June 2015 - Test - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 19 Jun '15

19 Jun '15

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 20 Jun, 2015 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 549882 Prefixes after maximum aggregation (per Origin AS): 208354 Deaggregation factor: 2.64 Unique aggregates announced (without unneeded subnets): 267650 Total ASes present in the Internet Routing Table: 50672 Prefixes per ASN: 10.85 Origin-only ASes present in the Internet Routing Table: 36714 Origin ASes announcing only one prefix: 16279 Transit ASes present in the Internet Routing Table: 6324 Transit-only ASes present in the Internet Routing Table: 165 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 41 Max AS path prepend of ASN ( 12486) 32 Prefixes from unregistered ASNs in the Routing Table: 1225 Unregistered ASNs in the Routing Table: 426 Number of 32-bit ASNs allocated by the RIRs: 9896 Number of 32-bit ASNs visible in the Routing Table: 7634 Prefixes from 32-bit ASNs in the Routing Table: 28027 Number of bogon 32-bit ASNs visible in the Routing Table: 13 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 388 Number of addresses announced to Internet: 2772890656 Equivalent to 165 /8s, 70 /16s and 244 /24s Percentage of available address space announced: 74.9 Percentage of allocated address space announced: 74.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 97.4 Total number of prefixes smaller than registry allocations: 184389 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 135535 Total APNIC prefixes after maximum aggregation: 39259 APNIC Deaggregation factor: 3.45 Prefixes being announced from the APNIC address blocks: 142125 Unique aggregates announced from the APNIC address blocks: 57084 APNIC Region origin ASes present in the Internet Routing Table: 5072 APNIC Prefixes per ASN: 28.02 APNIC Region origin ASes announcing only one prefix: 1215 APNIC Region transit ASes present in the Internet Routing Table: 878 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 38 Number of APNIC region 32-bit ASNs visible in the Routing Table: 1502 Number of APNIC addresses announced to Internet: 750709184 Equivalent to 44 /8s, 190 /16s and 233 /24s Percentage of available APNIC address space announced: 87.7 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 131072-135580 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 180493 Total ARIN prefixes after maximum aggregation: 88365 ARIN Deaggregation factor: 2.04 Prefixes being announced from the ARIN address blocks: 182879 Unique aggregates announced from the ARIN address blocks: 85354 ARIN Region origin ASes present in the Internet Routing Table: 16611 ARIN Prefixes per ASN: 11.01 ARIN Region origin ASes announcing only one prefix: 6117 ARIN Region transit ASes present in the Internet Routing Table: 1727 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 483 Number of ARIN addresses announced to Internet: 1093015328 Equivalent to 65 /8s, 38 /16s and 23 /24s Percentage of available ARIN address space announced: 57.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-395164 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 133222 Total RIPE prefixes after maximum aggregation: 66199 RIPE Deaggregation factor: 2.01 Prefixes being announced from the RIPE address blocks: 139731 Unique aggregates announced from the RIPE address blocks: 86551 RIPE Region origin ASes present in the Internet Routing Table: 17970 RIPE Prefixes per ASN: 7.78 RIPE Region origin ASes announcing only one prefix: 8133 RIPE Region transit ASes present in the Internet Routing Table: 2983 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 35 Number of RIPE region 32-bit ASNs visible in the Routing Table: 3790 Number of RIPE addresses announced to Internet: 694897664 Equivalent to 41 /8s, 107 /16s and 76 /24s Percentage of available RIPE address space announced: 101.0 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-204287 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 60347 Total LACNIC