August 2013 - Test - lists.nanog.org

Re: WaPo writes about vulnerabilities in Supermicro IPMIs
by Anthony Bonkoski 16 Aug '13

16 Aug '13

There's a few misconceptions I'd like to address, plus add some backstory. The Washington Post article is intentionally void of details. It is intended as a non-technical article. You can find the actual technical paper here: https://www.usenix.org/conference/woot13/illuminating-security-issues-surro… Cipher-0 is an awful, yet well-known issue that comes directly from the Intel spec, and thus affects a large set of implementations. Here's an excellent write-up: http://fish2.com/ipmi/cipherzero.html The iDRAC testurls vuln. was a result of the firmware being shipped with a developer debugging webpage that could be used as a backdoor. Recent work shows that some password hashes can be recovered and cracked. In this latest development, we reverse engineered a SuperMicro/ATEN firmware binary and discovered security gross negligence. We discovered the very worst vuln: client-side only input checking, shell-injection, and trivial buffer-overflows in many CGI programs including the user/pass fields of the login page. Further, the device has almost no modern buffer-overflow defenses (DEP, ASLR, and Stack Carries). We show that it is *easy* to exploit these flaws and gain a root shell. This is especially nasty because the system operator is not give access to a Unix shell on the BMC, thus a remote attacker can gain more capabilities on the BMC than even the administrator. In short, the previous work should certainly be enough to make any sys admin fear exposing IPMI to a public IP. However, the problem is much worse than we previously thought. This particular implementation shows a complete disregard for even the most basic security practices. -Anthony On Aug 16, 2013 10:19 AM, "Alain Hebert" <ahebert(a)pubnix.net> wrote: Hi, I find it odd that this is suddenly news... There is plenty of security updates for iBMC/iDrac/etc from IBM/HP/Dell/etc over the years. But: You can use ipmitool, rootkit/exploit some Linux box and upload your own firmware in that iBMC/iDrac/etc... for example the BMC firmware for a Dell C1100 leave plenty of space to inject your own shell in it. And Voila! access to the management network =D. BTW I got ipmitool working even on VMWare 5.1 :( Counter: We (PCIDSS hat) always check for those management interfaces and "proposed" to move those interfaces into they own VLANs+Subnets. Meaning: PCI DMZ Zone has its own DMZ iBMC VLAN/Subnet/FW Rules, PCI DB Zone has its own iBMC VLAN/Subnet/FW Rules, etc. It is a few more VLAN/Subnets... but modern Firewall can handle this easy. PS: "proposed" as in not giving them a choice =D ----- Alain Hebert ahebert(a)pubnix.net PubNIX Inc. 50 boul. St-Charles P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443 On 08/16/13 00:22, Kyle Creyts wrote: > just so we're all clear, SuperMicro wasn't the only one... > > link: http://pastebin.com/syXHLuC5 > > 1. CVE-2013-4782 CVSS Base Score = 10.0 > 2. The SuperMicro BMC implementation allows remote attackers to > bypass authentication and execute arbitrary IPMI commands by using > cipher suite 0 (aka cipher zero) and an arbitrary password. > 3. > 4. CVE-2013-4783 CVSS Base Score = 10.0 > 5. The Dell iDRAC 6 BMC implementation allows remote attackers to > bypass authentication and execute arbitrary IPMI commands by using > cipher suite 0 (aka cipher zero) and an arbitrary password. > 6. > 7. CVE-2013-4784 CVSS Base Score = 10.0 > 8. The HP Integrated Lights-Out (iLO) BMC implementation allows > remote attackers to bypass authentication and execute arbitrary IPMI > commands by using cipher suite 0 (aka cipher zero) and an arbitrary > password. > 9. > 10. CVE-2013-4785 CVSS Base Score = 10.0 > 11. iDRAC 6 firmware 1.7, and possibly other versions, allows remote > attackers to modify the CLP interface for arbitrary users and possibly > have other impact via a request to an unspecified form that is > accessible from testurls.html. > 12. > 13. CVE-2013-4786 CVSS Base Score = 7.8 > 14. The IPMI 2.0 specification supports RMCP+ Authenticated > Key-Exchange Protocol (RAKP) authentication, which allows remote > attackers to obtain password hashes and conduct offline password > guessing attacks by obtaining the HMAC from a RAKP message 2 responses > from a BMC. > > > References: > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4782 > => http://fish2.com/ipmi/cipherzero.html > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4783 > => http://fish2.com/ipmi/cipherzero.html > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4784 > => http://fish2.com/ipmi/cipherzero.html > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4785 > => http://fish2.com/ipmi/dell/secret.html > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4786 > => http://fish2.com/ipmi/remote-pw-cracking.html > > On Thu, Aug 15, 2013 at 6:00 PM, Jay Ashworth <jra(a)baylink.com> wrote: >> Presumably, everyone else's are very religious as well. >> >> Is anyone here stupid enough not to put the management interfaces behind >> a firewall/VPN? >> >> http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/14/researchers-fi… >> >> And should I be nervous that Usenix pointed me *there* for the story, >> rather than a tech press outlet? >> >> Cheers, >> -- jra >> -- >> Jay R. Ashworth Baylink jra(a)baylink.com >> Designer The Things I Think RFC 2100 >> Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII >> St Petersburg FL USA #natog +1 727 647 1274 >> > >

