April 2010 - Test - lists.nanog.org

Major additions to Team Cymru's Bogon Feed
by Tim Wilde 12 Apr '10

12 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings everyone! Team Cymru is pleased to announce a significant addition to our bogon reference project. The new portions of the project are offered at no cost to the community, and the original bogon lists and feeds are not being changed or canceled, just augmented. The new "fullbogon" feed includes prefixes allocated to RIRs, but not assigned by the RIRs to end-users, ISPs, etc, providing a more complete view of the unassigned space that should not be seen on the Internet. This new service is therefore more granular than the original feed, including a wide variety of non-routable prefixes as well as unassigned prefixes. We're also making IPv6 bogons available in these new feeds. If you're interested in receiving the new "fullbogon" feeds via BGP, simply e-mail bogonrs(a)cymru.com with your ASN, peering IP addresses and whether you use MD5 authentication. See an overview in the 46th episode of Team Cymru's 'The Who and Why Show' at www.youtube.com/teamcymru, as well as a more basic overview in episode 12. For a more detailed explanation of all the ways you can track the bogons, see the newly-updated bogon reference pages at: http://www.team-cymru.org/Services/Bogons/ Even more so than the original feed, there are significant changes to the fullbogons lists every day and the feed automatically recalculates the prefixes as they are allocated from the regional registries, so make sure you are able to regularly update your lists. Internet security is all about "the other guy." If one sizeable network is insecure, it WILL be used to abuse other networks. We look forward to continuing to help our community to secure the edge. Best regards, Tim Wilde, for Team Cymru - -- Tim Wilde, Senior Software Engineer, Team Cymru, Inc. twilde(a)cymru.com | +1-630-230-5433 | http://www.team-cymru.org/ -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkvDOPMACgkQluRbRini9tg0JACfSKs3TaNgACE9LEdbbjYY8/JS +DIAnjbFISSHMVfqe512mi70FQ6tQA+6 =0OAO -----END PGP SIGNATURE-----

1 0

Re: Carrier class email security recommendation
by Joel M Snyder 12 Apr '10

12 Apr '10

>I am in the process of sourcing for a carrier class email security >solution that will replace our current edge spam gateways based on open >source solutions. Some solutions that am currently considering are >Ironport, Fortinet Fortimail, MailFoundry and Barracuda. A lot of the answer depends on what you think of as "carrier class." Generally, I would consider a carrier-class device to have a couple of attributes that are different from a typical enterprise-class device: Quarantine: carrier class: no (enterprise: maybe) Per-user settings: carrier class: no (enterprise: maybe) False positive rate: carrier class: very very low (enterprise: very low) False negative rate: carrier class: low (enterprise: very low) Performance: carrier class: critical (enterprise: important) In other words, I think of a carrier-class product as something that sits in the mail stream and does a good job of blocking spam, but is setup so that no one needs to talk about it. You don't want to get a stream of false-positive reports, but you are willing to let some spam through in order to avoid help desk calls. The goal of this product is mostly to keep your mail servers happy, and as a secondary goal, keeps the users happy. You could have a second level of anti-spam protection, something more Postini-esque, which is carrier-sized but has a lot more user interaction and user settings, for people who want to get premium anti-spam protection. But that's more an enterprise product that scales up, which is subtly--but importantly--different from a carrier product. We test anti-spam products for efficacy (essentially FP & FN performance), less so for performance. If you are looking at Ironport, then you want to ask them about the Cloudmark anti-spam engine. It is a "carrier-focused" engine, and you'll find that the pricing is MUCH better than their own engine once you get to large numbers of users. In fact, I believe that they added the Cloudmark engine specifically to address queries like yours--people who like the product architecture, but are turned off by the licensing. With Cloudmark inside, you get the same product flow and features, but a less expensive engine good for large ISPs. In terms of speed, the obvious feature to look for is reputation services. This gives you an enormous savings. Symantec used to offer a box based on Turntide, which was a standalone throttle for spam; I don't know if they have that as a standalone or not, but if they do, I'd recommend something like that. You may be able to roll your own as well fairly easily since there's no MTA to worry about. The win with reputation services is fantastic. For example, I did a test with a Crossbeam box and Trend a while ago (http://www.opus1.com/www/whitepapers/crossbeam-perf.pdf) and we were getting a steady-state 600 message/second without reputation filtering; with reputation filtering, about 1645 messages/second. That's using MAPS RBL+, which is a low-risk reputation service. Plug in a service like Spamhaus or Ironport's SenderBase, and you would get closer to 2500 message/second (about 200 million messages/day). Based on our testing, for a carrier-class deployment, I'd recommend looking at Ironport+Cloudmark, Trend, and Tumbleweed (now Axway). There are other good products (Proofpoint, for example, turns in great scores as does Sophos), but performance-wise they may not be able to scale up to the kind of load you're talking about when you say "Carrier Class." Feel free to contact me offline if you need more observations, etc. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

