March 2013 - Test - lists.nanog.org

NANOG 58 - New Orleans - Call For Presentations is open!
by David Temkin 09 Apr '13

09 Apr '13

*Fresh off of a great NANOG 57 in Orlando, your program committee is already working hard to provide a world-class program for NANOG 58 in NOLA - New Orleans, Louisiana - one of my favorite destinations in the world.* * * *As a reminder, we will be following the same Monday-Wednesday program that we started at NANOG 57, with Tutorials beginning Monday morning and closing with the Peering Track (and potentially a social) on Wednesday evening. * * * *We look forward to seeing everyone in The Big Easy!* * -------------------- The North American Network Operators' Group (NANOG) will hold its 58th meeting in New Orleans on June 3rd - 5th, 2013 Verizon Terremark will host NANOG 58. The NANOG Program Committee is now seeking proposals for presentations, panels, tutorials, tracks sessions, keynote materials, and the NOGLab experience for the NANOG 58 program. We invite presentations highlighting issues relating to technology already deployed or soon-to-be deployed in the Internet. Vendors are encouraged to work with operators to present real-world deployment experiences with the vendor's products and interoperability via the program and as part of the NOGLab. NANOG 58 submissions are welcome at http://pc.nanog.org. About NANOG NANOG is the premier meeting for network operators in North America. Meetings provide a forum for information exchange among network operators, engineers, and researchers. NANOG meets three times each year, and includes panels, presentations, tutorial sessions, tracks, informal BOFs, and a NOGLab which features interoperability demonstrations. NANOG attendees include operators from networks of all sizes, enterprise operators, peering coordinators, transport and switching equipment vendors, and network researchers. NANOG attendees will share ideas and interact with leaders in the field of network operations, discuss current operational events and issues, and learn about state-of-the-art operational techniques. Materials from NANOG 58 will be archived at: http://www.nanog.org/meetings/nanog58/<http://www.nanog.org/meetings/nanog55/> <http://www.nanog.org/meetings/nanog55/> Key Dates for NANOG 58 • CFP Opens for NANOG 58: 25-February-2013 • CFP Deadline #1: Presentation Abstracts Due: 8-April-2013 • CFP Deadline #2: Presentation Slides Due: 29-April-2013 • NANOG Highlights Page Posted: 22-April-2013 • Preliminary Topic List Posted: 26-April-2013 • Meeting Agenda Published: 13-May-2013 • Meeting Agenda Final sent to printer: 20-May-2013 • Lightning Talk Submissions Open (Abstracts Only): 2-June-2013 • Speaker FINAL presentations to PCTool or speaker-support: 31-May-2013 • On-Site Registration: 31-May-2013 The NANOG Program Committee seeks proposals for presentations, panels, tutorial sessions, tracks, and BOFs in all areas of network operations, including (but not limited to): - Power and facilities - Topics may include power reliability and engineering, green power, power efficiency, cooling, and facilities management. - Interconnections - Topics may include IXes, intra-building, MMR, metro-wide connections, peering, and transit purchasing tactics and strategies. - Security - Topics may include routing security, route filtering of large peers/customers, and inter-AS security and cooperation. - DNS - Topics may include using DNS data for network metrics, botnet discovery, and geolocation. - IPv6 - Topics may include real-world deployment challenges, Carrier Grade NAT, NAT-PT implementations that work and scale, and allocation strategies. - Content - Topics may include Distribution (p2p, IPTV), content payment models, content distribution technologies and networks, and storage/archiving. - Disaster recovery - Topics may include risk analysis, training, agencies, planning methods, hardware portability, key tools, transport audits, and other lessons learned. In general, presentations are being sought by and for network operators of all sizes. Presentations about difficult problems (and interesting solutions) that you encounter in the course of your job are encouraged. In addition, the Program Committee, through participation with other organizations and vendor’s, will be programming a NOGLab experience. The topic of the NOGLab will be timely and feature real-world experiences faced by operators of today’s Internet. If you think you have an interesting topic but want some feedback or assistance working it into a presentation, please email the Program Committee chair (chair(a)pc.nanog.org) and a representative on the Program Committee will give you the feedback needed to work it into a presentation. Otherwise, don't delay in submitting your talk, keynote, track, or panel into the NANOG Program Committee tool, located at http://pc.nanog.org. For more information about talk types and format, please see http://nanog.org/presentations/guidelines/talktips.php<http://www.nanog.org/presentations/guidelines/talktips.php> <http://www.nanog.org/presentations/guidelines/talktips.php> How to Present The deadline for accepting abstracts and slides is April 8, 2013 . While the majority of speaking slots may be filled by that date, a limited number of slots may be available after that date for topics that are exceptionally timely, important, or critical to the operations of the Internet. Complete Presentation Guidelines can be found at http://nanog.org/presentations/ <http://www.nanog.org/presentations/> <http://www.nanog.org/presentations/> The primary speaker, moderator, or author should submit presentation information and an abstract online at: http://pc.nanog.org once you have done this, you will receive instructions for submitting your draft slides. - Author's name(s) - Preferred contact email address - A preferred phone number for contact - Submission category (General Session, Panel, Tutorial, or Research Forum) - Presentation title - Abstract - Slides (attachment or URL), in PDF (preferred) or PowerPoint format. We look forward to reviewing your submission. Talks Keynote Presentation: The Program Committee invites speakers to submit materials for up to one-hour keynote presentations. Speakers should indicate that their submission is for a keynote in their abstracts. Speaker must submit slides for a Keynote Presentation. General Session Talk: A General Session presentation should be on a topic of interest to the general NANOG audience, and may be up to 30-minutes long (including time for Q&A). Speakers must submit slides for a General Session presentation. General Session Panel: Panels are 60-90-minute discussion sessions between a moderator and a team of panelists. The panel moderator should submit an abstract on the panel topic, a list of panelists, and how the panel will be organized. Panel selection will be based on the importance, originality, focus and timeliness of the topic, expertise of proposed panelists, as well as the potential for informative and controversial discussion. After acceptance the panel leader will be given the option to invite panel authors to submit their presentations to the NANOG program Committee for review. Until then authors should not submit their individual presentations for the panel. Tracks: Tracks are 90-minute informal agenda blocks on topics, which are of interest to a portion of the NANOG community. The 90-minute block can be subdivided into a number of smaller, highly related presentations, panels or open discussion. A moderator coordinates content within the 90-minute block of time, and must submit a detailed outline to the Program Committee, including sub-topics and presenters Peering ISP Security Tools Typically two tracks or three tracks will be run concurrently. Tutorials: Tutorials are 90-minute sessions. A presentation from the introductory through advanced level on all related topics, including: Disaster Recovery Planning Troubleshooting BGP Best Practices for Determining Traffic Matrices Options for Blackhole and Discard Routing BGP/MPLS Layer 3 VPNs Peering business and engineering basics A tutorial submission should include an abstract and slides. BOFs: BOFs (Birds of a Feather sessions) are informal sessions on topics, which are of interest to a portion of the NANOG community. BOFs may be held in the hallways, breakout areas or in an unscheduled tutorial room. Requests for scheduled BOFs will be take place on site at the meeting. A typical BOF session may include some structure or presentations, but usually is focused on community discussion and interaction. Frequent BOF topics include: R&D collaboration Hot-topics in the media The less structured nature of BOF sessions allows for the greatest flexibility from a timing perspective. Lightning Talks: A lightning talk is a very short presentation or speech by any attendee on any topic relevant to the NANOG audience. These are limited to ten minutes; this will be strictly enforced. If you have a topic that's timely, interesting, or even a crackpot idea you want to share, we encourage you to consider presenting it. The Program Committee will vote on all Lightning Talk submissions onsite at the meeting, and a submitter will be notified about his or her submission one day prior to the scheduled talk time. Submit your lightning talk proposal at http://pc.nanog.org starting June 2, 2013. Research Forum: Researchers are invited to present short (10-minute) summaries of their work for operator feedback. Topics include routing, network performance, statistical measurement and analysis, and protocol development and implementation. Studies presented may be works in progress. Researchers from academia, government, and industry are encouraged to present. The NANOG registration fee is waived for: - For General Session presentations, the registration fee will be waived for a maximum of one speaker. - For General Session panels, fees will be waived for one panel moderator and all panelists. - For Tracks, fees will be waived for one moderator. - For Research Forum presentations, fees will be waived for one speaker. - For Tutorials, fees will be waived for one instructor. *

