August 2011 - Test - lists.nanog.org

RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 06 Sep '11

06 Sep '11

I just noticed that the quad-A records for both those two hosts are now gone. DNS being what it is, I'm not sure when that happened, but our monitoring system couldn't get the AAAA for www.qwest.com about half an hour ago. Hopefully CenturyLink is actively working towards IPv6-enabling their sites again. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Thursday, August 18, 2011 11:14 PM To: nanog(a)nanog.org Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days FYI, the issue is not resolved and I've not heard from either of the companies suggesting that they're working on it. Note their commitment to IPv6 in these releases: http://www.prnewswire.com/news-releases/centurylink-joins-internet-community -in-world-ipv6-day-123089908.html http://news.centurylink.com/index.php?s=43&item=2129 Frank -----Original Message----- From: Matthew Moyle-Croft [mailto:mmc@internode.com.au] Sent: Thursday, August 18, 2011 7:08 PM To: Owen DeLong Cc: nanog(a)nanog.org Subject: Re: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days On 19/08/2011, at 4:18 AM, Owen DeLong wrote: It'd really suck for end users to start actively avoiding IPv6 connectivity because it keeps breaking and for organisations that have active AAAA records to break peoples connectivity to their resources. +1 -- I'm all for publishing AAAA records as everyone knows, but, if you publish AAAA records for a consumer facing service, please support and monitor that service with a similar level to what you do for your IPv4 versions of the service. The coming years are going to be difficult enough for end-users without adding unnecessary anti-IPv6 sentiments to the mix. Owen +1 to Owen's comment. I'd also add some more comments: A lot of eyeballs that have v6 right now are the people with a lot of clue. Do you want these people, who'll often be buying or recommending your services to rate your ability to deliver as a fail? Our experience with IPv6 consumer broadband has been that the early adopters are the people who, well, goto IETF meetings, follow standards and ask the bloody hard questions. Even given the Happy Eyeballs (Did Hurricane PAY for it to be abbrievated as HE?? :-) ) most end users prefer IPv6 over IPv4. Deeply this means there is a tendency for v6 traffic to grow and be more important to connectivity than you may imagine. The tipping point for IPv6 traffic being dominant I suspect is going to be a lower threshold of take up than people might expect. Consider this when thinking about the level of thought you give to IPv6 infrastructure and PPS rates. MMC

6 8

Prefix hijacking by Michael Lindsay via Internap
by Denis Spirin 02 Sep '11

02 Sep '11

Hello All, I was hired by the Russian ISP company to get it back to the business. Due to impact of the financial crisis, the company was almost bankrupt, but then found the investor and have a big wish to life again. When I tried to announce it's networks, upstreams rejected to accept it because of Spamhaus listings. But our employer sworn there is not and was not any spamming from the company. The Spamhaus lists all our networks as spamming Zombies. And it IS announced and used now!!! The announce is from American based company Internap (AS12182). I wrote the abuse report them, but instead of stop unauthorized announces of our networks, I was contacted by a person named 'Michael Lindsay' - he tell me he buy our networks from some other people and demand we get back our abuse reports. Of course, we don't. After a short googling, I found this is well-known cyber crime person: http://www.spamhaus.org/rokso/listing.lasso?file=818&skip=0, and he did IP hijacking with the fake letter of authorization before: http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK8686 so our company is not a first victim of him. Yes, our company "help" him with the mistake of loosing old domain link-telecom.biz he was also squatted. This domain was listed as contact at RIPE Database. It is a good topic why these easy-to-forge LOAs is still in use, as RADB/RIPE DB/other routing database with the password access is a common thing. But this is not the main thing. The main thing is why Internap helps to commit a crime to the well-known felony person, and completely ignores our requests? Is there any way to push them to stop doing that immediately? If anybody can - please help...

