April 2014 - Test - lists.nanog.org

Recommendation on NTP appliances/devices
by David Hubbard 04 Apr '14

04 Apr '14

Anyone have recommendations on NTP appliances; i.e. make, model, gps vs cell, etc.? Roof/outdoor/window access not available. Would ideally need to be able to handle bursts of up to a few thousand simultaneous queries. Needs IPv6 support. Thanks!

4 3

Anyone from AS577 and AS852 in the house?
by Jason Lixfeld 03 Apr '14

03 Apr '14

Bell and Telus, if you're listening - I need to inquire about BGP community support on your respective networks that cannot be addressed by info published in RADB, by our assigned AM, SE, your NOC or any support documentation on your respective websites on the subject. Please hit me up off-list. Thanks in advance!

1 0

Cogent - ATT issue?
by Eric 02 Apr '14

02 Apr '14

Anyone know if there is a connectivity issue between Cogent and ATT in the northeast? We're seeing random timeouts to some systems we have in an ATT data center but only from sources on Cogent's network. Thanks... - Eric :)

2 1

new DNS forwarder vulnerability
by Mark Allman 02 Apr '14

02 Apr '14

Just a quick note to let folks know about a new vulnerability we have found in some low-rent DNS forwarders---which we have been calling the 'preplay attack'. The finding is that when the vulnerable open resolvers receive a DNS response they just look at the query string in the response to see if they have a request for the given string outstanding. If they do, they accept the result. I.e., there is no validating of the source IP, port numbers or DNS transaction ID in the response. Dumb. This makes poisoning the caches of these boxes trivial (i.e., send a request for www.facebook.com and then immediately send an answer). A few notes ... - We have found 7--9% of the open resolver population---or 2-3 million boxes---to be vulnerable to this cache poisoning attack. (The variance is from different runs of our experiments.) - We have not been able to nail this vulnerability down to a single box or manufacturer. To the contrary our efforts at identifying the boxes indicates it crosses such boundaries. (However, these boxes do seem to be largely situated in residential settings.) - We presented these results at PAM earlier this week. Our paper, slides, etc. with details of the attack (and results about previously known DNS attacks) are available here: http://www.icir.org/mallman/pubs/SCRA14/ - We did give CERT a heads up about this before the paper appeared and they kibitzed the information around to various manufacturers of this sort of gear. My mental model is that this sort of gear is upgraded when it goes kaput. So, vigilance I guess. FWIW. allman -- http://www.icir.org/mallman/

13 14

Microsoft security contact
by Henri Wahl 02 Apr '14

02 Apr '14

Hello, can someone from Microsoft responsible for security contact me off-list please? Thanks & regards -- Henri Wahl IT Department Leibniz-Institut fuer Festkoerper- u. Werkstoffforschung Dresden tel: (03 51) 46 59 - 797 email: h.wahl(a)ifw-dresden.de http://www.ifw-dresden.de Nagios status monitor Nagstamon: http://nagstamon.ifw-dresden.de DHCPv6 server dhcpy6d: http://dhcpy6d.ifw-dresden.de IFW Dresden e.V., Helmholtzstrasse 20, D-01069 Dresden VR Dresden Nr. 1369 Vorstand: Prof. Dr. Juergen Eckert, Dr. h.c. Dipl.-Finw. Rolf Pfrengle

2 1

Outgoing traffic problem on Citrix Netscaler Load Balancer
by Anil KARADAG 02 Apr '14