1 0

unsubscribe
by David Loutrel 12 Apr '10

12 Apr '10

-- David B. Loutrel, Operations Manager ACME Hosting & Design [1]www.acme-ent.net References 1. http://www.acme-ent.net/

2 1

Re: Solar Flux (was: Re: China prefix hijack)
by Warren Bailey 12 Apr '10

12 Apr '10

Are we thinking its going to get worse?? Did anyone else see the intelsat spacecraft failure last week?? Sent using my GCI BlackBerry ----- Original Message ----- From: Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> To: Michael Dillon <wavetossed(a)googlemail.com> Cc: Paul Vixie <vixie(a)isc.org>; Robert E. Seastrom <rs(a)seastrom.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Sun Apr 11 08:36:05 2010 Subject: Re: Solar Flux (was: Re: China prefix hijack) On Sun, 11 Apr 2010 16:58:40 BST, Michael Dillon said: > Would a Faraday cage be sufficient to protect against cosmic ray bit-flipping > and how could you retrofit a Faraday cage onto a rack or two of gear? Scientists build neutrino detectors in mines 8,000 feet underground because that much rock provides *partial* shielding against cosmic rays causing spurious detection events. Fortunately, the sun emits almost no cosmic rays. It does however spew a lot of less energetic particles that will cause single-bit upsets in electronic gear. Time to double-check that all your gear has ECC ram - the problem with the UltraSparc CPUs last time was that they had some cache chips built by IBM. IBM said "Use these chips in an ECC config", but Sun didn't. The ions hit, and the resulting bit-flips crashed the machines. Incidentally, Sun sued IBM over that, and the judge basically said "Well, IBM *told* you not to do that up front. Suit dismissed". One of the other big issues will be noise on satellite and microwave links screwing your S/N ratio. The one that scares me? Inducted currents on long runs of copper. You get a 200-300 mile 765Kva transmission line, and a solar flare hits, the Earth's magnetic field gets dented, so the field lines move relative to the stationary copper cable, and suddenly you have several thousand extra amps popping out one end of that cable. Ka-blam. The big danger there is that many substations are not designed for that - so it would basically *permanently* destroy that substation and they'd get to replace it. And of course, that's a several-weeks repair even if it's the only one - and in that sort of case, there will be *dozens* of step-down transformers blown up the same afternoon. How long can you run on diesel? ;)

5 4

China prefix hijack
by Grzegorz Janoszka 12 Apr '10

12 Apr '10

Just half an hour ago China Telecom hijacked one of our prefixes: Your prefix: X.Y.Z.0/19: Prefix Description: NETNAME Update time: 2010-04-08 15:58 (UTC) Detected by #peers: 1 Detected prefix: X.Y.Z.0/19 Announced by: AS23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation) Upstream AS: AS4134 (CHINANET-BACKBONE No.31,Jin-rong Street) ASpath: 39792 4134 23724 23724 Luckily it had to be limited as only one BGPmon peer saw it. Anyone else noticed it? -- Grzegorz Janoszka

19 21

32 bits ASN on Cisco
by Franck Martin 12 Apr '10

12 Apr '10

Sorry if it is not the right forum, but I'm trying to get a grip on 32Bits ASN on Cisco I see that feature is available on 12.4(24)T http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6554/ps6599/da… Which is available only for "new gear". I don't know how new is the 1800,2800,3800 series, but I know networks still running on 2500 and 2600. So does it mean that to get 32bit ASN you need to get new gear? Seems to me 12.4(24)T is relatively new, and that this feature is not available on the mainline IOS 12.4? So in one hand RIR allocates 32bit ASN, but on the other hand, it is hard to implement it on current equipment? Is that a (un)fair assessment?

