April 2012 - Test - lists.nanog.org

rpki vs. secure dns?
by Paul Vixie 05 Jun '12

05 Jun '12

http://tech.slashdot.org/story/12/04/27/2039237/engineers-ponder-easier-fix… > "The problem: Border Gateway Protocol (BGP) enables routers to > communicate about the best path to other networks, but routers don't > verify the route 'announcements.' When routing problems erupt, 'it's > very difficult to tell if this is fat fingering on a router or > malicious > <http://www.itworld.com/security/272320/engineers-ponder-easier-fix-dangerou…>,' > said Joe Gersch, chief operating officer for Secure64, a company that > makes Domain Name System (DNS) server software. In a well-known > incident, Pakistan Telecom made an error with BGP after Pakistan's > government ordered in 2008 that ISPs block YouTube, which ended up > knocking Google's service offline > <http://slashdot.org/story/08/02/25/1322252/pakistan-youtube-block-breaks-th…>. > A solution exists, but it's complex, and deployment has been slow. Now > experts have found an easier way." this seems late, compared to the various commitments made to rpki in recent years. is anybody taking it seriously?

27 69

Questions about anycasting setup
by Anurag Bhatia 04 Jun '12

04 Jun '12

Hello everyone. I am working on creating a small anycasting based setup with 3-4 servers in US. Plan is to use this for DNS and later for CDN setups. I have few confusions in mind and was wondering if you guys here can put some light on them: 1. For anycasting does announcing a /24 from different ASNs (of different datacenters) makes sense or it will be an issue to have a block being announced from different ASNs and I should avoid and prefer having own router below datacenters network and eventually use one single ASN to announce the anycasting block? 2. We plan to use this anycasting based setup for DNS during initial few months. Assuming low traffic for DNS say ~10Mbps on average (on 100Mbps port) and transit from just single network (datacenter itself) - is this setup OK for simple software based BGP like Quagga or Bird? Certainly colocating routers will be slow & expensive. Does it offer any direct advantage in such simple setups? 3. IPv6! - I am looking at possibility of having support of IPv6 in anycast right from start. Can't really find a good prefix size for anycasting announcement. I can see Hurricane Electric as well as Google using whole /32 block for IPv6. So is /32 is standard? We have only one /32 allocation from ARIN and thus if using /32 seems like hard deal - we have to likely get another /32 just for anycasting? or we can use /48 without issues? Also, is /48 a good number for breaking /32 so that we can do /48 announcements from different datacenters in simple uni casting setup? I apologize for any wrong questions/logic - really new to this. Please correct me if I am wrong on any concept. Appreciate your help. Thanks. -- Anurag Bhatia anuragbhatia.com or simply - http://[2001:470:26:78f::5] if you are on IPv6 connected network! Twitter: @anurag_bhatia <https://twitter.com/#!/anurag_bhatia> Linkedin: http://linkedin.anuragbhatia.com

7 16

Comcast IPv6 Update
by Brzozowski, John 01 Jun '12

01 Jun '12

Update from http://www.comcast6.net IPv6 Pilot Market Deployment Begins Wednesday, November 9, 2011 Comcast has started our first pilot market deployment of IPv6 in limited areas of California and Colorado. This first phase supports directly connected CPE, where a single computer is directly connected to a cable device. A subsequent phase will support home gateway devices. To learn more, check out FAQs on the pilot market deployment<http://www.comcast6.net/pilotfaq.php> and the announcement<http://blog.comcast.com/2011/11/ipv6-deployment.html> and technical details<http://blog.comcast.com/2011/11/ipv6-deployment-technology.html> on our blog. John ========================================= John Jason Brzozowski Comcast Cable e) mailto:john_brzozowski@cable.comcast.com o) 609-377-6594 m) 484-962-0060 w) http://www.comcast6.net =========================================

13 20

OSS Systems
by Shahab Vahabzadeh 21 May '12

21 May '12

Hi there, Has anybody experience about running and OSS System in enterprise level? And do you have any idea about it? For example for an ISP who is running users more than 20K or 30K, there must be some good solutions to integrate all systems like: Radius, Billing Systems and CRM For example after searching and asking friends I have some ideas about Radius to use: radiator Is there anybody who has analyse such a systems before in his ISP? Need sharing here :) Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90

3 5

Re: Historical records of IP allocations
by Lucas Wang 21 May '12

21 May '12

We started keeping track of whois databases from March 20th this year, and our earliest data shows it belongs to a Russian company called DIMEDIA LLC. Now the latest whois shows it belongs to "OVH Telecom" located in France. On Nov 6, 2011, at 10:58 AM, Louis P wrote: > Hello, > Does anyone know if it's possible to get old records (AS numbers...) of an IP allocation ? > I found on RIPE these data : ftp://ftp.ripe.net/pub/stats/ripencc/ > But only the country and allocation date are included. > > The IP range I would like to have more information about is 109.190.0.0/17 (it was Russian before and now French). > > Thanks in advance, > Regards, > Louis P.