02 Apr '14

Hi, I setup a netscaler load balancer for sip traffic on Amazon EC2. Clients packets are arrived to the backend servers over to the load balancer but any responses cannot be arrived to clients. I see the responses on the load balancer. I think there is a config problem for that but I don't know and did not find any solution for that. How can I fix the outbound traffic issue. thanks Bu e-posta mesaj? ve ekleri g?nderildi?i ki?i ya da kuruma ?zeldir ve gizlidir. Ayr?ca hukuken de gizli olabilir. Hi?bir ?ekilde ???nc? ki?ilere a??klanamaz ve yay?nlanamaz. E?er mesaj?n g?nderildi?i al?c? de?ilseniz bu elektronik postan?n i?eri?ini a??klaman?z, kopyalaman?z, y?nlendirmeniz ve kullanman?z kesinlikle yasakt?r ve bu elektronik postay? ve eklerini derhal silmeniz gerekmektedir. NETA? TELEKOM?N?KASYON A.?. bu mesaj?n i?erdi?i bilgilerin do?rulu?u veya eksiksiz oldu?u konusunda herhangi bir garanti vermemektedir. Bu nedenle bu bilgilerin ne ?ekilde olursa olsun i?eri?inden, iletilmesinden, al?nmas?ndan, saklanmas?ndan ve kullan?lmas?ndan sorumlu de?ildir. Bu mesajdaki g?r??ler g?nderen ki?iye ait olup, NETA? TELEKOM?N?KASYON A.?.'nin g?r??lerini yans?tmayabilir. ------------------------------------------------------- This e-mail and its attachments are private and confidential and intended for the exclusive use of the individual or entity to whom it is addressed. It may also be legally confidential. Any disclosure, distribution or other dissemination of this message to any third party is strictly prohibited. If you are not the intended recipient you are hereby notified that any dissemination, forwarding, copying or use of any of the information is strictly prohibited, and the e-mail should immediately be deleted. NETA? TELEKOM?N?KASYON A.?. makes no warranty as to the accuracy or completeness of any information contained in this message and hereby excludes any liability of any kind for the information contained therein or for the transmission, reception, storage or use of such information in any way whatsoever. The opinions expressed in this message are those of the sender and may not necessarily reflect the opinions of NETA? TELEKOM?N?KASYON A.?.

5 10

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability
by Clay Kossmeyer 02 Apr '14

02 Apr '14

Hi All - The Cisco PSIRT has been sending IOS Security Advisories to the NANOG mailing list for well over a decade. We started this process a long time ago at the request of the list’s then-membership and haven’t been asked to change since. Admittedly, vulnerability disclosure/discussion/reporting has changed a bit over the years and we may be a bit overdue on rethinking the need to send to NANOG. :) Given that there are a number of forums that more directly address either Cisco-specific issues or are specific to vulnerability announcements, we’re happy to discontinue sending to the NANOG list directly. Cisco maintains a mailing list and RSS feed to which we send our Security Advisories, and you’re welcome to join if interested: http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy… Thanks, Clay

5 4

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability
by Brandon Butterworth 01 Apr '14

01 Apr '14

> The Cisco PSIRT has been sending IOS Security Advisories to > the NANOG mailing list for well over a decade Thank you, much appreciated > Given that there are a number of forums that more directly > address either Cisco-specific issues or are specific to > vulnerability announcements, were happy to discontinue > sending to the NANOG list directly. They are lost in the noise of some endless threads > Cisco maintains a mailing list and RSS feed to which we > send our Security Advisories NANOG having a filtered feed of ISP backbone risk level advisorises seems fair brandon

2 1

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability
by Scott Weeks 01 Apr '14

01 Apr '14

--- ckossmey(a)cisco.com wrote: From: Clay Kossmeyer <ckossmey(a)cisco.com> [...] we’re happy to discontinue sending to the NANOG list directly. -------------------------------------------------- Instead of discontinuing them how about one email that contains all the details, rather than one email per detail. Similar to what I sent to the list earlier. For example: ---------------------------------------------- The Semiannual Cisco IOS Software Security Advisory has been released. For information please goto this URL: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html Advisory titles: - Session Initiation Protocol Denial of Service Vulnerability - Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability - Internet Key Exchange Version 2 Denial of Service Vulnerability - Network Address Translation Vulnerabilities - SSL VPN Denial of Service Vulnerability - Crafted IPv6 Packet Denial of Service Vulnerability ----------------------------------------------- scott

1 0

Microsoft mail contact
by Casey Deccio 01 Apr '14

01 Apr '14

Hi all, I'm looking for a Microsoft mail contact, specifically for MTAs in 2a01:111:f400::/48 address space. Please contact me off-list. Thanks, Casey

2 1