5 6

Re: BGP hijack from 23724 -> 4134 China?
by Bruce Morgan 12 Apr '10

12 Apr '10

Hi Bob, AARNet does have a fairly strong policy on prefix-filtering. We also peer with route-views servers so that Cyclops and other projects can actually get this type of information. Best not to shoot the messenger as the message can be useful ;-) Regards Bruce > From: peering-admin(a)aarnet.edu.au [mailto:peering-admin@aarnet.edu.au] > On Behalf Of Bob Poortinga > Sent: Friday, 9 April 2010 11:13 PM > To: nanog(a)nanog.org > Cc: peering(a)aarnet.edu.au; Bruce Morgan > Subject: Re: BGP hijack from 23724 -> 4134 China? > > Jay Hennigan <jay(a)west.net> writes: > >> We just got Cyclops alerts showing several of our prefixes sourced > from >> AS23474 propagating through AS4134. Anyone else? > > For the record, yes. Two of our blocks were announced via 7575 4134 > 23724 > yesterday. First seen by Cyclops at 2010-04-08 15:57:13 UTC and lasted > about 20 minutes. > > Does AS7575, Australian Academic and Reasearch Network, do any > filtering? > > -- > Bob Poortinga K9SQL <http://www.linkedin.com/in/bobpoortinga> > Technology Service Corp. <http://www.tsc.com> > Bloomington, Indiana US -- street address: AARNet, POD 3, 20 Dick Perry Ave, Kensington, WA 6151, Australia m. 0408 882 390 t. +61 8 9289 2212 e. bruce.morgan(a)aarnet.edu.au w. www.aarnet.edu.au important This email and any files transmitted with it are confidential, and the rights of confidentiality in such information are not waived or lost by its mistaken delivery to you. Any dissemination, copying, use or disclosure of the email and/or such files without the permission of AARNet, or the sender, is strictly prohibited. If you have received this email in error, please contact the sender immediately and delete all copies of this transmission.

1 0

Re: interop show network (was: legacy /8)
by Brandon Ross 12 Apr '10

12 Apr '10

On Sun, 4 Apr 2010, Jeroen van Aart wrote: > Someone in another thread mentioned interop show network. Which made me > curious and I did a bit of searching. I found the following article from 2008 > about the interop show: http://www.networkworld.com/community/node/27583 > > The show could setup an IPv6 only network in order to showcase it? That'd > free up a /8. Seriously? You do realize that the InteropNet actually has to provide a real service to the exhibitors and attendees of the show, right? This year's network will support v6, but a v6-only network is just not a practical way to supply real network connectivity to customers, yet. -- Brandon Ross AIM: BrandonNRoss Director of Network Engineering ICQ: 2269442 Xiocom Wireless Skype: brandonross Yahoo: BrandonNRoss

