September 2015 - Test - lists.nanog.org

Important - Register for NANOG 65 _by 1 October_ to Vote in the NRO NC Election
by John Curran 28 Sep '15

28 Sep '15

NANOGers - Meeting attendees who register for NANOG 65 by 1 October will be eligible to vote online in the Number Resource Organization Number Council (NRO NC) election for the ARIN region. If you are also an ARIN eligible voting contact, please note that you will vote in this same election beginning 8 October when voting opens for the ARIN Board and ARIN Advisory Council elections. The 2015 candidates for the one open seat are: - Louie Lee, Equinix - Timothy McGinnis, Unaffiliated You can view candidate questionnaires and see/make statements of support at: https://www.bigpulse.com/p35820/ You can learn more about the role of the NRO NC at: https://www.arin.net/about_us/nronc.html Note that all eligible NANOG 65 registered attendees will receive an email at 10:00 AM ET on Monday 5 October with instructions on how to cast your ballot. The election closes at 3:00 PM EDT Friday 16 October and results will be announced the following week. Please visit the ARIN Elections Helpdesk onsite in Montreal if you have issues voting or contact us via email at: info(a)arin.net. Thank you for participating! /John John Curran President and CEO American Registry for Internet Numbers (ARIN)

1 0

Recent trouble with QUIC?
by Sean Hunter 28 Sep '15

28 Sep '15

Hi all, I work for a 2500 user university and we've seen some odd behavior recently. 2-4 weeks ago we started seeing Google searches that would fail for ~2 minutes, or disconnects in Gmail briefly. This week, and particularly in the last 2-3 days, we've had reports from numerous users on campus, even those who generally do not complain unless an issue has been ongoing for a while. Those reports include Drive disconnecting, searches failing, Gmail presenting a "007" error, and calendar failing to create events. In fact, the issue became so widespread today, that the campus paper is writing about it as a last minute article before they're weekly publication's deadline this evening. (Important in our little world where we try to look good.) We aren't really staffed or equipped to figure out exactly what's happening (and issues are sporadic, so packet captures are difficult, to say the least), but we found that disabling QUIC dramatically and immediately improved the experience of a couple of users on campus. We're recommending via the paper that others do so as well. What I'm curious about is: a) Has anyone here had a similar experience? Was the root cause QUIC in your case? b) Has anyone noticed anything remotely similar in the last few weeks/days/today? We're an Apps domain, so this may be specific to universities in the Apps universe. If anyone has any useful information or hints, or if someone from Google would like more information, please feel free to contact me, on or off list. Thanks for reading and have a great night everyone! Happy Wednesday!

14 18

CHP website returning 503
by Grant Ridder 28 Sep '15

28 Sep '15

Hey, If anyone from CHP (california highway patrol) is listening, your website is returning a 503. curl -v https://www.chp.ca.gov * Rebuilt URL to: https://www.chp.ca.gov/ * Hostname was NOT found in DNS cache * Trying 168.145.114.48... * Connected to www.chp.ca.gov (168.145.114.48) port 443 (#0) * TLS 1.2 connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA * Server certificate: *.chp.ca.gov * Server certificate: Entrust Certification Authority - L1K * Server certificate: Entrust Root Certification Authority - G2 > GET / HTTP/1.1 > User-Agent: curl/7.37.1 > Host: www.chp.ca.gov > Accept: */* > < HTTP/1.1 503 Service Unavailable < Content-Type: text/html; charset=us-ascii < Date: Mon, 28 Sep 2015 02:48:23 GMT < X-Cnection: close < Content-Length: 326 < <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"" http://www.w3.org/TR/html4/strict.dtd"> <HTML><HEAD><TITLE>Service Unavailable</TITLE> <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD> <BODY><h2>Service Unavailable</h2> <hr><p>HTTP Error 503. The service is unavailable.</p> </BODY></HTML> * Connection #0 to host www.chp.ca.gov left intact -Grant

