July 2015 - Test - lists.nanog.org

Help with GMail...
by Grant Taylor 23 Jul '15

23 Jul '15

Hi, I was wondering if there were any GMail contacts on NANOG that might contact me either on or off list for some help. I am having problems sending email to GMail from my new (< 2 weeks old) Linode VPS. tncsrv06.tnetconsulting.net (IPv4: 45.33.28.24, IPv6: 2600:3c00:f03c:91ff:fe26:8849) I have forward and reverse DNS set up as well as following all of the same practices that I have used to administer email servers for the past 15 years. So, I think that I have everything covered. (If I've missed something, let me know and I'll take care of it.) Is there a chance that my IP address(es) (v4 and / or v6) have been blocked because of previous IP user actions? Or am I by chance part of a netblock that is black listed? Below is the multi-line SMTP response that is showing up in the DSN that I'm receiving. <<< 550-5.7.1 [2600:3c00::f03c:91ff:fe26:8849 12] Our system has detected that <<< 550-5.7.1 this message is likely unsolicited mail. To reduce the amount of spam <<< 550-5.7.1 sent to Gmail, this message has been blocked. Please visit <<< 550 5.7.1 https://support.google.com/mail/answer/188131 for more information. f5si4126138oeo.56 - gsmtp Any help or suggestions you could provide would be greatly appreciated. I'm in the process of migrating off of my old server to my new Linode VPS as part of a move and would like to get this quickly, if possible. As a temporary work around, I have routed gmail.com email to my other Linode which can send email to GMail. tncsrv05.tnetconsulting.net (IPv4: 109.74.192.125, IPv6: 2a01:7e00::f03c:91ff:fe89:2935) Thanks for your time and any help you can provide. -- Grant. . . . unix || die P.S. I did send an email to postmaster(a)gmail.com, but it bounced saying that the address had been disabled. > <postmaster(a)gmail.com> > (reason: 550 5.2.1 The email account that you tried to reach is > disabled. n5si4180778oib.56 - gsmtp)

3 5

OCP Data Center Spec: Ladder Tray
by Martin Hannigan 23 Jul '15

23 Jul '15

Hi NANOG, The Open Compute Project "OCP" had, at least that I can recall but now can not find, a ladder tray deployment spec in the data center working group. It called for tray to span the middle of the aisle as I remember it. Anyone recall or have a pointer to it? My favorite search engine and the OCP wiki yields nothing. I was also hoping to find someone involved in the spec to discuss a related NFPA issue with. Best, -M<

1 0

20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours
by Drew Weaver 23 Jul '15

23 Jul '15

Has anyone else seen a massive amount of illegitimate UDP 1720 traffic coming from China being sent towards IP addresses which provide VoIP services? I'm talking in the 20-30Gbps range? The first incident was yesterday at around 13:00 EST, the second incident was today at 09:00 EST. I'm assuming this is just another DDoS like all others, but I would be interested to hear if I am not the only one seeing this. On list or off-list is fine. Thanks, -Drew

21 42

Gmail contact?
by Marco Davids 23 Jul '15

23 Jul '15

Hi, Is there anyone on this list that can get me in touch with someone at Google/Gmail? I would like to discuss a suggested improvement with them in regard to RFC-compliance of DKIM/DMARC. Please contact me off-list. Thanks. -- Marco

1 0

another tilt at the Verizon FIOS IPv6 windmill
by Paul B. Henson 22 Jul '15

22 Jul '15

I think it's been about a year and a half since I last looked (and cried) at the status of FIOS IPv6. As far as I can tell, there's been no new official news since 2013. We're deploying IPv6 at the university I work at, so IPv6 at home is moving from "wish I had it to play with" towards "need to have it to work from home". So it seems I either cancel my fios and go with business class cable (I live in Time Warner territory and it looks like they're good to go with IPv6) or set up a tunnel with HE. Or pray Google fiber comes to my neck of the woods. Any new rumors floating around? Any Verizon employees interested in posting anonymously and explaining what on earth is going on inside the company? Any secret phone numbers to call to get in on an alpha/beta test in the So Cal area ;)? If nothing else, it always feels better to hear other people say how ridiculous this is too <sigh> :). Thanks...

