September 2013 - Test - lists.nanog.org

Radware vs Arbor
by Tempest 27 Sep '13

27 Sep '13

Doing a bunch of research, and I can't find a meaningful comparison of these two products. Work for a carrier, and I am looking at implementing a DDoS mitigation service that we can sell to our customers. Radware is cheaper, but I am seeing a lot of noise in various forums that makes me question their viability for what we need. Arbor has most of the market, and I assume there is good reason for it. Both companies seem to be very deceptive about how they compare to the other. Anyone out there with good hands on experience that can compare? Not interested in input from either company, we get plenty of that already. Good experience, or links to good write ups would be excellent... Davis B.

4 3

Re: iOS 7 update traffic
by Ben 27 Sep '13

27 Sep '13

On 24/09/2013 18:54, Michael Brown wrote: > That is most assuredly a rewrite, it's not just your perception. > > M. > Surprise surprise, that page now appears to Error 404... guess he must watch the list quite closely as it didn't take long for him to react ! ;-) Guess I should be flattered someone finds my internet rantings quoteworthy ! Would have appreciated at least a feable attempt at a citation (or at least a generic reference to the Nanog list in general).

2 1

BGP Attribute 128
by Jared Mauch 27 Sep '13

27 Sep '13

I'm curious how others are working with customers running code that drop the session with valid BGP attributes. Anyone else monitoring the proliferation of routes with attribute 128? I'm not really in favor of the features vendors have provided, such as this to just drop the attribute or routes. http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s… - Jared

2 3

Re: iOS 7 update traffic
by Mark Lancaster 26 Sep '13

26 Sep '13

I have heard a lot of questions and debate about whether the iOS updates download automatically: “Available updates download automatically if your device is connected to Wi-Fi and a power source.” http://support.apple.com/kb/HT4623 <http://support.apple.com/kb/HT4623> /mark <http://support.apple.com/kb/HT4623> <http://support.apple.com/kb/HT4623>

3 2

Re: Sudan disconnected from the Internet
by Tammy Firefly 26 Sep '13

26 Sep '13

On 9/25/13 18:29:58, Jeff Kell wrote: > On 9/25/2013 8:25 PM, Tammy Firefly wrote: >> with the old fashioned pair of diagonal cutters applied to fiber? > > Yes, interesting to know if it was cut fiber, pressure on the inside > providers (or their feeds), or pressure on the outside providers. > > Traceroutes lend any clue? > > Jeff > If the government did it, I guarantee it was cut fiber. That makes it difficult to quickly restore. One has to wonder whats going on there right now that they dont want the world to know about?

11 15

Re: gmail.com contact
by Chris Conn 26 Sep '13

26 Sep '13

: > > -----Original Message----- > From: Markus [mailto:universe@truemetal.org] > Sent: 26 septembre 2013 07:37 > To: nanog(a)nanog.org > Subject: gmail.com contact > > Hi list, > > We had a user account compromised a couple of days ago, spam naturally, and now the IP is blocked for delivering to gmail.com. We've completed the delivery problem form at support.google.com but if there is any way to speed up the process our customer and we would appreciate it. Could anyone put me in touch with a gmail.com contact? > > Hi, Good luck. I have been going through the "regular channels" for over a month, to try and de-list a server that has not sent an email for over a month to Google or anyone for that matter, and no such luck. If you get a hold of somebody, pls forward me contact info. I am trying again this morning, I will do the same for you. Cheers, Chris

1 0

gmail.com contact
by Markus 26 Sep '13

26 Sep '13

Hi list, We had a user account compromised a couple of days ago, spam naturally, and now the IP is blocked for delivering to gmail.com. We've completed the delivery problem form at support.google.com but if there is any way to speed up the process our customer and we would appreciate it. Could anyone put me in touch with a gmail.com contact? Thanks! Markus

1 0

Sudan disconnected from the Internet
by Glen Kent 26 Sep '13

26 Sep '13

Hi, The report from renesys states that "We initially stated that Sudan’s outage began at 12:47 UTC because that was when virtually all Sudanese routed networks were withdrawn from the global routing table" http://www.renesys.com/2013/09/internet-blackout-sudan/ If its a deliberate action to remove Sudan from the Internet then what exactly would the ISPs in Sudan have done? Drop their peering sessions with the three International gateways? How were the "Sudanese routed networks withdrawn"? Glen

3 2

RE:The block message is 521 DNSRBL: Blocked for abuse
by Timothy Metzinger 25 Sep '13

25 Sep '13

Here's a thought. Would it be possible to set up a process where ARIN, as part of reselling IP addresses, either issues a certificate of transfer that the new owner can use to prove to the ISPs that he's a new owner and not the old evil spammer, or ARIN publishes a list of IP assignments that can be used by ISPs to provisionally remove them from blocked lists? I sympathize with the original poster, it's sort of like buying a used car, only to find out the previous owner was the drunk driver who ran over your next door neighbor's dog.

8 8

Cisco Security Advisory: Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability Advisory ID: cisco-sa-20130925-rsvp Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger an interface queue wedge on the affected device. The vulnerability is due to improper parsing of UDP RSVP packets. An attacker could exploit this vulnerability by sending UDP port 1698 RSVP packets to the vulnerable device. An exploit could cause Cisco IOS Software and Cisco IOS XE Software to incorrectly process incoming packets, resulting in an interface queue wedge, which can lead to loss of connectivity, loss of routing protocol adjacency, and other denial of service (DoS) conditions. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6Z4ACgkQUddfH3/BbTq2kwEAj4vA8C+M60R9Q3Ytrpq0jvRh HY+VBYi3HMwsH+PmACYA/iBdUCcbxAHyHmip/8yVjs44Ej2r4JLFfvg6vLCQ8o2G =kOF1 -----END PGP SIGNATURE-----

1 0