June 2013 - Test - lists.nanog.org

Bogons filtering
by Jayram A. Deshpande 10 Jun '13

10 Jun '13

Hello, With IPv4 being almost exhausted[1] , I am curious to know how many net admins have the Bogon filtering ACLs still hanging around ? Google even gave me this expired Internet Draft [2] that seems to have been intended as a BCP. Regards, -Jay. [1] https://www.arin.net/resources/request/ipv4_countdown.html [2] https://tools.ietf.org/id/draft-vegoda-no-more-unallocated-slash8s-01.txt -- "Subvert the paradigm." - C.K. Prahlad

4 3

RE: PRISM: NSA/FBI Internet data mining project
by Scott Weeks 10 Jun '13

10 Jun '13

Funny, sort of. The guy was residing in Hawaii. Apologies for the long URLs... Report: NSA contract worker is surveillance source: http://thegardenisland.com/news/state-and-regional/report-nsa-contract-work… Hawaii real estate agent: Snowden left on May 1: http://thegardenisland.com/news/state-and-regional/hawaii-real-estate-agent… funny as well! NSA claims know-how to ensure no illegal spying: http://thegardenisland.com/news/state-and-regional/nsa-claims-know-how-to-e… scott

2 1

Mechanics of CALEA taps
by Randy Fischer 10 Jun '13

10 Jun '13

Dear nanog: Honestly, I expect replies to this question to range between zero and none, but I have to ask it. I understand the CALEA tap mechanism for most ISPs, generally, works like this: * we outsource our CALEA management to company X * we don't even know there's been a request until we've gotten a bill from X. And that's the extent of it. Well, golly Slothrop, maybe someone else has started picking up the tab. Would you even know? Is that possible? Thanks, Randy Fischer

7 6

Rep: ncnet
by Larry Stites 10 Jun '13

10 Jun '13

Too many of us look upon Americans as dollar chasers. This is a cruel libel, even if it is reiterated thoughtlessly by the Americans themselves.inf: http://www.wyncotkennels.com/perfctway.php6/10/2013 4:00:09 PMBest RegardsLarry Stites

2 1

OC3/STM-1 Line Card
by Nick Khamis 09 Jun '13

09 Jun '13

Hello Everyone, Anyone know of a way of bypassing the 90K audiocodes mediant 3000 equipped for STM-1 interface using line cards and a linux box :). What we are looking to do is replace our traditional ISDN DS3 equipped for voice using an STM-1/OC3 backbone and our own put together linux box. Again, this will be used for voice signaling... Kind Regards, Nick.

3 5

RE : Re: PRISM: NSA/FBI Internet data mining project
by Michael Hallgren 09 Jun '13

09 Jun '13

Yet appears a certain lack of transparency, no? mh -------- Message d'origine -------- De : "Jason L. Sparks" <jlsparks(a)gmail.com> Date : A : ku po <cciehelps(a)gmail.com> Cc : NANOG <nanog(a)nanog.org> Objet : Re: PRISM: NSA/FBI Internet data mining project To be fair, the reporting (initially) claimed the providers were granting the USG "access directly to their servers." It's understandable and appropriate that the providers pushed back against that apparently erroneous reporting. Jason On Jun 8, 2013, at 22:44, ku po <cciehelps(a)gmail.com> wrote: > What is the point to argue whether they have the capacity to process all > the data? > They DON'T need to build expensive systems. > They just need to make sure when they ask your company for information, > these information are available for them and fast enough. > So the statement that saying "we don't give them direct access" means > nothing!!! > The right question is IS THERE A DIRECT CHANNEL for them to ask you for > information without providing all the evidence( how could they show you all > the evidence when it is security related??), which you can't deny their > access. > > > > > On Sun, Jun 9, 2013 at 8:20 AM, James Harrison <james(a)talkunafraid.co.uk>wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On 08/06/2013 16:31, William Herrin wrote: >>> On Fri, Jun 7, 2013 at 1:25 AM, jamie rishaw <j(a)arpa.com> wrote: >>>> Just wait until we find out dark and lit private fiber is getting >>>> vampired. >>> >>> Why wait? >>> >>> http://www.nytimes.com/2005/02/20/politics/20submarine.html?_r=0 >>> >>> -Bill >> >> In a similar vein, a new PRISM slide was released by the Guardian this >> morning: >> >> >> http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-fac… >> >> Doesn't specifically say private fiber - just "fiber cables and >> infrastructure". May just refer to fiber to/from/within complying >> company infrastructure, ofc, not necessarily anything else. >> >> They also apparently have a web 2.0 compliant dashboard with a catchy >> name and pop-ups with big numbers in: Boundless Informant. >> >> >> http://www.guardian.co.uk/world/2013/jun/08/nsa-boundless-informant-global-… >> >> Speaking from the other side of the pond it's interesting to see where >> this is going. GCHQ (the UK NSA equivalent) are being asked stern >> questions by the government about their involvement and if they've >> been asking the NSA for UK citizens' data (since they're not allowed >> to collect it themselves). >> >> Cheers, >> James Harrison >> -----BEGIN PGP SIGNATURE----- >> Version: GnuPG v2.0.17 (MingW32) >> >> iEYEARECAAYFAlGzyl4ACgkQ22kkGnnJQAwVfQCePSYz9p5P95bnWYbp4YA2SeQD >> HeQAn0AOnReV6DQC0Y3k5P046BbFnBUJ >> =auDI >> -----END PGP SIGNATURE----- >> >>

