October 2012 - Test - lists.nanog.org

Detection of Rogue Access Points
by Jonathan Rogers 18 Oct '12

18 Oct '12

Gentlemen, An issue has come up in my organization recently with rogue access points. So far it has manifested itself two ways: 1. A WAP that was set up specifically to be transparent and provided unprotected wireless access to our network. 2. A consumer-grade wireless router that was plugged in and "just worked" because it got an address from DHCP and then handed out addresses on its own little network. These are at remote sites that are on their own subnets (10.100.x.0/24; about 130 of them so far). Each site has a decent Cisco router at the demarc that we control. The edge is relatively low-quality managed layer 2 switches that we could turn off ports on if we needed to, but we have to know where to look, first. I'm looking for innovative ideas on how to find such a rogue device, ideally as soon as it is plugged in to the network. With situation #2 we may be able to detect NAT going on that should not be there. Situation #1 is much more difficult, although I've seen some research material on how frames that originate from 802.11 networks look different from regular ethernet frames. Installation of an advanced monitoring device at each site is not really practical, but we may be able to run some software on a Windows PC in each office. One idea put forth was checking for NTP traffic that was not going to our authorized NTP server, but NTP isn't necessarily turned on by default, especially on consumer-grade hardware. Any ideas? Thank you for your time, Jonathan Rogers

25 38

best way to create entropy?
by shawn wilson 18 Oct '12

18 Oct '12

in the past, i've done many different things to create entropy - encode videos, watch youtube, tcpdump -vvv > /dev/null, compiled a kernel. but, what is best? just whatever gets your cpu to peak or are some tasks better than others?

18 25

WW: First round .web application IODesign sues ICANN
by Jay Ashworth 18 Oct '12

18 Oct '12

http://domainincite.com/10783-original-web-gtld-applicant-sues-icann Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

1 1

NRO NC Election now open to registered NANOG attendees !!
by John Curran 18 Oct '12

18 Oct '12

NANOG Community - The NRO NC (also known as the ASO AC) Election is open to NANOG meeting attendees; your participation will help select representatives from this region who will work on number policy coordination on a global basis, as well help in the selection of representatives to various ICANN bodies, including the ICANN Board. Please take a moment to review the attached materials and vote when you have a moment. Thank you! /John John Curran President and CEO ARIN Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] NRO NC Election Opens Today Date: October 17, 2012 9:52:19 AM EDT To: <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> The polls are now open for the election to fill the one open seat on the Number Resource Organization Number Council (NRO NC) from the ARIN region. The polls close at 5:00 PM ET, 24 October. Brief candidate biographies and a link to submit or view statements of support are posted on ARIN's website at: https://www.arin.net/app/election/ Designated Member Representatives (DMRs), NANOG Meeting attendees, and ARIN Meeting attendees are eligible to vote. NANOG or ARIN attendees must have registered for their meeting by 10 October 2012 to be eligible to vote. To vote, visit ARIN Election Headquarters and click on the Vote button. https://www.arin.net/app/election/ You can read instructions on how to cast your vote at: https://www.arin.net/participate/elections/instructions.html#vote Voters must cast and confirm their ballots by 5:00 PM ET, 24 October. A compilation of Candidate questionnaire responses in PDF is available at: https://www.arin.net/participate/elections/candidate_bios.pdf If you have any questions about voting or encounter problems with the system, please contact ARIN Member Services at info(a)arin.net<mailto:info@arin.net>. Regards, Communications and Member Services American Registry for Internet Numbers (ARIN) _______________________________________________ ARIN-Announce You are receiving this message because you are subscribed to the ARIN Announce Mailing List (ARIN-announce(a)arin.net<mailto:ARIN-announce@arin.net>). Unsubscribe or manage your mailing list subscription at: http://lists.arin.net/mailman/listinfo/arin-announce Please contact info(a)arin.net if you experience any issues.

1 0

14 years ago today....
by Rodney Joffe 16 Oct '12

16 Oct '12

... we lost Jon. http://www.ietf.org/rfc/rfc2468.txt

2 1

Re: processing passwords?
by Jay Ashworth 16 Oct '12

16 Oct '12

----- Original Message ----- > From: "Jean-Pierre A. Radley" <appl(a)jpr.com> > | $ JRA=test echo $JRA > | > | does not work in the superficially obvious manner, but it makes > | sense > | after I think about it -- it's like trying to use sudo with > | redirection. > | > | That behavior is documented back to the v7 shell, I'm pretty sure, > | though > | my v7 UPM is at home. > | > > Your shell isn't behaving like mine, in that case. I start out in tcsh > and: > > jpradley:appl 6 sh > $ unset JPR > $ JPR=test echo $JPR > > $ echo $JPR > test tcsh, not especially to my surprise, does not meet the SVID or POSIX, then. _Unix Shell Programming_, Kochan and Wood, 1985, Hayden, p 251: "Another Way To Pass Variables To A Subshell If you want to send the value of a variable to a subshell, there's another way to do it besides setting the variable and then exporting it. On the command line, you can precede the name of the command with the assignment of as many variables as you want. For example: DBHOME=/unx2/data DBID=452 dbrun places the variables DBHOME and DBID, and their indicated values, into the environment of dbrun, and then dbrun gets executed. *These variables will not be known to the current shell; they're created only for the execution of dbrun.*" (Emphasis mine). Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

1 0

Re: Internet-wide port scans
by Scott Weeks 16 Oct '12

16 Oct '12

--- djahandarie(a)gmail.com wrote: From: Darius Jahandarie <djahandarie(a)gmail.com> Either way, in the US at least, it's not legal to port scan random machines on the internet, so this was a rather useless exercise. (And ------------------------------------------------------ Want to re-write that section or should I respond now? ;-) scott

6 7

Re: 100.100.0.0/24
by Nick Hilliard 16 Oct '12

16 Oct '12

On 16/10/2012 11:37, Lowe, Richard B wrote: > Kind of like the 192.0.2.1/32 for IPv4, huh? no - 192.0.2.0/24 is formally "TEST-NET-1, documentation and examples", like 2001:db8::/32. 100::/64 is specifically for discard and analysis style RTBHs. I.e. for ipv6, you can now keep your documentation prefixes on your documentation. Nick > RFC: 5635 > > -----Original Message----- > From: Nick Hilliard [mailto:nick@foobar.org] > Sent: Sunday, October 07, 2012 6:40 AM > To: nanog(a)nanog.org > Subject: Re: 100.100.0.0/24 > > On 07/10/2012 00:34, Randy Bush wrote: >> ipv6 route 2001:DB8:0:DEAD:BEEF::1/128 Null0 > > plug: rfc 6666. > > 100::/64 is reserved for this purpose. > > Nick > > > >

1 0

Search DSL Supplier in Italy
by Olivier CALVANO 16 Oct '12

16 Oct '12

Hi I am search good DSL (Adsl/Sdsl/EFM) supplier in Italy. delivred in ATM, L2TP or EThernet Vlan (no internet) Contact me best regards Olivier

1 0

Attacking on Source Port 0 (ZERO)
by Shahab Vahabzadeh 15 Oct '12

15 Oct '12

Hi everybody, Does any body know what kind of attack can be come to port 0? I see such a logs in my routers which make high cpu loads: MYROUTERIP:0 *41.78.77.178:2816* MYROUTERIP:0 *217.160.5.153:2816* Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: +1 (415) 871 0742 PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90

5 8