February 2013 - Test - lists.nanog.org

Re: Network security on multiple levels (was Re: NYT covers China cyberthreat)
by Warren Bailey 13 Mar '13

13 Mar '13

Not to mention, the KG units are dot government only.. For obvious reasons. From my Android phone on T-Mobile. The first nationwide 4G network. -------- Original message -------- From: Christopher Morrow <morrowc.lists(a)gmail.com> Date: 02/21/2013 8:37 AM (GMT-08:00) To: Jack Bates <jbates(a)brightok.net> Cc: nanog(a)nanog.org Subject: Re: Network security on multiple levels (was Re: NYT covers China cyberthreat) On Thu, Feb 21, 2013 at 11:23 AM, Jack Bates <jbates(a)brightok.net> wrote: > On 2/21/2013 12:03 AM, Scott Weeks wrote: >> >> I would sure be interested in hearing about hands-on operational >> experiences with encryptors. Recent experiences have left me >> with a sour taste in my mouth. blech! >> >> scott >> >> > > Agreed. I've generally skipped the line side and stuck with L3 side > encryption for the same reason. and... some (most?) line-side encryptors light the line up fullspeed between the encryptors... if they are also attempting to suppress traffic analysis... so that can be costly if you don't own the whole pipe :)

4 5

Good transit provider @Hutchison Cavendish Centre
by Luan Nguyen 01 Mar '13

01 Mar '13

Hi Folks, Any recommendation for a 1 Gig Transit provider at Hutchison Cavendish Centre? Has to be able to black hole DDOS attack using BGP communities. Preferable: Tier 1 provider with US present (IAD would be best) HK NSP mailing list doesn't exist anymore? Thanks. Regards, -lmn

2 2

10 Mbit/s problem in your network
by Constantine A. Murenin 27 Feb '13

27 Feb '13

Dear NANOG@, In light of the recent discussion titled, "The 100 Gbit/s problem in your network", I'd like to point out that smaller operators and end-sites are currently very busy having and ignoring the 10 Mbit/s problem in their networks. Hotels in major metro areas, for example. Some have great connectivity (e.g. through high-capacity microwave links), and always have a latency of between 5ms and 15ms to the nearest internet exchange, and YouTube and Netflix just work, always, and nearly flawlessly, and in full HD. Others think that load-balancing 150+ rooms with Fast Ethernet and WiFi in every room, plus a couple of conference/meeting rooms (e.g. potentially more than a single /24 worth of all sorts of devices) on a couple of independent T1 and ADSL links is an acceptable practice. Yes, a T1 and an ADSL, with some kind of Layer 3 / 4 balancing! This is at a time when it would not be uncommon to travel with an Apple TV or a Roku. And then not only even YouTube and cbs.com don't work, but an average latency of above 500ms is not unusual in the evenings, and ssh is practically unusable. (Or sometimes they do the balancing wrong, and the ssh connections simply break every minute due to the broken balancer.) And this happens even with boutique hotels like the Joie de Vivre brand in the Silicon Valley (Wild Palms on El Camino Real in Sunnyvale has an absolutely horrible bandwidth even when it's half empty), or with brand-new properties like Hyatt Place in the hometown of a rather famous ILEC that has the whole town glassed up with fiber-optics (the place is less than 2 years old, and Google Maps still shows it as being constructed, yet independent T1 and ADSL links from two distinct ILECs is the only connectivity they have!). How should end-users deal with such broadband incompetence; why do local carriers allow businesses to abuse their connections and their own customers in such ways; why do the sub-contracted internet support companies design and support such broken-by-design setups? When you are staying at a 3* hotel, should you have no expectations that you'll be getting at least a 3Mbps pipe and at least an under 100ms average latency, and won't be getting a balancer that would be breaking up your ssh sessions? Best regards, Constantine.

23 41

BGP RIB Collection
by chip 27 Feb '13

27 Feb '13

Hello all, I have an application that needs to gather BGP RIB data from the routers that connect to all of our upstream providers. Basically I need to know all the routes available from a particular provider. Currently I'm gathering this data via SNMP. While this works it has its draw backs, it takes approximately 20 minutes per view, its nowhere near real-time, and I'm unable to gather information for IPv6. SNMP, however, is faster than screen scraping. All of the XML based access methods seem to take about the same time as well. I've been watching, with keen interest, the i2rs ietf workings, but the project is still in its infancy. BMP seems to be a good solution but I've not found a working client implementation yet. I see that you can actually configure this on some Juniper gear but I can't seem to locate a client to ingest the data the router produces. The BGP Add Paths implementation seems to be the best choice at the moment and exabgp has a working implementation. Are there any other technologies or methods of accessing this data that I've missed or that you've found useful? Thanks! --chip -- Just my $.02, your mileage may vary, batteries not included, etc....

