October 2014 - Test - lists.nanog.org

netfilter/iptables synproxy; need help deciding
by Paige Thompson 08 Oct '14

08 Oct '14

Hi, I guess syncookies wasn't enough and the SYNPROXY target is a relatively new addition to netfilter. If I remember correctly this has been a part of BSD PF for quite some time and is pretty easy to get up and working. I recently tried to set this up on one of my gateways considering that it's just one less uncovered means for somebody to be a dick that I have to deal with in the future. But, after spending some time researching and asking on Freenode I have been unable to determine whether or not it works, or even makes any sense. I'm starting to think it's a moot point. pastie.org/private/gjsypxkpjs8kuev0tlbxrw#22 (iptables rules, plenty of things to pick at but please try to focus on the subject of synproxy for the purpose of this e-mail.) based on the following table I want to say its not working because it seems to never change: http://pastie.org/private/xwct5opbb0aajcko2tnpw more info on /proc/stat/synproxy:http://www.spinics.net/lists/netdev/msg264350.html My only guess is that you can't do this at all with NAT because it relies on conntrack or maybe it will only work with SNAT? I don't understand this well enough to say; are proper firewall rules really a science that need to be understood that far in depth? Why is this not documented? This tutorial seems to indicate that you could use this with a NAT'd network: http://www.academia.edu/6773989/Homemade_DDoS_Protection_Using_IPTables_SYN… I really would like to come to some closure on this subject. Whether it needs to be done right or not done at all, I'm tired of it looming over me. I really want to believe I should do the very best to have all mitigation techniques already in place, but I'm having a hard time understanding why this is next to impossible to figure out if it's so important. #netfilter on freenode is next to no help, the mailing list seems to be unavailable.... the things people are saying about how I should "just switch" back to using pf seem like a drastic solution when people in #netfilter are so content (yet many of them have never heard of synproxy before.) Any thoughts on this are appreciated, -Paige

2 3

Re: Belkin Router issues this morning?
by Larry Sheldon 08 Oct '14

08 Oct '14

On 10/7/2014 17:32, Mike Lyon wrote: > And this, my friends, is why friends don't let friends buy Belkin... Amen. Side question? What happens is somebody is unwise to use Belkin routers on an internal, not-connected-to-the-Interatubes network (Like, for example, the network I tried to get ex-employer to install to serve the un-patched Windows 98 heart monitors and stuff that were favored targets of the crackers. I am having trouble understanding why a router would need a heartbeat from some foreign location. Or even what it would do with one. > Apparently, you still can't fix stupid, no matter how hard you try. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

3 3

PLDT on the list?
by Jon Lewis 08 Oct '14

08 Oct '14

This may be a long shot, but if there's anyone on-list from PLDT who can help out with PLDT I-Gate customer prefix filtering updates, I'd appreciate some help with an issue that's been dragging on for weeks. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Megapath contact
by Jeremy Parr 08 Oct '14

08 Oct '14

Could someone from Megapath contact me offlist? I'm fighting with some very strange routing for a customer.

1 0

Re: wifi blocking [was Re: Marriott wifi blocking]
by Larry Sheldon 08 Oct '14

08 Oct '14

On 10/7/2014 23:44, Valdis.Kletnieks(a)vt.edu wrote: > On Tue, 07 Oct 2014 23:10:15 -0500, Larry Sheldon said: >> The cell service is not a requirement placed upon them, I am pretty sure. > > However, once having chosen to provide it, and thus create an expectation > that cellular E911 is available, they're obligated to carry through on > that. > Obligated by what law, regulation, rule or contract? -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

3 2

Survey about RPKI/DNSSEC
by Matthias Waehlisch 08 Oct '14

08 Oct '14

Hi NANOG, we, a group of researchers, try to better understand the deployment of RPKI and DNSSEC. It's not always easy to find technical reasons for what we observe. To get more insights why you deploy or don't deploy RPKI or DNSSEC, we would like to ask you to participate in the following brief survey: http://eSurv.org?u=rpkidnssec We really appreciate your time. It should not take more than 5 minutes to complete the survey. The survey is anonymous. The results are only used to improve research on inter-networking. If there is interest, we will post the results to the list. Fell free to contact me offlist in case of further questions or comments. Many thanks! matthias (on behalf of the team) [This email has also been sent to RIPE and SIDR folks.] -- Matthias Waehlisch . Freie Universitaet Berlin, Inst. fuer Informatik, AG CST . Takustr. 9, D-14195 Berlin, Germany .. mailto:waehlisch@ieee.org .. http://www.inf.fu-berlin.de/~waehl :. Also: http://inet.cpt.haw-hamburg.de .. http://www.link-lab.net