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 16 Aug '13

16 Aug '13

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 17 Aug, 2013 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 462841 Prefixes after maximum aggregation: 187161 Deaggregation factor: 2.47 Unique aggregates announced to Internet: 229257 Total ASes present in the Internet Routing Table: 44722 Prefixes per ASN: 10.35 Origin-only ASes present in the Internet Routing Table: 34987 Origin ASes announcing only one prefix: 16208 Transit ASes present in the Internet Routing Table: 5885 Transit-only ASes present in the Internet Routing Table: 156 Average AS path length visible in the Internet Routing Table: 4.6 Max AS path length visible: 29 Max AS path prepend of ASN ( 19037) 22 Prefixes from unregistered ASNs in the Routing Table: 4596 Unregistered ASNs in the Routing Table: 1584 Number of 32-bit ASNs allocated by the RIRs: 4955 Number of 32-bit ASNs visible in the Routing Table: 3850 Prefixes from 32-bit ASNs in the Routing Table: 11664 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 304 Number of addresses announced to Internet: 2635027852 Equivalent to 157 /8s, 15 /16s and 85 /24s Percentage of available address space announced: 71.2 Percentage of allocated address space announced: 71.2 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 94.9 Total number of prefixes smaller than registry allocations: 162142 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 110903 Total APNIC prefixes after maximum aggregation: 33605 APNIC Deaggregation factor: 3.30 Prefixes being announced from the APNIC address blocks: 112709 Unique aggregates announced from the APNIC address blocks: 46196 APNIC Region origin ASes present in the Internet Routing Table: 4867 APNIC Prefixes per ASN: 23.16 APNIC Region origin ASes announcing only one prefix: 1223 APNIC Region transit ASes present in the Internet Routing Table: 824 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 28 Number of APNIC region 32-bit ASNs visible in the Routing Table: 638 Number of APNIC addresses announced to Internet: 725990208 Equivalent to 43 /8s, 69 /16s and 187 /24s Percentage of available APNIC address space announced: 84.8 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 131072-133119 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 160372 Total ARIN prefixes after maximum aggregation: 80867 ARIN Deaggregation factor: 1.98 Prefixes being announced from the ARIN address blocks: 160922 Unique aggregates announced from the ARIN address blocks: 74720 ARIN Region origin ASes present in the Internet Routing Table: 15828 ARIN Prefixes per ASN: 10.17 ARIN Region origin ASes announcing only one prefix: 5998 ARIN Region transit ASes present in the Internet Routing Table: 1660 Average ARIN Region AS path length visible: 4.1 Max ARIN Region AS path length visible: 27 Number of ARIN region 32-bit ASNs visible in the Routing Table: 19 Number of ARIN addresses announced to Internet: 1070350848 Equivalent to 63 /8s, 204 /16s and 66 /24s Percentage of available ARIN address space announced: 56.6 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 117912 Total RIPE prefixes after maximum aggregation: 60555 RIPE Deaggregation factor: 1.95 Prefixes being announced from the RIPE address blocks: 121724 Unique aggregates announced from the RIPE address blocks: 78516 RIPE Region origin ASes present in the Internet Routing Table: 17350 RIPE Prefixes per ASN: 7.02 RIPE Region origin ASes announcing only one prefix: 8219 RIPE Region transit ASes present in the Internet Routing Table: 2810 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 27 Number of RIPE region 32-bit ASNs visible in the Routing Table: 2386 Number of RIPE addresses announced to Internet: 656724772 Equivalent to 39 /8s, 36 /16s and 211 /24s Percentage of available RIPE address space announced: 95.5 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 196608-199679 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 