December 2012 - Test - lists.nanog.org

DDOS hardware appliances for network security - Arbor Pravail APS vs nsFocus ADS 6020 - Reviews - Feedback
by James Braunegg 02 Dec '12

02 Dec '12

Dear Nanog I would like to start a discussion on network security DDOS hardware appliances, mainly compairing the Arbor Pravail APS device vs the nsFocus ADS6020 device as I am looking at investing in such a product and would love to hear some industry feedback, reviews, information and from vendors etc. To provide some background information we are looking at a device for inline filtering to clean / filter out unwanted traffc inbound towards our network automaticaly. That being said I'm also happy to hear from other suppliers of appliances (not sure who else there is) or recomendations. For those who don't know much about either device the Arbor Pravail fact sheet can be found here http://www.arbornetworks.com/component/docman/doc_download/498-pravail-aps-… Like wise the fact sheet for the nsFocus ADS product can be found here http://www.nsfocus.com/en/uploadfile/Product/ADS/Datasheet/NSFOCUS%20ADS%20… Until recently I was only aware of the Arbor device, although after doing some research I quicky came up with another options, I'm sure many other people have asked / looked into the same questions before so let the debate begin... Kindest Regards James Braunegg W: 1300 769 972 | M: 0488 997 207 | D: (03) 9751 7616 E: james.braunegg(a)micron21.com<mailto:james.braunegg@micron21.com> | ABN: 12 109 977 666 [Description: Description: Description: Description: M21.jpg] This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.

1 0

Fwd: [tor-talk] William was raided for running a Tor exit node. Please help if you can.
by Mitar 02 Dec '12

02 Dec '12

Hi! Forwarding my answer to tor-talk list. Mitar ---------- Forwarded message ---------- From: Mitar <mmitar(a)gmail.com> Date: Sat, Dec 1, 2012 at 12:29 AM Subject: Re: [tor-talk] William was raided for running a Tor exit node. Please help if you can. To: tor-talk(a)lists.torproject.org Cc: nanog(a)nanog.org Hi! On Fri, Nov 30, 2012 at 2:09 PM, Naslund, Steve <SNaslund(a)medline.com> wrote: > Remember, they did not raid the Tor exit node. They raided the home of > the guy running the Tor exit node. Way different. I can probably explain that. We were running a Tor exit node in Slovenia (neighboring country of Austria, EU too). We had Tor exit node on collocation at local ISP and the collocation was on friend's name (not on some legal entity). Twice they came to his home in early hours with warrant for all computer equipment he has at home. Once because somebody was using Tor for blackmailing, the second time for child pornography. Why they came to his home? I believe the reason is simple: they have IP, they write to ISP something like "Who is your client who had that and that IP at that and that time?" ISP responds: "This is X Y, living there and there and + some other personal information they have on who this person is." Criminal investigators go to the judge and say "We need a warrant for this and this person at this and this location." They get one and they come to visit you in early morning hours. In both cases he just had to explain that: 1) this IP is at collocation and not at that location and 2) that it is a Tor exit node and we do not keep any logs of activity through it. 1) tells makes their warrant invalid and you move from being a suspect (they had in mind that you are using your own home connection to do something illegal, this is the highest probability based on their information) to a witness (you are server admin and it is higher probability that some your user did something illegal). 2) tells them that even if you are a witness, you are worthless witness: you do not have typical users and services, and you are not even logging anything. For most services you are not really required to log anything. Running Tor is not illegal. Having logs for it also not required. They left without taking anything and he hasn't heard from them afterwards (this was few years ago). It might be because both cases were international (Interpol) so for local investigators it was the easiest to just write: it was Tor exit nodes, no logs possible to obtain, case closed. And move on with their lives. If it would be some local thing with a very motivated investigator they might not believe him and would still confiscate equipment. But from a point when they discover that their warrant is probably wrong they are on thin ice as obviously IP was physically somewhere else. It might be that in this case of a guy from Austria he didn't know that it raid is for Tor node but he thought that it might be for something else and just later on discovered that. Or that they simply didn't listen to or believe him. Probably it depends on how you communicate with investigators and your language skills. Mitar

1 0

When an ISP should run their own IRR for customers
by ML 02 Dec '12

02 Dec '12

I'm querying the community on the feasibility of running my own IRR on behalf of customers whom probably aren't/won't register their own objects. I'm going down this path since I don't believe RADB or ARIN would let me register objects on behalf of my customers. I know I'm going to need this in the near future once my AS starts to peer. Conservatively I would be proxy registering about 100 customers. Would a potential upstream/peer NOT want to query my IRR because I'm not RADB, ARIN, etc (Essentially not a well known registry)? If not, is it likely my IRR could get mirrored by RADB so other networks can retrieve good info via RADB. If I was to run my own IRR is Merit's IRRd they way to go or is there something better? Thanks

2 1

Re: William was raided for running a Tor exit node. Please help if you can.
by Anne P. Mitchell, Esq. 01 Dec '12

01 Dec '12

> Example of an actual warrant: > > > https://www.eff.org/sites/default/files/filenode/inresearchBC/EXHIBIT-A.pdf Please also keep in mind, if it's relevant, that *no warrant* is required for data that is stored by a third-party. Data on a server, TOR or otherwise, would by definition be data that is stored by a third party. Which means that if there is a person of interest (POI), it would not be terribly hard to get at personal information about the POI that is not on their own private machines. (Here is an article we wrote about that: http://www.theinternetpatrol.com/no-warrant-necessary-for-law-enforcement-t… ) > Not a lawyer. Is a lawyer, but hasn't been following this thread. That said, if there are specific questions, I'd be happy to answer them if I can. Anne Anne P. Mitchell, Esq CEO/President Institute for Social Internet Public Policy http://www.ISIPP.com Member, Cal. Bar Cyberspace Law Committee

1 0

[liberationtech] Internet back in Syria
by Eugen Leitl 01 Dec '12

01 Dec '12

----- Forwarded message from Rafal Rohozinski <r.rohozinski(a)psiphon.ca> ----- From: Rafal Rohozinski <r.rohozinski(a)psiphon.ca> Date: Sat, 1 Dec 2012 10:39:24 -0500 To: liberationtech Technologies <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] Internet back in Syria Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Secdev detected BGP announcements from Syria as of 7:30 AM Eastern standard time. For our initial monitoring we look at the updates that are broadcast, because dumps of those are available every 15 minutes. However a more complete status is available every two hours, which will provide better insight into when the return of the address space was stabilized. How resources across the country are now reporting connectivity in a number of cities. Rafal Sent by SecDev secure mobile. Please excuse typos or other oddities. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0