15 31

Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours
by Scott Weeks 21 Jul '15

21 Jul '15

--- Valdis.Kletnieks(a)vt.edu wrote: On Mon, 20 Jul 2015 20:18:46 +0100, Colin Johnston said: > in war you take information at face value and use it > if needed to mitigate risk, if there is legit traffic > in blocked ranges then excemption procedure in place to > unblock. :: So how does Joe Aussie-Sixpack notify you that you :: goofed, when you've blocked his IP range? --------------------------------- He doesn't. This is war and us amuricans're gonna make them change their culture to fit our expectations, too. >;-) scott

6 5

Remember "Internet-In-A-Box"?
by Stephen Satchell 21 Jul '15

21 Jul '15

This goes back a number of years. There was a product that literally was a cardboard box that contained everything one needed to get started on the Internet. Just add a modem and a computer, and you were on your way. No fuss, no "learning curve". I'm beginning to think that someone needs to create a similar product, but for IPv6 internet. The Internet service providers would provide the same sort of kit to get people started. Just add a CSU/DSU (like a cable modem) and a computer, and you are on your way. Also, I think we need a *real* book called "IPv6 for Dummies" (maybe even published by IDG Books) that walks through all the beginner stuff. There's beginner stuff that I've seen by using a search engine; a dead-tree book, though, may well be better for Joe Average. Just my pair-o-pennies(tm)

26 35

Re: SEC webpages inaccessible due to Firefox blocking servers with weak DH ciphers
by Alexander Maassen 20 Jul '15

20 Jul '15

(Sorry Michael for the duplicate, forgot to press reply all :P) No problem making the web more secure, but in such cases I think it would have been better if you could set this behaviour per site, same as with 'invalid/self signed certs'. And in some cases, vendors use weak ciphers because they also utilize less resources. Everyone who has a DRAC knows about it's sluggish performance. Another backdraw of the DRAC's is, they are https only, and you cannot turn this behaviour off. Guess for that the only options would be to make your own interface and utilize the telnet/snmp interface. (Which is probably less secure then SSLv3), or some form of SSLv3 <-> strong cipher proxy. And needing to replace hardware that works perfectly fine for the purposes it's intended for just because a browser refuses to connect to it and denies you the option to make exceptions sounds just like the well known error 'Not enough money spend on hardware' On Fri, July 17, 2015 9:14 pm, Michael O Holstein wrote: >>making 99% of the web secure is better than keeping an old 1% working > > A fine idea, unless for $reason your application is among the 1% .. nevermind the arrogance of the "I'm sorry Dave" sort of attitude. > > As an example .. we have a vendor who, in the current release (last 3 months) still requires "weak" ciphers in authentication responses. That was mostly okay until another vendor (with more sense) wanted to auth the same way but only permitted strong ciphers. > > My $0.02 > > Michael Holstein > Cleveland State University

5 4

Re: SIP trunking providers
by Dovid Bender 19 Jul '15

19 Jul '15

Almost every itsp will do that to your traffic regardless of where you see it going. Under 100ms and you won't even notice it. ------Original Message------ From: Mike Hammett Sender: NANOG Cc: nanog(a)nanog.org Subject: Re: SIP trunking providers Sent: Jul 19, 2015 16:04 I too am looking for the Chicago area. Low volume. I'm looking for people whose SIP and RTP hit the end of the road in Chicago. Not interested in someone whose SIP servers are in LA , but will redirect me to the nearest gateway... without telling me where said gateway is. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com ----- Original Message ----- From: "Rafael Possamai" <rafael(a)gav.ufsc.br> To: nanog(a)nanog.org Sent: Friday, June 19, 2015 4:40:48 PM Subject: SIP trunking providers Would anyone in the list be able to recommend a SIP trunk provider in the Chicago area? Not a VoIP expert, so just looking for someone with previous experience. Thanks, Rafael Regards, Dovid

1 0

SEC webpages inaccessible due to Firefox blocking servers with weak DH ciphers
by Matthew Huff 19 Jul '15

19 Jul '15

Just ran into this issue this morning. The SEC requires companies to file EDGAR reports on https://edgarfiling.sec.gov. The newer versions of Firefox won't let you access the webpages without manually going into about:config and re-enabling the weak ciphers. Given the recent issue with the OPM, I would think this would be a very bad follow-up if the SEC got hacked. SSLLabs gives the website an "F". IE 11 won't work either (for other reasons). https://www.ssllabs.com/ssltest/analyze.html?d=edgarfiling.sec.gov The website looks like it was designed in the '90s. I've tried to reach out to their contacts (webmaster, oig, etc...) but haven't gotten a reply yet. It's possible that I might get a reply eventually, but does anyone have any direct contacts at the SEC? ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-694-5669

12 15