9 12

Fwd: Byte Night Manchester - Action for Children - donation help needed please :)
by Colin Johnston 28 Sep '15

28 Sep '15

Hopefully IT folks will donate to this great cause, hopefully folks will allow this posting :) > Dear all, > As my regular yearly charity participation event please support below > Byte Night Manchester - BT Manchester folks – Colin team of one. > > On Friday night next, 2nd Oct 2015 from 7pm to 6am next morning, I (Colin Johnston) am participating in > Action for Children Byte Night Manchester. > As we have been asked to dress up for nice social media pictures I decided that being dressed as a Sylvester Cat > would be good fun. > I have managed to get http://celebrationpartyshoponline.co.uk/stores <http://celebrationpartyshoponline.co.uk/stores> to give me a discount on the costume hire as well. > The Byte Night for Manchester is being held at Granada Studios in Manchester on the street of Coronation Street. > > We(Byte Night participants) are sleeping on the street in sleeping bags and foil survival bag. > > Please donate to this great cause, either by donation bucket in BT Bolton AMTE (Sylvester will be in Bolton on Thursday/Friday) or > BT Dial House Manchester (Sylvester will make a visit on Friday), > or via internet https://www.justgiving.com/bt-bt-manchester-folks/4w350m3/donate#MessageAnd… <https://www.justgiving.com/bt-bt-manchester-folks/4w350m3/donate#MessageAnd…> > > Please email me colin.johnstone(a)bt.com <mailto:colin.johnstone@bt.com> if donation made so I can keep track of donators list. > I want to transfer the total raised to Action for Children by middle of Oct so please give money via above either this week coming or next. > I will email folks with acknowledgement of final donation amount once received, would be great to get 500 pounds ++.. > > Pictures will be sent after the event for BT Today and all on this email to listJ > > Please give generously if you can afford it, pay day on Wednesday J > > Please distribute widely if you think others not mentioned would be willing to donate JJ > > Yours > > Colin Johnston

1 0

Re: Question re session hijacking in dual stack environments w/MacOS
by Dovid Bender 27 Sep '15

27 Sep '15

What about users on cgnat? I know isp's in the far east that only offer cgnat and it's pot lock how you go out. ------Original Message------ From: Michael Brown Sender: NANOG To: Brandon Butterworth To: nanog(a)nanog.org To: dhubbard(a)dino.hostasaurus.com Subject: Re: Question re session hijacking in dual stack environments w/MacOS Sent: Sep 26, 2015 23:19 ‎> Those site eventually learnt after much feedback not to assume on IPv4 address continuity. I could envision that those checks might now be relaxed‎ to checking for address continuity in the same /24 for instance. But when you're seeing the same session being used from two wildly different places (in this case, IPv4 and IPv6) at the SAME TIME, that does seem rather suspicious in the absence of other information. M. Regards, Dovid

4 3

Re: ARIN Region IPv4 Free Pool Reaches Zero
by Connor Wilkins 27 Sep '15

27 Sep '15

On 2015-09-26 22:56, Seth Mattinen wrote: > What's worked for me is not signing or renewing or buying things that > lack IPv6 support. While you're demanding better technology you may also want to include things like crypto in there. I've gotten proposals for things that support IPv6 but only work with SSLv2/SSLv3 with a weak cipher and with MD5 or SHA1 only. I've even had ones that didn't implement certificate verification at all or say they did but then it turned out not to work at all. Disgusting and unacceptable. (But they did support IPv6!) -- “Simply stated, we have a new formula for Coke.” --- Roberto C. Goizueta, Company Chairman, Coca-Cola

1 0

Re: Recent trouble with QUIC?
by Dovid Bender 27 Sep '15

27 Sep '15

I forgot who it was but I think it was a uni network. As an isp everything should be allowed as an end network you want to cya. Much like the hospital I was just at that had free wifi. Only ports 80 and 443 over tcp were allowed. That's when having ssh on 443 so you can proxy for alt ports really helps. ------Original Message------ From: James Bensley Sender: NANOG To: NANOG Operators' Group Subject: Re: Recent trouble with QUIC? Sent: Sep 26, 2015 10:54 On 26 September 2015 at 08:20, Mike Hale <eyeronic.design(a)gmail.com> wrote: > OH SNAP! Tiny Rick!!! Regards, Dovid

