May 2012 - Test - lists.nanog.org

rpki vs. secure dns?
by Paul Vixie 05 Jun '12

05 Jun '12

http://tech.slashdot.org/story/12/04/27/2039237/engineers-ponder-easier-fix… > "The problem: Border Gateway Protocol (BGP) enables routers to > communicate about the best path to other networks, but routers don't > verify the route 'announcements.' When routing problems erupt, 'it's > very difficult to tell if this is fat fingering on a router or > malicious > <http://www.itworld.com/security/272320/engineers-ponder-easier-fix-dangerou…>,' > said Joe Gersch, chief operating officer for Secure64, a company that > makes Domain Name System (DNS) server software. In a well-known > incident, Pakistan Telecom made an error with BGP after Pakistan's > government ordered in 2008 that ISPs block YouTube, which ended up > knocking Google's service offline > <http://slashdot.org/story/08/02/25/1322252/pakistan-youtube-block-breaks-th…>. > A solution exists, but it's complex, and deployment has been slow. Now > experts have found an easier way." this seems late, compared to the various commitments made to rpki in recent years. is anybody taking it seriously?

27 69

Questions about anycasting setup
by Anurag Bhatia 04 Jun '12

04 Jun '12

Hello everyone. I am working on creating a small anycasting based setup with 3-4 servers in US. Plan is to use this for DNS and later for CDN setups. I have few confusions in mind and was wondering if you guys here can put some light on them: 1. For anycasting does announcing a /24 from different ASNs (of different datacenters) makes sense or it will be an issue to have a block being announced from different ASNs and I should avoid and prefer having own router below datacenters network and eventually use one single ASN to announce the anycasting block? 2. We plan to use this anycasting based setup for DNS during initial few months. Assuming low traffic for DNS say ~10Mbps on average (on 100Mbps port) and transit from just single network (datacenter itself) - is this setup OK for simple software based BGP like Quagga or Bird? Certainly colocating routers will be slow & expensive. Does it offer any direct advantage in such simple setups? 3. IPv6! - I am looking at possibility of having support of IPv6 in anycast right from start. Can't really find a good prefix size for anycasting announcement. I can see Hurricane Electric as well as Google using whole /32 block for IPv6. So is /32 is standard? We have only one /32 allocation from ARIN and thus if using /32 seems like hard deal - we have to likely get another /32 just for anycasting? or we can use /48 without issues? Also, is /48 a good number for breaking /32 so that we can do /48 announcements from different datacenters in simple uni casting setup? I apologize for any wrong questions/logic - really new to this. Please correct me if I am wrong on any concept. Appreciate your help. Thanks. -- Anurag Bhatia anuragbhatia.com or simply - http://[2001:470:26:78f::5] if you are on IPv6 connected network! Twitter: @anurag_bhatia <https://twitter.com/#!/anurag_bhatia> Linkedin: http://linkedin.anuragbhatia.com

7 16

HE.net BGP origin attribute rewriting
by Daniel Suchy 02 Jun '12

02 Jun '12

Hello, we discovered, that at least Hurricane Electric (HE, AS 6939) does rewrite BGP origin attribute unconditionally in all routes traversing their network. This mandatory, but probably not widely known/used attribute should not be changed by any speaker except originating router (RFC 4271, section 5.1.1). HE rewrites origin for all routes. I tried communicate this issue with HE, but they're not willing change their configuration and respect mentioned RFC document, and they're claiming, that another networks (Level3 was mentioned exactly) does similar thing. In my experience, there're not so many service providers doing that. What's your view on this, do you think, that service providers can simply ignore existing RFCs? With regards, Daniel

11 28

Comcast IPv6 Update
by Brzozowski, John 01 Jun '12

01 Jun '12

Update from http://www.comcast6.net IPv6 Pilot Market Deployment Begins Wednesday, November 9, 2011 Comcast has started our first pilot market deployment of IPv6 in limited areas of California and Colorado. This first phase supports directly connected CPE, where a single computer is directly connected to a cable device. A subsequent phase will support home gateway devices. To learn more, check out FAQs on the pilot market deployment<http://www.comcast6.net/pilotfaq.php> and the announcement<http://blog.comcast.com/2011/11/ipv6-deployment.html> and technical details<http://blog.comcast.com/2011/11/ipv6-deployment-technology.html> on our blog. John ========================================= John Jason Brzozowski Comcast Cable e) mailto:john_brzozowski@cable.comcast.com o) 609-377-6594 m) 484-962-0060 w) http://www.comcast6.net =========================================