1 0

Re: Facebook broken over v6?
by Chris Conn 08 Jun '13

08 Jun '13

On 2013-06-08 15:29, Chris Conn wrote: > It's affecting anyone running dual stack, as the server responds, > hangs, times out and then it tries again on v6. At least in the latest > FF and Safari browsers, I've not tried chrome. I've cc'd this over to > Nanog, as I've not seen anything about it there, and I'm sure others > are seeing it. www.v6.facebook.com works fine as a workaround for the > time being. -- Indeed, I have seen this behaviour for at least a week. It seems to somehow be related to geo-located DNS (akamai?) since the timeouts and RSTs I see in the traffic are from IPv6 akamai servers, not facebook itself. I tried de-peering from a number of networks to try and isolate it and it was not transit-specific. I stopped questioning my network when I saw a thread on Sixxs and tunnelbroker about this very issue. Hopefully it won't persist as right now as having Facebook intermittently connect is likely hurting deployment slightly. Chris

6 5

RE: Facebook broken over v6?
by Frank Bulk 08 Jun '13

08 Jun '13

And just like that, the AAAA is back again. =) ============================================ DNS server: 167.142.225.5 ; <<>> DiG 9.7.3 <<>> AAAA www.facebook.com @167.142.225.5 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46006 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;www.facebook.com. IN AAAA ;; ANSWER SECTION: www.facebook.com. 452 IN CNAME star.c10r.facebook.com. star.c10r.facebook.com. 37 IN AAAA 2a03:2880:10:1f02:face:b00c:0:8 ;; AUTHORITY SECTION: c10r.facebook.com. 119251 IN NS b.ns.c10r.facebook.com. c10r.facebook.com. 119251 IN NS a.ns.c10r.facebook.com. ;; ADDITIONAL SECTION: a.ns.c10r.facebook.com. 120993 IN A 69.171.239.11 b.ns.c10r.facebook.com. 120381 IN A 69.171.255.11 ;; Query time: 7 msec ;; SERVER: 167.142.225.5#53(167.142.225.5) ;; WHEN: Sat Jun 8 18:12:42 2013 ;; MSG SIZE rcvd: 153 ============================================ Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Saturday, June 08, 2013 5:43 PM To: 'Doug Porter' Cc: nanog(a)nanog.org Subject: RE: Facebook broken over v6? Someone must have yanked the AAAA for www.facebook.com, because I see a CNAME to star.c10r.facebook.com, which doesn't have an AAAA. ============================================ DNS server: 199.120.69.24 ; <<>> DiG 9.7.3 <<>> AAAA www.facebook.com @199.120.69.24 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16032 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.facebook.com. IN AAAA ;; ANSWER SECTION: www.facebook.com. 3147 IN CNAME star.c10r.facebook.com. ;; AUTHORITY SECTION: c10r.facebook.com. 51 IN SOA a.ns.c10r.facebook.com. dns.facebook.com. 1370731022 300 600 600 300 ;; Query time: 0 msec ;; SERVER: 199.120.69.24#53(199.120.69.24) ;; WHEN: Sat Jun 8 17:41:30 2013 ;; MSG SIZE rcvd: 103 ============================================ DNS server: 167.142.225.5 ; <<>> DiG 9.7.3 <<>> AAAA www.facebook.com @167.142.225.5 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 963 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.facebook.com. IN AAAA ;; ANSWER SECTION: www.facebook.com. 2324 IN CNAME star.c10r.facebook.com. ;; AUTHORITY SECTION: c10r.facebook.com. 44 IN SOA a.ns.c10r.facebook.com. dns.facebook.com. 1370731022 300 600 600 300 ;; Query time: 8 msec ;; SERVER: 167.142.225.5#53(167.142.225.5) ;; WHEN: Sat Jun 8 17:41:30 2013 ;; MSG SIZE rcvd: 103 ============================================ Frank -----Original Message----- From: Doug Porter [mailto:dsp@fb.com] Sent: Saturday, June 08, 2013 3:30 PM Cc: nanog(a)nanog.org Subject: Re: Facebook broken over v6? We're actively investigating the v6 issues. We need more data though. If you're experiencing problems, please email me a tcpdump/pcap or any other debug data you think will help. Thanks, -- dsp

1 0

Re: Facebook broken over v6?
by Bryan Fields 08 Jun '13

08 Jun '13

On 6/7/13 12:21 PM, Jeroen Massar wrote: > On 2013-06-07 09:12, Aaron Hughes wrote: >> >> Anyone else getting connection hangs and closes to Facebook? > > Yes, and from a lot of vantage points, thus it is not your local network > that is at fault, seems that there are some IP addresses which are being > returned by some Facebook DNS servers that are actually not properly > provisioned and thus do not respond. > > More to it at: > http://www.sixxs.net/forum/?msg=general-9511818 > > I've informed the Facebook peoples (and bcc'd them on this email), and > apparently they are digging into it from the response I've received. > > Note that using www.v6.facebook.com apparently works fine as that IP is > not affected and is not geo-balanced or something like that thus is > always (afaik) the same. Thus if you like sharing your life and > everything you do, that is the thing to use. It's affecting anyone running dual stack, as the server responds, hangs, times out and then it tries again on v6. At least in the latest FF and Safari browsers, I've not tried chrome. I've cc'd this over to Nanog, as I've not seen anything about it there, and I'm sure others are seeing it. www.v6.facebook.com works fine as a workaround for the time being. -- Bryan Fields 727-409-1194 - Voice 727-214-2508 - Fax http://bryanfields.net

1 0

PRISM Update: NYT says WaPo a bit credulous
by Jay Ashworth 08 Jun '13

08 Jun '13

Well, ok, they don't actually *say* that, but it's the underlying idea behind their own piece, which says that the listed companies didn't really give NSA quite such unfettered access: http://www.nytimes.com/2013/06/08/technology/tech-companies-bristling-conce… Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

3 2