50343 Total LACNIC prefixes after maximum aggregation: 9566 LACNIC Deaggregation factor: 5.26 Prefixes being announced from the LACNIC address blocks: 55020 Unique aggregates announced from the LACNIC address blocks: 25639 LACNIC Region origin ASes present in the Internet Routing Table: 2001 LACNIC Prefixes per ASN: 27.50 LACNIC Region origin ASes announcing only one prefix: 578 LACNIC Region transit ASes present in the Internet Routing Table: 369 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 29 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 801 Number of LACNIC addresses announced to Internet: 135157288 Equivalent to 8 /8s, 14 /16s and 86 /24s Percentage of available LACNIC address space announced: 80.6 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 262144-263679 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 11560 Total AfriNIC prefixes after maximum aggregation: 2528 AfriNIC Deaggregation factor: 4.57 Prefixes being announced from the AfriNIC address blocks: 12162 Unique aggregates announced from the AfriNIC address blocks: 3903 AfriNIC Region origin ASes present in the Internet Routing Table: 643 AfriNIC Prefixes per ASN: 18.91 AfriNIC Region origin ASes announcing only one prefix: 190 AfriNIC Region transit ASes present in the Internet Routing Table: 131 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 6 Number of AfriNIC addresses announced to Internet: 46473728 Equivalent to 2 /8s, 197 /16s and 34 /24s Percentage of available AfriNIC address space announced: 46.2 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2922 11561 918 Korea Telecom (KIX) 17974 2655 871 92 PT TELEKOMUNIKASI INDONESIA 7545 2056 321 112 TPG Internet Pty Ltd 4755 1780 393 197 TATA Communications formerly 9829 1537 1221 45 BSNL National Internet Backbo 9583 1224 92 504 Sify Limited 9498 1175 309 70 BHARTI Airtel Ltd. 4808 1153 2127 332 CNCGROUP IP network: China169 7552 1139 1080 13 Vietel Corporation 24560 1088 394 164 Bharti Airtel Ltd., Telemedia Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 2978 3689 62 bellsouth.net, inc. 18566 2065 382 184 Covad Communications 1785 2006 679 125 PaeTec Communications, Inc. 22773 2006 2927 123 Cox Communications, Inc. 20115 1675 1646 621 Charter Communications 4323 1618 1105 408 Time Warner Telecom 701 1521 11103 797 UUNET Technologies, Inc. 30036 1365 305 639 Mediacom Communications Corp 7018 1317 11293 832 AT&T WorldNet Services 11492 1221 218 363 Cable One Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1562 544 16 Corbina telecom 34984 1303 244 221 BILISIM TELEKOM 31148 978 43 17 FreeNet ISP 20940 977 349 748 Akamai Technologies European 2118 962 97 13 EUnet/RELCOM Autonomous Syste 6830 898 2371 429 UPC Distribution Services 13188 843 99 70 Educational Network 8551 768 370 45 Bezeq International 12479 687 797 53 Uni2 Autonomous System 58113 541 55 339 LIR DATACENTER TELECOM SRL Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3129 1655 108 NET Servicos de Comunicao S.A 10620 2668 424 223 TVCABLE BOGOTA 7303 1730 1157 220 Telecom Argentina Stet-France 18881 1359 844 20 Global Village Telecom 8151 1283 2764 392 UniNet S.A. de C.V. 11830 945 364 15 Instituto Costarricense de El 27947 837 94 91 Telconet S.A 6503 787 434 63 AVANTEL, S.A. 6147 738 374 25 Telefonica Del Peru 3816 721 302 83 Empresa Nacional de Telecomun Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 36998 1861 112 5 MOBITEL 24863 874 274 30 LINKdotNET AS number 6713 543 633 26 Itissalat Al-MAGHRIB 8452 438 956 9 TEDATA 24835 291 80 8 RAYA Telecom - Egypt 3741 258 921 217 The Internet Solution 15706 221 32 6 Sudatel Internet Exchange Aut 29571 220 17 12 Ci Telecom Autonomous system 36992 220 501 29 Etisalat MISR 12258 193 28 71 Vodacom Internet Company Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3129 1655 108 NET Servicos de Comunicao S.A 6389 2978 3689 62 bellsouth.net, inc. 4766 2922 11561 918 Korea Telecom (KIX) 10620 2668 424 