13 20

BGP ORF in practice
by Wayne Tucker 01 Jun '12

01 Jun '12

What's the general consensus (hah! ;) regarding the use of RFC5291 BGP outbound route filtering? It's worked well for me in the lab, but I have yet to use it in a live environment (and I don't know that most service providers would know what I was talking about if I asked for it). Does it work great or does it end up being more pain than it's worth? Thanks :w

2 2

Re: [liberationtech] Syria blackout?
by Eugen Leitl 31 May '12

31 May '12

----- Forwarded message from KheOps <kheops(a)ceops.eu> ----- From: KheOps <kheops(a)ceops.eu> Date: Thu, 31 May 2012 23:11:37 +0200 To: liberationtech(a)lists.stanford.edu Subject: Re: [liberationtech] Syria blackout? User-Agent: Mozilla/5.0 (X11; Linux i686; rv:12.0) Gecko/20120430 Thunderbird/12.0.1 Yes, this has been confirmed by several people we know there. Tor seems to be blocked at least on 3G connections. Download of some file extensions through cleartext HTTP is blocked too (mp4, flv, mpg, ...). It seems UltraSurf and some other VPNs are blocked too, though as Andrew said, some other specific ones continue working. For Tor, it would be worth setting up obfsproxy-equipped bridges. We will try to work on this asap on our side. KheOps On 05/31/2012 08:36 PM, Andrew wrote: > And it looks like I maybe wrong. It seems that torrents, and videos > stopped working sometime yesterday. I am going to do some more > digging. Tor, and some specific types of VPNs still seem to be working > fine. > > -Andrew > > On 5/31/2012 2:26 PM, Eugen Leitl wrote: >> ----- Forwarded message from Rafael Cresci <rafael(a)cresci.org> >> ----- > >> From: Rafael Cresci <rafael(a)cresci.org> Date: Thu, 31 May 2012 >> 14:41:09 -0300 To: nanog(a)nanog.org Subject: Syria blackout? >> X-Mailer: Apple Mail (2.1278) > >> Customers (from UAE) who have servers with us in Atlanta - one of >> the companies I work for, remaining anonymus for the moment - are >> reporting that their sub-customers and viewers from Syria can't >> access FTP or download any kind of Flash/video/multimedia content >> from inside that country. Completely blocked. > >> Anyone confirms? > >> Another government blockage to avoid social captiruing of massacre >> videos and photos? > > >> ----- End forwarded message ----- > > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" > > You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Current IPv6 state of US Mobile Phone Carriers
by Paul Porter 31 May '12

31 May '12

Hi NANOG, I'm looking for some information on the four largest US mobile phone carriers and the current state of their IPv6 infrastructure. Specifically, we are trying to figure out: 1. How much of the carrier core and edge for AT&T, Verizon. T-Mobile, and Sprint are on IPv6 now? 2. If, and how, are they handling NAT64 for native IPv6 edge devices? 3. What is the percentage of breakdown for users on native IPv6? Dual stacked? GREE is a mobile social gaming company and we're trying to better understand what lies between our customer's smart phones and our servers. My next step will be to reach out to the carriers themselves, but I figured many of their Network Engineers are probably on the NANOG mailing list and this would be a great place to start. Thanks in advance for your time and assistance. Sincerely, - Paul Porter -- *Paul G. Porter *GREE International | Network Engineer CCNP, CCSP, JNCIS-FWV, JNCIA-Junos E-mail: paul.porter(a)gree.net Mobile: (510) 371-1147 Twitter: paul_g_porter

20 33

Re: Vixie warns: DNS Changer ‘blackouts’ inevitable
by Christopher Morrow 31 May '12

31 May '12

On Wed, May 23, 2012 at 1:40 AM, <bmanning(a)vacation.karoshi.com> wrote: > Paul will be there to turn things off when > they no longer make money for his company. is the dns changer thingy making money for isc?