1 1

Re: wifi blocking [was Re: Marriott wifi blocking]
by Larry Sheldon 08 Oct '14

08 Oct '14

On 10/8/2014 00:35, Larry Sheldon wrote: > On 10/7/2014 23:44, Valdis.Kletnieks(a)vt.edu wrote: >> On Tue, 07 Oct 2014 23:10:15 -0500, Larry Sheldon said: >>> The cell service is not a requirement placed upon them, I am pretty >>> sure. >> >> However, once having chosen to provide it, and thus create an expectation >> that cellular E911 is available, they're obligated to carry through on >> that. >> > Obligated by what law, regulation, rule or contract? > I lived in the area and worked in San Francisco when BART was built, and while I never rode BART regularly, I have no recall of cell service on BART or MUNI being a safety issue or advertised as such. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

1 0

Re: wifi blocking [was Re: Marriott wifi blocking]
by Larry Sheldon 08 Oct '14

08 Oct '14

On 10/7/2014 22:28, Roy wrote: > On 10/7/2014 7:34 PM, Larry Sheldon wrote: >> On 10/7/2014 20:59, Roy wrote: >>> >>> The SF Bay Area Rapid Transits System) turned off cellphones in 2011. >>> >>> http://www.sfgate.com/news/article/BART-admits-halting-cell-service-to-stop… >>> >>> >>> >>> and the FCC emphasis that future actions "recognizes that any >>> interruption of cell phone service poses serious risks to public safety" >>> >>> http://www.sfgate.com/bayarea/article/BART-cell-phone-shutdown-rules-adopte… >>> >> >> I see that as a fundamentally very different mater. >> >> If I understand, they turned off repeaters ("towers") that they owned >> and provided, in tunnels and other structures they owned--equipment >> that they were under no obligation whatever to provide. >> >> A reaction to "bright" marketing ideas that had not been thought-through. >> > > BART's equipment was licensed by the FCC with a main reason being 911 > access. OK--not a Marketing idea, maybe. But still, all the options are in BART's hands--they have emergency phones and people everywhere. The cell service is not a requirement placed upon them, I am pretty sure. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

2 1

Re: wifi blocking [was Re: Marriott wifi blocking]
by Larry Sheldon 08 Oct '14

08 Oct '14

On 10/7/2014 20:59, Roy wrote: > > The SF Bay Area Rapid Transits System) turned off cellphones in 2011. > > http://www.sfgate.com/news/article/BART-admits-halting-cell-service-to-stop… > > > and the FCC emphasis that future actions "recognizes that any > interruption of cell phone service poses serious risks to public safety" > > http://www.sfgate.com/bayarea/article/BART-cell-phone-shutdown-rules-adopte… I see that as a fundamentally very different mater. If I understand, they turned off repeaters ("towers") that they owned and provided, in tunnels and other structures they owned--equipment that they were under no obligation whatever to provide. A reaction to "bright" marketing ideas that had not been thought-through. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

2 1

Weird Issues within L3
by Khurram Khan 07 Oct '14

07 Oct '14

Hi Group, We have a couple of circuits , internet facing with Level 3 and from our edge in San Diego, seeing some packet loss when trying a ping to 4.2.2.4, sourcing from 63.214.184.3. anyone seeing a similar issue ? Packet sent with a source address of 63.214.184.3 !.!!!.!!!!!!!!!!!!!...!!!..!!!!!!.!!.!!!!!!.!..!!.!!.!!!!!!!!!!!!!!!!! !!!!!!!!!.!!.!!!..!!!!!.!!!!.! Success rate is 80 percent (80/100), round-trip min/avg/max = 12/13/16 ms

5 4