July 2012 - Test - lists.nanog.org

Re: U.S. spy agencies ... email for cybersecurity
by Jason Pope 10 Jul '12

10 Jul '12

Seriously, on the subject of "email for cybersecurity", can we please just black list NIG NOG <nanog195(a)yahoo.com>? Jason K Pope

1 0

Running your own DNSchanger proxies
by Cameron Byrne 10 Jul '12

10 Jul '12

On the other thread i read that some ISP are running their own proxies for infected host. That sounded interesting, so i googled around to find out how to do that and i could not find a HOWTO, so imagined up a solution myself, tested it in VirtualBox, and wrote it down in case anyone finds it useful or has another approach https://sites.google.com/site/cbyrne/dnschanger I don't plan to use this solution, but it was interesting to think about and may be a good starting point in the unlikely event that some VP pushes the panic button on Monday. CB

4 3

arin ipv6 whois working for you?
by David Hubbard 10 Jul '12

10 Jul '12

I want to make sure it's not just me but I'm not seeing a bgp route from my upstreams to networks with the addresses they're advertising: ;; ANSWER SECTION: whois.arin.net. 274 IN AAAA 2001:500:13::48 whois.arin.net. 274 IN AAAA 2001:500:13::46 whois.arin.net. 274 IN AAAA 2001:500:13::47 Thanks, Dave

4 4

Re: job screening question
by Derek Andrew 10 Jul '12

10 Jul '12

Isn't MTU discovery on IP and not TCP? On Thu, Jul 5, 2012 at 11:11 AM, Oliver Garraux <oliver(a)g.garraux.net>wrote: > Seems fairly straightforward to me. It'll break path MTU discovery. > > I would hope someone applying for an "IP expert" position would know that. > > Could HR be mangling the question or something? > > Oliver > > ------------------------------------- > > Oliver Garraux > Check out my blog: www.GetSimpliciti.com/blog > Follow me on Twitter: twitter.com/olivergarraux > > > On Thu, Jul 5, 2012 at 1:02 PM, William Herrin <bill(a)herrin.us> wrote: > > Hi folks, > > > > I gave my HR folks a screening question to ask candidates for an IP > > expert position. I've gotten some "unexpected" answers, so I want to > > do a sanity check and make sure I'm not asking something unreasonable. > > And by "unexpected" I don't mean naively incorrect answers, I mean > > oh-my-God-how-did-you-get-that-cisco-certification answers. > > > > The question was: > > > > You implement a firewall on which you block all ICMP packets. *What* > > *part of the TCP protocol (not IP in general, TCP specifically)* > > *malfunctions as a result?* > > > > > > My questions for you are: > > > > 1. As an expert who follows NANOG, do you know the answer? Or is this > > question too hard? > > > > 2. Is the question too vague? Is there a clearer way to word it? > > > > 3. Is there a better screening question I could pass to HR to ask and > > check the candidate's response against the supplied answer? > > > > Thanks, > > Bill Herrin > > > > > > -- > > William D. Herrin ................ herrin(a)dirtside.com bill(a)herrin.us > > 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> > > Falls Church, VA 22042-3004 > > > > -- Copyright 2012 Derek Andrew (excluding quotations) +1 306 966 4808 ICT University of Saskatchewan Peterson 120; 105 North Road Saskatoon,Saskatchewan,Canada. S7N 4L5 Timezone GMT-6 Typed but not read. [image: Description: Description: Description: Description: Description: cid:image002.png@01CCD52C.EA7400D0] <http://www.usask.ca/> --

21 31

Re: U.S. spy agencies ... email for cybersecurity
by Jeff Shultz 10 Jul '12

10 Jul '12

One thing that GEN Alexander has is a clue. He was my Battalion Commander in Germany in the early 90s and he is one of those guys you don't give a second thought to following. Very competent.

1 0

Carrier assistance
by Darrell Hyde 09 Jul '12

09 Jul '12

Could anyone from Qwest/CenturyLink, TW Telecom, or XO with the ability to assist with some null routing please drop me a line off-list? Got a customer getting attacked in one of my sites and our calls are languishing in hold queues. Thanks in advance, - Darrell

5 4

Any advantage of announcing IPv6/64s Or purely misconfiguration?
by Anurag Bhatia 09 Jul '12