223 TVCABLE BOGOTA 17974 2655 871 92 PT TELEKOMUNIKASI INDONESIA 18566 2065 382 184 Covad Communications 7545 2056 321 112 TPG Internet Pty Ltd 1785 2006 679 125 PaeTec Communications, Inc. 22773 2006 2927 123 Cox Communications, Inc. 36998 1861 112 5 MOBITEL Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6389 2978 2916 bellsouth.net, inc. 17974 2655 2563 PT TELEKOMUNIKASI INDONESIA 10620 2668 2445 TVCABLE BOGOTA 4766 2922 2004 Korea Telecom (KIX) 7545 2056 1944 TPG Internet Pty Ltd 22773 2006 1883 Cox Communications, Inc. 18566 2065 1881 Covad Communications 1785 2006 1881 PaeTec Communications, Inc. 36998 1861 1856 MOBITEL 4755 1780 1583 TATA Communications formerly Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 30031 UNALLOCATED 12.27.122.0/24 7018 AT&T WorldNet Servic 13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic 23502 UNALLOCATED 12.44.44.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.103.0/24 209 Qwest 17300 UNALLOCATED 12.45.110.0/24 701 UUNET Technologies, 16476 UNALLOCATED 12.46.27.0/24 7018 AT&T WorldNet Servic 14764 UNALLOCATED 12.108.237.0/24 7018 AT&T WorldNet Servic 33649 UNALLOCATED 12.111.112.0/24 19029 New Edge Networks 30621 UNALLOCATED 12.151.74.0/23 7018 AT&T WorldNet Servic Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 100.100.0.0/24 4847 China Networks Inter-Exchange Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.92.16.0/21 8001 Net Access Corporation 23.92.24.0/22 6939 Hurricane Electric 23.92.64.0/24 54540 Incero LLC 23.92.65.0/24 54540 Incero LLC 23.92.66.0/24 54540 Incero LLC 23.92.67.0/24 54540 Incero LLC 23.92.68.0/24 54540 Incero LLC 23.92.69.0/24 54540 Incero LLC 23.92.70.0/24 54540 Incero LLC 23.92.71.0/24 54540 Incero LLC Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:11 /10:30 /11:93 /12:250 /13:479 /14:905 /15:1608 /16:12739 /17:6632 /18:11022 /19:22555 /20:32285 /21:34854 /22:48885 /23:42800 /24:244455 /25:1044 /26:1426 /27:597 /28:43 /29:75 /30:18 /31:0 /32:19 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 2016 2065 Covad Communications 36998 1826 1861 MOBITEL 6389 1713 2978 bellsouth.net, inc. 22773 1304 2006 Cox Communications, Inc. 8402 1271 1562 Corbina telecom 30036 1229 1365 Mediacom Communications Corp 11492 1182 1221 Cable One 1785 1079 2006 PaeTec Communications, Inc. 6983 1024 1152 ITC^Deltacom 10620 990 2668 TVCABLE BOGOTA Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:811 2:706 3:3 4:19 5:908 6:17 8:599 12:1897 13:2 14:868 15:11 16:3 17:10 18:19 20:17 23:334 24:1749 27:1540 31:1274 32:45 33:2 34:5 36:70 37:1818 38:898 39:2 40:180 41:3241 42:259 44:9 46:1854 47:3 49:652 50:842 52:12 54:37 55:7 57:26 58:1174 59:644 60:330 61:1494 62:1181 63:1985 64:4348 65:2155 66:4204 67:2016 68:1090 69:3315 70:863 71:492 72:1917 74:2528 75:327 76:305 77:1138 78:1007 79:615 80:1307 81:1018 82:649 83:587 84:569 85:1214 86:471 87:1042 88:537 89:1811 90:158 91:5568 92:625 93:1656 94:2015 95:1556 96:587 97:346 98:1029 99:42 100:29 101:598 103:3147 105:519 106:139 107:210 108:495 109:1865 110:945 111:1098 112:570 113:802 114:729 115:1102 116:956 117:800 118:1146 119:1288 120:363 121:850 122:1807 123:1243 124:1369 125:1411 128:635 129:223 130:302 131:667 132:348 133:160 134:277 135:72 136:259 137:242 138:344 139:189 140:207 141:321 142:532 143:393 144:498 145:93 146:531 147:478 148:678 149:354 150:154 151:589 152:413 153:193 154:30 155:415 156:275 157:405 158:276 159:745 160:349 161:446 162:580 163:222 164:548 165:555 166:255 167:602 168:1033 169:126 170:1071 171:188 172:25 173:1581 174:567 175:491 176:1173 177:2156 178:1899 179:91 180:1516 181:640 182:1225 183:432 184:655 185:757 186:2476 187:1401 188:1796 189:1279 190:7004 192:6867 193:5546 194:4601 195:3595 196:1327 197:985 198:4590 199:5384 200:5981 201:2602 202:8842 203:8870 204:4519 205:2604 206:2833 207:2893 208:3992 209:3589 210:2938 211:1553 212:2253 213:2019 214:928 215:100 216:5254 217:1651 218:618 219:323 220:1277 221:552 222:322 223:465 End of report