1 2

Open Resolver Problems
by Jared Mauch 02 Apr '13

02 Apr '13

All, Open resolvers pose a security threat. I wanted to let everyone know about a search tool that can help you find the ones within your organization. Treat it like a big "BETA" stamp is across it, but please try it out and see if you can close down any hosts within your network. This threat is larger than the SMURF amplification attacks in the past and can result in some quite large attacks. I've seen this spilling out into other mailing lists (e.g.: juniper-nap and others). Please send feedback about links that should be included or documentation and spelling errors to me. openresolverproject.org Some basic stats: 27 million resolvers existed as of this dataset collection only 2.1 million of them were "closed". We have a lot to do to close the hosts, please do what you can to help. Thanks, - Jared

45 129

BCP38 tester?
by Jay Ashworth 02 Apr '13

02 Apr '13

Is there a program which users can run on an end-site workstation which would test whether they are being some link which is doing BCP38, or some related type of source-address ingress filtering? I'm hoping for something that could be downloaded by users and run, and try to forge a few packets to somewhere useful, which could be logged somehow in conjunction with some unforged packets containing a traceroute, so we could build up a database of leaky networks. On a related topic, while I know GRC Research's Steve Gibson is a bit of a polarizing personality, he does have a fairly sizable consumer audience, and might be a great distribution venue for such a thing. Or, perhaps, is there someone on here from Ookla? Patrick? Could Akamai be persuaded to take an interest in this as a research project? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

