April 2014 - Test - lists.nanog.org

Re: NANOG NYC Event
by Fisher, Shawn 30 Jul '25

30 Jul '25

Personally I like dinosaur bbq, great malt beverages as well, and also blue smoke is great and if you like jazz, check out downstairs. -------------------------- Sent using BlackBerry -----Original Message----- From: andrew young To: Scott Brim CC: nanog(a)nanog.org Sent: Sat May 31 18:28:57 2008 Subject: Re: NANOG NYC Event Speaking of food, ill be going to the Big Apple BBQ fest next weekend: http://bigapplebbq.org/2008/ If you love to eat BBQ, this is a big MUST to cap off your stay in NYC. if you do decided to go, be sure to get the Fastpass: http://www.bigapplebbq.org/2008/index.php?s=fastpass You dont want to wait 30 mins online for food. Don't forget a bib and leave your belt at home. :-) - ------------------------------------ Andrew Young Webair Internet Development, Inc Phone: 1 866 WEBAIR 1 FAX: 516.938.5100 http://www.webair.com andrewy(a)webair.com ------------------------------------- We are interested in any feedback you might have about the service you received. Please contact our technical support consumer care manager directly at 1.866.WEBAIR1 or e-mail customercare(a)webair.com ------------------------------------- On Sat, 2008-05-31 at 18:17 -0400, Scott Brim wrote: > On 5/31/08 12:36 PM, Rod Beck allegedly wrote: > > I strongly suggest that those heading to New York visit the great > > musems, architecture (Saint Patrick's Cathedral), and restaurants. > > You have the American Museum of Natural History, which includes an > > excellent Planetarium and just on the other side of Central Park, the > > Metropolitan Museum of Art and the Guggenheim. There are excellent > > Chinese and Indian restaurants in Lower Manhattan. > > Don't forget about Brooklyn in all this Manhattan praise :-). Consider > the Brooklyn Botanic Garden. It's too late for cherries but the rose > collections will be great. And the best pizza in New York (if you can > get in) is at > http://menupages.com/restaurantdetails.asp?areaid=0&restaurantid=31402&neig… >

15 17

common checks performed when passing on an IPv4 PA allocation from one end-customer to another
by Martin T 23 Feb '16

23 Feb '16

Hi, when one end-customer has been using for example /24 IPv4 allocation for a while and returns this(for example changes an ISP) to LIR, then are there some good practices before handing out this same /24 to a new customer? I guess LIR should: 1) remove all the DNS PTR records, classless of classful delegations 2) check if some of the IP addresses are in DNSBL(maybe the previous customer was a spammer). Example with 93.184.216.0/24: $ for ip in {0..255}.216.184.93;\ > do for addr in \ > cbl.abuseat.org \ > dnsbl.inps.de \ > no-more-funn.moensted.dk \ > dnsbl.sorbs.net \ > bl.spamcannibal.org \ > bl.spamcop.net \ > psbl.surriel.com \ > dnsrbl.swinog.ch; \ > do dig @8.8.8.8 "$ip"."$addr" +short | grep -q "^127.0.0." && \ > echo "DNSBL-Alarm: $ip is listed on $addr"; done; done $ Anything else? regards, Martin

2 4

Big day for IPv6 - 1% native penetration
by Tomas Podermanski 06 Jan '16

06 Jan '16

Hi, It seems that today is a "big day" for IPv6. It is the very first time when native IPv6 on google statistics (http://www.google.com/intl/en/ipv6/statistics.html) reached 1%. Some might say it is tremendous success after 16 years of deploying IPv6 :-) T.

87 261

How are you doing DHCPv6 ?
by Randy Carpenter 02 Apr '15

02 Apr '15

I am wondering how people out there are using DHCPv6 to handle assigning prefixes to end users. We have a requirement for it to be a redundant server that is centrally located. DHCPv6 will be relayed from each customer access segment. We have been looking at using ISC dhcpd, as that is what we use for v4. However, it currently does not support any redundancy. It also does not do very much useful logging for DHCPv6 requests. Certainly not enough to keep track of users and devices. So, my questions are: How are you doing DHCPv6 with Prefix Delegation? What software are you using? When DHCPv6 with Prefix Delegation seems to be about the only way to deploy IPv6 to end users in a generic device-agnostic fashion, I am wondering why it is so difficult to find a working solution. thanks, -Randy -- | Randy Carpenter | Vice President - IT Services | Red Hat Certified Engineer | First Network Group, Inc. | (800)578-6381, Opt. 1 ----

