July 2013 - Test - lists.nanog.org

.gov DNSSEC operational message
by Wessels, Duane 14 Aug '13

14 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An algorithm roll for the .gov zone will occur at the end of August, 2013. This notice is provided as a courtesy to the DNSSEC community. No action should be required on your part. The .gov zone is currently signed with algorithm 7 (RSASHA1-NSEC3-SHA1) and will be changed to use algorithm 8 (RSA/SHA-256), bringing it in line with other top-level domains such as as .com, .net, and the root zone. The zone will be signed with both algorithms for a period of approximately 10 days. Further scheduling details will be provided one week before the algorithm roll begins. Duane W. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJR+BwJAAoJEGyZpGmowJiNb1QIAL4VURzp377H7iX8ZaBfljTt pdj6gTyChZe4M4AwTslT3woTBMwJZsOYxMKFnGcPoxFd0ROT1HuFKt1JE5G6ITBN +qHQJFplgU4SBKcknAcIL5/0DXgqeGVR9JYsbkRiytocp89eBWx8lhZuVRqQCRDw u/ZiKluAd32ioSosuzAJJawRp0PZQKJX8/WQ5HnLPeDpH3jHDR21I5RDp35l8X0x GIiD9+UV1yivYr4JhjLfVqTkToND+m3rwG7c6VwUf8PxCv5mEJN3sFpC72HsRvCd uNipDuwaAcYLFCx3mSUsuXjUttUXe9yFE9v3rPZ286eMo5GqVvs+Zy7yjrQuOpU= =p/aG -----END PGP SIGNATURE-----

1 1

which firewall product?
by William Herrin 05 Aug '13

05 Aug '13

Hi folks, I'm trying to identify a firewall appliance for one of my customers. The wrinkle is: it has to be able to inspect packets inside an IPIP tunnel and accept/reject based on IP address, TCP port number and standard things like that. On the packet carried *inside* the IPIP tunnel packet. >From what I can tell, the Cisco ASA can't do this. Linux iptables can (with the u32 match module) but the customer wants an appliance, not a server. What appliances do you know of that can do this? Is there a different Cisco box? A Juniper firewall? Anything else? Thanks in advance, Bill Herrin -- William D. Herrin ................ herrin(a)dirtside.com bill(a)herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004

12 16

Revealed: NSA program collects 'nearly everything a user does on the internet'
by Warren Bailey 02 Aug '13

02 Aug '13

Tin foil hat Wednesday, limited supplies. Revealed: NSA program collects 'nearly everything a user does on the internet' http://gu.com/p/3hy4h Sent from my Mobile Device.

8 8

Re: ARIN WHOIS for leads
by Joel M Snyder 01 Aug '13

01 Aug '13

>What about the 2am phone calls from the guy, who did a >nslookup on a website, and then whois on the ip, >who is calling to say his porn site >is partially not working and he's pissed. No amount of changing contacts is going to solve this type of problem. We routinely get support calls, sometimes even in the emergency support line, from people who are pissed off at an ISP 2,000 miles away called "Opus" something-or-another-but-not-Opus-One. Apparently their dialup service is not so hot anymore and when it doesn't work, the one-step-down-from-AOL customer base they attract types "opus" into their browser and then calls whatever phone number comes to the top of whatever search engine their browser vendor chose for them. Changing the nature of WHOIS isn't going to keep the stupid from doing stupid things. However, it might make life harder for the not-stupid trying to solve real problems. Honestly, this seems to me like a non-problem. I liken it to the hypersensitivity of some people to spam, where if they get 1 message through their filters it's somehow a major crisis. Maybe our ACD, which requires the clue-challenged to be able to spell the first or last name of the person their calling, or perhaps read the extension number from a directory listing, screens the worst of the worst out from us... I also don't see the problem of cold calling when it's obviously for a service or product that I am interested in, just as I don't see the problem of cold snail-mailing for the same services. I'm in business, and I expect other businesses to try and market to me. I don't want to hear from window, insurance, and other crap sellers, but if a Cisco reseller or bandwidth seller wants to make contact and say "how can I help you?" that doesn't seem out of line to me. Only in the world of email do we (justifiably) get all weirded out by the prospect of unsolicited sales pitches. It seems to me that if you don't want people to call you, don't give out your phone number (or give out a phone number that makes it hard for anyone but a real person who really wants to talk to you to get to you). How did our little capitalist industry suddenly become a "you must have permission to contact me by any means no matter what" industry? jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

4 3

Hilton proxy issue
by Grant Ridder 31 Jul '13

31 Jul '13

Hi, Anyone from Hilton Hotels NOC or related on here? We are seeing their internet proxy doing weird things to http requests to servers at $DAYJOB. -Grant

3 6

Re: SNMP DDoS: the vulnerability you might not know you have
by Larry Sheldon 31 Jul '13

