November 2014 - Test - lists.nanog.org

Re: Kind of sad
by Larry Sheldon 12 Nov '14

12 Nov '14

On 11/11/2014 15:37, Ricky Beam wrote: > On Mon, 10 Nov 2014 22:43:09 -0500, Joe <jbfixurpc(a)gmail.com> wrote: >> Generally speaking its best you do what your good at and this is not it. >> >> Exposing there is a window open to a gov agency is not hacking, trust >> me. I would say go back to fathering children and once you have a few >> more years under your belt feel free to join in. > > And you, sir, should consult a lawyer before publicly slinging insults. > > I'm not a lawyer, but I have worked with one in this area. What you have > post *is* evidence of a crime under the Computer and Fraud Abuse Act. > The wording of that law is horrible, but it is what it is; the bar for > of "unauthorized access" is *very* low. How you found it is irrelevant. > You connected it to it -- knowing full well you are not authorized -- > and proceeded to attempt to login, even if in jest. > > (Government agencies have zero sense of humor. And judges have next to > no understanding of technology. Merely being charged can be a career > killer.) As an ex-admin I completely--we took action for such things. My understanding is that you can get a nasty lead overdose for standing next to a car with a Slim Jim, or trying doors to houses and warehouses to see if they are locked. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

3 2

IPv6 Operations
by Lee Howard 12 Nov '14

12 Nov '14

As a co-chair of the IETF v6ops Working Group, I thought I'd share my notes about yesterday's meeting with you, as actual operators, and ask for more input. Deprecating 6to4 Brian Carpenter discussed draft-ietf-v6ops-6to4-to-historic <http://tools.ietf.org/wg/v6ops/draft-ietf-v6ops-6to4-to-historic/> , specifically questions about whether to deprecate it completely, or just the version based on RFC3068 (which relies on anycast relays), and leave RFC3056 (useful for peer-to-peer kinds of connections) alone. That was the consensus. Relatedly, there was consensus to recommend filtering the anycast prefix 192.88.99.0/24, but not the related IPv6 version. Data Center Translation: SIIT-DC Tore Anderson presented (remotelyvery cool) his idea for statelessly translating from the IPv4 Internet to an IPv6-only data center. There was clear consensus that we should continue working on this as a working group, although it needs a better name, and Tore is looking for co-authors. If you have data center expertise and have ever wanted your name on an RFC, this is your chance. Read draft-anderson-v6ops-siit-dc <http://tools.ietf.org/id/draft-anderson-v6ops-siit-dc-01.txt> and draft-anderson-v6ops-siit-dc-2xlat <http://tools.ietf.org/id/draft-anderson-v6ops-siit-dc-2xlat-00.txt> and contact Tore. DHCPV6/SLAAC Interaction Bing Liu provided an update on two related documents, draft-ietf-v6ops-dhcpv6-slaac-problem <http://tools.ietf.org/wg/v6ops/draft-ietf-v6ops-dhcpv6-slaac-problem/> and draft-liu-v6ops-dhcpv6-slaac-guidance <http://tools.ietf.org/id/draft-liu-v6ops-dhcpv6-slaac-guidance-03.txt> . The discussion focussed on whether the behavior in the presence of both DHCPv6 and SLAAC is simply ambiguous (and therefore dependent on implementation) or broken. If it's ambiguous, we can clarify. If it's broken, we probably need a specification update (and, in fact, the DHC working group is working on revising rfc3315). We determined that the Problem Statement document (which may need to be renamed) should focus on behaviors in real implementations, and come back to the Guidance document later. Considerations for Using ULAs Bing also updated us on draft-ietf-v6ops-ula-usage-recommendations <http://tools.ietf.org/wg/v6ops/draft-ietf-v6ops-ula-usage-recommendations/> , but there was little discussion other than making sure it was consistent with current work in the Homenet WG. Considerations for Running Multiple IPv6 Prefixes Sheng Jiang updated us on draft-liu-v6ops-running-multiple-prefixes <http://tools.ietf.org/id/draft-liu-v6ops-running-multiple-prefixes-02.txt> , but