7 7

Fwd: Re: NYT covers China cyberthreat
by jjanusze＠wd-tek.com 27 Feb '13

27 Feb '13

Defense in Depth has been paid lipservice for too long, and now we are witnessing the outcome. > ---------- Original Message ---------- > From: Adele Thompson <paigeadele(a)gmail.com> > To: Kyle Creyts <kyle.creyts(a)gmail.com> > Cc: Derek Noggle <dnoggle(a)gmail.com>, nanog(a)nanog.org > Date: February 27, 2013 at 1:24 AM > Subject: Re: NYT covers China cyberthreat > > On Tue, Feb 26, 2013 at 8:39 AM, Kyle Creyts <kyle.creyts(a)gmail.com> wrote: > > > I think it is safe to say that finding a foothold inside of the United > > States from which to perform/proxy an attack is not the hardest thing > > in the world. I don't understand why everyone expects that major > > corporations and diligent operators blocking certain countries' > > prefixes will help. That being said, you make a solid point to which > > people should absolutely listen: applying an understanding of your > > business-needs-network-traffic baseline to your firewall rules and > > heuristic network detections (in a more precise fashion than just "IPs > > from country $x") is a SOLID tactic that yields huge security > > benefits. Nobody who cares about security should really be able to > > argue with it (plenty of those who care don't will hate it, though), > > and makes life _awful_ for any attackers. > > > > On Tue, Feb 26, 2013 at 3:43 AM, Rich Kulawiec <rsk(a)gsp.org> wrote: > > > On Thu, Feb 21, 2013 at 11:47:44AM -0600, Naslund, Steve wrote: > > > > > > [a number of very good points ] > > > > > > Geoblocking, like passive OS fingerprinting (another technique that > > > reduces attack surface as measured along one axis but can be defeated > > > by a reasonably clueful attacker), doesn't really solve problems, per se. > > > If you have a web app that's vulnerable to SQL injection attacks, then > > > it's still just as hackable -- all the attacker has to do is try from > > > somewhere else, from something else. > > > > > > But... > > > > > > 1. It raises the bar. And it cuts down on the noise, which is one of the > > > security meta-problems we face: our logs capture so much cruft, so many > > > instances of attacks and abuse and mistakes and misconfigurations and > > > malfunctions, that we struggle to understand what they're trying to tell > > > us. That problem is so bad that there's an entire subindustry built > > > around the task of trying to reduce what's in the logs to something > > > that a human brain can process in finite time. Mountains of time > > > and wads of cash have been spent on the thorny problems that arise > > > when we try to figure out what to pay attention to and what to ignore... > > > and we still screw it up. Often. > > > > > > So even if the *only* effect of doing so is to shrink the size of > > > the logs: that's a win. (And used judiciously, it can be a HUGE win, > > > as in "several orders of magnitude".) So if your security guy is > > > as busy as you say...maybe this would be a good idea. > > > > > > And let me note in passing that by raising the bar, it ensures that > > > you're faced with a somewhat higher class of attacker. It's one > > > thing to be hacked by a competent, diligent adversary who wields > > > their tools with rapier-like precision; it's another to be owned > > > by a script kiddie who has no idea what they're doing and doesn't > > > even read the language your assets are using. That's just embarassing. > > > > > > 2. Outbound blocks work too, y'know. Does anybody in your marketing > > > department need to reach Elbonia? If not, then why are you allowing > > > packets from that group's desktops to go there? Because either > > > (a) it's someone doing something they shouldn't or (b) it's something > > doing > > > something it shouldn't, as in a bot trying to phone home or a data > > > exfiltration attack or something else unpleasant. So if there's > > > no business need for that group to exchange packets with Elbonia > > > or any of 82 other countries, why *aren't* you blocking that? > > > > > > 3. Yes, this can turn into a moderate-sized matrix of inbound and > > > outbound rules. That's why make(1) and similar tools are your friends, > > > because they'll let you manage this without needing to resort to scotch > > > by 9:30 AM. And yes, sometimes things will break (because something's > > > changed) -- but the brokeness is the best kind of brokeness: obvious, > > > deterministic, repeatable, fixable. > > > > > > It's not hard. But it does require that you actually know what your > > > own systems are doing and why. > > > > > > 4. "We were hacked from China" is wearing awfully damn thin as the > > > feeble whining excuse of people who should have bidirectionally > > firewalled > > > out China from their corporate infrastructure (note: not necessarily > > > their public-facing servers) years ago. And "our data was exfiltrated > > > to Elbonia" is getting thin as an excuse too: if you do not have an > > > organizational need to allow outbound network traffic to Elbonia, then > > > why the hell are you letting so much as a single packet go there? > > > > > > Like I said: at least make them work for it. A little. Instead of > > > doing profoundly idiotic things like the NYTimes (e.g., "infrastructure > > > reachable from the planet", "using M$ software", "actually believing that > > > anti-virus software will work despite a quarter-century of uninterrupted > > > failure", etc.). That's not making them work for it: that's inviting > > > them in, rolling out the red carpet, and handing them celebratory > > champagne. > > > > > > ---rsk > > > > > > > > > > > -- > > Kyle Creyts > > > > Information Assurance Professional > > BSidesDetroit Organizer > > > > > > I've been doing some thinking about the internet tonight and came across > this e-mail by which I am intrigued. Currently we suffer from DDoS downtime > on Rackspace (granted it's a very small amount of time, its a hit to our > only single point of failure for which I am currently trying to solve by > obtaining a /24 and an anycast address as a means of mitigation and > providing a highly available HTTP cluster of load balancers. I can't help > but wonder if the cost (both in ipv4 resources and cash) outweighs the > worth of an environment that is sanctioned from the globe. While cloud > hosting has proven to be a scalable solution for our needs, we currently > are only serving US-based organizations as far as I know. Even so, the > desire to grow beyond that isn't far fetched when adding networks that are > still segregated from access outside of a country becomes more available > (kinda like vlans.) > > > > > Germany, Russia, and Spain. > > > > "IN vain is the net spread in the sight of anybird," especially if the > > bird be as keen-eyed asPrince Bismarck. The Carlist attempts to > > irritateGermany > > into intervention —whether by > > > > firing on her gunboats, or, as report says,attempting to take prisoners > > the German andAustrian representatives to Madrid in the courseof their > > railway journey, or by any other means—have been, and will be, failures. > > Prince Bismarck knows as well as anybody that nothingwould give so > > effectual a spur to the Carlistcause as a German intervention against it, > > andwe may therefore well believe his organ when ittells us that nothing > > so wild as the project oflanding German troops in Spain was ever > > contemplated > > by him. Prince Bismarck was wiseenough, even during the war with France, > > whenthe German power was already in possession,and was on the spot, to > > avoid anythinglike taking a part between the differentpolitical factions > > into which France was divided.Is it reasonable to suppose that, after > > keeping socarefully out of the net with which his feet werealmost in > > contact in France, he would allow himself to be entangled in it in Spain > > ? The realdanger on the Franco-Spanish frontier is not ofa German > > intervention in Spain, but of jealousiesgrowing up between Germany and > > France sokeen as to render a renewal of the war all butinevitable. No > > doubt that would suit PrinceBismarck's book much better than a barren > > intervention in Spain. No doubt his agents are notparticularly delicate > > in their modes of insistingthat France shall cut off all supplies from > > theCarlist > > forces, and in indirectly reminding Frenchmen of the difference beween > > their position now,when they are kept to their internationalduties > > towards Spain by the watchful eye ofGermany, and their position four > > yearsago, > > when they made the mere suggestion of aGerman candidate for the throne of > > Spain aground of affront, and ultimately a cause of war.We do not suppose > > that Prince Bismarck wishesfor another big war, and all the new odium > > itwould > > bring on the victor, but if it must come,no doubt he would like it to > > come soon. It wasa good notion of his to pose as the protector ofthe > > regency of Marshal Serrano in Spain, and sowin an ally south of the > > Pyrenees, as well assouth of the Alps. But in spite of his no doubtsincere > > wish to see Ultramontanism defeated inthe defeat of Don Carlos, it is > > pretty certainthat his Spanish policy is studied much morewith a view to > > crippling France, than with aview to crippling Rome.There is indeed > > something encouraging in theclear evidence afforded, both by Prince > > Bismarck's > > and by Prince GortschakofTs policyin regard