March 2015 - Test - lists.nanog.org

Purpose of spoofed packets ???
by Matthew Huff 11 Mar '15

11 Mar '15

We recently got an abuse report of an IP address in our net range. However, that IP address isn't in use in our networks and the covering network is null routed, so no return traffic is possible. We have external BGP monitoring, so unless something very tricky is going on, we don't have part of our prefix hijacked. I assume the source address was spoofed, but this leads to my question. Since the person that submitted the report didn't mention a high packet rate (it was on ssh port 22), it doesn't look like some sort of SYN attack, but any OS fingerprinting or doorknob twisting wouldn't be useful from the attacker if the traffic doesn't return to them, so what gives? BTW, we are in the ARIN region, the report came out of the RIPE region. ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-694-5669

6 6

Re: Purpose of spoofed packets ???
by Bacon Zombie 11 Mar '15

11 Mar '15

Nmap has an option to "hide" your real IP among either a provides or IP list of IP addresses. " D *<**decoy1**>*[,*<**decoy2**>*][,ME][,...] (Cloak a scan with decoys) Causes a decoy scan to be performed, which makes it appear to the remote host that the host(s) you specify as decoys are scanning the target network too. Thus their IDS might report 5–10 port scans from unique IP addresses, but they won't know which IP was scanning them and which were innocent decoys. While this can be defeated through router path tracing, response-dropping, and other active mechanisms, it is generally an effective technique for hiding your IP address." http://nmap.org/book/man-bypass-firewalls-ids.html On 11 Mar 2015 02:17, "Steve Atkins" <steve(a)blighty.com> wrote: On Mar 10, 2015, at 4:40 PM, Matthew Huff <mhuff(a)ox.com> wrote: > We recently got an abuse report of an IP address in our net range. However, that IP address isn't in use in our networks and the covering network is null routed, so no return traffic is possible. We have external BGP monitoring, so unless something very tricky is going on, we don't have part of our prefix hijacked. > > I assume the source address was spoofed, but this leads to my question. Since the person that submitted the report didn't mention a high packet rate (it was on ssh port 22), it doesn't look like some sort of SYN attack, but any OS fingerprinting or doorknob twisting wouldn't be useful from the attacker if the traffic doesn't return to them, so what gives? > > BTW, we are in the ARIN region, the report came out of the RIPE region. Either the reporter doesn't know what they're talking about (common enough) or someone is scanning for open ssh ports, hiding their real IP address by burying it in a host of faked source addresses. That's a standard option on some of the stealthier port scanners, IIRC. Cheers, Steve

2 1

Phone adapter with router
by A MEKKAOUI 11 Mar '15

11 Mar '15

Hi Do you know any good router with phone adapters to provide home phone and internet? We tried couple of them like Linksys, Thomson, etc. and no one does the job perfectly. Any comment will be appreciated. Thank you Karim

7 7

[Deadline Extended] IEEE International Workshop on Manageability and Security of Network Function Virtualization and Software Defined Network (MASONS)
by Chen Liu 11 Mar '15