17 18

Re: Solar Flux (was: Re: China prefix hijack)
by Warren Bailey 11 Apr '10

11 Apr '10

Bring cider, he'll be more talkative. Here in Alaska, the natives believed the Aurora was brought by birds - so anything is possible. Though, I will admit - I've read similar craziness on this mailing list. Not craziness, bat shit crazy is probably more appropriate. Sent using my GCI BlackBerry ----- Original Message ----- From: Leigh Porter <leigh.porter(a)ukbroadband.com> To: Warren Bailey; Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu>; wavetossed(a)googlemail.com <wavetossed(a)googlemail.com> Cc: vixie(a)isc.org <vixie(a)isc.org>; rs(a)seastrom.com <rs(a)seastrom.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Sun Apr 11 12:39:39 2010 Subject: Re: Solar Flux (was: Re: China prefix hijack) There is a guy who walks aroung Hyde Park Corner in London with a sandwich board that says "its going to get worse". Perhaps Ill go and talk to him next weekend and see what he thinks. -- Leigh --- original message --- From: "Warren Bailey" <wbailey(a)gci.com> Subject: Re: Solar Flux (was: Re: China prefix hijack) Date: 11th April 2010 Time: 9:14:50 pm Are we thinking its going to get worse?? Did anyone else see the intelsat spacecraft failure last week?? Sent using my GCI BlackBerry ----- Original Message ----- From: Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> To: Michael Dillon <wavetossed(a)googlemail.com> Cc: Paul Vixie <vixie(a)isc.org>; Robert E. Seastrom <rs(a)seastrom.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Sun Apr 11 08:36:05 2010 Subject: Re: Solar Flux (was: Re: China prefix hijack) On Sun, 11 Apr 2010 16:58:40 BST, Michael Dillon said: > Would a Faraday cage be sufficient to protect against cosmic ray bit-flipping > and how could you retrofit a Faraday cage onto a rack or two of gear? Scientists build neutrino detectors in mines 8,000 feet underground because that much rock provides *partial* shielding against cosmic rays causing spurious detection events. Fortunately, the sun emits almost no cosmic rays. It does however spew a lot of less energetic particles that will cause single-bit upsets in electronic gear. Time to double-check that all your gear has ECC ram - the problem with the UltraSparc CPUs last time was that they had some cache chips built by IBM. IBM said "Use these chips in an ECC config", but Sun didn't. The ions hit, and the resulting bit-flips crashed the machines. Incidentally, Sun sued IBM over that, and the judge basically said "Well, IBM *told* you not to do that up front. Suit dismissed". One of the other big issues will be noise on satellite and microwave links screwing your S/N ratio. The one that scares me? Inducted currents on long runs of copper. You get a 200-300 mile 765Kva transmission line, and a solar flare hits, the Earth's magnetic field gets dented, so the field lines move relative to the stationary copper cable, and suddenly you have several thousand extra amps popping out one end of that cable. Ka-blam. The big danger there is that many substations are not designed for that - so it would basically *permanently* destroy that substation and they'd get to replace it. And of course, that's a several-weeks repair even if it's the only one - and in that sort of case, there will be *dozens* of step-down transformers blown up the same afternoon. How long can you run on diesel? ;)

1 0

Re: Solar Flux (was: Re: China prefix hijack)
by Leigh Porter 11 Apr '10

11 Apr '10

There is a guy who walks aroung Hyde Park Corner in London with a sandwich board that says "its going to get worse". Perhaps Ill go and talk to him next weekend and see what he thinks. -- Leigh --- original message --- From: "Warren Bailey" <wbailey(a)gci.com> Subject: Re: Solar Flux (was: Re: China prefix hijack) Date: 11th April 2010 Time: 9:14:50 pm Are we thinking its going to get worse?? Did anyone else see the intelsat spacecraft failure last week?? Sent using my GCI BlackBerry ----- Original Message ----- From: Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> To: Michael Dillon <wavetossed(a)googlemail.com> Cc: Paul Vixie <vixie(a)isc.org>; Robert E. Seastrom <rs(a)seastrom.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Sun Apr 11 08:36:05 2010 Subject: Re: Solar Flux (was: Re: China prefix hijack) On Sun, 11 Apr 2010 16:58:40 BST, Michael Dillon said: > Would a Faraday cage be sufficient to protect against cosmic ray bit-flipping > and how could you retrofit a Faraday cage onto a rack or two of gear? Scientists build neutrino detectors in mines 8,000 feet underground because that much rock provides *partial* shielding against cosmic rays causing spurious detection events. Fortunately, the sun emits almost no cosmic rays. It does however spew a lot of less energetic particles that will cause single-bit upsets in electronic gear. Time to double-check that all your gear has ECC ram - the problem with the UltraSparc CPUs last time was that they had some cache chips built by IBM. IBM said "Use these chips in an ECC config", but Sun didn't. The ions hit, and the resulting bit-flips crashed the machines. Incidentally, Sun sued IBM over that, and the judge basically said "Well, IBM *told* you not to do that up front. Suit dismissed". One of the other big issues will be noise on satellite and microwave links screwing your S/N ratio. The one that scares me? Inducted currents on long runs of copper. You get a 200-300 mile 765Kva transmission line, and a solar flare hits, the Earth's magnetic field gets dented, so the field lines move relative to the stationary copper cable, and suddenly you have several thousand extra amps popping out one end of that cable. Ka-blam. The big danger there is that many substations are not designed for that - so it would basically *permanently* destroy that substation and they'd get to replace it. And of course, that's a several-weeks repair even if it's the only one - and in that sort of case, there will be *dozens* of step-down transformers blown up the same afternoon. How long can you run on diesel? ;)

1 0