17 33

Re: PuTTY alt-keys (was Re: 16-User Network)
by Jay R Ashworth 31 Aug '11

31 Aug '11

Lynda <shrdlu(a)deaddrop.org> wrote: >On 8/30/2011 10:36 PM, Jay Ashworth wrote: > >> See again the name of this list ;-) > >Oh, dear. I'll bet anything you didn't mean this to go to NANOG. > >-- >The Consultant's Curse: > When the customer has beaten up on you long enough, give him > what he asks for, instead of what he needs. This is very strong > medicine, and is normally only required once. Must. Not. Post. After. 1am. Sorry, all. --jra -- Sent from my HTC Supersonic with K-9 Mail. Please excuse my brevity.

5 5

GNS3 site
by Stefan 31 Aug '11

31 Aug '11

http://www.downforeveryoneorjustme.com/www.gns3.net <- anybody having any idea about the status of this? ***Stefan Mititelu http://twitter.com/netfortius http://www.linkedin.com/in/netfortius

1 0

New Natural Disaster! 8/27/2011 Hurricane Irene
by Andrew Kirch 31 Aug '11

31 Aug '11

The US Airforce has sent most of the fighters from the East Coast to Indiana, what are you doing to prepare for the storm of the next 2 days? Ready, Set, DISCUSS!

23 24

Re: PuTTY alt-keys (was Re: 16-User Network)
by Jay Ashworth 31 Aug '11

31 Aug '11

----- Original Message ----- > From: "Fairlight" <fairlite(a)fairlite.com> > Unless someone dumbs down and jails their environment for them, which > I'm staunchly against for anything except ftp or sftp use. This is, um, the *filePro* mailing list. Quick: who on here has ever set up a Unix user to go directly into a filePro menu? :-) > My belief is that if you can't configure a simple terminal emulator, you're > quite possibly a menace with an operating system a few hundred times as > complex. All the chmod 0777 monkeys out there haven't done anything but > reinforce my opinion over the years. There are some notable exceptions, > but I'm wary of putting non-technical people in front of an actual shell > prompt. Yup. Why I never do it. > And I've never been a fan of pseudo-jailed environments. I've yet to> find > one I can't find -some- way out of (including at a bank, who> overlooked > the fact that WordPerfect had a shell escape buried in it!), and> admins > place way too much trust in the stupidity of the users they fool into > thinking their access is limited. Sorry, changing the prompt to look > like a several-choice menu is -not- security. (Yes, I know a company that > does this.) Ha. :-) In practice, in 20 years, on well over 500 seats, I *never* had a problem. Never. > But I'd never let someone near my own box if they can't even configure > a PuTTY connection to it. Oh, -hell- no. :) Strawman. Wasn't suggesting that you should. See again the name of this list ;-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

1 0

[NANOG-announce] Amendments to the NANOG Bylaws
by Steve Gibbard 30 Aug '11

30 Aug '11

NANOG members (and other interested people), The NANOG bylaws provide an opportunity each year to amend them, if needed. Bylaw amendments may be enacted by a majority vote of eligible voters (in other words, NANOG Members), during NANOG's annual election. The election is scheduled to take place during NANOG 53, from October 9-11, with voting open to all NANOG members (http://www.nanog.org/membership_main.html) The current bylaws are posted at http://www.nanog.org/governance/documents/By-Laws_20110104.pdf An amendment may be put on the ballot by the Board of Directors or by petition. A petition must be signed by at least 30 eligible voters, or 1 percent of eligible voters, whichever is greater. In addition, the Board had the power to make bylaw amendments during NANOG's first year as an independent corporation, subject to ratification by the voters in the next election. The Board used that procedure to amend the bylaws and institute the current membership structure, so that amendment will now need to be accepted or rejected by the membership. Accordingly, there will be a proposal on the ballot to ratify the current membership structure (Section 5 of the bylaws). The board has also discussed submitting a proposal to modify the committee structure called for in the bylaws (Section 9), to reflect that some of the committee functions are now being handled by staff. Any other changes people want to suggest may be discussed on the nanog-futures(a)nanog.org mailing list. Anybody wishing to put a bylaw amendment on the ballot without board action may do so by submitting a petition to nominations(a)nanog.org no later than September 26. Thank you, Steve Gibbard NANOG Membership Chair _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Rate Limiting and Bit Counting
by Luke Marrott 30 Aug '11

