November 2011 - Test - lists.nanog.org

Flapping POS Interface on Frame-relay between a Juniper and Cisco
by Righa Shake 05 Dec '11

05 Dec '11

Hi, Am having a problem that is buffling. I recently changed a POS link encapsulation from PPP to Frame-relay. Since that time the POS interface keeps resetting from time to time. On my BGP session am receiving cease notifications from my upstream provider. The setup is such that we have a cisco on one end and a Juniper on the other. interface POS0/0/0 mtu 4474 no ip address no ip unreachables encapsulation frame-relay logging event link-status crc 32 pos scramble-atm frame-relay lmi-type ansi end ROUTERshow run int pos0/0/0.101 Building configuration... ! interface POS0/0/0.101 point-to-point ip address X.X.X.X 255.255.255.252 frame-relay interface-dlci 101 end ROUTER#show int pos0/0/0 POS0/0/0 is up, line protocol is up Hardware is SPA-2XOC12-POS MTU 4474 bytes, BW 622000 Kbit/sec, DLY 100 usec, reliability 255/255, txload 6/255, rxload 38/255 Encapsulation FRAME-RELAY, crc 32, loopback not set Keepalive set (10 sec) Scramble enabled LMI enq sent 81981, LMI stat recvd 77480, LMI upd recvd 0, DTE LMI up LMI enq recvd 0, LMI stat sent 0, LMI upd sent 0 LMI DLCI 0 LMI type is ANSI Annex D frame relay DTE segmentation inactive FR SVC disabled, LAPF state down Broadcast queue 0/256, broadcasts sent/dropped 26/0, interface broadcasts 0 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 1w2d Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 94336000 bits/sec, 13151 packets/sec 5 minute output rate 16470000 bits/sec, 7049 packets/sec 12211574207 packets input, 10967607038364 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 6970870 runts, 2179 giants, 0 throttles 0 parity 892493293 input errors, 882184781 CRC, 0 frame, 0 overrun, 0 ignored, 3335463 abort 6379191154 packets output, 1614018181446 bytes, 0 underruns 0 output errors, 0 applique, 4 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions Any assistance on this will be greatly appreciated. Regards, Righa Shake

3 2

ATT GigE issue on 11/19 in Kansas City
by comptech＠kc.rr.com 03 Dec '11

03 Dec '11

We lost several of our GigE links to AT&T for 6 hours on 11/19, anyone else see this and get a root cause from AT&T? All I can get is that they believe a change caused the issue.

10 11

Recent DNS attacks from China?
by Leland Vandervort 02 Dec '11

02 Dec '11

Hi All, I am wondering if anyone else is seeing a sudden increase in DNS attacks emanating from chinese IP addresses? Over the past 24 hours we've seen a sudden rash of chinese IPs attacking our DNS servers in the order of 5 to 10 million PPS for periods of 5 to 10 mins, repeated every 20 to 30 minutes. This anomalous traffic started roughly 24 hours ago, and while we've had occasions of anomalous chinese traffic, never anything of this type. Anyone else? Regards, Leland

11 13

IPv6 prefixes longer then /64: are they possible in DOCSIS networks?
by Dmitry Cherkasov 02 Dec '11

02 Dec '11

Hello everybody, It is commonly agreed that /64 is maximal length for LANs because if we use longer prefix we introduce conflict with stateless address autoconfiguration (SLAAC) based on EUI-64 spec. But SLAAC is not used in DOCSIS networks. So there seems to be no objections to use smaller networks per cable interfaces of CMTS. I was not able to find any recommendations anywhere including Cable Labs specs for using prefixes not greater then /64 in DOCSIS networks. Some tech from ISP assumed that DHCPv6 server may generate interface ID part of IPv6 address similarly to EUI-64 so MAC address of the device can easily be obtained from its IPv6 address, but this does not seem like convincing argument. What do you think? Dmitry Cherkasov