11 13

Re: [liberationtech] Syria blackout?
by Eugen Leitl 31 May '12

31 May '12

----- Forwarded message from Andrew <andrew(a)pdqvpn.com> ----- From: Andrew <andrew(a)pdqvpn.com> Date: Thu, 31 May 2012 14:36:22 -0400 To: liberationtech(a)lists.stanford.edu Subject: Re: [liberationtech] Syria blackout? User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 And it looks like I maybe wrong. It seems that torrents, and videos stopped working sometime yesterday. I am going to do some more digging. Tor, and some specific types of VPNs still seem to be working fine. - -Andrew On 5/31/2012 2:26 PM, Eugen Leitl wrote: > ----- Forwarded message from Rafael Cresci <rafael(a)cresci.org> > ----- > > From: Rafael Cresci <rafael(a)cresci.org> Date: Thu, 31 May 2012 > 14:41:09 -0300 To: nanog(a)nanog.org Subject: Syria blackout? > X-Mailer: Apple Mail (2.1278) > > Customers (from UAE) who have servers with us in Atlanta - one of > the companies I work for, remaining anonymus for the moment - are > reporting that their sub-customers and viewers from Syria can't > access FTP or download any kind of Flash/video/multimedia content > from inside that country. Completely blocked. > > Anyone confirms? > > Another government blockage to avoid social captiruing of massacre > videos and photos? > > > ----- End forwarded message ----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPx7omAAoJEJW/J8aB8dYIUkYIAJtSxAFptjkShh3rpYXPKXpi 7wXj77j126e5mk5Dd/XpR1VuiRyTBbBt+fscRWZaW1c6IvDTe9YjrYDMFUcq3tns dWCvqD+sMowhB9UGnx9zOe+mJwOoMMqAI6rWtewNKQPlgDbA+wzVujGsLHT1jdYz YGujXrCudM2+w79uL79vmJRJ/r6DgaUDgif5beubEdcTzP0uGL3zg8rhCAQ1Oh6I qKHV9AdC4jEmGmz0Abd0KoCpVrEyI4QypD7TiCToo+Uc3TSjtXcRmxmZiT+183FH YCg8JBEYqFSArmk8S5YXxxQwDYvYN83jTp8Esrrlh8Rae22f45E7EXDw6xV0qlo= =57kz -----END PGP SIGNATURE----- _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

2 1

Re: [liberationtech] Syria blackout?
by Eugen Leitl 31 May '12

31 May '12

----- Forwarded message from Andrew Lewis <andrew(a)pdqvpn.com> ----- From: Andrew Lewis <andrew(a)pdqvpn.com> Date: Thu, 31 May 2012 14:29:05 -0400 To: Eugen Leitl <eugen(a)leitl.org>, liberationtech(a)lists.stanford.edu Subject: Re: [liberationtech] Syria blackout? User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Not as far as I can tell. Everything seemed to be the same, and my contacts in Syria haven't reported anything amiss. On 5/31/12 2:26 PM, Eugen Leitl wrote: > ----- Forwarded message from Rafael Cresci <rafael(a)cresci.org> > ----- > > From: Rafael Cresci <rafael(a)cresci.org> Date: Thu, 31 May 2012 > 14:41:09 -0300 To: nanog(a)nanog.org Subject: Syria blackout? > X-Mailer: Apple Mail (2.1278) > > Customers (from UAE) who have servers with us in Atlanta - one of > the companies I work for, remaining anonymus for the moment - are > reporting that their sub-customers and viewers from Syria can't > access FTP or download any kind of Flash/video/multimedia content > from inside that country. Completely blocked. > > Anyone confirms? > > Another government blockage to avoid social captiruing of massacre > videos and photos? > > > ----- End forwarded message ----- -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPx7hxAAoJEJW/J8aB8dYIMEgIAIGuNaBKjCpZDpD7VFx+sig+ rAnmeQzxARQBZixb858qAncpEKP71gDJhdS8tcKRTuTZk8k59/781aFjmnVvCC2j QRNMmHl6AOggt/5T0VHY+E3ixm7mAOTM3TtumlwPNKKecI6GzzP1CDkAyvnSUKU7 FpDzv4JrsRCJZrtv0Sg5A5ijvWf3JT020sCjTchC05/FTaqjukmOvAGm9vrh2eFy bDUprMD83tqVDpKeCtRWhh+v4L9nXgoRBYoJ0JOnP1A+/wcFCk3AVNL9VcS1zZHQ TlI/1WbbL9MNtZg+GIv5ZgDtiIpgy/hqk9tBWh/ZSM79YTX/dAw17vK3TpZ4Rww= =58O+ -----END PGP SIGNATURE----- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0