January 2013 - Test - lists.nanog.org

Re: Suggestions for the future on your web site: (was cookies, and before that Re: Dreamhost hijacking my prefix...)
by Scott Weeks 30 Jan '13

30 Jan '13

------- mpalmer(a)hezmatt.org wrote: ------- From: Matt Palmer <mpalmer(a)hezmatt.org> [Cookies on stat.ripe.net] On Wed, Jan 16, 2013 at 11:36:25AM -0800, Shrdlu wrote: > The cookie stays around for a YEAR (if I let it), and has the > following stuff: CSRF protection is one of the few valid uses of a cookie. <snip> By the way, if anyone *does* know of a good and reliable way to prevent CSRF without the need for any cookies or persistent server-side session state, I'd love to know how. Ten minutes with Google hasn't provided any useful information. ----------------------------------------- But, if I understand correctly, it only only if you are authenticated can anything bad be made to happen: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 "CSRF attacks generally target functions that cause a state change on the server but can also be used to access sensitive data. For most sites, browsers will automatically include with such requests any credentials associated with the site, such as the user's session cookie, basic auth credentials, IP address, Windows domain credentials, etc. Therefore, if the user is currently authenticated to the site, the site will have no way to distinguish this from a legitimate user request. In this way, the attacker can make the victim perform actions that they didn't intend to, such as logout, purchase item, change account information, retrieve account information, or any other function provided by the vulnerable website." So, if someone is just looking around, why is the cookie needed? scott

13 27

Calix optics for Muni
by Jay Ashworth 30 Jan '13

30 Jan '13

The box Jason was telling me about was the Calix 836GE, which, Leo, will make you happy cause it's a router/wifi/bridge with what looks to me like a Duplex-LC connector on the back. Its companion is their E7-20, a 20-slot chassis that will do (presently) 480 home-run ports or 10k GPONs in what looks like about 10U; double density linecards (which might well be just bidirectional optics, though the front panels don't look at all crowded just now) are in the pipe. If anyone's got this stuff deployed, and can whisper in my ear offlist a rough estimate of what price class it's in, that'd be neat. Yes, Calix reps are on the list; remember; I'm a 24-month client, minimum. Probably 36. Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

1 0

Looking for contact at COGENT routing team
by tglassey 30 Jan '13

30 Jan '13

I am looking for a contact at Cogent's route management team if you have one? Todd -- Regards TSG "Ex-Cruce-Leo" //Confidential Mailing - Please destroy this if you are not the intended recipient.

1 0

Time warner cable contact
by Emil Fredriksson 30 Jan '13

30 Jan '13

Hi Could someone from TWC contact me off list please. Trying to diagnose an issue where TWC customers can not reach my network. Much appreciated //Emil

1 0

IPV6 in enterprise best practices/white papaers
by Pavel Dimow 30 Jan '13

30 Jan '13

Hi, I have read many of those ipv6 documents and they are great but I still luck to find something like "real word" scenario. What I mean is that for example I want to start implementation of ipv6 in my enterprise according to mu knowledge so far my first step is to create address plan, then implement security on routers/switches then on hosts, and after that I can start to create AAAA record and PTR recors in DNS and after that I should configure my dhcp servers and after all has been done I can test ipv6 in LAN and after that I can start configure bgp with ISP. Is this correct procedure? Any thoughts? If all is correct I have a few questions.. Regarding DNS, if I give a /64 to host using SLAAC or DHCP how do I maintain PTR for this /64? I should use DDNS? What do you use in your enterprise SLAAC or DHCP? If SLAAC why not DHCP? Any other hints/tips?

23 49

Google's Public DNS does DNSSEC validation
by Marco Davids 30 Jan '13

30 Jan '13

This is interesting news; it seems that Google's Public DNS is performing DNSSEC validation (when the DO-bit is set): dig +dnssec +multi www.dnssec.nl @8.8.8.8 ; <<>> DiG 9.9.1-vjs163.18-P1 <<>> +dnssec +multi www.dnssec.nl @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51937 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;www.dnssec.nl. IN A ;; ANSWER SECTION: www.dnssec.nl. 21580 IN A 213.154.228.160 www.dnssec.nl. 21580 IN RRSIG A 8 3 86400 ( 20130227071505 20130128071505 33084 dnssec.nl. J9MzudQJHT7UEFZDxioAeOSARqvN87stHIiXLdl1f6ZB I3UGSqKIOlYpuaM7a6jk8k8oajUkGEHGOxa9ypJQHvlv mAE6noaI5sZh6R6lnkd48zGs/xPg4BNODG2zNb3I/lQ3 2ojQtcs9AIMDEtH5+XISuwvPre5hhYkneM6mtUc= ) ;; Query time: 28 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Tue Jan 29 08:03:53 2013 ;; MSG SIZE rcvd: 227 -- Marco Davids

5 4

BGP / ISIS route recorder advice
by Ben Bartsch 30 Jan '13

30 Jan '13

Greetings: I work for a REN and we are looking for advice on a route recorder. We have been working with Packet Design and I absolutely love their product RouteExplorer (well, everything except the price tag). I was wondering if anyone out there in NANOG land had any suggestions or recommendations on a product similar to their 3600 that can handle both ISIS and BGP (we have a goofy BGP config that includes a lot of RR clients so we need an appliance that can handle 7-8M routes if we do a full mesh with the recorder). I'm aware of iBGPlay, but have not been able to get them to answer emails requesting more information. If you can offer any suggestions, please let me know. Thanks! -ben

1 0

RE: switch 10G standalone TOR, core to DC
by Phil Bedard 30 Jan '13

30 Jan '13

Cisco also now has the Nexus 6001 but I don't know of its ability to do BGP or support things like Netflow. 48x10GE+4x40GE in 1RU. Also likely doesn't have huge packet buffers. From: Piotr Sent: 1/30/2013 5:32 To: nanog(a)nanog.org Subject: Re: switch 10G standalone TOR, core to DC Someone use this switches ? 1. Alacatel lucent omniswitch OS6900-X40 Deep packet buffers for simultaneous high-burst absorption in all ports gpl 28k$ 2. Hp 5900 af 48xg large buffer options - configurable buffers gpl 30k$ What is, exactly, buffer size ? I can't find in documentation best, Piotr

1 0

Re: switch 10G standalone TOR, core to DC
by Piotr 30 Jan '13

30 Jan '13

Someone use this switches ? 1. Alacatel lucent omniswitch OS6900-X40 Deep packet buffers for simultaneous high-burst absorption in all ports gpl 28k$ 2. Hp 5900 af 48xg large buffer options - configurable buffers gpl 30k$ What is, exactly, buffer size ? I can't find in documentation best, Piotr

1 0

Re: Muni network ownership and the Fourth
by Jay Ashworth 29 Jan '13

29 Jan '13

----- Original Message ----- > From: "Scott Brim" <swb(a)internet2.edu> > > (Actually, my approach if I was building it would be Layer 2 unless the > > resident wants a Layer 1 connection to {a properly provisioned ISP,some > > other location of theirs}. Best of both worlds.) > Right, and a public-private partnership model is more common than > having the city actually operate the network at any layer. Oh, sure; most muni's contract out the build, and often the day to day operation and customer support load, to a contractor. But that wouldn't really help as much in this case, I don't think; that contract would create an agency relationship, and the contractor would not protect such log data (if it existed, which for L1 and L2 service, it would not as this argument posits it) *from the responsible IT employees of the municipality*. Cheers, -- jr 'IANAL, I just play one on the Internet' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

6 6