30 Aug '11

I'm looking to evaluate some solutions for Rate limiting and bit counting / metering. I am not really interested in Filtering packets by application or protocol, just delivering bandwidth at a defined service level based on endpoint IP. I would also like to have the option to track how much data is transferred per endpoint for potential metering. I already use a smaller sandvine at another location and we are satisfied with it but this would be a bigger project so I am looking for alternatives. Does anyone have any experience with hardware like this they could recommend? Thanks, :Luke

2 1

Aqua Conduit for 10G multi-mode?
by Michael J McCafferty 30 Aug '11

30 Aug '11

All, Orange innerduct/split-loom tubing for multi-mode, yellow for single-mode... Where's the aqua for the aqua OM3 fiber? I feel like the Ethernet fashion police, but it's a horrible color clash for aqua fiber dressed in yellow or orange. Where is my aqua innerduct and/or tubing? Does anyone make it? Cheers, Mike -- ************************************************************ Michael J. McCafferty M5 Hosting http://www.m5hosting.com You can have your own custom Dedicated Server up and running today ! RedHat Enterprise, CentOS, Ubuntu, Debian, OpenBSD, FreeBSD, and more ************************************************************

6 6

RAID 2011 (Sep. 20-21, Menlo Park, CA) - Final Call for Participation
by Guofei Gu 30 Aug '11