prefixes after maximum aggregation: 11405 LACNIC Deaggregation factor: 5.29 Prefixes being announced from the LACNIC address blocks: 70967 Unique aggregates announced from the LACNIC address blocks: 33075 LACNIC Region origin ASes present in the Internet Routing Table: 2449 LACNIC Prefixes per ASN: 28.98 LACNIC Region origin ASes announcing only one prefix: 618 LACNIC Region transit ASes present in the Internet Routing Table: 506 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 22 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 1736 Number of LACNIC addresses announced to Internet: 168145216 Equivalent to 10 /8s, 5 /16s and 177 /24s Percentage of available LACNIC address space announced: 100.2 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-265628 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 12002 Total AfriNIC prefixes after maximum aggregation: 3078 AfriNIC Deaggregation factor: 3.90 Prefixes being announced from the AfriNIC address blocks: 13792 Unique aggregates announced from the AfriNIC address blocks: 5236 AfriNIC Region origin ASes present in the Internet Routing Table: 739 AfriNIC Prefixes per ASN: 18.66 AfriNIC Region origin ASes announcing only one prefix: 196 AfriNIC Region transit ASes present in the Internet Routing Table: 157 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 123 Number of AfriNIC addresses announced to Internet: 65706496 Equivalent to 3 /8s, 234 /16s and 154 /24s Percentage of available AfriNIC address space announced: 65.3 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2949 11560 938 Korea Telecom 17974 2697 904 78 PT Telekomunikasi Indonesia 7545 2597 336 128 TPG Telecom Limited 4755 2026 423 222 TATA Communications formerly 4538 1936 4190 71 China Education and Research 9829 1717 1345 103 National Internet Backbone 9808 1539 8717 28 Guangdong Mobile Communicatio 9583 1471 117 567 Sify Limited 4808 1453 2247 463 CNCGROUP IP network China169 9498 1350 336 106 BHARTI Airtel Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3172 2958 139 Cox Communications Inc. 6389 2792 3688 51 BellSouth.net Inc. 3356 2557 10687 504 Level 3 Communications, Inc. 18566 2050 380 192 MegaPath Corporation 20115 1887 1853 423 Charter Communications 6983 1749 850 244 EarthLink, Inc. 4323 1607 1022 411 tw telecom holdings, inc. 30036 1570 319 440 Mediacom Communications Corp 701 1394 11353 678 MCI Communications Services, 22561 1355 414 250 CenturyTel Internet Holdings, Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 2472 128 6 SaudiNet, Saudi Telecom Compa 34984 2146 305 363 TELLCOM ILETISIM HIZMETLERI A 20940 1945 758 1417 Akamai International B.V. 6849 1210 355 22 JSC "Ukrtelecom" 31148 1048 45 23 Freenet Ltd. 13188 1041 97 71 TOV "Bank-Inform" 8402 1031 544 15 OJSC "Vimpelcom" 12479 947 868 72 France Telecom Espana SA 6830 912 2694 468 Liberty Global Operations B.V 8551 872 376 52 Bezeq International-Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3250 532 228 Telmex Colombia S.A. 28573 2276 2170 113 NET Serviços de Comunicação S 8151 1688 3238 469 Uninet S.A. de C.V. 7303 1639 1019 238 Telecom Argentina S.A. 6147 1621 373 44 Telefonica del Peru S.A.A. 6503 1251 421 55 Axtel, S.A.B. de C.V. 26615 1056 2325 35 Tim Celular S.A. 7738 999 1882 41 Telemar Norte Leste S.A. 3816 947 427 159 COLOMBIA TELECOMUNICACIONES S 11830 893 364 15 Instituto Costarricense de El Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 875 280 26 Link Egypt (Link.NET) 8452 801 958 13 TE-AS 36903 510 257 102 Office National des Postes et 36992 423 1229 32 ETISALAT MISR 37492 312 175 71 Orange Tunisie 24835 306 146 13 Vodafone Data 3741 250 857 208 Internet Solutions 29571 241 21 12 Cote d'Ivoire Telecom 36947 189 807 13 Telecom Algeria 37054 180 19 6 Data Telecom Service Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3250 532 228 Telmex Colombia S.A. 22773 3172 2958 139 Cox Communications Inc. 4766 2949 11560 938 Korea Telecom 6389 2792 3688 51 BellSouth.net Inc. 17974 2697 904 78 PT Telekomunikasi Indonesia 7545 2597 336 128 TPG