February 2010 - Test - lists.nanog.org

Western Canada major outage last night?
by James Smallacombe 09 Feb '10

09 Feb '10

I rent a server with eSecureData in Vancouver. Their network became unreachable yesterday evening around 7:37 EST. They didn't come back online until about noon today, and have given this explanation on their voicemaik during the outage and via email afterward:: ---- STATUS REPORT There has been an unprecedented breakage in upstream fibre optic cables owned by Bell Canada that has caused a network interruption to all of Western Canada. We assure you that Bell has the full force of their network operations department on this issue, and we expect resolution of this issue shortly ---- I've not found any indication of this on bellcanada.ca or any news sites, and this list has been quiet on al things Canadian (I'm in PA, but my server's there). Can anyone verify or elaborate on this? Thanks, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

2 1

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations
by andrew.wallace 08 Feb '10

08 Feb '10

On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron <ge(a)linuxbox.org> wrote: > "That peer-review is the basic purpose of my Blackhat talk and the > associated paper. I plan to review Cisco’s architecture for lawful intercept > and explain the approach a bad guy would take to getting access without > authorization. I’ll identify several aspects of the design and > implementation of the Lawful Intercept (LI) and Simple Network Management > Protocol Version 3 (SNMPv3) protocols that can be exploited to gain access > to the interface, and provide recommendations for mitigating those > vulnerabilities in design, implementation, and deployment." > > More here: > http://blogs.iss.net/archive/blackhatlitalk.html > > Gadi. For the sake of clarity and transparency, Gadi Evron has absolutely no connection to this research whatsoever. He is famous in the security community for piggybacking off other peoples research. We are frustrated with him as much as we are annoyed. Andrew Security consultant

2 2

Adopt‐an‐Haitian‐Internet‐technician‐or‐facility
by Eric Brunner-Williams 08 Feb '10

08 Feb '10

All, Attached is a project description by Reynold Guerrier, Network Engineer and Treasurer of the Association Haïtienne pour le développement des technologies de l’Information et de la Communication (AHTIC). I know many have helped and many have offered to help, and kit and people have been sent, and are continuing to be sent, however there is an unmet need, the continuation of the "fuel, food, families" trio that kept the Boutilliers NAP powered and its surviving technical team intact. And the most effective aid is cash, which enables the recipients to prioritize according to their needs, and the bulk purchases of aid recipients proximal to them. The budget and resources for this project is as follows: o $100,000 for  salaries  to  support  technicians  and  their  family  to  get  them  back on track  o 5  content  production  units  o Production  software  o Management  software   o 10  data  center  in  a  box  The data centers in a box resource was identified by Reynold on the 19th, a week after the quake, when he wrote to NANOG: > We would like to provide to the haitian government a UC systems with several branches: > > o President office: 10 endpoints > o Prime Minister office: 10 endpoints > o 12 mayor city hall offices: 3 for each: 36 endpoints > o Ministries (9 differents locations 3 for each): 27 endpoints > o Communications Center: 20 endpoints > o emergency Clusters: 14 ednpoints > > Total: 117 endpoints > > So if someone can provide recommendations, equipment, skilled technician for that it would be fine. There is wire transfer information in the attached pdf, and if anyone finds that cumbersome drop me a note and we'll work something out. Yes, there are a lot of aid dollars going to Haiti, but dollars given to AHTIC will go specifically to re-build the network infrastructure and keep the families of the surviving engineers and technicians fed and their basic needs met. Thanks in advance, Eric

7 9

Re: Adopt‐an‐Haitian‐Internet‐technician‐or‐facility
by a.harrowell＠gmail.com 08 Feb '10

08 Feb '10

-original message- Subject: Re: Adopt‐an‐Haitian‐Internet‐technician‐or‐facility From: Steven Bellovin <smb(a)cs.columbia.edu> Date: 08/02/2010 5:47 pm As a matter of form, how might one check out the legitimacy of requests like this? (No, I don't think this one is fake...) As a start, web of trust. This one was introduced to the list by Eric Brunner-Williams originally, a member in good standing.