6 5

VPN over satellite
by Rens 10 May '12

10 May '12

Dear, Could anybody recommend any hardware that can build a VPN that works well over satellite connections? (TCP enhancements) I want to setup a L3 VPN between 2 satellite connections Even additionally if that hardware would also support WAN bonding even better because I also have a scenario to connect 2 times 2 satellites to have more capacity for my L3 VPN Regards, Rens

8 8

Question about peering
by Anurag Bhatia 10 May '12

10 May '12

Hello everyone I am curious to know how small ISPs plan peering with other interested parties. E.g if ISP A is connected to ISP C via big backbone ISP B, and say A and C both have open peering policy and assuming the exist in same exchange or nearby. Now at this point is there is any "minimum bandwidth" considerations? Say if A and C have 1Gbps + of flowing traffic - very likely peering would be good idea to save transit costs to B. But if A and C have very low levels - does it still makes sense? Does peering costs anything if ISPs are in same exchange? Does at low traffic level it makes more sense to keep on reaching other ISPs via big transit provider? Thanks. -- Anurag Bhatia anuragbhatia.com or simply - http://[2001:470:26:78f::5] if you are on IPv6 connected network! Twitter: @anurag_bhatia <https://twitter.com/#!/anurag_bhatia> Linkedin: http://linkedin.anuragbhatia.com

10 13

Operation Ghost Click
by Jeroen van Aart 09 May '12

09 May '12

Excuse the horrible subject :-) Anyone have anything insightful to say about it? Is it just lots of fuss about nothing or is it an actual substantial problem? http://www.fbi.gov/news/stories/2011/november/malware_110911 "Update on March 12, 2012: To assist victims affected by the DNSChanger malicious software, the FBI obtained a court order authorizing the Internet Systems Consortium (ISC) to deploy and maintain temporary clean DNS servers. This solution is temporary, providing additional time for victims to clean affected computers and restore their normal DNS settings. The clean DNS servers will be turned off on July 9, 2012, and computers still impacted by DNSChanger may lose Internet connectivity at that time." -- Earthquake Magnitude: 5.5 Date: Thursday, April 26, 2012 19:21:45 UTC Location: off the west coast of northern Sumatra Latitude: 2.6946; Longitude: 94.5307 Depth: 26.00 km

42 93

FW: Force10 E Series at the edge?
by Roberts, Brent 07 May '12

07 May '12

Is anyone running an E300 Series Chassis at the internet edge with multiple Full BGP feeds? 95th percent would be about 300 meg of traffic. BGP session count would be between 2 and 4 Peers. 6k internal Prefix count as it stands right now. Alternative are welcome. Thought about the ASR1006 but I need some local switching as well. Full requirements include Full internet Peering over GigE Links. Fully Redundant Power Redundant "Supervisor/Route Processor" Would prefer a Small Chassis unit. (under 10u) Would also prefer a single unit as opposed to a two smaller units. ________________________________ This email and any attached files may contain confidential and/or privileged material and is intended solely for the use of the person to whom it is addressed. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete it and all attachments from your computer. Progressive Solutions is not liable for any errors or omissions in the content or transmission of this email.

10 12

Re: Operation Ghost Click
by A. Pishdadi 02 May '12

02 May '12

At some point in like 10 years when all the computer illiterate people are gone there will be no more excuses for not being educated on malware and viruses. While I understand the ISP doesn't want to possibly cut into there profit margins they could easily put in place monitoring tools that can detect network traffic that is malware bound and reach out to the customer by email, phone and if need be by person. How much of tax payer money is spent to pay these FEDERAL (F.B.I.) agents to sit here and baby sit these computer ignorant and illiterate people for 6 months? So for the big ISPs like comcast i should pay out of my tax money because they cannot properly enforce a network policy that would require them to actually give a crap what is coming out of there network? There is always going to be viruses and malware, they will find ways to get them through but for heavens sake why would we if identified leave millions of compromised machines online with an attempt to do a cleanup? YOU as a network operator have a responsiblity to the other 40,000 AUTONOMOUS network to make sure your not polluting our private network infrastructure with garbage coming from your users and network. Clean up your mess. Like we will not tolerate spammers being housed on 'hosting' networks why should tolerate malware and infections coming from ISP's??? How much money is spent cleaning up hacked word press servers and udp.pl scripts... This is much bigger issue then at any cost making sure a user can get on to facebook to upload a picture of there cat sleeping upside down. If we enforced a proper policy and held network activity to certain standards the ISP's would fix the issue of ignorant users themselves by #1 educating there users , #2 implementing network monitoring on there outbound traffic to identify sources of infected and compromised machines, #3 implementing a cleanup policy, #4 letting the end user know they have a responsibility to make sure the machines they access the network from are clean and to do checks and to do there antivirus updates and os updates. Oh yah, and if we got all these 'supporting' DNS servers up why not just direct ALL users of it, who are clearly infected to a temporary page that will enlighten the customer that they are infected and give them instructions on clean up and give them a deadline of when there service will stop......... How hard is that? On Fri, Apr 27, 2012 at 10:55 PM, <Valdis.Kletnieks(a)vt.edu> wrote: > On Fri, 27 Apr 2012 21:39:20 -0500, you said: > > > Is it not detected by the common anti-virus software vendors? If the > > This assumes that the computer hasn't been hit by something *else* that > disables the user's AV software. Remember, multiple infections are > *common*. > > > internet stopped working on my computer i would reach out to someone who > > knew how to fix it, keeping these people online and spreading the malware > > helps how?? > > The point is that the internet *didn't* stop working, so they have no > reason to > reach out yet. > > And no, you can't just blindly cut the users off and make them call the > ISP for > several reasons: > > 1) At that point, the ISP incurs an expense to fix a problem they didn't > cause. > Remember that margins on most consumer-grade Internet accounts are pretty > thin, > and one long support call can wipe out the profit. So explain why the ISP > wants to cut off a user who makes them $10/year profit, and spend $30 or > more > handling the support call, when they aren't in the business of providing > security services to end users? > > 2) If the user has no POTS, cutting them off may have just cut off their > 911 > service. You want to take that risk? > > 3) Many times, there are multiple customer computers behind a NAT. Do you > really want the hassle of an irate user calling in because you just broke > the > dad's VPN to work, because one of their kids has some cruft on their > computer? > (And no, don't try to tell them they should have bought business class > service > or similar crap, that *will* lose you a customer). > > So explain why the ISP wants to cut off the user, when it will cost them > money, and possibly a customer? >

2 1