Telecom Limited 3356 2557 10687 504 Level 3 Communications, Inc. 39891 2472 128 6 SaudiNet, Saudi Telecom Compa 28573 2276 2170 113 NET Serviços de Comunicação S 34984 2146 305 363 TELLCOM ILETISIM HIZMETLERI A Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3172 3033 Cox Communications Inc. 6389 2792 2741 BellSouth.net Inc. 17974 2697 2619 PT Telekomunikasi Indonesia 7545 2597 2469 TPG Telecom Limited 39891 2472 2466 SaudiNet, Saudi Telecom Compa 28573 2276 2163 NET Serviços de Comunicação S 3356 2557 2053 Level 3 Communications, Inc. 4766 2949 2011 Korea Telecom 4538 1936 1865 China Education and Research 18566 2050 1858 MegaPath Corporation Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 30662 UNALLOCATED 8.2.129.0/24 3356 Level 3 Communicatio 53506 UNALLOCATED 8.17.102.0/23 3356 Level 3 Communicatio 46467 UNALLOCATED 8.19.192.0/24 46887 Lightower Fiber Netw 18985 UNALLOCATED 8.21.68.0/22 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.122.0/24 12180 Internap Network Ser 46473 UNALLOCATED 8.27.124.0/24 12180 Internap Network Ser 27205 UNALLOCATED 8.38.16.0/21 6461 Abovenet Communicati 15347 UNALLOCATED 8.224.147.0/24 12064 Cox Communications I 33628 UNALLOCATED 12.0.239.0/24 1239 Sprint 32805 UNALLOCATED 12.1.225.0/24 7018 AT&T Services, Inc. Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 5.100.241.0/24 23456 32bit Transition AS 23.226.112.0/20 62788 >>UNKNOWN<< 27.100.7.0/24 56096 >>UNKNOWN<< 31.217.248.0/21 44902 COVAGE NETWORKS SASU 41.73.1.0/24 37004 >>UNKNOWN<< 41.73.10.0/24 37004 >>UNKNOWN<< 41.73.11.0/24 37004 >>UNKNOWN<< 41.73.12.0/24 37004 >>UNKNOWN<< 41.73.13.0/24 37004 >>UNKNOWN<< 41.73.15.0/24 37004 >>UNKNOWN<< Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:13 /10:34 /11:95 /12:264 /13:507 /14:1004 /15:1724 /16:12948 /17:7303 /18:12345 /19:25546 /20:36082 /21:38868 /22:60125 /23:52172 /24:297840 /25:1097 /26:1135 /27:715 /28:14 /29:12 /30:7 /31:0 /32:15 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 39891 2432 2472 SaudiNet, Saudi Telecom Compa 22773 2374 3172 Cox Communications Inc. 18566 2000 2050 MegaPath Corporation 6389 1640 2792 BellSouth.net Inc. 34984 1401 2146 TELLCOM ILETISIM HIZMETLERI A 6983 1397 1749 EarthLink, Inc. 30036 1396 1570 Mediacom Communications Corp 6147 1174 1621 Telefonica del Peru S.A.A. 10620 1144 3250 Telmex Colombia S.A. 11492 1105 1188 CABLE ONE, INC. Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1496 2:681 4:92 5:1867 6:25 8:1409 11:1 12:1818 13:14 14:1374 15:17 16:2 17:44 18:22 20:48 23:1240 24:1762 27:1923 31:1591 32:38 33:2 34:4 35:3 36:133 37:1984 38:1038 39:6 40:253 41:2669 42:276 43:1330 44:28 45:751 46:2294 47:45 49:901 50:812 52:12 54:77 55:5 56:6 57:41 58:1323 59:715 60:480 61:1745 62:1365 63:1923 64:4475 65:2263 66:4070 67:2076 68:1064 69:3254 70:1024 71:445 72:1978 74:2658 75:339 76:424 77:1296 78:1180 79:787 80:1338 81:1297 82:834 83:722 84:726 85:1409 86:411 87:1042 88:524 89:1848 90:152 91:5995 92:856 93:2238 94:2053 95:2180 96:426 97:355 98:1053 99:51 100:72 101:840 103:7660 104:1821 105:61 106:235 107:990 108:630 109:2065 110:1119 111:1442 112:831 113:1088 114:836 115:1278 116:1386 117:1038 118:1821 119:1458 120:447 121:1089 122:2146 123:1843 124:1516 125:1611 128:644 129:394 130:404 131:1200 132:502 133:177 134:407 135:95 136:332 137:314 138:886 139:153 140:235 141:448 142:668 143:522 144:572 145:118 146:736 147:586 148:1207 149:417 150:564 151:667 152:519 153:245 154:460 155:861 156:417 157:417 158:343 159:1006 160:384 161:663 162:1957 163:436 164:685 165:695 166:312 167:836 168:1314 169:177 170:1461 171:246 172:193 173:1554 174:721 175:694 176:1370 177:3786 178:2156 179:948 180:1948 181:1676 182:1810 183:628 184:755 185:3706 186:2740 187:1791 188:2059 189:1581 190:7788 191:1031 192:8468 193:5619 194:4169 195:3688 196:1980 197:966 198:5550 199:5493 200:6656 201:3259 202:9438 203:9155 204:4701 205:2842 206:3051 207:2967 208:3989 209:3966 210:3532 211:1860 212:2562 213:2365 214:850 215:72 216:5759 217:1801 218:715 219:463 220:1454 221:780 222:477 223:725 End of report