12 24

alexandria cable cutters?
by Randy Bush 01 Apr '13

01 Apr '13

nyt reports capture of scuba divers attempting to cut telecom egypt undersea fiber. http://www.nytimes.com/aponline/2013/03/27/world/middleeast/ap-ml-egypt-int… randy

6 9

Tier 2 ingress filtering
by Jay Ashworth 31 Mar '13

31 Mar '13

In the current BCP38/DDoS discussions, I've seen a lot of people suggesting that it's practical to do ingress filtering at places other than the edge. My understanding has always been different from that, based on the idea that the carrier to which a customer connects is the only one with which that end-site has a business relationship, and therefore (frex), the only one whom that end-site could advise that they believe they have a valid reason to originate traffic from address space not otherwise known to the carrier; jack-leg dual-homing, for example, as was discussed in still a third thread this week. The edge carrier's *upstream* is not going to know that it's reasonable for their customer -- the end-site's carrier -- to be originating traffic with those source addresses, and if they ingress filter based on the prefixes they route down to that carrier, they'll drop that traffic... which is not fraudulent, and has a valid engineering reason to exist and appear on their incoming interface. Fixing that will require the construction of an entirely new tracking system at the Tier 2, which is not really the case for the Tier 3 edge carrier, as I see it - you generally just turn unicast-rpf on for everyone's port, unless you have a signed waiver in your file cabinet, in which case you turn it off. Am I missing something? Or is the overarching problem large enough that people are willing to throw the baby out with the bathwater? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

12 23

Dropping connectivity for Cyberbunker?
by Joseph Chin 31 Mar '13

31 Mar '13

This article talks about convincing direct peers and transit providers to stop Net connectivity to the culprit http://www.darkreading.com/blog/240151931/who-supplies-cyberbunker.html Would it not be easier if a majority of the ISPs simply filter BGP prefixes containing the aforementioned ASes in the paths? Maybe many of you are already quietly doing it? This probably won't stop the baddies from spoofing source addresses for attacks, but it will make Cyberbunker economically unviable as no one will be able to reach assets hosted on their IP addresses. They have proven beyond a reasonable doubt that they have no intention to behave as civilized Netizens. So why should the rest of us continue to play nice? Does anyone see a problem with this action?

1 0

[Q] Any detailed enterprise WAN QoS design/config for MPLS services, f/various ISPs?
by Stefan 31 Mar '13

31 Mar '13

Been looking for Verizon and AT&T AVPN MPLS, specifically. Pointers highly appreciated, as the nanog archive does not seem to have searchable items ref such. Cisco docs have some info, but I am mostly looking for tried and proven configs with the specifics that Verizon and AT&T offer. Traditional AT&T (e.g.) means involve the likes of (for main DC): policy-map <GENERAL NAME> description <ISP> CoS Profile <nb code> <nb>% RT (nb1/nb2/nb3) class <0> priority percent <nb> class <1> set dscp af21 bandwidth <nb1> class C<2> set dscp af31 bandwidth <nb2> policy-map <3> class <4> set dscp af21 class <5> set dscp af31 class <6> priority percent <nb> policy-map <NAME> class class-default shape average <nb> service-policy <GENERAL NAME> ... interface GigabitEthernet2/0/0.x ... ip pim sparse-mode service-policy output <3> ... or the likes (can't even tell if I consistently sanitized the info, but you get the point) I am interested in main hub/DC + remotes - docs, preferably. TIA, ***Stefan

1 0

CIO Mag on the Spanhaus attack
by Jay Ashworth 30 Mar '13

30 Mar '13

Mentions ODRP, doesn't mention BCP38. http://www.cio.com/article/730882/Spamhaus_Attacks_Expose_Huge_Open_DNS_Ser… Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

1 0

So how big was it *really*?
by Valdis Kletnieks 30 Mar '13

30 Mar '13

So we all have heard the breathless news reports of how the recent urinating contest between Spamhaus and a butthurt ISP was the "biggest in history". Where would you guys put it, if measured as "percent of total worldwide available Internet bandwidth/resources"? My gut feeling is that by that metric, it didn't even make the top 20. Think back to the Morris worm, or Blaster/Nachi/etc - *nobody* had any free bandwidth when those happened. And even if you restrict the discussion to intentional targeted attacks, I'm sure we've had worse (Smurf, anybody? :)

9 9

BGP hijack of Spamhaus?
by Nicolai 30 Mar '13

30 Mar '13

Hi all, Regarding the Spamhaus DDoS attack, there's a Cisco article [0] detailing its chronology, which cites greenhost.nl [1] claiming a BGP hijack by AS34109 (CB3ROB). Here, a /32 was announced (and accepted...) for 0.ns.spamhaus.org, and the fraudulent server returned 127.0.0.2 for *all* DNSBL queries, with the intent to undermine confidence in Spamhaus. Are there any confirmations of this claim? This needs to be investigated and proven/disproven. Nicolai 0. http://blogs.cisco.com/security/chronology-of-a-ddos-spamhaus/ 1. https://greenhost.nl/2013/03/21/spam-not-spam-tracking-hijacked-spamhaus-ip/

2 2