to Spain—though these > > policies aredifferent -that even the least teachable of thegreat European > > Powers have learned the lessonthat interventions for the purpose of > > settling theinternal disputes of any great nation are thesilliest of > > mistakes. Germany has recognised,and has probably persuaded various other > > greatPowers to recognise, the Government of Madrid,while Russia declines > > to recognise it; but evenRussia carefully explains that her reason for > > holding back is not any wish to strengthen the hopes ofthe Carlist > > insurrection, but rather on even greaterdelicacy than that shown by the > > other Powersfor the free choice of the Spanish nation, and areluctance > > therefore to enter into formal relations with a Government which, since > > GeneralPavin's coup Witat, has had no sanctionfrom the will of the > > people. Nodoubt one may fairly smile at the reasongiven, when it comes > > from the Ministerof Russia. No doubt it is quite natural to suspect that > > other motives mingle with the refusal—the dislike to follow implicitly > > German lead—the uueasiuess lest the example of Spain shouldbe eventually > > pleaded for Republican institutions;but even though it be so, the fact > > remains thatRussia offers an almost pedantically constitutional reason > > for refusing to acknowledge as yetthe Government of Marshal Serrano, and > > wishesto be understood as setting an example of evengreater delicacy and > > greater deference to thewishes of the Spanish nation than either > > GreatBritain > > or France. No doubt Russia Las pushedthe doctrine to an extreme, if she > > has allowedher deference to the wishes of the Spanishpeople to prevent > > her from recognising a Government the continuance of which she would thinka > > great safeguard to the peace of Europe. Inpoint of fact, Russia, in all > > probability, holds nosuch opinion. The Greek Church is too wellestablished > > and too popular in Russia to makeit a matter of any account to her > > whether thenew Government of Spain be Ultramontane orotherwise, while it > > can never be a matter ofabsolute indifference to the Czar of Russiawhether > > another European people throws offthe monarchy or not. If Don Carlos were > > tosucceed, at least the Republican current ofevents would be reversed for > > a time. Butwhether the success of Marshal Serrano willmean a Republican > > or a Throne for Spain is amatter extremely doubtful. On the otherhand, to > > neither Germany, nor England, norItaly can it fail to be a matter of some > > interestwhether or not a new stimulus or a new checkis to be applied to > > Ultramontane zeaL And asregards France, the Government of MarshalMacMahon > > has a very difficult problem to solve.Doubtless the Extreme Right, and > > with theExtreme Right the whole Sacerdotal party,would prefer to see Don > > Carlos succeed, sincesuch a success would be a new ground of hopefor > > Henri V. and the white flag. But thenMarshal MacMahon has been obliged to > > quarrelwith the Extreme Right, who make light of hisSepteunate, and > > affect to treat him as a merelocum tenena for the coming king. Hence it > > isessential > > for him to secure a certain amount ofmoderate Liberal support, and the > > regency ofMarshal Serrano is so very homogeneous a kindof power to his > > own—namely, a mere excuse fordelay—that he can hardly fail to feel a > > certainsympathy with its position. Add to this theextreme desirability of > > conceding to Germanyall that can be conceded while the fears of quarreland > > the occasions of quarrel are still so numerous,and we do not doubt that a > > very wise decision hasbeen taken, even in the interest of the Government > > itself, in recognising the de facto Government of Madrid. On the whole, > > we regard itas a very satisfactory evidence of the progressmade in > > mastering elementary Constitutionalideas, eveu by the most despotic > > Powers, thatall the great Powers alike repudiate intervention > > Fix this > > text<http://trove.nla.gov.au/ndp/del/captchaForm?target=ocr&t=1361946009073> > > in Spain, and use even their fair privilege ofgiving a sort of moral > > support to that one ofthe rival Governments which they think be3tcalculated > > to maintain the peace of Europe, withgreat reserve and moderation. The > > day of HolyAlliances to mould the internal institutions ofrefractory > > countries is now, at last, probablypast, aud with these, the day of some > > of themoot mischievous European combinations whichthe world has ever > > seen.— Spectator. > > > > It is learned that the arrest of Count YonAmiin was effected without the > > knowledge of theEmperor. The musing documents hare beengiven to the > > Ultraniontanes by Deputy Windernorst. > >