24 69

Re: Recent DNS attacks from China?
by Hal Murray 30 Nov '11

30 Nov '11

> I am wondering if anyone else is seeing a sudden increase in DNS attacks > emanating from chinese IP addresses? Over the past 24 hours we've seen a > sudden rash of chinese IPs attacking our DNS servers in the order of 5 to 10 > million PPS for periods of 5 to 10 mins, repeated every 20 to 30 minutes. > This anomalous traffic started roughly 24 hours ago, and while we've had > occasions of anomalous chinese traffic, never anything of this type. I don't know if it's related, but at about the same time USNO reported an attack on their NTP servers. I could easily imagine a piece of malware with a bug that does massive retransmits on both DNS and NTP. ----------- From: Rich <schmidt.rich(a)gmail.com> Newsgroups: comp.protocols.time.ntp Subject: NTP Denial of Service attack 29 November 2011 Date: Tue, 29 Nov 2011 12:44:44 -0800 (PST) Organization: http://groups.google.com NNTP-Posting-Host: 199.211.133.254 USNO is seeing an apparent coordinated denial of service attack on NTP originating with the following IPs: 220.117.53.67; 218.92.115.152; 114.40.28.224; 218.201.21.194. ---------- At 11 pm EST 29 Nov 2011 the Navy Cyber Defense Operations Command ordered USNO to take NTP servers in Washington, DC offline, and USNO complied. USNO serves more than 3 million clients. This is the first time in 17 years that we have ceased NTP operations. ---- NTP Service from USNO Washington was restored at 30.56 November 2011 UTC. No further information is available for dissemination at this time. -- These are my opinions, not necessarily my employer's. I hate spam.

2 1

IPv6 NPT and NAT for Linux
by Ray Soucy 30 Nov '11

30 Nov '11

For those who missed it, Linux is adding NAT for IPv6 to netfilter: http://www.spinics.net/lists/netfilter-devel/msg19979.html Along with tradition SNAT, and DNAT targets most of us are familiar with, a new NETMAP target is included that implements NPT (network prefix translation). I for one am happy to see this; despite not wanting to see people NAT IPv6 as the norm, having the NETMAP target will largely replace the use of SNAT and MASQUERADE for many deployments, while keeping those tools for the times when traditional NAT is desirable. -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-3526 Networkmaine, a Unit of the University of Maine System http://www.networkmaine.net/

3 2

Re: Looking for a Tier 1 ISP Mentor for career advice.
by joshua sahala 30 Nov '11

30 Nov '11

tyler, some additional "soft" skills that will help you distinguish yourself from others: - learn to write well: take some creative writing classes in addition to technical writing. being able to efficiently write clear, concise, and effective documentation is a skill that is necessary, and i daresay, required, especially for senior-level staff. - learn how to present/speak: join the local toastermasters. grok tufte's 'visual display of quantitative information' (or something similar -- this goes back to writing effective and concise documentation) - in addition to business and finance, learn negotiation techniques. 'getting to yes' is a good book; there are many others - learn time/task/project management: you should be able to accurately guage how long things take, task interdepence, and how to structure a (simple) project. try a few different methods to find one that works for you, and then build and rebuild your home lab using your project plan. this is also a good time to practise documentation ;) - get involved: join/start local users groups, go to a conference or two, subscribe to/read mailing lists on topics which interest you, or which are relevant to something you are studying/playing with - to reiterate what others have said: learn to troubleshoot. learn to troubleshoot. learn to troubleshoot. - develop an efficient, comprehensive methodology, and stick to it (a checklist can be helpful) - learn to take notes as you work through your procedure (what you did, what was the result: this will aid in writing both root-cause reports and operational procedures -- more documentation practise) - as you gain experience, re-evaluate and optimise, but be consistent in your approach - be able to explain and justify your procedure(s); teaching and learning from others makes you both better. mentoring will be an extremely valuable skill to your hiring manager/team (and will better position you for leadership roles) - learn how to use $favourite_search_engine in order to find answers you might also consider getting a juniper j-series box (or running bird on a *nix box, or three). a ccnp will teach you cisco's way, but most provider networks are heterogenous, and the ability to understand a non-cisco device (and moreover, a non-cisco-style cli/config), will benefit you long-term (imho). above all, have fun with what you are doing. this industry can be a lot of fun, but it is also stressful, and if you aren't enjoying what you are learning/doing, it might be time to re-evaluate your focus/priorities. hth /joshua

