July 2010 - Test - lists.nanog.org

Re: Vyatta as a BRAS
by Scott Weeks 20 Jul '10

20 Jul '10

--- rdobbins(a)arbor.net wrote: When BCPs are followed, they don't tend to fall over the moment someone hits them with a few kpps of packets - which should be a key criteria for an edge device. ------------------------------------------------------- I'm guessing "a few kpps of packets" is tounge-in-cheek? Entry level script kiddies can get to a few hundred kpps easily. scott

10 17

[NANOG-announce] Please get your talks in for NANOG 50
by David Meyer 20 Jul '10

20 Jul '10

Folks, NANOG 50 is looming. If you have content you'd like to present, please go to pc.nanog.org, create a username (if you don't have one), and upload your materials. Thanks, Dave (for the NANOG PC) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

While we worry about Vyatta and Bras.....
by Larry Sheldon 20 Jul '10

20 Jul '10

..in other news (that seems to have attracted little attention)... http://www.moonbattery.com/archives/2010/07/73000-blogs-shu.html 73000 Internet "sites" where shutdown by somebody, for something. -- Somebody should have said: A democracy is two wolves and a lamb voting on what to have for dinner. Freedom under a constitutional republic is a well armed lamb contesting the vote. Requiescas in pace o email Ex turpi causa non oritur actio Eppure si rinfresca ICBM Targeting Information: http://tinyurl.com/4sqczs http://tinyurl.com/7tp8ml

6 8

QppB and SCU/DCU
by bit gossip 20 Jul '10

20 Jul '10

Experts, is there a standard comprising these 2 vendor specific implementations of the ~same~ feature? Thanks, bit.

1 0

[NANOG-announce] Registration open for NANOG 50 - Atlanta, GA
by Steve Feldman 20 Jul '10

20 Jul '10

Registration is now open for the 50th Meeting of the North American Network Operators' Group. NANOG 50 will be held October 3-6 in the new Loews Atlanta Hotel in Midtown. The meeting will be hosted by Telx. The meeting will be back-to-back with ARIN XXVI. A joint NANOG/ARIN program will be presented on the morning of October 6, featuring IPv6 deployment experiences. ARIN XXVI will continue through October 8. See http://www.nanog.org/meetings/nanog50/index.php for complete meeting details, and follow the important links on the left to submit presentations, register, and reserve your hotel room. Please note there are tiered rates for registration, so plan to register early to take advantage of the best rate. If you need lodging you are encouraged to make your reservation early, as rooms are limited. The NANOG group rate expires on September 15 or when filled. See you in Atlanta this fall! Steve Feldman NANOG Steering Committee Chair _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

While we worry about Vyatta and Bras.....
by Nathan Eisenberg 19 Jul '10

19 Jul '10

> >> The single host/box had bomb making info and hit lists. Yeah, I'd > >> shut it down too if it was on my network. > >> > >> Joe Hamelin, W7COM, Tulalip, WA, 360-474-7474 > > > > As would any reasonable operator. > > Or maybe it would have been better to not destroy a known source, and > work with the FBI to maximize its value. > > Cutting it off like that was short-sighted and stupid. > > -j (Fixing the subject line - sorry about that...) It sounds like the letter from the FBI to Burst.net specifically allowed for that possibility. "In the FBI's letter, the agency included a clause that says Web hosts and Internet service providers may voluntarily elect to shut down the sites of customers involved in these kinds of situations." Nathan Eisenberg, Atlas Networks

1 0

RE: NANOG Digest, Vol 30, Issue 50
by Nathan Eisenberg 19 Jul '10

19 Jul '10

> > ..in other news (that seems to have attracted little attention)... > > > > http://www.moonbattery.com/archives/2010/07/73000-blogs-shu.html > > > > 73000 Internet "sites" where shutdown by somebody, for something. > > > http://yro.slashdot.org/story/10/07/19/2052202/Blogetery-Shutdown-Due- > To-al-Qaeda-Info > > The single host/box had bomb making info and hit lists. Yeah, I'd > shut it down too if it was on my network. > > Joe Hamelin, W7COM, Tulalip, WA, 360-474-7474 As would any reasonable operator. I'm pretty disappointed that an article of the Moon Battery's very low caliber is considered by anyone to be news, especially news worth citing on NANOG. These malformed packets should have matched a mental drop rule, or at the very least, invoked a 'reputable news source' query. Or, as our icanhazcheezburger friends would say... I can haz obvious political agenda? Nathan Eisenberg, Atlas Networks

