure 12 information systems or networks. 13 Other pearls of wisdom: the government will license all "cyber" security folks and you don't work on government or "any network deemed by the president to be critical infrastructure" without one. If only we knew: to achieve a secure DNS all you need to do is publish a notice in the Federal Register. jy

8 11

Spoofer project update
by Robert Beverly 05 Apr '09

05 Apr '09

Hi, as many of you are acutely aware, IP source spoofing is still a common attack vector. The ANA spoofer project: http://spoofer.csail.mit.edu first began quantifying the extent of source verification in 2005. We've amassed several years worth of data -- data that has become particularly interesting in light of recent attacks. However, our data raised as many questions as it answered. Hence, we have developed a new version of the tester designed to answer these questions and improve our Internet-wide inferences. What's New: In addition to new tests, we've hooked into CAIDA's Ark infrastructure which allows us to perform multiple path-based measurements. This information is presented to the client now in visual form; see the screenshots for an example report: http://spoofer.csail.mit.edu/example/example.php How you can help: Simple -- take a few minutes to download and run the tester. The more points you can run the tester from, the better. Comments/Flames: Welcome, and we appreciate all feedback. Be sure to read the FAQ: http://spoofer.csail.mit.edu/faq.php Many thanks, rob

2 1

Re: Nipper and Cisco configuration results
by Subba Rao 05 Apr '09

05 Apr '09

I did see a few false positives too with Nipper. What do you think about Router Audit Tool (RAT) instead? I downloaded ncat (aka RAT), but it does not have a global configuration file which I can use for all the routers and switches I have. Any tips on ncat/RAT configuration? I could not find any examples on using ncat. Subba Rao --- On Fri, 4/3/09, Christopher <chrismcc(a)pricegrabber.com> wrote: From: Christopher <chrismcc(a)pricegrabber.com> Subject: Re: Nipper and Cisco configuration results To: "nanog" <nanog(a)nanog.org> Date: Friday, April 3, 2009, 12:36 PM On Thu, 2009-04-02 at 15:33 -0700, Subba Rao wrote: > I am using Nipper for verifying my Cisco configuration. Nipper is > finding the "rlogin" service that is not in the configuration. I have > searched the access lists and do not see it anywhere. The explanation > by Nipper about this finding, "....Telnet protocol implemented by this > service...." is confusing. The problem, IMHO, is nipper. You might or might not have the rlogin service enabled, but nipper has so many false positives I find is almost useless. In my case, it caught some obvious things I had forgotten to do, but everything else was useless. For instance from the nipper source code: struct vulnerability report_vuln_ios11 = {9, 0, 0, 12, 4, 0, "CVE-2007-0479", "22208", "IPv4 TCP listener denial of service", true, false, vuln_req_none, false, &report_vuln_ios12}; What the above means to nipper is any IOS version 12.0.x, 12.1.x, 12.2.x, 12.3.x is vulnerable, while every 12.4.x version is OK. This is obviously false on *both* counts. http://www.cisco.com/en/US/products/products_security_advisory09186a00807cb… I spent a lot of time trying to explain this to $corporate audit guy that had never even logged into a router, let alone had to choose a stable IOS version for 6500/7600 class hardware. > Here is the Nipper's output: > <snip> > Thank you in advance for any help. > > Subba Rao -- Christopher McCrory "The guy that keeps the servers running" chrismcc(a)pricegrabber.com http://www.pricegrabber.com To the optimist, the glass is half full. To the pessimist, the glass is half empty. To the engineer, the glass is twice as big as it needs to be.

3 2