09 Jul '12

Hello everyone I was just looking around and say a major Indian provider Sify (AS9583) is announcing /64s via BGP along with main /32 which is their allocation from APNIC. inet6num: 2001:0E48::/32 netname: SILNET descr: Sify Limited descr: Value Added Network service provider country: IN admin-c: HS51-AP tech-c: HS51-AP status: ALLOCATED PORTABLE mnt-by: APNIC-HM mnt-lower: MAINT-IN-SIFY changed: hm-changed(a)apnic.net 20040211 changed: hm-changed(a)apnic.net 20060117 source: APNIC As per IPv6 prefixes announced by AS9583 via bgp.he.net - http://bgp.he.net/AS9583#_prefixes6 we can see multiple /64s. Prefix <http://bgp.he.net/AS9583#>Description <http://bgp.he.net/AS9583#> 2001:0e48::/32 <http://bgp.he.net/net/2001:0e48::/32>Sify Limited [image: India] 2001:0e48:0000:0001::/64 <http://bgp.he.net/net/2001:0e48:0000:0001::/64>Sify Limited [image: India] 2001:0e48:0000:0002::/64 <http://bgp.he.net/net/2001:0e48:0000:0002::/64>Sify Limited [image: India] 2001:0e48:0000:0004::/64 <http://bgp.he.net/net/2001:0e48:0000:0004::/64>Sify Limited [image: India] I see Tata Comm (Sify's upstream) is accepting /64s while Tinet (one of other upstream) is dropping and taking only /32. Other major backbones like HE, Level3 dropping but Telia still accepting. Pretty much mixed result. Is it simply a misconfiguration or there is some use of announcing /64s along with main /32? Thanks. -- Anurag Bhatia Web: anuragbhatia.com Skype: anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia>| Google+ <https://plus.google.com/118280168625121532854>

7 7

Re: FYI Netflix is down
by gb10hkzo-nanog＠yahoo.co.uk 09 Jul '12

09 Jul '12

Steve at pirk, I fail to grasp the concept in your argument. You do realise, do you not, that your $$$$$ black boxes from your favourite brand name vendor have software running inside of them do you not ? Case in point for example, the recent LINX issues.... it wasn't the hardware that gave them the headaches, but the software running on it sure did ! >I am a big believer in using hardware to load balance data centers, and not >leave it up to software in the data center which might fail.

3 2

Re: job screening question
by Scott Weeks 08 Jul '12

08 Jul '12

--- jason(a)thebaughers.com wrote: From: Jason Baugher <jason(a)thebaughers.com> Geez, I'd be happy to find someone with a good attitude, a solid work ethic, and the desire and aptitude to learn. :) --------------------------------------- Yeah, that. But how do you get those folks through the HR process to you, so you can decipher their skill/work ethic level? What can the HR person ask to find out if someone has these qualities? OSPF LSA type questions will not help. I definitely would rather work with a person willing to learn the nuances of the particular network, rather than someone that can spit out canned answers. scott

22 29

FW: job screening question
by Keith Medcalf 07 Jul '12

07 Jul '12

(now copied to list as well) On Sat 07 July, 2012 at 20:32, Owen DeLong wrote: >>> "What TCP destination port numbers should be allowed through the >>> perimeter stateful firewall device to and from a mail server whose >>> only purpose is to proxy SMTP mail from internal sources?" >>> (one number answer) >> Short Answer: There is no answer to the question that can be expressed in >> one number. > Sure there is, if you count "none" as a number. None, NIL, NUL, NULL would be valid I suppose if nulls were permitted. 0 however is not correct. >> Outbound connections to TCP destination port 25 only. Returning traffic >> (including associated ICMP) should be automatically handled by your stateful >> inspection firewall. If not, you need to buy a better firewall. > I'd allow 25 and 465 outbound, myself. No reason to block SSL if the remote > side offers the capability. http://www.imc.org/ietf-apps-tls/mail-archive/msg00204.html SMTPS is deprecated and port 465 is no longer registered for SMTPS (SMTP over SSL), it is now for <record> <name>urd</name> <protocol>tcp</protocol> <description>URL Rendesvous Directory for SSM</description> <number>465</number> </record> So even though many folks may still run SMTPS on port 465, you SHOULD be using STARTTLS on port 25. > ICMP wouldn't be a TCP destination port number anyway. Very true. The again, there is a significant proportion of the same experts who think DNS only runs over UDP ... > > Any applicant who provides any answer should the rejected out of hand as > (a) being unable to read (b) being a threat to security. > LoL... Some truth to that. You would be surprised how many people think that if you permit tcp host x.x.x.x any eq 25 to let traffic out, then you need permit tcp any eq 25 host x.x.x.x as the inverse to permit returning traffic. This is more of a problem when using packet filtering than it is when configuring stateful inspection firewalls. Nonetheless, the question does ask what should be opened "to and from" in order to "proxy SMTP mail from internal sources". It could of course just be a brilliant question designed to detect such problems ... > Owen Keith --- () ascii ribbon campaign against html e-mail /\ www.asciiribbon.org

1 0