3 2

Whois-RWS Released 17 July 2010
by Mark Kosters 19 Jul '10

19 Jul '10

<Apologies for the duplicate email but want to keep you informed about changes occurring at ARIN. This particular upgrade may be of interest to those who are not subscribed to arin-announce.> ----- Forwarded message from Member Services <info(a)arin.net> ----- From: Member Services <info(a)arin.net> Date: Mon, 19 Jul 2010 13:27:32 -0400 To: "arin-announce(a)arin.net" <arin-announce(a)arin.net> Subject: [arin-announce] Whois-RWS Released 17 July 2010 ARIN is pleased to announce the release of Whois-RWS. ARIN's Whois RESTful Web Service (Whois-RWS) is the directory service for accessing registration data contained within ARIN's registration database. Whois-RWS provides several improvements over ARIN's previous Whois service. Whois-RWS can easily be integrated into command line scripts similar to Whois or RWhois, or it can be accessed with a web browser. For those who rely on existing scripts and clients, ARIN will continue to maintain services for the NICNAME/WHOIS protocol on TCP/43. This is achieved by using a proxy service to translate traditional ARIN Whois queries into Whois-RWS queries. View service differences, a Whois-RWS FAQ, and API documentation at: https://www.arin.net/resources/whoisrws/ Important details on other features in development can be found at: https://www.arin.net/features/ Please send any questions, comments, or issues to: hostmaster(a)arin.net. Regards, Mark Kosters Chief Technical Officer American Registry for Internet Numbers (ARIN) ----- End forwarded message -----

1 0

replacement SSG550 Firmware Image
by todd glassey 19 Jul '10

19 Jul '10

I just inherited a 550 from our old stash of Juniper and find that someone corrupted the flash image. Anyone know where there is a replacement image online? - contact me off list please. Todd Glassey

1 0

On another security note... (of sorts)
by J. Oquendo 19 Jul '10

19 Jul '10

<upcoming-getting-old-birthday-ramble> While on another list (security list that some of you guys are on) there is a discussion about a particular botnet that the "BP approach" of containment is occurring. Not a big deal, we've all seen them from time to time. I read with interest on how volunteers are scrambling to contain this botnet. Mind you, most of us work and do this (security tidbits) at the same time while we work. Many of us do it for self-satisfaction, for learning, for maybe naively thinking we can help make the net a better place (INSERT_SAPPY_SONG_THERE). I just can't help but taking the 50k foot view here... Why is it that network operators can't work together on instances like this and have a "botnet killswitch" framework in order. Now I know I will see the ramblings of "Why should I waste my time (spend my money)" or "This is not an operational post take a hike" and other similar posting however, this IS related to 'many-a-networks' that could be avoided. RFP anyone.. Botnet Mitigation for Networks surely collectively it would and CAN work. Is it going to take an act of someone 'pwning' everyone's account here before someone else says: "We should work together" or will go in one ear and out the other while misfits run around emptying out accounts, causing businesses to go under. Some of you guys have the most amazing minds and have literally been the glue for what we use (the Internet) and some have been the laziest admins I've seen on the planet. Surely even a minimal framework to submit "validated" botnet distribution sites is something everyone can collectively do. Nipping at the head surely minimizes the overall damage these things are doing. Now I do know some would come back and state the oft-said "Why bother! ... Dude fast-flux, etc." We know... To those, why respond. How about solutions from those who are controlling how traffic on the net flows. </upcoming-getting-old-birthday-ramble> -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

10 13