October 2011 - Test - lists.nanog.org

Advice on BGP traffic engineering for classified traffic
by Jack Bates 26 Oct '11

26 Oct '11

I'm curious if anyone has a pointer on traffic manipulation for classified traffic. Basics, I have a really cheap transit connection that some customers are paying reduced rates to only use that connection (and not my other transits). Though I've considered support for cases where NSP peering disputes break out. While I can advertise their networks out the correct transit for return traffic, I still have to figure out how to handle egress traffic. I'm guessing the crux of it is policy routing based on source address, but I'm interested in ways to engineer it to easy management and scalability. I've considered the possibility of an l3vpn to interconnect customers that are not requiring full routes, and possibly some type of vpls tunnel terminated at the necessary router for customers who need full routes. Thoughts, pointers, suggestions? Jack

4 4

[NANOG-announce] NANOG54 (San Diego, Feb 5-8 2012): Call for Presentations and Registration Now Open!
by Dave Temkin 26 Oct '11

26 Oct '11

All, After a fantastic meeting in Philadelphia we're getting ready to provide you with another content rich meeting at the Westin Gaslamp Quarter in San Diego. Registration is now open for the meeting, and you can take advantage of the Early Bird Registration Discount and save $75 by registering before December 5th, 2011. Please see http://www.nanog.org/meetings/nanog54/nanog54_registration.html for more details. --- The NANOG54 CFP is available at: http://www.nanog.org/meetings/nanog54/callforpresentations.html Please keep these key dates in mind: Presentation Abstracts and Draft Slides Due: December 5th, 2011 Final Slides Due: December 19th, 2011 The NANOG Program Committee intends on having a draft program published by December 20th, 2011 and the final agenda published by January 16, 2012. --- Thanks, -Dave Temkin (for the NANOG Program Committee) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: Facebook insecure by design
by Robert Bonomi 26 Oct '11

26 Oct '11

> From: "steve pirk [egrep]" <steve(a)pirk.com> > Date: Wed, 26 Oct 2011 09:24:04 -0700 > Subject: Re: Facebook insecure by design > > On Oct 24, 2011 7:55 AM, "Robert Bonomi" <bonomi(a)mail.r-bonomi.com> wrote: > > > > > > > You can even download it all and erase yourself if > > > you want out. > > > > Don't count on it. You may 'disappear' from public view, but that does > > not necessarily mean the data is truely 'gone'. Specific example -- if > you > > request a USENET posting to be removed, all they do is make it 'invisible' > > to the world. It is _not_ removed from the databases, or from inernal > > access/use. > > > > > > That is a very good point, and one of the things that is being tested now > that Buzz is going into archive mode. Users are given the option of backing > up their posts on Buzz, and then deleting their Buzz content. Many like > myself will just leave it there. It is a year+ of history, and what I posted > publicly can stay public. > > It is supposed to remove all your Buzz content from the service and I > believe it includes the content shared only with certain individuals. It > does not completely erase it, because I believe email copies of the posts > and comments that people had sent to their Gmail accounts will remain with > those users. > > Deleting a product like your Picasa web albums is permanent as far as I > know, but I will definitely ask some people on the Picasa team. Deleting > your search history and other Dashboard items is supposed to be permanent, > but as you pointed out, we are taking Google's word for it. > I _don't_ know, but I *strongly* suspect that things like search history _are_ kept -- although 'detached' from any identification of the original person. That kind of information is simply 'too valuable' -- for pattern recognition, say -- to entirely discard. I also suspect it remains as part of lots of aggregate demographics, etc. I wouldn't be surrised if they kept statistal data on 'who deletes what'. <grin>

1 0

Facebook insecure by design
by William Allen Simpson 26 Oct '11

26 Oct '11

In accord with the recent thread, "facebook spying on us?" We should also worry about other spying on us. Without some sort of rudimentary security, all that personally identifiable information is exposed on our ISP networks, over WiFi, etc. Facebook claims to be able to run over TLS connections. Not so much (see attached picture). This wasn't an "app", this is the simple default content of a page accessed after a Google search. https://www.facebook.com/ceelogreen

21 29

the route is not in our bgprouter
by Deric Kwok 26 Oct '11

26 Oct '11

Hi When we try to reach to outside ip, this route doesn't have in our bgp router How can we check whether it doesn't advertise from our upstream to us? Any web site and tools can help? Thank you