it wasn't clear how useful it will be given ongoing work in the MIF WG, and whether NAT/NPT uses were relevant. We may revisit it later, if people want further discussion. IPv6 Vulnerability Test Program in Japan Ruri Hiromi described the IPv6 vulnerability test program in Japan <https://tools.ietf.org/html/draft-jpcert-ipv6vullnerability-check> , and asked for more participation and support. This has the potential for being very useful work; check it out. IPv6 Extension Headers Fernando Gont detailed his ongoing work on IPv6 Extension Headers in the Real World <https://tools.ietf.org/html/draft-gont-v6ops-ipv6-ehs-in-real-world> . The authors found that packets with IPv6 EH are often dropped: 20% drop rate for fragments 10% drops for Destination Options 40% drops for Hop-by-Hop options 25% for fragmented traffic 20-60% of drops occur at an AS other than Destination AS There was general agreement that this was bad, and he described several ramifications, including DOS vulnerabilities. Fernando said that applications relying on EH will need a fallback mechanism, but there was consensus that dropping EH packets is the problem, not the protocol design. We may work on a document providing recommendations on how to configure. This seems like a great topic for NANOG members to chime in on; do you drop packets with Extension Headers, and if so, why? Design Choices for IPv6 Networks Victor Kuarsingh presented Design Choices for IPv6 Networks <https://tools.ietf.org/html/draft-ietf-v6ops-design-choices> , and got consensus that the title and abstract needed a tighter scope, and the document should mention a couple of other design alternatives that are documented in other internet-drafts and RFCs. This document would also greatly benefit from review from NANOG participants, as it is intended for this audience. IPv4 Literals Break in NAT64 Osamu proposed A Special Purpose TLD to resolve IPv4 Address Literal on DNS64/NAT64 environments <https://tools.ietf.org/html/draft-osamu-v6ops-ipv4-literal-in-url> . There was good discussion, but not consensus that this was the right solution. Considerations on IPv6-only DNS Development Linjiang Song talked about Considerations on IPv6-only DNS Development <https://tools.ietf.org/html/draft-song-sunset4-ipv6only-dns> . Discussion focussed on the need for support for EDNS0, especially in Android. IPv6 Considerations for NFV Hui Deng described IPv6 Considerations for Network Function Virtualization (NFV) <https://tools.ietf.org/html/draft-chen-v6ops-nfv-ipv6> , which was enlightening for people like me who have not been deeply involved in OpenStack or NFV generally. There is a lot of work needed to get good IPv6 networking support. There are several other internet drafts related to OpenStack: go to https://datatracker.ietf.org/doc <https://datatracker.ietf.org/doc> / and search for "openstack." If any of these topics look interesting to you, there are a couple of things you can and should do: 1. Subscribe to the v6ops mailing list: https://www.ietf.org/mailman/listinfo/v6ops 2. Read the full draft, and send comments and questions to the v6ops mailing list Please note that if you reply here, some people will see your comments: if you do not clearly intend your statements not to be IETF Contributions, they may be considered as suchin other words, read the Note Well <https://www.ietf.org/about/note-well.html> . I hope this summary is interesting and useful. I would really like to see more operator input to our work. Thanks, Lee

1 0

Inside China GFW - basic dedicated server or cloud instance
by Andrius Kasparavicius 12 Nov '14

12 Nov '14

Business needs some permanent basic browser/tcp/ip view from *inside China great firewall* (Hong Kong or unfirewalled locations not good) for connectivity testing, troubleshooting for customers in China. Ideally just a dedicated windows box/server. Are there any simple providers with self-provisioning VPS or similar low cost solutions. Best to have it on ChinaTel network. No hosting or content would be shared from this box. Thanks

