July 2015 - Test - lists.nanog.org

OCP Data Center Spec: Ladder Tray
by Martin Hannigan 23 Jul '15

23 Jul '15

Hi NANOG, The Open Compute Project "OCP" had, at least that I can recall but now can not find, a ladder tray deployment spec in the data center working group. It called for tray to span the middle of the aisle as I remember it. Anyone recall or have a pointer to it? My favorite search engine and the OCP wiki yields nothing. I was also hoping to find someone involved in the spec to discuss a related NFPA issue with. Best, -M<

1 0

20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours
by Drew Weaver 23 Jul '15

23 Jul '15

Has anyone else seen a massive amount of illegitimate UDP 1720 traffic coming from China being sent towards IP addresses which provide VoIP services? I'm talking in the 20-30Gbps range? The first incident was yesterday at around 13:00 EST, the second incident was today at 09:00 EST. I'm assuming this is just another DDoS like all others, but I would be interested to hear if I am not the only one seeing this. On list or off-list is fine. Thanks, -Drew

21 42

Gmail contact?
by Marco Davids 23 Jul '15

23 Jul '15

Hi, Is there anyone on this list that can get me in touch with someone at Google/Gmail? I would like to discuss a suggested improvement with them in regard to RFC-compliance of DKIM/DMARC. Please contact me off-list. Thanks. -- Marco

1 0

another tilt at the Verizon FIOS IPv6 windmill
by Paul B. Henson 21 Jul '15

21 Jul '15

I think it's been about a year and a half since I last looked (and cried) at the status of FIOS IPv6. As far as I can tell, there's been no new official news since 2013. We're deploying IPv6 at the university I work at, so IPv6 at home is moving from "wish I had it to play with" towards "need to have it to work from home". So it seems I either cancel my fios and go with business class cable (I live in Time Warner territory and it looks like they're good to go with IPv6) or set up a tunnel with HE. Or pray Google fiber comes to my neck of the woods. Any new rumors floating around? Any Verizon employees interested in posting anonymously and explaining what on earth is going on inside the company? Any secret phone numbers to call to get in on an alpha/beta test in the So Cal area ;)? If nothing else, it always feels better to hear other people say how ridiculous this is too <sigh> :). Thanks...

15 31

Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours
by Scott Weeks 21 Jul '15

21 Jul '15

--- Valdis.Kletnieks(a)vt.edu wrote: On Mon, 20 Jul 2015 20:18:46 +0100, Colin Johnston said: > in war you take information at face value and use it > if needed to mitigate risk, if there is legit traffic > in blocked ranges then excemption procedure in place to > unblock. :: So how does Joe Aussie-Sixpack notify you that you :: goofed, when you've blocked his IP range? --------------------------------- He doesn't. This is war and us amuricans're gonna make them change their culture to fit our expectations, too. >;-) scott

6 5

Remember "Internet-In-A-Box"?
by Stephen Satchell 21 Jul '15

21 Jul '15

This goes back a number of years. There was a product that literally was a cardboard box that contained everything one needed to get started on the Internet. Just add a modem and a computer, and you were on your way. No fuss, no "learning curve". I'm beginning to think that someone needs to create a similar product, but for IPv6 internet. The Internet service providers would provide the same sort of kit to get people started. Just add a CSU/DSU (like a cable modem) and a computer, and you are on your way. Also, I think we need a *real* book called "IPv6 for Dummies" (maybe even published by IDG Books) that walks through all the beginner stuff. There's beginner stuff that I've seen by using a search engine; a dead-tree book, though, may well be better for Joe Average. Just my pair-o-pennies(tm)

26 35

Re: SEC webpages inaccessible due to Firefox blocking servers with weak DH ciphers
by Alexander Maassen 20 Jul '15