1 0

Cisco DMVPN Configuration Question
by Ray Soucy 16 Aug '13

16 Aug '13

Don't usually poke NANOG for a second pair of eyes, but got hit with an urgent need to get connectivity up on a small budget. I've run into a situation where I require multiple DMVPN spokes to be behind a single NAT IP (picture of things to come with CGN?) The DMVPN endpoint works fine behind NAT until a 2nd is added behind the same IP address. At that point the hub gets confused and I start seeing packet loss to the endpoints in a round-robin fashion. As far as I can see Cisco documentation says pretty clearly that each DMVPN spoke requires a unique IP address. Is there any way around this, or do I need to be looking at an alternative VPN solution? Hub config: ----8<---- description DMVPN bandwidth 100000 ip address 10.231.254.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication ! removed ip nhrp map multicast dynamic ip nhrp network-id 1 ip nhrp redirect ip tcp adjust-mss 1360 tunnel source ! removed tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile DMVPN ----8<---- Spoke: ----8<---- interface Tunnel2 description DMVPN bandwidth 100000 ip vrf forwarding DMVPN ip address 10.231.254.10 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication ! removed ip nhrp map multicast ! removed ip nhrp map 10.231.254.1 ! removed ip nhrp network-id 1 ip nhrp nhs 10.231.254.1 ip nhrp shortcut ip tcp adjust-mss 1360 tunnel source FastEthernet0/0 tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile DMVPN end ----8<---- -- Ray Patrick Soucy Network Engineer University of Maine System T: 207-561-3526 F: 207-561-3531 MaineREN, Maine's Research and Education Network www.maineren.net

2 1

Re: How big is the Internet?
by Scott Weeks 16 Aug '13

16 Aug '13

Ok, I'll put on my flame-proof undies, have some fun and bite at this one... --- sean(a)donelan.com wrote: From: Sean Donelan <sean(a)donelan.com> :: It seems odd that there are relatively good estimates :: for other communication networks and utilities; i.e. :: how big is the PSTN :: how many television or radio stations, :: how much freight is carried by railroads, trucks and ships. centralized control :: But asking how big is the Internet [...] What so special :: about the Internet that it can't be measured? Not controlled by small groups of people in positions of power. Thus innovation flourishes. Yay! :-) scott

2 1

Re: WaPo writes about vulnerabilities in Supermicro IPMIs
by Larry Sheldon 16 Aug '13

16 Aug '13

On 8/15/2013 8:53 PM, Scott Weeks wrote: > > > On 2013-08-15 19:00, Jay Ashworth wrote: > >> Is anyone here stupid enough not to put the management interfaces >> behind a firewall/VPN? > --------------------------------------------------- > > > Pain is a great teacher... The problem is getting the one that learned to transfer what was learned to the person hired as the replacement for the idiot that did the learning. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: WaPo writes about vulnerabilities in Supermicro IPMIs
by Scott Weeks 16 Aug '13

16 Aug '13

On 2013-08-15 19:00, Jay Ashworth wrote: > Is anyone here stupid enough not to put the management interfaces behind > a firewall/VPN? --------------------------------------------------- Pain is a great teacher... scott

1 0

Re: How big is the Internet?
by Larry Sheldon 15 Aug '13

15 Aug '13

On 8/15/2013 9:05 AM, Leo Bicknell wrote: > > On Aug 14, 2013, at 3:27 PM, Patrick W. Gilmore <patrick(a)ianai.net> > wrote: > >> Once you define what you mean by "how bit is the Internet", I'll be >> happy to spout off about how big it is. :) > > Arbitrary definition time: A Internet host is one that can send and > receive packets directly with at least one far end device addressed > out of RIR managed IPv4 or IPv6 space. > > That means behind a NAT counts, behind a firewall counts, but a true > private network (two PC's into an L2 switch with no other > connections) does not, even if they use IP protocols. Note that > devices behind a pure L3 proxy do not count, but the L3 proxy itself > counts. Isn't that like excluding city streets from the "How many miles of roads?" question--likely to be the bigger fraction of the whole-as-a-traveler-sees-it? -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

