June 2012 - Test - lists.nanog.org

Article: IPv6 host scanning attacks
by Fernando Gont 15 Jun '12

15 Jun '12

Folks, TechTarget has published an article I've authored for them, entitled "Analysis: Vast IPv6 address space actually enables IPv6 attacks". The aforementioned article is available at: <http://searchsecurity.techtarget.com/tip/Analysis-Vast-IPv6-address-space-a…> (FWIW, it's a human-readable version of the IETF Internet-Draft I published a month ago or so about IPv6 host scanning (see: <http://tools.ietf.org/html/draft-gont-opsec-ipv6-host-scanning>)) You can get "news" about this sort of stuff by following @SI6Networks on Twitter. Cheers, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

4 7

IETF I-D: Current issues with DNS Configuration Options for SLAAC
by Fernando Gont 15 Jun '12

15 Jun '12

Folks, We have published a new IETF I-D entitled "Current issues with DNS Configuration Options for SLAAC", about existing problems with the DNS configuration options used with SLAAC. The I-D is available at: <http://tools.ietf.org/id/draft-gont-6man-slaac-dns-config-issues-00.txt>. Abstract: ---- cut here ---- RFC 6106 specifies two Neighbor Discovery options that can be included in Router Advertisement messages to convey information about DNS recursive servers and DNS Search Lists. Small lifetime values for the aforementioned options have been found to cause interoperability problems in those network scenarios in which these options are used to convey DNS-related information. This document analyzes the aforementioned problem, and formally updates RFC 6106 such that these issues are mitigated. ---- cut here ---- This version of the I-D discusses different *alternative* mitigations for the forementioned problem. Your input will be very appreciated. Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Re: best practives multi-homed BGP 2 physical locations
by Philip Lavine 15 Jun '12

15 Jun '12

Easy part: I need to provide my users acces to the internet from my HQ site via a local Internet connection or via a colo. Hard part: I also need to provide incoming access to hosted apps (HTTP, FTP, SMTP) from either location, so if the colo internet connection goes down the traffic can re-route to the HQ server farm and visa versa. I am in the process of purchasing an AS and ip space. Is it advisable to use the same IP space at both locations and run iBGP over a dedicated L2 connection between the sites. P ________________________________ From: Mick O'Rourke <mkorourke(a)gmail.com> To: Philip Lavine <source_route(a)yahoo.com> Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> Sent: Thursday, June 14, 2012 2:48 PM Subject: Re: best practives multi-homed BGP 2 physical locations As in - use of multi or single AS? - private, vpn or other dci? - etc What's the purpose of the site? Or what end result are you trying to achieve? On Jun 15, 2012 6:04 AM, "Philip Lavine" <source_route(a)yahoo.com> wrote: Is there any best practices documentation on how to run BGP multihoming accross two phyiscally seperated sites. >

3 2

best practives multi-homed BGP 2 physical locations
by Philip Lavine 14 Jun '12

14 Jun '12

Is there any best practices documentation on how to run BGP multihoming accross two phyiscally seperated sites.

2 2

Re: EBAY and AMAZON
by Astro Dog 14 Jun '12

14 Jun '12

(Sorry for the top post. Mail client is being obnoxious.) Why? The prevalence of malware for a given OS is going to, generally, be a matter of most return for least work. If you're writing malware to steal credit card numbers, say, you're much better served writing it for Windows than you are OSX or Linux, even if it were slightly more difficult to do, because that will get you the largest number of card numbers, simply because more people use Windows. It's generally safe to assume that malware writers want to target as many machines as possible, thus they will focus on Windows, reg ardless of the relative ease or difficulty of the other platforms. There is no reason to believe that the platform distribution of malware would have a linear relationship with general usage rates or ease of exploitation, given the motivations and methods involved. --- Harrison ----- Original Message ----- From: Rich Kulawiec Sent: 06/13/12 06:55 AM To: nanog(a)nanog.org Subject: Re: EBAY and AMAZON On Tue, Jun 12, 2012 at 11:44:44AM +0000, Jamie Bowden wrote: > While MS may be a favorite whipping boy, let's not pretend that if the > dominant OS were Apple or some flavor of *nix, things would be any better. I've heard this argument many times, and I reject it this time as I have before. If popularity were the measure of relative OS security, then we would expect to see infection rates proportional to deployment rates: thus if operating systems A, B and C respectively accounted for 85%, 10%, and 5% of deployments, we should see those numbers reflected in infection rates.