3 4

Senate Bill S.968
by Jason LeBlanc 26 Oct '11

26 Oct '11

Anyone read this? http://en.wikipedia.org/wiki/Protect_IP_Act More attempts to regulate Internet usage. Not in favor. Jason

3 2

Vancouver, BC providers
by Ravi Pina 25 Oct '11

25 Oct '11

Hi, I was looking for some metro-e options in Vancouver, BC CA specifically in the Downtown/Gastown area. I'm finding the area isn't the most built up so options are very thin. We already have service through Level3, but would like a secondary one. It doesn't have to be tier1 or even terrestrial service so much as reliable and vouched for. Any tips would be appreciated. Thanks, -r

5 5

Re: Outgoing SMTP Servers
by Brian Dickson 25 Oct '11

25 Oct '11

Owen wrote: >On Oct 25, 2011, at 3:29 AM, <Valdis.Kletnieks at vt.edu> wrote: > >> On Tue, 25 Oct 2011 02:35:31 PDT, Owen DeLong said: >> >>> If they are using someone else's mail server for outbound, how, exactly do you control >>> whether or not they use AUTH in the process? >> >> 1) You don't even really *care* if they do or not, because... >> >> 2) if some other site is running with an un-AUTHed open port 587, the miscreants will >> find it and abuse it just like any other open mail relay. The community will >> deal with it quick enough so you don't have to. And at that point, it's the >> open mail relay's IP that ends up on the block lists, not your mail relay's IP. >> >But that applies to port 25 also, so, I'm not understanding the difference. > >> Other people running open port 587s tends to be quite self-correcting. >> > >At this point, so do open port 25s. > >Owen I'll try to explain with text stick-diagrams... The players are: G - good user B - botnet host I - ISP O - open relay S - mail-submission relay V - victim SMTP/mailbox host It's all about how port-25 traffic containing SPAM gets to machine "V". (Or not, which is the preferred situation.) Possible routes include: B.25 -> (I allows 25) -> O -> V (classic open relay) [SPAM] B.25 -> (I allows 25) -> V (new mode, and what William Herrin is talking about) [SPAM] B.587 -> (I !allow 25) -> V (but that makes no sense - how does B authenticate to the victim? She doesn't!!) [BLOCKED] B.587 -> (I !allow 25) -> S (ditto - not an open unauthenticated relay, only allows authenticated relaying!!!) [BLOCKED] Meanwhile, we have: G.587 -> (I !allow 25) -> S.g.587/.25 (mail submission gateway for G) -> V.25 [NOT-SPAM && NOT-BLOCKED] S.g is either G's enterprise mail server, or G's home mail server, or G's ISP themselves, or some other S to which G can authenticate. S.g receives on 587, and sends on 25, and is a generally reputable port-25 host (whatever that means). So, basically, not blocking 587 and blocking 25 removes all the avenues for direct botnet spam. Authenticating botnet sources become trackable on auth-hosts, and easy to shut down. Is there some path not listed above that could allow a spammer (botnet host) behind the ISP to send email, without having a relay host to which it can authenticate, that I'm not seeing? Brian

1 0

ARIN and Legacy IPv4 Assignement from CA*Net (Canarie)
by Alain Hebert 25 Oct '11

25 Oct '11

Hi, From what we've been seeing there is a lot of those legacy assignement about to be freed. ( Yeah! ) We're having some issue with a few Legacy that where miss-assigned when transfered from CA*Net to ARIN back in the day. ( We kept the control on them since we had access to the POC's and OrgID, which is not the case anymore for some reason ) If anyone has a hint (off-list please) about how to go about fixing those broken assignement, we had no luck finding the process on ARIN. I can only gather that there is no records left from the CA*Net merge :( Thanks. PS: Check your ARIN records if you have subnets in the 198., 199. and 205. just in case. ----- Alain Hebert ahebert(a)pubnix.net PubNIX Inc. 50 boul. St-Charles P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443

2 1

Outsourcing DDOS
by samuel.cunningham＠wellsfargo.com 25 Oct '11

25 Oct '11

We are considering using Prolexic to 'defend' our Internet-facing network from DDOS attacks. Anyone have any known issues or word of warnings before we proceed? Chris Cunningham Network Engineering Secure Connectivity 704-427-3557 (Desk) 704-701-6924 (Cell) Samuel.Cunningham(a)Wellsfargo.com<mailto:Samuel.cunningham@wellsfargo.com> [X] This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient. Any review, use, distribution, or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message.

7 12