Recommendations for dynamic imix traffic generators
by Jason Lixfeld 15 Aug '13

15 Aug '13

Hi folks, I'm trying to put together a test bench to soak some CPE equipment with an imix of eyeball traffic. I'm wondering if anyone has any recommendations on open-source platforms that might be able to accomplish this. I'd like to simulate traffic conditions that various tiers of Internet users might create from behind these CPEs - Casual user, business user, gamer, heavy users, netflix client, Apple TV client, a combination of any of the aforementioned, etc. In a perfect world, I'd love for these traffic patterns to be dynamic; various pps/bps/fps/nat cps rates, various intervals of each and durations of each instead of just continually puking out the same set of packets in an endless loop. I think it would be important for this traffic generator to be intelligent enough to determine whether or not the tests it's performing are successful or not; that is, be cognizant of errors in the tests that would translate into what a user would perceive to be a broken web page or a slow loading web page or a video freezing or a game to lock up, all of which might be attributed to a timeout on a DNS lookup or packet-loss or a bad NAT stack, etc. If anyone has any ideas or experiences they can share on this type of setup, I'd love some feedback or advice. icir.org has a list of tools which I'm making my way through as well. Not sure what is useful for what it I'm trying to do, but I digress. Thanks in advance.

1 0

Level3 L2VPN service
by harbor235 15 Aug '13

15 Aug '13

Anybody have any experiences they want to share with Level3's L2VPN service? I am looking for performance, stability, and support issues? thank you, Mike

1 0

SMTP Authentication for Local Domain in Postfix
by Shahab Vahabzadeh 15 Aug '13

15 Aug '13

Dear friends, I have problem with my postfix configuration, I have enable SASL for postfix and now authentication works well for my clients but right now anyboy can send email from my local domain to local domain without authentication and cause of that I have lots of attacks. How can I force that if sender is my localdomain it must authenticate?! Here is my postfix configuration: main.cf: smtpd_sasl_auth_enable = yes > smtpd_sasl_local_domain = $myhostname > smtpd_sasl_security_options = noanonymous > broken_sasl_auth_clients = yes > smtpd_sasl_authenticated_header = yes > smtpd_client_restrictions = > permit_mynetworks, > permit_sasl_authenticated, > reject_unauth_pipelining, > reject_rbl_client zen.spamhaus.org, > smtpd_helo_restrictions = > permit_mynetworks, > #reject_non_fqdn_hostname, > reject_invalid_hostname > smtpd_sender_restriction = > permit_mynetworks, > permit_sasl_authenticated, > check_sender_access hash:/etc/postfix/access_table > reject_unknown_sender_domain, > reject_non_fqdn_sender > smtpd_recipient_restrictions = > permit_mynetworks, > permit_sasl_authenticated, > reject_invalid_hostname, > reject_unauth_pipelining, > reject_non_fqdn_sender, > reject_unknown_sender_domain, > reject_non_fqdn_recipient, > reject_unknown_recipient_domain, > reject_unverified_recipient, > reject_unauth_destination, > check_policy_service unix:private/policy-spf, > permit master.cf: smtp inet n - - - - smtpd > -o content_filter=spamassassin > submission inet n - - - - smtpd > -o smtpd_tls_security_level=may > -o smtpd_sasl_auth_enable=yes > -o smtpd_client_restrictions=permit_sasl_authenticated,reject > -o milter_macro_daemon_name=ORIGINATING > -o content_filter=spamassassin > smtps inet n - - - - smtpd > -o smtpd_tls_wrappermode=yes > -o smtpd_sasl_auth_enable=yes > -o smtpd_client_restrictions=permit_sasl_authenticated,reject > -o milter_macro_daemon_name=ORIGINATING > spamassassin > unix - n n - - pipe > user=nobody argv=/usr/bin/spamc -e /usr/sbin/sendmail -oi -f ${sender} > ${recipient} > policy-spf unix - n n - - spawn > user=nobody argv=/usr/bin/perl /usr/sbin/postfix-policyd-spf-perl access_table: mydomain.com REJECT You're not me! Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: +1 (415) 871 0742 PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90

2 1