4 3

[NANOG-announce] Survey Reminder
by Betty Burke <betty＠nanog.org> 14 Jun '12

14 Jun '12

NANOGers; Thank you to those recently participating in NANOG 55, Vancouver. Either as an on-site or remote attendee, speaker, sponsor, or member, your opinions are valued. If you have not yet completed the NANOG 55 survey(s), we would greatly appreciate you taking the time to complete them by visiting the NANOG 55 Survey http://www.nanog.org/meetings/nanog55/surveys.html The surveys will close at end of day Friday, June 15, 2012. Remember, your feedback will help us take action to continuously improve the NANG meeting experience! Sincerely, Betty -- Betty Burke NANOG Executive Director _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

WLC vlan size and management
by Andrey Khomyakov 14 Jun '12

14 Jun '12

Hi list, If I may ask for your advice, I have a Cisco 5508 WLC. Need to use it to manage APs at multiple buildings which I plan on doing using AP Groups. I understand that if I have one SSID mapped to one VLAN I can do it within the AP group and all is well. In my case, I have to provide a single SSID, but be able to assign clients into vlans based on their credentials. ACS 5.2 takes care of that with Tunnel-Private-Group-ID. Currently, I only have it managing one building, so the problem is only looming, but need to start converting my fat APs to LWAPs in other places. That means "way more clients than I can fit into a /24 or even a /23". The way I have it configured right now is as follows: 1. I have interfaces created in the WLC with names corresponding to the value that gets sent in Tunnel-Private-Group-ID (this is done because there are multiple controllers, but I can adjust to a tag instead. Though I don't think this will help in my case) 2. I have these interfaces grouped into an interface group. 3. I have the WLAN created and mapped to the interface group (which I'm pretty sure is not important, since AP group overrides this) 4. I have an AP Group with my APs in just this one building and that has that very same WLAN mapped to the same interface group mentioned above 5. ACS sends back the interface name in Tunnel-Private-Group-ID and the client gets placed into an appropriate vlan based on client's credentials Now the issue 1. I need to add other buildings full of APs, so I'm guessing more AP groups (one per building) 2. If I map the next new AP group to the same interface group it will work and the clients will get placed into the same vlans as the clients above 3. The issue is that at some point I will exhaust the DHCP scopes. I'm thinking that somehow I need to be able to place clients into an appropriate vlan based no only on credentials but also on location (that is building). What I can't find is how to match clients based on AP location in my WLC 7.0 + ACS 5.2 setup. The best I could come up with is tracking all AP's mac addresses and match Called-Station-ID based on those address, but that's a nightmare in my opinion. How do others do it? I would imaging there are some kind of "spill over" features that have to exist out there or some other technique Thanks, --Andrey

1 0

HE IPv6 tunnel inbound
by Grant Ridder 14 Jun '12

14 Jun '12

Hi, I have a Hurricane Electric v6 tunnel setup on an AWS (amazon web services) instance so that i can have ipv6 connectivity. I can ping and traceroute out of the tunnel fine, but am unable to access the tunnel from outside. For example, i am unable to traceroute to the tunnel address outside the tunnel address, even with the AWS instance firewall completely open. I would like to host a website accessible via IPv6, hence the tunnel setup. Is this possible? if so, what could i be doing wrong? Or is there a better was to go about this? Thanks, Grant

7 7

Re: HE IPv6 tunnel inbound
by Grant Ridder 14 Jun '12

14 Jun '12

Hi, Thanks for all the replies. I will look at Chris's solution to see if that will work. I had found similar instructions, but none as extensive. Also, I am using the AWS free tier right now, hence the choice, but i am open to other suggestions. Thanks, Grant On Thu, Jun 14, 2012 at 7:54 AM, seth <seth(a)untethered.org> wrote: > > > > > On Jun 13, 2012, at 11:10 PM, Cameron Byrne <cb.list6(a)gmail.com> wrote: > > > On Jun 13, 2012 8:29 PM, "Grant Ridder" <shortdudey123(a)gmail.com> wrote: > >> > >> Hi, > >> > >> I have a Hurricane Electric v6 tunnel setup on an AWS (amazon web > > services) > >> instance so that i can have ipv6 connectivity. I can ping and > traceroute > >> out of the tunnel fine, but am unable to access the tunnel from outside. > >> For example, i am unable to traceroute to the tunnel address outside the > >> tunnel address, even with the AWS instance firewall completely open. I > >> would like to host a website accessible via IPv6, hence the tunnel > setup. > >> Is this possible? if so, what could i be doing wrong? Or is there a > >> better was to go about this? > >> > >> Thanks, > >> Grant > > > > Sigh. > > > > Or you could take your business to the dozen or so cloud / vps providers > > that support ipv6. ... Softlayer and Arpnetworks come to mind. I have > used > > both with a high level of sucess > > > > CB > > But everybody knows that "amazon" and "cloud" are synonyms.

1 0

Re: very confusing.
by Randy Bush 14 Jun '12

14 Jun '12

NANOG, i strongly desire to restrain this slimeball idiot's trade. please tell me if you have any ideas on how to do so. --- > Be advised that Im following your posts and have your threating > messages to me. If there is an ddos or restraint of trade due to my > ACCIDENTAL email I'll escalate to commerce and FBI. LOL. you are not only a slimeball (who the ietf and nanog admins are scraping out), but an idiot. but do please tell me how i can restrain your trade. would love to discuss your spam with the DoC and FBI. randy

12 11