1 0

Re: NYT covers China cyberthreat
by Scott Weeks 27 Feb '13

27 Feb '13

--- Valdis.Kletnieks(a)vt.edu wrote: The scary part is that so many things got hacked by a bunch of people who made the totally noob mistake of launching all their attacks from the same place.... ------------------------------------------------ This all seems to be noobie stuff. There's nothing technically cool to see here. All they do is spear phishing and, once the link is clicked, put in a backdoor that uses commonly available tools. As I suspected earlier it's M$ against M$ only. The downside is nontechnical folks in positions of power often have sensitive data on their computers, only know M$ and don't have the knowledge to don't click on that "bank" email. Technically, it was 74 pages of yawn. Don't waste your time unless you're interested in how they found out where the attack was originating from and how they tied it to the .cn gov't. scott

8 8

ethernet in Socal
by Tri Tran 27 Feb '13

27 Feb '13

I'm evaluating between cBeyond, Cox, and Megapath. Anyone have experience with their ethernet over copper or fiber products? How are their reliability, service, and performance? Regards, Tri Tran

1 0

Question about FibroLAN Falcon-x
by Rod James Bio 27 Feb '13

27 Feb '13

Hello All! Just a quick question. Anybody here had experience with Falcon-X of Fibrolan? How do you rate itas a MetroE ringswitch? They have a very competitive price and we are now considering using them. P.S. I'm not sure if this kind of questions are allowed to be on this list, if notI would appreciate even a private mail to me. Thanks! -- Rod Bio

1 0

Re: 10 Mbit/s problem in your network
by Constantine A. Murenin 26 Feb '13

26 Feb '13

On 9 February 2013 22:49, Keith Medcalf <kmedcalf(a)dessus.com> wrote: > > Most of these networks are provided by "Internet Marketing Companies". In exchange for free-reign in data harvesting and data capture/logging/tracking and advertisement/javascript insertion in web pages (etc), the hotel gets to offer "free" internet connections. Often the Hotel Internet is a profit center for the Hotel, the "Internet Company" paying the Hotel for unrestricted diddling rights to the unsuspecting guests traffic. > > Same applies to almost every business that offers "free complimentary internet connections" ... > > Occasionally you run into a Hotel that offers a quality and clean internet connection, however, these are few and far between ... Several 2.5* / 3* hotel managers I spoke with volunteered, implied or confirmed that they're paying on the order of 2k$/mo for "internet" in Northern California. And at least in the US, I'm yet to encounter a complementary WiFi at any hotel that would be doing JavaScript insertion, so I'm not sure where you get your information that the free internet always means ads or a very high level of tampering. One of my prior residential ISPs, Embarq, arguably did more tampering and data mining with my connection than any of the hotels I have ever stayed at. (I'm talking about DNS hijacking.) Now. Notice that these hotels are already paying 2k$/mo and getting 10Mbps, which residentially retails at 40$/mo. How much will 100Mbps cost them? What, still 2k/mo? What are they waiting for? Or, pardon my residential bias, but are some of them still using T1's? Don't those cost a fortune? Wouldn't they actually save their money by going elsewhere? I hear microwave links are pretty popular these days, and offer great bandwidth and latency. C. >> -----Original Message----- >> From: Mike Lyon [mailto:mike.lyon@gmail.com] >> Sent: Saturday, 09 February, 2013 23:23 >> To: Constantine A. Murenin >> Cc: North American Network Operators' Group >> Subject: Re: 10 Mbit/s problem in your network >> >> "why do the sub-contracted internet support companies design and >> support such broken-by-design setups?" >> >> Because they don't know any better and lack the technical clue on how >> to implement a network that can support a hotel-full (or half-full) of >> people... >> >> But i'm sure they all have their MCSEs and CCNAs so they are qualified :) >> >> -mike >> >> Sent from my iPhone >> >> On Feb 9, 2013, at 19:57, "Constantine A. Murenin" <mureninc(a)gmail.com> >> wrote: >> >> > why do the sub-contracted internet support >> > companies design and support such broken-by-design setups?

11 23

looking for terminology recommendations concerning non-rooted FQDNs
by Brian Reichert 26 Feb '13

26 Feb '13

I'm trying to nail down some terminology for doc purposes. The issue: most resources on the net freely describe a fully-qualified domian name ('FQDN') as to exclude the root domain; i.e, they exclude the trailing dot as mandated by some RFCs such as RFC 1535: http://www.ietf.org/rfc/rfc1535.txt An absolute "rooted" FQDN is of the format {name}{.} A non "rooted" domain name is of the format {name} I'm trying to come up with some human-facing terminology that names these two forms: "a.b.c." "a.b.c" Many resources on the net use the term 'rooted domain name' for the former, but they're collectively ambigious about what the other form should be called. Does anyone here have any solid advice, or can point me to a resource that would call out useful conventions? This was all fueled by Microsoft's client code apparently stripping the root domain from PTR record results; I'm separately trying to track down why that's occuring... -- Brian Reichert <reichert(a)numachi.com> BSD admin/developer at large

16 61