1 0

Re: Recent DNS attacks from China?
by Rob.Vercouteren＠kpn.com 30 Nov '11

30 Nov '11

Hello Leland, Yes we do see the same behavior! regards, Rob Vercouteren

3 3

Used your smartphone to log into your network?
by Rich Kulawiec 30 Nov '11

30 Nov '11

If so, this might be a good time to change passwords, and to review what other information has transited your phone. (Note: androidsecuritytest.com appears to be slashdotted at the moment.) November 16: initial reports of Carrier IQ spyware surface: CarrierIQ: Most Phones Ship With "Rootkit" http://yro.slashdot.org/story/11/11/16/1517248/carrieriq-most-phones-ship-w… The Rookit of All Evil http://www.xda-developers.com/android/the-rootkit-of-all-evil-ciq/ More on CarrierIQ http://www.xda-developers.com/android/more-on-carrier-iq/ all of which reference the research presented here: Carrier IQ http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ November 22: Carrier IQ threatens security researcher Trevor Eckhart: CarrierIQ Tries To Silence Security Researcher http://mobile.slashdot.org/story/11/11/23/0032233/carrieriq-tries-to-silenc… Mobile Rootkit Maker Tries to Silence Critical Android Dev http://www.wired.com/threatlevel/2011/11/rootkit-brouhaha/ November 24: Carrier IQ backs off its threats, says that it doesn't track Android users Carrier IQ Relents, Apologizes http://yro.slashdot.org/story/11/11/24/1852213/carrier-iq-relents-apologizes Carrier IQ retracts cease and desist letter sent to security researcher, says it doesn't track Android users http://www.theverge.com/2011/11/23/2583862/carrier-iq-retracts-cease-and-de… November 29: Further research by Trevor Eckhart shows Carrier IQ spyware logs ALL keystrokes Android Dev Demonstrates CarrierIQ Phone Logging Software On Video http://yro.slashdot.org/story/11/11/30/0423256/android-dev-demonstrates-car… Researcher's Video Shows Secret Software on Millions of Phones Logging Everything http://www.wired.com/threatlevel/2011/11/secret-software-logging-video The Storm Is Not Over Yet -- Lets Talk About #CIQ http://www.xda-developers.com/android/the-storm-is-not-over-yet-lets-talk-a… all of which reference this research: Carrier IQ Part 2 http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq… ---rsk

1 0

RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 30 Nov '11

30 Nov '11

Well, sometime yesterday www.centurylink.com removed it AAAA record(s). www.qwest.com still has them. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Monday, October 24, 2011 1:47 PM To: 'nanog(a)nanog.org' Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days Good news: access to the v6 version of www.qwest.com came up at 12:30 pm today -- it redirects to www.centurylink.com, but at least it's working. Only www.savvis.com remains in my list of service provider websites that have non-working IPv6. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Thursday, August 18, 2011 12:35 AM To: nanog(a)nanog.org Subject: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days The IPv6 version of www.qwest.com has been down for 10 days. Wget shows a 301 to www.centurylink.com, but that also fails. Emails to the nocs at both companies have gone unanswered. Unless HE is deployed in a web browser, this behavior leads to a bad end-user experience. If anyone can prod either of these two companies that would be much appreciated. Frank nagios:/home/fbulk# wget -6 www.qwest.com --2011-08-18 00:32:40-- http://www.qwest.com/ Resolving www.qwest.com... 2001:428:b21:1::20 Connecting to www.qwest.com|2001:428:b21:1::20|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: http://www.centurylink.com/ [following] --2011-08-18 00:32:40-- http://www.centurylink.com/ Resolving www.centurylink.com... 2001:428:b21:1::22 Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:02-- (try: 2) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:25-- (try: 3) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:49-- (try: 4) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. Etc...

1 0