3 2

Kind of sad
by Joe 11 Nov '14

11 Nov '14

Kind of sad that the state govs don't curtail telnet,,, [root@bighughness ~]# telnet 167.240.254.155 623 Trying 167.240.254.155... Connected to external-dns1.state.mi.us (167.240.254.155). Escape character is '^]'. Username:root Password:

14 18

I am about to inherit 26 miles of dark fiber. What do I do with it?
by Lorell Hathcock 11 Nov '14

11 Nov '14

All: A job opportunity just came my way to work with 26 miles of dark fiber in and around a city in Texas. The intent is for me to deliver internet and private network services to business customers in this area. I relish the thought of starting from scratch to build a network right from the start instead of inheriting and fixing someone else's mess. That being said, what suggestions does the group have for building a new network using existing dark fiber? MPLS backbone? Like all businesses these days, I will likely have to build the lit backbone as I add customers. So how would you recommend scaling the network? I have six strands of SMF that connect within municipal facilities. Each new customer will be a new build out from the nearest point. Because of having only six strands, I don't anticipate selling dark fiber. I believe I need to conserve fibers so that it would be lit services that I offer to customers. I would like to offer speeds up to 10 GB. Thoughts are appreciated! Sincerely, Lorell Hathcock

11 16

Re: Undefined terms overload
by Larry Sheldon 11 Nov '14

11 Nov '14

On 11/10/2014 22:23, Christopher Morrow wrote: Thanks--I've received several useful offers of help. >> What does "bikeshedding" mean here? > > en.wikipedia.org/wiki/Parkinson's_law_of_triviality I'd forgotten the Parkinson's discussion and the term didn't stir anything up. I have current experience with the concept. >> And, what does "OOB" mean here--the decodes with which I am familiar do not > > 'out of band' - ideally: "Access the console of my equipment without > having to use the network my equipment is supporting" From another helpful message I was able to connect to the old telephone term that had the same functional definition in a different physical implementation. Thanks, all. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

1 0

Undefined terms overload
by Larry Sheldon 11 Nov '14

11 Nov '14

I was able to ignore it for a while, but now I have run into one in two unrelated threads. What does "bikeshedding" mean here? And, what does "OOB" mean here--the decodes with which I am familiar do not seem to fit: Out of Bounds, Out Of Body, Out of Bed, Out of Business, Open Of Business (used to see this one many times daily), Out Of Bullets, Out Of Band (also familiar from telephone days). -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

2 1

Re: Kind of sad
by Scott Weeks 11 Nov '14

11 Nov '14

--- jmkeller(a)houseofzen.org wrote: From: James Michael Keller <jmkeller(a)houseofzen.org> On 11/10/2014 06:34 PM, Joe wrote: > Kind of sad that the state govs don't curtail telnet,,, > > [root@bighughness ~]# telnet 167.240.254.155 623 > Trying 167.240.254.155... > Connected to external-dns1.state.mi.us (167.240.254.155). > Escape character is '^]'. > Username:root > Password: > Hopefully a honeypot / synthetic response from an IPS unit.... -------------------------------------------------- State gov't. I doubt it. I've seen the horrors that happen in those places... :-) scott

1 0

Contact at internode / iiNet (AS4739)?
by Paul S. 11 Nov '14

11 Nov '14

Hey, If anyone from the routing / peering team of Internode / iiNet happens to frequent this list, could you reach me off-list? I've been having routing problems with my peering session to you for a few months already, and haven't been able to get a response off the helpdesk. Thanks, and sorry for the noise.

1 0

Hosted IP telephony
by A Mekkaoui 10 Nov '14

10 Nov '14

Hi, We are an Internet and IP telephony provider in Canada and looking for options to reduce our costs. We are exploring hosted IP telephony option to see how it can help us reducing cost and operational headaches. We have few hundred of phone adapters to register and this number increases from day to day. If you provide this type of solutions or know providers of this type of solutions please contact me. Your help will be appreciated. Thank you Karim

1 0