1 0

OPM Data Breach - Whitehouse Petition - Help Wanted
by Ronald F. Guilmette 19 Jun '15

19 Jun '15

My apologies in advance to any here who might feel that this is off topic... I don't personally believe that it is. Frankly, I don't know of that many mailing lists where the subscribers are likely to care as much about network security (and/or the lack thereof) as the membership of this list does. By now, most of you will have read about the massive federal data breach at the U.S. Government's Office of Personnel Management (OPM), and also the fact that (by OPM's own preliminary estimates) this massive data breach affects at least four million federal government employees... but perhaps as many as 14 million current and former employees. However as this story is still evolving, even as we speak, you may perhaps not be familiar with the following additional important facts that have just come out: *) In addition to ordinary government personel records, including the usual kinds of frequently-hacked personal information (e.g. social security numbers), an as-yet undetermined number of highly detailed 127-page government security clearance forms (SF86) containing vast and intimate details of virtually every aspect of the lives of essentially EVERYONE who has applied for or been granted a government security clearance at any time within THE PAST 30 YEARS have also been hacked/leaked. (Experts seem to agree that this security clearance data constitutes and absolute gold mine and treasure trove of information for foreign intelligence services, opening up vast possibilities for phishing, blackmail, and on and on.) *) The Director of the Office of Personnel Management, Ms. Katherine Archueta was warned, repeatedly, and over several years, by her own department's Inspector General (IG) that many of OPM's systems were insecure and should be taken out of service. Nontheless, as reveled during congressional testimony yesterday, she overruled and ignored this advice and kept the systems online. Given the above facts, I've just started a new Whitehouse Petition, asking that the director of OPM, Ms. Archueta, be fired for gross incompetence. I _do_ understand that the likelihood of anyone ever getting fired for incompetence anywhere within the Washington D.C. Beltway is very much of a long shot, based on history, but I nontheless feel that as a U.S. citizen and taxpayer, I at least want to make my opinion of this matter known to The Powers That Be. I *really* would like some help from members of this list on this endeavor. In particular, if you agree, I'd appreciate it if you would sign my petition, and, whether you agree or not, I sure would appreciate it if you would all share the following URL widely: https://petitions.whitehouse.gov//petition/immediately-fire-office-personne… Note that Whitehouse petitions do not even get properly or completely published on the Whitehouse web site until such time as they receive at least 150 signatures. I am hoping that members of this (NANOG) mailing list will help me to get past that threshold. Thanks for your attention. Regards, rfg

17 29

Re: Anycast provider for SMTP?
by Larry Sheldon 19 Jun '15

19 Jun '15

On 6/18/2015 16:40, Jonas Björk wrote: > >> On Jun 18, 2015, at 11:29 PM, Larry Sheldon <larrysheldon(a)cox.net> wrote: >> >>> On 6/18/2015 16:25, Jonas Björk wrote: >>> >>>> Because clients will switch to unicast for renewal. Also clients will stay >>>> with the current server forever, so you might have a bad distribution of >>>> load between the servers. If one server was down everyone will switch to >>>> the other and never go back until forced. >>> >>> Why wouldn't they go back to the nearest server when it comes back online? >> >> Been awhile, but it seems like they try to "renew" the lease they have, with the server that holds it. > The clients speak unicast with one single ip-helper which address is shared by all the servers. > They can't choose which ever server to talk to. One of us is confused (and it may well be me) but I thought the ip-helper address was only useful in the initial grope-in-the-dark for a server that is not on the local Ethernet broadcast domain. Thereafter the negotiations (I thought) are between the client and the responding server and forever after until a failure-to-renew occurred. -- sed quis custodiet ipsos custodes? (Juvenal)