20 Jul '15

(Sorry Michael for the duplicate, forgot to press reply all :P) No problem making the web more secure, but in such cases I think it would have been better if you could set this behaviour per site, same as with 'invalid/self signed certs'. And in some cases, vendors use weak ciphers because they also utilize less resources. Everyone who has a DRAC knows about it's sluggish performance. Another backdraw of the DRAC's is, they are https only, and you cannot turn this behaviour off. Guess for that the only options would be to make your own interface and utilize the telnet/snmp interface. (Which is probably less secure then SSLv3), or some form of SSLv3 <-> strong cipher proxy. And needing to replace hardware that works perfectly fine for the purposes it's intended for just because a browser refuses to connect to it and denies you the option to make exceptions sounds just like the well known error 'Not enough money spend on hardware' On Fri, July 17, 2015 9:14 pm, Michael O Holstein wrote: >>making 99% of the web secure is better than keeping an old 1% working > > A fine idea, unless for $reason your application is among the 1% .. nevermind the arrogance of the "I'm sorry Dave" sort of attitude. > > As an example .. we have a vendor who, in the current release (last 3 months) still requires "weak" ciphers in authentication responses. That was mostly okay until another vendor (with more sense) wanted to auth the same way but only permitted strong ciphers. > > My $0.02 > > Michael Holstein > Cleveland State University

5 4

Re: SIP trunking providers
by Dovid Bender 19 Jul '15

19 Jul '15

Almost every itsp will do that to your traffic regardless of where you see it going. Under 100ms and you won't even notice it. ------Original Message------ From: Mike Hammett Sender: NANOG Cc: nanog(a)nanog.org Subject: Re: SIP trunking providers Sent: Jul 19, 2015 16:04 I too am looking for the Chicago area. Low volume. I'm looking for people whose SIP and RTP hit the end of the road in Chicago. Not interested in someone whose SIP servers are in LA , but will redirect me to the nearest gateway... without telling me where said gateway is. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com ----- Original Message ----- From: "Rafael Possamai" <rafael(a)gav.ufsc.br> To: nanog(a)nanog.org Sent: Friday, June 19, 2015 4:40:48 PM Subject: SIP trunking providers Would anyone in the list be able to recommend a SIP trunk provider in the Chicago area? Not a VoIP expert, so just looking for someone with previous experience. Thanks, Rafael Regards, Dovid

1 0

SEC webpages inaccessible due to Firefox blocking servers with weak DH ciphers
by Matthew Huff 19 Jul '15

19 Jul '15

Just ran into this issue this morning. The SEC requires companies to file EDGAR reports on https://edgarfiling.sec.gov. The newer versions of Firefox won't let you access the webpages without manually going into about:config and re-enabling the weak ciphers. Given the recent issue with the OPM, I would think this would be a very bad follow-up if the SEC got hacked. SSLLabs gives the website an "F". IE 11 won't work either (for other reasons). https://www.ssllabs.com/ssltest/analyze.html?d=edgarfiling.sec.gov The website looks like it was designed in the '90s. I've tried to reach out to their contacts (webmaster, oig, etc...) but haven't gotten a reply yet. It's possible that I might get a reply eventually, but does anyone have any direct contacts at the SEC? ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-694-5669

12 15

Dual stack IPv6 for IPv4 depletion
by Josh Moore 19 Jul '15

19 Jul '15

Traditional dual stack deployments implement both IPv4 and IPv6 to the CPE. Consider the following: An ISP is at 90% IPv4 utilization and would like to deploy dual stack with the purpose of allowing their subscriber base to continue to grow regardless of the depletion of the IPv4 space. Current dual stack best practices seem to recommend deploying BOTH IPv4 and IPv6 to every CPE. If this is the case, and BOTH are still required, then how does IPv6 help with the v4 address depletion crisis? Many sites and services would still need legacy IPv4 compatibility. Sure, CGN technology may be a solution but what about applications that need direct IPv4 connectivity without NAT? It seems that there should be a mechanism to enable on-demand and efficient IPv4 address consumption ONLY when needed. My question is this: What, if any, solutions like this exist? If no solution exists then what is the next best thing? What would the overall IPv6 migration strategy and goal be? Sorry for the length of this email but these are legitimate concerns and while I understand the need for IPv6 and the importance of getting there; I don't understand exactly HOW that can be done considering the immediate issue: IPv4 depletion. Thanks Joshua Moore Network Engineer ATC Broadband 912.632.3161

52 275