11 Mar '15

--------------------------------------------------------------------------------------------------------------------------- Apologies for cross-postings! --------------------------------------------------------------------------------------------------------------------------- Call for Papers IEEE International Workshop on Manageability and Security of Network Function Virtualization and Software Defined Network (MASONS) With ICCCN 2015 at Las Vegas, Aug 3 – 6, 2015 http://www.icccn.org/icccn15/ MASONS 2015 is Technically Co-Sponsored by the IEEE Communication Society 1. Theme Today, many research organizations in academia, government labs and industry are exploring SDN and NFV technologies to study and materialize their benefits in real world networks. These benefits are enabling automation, reducing time to market in case of new service introductions, optimization and/or improving overall economics of network and system management and operations. However to materialize the benefits of SDN and NFV at larger scale across multiple domains, similar to today’s internet, additional investigations are needed which should focus beyond the core SDN, NFV features and functionalities. This involves: development of multi-domain SDN network to support Internet; large scale deployment of novel applications, identification of technological and operational gaps in research and development over the longer term to increase the capability of SDN and NFV powered networks, and better integrate them with existing public Internet and emerging cloud technologies; Identification of security, manageability gaps, including opportunities to build in additional levels of security, resilience and management capabilities. 2. Topics of interest This workshop aims to show case and disseminate new ideas and high quality research on manageability and security of Software Defined Network and Network Function Virtualization. We solicit original research articles, review papers, theoretical studies, and practical software systems incorporating new paradigms, experimental prototypes, and insightful requirement analysis with the above theme including, but not limited to the topics below: * Design, requirements and prototypes of Software Defined Exchanges (SDX) to enable interoperability and use of new approaches with the current Internet infrastructure. * Security, privacy, authentication, trust, verification for SDN and NFV. * Integration of compute, storage and network under the Software Defined Infrastructure (SDI) paradigm. * Analysis of new management challenges that SDN and NFV has introduced. * Network management practices and business processes for SDN and NFV, in service provider and data center infrastructures. * Tools and operational procedures for managing SDN. * New paradigms in network operations, administration and management (OAM), service orchestration, service engineering, converged network-compute and data center management. * Software Defined Network (SDN), abstraction, programmability, application Interface, south and northbound API. * Network Function Virtualization (NFV), distributed control, virtual switches, routing virtualization. * Network system management, orchestration, resource management and optimization, integration, interoperability. * Network operations management related automation, troubleshooting and management tools. * Cloud based network and system management application paradigms. * Application of artificial intelligence (AI), machine learning (ML), analytics and big data in network and system management. * Insights about Network Management System architectural requirements analysis. * Scalability of SDN, NFV, SDI, NMS systems. * User experience, user interface design issues and challenges in NMS for SDN, NFV, ethnographic studies on network operations centers, usability studies of management applications. 3. Speakers and Industry Panel * Morning keynote: Dr. Gee Rittenhouse, SVP, Cloud & Virtualization Group, Cisco System * Industry panel: Microsoft, IBM, Google, Cisco 4. Instructions for IEEE MASONS 2015 Workshop Authors: Submitted manuscripts must be formatted in standard IEEE camera ready format (double column, 10 pt font) and must be submitted via EasyChair ( http://www.easychair.org/) as PDF files (formatted for 8.5×11 inch paper). It should be no longer than 6 pages with up to two extra pages given the authors are willing to pay an over-length charge per extra page. The detailed information can be found in the ICCCN 2015 (Las Vegas) website. For any workshop related questions or additional information please contact the General, TPC, or Workshop Chairs. Submitted papers should not be previously published in or be under consideration for publication in another conference or journal. Paper titles and/or author names cannot be changed and/or added to the papers once papers are submitted to ICCCN 2015 for review. Submissions must include a title, abstract, keywords, author(s) and affiliation(s) with postal and email address(es) and phone number(s). A paper abstract must be registered on EasyChair by the deadline indicated below. 5. Important dates: * Abstract Due: Mar 21, 2015 * Paper Due: Mar 21, 2015 * Acceptance Notification: Apr 13, 2015 * Camera Ready Due: May 8, 2015 6. Review and Publication of Manuscripts: Submitted papers will be reviewed by the ICCCN 2015 TPC members and judged on originality, technical correctness, relevance, and quality of presentation. An accepted paper must be presented at the conference venue by one (who registered/paid full author reg. fee) of authors to be included in the conference venue. Each full registration covers up to two ICCCN 2015 conference papers authored by the registered/paid author. Accepted and presented papers will be published in the conference proceedings and submitted to IEEE Xplore as well as other Abstracting and Indexing (A&I) databases. The page limit for papers is 6 pages. Papers should be submitted on EDAS, the link for this workshop will be published here shortly. Papers of special merit will be selected for possible fast track at a journal special issue at IJCNDS (see details at http://www.inderscience.com/info/ingeneral/cfplist.php?jcode=ijcnds and http://www.manageability-at-scale.org/cfp/) 7. Workshop chairs * Inder Monga, ESnet and LBNL, USA, imonga(a)es.net * Amitava Biswas, Cisco Systems, USA, amitavabiswas(a)ieee.org * Chen Liu, Microsoft, USA, chenliu419(a)gmail.com

1 0

Spam coming from (possibly) GoDaddy servers - anyone on the list?
by Rafael Possamai 11 Mar '15

11 Mar '15

Received some fake FedEx emails coming from "secureserver.net" servers that afaik belong to GoDaddy. I can give more details if someone speaks up. GMail anti-spam only picked up a few of these, others went straight through to inbox. Regards, Rafael

1 0

Verizon Policy Statement on Net Neutrality
by Larry Sheldon 11 Mar '15

11 Mar '15

http://publicpolicy.verizon.com/blog/entry/fccs-throwback-thursday-move-imp… -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

7 7

HBO DNS Admins?
by Livingood, Jason 10 Mar '15

10 Mar '15

Any DNS admins for HBO here? Your FQDN for order.hbonow.com looks a little messed up. http://dnsviz.net/d/order.hbonow.com/VP5DKQ/dnssec/ Jason

2 2

ASN to IP Mapping
by Andrew Iwamoto 09 Mar '15

09 Mar '15

Is there a tool or method to determine IP blocks assigned to an organization by ASN? I.e. if I have an organization's ASN number I want to know all blocks assigned to that ASN. Thank you. Andrew Iwamoto Unleashed Technologies

14 18

Facebook and Twitter outage
by Rashed Alwarrag 07 Mar '15

07 Mar '15

Hi All is there any global issue to access Facebook and twitter we are facing a problem from AS25019 for some subnets -- *Rashed Alwarrag *

1 0

Re: ASN to IP Mapping
by Hank Nussbacher 07 Mar '15

07 Mar '15

At 15:37 07/03/2015 +0000, Andrew Iwamoto wrote: >Is there a tool or method to determine IP blocks assigned to an >organization by ASN? I.e. if I have an organization's ASN number I want >to know all blocks assigned to that ASN. I use the excellent tool: http://bgp.he.net/ and select the "Prefixes V4" tab after entering the ASN in the webform. -Hank >Thank you. > >Andrew Iwamoto >Unleashed Technologies

1 0