March 2011 - Test - lists.nanog.org

The state-level attack on the SSL CA security model
by Martin Millnert 29 Mar '11

29 Mar '11

To my surprise, I did not see a mention in this community of the latest proof of the complete failure of the SSL CA model to actually do what it is supposed to: provide security, rather than a false sense of security. Essentially a state somewhere between Iraq and Pakistan snatched valid certs for: - mail.google.com - www.google.com - login.yahoo.com - login.skype.com - addons.mozilla.org - login.live.com - "global trustee" https://blog.torproject.org/blog/detecting-certificate-authority-compromise… http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html http://www.imperialviolet.org/2011/03/18/revocation.html (on epic failure of cert revocation lists implementations in browsers, failing open (!)) http://blog.mozilla.com/security/2011/03/22/firefox-blocking-fraudulent-cer… http://www.microsoft.com/technet/security/advisory/2524375.mspx For over a week users of browsers, and the internet at large, were/was not informed by COMODO that their security was compromised. "Why not" is beyond many of us. Announcing this high and loud even before fixes were available would not have exposed more users to threats, but less. Conclusion: protecting people must not be a priority in the SSL CA model. In some places, failure of internet security means people die, and it is high time to start serious work to replace this time-and-time again proven flawed model with something that, at the very least, does not fail this tragically. DNSSEC is a good but insufficient start in this particular case. Regards, Martin

23 34

Paul Baran, RIP.
by Dobbins, Roland 29 Mar '11

29 Mar '11

<http://www.networkworld.com/news/2011/032811-paul-baran-packet-switching-ob…> ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> The basis of optimism is sheer terror. -- Oscar Wilde

7 7

IPv4 address shortage? Really?
by Vadim Antonov 29 Mar '11

29 Mar '11

I'm wondering (and that shows that I have nothing better to do at 3:30am on Monday...) how many people around here realize that the plain old IPv4 - as widely implemented and specified in standard RFCs can be easily used to connect pretty much arbitrary number (arbitrary means >2^256) of computers WITHOUT NETWORK ADDRESS TRANSLATION. Yes, you hear me right. And, no, it does not require any changes any in the global routing infrastructure - as implemented now, and most OS kernels (those which aren't broken-as-designed, grin) would do the trick just fine. None of that dual-stack stupidity, and, of course, no chicken-and-egg problem if the servers and gateways can be made to respect really old and well-established standards. DNS and most applications would need some (fairly trivial) updating, though, to work properly with the extended addressing; and sysadmins would need to do tweaks in their configs since some mythology-driven "security" can get in the way. But they don't have to do that en mass and all at once. The most obvious solution to the non-problem of address space shortage is the hardest to notice, ain't it? --vadim P.S. Hfr YFEE gb ebhgr orgjrra cevingr nqqerff fcnprf bire choyvpnyyl ebhgrq fcnpr, Yhxr. Guvax bs cevingr nqqerff ovgf nf n evtug-fvqr rkgrafvba gb gur sbhe-bpgrg choyvp nqqerff. P.P.S. Gb rkgraq shegure, nygreangr gjb qvfgvapg cevingr nqqerff fcnprf, nf znal gvzrf nf lbh pna svg vagb gur urnqre.

12 11

XGMII interface
by yifeng zhou 29 Mar '11

29 Mar '11

Dears: As in IEEE 802.3 clause 46, in 10G Ethernet, RS and PCS may use XGMII interface to inter-connect. XGMII interface is a 32-bit wide, transmit & receive data path, working on frequency of 156.25HZ. So, for transmit direction, the total transmit rate should be 32*156.25=5Gbps, how 10G works with this interface? Further, on PMA, the transmit rate become 312.5M characters per lane.. how done this number come? thanks!

2 2

iBGP usage on a BRAS
by Mike 29 Mar '11

29 Mar '11

Hello, I have a BRAS (Terminating several thousand PPPoE sessions), and today I use simple static routes pointing to the bras for customer routes. I want to improve this model and allow for failover and so forth, and I would like instead for my customer routes to be entered into my igp so if they move around, the routes can follow them. I was wondering if iBGP may be sutaible for this task - there will always be a steady stream of route updates as customer connect and disconnect, mostly in the range of /32's and /29's. BGP seems way superior to ospf for this because of it's excellent filtering and other capabilities, but never having done this on a large scale with the potential for updates as I said, I was hoping someone could make a clear case for or against it. The client routes would not have to be propagated all across my network so updates don't really have to go far; I could certainly summarize these routes easily at a core router 1 hop from my bras for example, with that router(s) knowing the final hop from ibgp. I just want them to be able to float between bras and I can even tolerate a few seconds of route instability (hey, if you want stability then don't keep redialing; nail the pppoe up and leave it up!) Thank you Oh wizend ones (!), Mike-

2 1

What is this Cisco process?
by Joe Renwick 29 Mar '11

29 Mar '11

Hello, Have a Cisco 3560 running "flash:/c3560-ipbasek9-mz.122-55.SE1.bin". Been running at 20% CPU since we started it: [image: plf-access - CPU Usage] The switch is completely layer-2... basic configuration. CPU utilization is soley based on a single process: plf-access#sh proc cpu sorted CPU utilization for five seconds: 27%/0%; one minute: 25%; five minutes: 24% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 41 232891470 1072247 217210 20.12% 18.99% 18.01% 0 SFF8472 78 2376721 123621 19225 0.95% 0.22% 0.17% 0 HULC Tcam Memory 303 299 163 1834 0.47% 0.23% 0.07% 2 SSH Process 55 106535 11303527 9 0.15% 0.02% 0.00% 0 RedEarth Tx Mana Anybody have a clue what this process is? Thanks for the time. Cheers, -- Joe Renwick IP Network Consultant, CCIE #16465 GO NETFORWARD! Direct: 619-800-2055, Emergency Support: 800-719-0504 Is your network moving you forward?

4 3

Anyone have info on the Dallas Infomart power outage?
by Tim Connolly 29 Mar '11

29 Mar '11

Anyone have details?

1 0

Regional AS model
by Zaid Ali 28 Mar '11

28 Mar '11

I have seen age old discussions on single AS vs multiple AS for backbone and datacenter design. I am particularly interested in operational challenges for running AS per region e.g. one AS for US, one EU etc or I have heard folks do one AS per DC. I particularly don't see any advantage in doing one AS per region or datacenter since most of the reasons I hear is to reduce the iBGP mesh. I generally prefer one AS and making use of confederation. Zaid

14 24

Re: New tsunami advisory warning - Japan
by andrew.wallace 28 Mar '11

28 Mar '11

On Mon, Mar 28, 2011 at 1:59 AM, <Valdis.Kletnieks(a)vt.edu> wrote: > *yawn*. A foot and a half isn't going to be all *that* bad Remember a wall of tsunami water travels in general at approx 970 kph (600 mph), think about it.

6 5

Re: New tsunami advisory warning - Japan
by andrew.wallace 28 Mar '11

28 Mar '11

On Mon, Mar 28, 2011 at 11:43 AM, Gavin Pearce <Gavin.Pearce(a)3seven9.com> wrote: >> travels in general at approx 970 kph (600 mph) > > True in the deepest parts of open ocean - upon reaching the shore-line > it'll be travelling a lot slower. You guys forget a lot of folks on the list are working on cabling ships and off shore platforms, its not all about what happens on shore in this industry. Andrew

5 6