September 2015 - Test - lists.nanog.org

Re: Question re session hijacking in dual stack environments w/MacOS
by John Schimmel 29 Sep '15

29 Sep '15

I can¹t speak to every case, but I ran into a similar issue with our WAF product, so I can explain what was happening there. Most Web application firewalls have cross-site request forgery protection. When a form is downloaded, the firewall inserts a hidden field or cookie that contains the IP address of the request. When the form is submitted, the firewall then verifies that the post is sent from the same address. If the client does a get via IPv6, and the form contains a form action for a URL that is better reached via IPv4 then the firewall sees the post coming from a different IP address and refuses the request. This is nothing specifically to do with MacOS, it is true of any multi-homed system. The options are either to rewrite the client to guarantee that the address in a post always matches the corresponding get; to maintain different URLs on the server such that requests from IPv6 clients always return action URLs that will go to an IPv6 hostname, and vice-versa for IPv4; or to disable CSRF protection. Later, John > From: David Hubbard <dhubbard(a)dino.hostasaurus.com> > > Hey all, as we've slowly deployed IPv6 to our end users, it has begun to > cause some issues for those on Mac's specifically. Apple apparently has > an algorithm at some point in the network stack to decide whether IPv4 > or IPv6 is, perhaps, 'better' or 'faster' at any given point in time > during an ongoing session. This allows a computer talking to a dual > stack remote website to flip flop between v4 and v6 as activity is > conducted. > > Websites that require some type of authentication that is handled via > session cookies have been booting our users out randomly with "your ip > address has changed" type message. This occurs when their Mac decides > to switch between protocols because the site views it as a session > hijacking attempt when Joe User with session ID xyz switches from > 192.0.2.10 to 2001:db8::1:1:a or vice versa. > > Has anyone run into this? Our users on other platforms don't seem to > have this issue; linux and MS desktops seem to just use v6 if it's > available and v4 if not. > > Thanks, > > David

2 1

Facebook invisible in Italy
by Marco Paesani 28 Sep '15

28 Sep '15

Hi, some issues from FB network ?? Do you have some info ? Regards, -- Marco Paesani MPAE Srl Skype: mpaesani Mobile: +39 348 6019349 Success depends on the right choice ! Email: marco(a)paesani.it

13 12

Important - Register for NANOG 65 _by 1 October_ to Vote in the NRO NC Election
by John Curran 28 Sep '15

28 Sep '15

NANOGers - Meeting attendees who register for NANOG 65 by 1 October will be eligible to vote online in the Number Resource Organization Number Council (NRO NC) election for the ARIN region. If you are also an ARIN eligible voting contact, please note that you will vote in this same election beginning 8 October when voting opens for the ARIN Board and ARIN Advisory Council elections. The 2015 candidates for the one open seat are: - Louie Lee, Equinix - Timothy McGinnis, Unaffiliated You can view candidate questionnaires and see/make statements of support at: https://www.bigpulse.com/p35820/ You can learn more about the role of the NRO NC at: https://www.arin.net/about_us/nronc.html Note that all eligible NANOG 65 registered attendees will receive an email at 10:00 AM ET on Monday 5 October with instructions on how to cast your ballot. The election closes at 3:00 PM EDT Friday 16 October and results will be announced the following week. Please visit the ARIN Elections Helpdesk onsite in Montreal if you have issues voting or contact us via email at: info(a)arin.net. Thank you for participating! /John John Curran President and CEO American Registry for Internet Numbers (ARIN)

1 0

Recent trouble with QUIC?
by Sean Hunter 28 Sep '15

28 Sep '15

Hi all, I work for a 2500 user university and we've seen some odd behavior recently. 2-4 weeks ago we started seeing Google searches that would fail for ~2 minutes, or disconnects in Gmail briefly. This week, and particularly in the last 2-3 days, we've had reports from numerous users on campus, even those who generally do not complain unless an issue has been ongoing for a while. Those reports include Drive disconnecting, searches failing, Gmail presenting a "007" error, and calendar failing to create events. In fact, the issue became so widespread today, that the campus paper is writing about it as a last minute article before they're weekly publication's deadline this evening. (Important in our little world where we try to look good.) We aren't really staffed or equipped to figure out exactly what's happening (and issues are sporadic, so packet captures are difficult, to say the least), but we found that disabling QUIC dramatically and immediately improved the experience of a couple of users on campus. We're recommending via the paper that others do so as well. What I'm curious about is: a) Has anyone here had a similar experience? Was the root cause QUIC in your case? b) Has anyone noticed anything remotely similar in the last few weeks/days/today? We're an Apps domain, so this may be specific to universities in the Apps universe. If anyone has any useful information or hints, or if someone from Google would like more information, please feel free to contact me, on or off list. Thanks for reading and have a great night everyone! Happy Wednesday!

