April 2012 - Test - lists.nanog.org

Yahoo Mail: Contact
by Thomas King 27 Apr '12

27 Apr '12

Hi all, could someone from Yahoo Mail please contact me off-list? Thanks in advance, Thomas -- Dr. Thomas King audriga GmbH Spitalstr. 23A | 76227 Karlsruhe www.audriga.com | www.twitter.com/audriga +49 (0) 1577 1539262 Handelsregister: Amtsgericht Mannheim - HRB 713034 Sitz der Gesellschaft: Karlsruhe Geschäftsführer: Frank Dengler, Hans-Jörg Happel, Dr. Thomas King USt-ID: DE 279724142

1 0

RPKI production support on Cisco, also EFT
by Alex Band 25 Apr '12

25 Apr '12

I didn't see any post on this topic here, so I just want to mention that RPKI is officially supported on these Cisco platforms: ASR1000, 7600, ASR903 and ASR901 – releases are 15.2(1)S or XE 3.5. Early Field Trial is available for the following platforms (contact bduvivie at cisco dot com): ASR9000, CRS1, CRS3 and c12K (IOS-XR). Source (in French): http://reseauxblog.cisco.fr/2012/04/23/jai-teste-pour-vous-securiser-le-rou… The RIPE NCC also just released RPKI Validator 2.1.0 with some new features and improvements: https://www.ripe.net/certification/tools-and-resources Here are instructions on how to hook up our Validator toolset to one of the Ciscos above: https://www.ripe.net/certification/router-configuration Cheers, Alex Band RIPE NCC -- This message has been scanned by Kaspersky Anti-Virus. For more information about data security please visit http://www.kaspersky.com and http://www.viruslist.com

2 1

admin for fixedorbit.com
by Kyle Creyts 25 Apr '12

25 Apr '12

The contact form appears to be down (503 bad gateway on submit), and if it is actively maintained, I would be very interested in talking to someone about how it works, and how its path tracing simulations or estimates compare with real-world numbers. (or if it is driven by real world numbers, how it compares to what we observe) Some of the information in the output of the path trace tool is less than verbose. -- Kyle Creyts

1 0

internap route server/looking glass?
by David Hubbard 25 Apr '12

25 Apr '12

Anyone know of, or have access to, a route server on Internap's (AS 12180) network? Trying to make sure a specific advertisement is being seen. Thanks, David

2 1

Juniper MX expert?
by Randy Carpenter 25 Apr '12

25 Apr '12

Any Juniper MX experts out there want to do some quick consulting for me (not for free)? I am working on implementing a couple of MX5 routers in a service provider setting, and have run into some issues. I am pretty proficient at the SRX and EX lines, but not as much with the MX. As the particulars of the issues go a little deeper than I feel comfortable asking for free help for, I will leave out the details on the list. Please contact me off list if you are willing and able to give me a hand. thanks, -Randy

1 1

10GBASE-LR SFP+ in Reston, VA
by Brandon Ewing 24 Apr '12

24 Apr '12

Greetings, Anyone know how I can get my hands on a SFP-10G-LR in the Reston area, tonight? -- Brandon Ewing (nicotine(a)warningg.com)

2 1

IPv6 dark traffic collection restarted
by Geoff Huston 24 Apr '12

24 Apr '12

Hi, In 2010, and again in 2011, I ran an experiment to examine the "dark" traffic in IPv6. I did this by announcing the "superblock" 2400::/12 which has been allocated to APNIC for its IPv6 allocations. The superblock announcement is an aggregate and will not disrupt any IPv6 traffic - the packets that will head to this dark traffic collector were on their way to /dev/null in any case. We are about to run this experiment up again to collect a 2012 data profile for IPv6 dark traffic in 2012. Accordingly, 2400::/12 will be announced by AS3562 - please don't filter it! IPv6 packets are scarce enough already! :-) This time around we are being assisted by Sandia National Laboratories and ESnet, for which APNIC would like to acknowledge their assistance in this ongoing research activity. Some URLs: - ESnet news item is at: http://www.es.net/services/ipv6-network/esnet-supports-sandia-and-apnic-ipv… - LOA for the announcement: http://www.sandia.gov/apnic/authorization.pdf - Previous re[port: http://www.potaroo.net/ispcol/2010-07/dark6.pdf thanks, Geoff

2 1

Partial Outage with TW Telecom and CenturyLink
by Eric C. Miller 24 Apr '12

24 Apr '12

Morning Everyone, Yesterday between about 1900 and 2230 UTC, we had a partial drop with reaching various sites through TW Telecom from our circuit in Orlando, FL. The unavailable sites included Facebook, Newegg, and Godaddy. The outage did not affect our Atlanta TW Telecom. I confered with a colleague who manages a large customer in Apopka who said that they appeared not to be affected. His circuit and ours loop to the same TW Telecom POP. But even more Murphy than that, our Centurylink secondary circuit was having a routing loop issue at the same time, so while our BGP routes were being advertised to world through Centurylink, the circuit was useless. Centurylink aknowledged the existence of a bigger transport issue and said that we weren't the only customer affected. Anybody else notice these issues or have any other insight? Thanks! Eric Miller

6 7

Fwd: Host scanning in IPv6 Networks
by Fernando Gont 24 Apr '12

24 Apr '12

FYI -------- Original Message -------- Subject: IPv6 host scanning in IPv6 Date: Fri, 20 Apr 2012 03:57:48 -0300 From: Fernando Gont <fgont(a)si6networks.com> Organization: SI6 Networks To: IPv6 Hackers Mailing List <ipv6hackers(a)lists.si6networks.com> Folks, We've just published an IETF internet-draft about IPv6 host scanning attacks. The aforementioned document is available at: <http://www.ietf.org/id/draft-gont-opsec-ipv6-host-scanning-00.txt> The Abstract of the document is: ---- cut here ---- IPv6 offers a much larger address space than that of its IPv4 counterpart. The standard /64 IPv6 subnets can (in theory) accommodate approximately 1.844 * 10^19 hosts, thus resulting in a much lower host density (#hosts/#addresses) than their IPv4 counterparts. As a result, it is widely assumed that it would take a tremendous effort to perform host scanning attacks against IPv6 networks, and therefore IPv6 host scanning attacks have long been considered unfeasible. This document analyzes the IPv6 address configuration policies implemented in most popular IPv6 stacks, and identifies a number of patterns in the resulting addresses lead to a tremendous reduction in the host address search space, thus dismantling the myth that IPv6 host scanning attacks are unfeasible. ---- cut here ---- Any comments will be very welcome (note: this is a drafty initial version, with lots of stuff still to be added... but hopefully a good starting point, and a nice reading ;-) ). Thanks! Best regards,

6 7

risk bearing/calculation for security service provider
by Ganbold Tsagaankhuu 24 Apr '12

24 Apr '12

Hi, I have some questions related to the security service that security SP offers. Is it common for SP to include risk related calculation into the security service (in contract/SLA) they offer? The question or problem might arise when some incident happened even the customer got secure hosting service from security SP. The customer might complain that SP doesn't protect them well and ask for some penalty in this case. So how does SP protect themselves in this case? Is there any best practice for that? thanks a lot, Ganbold

1 0