13 37

Generating IPv6 list with filtergen.level3.net
by Smith, Courtney 28 Mar '15

28 Mar '15

Anyone out there know how to generate a IPv6 list Level3's filtergen? I tried Google but didn't find anything. () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

4 4

The state of TACACS+
by Robert Drake 05 Jan '15

05 Jan '15

Ever since first using it I've always liked tacacs+. Having said that I've grown to dislike some things about it recently. I guess, there have always been problems but I've been willing to leave them alone. I don't have time to give the code a real deep inspection, so I'm interested in others thoughts about it. I suspect people have just left it alone because it works. Also I apologize if this is too verbose or technical, or not technical enough, or just hard to read. History: TACACS+ was proposed as a standard to the IETF. They never adopted it and let the standards draft expire in 1998. Since then there have been no official changes to the code. Much has happened between now and then. I specifically was interested in parsing tac_plus logs correctly. After finding idiosyncrasies I decided to look at the source and the RFC to see what was really happening. Logging, or why I got into this mess: In the accounting log, fields are sometimes logged in different order. It appears the client is logging whatever it receives without parsing it or modifying it. That means the remote system is sending them in different orders, so technically the fault lies with them. However, it seems too trusting to take in data and log it without looking at it. This can also cause issues when you send a command like (Cisco) "dir /all nvram:" on a box with many files. The device expands the command to include everything on the nvram (important because you might want to deny access to that command based on something it expanded), but it gets truncated somewhere (not sure if it's the device buffer that is full, tac_plus, or the logging part. I might tcpdump for a while to see if I can figure out what it looks like on the wire) I'm not sure if there are security implications there. Encryption: The existing security consists of md5 XOR <content> with the md5 being composed of a running series of 16 byte hashes, taking the previous hash as part of the seed of the next hash. A sequence number is used so simple replay shouldn't be a factor. Depending on how vulnerable iterative md5 is to it, and how much time you had to sniff the traffic, I would think this would be highly vulnerable to chosen plaintext if you already have a user-level login, or at least partial known plaintext (with the assumption they make backups, you can guess that at least some of the packets will have "show running-config" and other common commands). They also don't pad the encrypted string so you can guess the command (or password) based on the length of the encrypted data. For a better description of the encryption you can read the draft: http://tools.ietf.org/html/draft-grant-tacacs-02 I found an article from May, 2000 which shows that the encryption scheme chosen was insufficient even then. http://www.openwall.com/articles/TACACS+-Protocol-Security For new crypto I would advise multiple cipher support with negotiation so you know what each client and server is capable of. If the client and server supported multiple keys (with a keyid) it would be easier to roll keys frequently, or if it isn't too much overhead they could use public key. Clients: As for clients, Wikipedia lists several that seem to be based on the original open-source tac_plus from Cisco. shrubbery.net has the "official" version that debian and freebsd use. I looked at some of the others and they all seemed to derive from Cisco's code directly or shrubbery.net code, but they retained the name and started doing their own versioning. All the webpages look like they're from 1995. In some cases I think it's intentional but in some ways it shows a lack of care for the code, like it's been dropped since 2000. Documentation is old: This only applies to shrubbery.net's version. I didn't look at the other ones that closely. While all of it appears valid, one Q&A in the FAQ was about IOS 10.3/11.0. Performance questions use the sparc 2 as a target machine. There isn't an INSTALL or README, just the FAQ/CHANGES/COPYING (and a tac_plus.conf manpage), so the learning curve for new users is probably pretty steep. Also there isn't a clear maintainer. The best email address I found was listed in the tacacs+.spec file, for packaging on rpm systems. If you hit the website they give some hints with some outdated, though still functional links. And they list the official email as tac_plus(a)shrubbery.net Conclusion: Did everyone already know this but me? If so have you moved to Kerberos? Can Kerberos do everything TACACS+ was doing for router authorization? I've got gear that only supports radius and tacacsplus, so in some cases I have no choice but to use one of those, neither of which I would trust over an unencrypted wire. If TACACS+ isn't a dead end then it needs a push to bring the protocol to a new version. There are big name vendors involved in making supported clients and servers. There should be someone invested in keeping it secure and adding features.