14 18

CHP website returning 503
by Grant Ridder 28 Sep '15

28 Sep '15

Hey, If anyone from CHP (california highway patrol) is listening, your website is returning a 503. curl -v https://www.chp.ca.gov * Rebuilt URL to: https://www.chp.ca.gov/ * Hostname was NOT found in DNS cache * Trying 168.145.114.48... * Connected to www.chp.ca.gov (168.145.114.48) port 443 (#0) * TLS 1.2 connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA * Server certificate: *.chp.ca.gov * Server certificate: Entrust Certification Authority - L1K * Server certificate: Entrust Root Certification Authority - G2 > GET / HTTP/1.1 > User-Agent: curl/7.37.1 > Host: www.chp.ca.gov > Accept: */* > < HTTP/1.1 503 Service Unavailable < Content-Type: text/html; charset=us-ascii < Date: Mon, 28 Sep 2015 02:48:23 GMT < X-Cnection: close < Content-Length: 326 < <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"" http://www.w3.org/TR/html4/strict.dtd"> <HTML><HEAD><TITLE>Service Unavailable</TITLE> <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD> <BODY><h2>Service Unavailable</h2> <hr><p>HTTP Error 503. The service is unavailable.</p> </BODY></HTML> * Connection #0 to host www.chp.ca.gov left intact -Grant

9 12

Fwd: Byte Night Manchester - Action for Children - donation help needed please :)
by Colin Johnston 28 Sep '15

28 Sep '15

Hopefully IT folks will donate to this great cause, hopefully folks will allow this posting :) > Dear all, > As my regular yearly charity participation event please support below > Byte Night Manchester - BT Manchester folks – Colin team of one. > > On Friday night next, 2nd Oct 2015 from 7pm to 6am next morning, I (Colin Johnston) am participating in > Action for Children Byte Night Manchester. > As we have been asked to dress up for nice social media pictures I decided that being dressed as a Sylvester Cat > would be good fun. > I have managed to get http://celebrationpartyshoponline.co.uk/stores <http://celebrationpartyshoponline.co.uk/stores> to give me a discount on the costume hire as well. > The Byte Night for Manchester is being held at Granada Studios in Manchester on the street of Coronation Street. > > We(Byte Night participants) are sleeping on the street in sleeping bags and foil survival bag. > > Please donate to this great cause, either by donation bucket in BT Bolton AMTE (Sylvester will be in Bolton on Thursday/Friday) or > BT Dial House Manchester (Sylvester will make a visit on Friday), > or via internet https://www.justgiving.com/bt-bt-manchester-folks/4w350m3/donate#MessageAnd… <https://www.justgiving.com/bt-bt-manchester-folks/4w350m3/donate#MessageAnd…> > > Please email me colin.johnstone(a)bt.com <mailto:colin.johnstone@bt.com> if donation made so I can keep track of donators list. > I want to transfer the total raised to Action for Children by middle of Oct so please give money via above either this week coming or next. > I will email folks with acknowledgement of final donation amount once received, would be great to get 500 pounds ++.. > > Pictures will be sent after the event for BT Today and all on this email to listJ > > Please give generously if you can afford it, pay day on Wednesday J > > Please distribute widely if you think others not mentioned would be willing to donate JJ > > Yours > > Colin Johnston

1 0

Re: Question re session hijacking in dual stack environments w/MacOS
by Dovid Bender 27 Sep '15

27 Sep '15

What about users on cgnat? I know isp's in the far east that only offer cgnat and it's pot lock how you go out. ------Original Message------ From: Michael Brown Sender: NANOG To: Brandon Butterworth To: nanog(a)nanog.org To: dhubbard(a)dino.hostasaurus.com Subject: Re: Question re session hijacking in dual stack environments w/MacOS Sent: Sep 26, 2015 23:19 ‎> Those site eventually learnt after much feedback not to assume on IPv4 address continuity. I could envision that those checks might now be relaxed‎ to checking for address continuity in the same /24 for instance. But when you're seeing the same session being used from two wildly different places (in this case, IPv4 and IPv6) at the SAME TIME, that does seem rather suspicious in the absence of other information. M. Regards, Dovid

4 3

Re: ARIN Region IPv4 Free Pool Reaches Zero
by Connor Wilkins 27 Sep '15

27 Sep '15

On 2015-09-26 22:56, Seth Mattinen wrote: > What's worked for me is not signing or renewing or buying things that > lack IPv6 support. While you're demanding better technology you may also want to include things like crypto in there. I've gotten proposals for things that support IPv6 but only work with SSLv2/SSLv3 with a weak cipher and with MD5 or SHA1 only. I've even had ones that didn't implement certificate verification at all or say they did but then it turned out not to work at all. Disgusting and unacceptable. (But they did support IPv6!) -- “Simply stated, we have a new formula for Coke.” --- Roberto C. Goizueta, Company Chairman, Coca-Cola

1 0

Re: Recent trouble with QUIC?
by Dovid Bender 27 Sep '15

27 Sep '15

I forgot who it was but I think it was a uni network. As an isp everything should be allowed as an end network you want to cya. Much like the hospital I was just at that had free wifi. Only ports 80 and 443 over tcp were allowed. That's when having ssh on 443 so you can proxy for alt ports really helps. ------Original Message------ From: James Bensley Sender: NANOG To: NANOG Operators' Group Subject: Re: Recent trouble with QUIC? Sent: Sep 26, 2015 10:54 On 26 September 2015 at 08:20, Mike Hale <eyeronic.design(a)gmail.com> wrote: > OH SNAP! Tiny Rick!!! Regards, Dovid

2 1

Re: Ear protection
by Dovid Bender 27 Sep '15

27 Sep '15

No but some one in Australia just bought the iPhone 6s via a robot. ------Original Message------ From: Alan Buxey Sender: NANOG To: Nick Hilliard To: nanog(a)nanog.org Subject: Re: Ear protection Sent: Sep 26, 2015 04:21 Great summary of the thread No-one using remote control robots with video feed etc for working in these environments then? Plans to? ;) alan Regards, Dovid

1 0