April 2014 - Test - lists.nanog.org

Starting a greenfield carrier backbone network that can scale to national and international service. What would you do?
by charles＠thefnf.org 04 Apr '14

04 Apr '14

Hello everyone, It's been some time since I've been subscribed/replied/posted here (or on WISPA for that matter). I've been pretty busy running a non profit startup (protip: don't do that. It's really really terrible) :) I'm cofounder and CTO of the Free Networking Foundation. Our goal is to bring broadband (5 mbps symmetric to start) bandwidth to the 2/3 of Americans who currently can't get it (rural, urban core, undeserved, "$ILEC stops on otherside of street" etc). Efforts so far primarily have consisted of WiFI last (square) mile delivery using Ubiquiti hardware and the qmp.cat firmware (also meraki access points that were donated, for some reason this seems to happen quite a bit). We've helped numerous networks get started, grow and (soon we hope) become self sustaining in Austin, Kansas City, Los Angeles, Detroit, New York and a few other places throughout the US. The networks are in various stages of maturity of course, but a number of them are fully operational and passing real traffic. Especially the one in Kansas City (it spans both states). These are (point to point, routed) access/distribution networks which connect into colocation providers blended networks. So that's the background and current state of affairs. Not really NANOG material. The next step is to secure our v6 space and AS number. Now that's not horribly difficult or really worthy of NANOG (though I do greatly appreciate folks on the list who helped me through the theory/practice of that process sometime ago). It appears to be fairly straightforward if you are not an LIR. Simply go through the paperwork (LOA, submit to ARIN, get out the credit card, textbook BGP config and done). And if FNF was operating the networks (we don't, we just help with organizing/consulting/software guidance/hardware spend optimization/logistics etc) and if there was just one POP (and associated administrative body), then again it wouldn't be that interesting or worth cluttering up NANOG. FNF goal is to serve as an LIR, SWIPing out /48 chunks to neighborhood level operators. They would then peer with whatever upstream ISPs are regionally close and announce out the space. This of course would be associated with a training program, registration in an IPAM tool etc. Regarding the above? What do the operators on this list wish they could of been trained in starting out? I mean obviously they should have good mastery and working experience of CCNA level material, along with exposure to higher level concepts of WAN networking. What are the tricks, the gotchas, the "man that would of saved my company a million bucks in transit costs". Yes I realize these sort of things are usually closely held. I also am striving to create an entirely new breed of operators running BGP enabled sites with ipv6. The more I can do to help ease those folks integration into the internet, the better. In short, the often debated issue on this list of v6 endpoint explosion is going to be very very very real. What IPAM tools out there can scale to a multi hundred million node, distributed, "eventual consistency" national level? (I've been working closely with guifi.net, and we are attempting to relaunch that as a very slick Apple like experience with a libremap (couchdb based) system. I'd love to hear from folks across the spectrum of experience and network size. From folks who have been dual homed for <~1 year at a single site, to tier1 operators who were there when it all started. So what would you like to see done in a greenfield, open source, open governance carrier backbone network? What would a dream TIER1 (and I use that in the default free zone sense of the word) look like to you? Also how the heck would one get this bootstrapped at a sustainable pace? Would one create numerous tier2 regional carriers, and they would feed into an over arching tier1? I'm thinking something like a 501c8 type structure ( http://www.irs.gov/Charities-&-Non-Profits/Other-Non-Profits/Fraternal-Soci… ) As far as I know, this is the first time that an intentional community type approach is taken and a tier1 is the end goal. Not evolving into one, buying ones way into it, but a manifest destiny type approach to building a backbone. Please feel free to reach out to me directly (charles(a)thefnf.org[2] ) if you wish to have a one on one discussion. In particular I'm interested in legal expertise in these sort of areas (law/compliance/contracting/negotiations for right of way etc etc etc). Thanks for reading. I look forward to the discussion! PS: Yes, I'm young and idealistic. I'm also grounded/practical/focused. I'm currently working on making the access portion of the network as smooth and turnkey as possible. (That basically means packaging up zeroshell/observium/powerdns/libremap/trigger and other bits/bobs into a nice livecd/ova/openvz package). I also like to think about the next wave of issues while working on the current one. It will take another year or so before we need to really be building out the backbone (if nothing else, to link up the rapidly growing regional networks). This is about physical, layer 1 infrastructure. This isn't yet another overlay network (CJDNS/GNu FreeNet etc). Yes it's messy, yes it's all about non technical end users, yes it's about taking a rather complex stack (auth/network awareness/routing platform) and making it accessible to power users/"IT professionals". It's also a whole lot of fun! Please feel free to visit us at https://www.thefnf.org for more information.