4 4

Wireshark Developer and User Conference
by Janice Spampinato 08 Feb '10

08 Feb '10

CACE Technologies hosts the third annual Wireshark Developer and User Conference at Stanford in June and extends an invitation to the NANOG community to participate in 3 days of knowledge-transfer with the Wireshark Developer Group, learning about, and helping to direct, product futures for the world’s most widely-deployed packet and network analyzer. http://www.cacetech.com/sharkfest.10/

1 0

NANOG newbie
by James Jones 08 Feb '10

08 Feb '10

Greetings, Hi, I have just recently returned to the United States from New Zealand. I have spent a bit of time down their working as a network designer for ALU and was a member of NZNOG. The infrastructure demands and designs are completely different here in U.S. I am currently working for a VoIP company in Springfield, MA. I was wondering if their might be someone in the area that might be able to help me get my bearings and might be able to give some insight into the BMI project in the area offlist? Thanks for your time. -- James Jones +1-413-667-9199 james(a)freedomnet.co.nz

2 2

Small Network Equipment Shipping boxes
by Andrew Konkol 07 Feb '10

07 Feb '10

Gurus, Where I work we ship our own gear. That being said, we've run out of 1U shipping boxes for cisco gear. I've searched the list archives, uline, as well as a few other shipping material websites and cannot find an acceptable shipping box with foam inserts. I would like a corrugated cardboard box with foam supports for shipping 1U cisco gear (3550s, 4948s, etc..) I was wondering if anyone has sourced a good shipping box? I apologize if this topic has been brought up before and my search didn't find the thread. Thanks, -a

4 3

How polluted is 1/8?
by Mirjam Kuehne 07 Feb '10

07 Feb '10

Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is. See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18 Please also note the call for feedback at the bottom of the article. Kind Regards, Mirjam Kuehne RIPE NCC

11 12

How common are wide open SIP gateways?
by Drew Weaver 07 Feb '10

07 Feb '10

Heya, Has anyone done any research or have any anecdotal numbers related to how common it is to have a SIP gateway sitting out on the Internet with no ACL or authentication? Recently we have noticed a couple of instances where we get abuse complaints from companies who claim that one of our hosting clients 'stole SIP service' from them. This reminds me somewhat of the 'SMTP open relay' days. We obviously take action and shut the offending user down but I can't help but wonder how common this practice is. Usually I just ask the company why their system allows anyone to use their SIP gateway and they usually say something like "We can't predict what IP our users will come in from... etc" I am just wondering if anyone else has noticed this trend. -Drew

9 10

Insecure Cable networks ?
by Jorge Amodio 06 Feb '10

06 Feb '10

Is it a common practice on cable network providers to leave access to the cable modem/router management web UI wide open ? Here is the scoop. I heard about it but didn't experienced it hands on or seen myself until recently when I was testing one of the embedded TCP/IP boards I produce which as many other IP gadgets has a mini HTTP server which I access just typing the IP address of the thing. In my home lab an IPv4 address on 10/8, not very uncommon I screwed up and made a typo on the IP address and ended on a different device web UI, an Ambit cable modem Hmmm my modem is from Toshiba, I tried the default factory password, it worked !!, not only that, this thing is several cities hundreds of miles away from here .. ehhh ? fired nmap, tried several 10/24 networks and just playing by hand found hundreds of devices and every single one I tried default password it worked, not only modems, also modem/routers and some with integrated VoIP where if I wanted I would have been able to change provisioning configuration, channel scanning, browse through the call manager logs and see who's calling or being called, etc. Isn't this a huge security hole ? It wont take much for a kiddie to write a very simple script to drive crazy the noc guys taking down pieces of the network here and there ... If a grownup from TWC/RR wants to get more specifics feel free to contact me. Regards

4 4