March 2013 - Test - lists.nanog.org

NYT covers China cyberthreat
by Jay Ashworth 13 Mar '13

13 Mar '13

http://www.nytimes.com/2013/02/19/technology/chinas-army-is-seen-as-tied-to… -- Sent from my Android phone with K-9 Mail. Please excuse my brevity.

16 27

Re: [outages] comcast/sprint oddities
by Jay Ashworth 13 Mar '13

13 Mar '13

----- Original Message ----- > From: "Jeremy Chadwick" <jdc(a)koitsu.org> > If you really wanted to bring this up with Sprint, you would need to > have a relationship with them, and you would *need* to provide source > and destination IPs. And there's the point that makes fixing this stuff such a bitch: you almost never have a relationship with anyone except the carrier you connect through (and sometimes not even them :-). This is, incidentally, why my professional recommendation to people setting up "nailed up" links over the Internet is to move heaven and earth to get every point on the same carrier, or to make sure, at the very least that there is only one exchange point in the middle, and you're a customer of the carrier on both sides of it. Having to escalate through 3 or 4 carriers to get something fixed isn't just time consuming, it's often impossible. Social engineering NOC hotlines (as much as I hate to advocate it) is often the only solution; bring your Geek License. :-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

2 3

Network Configuration Management
by Chip Marshall 13 Mar '13

13 Mar '13

Just curious what people are using for network configuration manangement systems. I'm guessing most places have something built in-house, but before starting down that road I figured it would be a good idea to see if people have any off-the-shelf systems they like. Some features I'd like to have: * Interface configs * Firewall filter configs * BGP session configs * User management * Support for multiple router and switch vendors (at least Juniper and Cisco) -- Chip Marshall <chip(a)2bithacker.net> http://2bithacker.net/

11 11

Re: Network security on multiple levels (was Re: NYT covers China cyberthreat)
by Warren Bailey 13 Mar '13

13 Mar '13

Not to mention, the KG units are dot government only.. For obvious reasons. From my Android phone on T-Mobile. The first nationwide 4G network. -------- Original message -------- From: Christopher Morrow <morrowc.lists(a)gmail.com> Date: 02/21/2013 8:37 AM (GMT-08:00) To: Jack Bates <jbates(a)brightok.net> Cc: nanog(a)nanog.org Subject: Re: Network security on multiple levels (was Re: NYT covers China cyberthreat) On Thu, Feb 21, 2013 at 11:23 AM, Jack Bates <jbates(a)brightok.net> wrote: > On 2/21/2013 12:03 AM, Scott Weeks wrote: >> >> I would sure be interested in hearing about hands-on operational >> experiences with encryptors. Recent experiences have left me >> with a sour taste in my mouth. blech! >> >> scott >> >> > > Agreed. I've generally skipped the line side and stuck with L3 side > encryption for the same reason. and... some (most?) line-side encryptors light the line up fullspeed between the encryptors... if they are also attempting to suppress traffic analysis... so that can be costly if you don't own the whole pipe :)

4 5

site that shows overview of current cyber attacks
by Scott Weeks 13 Mar '13

13 Mar '13

I saw this over on the Vanuatu Internet Users Group and thought it might be interesting for some: http://www.sicherheitstacho.eu scott

3 2

Re: Network mapping software
by Hank Nussbacher 13 Mar '13

13 Mar '13

At 12:16 12/03/2013 -0700, Garrett Skjelstad wrote: >I have seen NetBrain mentioned a few times here on this mailing list. Does >anyone have any experience with it, and could they tell me some of the pros >& cons that they had of their installations? > >Any limitations or pain points? Feel free to hit me off list. This is a very nice piece of software for building automated maps of your network. You can do it online or feed it all your saved config files from a directory and it will auto-build OSPF and BGP or EIGRP maps of your network. It helped me spot one place where we forgot to turn on PIM. The map is dynamic and you can move your routers around and the links move with the shift on the map. It also flags routers that are missing a connection from the other end. -Hank >-Garrett

1 0

traffic accounting
by Joe Abley 12 Mar '13

12 Mar '13

Hi all, Imagine you have a number of GE and 10GE interfaces spread across multiple MX-class Juniper routers, and for each interface you want to maintain an accurate count of bytes sent, categorised by destination address. There is no layer-2 aggregation going on beyond the router, so no opportunity to create span ports on which to measure over on the side. Using optical splitters on each and every router interface and listening on the side using dedicated sniffers is an option, although it means tangles of fibre and potentially lots of sniffer boxes with lots of interfaces. I don't necessarily need a free or tremendously cheap solution, although it's always nice not to have to spend money. What are better approaches? Off-list would be fine if people have experience of this kind of thing; I can summarise if there is interest. Joe

7 9

Re: What Should an Engineer Address when 'Selling' IPv6 to Executives?
by kpospisek＠bigpond.com 12 Mar '13

12 Mar '13

I would be concerned in strongly spruiking advantages of IPv6 to executives if an IPv6 dual stack solution is actually being deployed. (ie. some given IPv6 SS advantages below do not apply to IPv6 DS) > 1. Decreased application complexity: > Because we will be able to get rid of all that NAT traversal code, > we get the following benefits: > > I. Improved security > A. Fewer code paths to test > B. Lower complexity = less opportunity to introduce flaws > II. Lower cost > A. Less developer man hours maintaining (or developing) NAT > traversal code > B. Less QA time spent testing NAT traversal code > C. No longer need to keep the lab stocked with every NAT > implementation ever invented > D. Fewer calls to support for failures in product's NAT traversal > code > 2. Increased transparency: > Because addressing is now end-to-end transparent, we gain a > number of benefits: > > I. Improved Security > A. Harder for attackers to hide in anonymous address space. > B. Easier to track down spoofing > C. Simplified log correlation > D. Easier to identify source/target of attacks > II. Simplified troubleshooting > A. No more need to include state table dumps in troubleshooting > B. tcpdump inside and tcpdump outside contain the same packets. > There are two well documented advantages to IPv6 dual stack: - responding to customers requesting IPv6 dual stack connectivity - excellent access to the IPv4 network IPv6 is a *different* network to IPv4 even if both networks happen to be carried on the same platforms (thank you Cisco, F5, Juniper etc - without this, our execs would be seriously baulking at having to replace fairly modern hardware). I have also noticed examples given of historic protocol changes. Not all of these are relevant as some of them only involved "middle" OSI layers, so do not apply very well to the IPv6->IPv6 transition. Greets Engineer Karl Pospisek (alias kpospisek(a)telstra.com)

5 6

Bing/MSN/Microsoft contact
by Blair Trosper 12 Mar '13

12 Mar '13

If possible, I need someone from Microsoft/Bing (a la the MSN and Bing crawler bots) to contact me off list. Several IPs going back to AS8075 (with the user agent MSN and "bingbot") are basically attacking several IPs on my network with hundreds of requests per second. Thanks, Blair

2 1

Odd announcement from AS27048
by Alain Hebert 12 Mar '13

12 Mar '13

Hi, On the 5th we notice that 27048 was announcing 2 of ours /24 812 3549 209 721 27064 27047 27047 27047 27048 It lasted about 9h but didn't impact anything due to its prepend and such... My inquiry is: . False positive? . Broken 16b <=> 32b ASN's? . Human Error? . I should remove my Echelon triggering keywords from my personal .sig? ( 27048 is part of a US DoD ASN range =D ). I check around and it happened a few times in the past. ( I saw a CIDR report in 2008 where 27048 was announcing 8m+ IP's ) Let me know. -- ----- Alain Hebert ahebert(a)pubnix.net PubNIX Inc. 50 boul. St-Charles P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443

3 2