4 4

Recommendation on NTP appliances/devices
by David Hubbard 04 Apr '14

04 Apr '14

Anyone have recommendations on NTP appliances; i.e. make, model, gps vs cell, etc.? Roof/outdoor/window access not available. Would ideally need to be able to handle bursts of up to a few thousand simultaneous queries. Needs IPv6 support. Thanks!

4 3

Anyone from AS577 and AS852 in the house?
by Jason Lixfeld 03 Apr '14

03 Apr '14

Bell and Telus, if you're listening - I need to inquire about BGP community support on your respective networks that cannot be addressed by info published in RADB, by our assigned AM, SE, your NOC or any support documentation on your respective websites on the subject. Please hit me up off-list. Thanks in advance!

1 0

Cogent - ATT issue?
by Eric 02 Apr '14

02 Apr '14

Anyone know if there is a connectivity issue between Cogent and ATT in the northeast? We're seeing random timeouts to some systems we have in an ATT data center but only from sources on Cogent's network. Thanks... - Eric :)

2 1

new DNS forwarder vulnerability
by Mark Allman 02 Apr '14

02 Apr '14

Just a quick note to let folks know about a new vulnerability we have found in some low-rent DNS forwarders---which we have been calling the 'preplay attack'. The finding is that when the vulnerable open resolvers receive a DNS response they just look at the query string in the response to see if they have a request for the given string outstanding. If they do, they accept the result. I.e., there is no validating of the source IP, port numbers or DNS transaction ID in the response. Dumb. This makes poisoning the caches of these boxes trivial (i.e., send a request for www.facebook.com and then immediately send an answer). A few notes ... - We have found 7--9% of the open resolver population---or 2-3 million boxes---to be vulnerable to this cache poisoning attack. (The variance is from different runs of our experiments.) - We have not been able to nail this vulnerability down to a single box or manufacturer. To the contrary our efforts at identifying the boxes indicates it crosses such boundaries. (However, these boxes do seem to be largely situated in residential settings.) - We presented these results at PAM earlier this week. Our paper, slides, etc. with details of the attack (and results about previously known DNS attacks) are available here: http://www.icir.org/mallman/pubs/SCRA14/ - We did give CERT a heads up about this before the paper appeared and they kibitzed the information around to various manufacturers of this sort of gear. My mental model is that this sort of gear is upgraded when it goes kaput. So, vigilance I guess. FWIW. allman -- http://www.icir.org/mallman/

13 14

Microsoft security contact
by Henri Wahl 02 Apr '14

02 Apr '14

Hello, can someone from Microsoft responsible for security contact me off-list please? Thanks & regards -- Henri Wahl IT Department Leibniz-Institut fuer Festkoerper- u. Werkstoffforschung Dresden tel: (03 51) 46 59 - 797 email: h.wahl(a)ifw-dresden.de http://www.ifw-dresden.de Nagios status monitor Nagstamon: http://nagstamon.ifw-dresden.de DHCPv6 server dhcpy6d: http://dhcpy6d.ifw-dresden.de IFW Dresden e.V., Helmholtzstrasse 20, D-01069 Dresden VR Dresden Nr. 1369 Vorstand: Prof. Dr. Juergen Eckert, Dr. h.c. Dipl.-Finw. Rolf Pfrengle

2 1

Outgoing traffic problem on Citrix Netscaler Load Balancer
by Anil KARADAG 02 Apr '14