2 1

Re: Ear protection
by Dovid Bender 26 Sep '15

26 Sep '15

No but some one in Australia just bought the iPhone 6s via a robot. ------Original Message------ From: Alan Buxey Sender: NANOG To: Nick Hilliard To: nanog(a)nanog.org Subject: Re: Ear protection Sent: Sep 26, 2015 04:21 Great summary of the thread No-one using remote control robots with video feed etc for working in these environments then? Plans to? ;) alan Regards, Dovid

1 0

Re: Question re session hijacking in dual stack environments w/MacOS
by Brandon Butterworth 26 Sep '15

26 Sep '15

> From: David Hubbard <dhubbard(a)dino.hostasaurus.com> > Websites that require some type of authentication that is handled via > session cookies have been booting our users out randomly with "your ip > address has changed" type message. This occurs when their Mac decides > to switch between protocols because the site views it as a session > hijacking attempt when Joe User with session ID xyz switches from > 192.0.2.10 to 2001:db8::1:1:a or vice versa. > > Has anyone run into this? It's 1997 again? This used to be a common IPv4 problem for us as users exited through a cluster of squid caches which could result in a different address per request. Those site eventually learnt after much feedback not to assume on IPv4 address continuity. brandon

2 1

ARIN Region IPv4 Free Pool Reaches Zero
by John Curran 26 Sep '15

26 Sep '15

(Apologies for redistribution, but need to insure that this is seen by all in the region.) The IPv4 free pool for the ARIN region is now depleted; ISPs are encouraged to utilize IPv6 for additional customer growth and the IPv4 transfer market for their IPv4 interim needs. Thanks! /John John Curran President and CEO ARIN Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] ARIN IPv4 Free Pool Reaches Zero Date: September 24, 2015 at 12:04:22 PM EDT To: <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> On 24 September 2015, ARIN issued the final IPv4 addresses in its free pool. ARIN will continue to process and approve requests for IPv4 address blocks. Those approved requests may be fulfilled via the Wait List for Unmet IPv4 Requests, or through the IPv4 Transfer Market. For information on the Waiting List, visit: https://www.arin.net/resources/request/waiting_list.html For information on IPv4 Transfers, visit: https://www.arin.net/resources/transfers/index.html Exhaustion of the ARIN Free Pool does trigger changes in ARIN's Specified Transfer policy (NRPM 8.3) and Inter-RIR Transfer policy (NRPM 8.4). In both cases, these changes impact organizations that have been the source entity in a specified transfer within the last twelve months: "The source entity (-ies within the ARIN Region (8.4)) will be ineligible to receive any further IPv4 address allocations or assignments from ARIN for a period of 12 months after a transfer approval, or until the exhaustion of ARIN's IPv4 space, whichever occurs first." Effective today, because exhaustion of the ARIN IPv4 free pool has occurred for the first time, there is no longer a restriction on how often organizations may request transfers to specified recipients. In the future, any IPv4 address space that ARIN receives from IANA, or recovers from revocations or returns from organizations, will be used to satisfy approved requests on the Waiting List for Unmet Requests. If we are able to fully satisfy all of the requests on the waiting list, any remaining IPv4 addresses would be placed into the ARIN free pool of IPv4 addresses to satisfy future requests. ARIN encourages customers with questions about IPv4 availability to contact hostmaster(a)arin.net or the Registration Services Help Desk at +1.703.227.0660. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) _______________________________________________ ARIN-Announce You are receiving this message because you are subscribed to the ARIN Announce Mailing List (ARIN-announce(a)arin.net) Unsubscribe or manage your mailing list subscription at: http://lists.arin.net/mailman/listinfo/arin-announce Please contact info(a)arin.net if you experience any issues.

26 35