19 30

pay.gov and IPv6
by Matthew Kaufman 27 Oct '14

27 Oct '14

Random IPv6 complaint of the day: redirects from FCC.gov to pay.gov fail when clients have IPv6 enabled. Work fine if IPv6 is off. One more set of client computers that should be dual-stacked are now relegated to IPv4-only until someone remembers to turn it back on for each of them... sigh. Matthew Kaufman

9 14

US patent 5473599
by Nick Hilliard 09 May '14

09 May '14

... turns 20 today. This is the patent which covers hsrp, vrrp, many applications of carp and some other vendor-specific standby protocols. Assuming no term adjustments, 20 years is the normal term for US patents so unless there's been any adjustments / continuations, probably this patent is now expired. More details on: https://www.google.com/patents/US5473599 Nick

29 63

Anternet
by Larry Sheldon 07 May '14

07 May '14

Offered for your amusement--no followup. http://kottke.org/14/04/the-anternet -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

11 10

What Net Neutrality should and should not cover
by Rick Astley 05 May '14

05 May '14

Without the actual proposal being published for review its hard to know the specifics but it appears that it prohibits blocking and last mile tinkering of traffic (#1). What this means to me is ISP's can't block access to a specific website like alibaba and demand ransom from subscribers to access it again. I do not know if this provision would also include prohibiting intentionally throttling traffic on a home by home basis (#2) and holding services to the same kind of random is also prohibited but I think this too would be a far practice to prohibit. Bits are bits. >From the routers article ( http://www.reuters.com/article/2014/04/23/us-usa-fcc-internet-idUSBREA3M1H0…) and elsewhere it seems what the proposal does not outlaw is paid peering and perhaps use of QoS on networks. #3 On paid peering: I think this is where people start to disagree but I don't see what should be criminal about paid peering agreements. More specifically, I see serious problems once you outlaw paid peering and then look at the potential repercussions that would have. Clearly it would not be fair to for only the largest content providers to be legally mandated as settlement free peers because that would leave smaller competitors out in the cold. The only fair way to outlaw paid peering would be to do it across the board for all companies big and small. This would be everyone from major content providers to my uncle to sells hand runs a website to sell hand crafted chairs. This would have major sweeping repercussions for the Internet as we know it over night. I think it makes sense to allow companies to work it out as long as the prices charged aren't unreasonably high based on market prices for data. This means if 2 ISP's with similar networks want to be settlement free they can. If ISP's want to charge for transit they can, and if ISP's want to charge CDN's to deliver data they can. Typically the company with the disproportional amount of costs of carrying the traffic would charge the other company but really it should be up to the companies involved to decide. Based on the post by Tom Wheeler from the FCC ( http://www.fcc.gov/blog/setting-record-straight-fcc-s-open-internet-rules ) it sounds like if this pricing is "commercially unreasonable" (ie extortion) they will step in. Again I think this is fair. #4 On QoS (ie fast lane?): In some of the articles I skimmed there was a lot of talk about fast lane traffic but what this sounds like today would be known as QoS and classification marking that would really only become a factor under instances of congestion. The tech bloggers and journalists all seems to be unanimously opposed to this but I admit I am sort of scratching my head at the outrage over something that has been in prevalent use on many major networks for several years. I don't see this as the end of the Internet as we know it that now seems to essentially be popular opinion on the issue. Numerous businesses are using QoS to protect things like voice traffic and business critical or emergency traffic from being impacted in a failure scenario. In modern day hyper converged networks where pretty soon even mobile voice traffic could be VoIP over a data network prohibiting the use of all QoS seems irresponsible. The larger question is, is it fair for ISP's to charge people to be in a priority other than "best effort"? To answer a question with a question, if an ISP is using a priority other than "best effort" for some of its own traffic is it fair if a peer with a competing service is only best effort delivery? This is sort of akin to Comcast not counting its own video service against the ~250G/month cap of subscribers but counting off network traffic against it. In theory if some of an ISP's own services are able to use higher than best effort priority the same should be available to the business they are selling service to. If they go completely out of their way to intentionally congest the network to force people into needing a higher than best effort classification I would think it should fall into what the FCC calls "commercially unreasonable" and thus be considered a violation. So again, I think this is fair. I have numbered the items I mentioned from 1-4 being #1. Blocking #2. per household (last mile) rate limiting of a service (though rate limiting at all anywhere should probably be up for discussion so #2.5) #3. The legality of paid peering #4. The legality of QoS (unless fast lane is something else I don't understand). Feel free to augment the list.

18 22