02 Apr '14

Hi, I setup a netscaler load balancer for sip traffic on Amazon EC2. Clients packets are arrived to the backend servers over to the load balancer but any responses cannot be arrived to clients. I see the responses on the load balancer. I think there is a config problem for that but I don't know and did not find any solution for that. How can I fix the outbound traffic issue. thanks Bu e-posta mesaj? ve ekleri g?nderildi?i ki?i ya da kuruma ?zeldir ve gizlidir. Ayr?ca hukuken de gizli olabilir. Hi?bir ?ekilde ???nc? ki?ilere a??klanamaz ve yay?nlanamaz. E?er mesaj?n g?nderildi?i al?c? de?ilseniz bu elektronik postan?n i?eri?ini a??klaman?z, kopyalaman?z, y?nlendirmeniz ve kullanman?z kesinlikle yasakt?r ve bu elektronik postay? ve eklerini derhal silmeniz gerekmektedir. NETA? TELEKOM?N?KASYON A.?. bu mesaj?n i?erdi?i bilgilerin do?rulu?u veya eksiksiz oldu?u konusunda herhangi bir garanti vermemektedir. Bu nedenle bu bilgilerin ne ?ekilde olursa olsun i?eri?inden, iletilmesinden, al?nmas?ndan, saklanmas?ndan ve kullan?lmas?ndan sorumlu de?ildir. Bu mesajdaki g?r??ler g?nderen ki?iye ait olup, NETA? TELEKOM?N?KASYON A.?.'nin g?r??lerini yans?tmayabilir. ------------------------------------------------------- This e-mail and its attachments are private and confidential and intended for the exclusive use of the individual or entity to whom it is addressed. It may also be legally confidential. Any disclosure, distribution or other dissemination of this message to any third party is strictly prohibited. If you are not the intended recipient you are hereby notified that any dissemination, forwarding, copying or use of any of the information is strictly prohibited, and the e-mail should immediately be deleted. NETA? TELEKOM?N?KASYON A.?. makes no warranty as to the accuracy or completeness of any information contained in this message and hereby excludes any liability of any kind for the information contained therein or for the transmission, reception, storage or use of such information in any way whatsoever. The opinions expressed in this message are those of the sender and may not necessarily reflect the opinions of NETA? TELEKOM?N?KASYON A.?.

5 10

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability
by Clay Kossmeyer 02 Apr '14

02 Apr '14

Hi All - The Cisco PSIRT has been sending IOS Security Advisories to the NANOG mailing list for well over a decade. We started this process a long time ago at the request of the list’s then-membership and haven’t been asked to change since. Admittedly, vulnerability disclosure/discussion/reporting has changed a bit over the years and we may be a bit overdue on rethinking the need to send to NANOG. :) Given that there are a number of forums that more directly address either Cisco-specific issues or are specific to vulnerability announcements, we’re happy to discontinue sending to the NANOG list directly. Cisco maintains a mailing list and RSS feed to which we send our Security Advisories, and you’re welcome to join if interested: http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy… Thanks, Clay

5 4

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability
by Brandon Butterworth 01 Apr '14

01 Apr '14

> The Cisco PSIRT has been sending IOS Security Advisories to > the NANOG mailing list for well over a decade Thank you, much appreciated > Given that there are a number of forums that more directly > address either Cisco-specific issues or are specific to > vulnerability announcements, were happy to discontinue > sending to the NANOG list directly. They are lost in the noise of some endless threads > Cisco maintains a mailing list and RSS feed to which we > send our Security Advisories NANOG having a filtered feed of ISP backbone risk level advisorises seems fair brandon

2 1

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability
by Scott Weeks 01 Apr '14

01 Apr '14

--- ckossmey(a)cisco.com wrote: From: Clay Kossmeyer <ckossmey(a)cisco.com> [...] we’re happy to discontinue sending to the NANOG list directly. -------------------------------------------------- Instead of discontinuing them how about one email that contains all the details, rather than one email per detail. Similar to what I sent to the list earlier. For example: ---------------------------------------------- The Semiannual Cisco IOS Software Security Advisory has been released. For information please goto this URL: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html Advisory titles: - Session Initiation Protocol Denial of Service Vulnerability - Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability - Internet Key Exchange Version 2 Denial of Service Vulnerability - Network Address Translation Vulnerabilities - SSL VPN Denial of Service Vulnerability - Crafted IPv6 Packet Denial of Service Vulnerability ----------------------------------------------- scott

1 0