2 1

Re: Anycast provider for SMTP?
by Larry Sheldon 18 Jun '15

18 Jun '15

On 6/18/2015 16:25, Jonas Björk wrote: > >> Because clients will switch to unicast for renewal. Also clients will stay >> with the current server forever, so you might have a bad distribution of >> load between the servers. If one server was down everyone will switch to >> the other and never go back until forced. > > Why wouldn't they go back to the nearest server when it comes back online? Been awhile, but it seems like they try to "renew" the lease they have, with the server that holds it. -- sed quis custodiet ipsos custodes? (Juvenal)

2 1

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Scott Weeks 18 Jun '15

18 Jun '15

--- rfg(a)tristatelogic.com wrote: From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> I _do_ understand the point you are making. But if you are charged with the safekeeping of untold millions of extraordinarily detailed personal data files, and if you don't have the resources to do your job properly, wouldn't the Right Thing To Do be to either (a) resign in protest or else (b) at the very least send a letter to members of Congress telling them just how effed up things really are, so that they will understand what is at risk? ----------------------------------------------------- As someone else said, you can't understand unless you've worked around it. From the statements you're making, it can be seen you haven't. The petition will not help and it's not just one person's fault. Try to stop continental drift. You'd have a better chance. scott

1 0

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Scott Weeks 18 Jun '15

18 Jun '15

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> The core problem here is that the Authority To Operate (ATO) process consumes essentially the entire activity of a USG computing project's security staff. The non-sensical compliance requirements, which if taken literally just about prevent you from ever connecting any computer to any other, get in the way of architecting systems around pragmatic and effective security. -------------------------------------------- "non-sensical compliance" Yeah, that. Pure, unmitigated insanity. scott

1 0

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Ronald F. Guilmette 18 Jun '15

