January 2012 - Test - lists.nanog.org

Possible New Zero Day Microsoft Windows 3389 vulnerability - outbound traffic 3389
by James Braunegg 13 Jan '12

13 Jan '12

Hey All, Just posting to see if anyone has seen any strange outbound traffic on port 3389 from Microsoft Windows Server over the last few hours. We witnessed an alarming amount of completely independent Microsoft Windows Servers, each on separate vlan and subnets (ie all /30 and /29 allocations) with separate gateways on and completely separate customers, but all services were within the same 1.x.x.x/16 allocation all simultaneously send around 2mbit or so data to a specific target IP address. The only common link was / is terminal services port 3389 is open to the public. Obviously someone (Mr 133t dude) scanned an allocation within our network, and like a worm was able to simultaneously control every Microsoft Windows Server to send outbound traffic. Microsoft Windows Servers within the 1.x.x.x/16 allocation which were behind a firewall or VPN and did not have public 3389 access did not send the unknown traffic Would be very interested if anyone else has seen this behavior before ! Or is this the start of a lovely new Zero Day Vulnerability with Windows RDP, if so I name it "ohDeer-RDP" A sample of the traffic is as per below, collected from netflow Source Destination Application Src Port Dst x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 51534 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 52699 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 60824 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 51669 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 49215 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 62099 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 65429 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 51965 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 50381 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 59379 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 58103 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 59514 TCP x.x.x.x/16 58.162.67.45 ms-wbt-server 3389 58298 TCP This occurred around 10:30pm AEST Friday the 13th of January 2012 We had many other Microsoft Windows Servers in other 2.x.x.x/16 IP ranges which were totally unaffected. Kindest Regards James Braunegg W: 1300 769 972 | M: 0488 997 207 | D: (03) 9751 7616 E: james.braunegg(a)micron21.com<mailto:james.braunegg@micron21.com> | ABN: 12 109 977 666 [Description: Description: Description: M21.jpg] This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.

5 6

In search of uplink vendor
by Paul Kaminsky 12 Jan '12

12 Jan '12

Hi all, We are at a stage where we need an all-out uplink vendor to fuel our business endeavor. The bells and whistles we need are: 1. 1 Gbps link with complete block of UDP/ICMP protocol 2. BGP session with our AS 3. Ability to blackhole (no route to host) by /32 prefix 4. Presence in Equinix SV1 or SV5 (San Jose) DC's - this is not mandatory, we're open for suggestions If you feel your company measures up or is a cut above the rest, please get in touch with us to discuss the specific details. Cheers Paul

9 15

RE: Linux Centralized Administration
by Paul Stewart 12 Jan '12

12 Jan '12

Awesome! I remember someone telling me about this before and couldn't remember the name til now... Cheers, Paul -----Original Message----- From: Daniel Ankers [mailto:md1clv@md1clv.com] Sent: Thursday, January 12, 2012 4:08 PM To: Paul Stewart Subject: Re: Linux Centralized Administration On 12 January 2012 21:02, Paul Stewart <paul(a)paulstewart.org> wrote: > Hey folks. just curious what people are using for automating updates > to Linux boxes? > > Today, we manually do YUM updates to all the CentOS servers . just an > example but a good one. I have heard there are some open source > solutions similar to that of Red Hat Network? It so happens that just yesterday I stumbled across Spacewalk (http://spacewalk.redhat.com) - which is the open source version of RHN Satellite. I ran into a few problems setting the server up - but nothing too difficult to solve, and client installation is a breeze. Dan

1 0

QinQ switch or similar
by Bonald 12 Jan '12

12 Jan '12

Hi, We need to purchase some switch that support 1gbit QinQ. Any suggestions ? We need to connect 9 schools together in layer2. All 9 schools have 1gb link from our provider, provider gaves us 5 vlan to work with. We have around 35 vlan in-house. We are low budget. Any recommendation beside QinQ ?

7 6

Looking for Capitol One, NA POC
by whtn0ise 12 Jan '12

12 Jan '12

If there is a member Capitol One North America's IT/Security on this distro please contact me off line please.