30 Aug '11

Call for Participation 14th International Symposium on Recent Advances in Intrusion Detection (RAID'2011) September 20-21, 2011 SRI International, Menlo Park, CA http://www.raid2011.org Register online now! http://www.raid2011.org/ =========================================================== About the conference: For the fourteenth year, the intrusion detection community will converge at RAID'2011 to discuss cutting-edge research in malware, application security, anomaly detection, special environments and sandboxing, web security and social networks, and network security. You are invited to join us at RAID for two days this September at SRI International, Menlo Park, CA. The annual symposium brings together leading researchers and practitioners from academia, government, and industry to discuss issues and technologies related to intrusion detection and defense. RAID 2011 features an exciting technical program, with presentations addressing topics such as dynamic analysis of malicious shellcode, world's fastest taint tracker, anomaly detection using software defined networking, defending legacy embeded systems, web and social network security, and cross-analysis of botnet victims. A poster session during the symposium will provide lively face-to-face discussions of work in progress. =========================================================== Program this year: ******Tuesday September 20th****** 8:45 9:45 Keynote: Kevin Fu The Cutting Edge of Medical Device Security and Privacy 10:00 12:00 Session 1 (Malware) Chair: Guofei Gu 10:00 10:30 Shellzer: a tool for the dynamic analysis of malicious shellcode Yanick Fratantonio (Politecnico di Milano), Christopher Kruegel and Giovanni Vigna (University of California, Santa Barbara) 10:30 11:00 KLIMAX: Profiling Memory Write Patterns to Detect Keystroke-Harvesting Malware Stefano Ortolani and Cristiano Giuffrida (Vrije Universiteit) and Bruno Crispo (University of Trento) 11:00 11:30 Packed, Printable, and Polymorphic Return-Oriented Programming Kangjie Lu and Dabi Zou (Singapore Management University), Weiping Wen (Peking University), and Debin Gao (Singapore Management University) 11:30 12:00 On the Expressiveness of Return-into-libc Attacks Minh Tran, Mark Etheridge, Tyler Bletsch, Xuxian Jiang, Vincent Freeh, and Peng Ning (North Carolina State University) 12:00 13:30 Lunch 13:30 15:00 Session 2 (Application Security) Chair: Debin Gao 13:30 14:00 Minemu: The World's Fastest Taint Tracker Erik Bosman, Asia Slowinska, and Herbert Bos (Vrije Universiteit Amsterdam) 14:00 14:30 Dymo: Tracking Dynamic Code Identity Bob Gilbert, Richard Kemmerer, Christopher Kruegel, and Giovanni Vigna (University of California, Santa Barbara) 14:30 15:00 Automated Identification of Cryptographic Primitives in Binary Programs Felix Gröt (Ruhr-University Bochum), Carsten Willems (University of Mannheim), and Thorsten Holz (Ruhr-University Bochum) 15:00 15:30 Health Break 15:30 17:00 Session 3 (Anomaly Detection) Chair: Mathieu Couture 15:30 16:00 Cross-domain Collaborative Anomaly Detection: So Far Yet So Close Nathaniel Boggs (Columbia University), Sharath Hiremagalore and Angelos Stavrou (George Mason University), and Salvatore J. Stolfo (Columbia University) 16:00 16:30 Revisiting Traffic Anomaly Detection using Software Defined Networking Syed Akbar Mehdi, Junaid Khalid, and Syed Ali Khayam (National University of Sciences and Technology, Pakistan) 16:30 17:00 Modeling User Search Behavior for Masquerade Detection Malek Ben Salem and Salvatore J. Stolfo (Columbia University) 17:00 19:00 Poster Session (lobby) 19:30 Banquet at Oak City Restaurant (walk from conference) ******Wednesday September 21st****** 8:00 - 8:30 Continental Breakfast 8:30 10:00 Session 4 (Special Environments and Sandboxing) Chair: Angelos Stavrou 8:30 9:00 Defending Legacy Embedded Systems with Software Symbiotes Ang Cui and Salvatore J. Stolfo (Columbia University) 9:00 9:30 What if you can't trust your network card? LoïDuflot, Yves-Alexis Perez, and Benjamin Morin (ANSSI) 9:30 10:00 Detecting Environment-Sensitive Malware Martina Lindorfer, Clemens Kolbitsch, and Paolo Milani Comparetti (Vienna University of Technology) 10:00 10:15 Health Break 10:15 11:45 Panel Discussion: State and Future of Open-Source Network Intrusion Detection 11:45 13:15 Lunch 13:15 15:15 Session 5 (Web Security and Social Networks) Chair: Davide Balzarotti 13:15 13:45 Banksafe - Information Stealer Detection inside the Web Browser Armin Buescher (G Data Security Labs), Felix Leder (University of Bonn), and Thomas Siebert (G Data Security Labs) 13:45 14:15 IceShield: Detection and Mitigation of Malicious Websites with a Frozen DOM Mario Heiderich, Tilman Frosch, and Thorsten Holz (Ruhr-University Bochum) 14:15 14:45 Spam Filtering in Twitter using Sender-Receiver Relationship Jonghyuk Song, Sangho Lee, and Jong Kim (POSTECH) 14:45 15:15 Die Free or Live Hard? Empirical Evaluation and New Design for Fighting Evolving Twitter Spammers Chao Yang, Robert Harkreader, and Guofei Gu (Texas A&M University) 15:15 15:30 Health Break 15:30 17:00 Session 6 (Network Security) Chair: Phil Porras 15:30 16:00 Securing Application-Level Topology Estimation Networks: Facing the Frog-Boiling Attack Sheila Becker (University of Luxembourg), Jeff Seibert and Cristina Nita-Rotaru (Purdue University), and Radu State (University of Luxembourg) 16:00 16:30 Detecting Traffic Snooping in Tor Using Decoys Sambuddho Chakravarty, Georgios Portokalidis, Michalis Polychronakis, and Angelos D. Keromytis (Columbia University) 16:30 17:00 Cross-Analysis of Botnet Victims: New Insights and Implications Seungwon Shin, Raymond Lin, and Guofei Gu (Texas A&M University)

1 0