18 Jun '15

Harry Hoffman hhoffman at ip-solutions.net wrote: >I think it would be great if you were to include some source links in >your petition/email so that folks unaware of the specifics can educate >themselves in a non-partisan and factual manner. Well, as regards to the petition itself, I can't because now it is cast in stone and can't be edited, I think, which is too bad, because I slightly misspelled the lady's name. It is Katherine Archuleta, not Katherine Archueta. :-( But more to the point, they only give you a VERY limited number of characters to state what your petition is asking for, so there's really not room for much in the way of links within the petition itself. But elsewise, I'll give a few good links here, but really if you just go to Google News and search for "OPM breach" you will find one hell of a lot of VERY fresh news reports. =============================================================================== Fed Agency blames giant hack on 'neglected' security systems http://www.usnews.com/news/politics/articles/2015/06/16/cybertheft-of-perso… (Executive Summary: 4.2 mellion federal personel records stolen - OPM was warned, repeatedly, FOR YEARS that systems were insecure and didn't do squat.) =============================================================================== Military clearance OPM data breach 'absolute calamity' http://www.navytimes.com/story/military/2015/06/17/sf-86-security-clearance… (Executive Summary: Literally MILLIONS of detailed security clearance files were taken... quote: "everyone's".) =============================================================================== OPM Hack Probe Hindered Because Digital Trail Has Been Erased, US Official Says http://abcnews.go.com/US/opm-hack-probe-hindered-digital-trail-erased-us/st… (Executive Summary: They don't know how long this lasted or even what really happened because they over-write their log files every 60 days) =============================================================================== Will anyone at OPM be fired for not preventing this catastrophic mega-hack by China? http://hotair.com/archives/2015/06/16/will-anyone-at-opm-be-fired-for-not-p… Nope! In fact, Whitehouse has already come out expressing confidence in the OPM Director, Katherine Archuleta: http://thehill.com/policy/cybersecurity/245294-obama-has-confidence-in-opm-… =============================================================================== Catching Up on the OPM Breach - Krebs On Security http://krebsonsecurity.com/2015/06/catching-up-on-the-opm-breach/ (Detailed timeline of the MANY screw-ups) =============================================================================== And last but by no means least, we have ArsTechnica's most recent contribution to the news coverage, it which the following UNBELIEVEABLE insanity is revealed: Encryption would not have helped" at OPM, says DHS official http://arstechnica.com/security/2015/06/encryption-would-not-have-helped-at… ... A consultant who did some work with a company contracted by OPM to manage personnel records for a number of agencies told Ars that he found the Unix systems administrator for the project "was in Argentina and his co-worker was physically located in the [People's Republic of China]. Both had direct access to every row of data in every database: they were root. Another team that worked with these databases had at its head two team members with PRC passports. I know that because I challenged them personally and revoked their privileges. From my perspective, OPM compromised this information more than three years ago and my take on the current breach is 'so what's new?'" Yea. Right. If you are trying to keep foreign nationals out of your "secure" system, then encryption quite certainly WILL NOT HELP if you have already given them root. Regards, rfg P.S. Regadless of your politics or what you think of Snowden, THIS INCIDENT is VASTLY WORSE that any leak that Snowden participated in. At least he and the reporters he worked with tried to exercise some discretion, and did not leak any personal details about any specific U.S. government employees. In the case of this massive OPM hack however, the incompetents in charge of OPM gave unknown foreign enemies EVERYTHING... enough data and personal dirt on millions of federal employees... including active service members and intelligence operatives... to allow them, our enemies, to engage in virtually unlimited blackmailing and spear-phishing of our people until the Second Coming. For those who were worriedly waiting for the much-predicted "Digital Pearl Harbor" attack on this country... well... you don't have to fret about THAT anymore, because this is it. It's already happened. And we did it to ourselves. P.P.S. Here is OPM Director Katherine Archuleta's personal biography. Executive Summary: She a long-time Democratic Party political hack with nothing other than a Master's degree in Education. (Still, isn't it comforting to know that "As a long-time public servant, she is a champion of Federal employees" ?) https://www.opm.gov/about-us/our-people-organization/senior-staff-bios/kath… P,P.P.S. Here's a nice clear explanation of how/why she got the job as the Director of the Office of Personel Management, overseeing the safety and security of millions of confidential federal government employee files and the people behind them: http://www.nationaljournal.com/decision-makers/government-operations/kather… July 18, 2013 - Even before President Obama nominated Archuleta to be director of OPM in late May, word leaked to the Washington press corps that the White House was intent on choosing a Hispanic. Both Interior Secretary Ken Salazar and Labor Secretary Hilda Solis had resigned from the Obama administration, and groups such as the National Council of La Raza had chided the president for nominating only one Hispanic to a Cabinet-level position in his second term. Enter Archuleta, who helped engineer the president's reelection win as Obama for America's national political director. Not only is she Latina, but Archuleta also hails from the swing state of Colorado, where Democrats have made inroads in recent years. If she is confirmed as OPM director, the 64-year-old will be the first Hispanic to hold that position. ...

1 0

Is it safe to use 240.0.0.0/4
by Luan Nguyen 18 Jun '15

18 Jun '15

Is that safe to use internally? Anyone using it? Just for NATTING on Cisco gears...

17 22

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Scott Weeks 18 Jun '15

18 Jun '15

--- rfg(a)tristatelogic.com wrote: From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> *) The Director of the Office of Personnel Management, Ms. Katherine Archueta was warned, repeatedly, and over several years, by her own department's Inspector General (IG) that many of OPM's systems were insecure and should be taken out of service. Nontheless, as reveled during congressional testimony yesterday, she overruled and ignored this advice and kept the systems online. ------------------------------------------- >From personal experience (at a different level) this is SOP, unfortunately. They just don't understand the importance until catastrophic failure. scott

1 0

DMARC in education
by Matthew Black 18 Jun '15

18 Jun '15

Looking at implementing DMARC for my institution. We currently have an SPF record and use DKIM to sign a small subset of messages. Rollout recommendations for DMARC suggest initially creating a "p=none" record to gather information on how a domain is being used. The RUA tag specifies a URI of where to send daily reports. Trying to get an idea of how many reports to expect a day or two after the dust settles. Does anyone use an aggregator to process their feedback (RUA tag) and/or forensic reports (RUF tag)? DMARC information. https://dmarc.org/ See slide 38 of 93 at http://www.slideshare.net/kka7/fighting-email-abuse-with-dmarc?qid=5e90be27… Everyone's first DMARC record V=DMARC1; p=none; rua=mailto:aggregate@example.com; Cheers! matthew black information technology services california state university, long beach

5 4