1 0

Whacky Weekend: Is Internet Access a Human Right?
by Jay Ashworth 12 Jan '12

12 Jan '12

Vint Cerf says no: http://j.mp/wwL9Ip But I wonder to what degree that's dependent on how much our governments make Internet access the most practical/only practical way to interact with them. Understand: I'm not saying that FiOS should be a human right. But as a society, America's recognized for decades that you gotta have a telephone, and subsidized local/lifeline service to that extent; that sort of subsidy applies to cellular phones now as well. Thoughts? Cheers, -- jr 'yes, I know I'm early...' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

20 32

So... my colo was just bought.
by Jay Ashworth 11 Jan '12

11 Jan '12

By Knology. Should I be scared? My experiences with Knology have been fairly thin, but uniformly negative, for at least the last 5 years. But I know that the plural of 'anecdote' is not 'data'. That said, I'm accepting all anecdotes. :-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

9 13

IPv6 RA vs DHCPv6 - The chosen one?
by Ravi Duggal 11 Jan '12

11 Jan '12

Hi, IPv6 devices (routers and hosts) can obtain configuration information about default routers, on-link prefixes and addresses from Router Advertisements as defined in Neighbor Discovery. I have been told that in some deployments, there is a strong desire not to use Router Advertisements at all and to perform all configuration via DHCPv6. There are thus similar IETF standards to get everything that you can get from RAs, by using DHCPv6 instead. As a result of this we see new proposals in IETF that try to do similar things by either extending RA mechanisms or by introducing new options in DHCPv6. We thus have draft-droms-dhc-dhcpv6-default-router-00 that extends DHCPv6 to do what RA does. And now, we have draft-bcd-6man-ntp-server-ra-opt-00.txt that extends RA to advertise the NTP information that is currently done via DHCPv6. My question is, that which then is the more preferred option for the operators? Do they prefer extending RA so that the new information loaded on top of the RA messages gets known in the single shot when routers do neighbor discovery. Or do they prefer all the extra information to be learnt via DHCPv6? What are the pros and cons in each approach and when would people favor one over the other? I can see some advantages with the loading information to RA since then one is not dependent on the DHCPv6 server. However, the latter provides its own benefits. Regards, Ravi D.

42 144

Comcast DNSSEC
by Jeremy Bresley 11 Jan '12

11 Jan '12

Hadn't seen this mentioned yet. http://blog.comcast.com/2012/01/comcast-completes-dnssec-deployment.html Comcast has signed all their managed domains, as well as deployed DNSSEC resolvers for their customers. And they're encouraging others to make the jump to DNSSEC now as well, especially e-comm/banking sites. Nice work guys, any of the Comcast guys on the list want to give us an idea how much work is involved in this from a large-scale service provider perspective to do it? Any big caveats you encountered that people should watch out for? Jeremy "TheBrez" Bresley brez(a)brezworks.com

6 5

BOF at NANOG 54 - IPV4 runout, doing more with less.
by Joel jaeggli 11 Jan '12

11 Jan '12

Greetings, The BOF topic that I proposed during the recent thread: Re: Sad IPv4 story? Got approved, I'm still looking for 1-2 additional speakers to round out the agenda. To recap: * IPV4 run-out means new entrants will from the outset deploy techniques the present operators consider undesirable. * IPV6 should be appearing as part and parcel of new greenfield projects I would think. * On the vendor side CGN hardware is becoming a mature product space. * Datacenter/ICP operators confront a similar set of problems both supporting outgoing connections for large pools and incoming termination. I you have thoughts on any or all of these subjects your fellow NANOG participants are likely to be a receptive audience. In particular I think our colleagues running access networks would be potentially interested in thoughtful commentary on some of the following: * Port constrained or determistic nat mappings e.g. draft-donley-behave-deterministic-cgn-00 * What the near term state of residential/small business cpe are, and what if anything they're still missing to be suitable for ipv6 deployment. * What scaling properties pitfalls have been encountered with big stateful translation systems either nat44 or nat64. If you like a formal slot on the agenda, please reach out to me. If you simply have an interest in this area let me know and we'll see if we can fit your topic in the plan. Thanks joel

1 0