31 Jul '13

On 7/31/2013 4:29 PM, Blake Dunlap wrote: > It works better to fix the design issues than to play whack a mole > by blocking every imaginable service to your customers that responds > to the public with data larger than a FIN. Like getting their > providers to more proactively police their spew, manufactures to stop > making negligent devices, or implementing more intelligent filter > communication so the only option doesn't begin with calling your > provider and asking them over the phone to block X ip for you since > you're off the internet. > > Maybe even look into liability laws for allowing said attacks to > originate from your customers and not doing anything about it, or > being manufacturer of said devices that harm others through their > lack of due diligence implementing proper security. It's still way > more effective than trying to fix the *last instance* of the problem, > instead of it's reasons for enduring as an issue at a global scale. The first time I became a pariah on NANOG was for postulating precisely that view--that if the originators of problems would stop, we would not have to figure out how to clean up after them. But I am past that now and out of work. But it does occur to me for the first time that I can recall, that maybe the tremendous efforts to Get Control Of The Intertubes could be suckered into doing some good, say be establishing a certification authority to test and certify the safety of designs (is Scott B????? still around) and devise a way to not permit traffic from uncertified devices or configurations. But after years of research I will tell you that there is no way to stop an avalanche once it has been released at the source. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

Revealed: NSA program collects 'nearly everything a user does on the internet'
by Marsh Ray 31 Jul '13

31 Jul '13

Chris Boyd cboyd at gizmopartners.com Wed Jul 31 15:50:09 UTC 2013 > > I would guess that it's becasuse many VPN services still support PPTP which can be attacked as outlined here: > http://www.schneier.com/paper-pptpv2.html > > --Chris That link doesn't even mention the worst vulnerability in PPTP/MS-CHAPv2. Strangely, it's only in the PDF version http://www.schneier.com/paper-pptpv2.pdf at the bottom of page 6: > Note also that the MS-CHAP response generation algorithm is also a weak > link, even when passwords contain adequate entropy. It is clear that the NT > hash can be recovered with just two DES exhaustive keysearches (about 256 > trial DES decryptions on average) In other words, PPTP/MS-CHAPv2 is equivalent to encrypting your password with *single DES* and sending it over the untrusted network. It doesn't matter how strong your plaintext password is. Not only can the passive eavesdropper decrypt your VPN-tunneled data, he can obtain the NT hash which is a password-equivalent credential allowing him to impersonate the user to log into any other network services. Moxie Marlinspike and David Hulton described the exploit for it at Defcon 20 last summer: Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2 http://www.youtube.com/watch?v=vWXP3DvH8OQ Moxie's Cloudcracker online service will decrypt your PPTP packet captures using an FPGA cluster from Pico Computing. Last I heard, the price was a flat fee of $200, although it sometimes goes on sale. http://www.h-online.com/security/features/A-death-blow-for-PPTP-1716768.html http://h-online.com/-1716768 So it's not just the NSA, it's any passive observer with a budget of $200 for a one-off or ~$10K for their own hardware capability. PPTP is old and busted, don't let your friends use it! If you've ever used it, change your password. IMHO, if there's any other protocol more deserving of the "internet kill switch" I don't know what it is. - Marsh (sorry for not threading properly, I just subscribed to reply)

1 0

GTT/Inteliquent/nLayer
by Tim Durack 31 Jul '13

31 Jul '13

Any experience/comments on the GTT Global eXpress service? Looks interesting but odd. Why would I use a virtual IXP? Who participates? Comments on-list or off-list are fine. -- Tim:>

2 1

Re: File transfer speed between Hong Kong and Johannesburg, South Africa
by Larry Sheldon 31 Jul '13

31 Jul '13

On 7/11/2013 10:32 AM, Clayton Zekelman wrote: > > It all depends on the air speed velocity of an unladen swallow, and > varies if it is African or Eurpoean. > > In all seriousness, you need to know the speed and latency of the link > before that question can be answered. > > At 10:04 AM 11/07/2013, Luan Nguyen wrote: >> Hello folks, >> >> Does anyone know what's the average speed for windows file transferring >> (SMB2) between Hong Kong and Johannesburg? >> Any guide on how to calculate/estimate this? An old-timers-uncalibrated-guess" If you are going to do large transfers using a protocol designed (for want of a term) for local area networks with near-fault free performance over a long multihop network, you are not going to like it. What criteria drive the selection of such an unlikely protocol? -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

vodafone contact
by ryanL 31 Jul '13

31 Jul '13

anyone hanging out from vodafone in europe? or anyone know someone over at vodafone? we are having goofy issues with mobile clients on your LTE network. we're having to dump mtu and advmss a whole bunch to make things work. wondering if you'd be willing to chat offline. appreciated. r

3 3