April 2016 - Test - lists.nanog.org

Security Track @ NANOG 67 Call for Participation
by John Kristoff 14 Apr '16

14 Apr '16

[ Apologies if you saw this elsewhere already - jtk ] Friends, colleagues, fellow operators, The network security track, formerly known as the ISP security BoF, may be on the agenda at NANOG 67 in Chicago and if we can put together a reasonable agenda I may be your track facilitator. We not only seek your participation, but we are also interested you contributing to the track content. If you have an idea or if you know someone who might like to present, discuss or conduct a demonstration of something, we want to hear from you. Here is an incomplete list of relevant topics to stir your thoughts: * Privacy-related issues and topics * DDoS attacks and mitigation * Internet of Things and security * Government regulatory and compliance issues * IPv6 considerations * abuse@ management and war stories * 802.11 authentication, authorization and accounting * New security software projects and tools (non-commercial) * BGPSEC and RPKI * The latest in protocol abuse * <insert your new cool tool or idea here> John

1 0

FCC Privacy NPRM [was Re: GeoIP database]
by Livingood, Jason 14 Apr '16

14 Apr '16

I have not yet read all of the 147 pages of the FCC Privacy NPRM - https://www.fcc.gov/document/fcc-releases-proposed-rules-protect-broadband- consumer-privacy. But it may be worth noting, especially for this audience, that the FCC proposes considering things like IP addresses and geo-location information to be Customer Proprietary Information. While IANAL it seems that this could perhaps complicate efforts to make GeoIP services more accurate. But who knows. Jason P.S. While these proposed rules would only initially apply to ISPs, from what I understand following adoption there will be a move for so-called parity such that any app or edge provider in the US might have to meet the same standards. On 4/12/16, 8:17 PM, "NANOG on behalf of Jean-Francois Mezei" <nanog-bounces(a)nanog.org on behalf of jfmezei_nanog(a)vaxination.ca> wrote: >All GeoIP services would be forced to document their default lat/long >values so that users know that when these values, they know it is a >generic one for that country. (or supply +181.0000 +91.00000 which is an >invalid value indicating that there is no lat/long, look at country code >given). >

3 2

Re: phone fun, was GeoIP database issues and the real world consequences
by Jonathan Smith 14 Apr '16

14 Apr '16

"If they're land lines, the NPA/NXX will be local to the CO so you won't have out-of-area numbers other than a rare corner case of a very expensive foreign exchange line." This hasn't been a true statement since Local Number Portability. NPA/NXX is nothing more than 'where the number originally was assigned from', and that only for the ones issued BEFORE LNP started; since is anyone's guess. They follow something similiar to what a routed phone call does, but ties into slightly different information that is 'supposed' to associate the end-client address with said LNI that is 'supposed' to be populated with accurate street address information. Similar to what VoIP has had to deal with since, most charge a fee, disclaim any responsibility as to the accuracy of the information that the end user provides. I am sure litigation on/around THAT particular issue is just around the corner. Regards, Jonathan Smith On Wed, Apr 13, 2016 at 11:22 PM, Jay Hennigan <jay(a)west.net> wrote: > On 4/13/16 8:54 PM, Peter Beckman wrote: > >> On Wed, 13 Apr 2016, Jay Hennigan wrote: >> > > When either of those people dial 9-1-1, where does the ambulance show up? >>> >> >> I suspect your response was sarcastic, but when you dig into what really >> happens, it's not nearly as sophisticated as one might hope. >> >> If the numbers are land or VoIP lines, and the address associated with >> the >> numbers are registered with the Automatic Location Information (ALI) >> database run by ILECs or 3rd parties to fetch the address keyed on the >> calling number, and the 911 PSAP is E911 capable, they operator will see >> the ALI address. >> > > If they're land lines, the NPA/NXX will be local to the CO so you won't > have out-of-area numbers other than a rare corner case of a very expensive > foreign exchange line. If they're VoIP lines, the address is *supposed* to > be so registered, but softphones and even VoIP handsets tend to move around > without the user considering 9-1-1. > > VoIP was the scenario to which I was referring. A VoIP phone native to > 408-land that moves with a remote office worker to Boston without a > conscious effort on his company and VoIP provider to track it down and > update ALI will reach a PSAP in San Jose or thereabouts. The PSAPs have > forwarding capability but generally only to neighboring PSAPs with a single > button. How quickly will they be able to get the call routed to Boston, if > at all? And as we saw at the beginning of the thread, forget geo-IP. The > ambulance goes to the Vogelmans' farm. If a remote office worker, it could > be VPN back to the VoIP PBX in 408-land anyway. > > So, it isn't just IP addresses that aren't easily geo-referenced. It's > also phone numbers. The number may start as a well-referenced PRI going to > an IP-PBX after which all bets are off. If the ANI is the company's HQ main > number where the PRI and IP-PBX are located, then it's just about > impossible to route 9-1-1 from a worker's IP phone in Boston to the right > PSAP. > > If they are mobile devices, it depends. Basic gives you nothing (all >> phones >> since 2003 should have GPS, but people hang on to phones a long time..); >> > > Mobile is a separate case where it's expected that the NPA-NXX isn't going > to be tied to a location. In California, mobile 9-1-1 goes to the CHP and > not the local PSAP based on the cell tower or GPS for that reason. If not a > traffic incident, they forward to the appropriate PSAP based on the > caller's info or perhaps whatever ALI (or estimate) they get from the > cellular provider. > > > -- > Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net > Impulse Internet Service - http://www.impulse.net/ > Your local telephone and internet company - 805 884-6323 - WB6RDV >

1 0

CHI-NOG 06 Conference Agenda
by Tom Kacprzynski 13 Apr '16

13 Apr '16

We are pleased to announce that the Chicago Network Operators Group will host their 6th annual meeting (CHI-NOG 06) on May 12th, 2016 in Chicago, IL. Presentation | Speaker 1. CHI-NOG Welcome and Introduction | Tom Kacprzynski 2. BGP Security: An Overview | Russ White 3. IPv6: Passing on Lessons Learned from My Journey | Denise Fishburne 4. EVPN: Or How I Learned to Stop Worrying and Love the BGP | Tom Dwyer and Clay Haynes 5. InterTubes: A Study of the US Long-Haul Fiber-Optic Infrastructure | Rakrishnan Durairajan 6. VXLAN Deployment in IX Fabrics | Hemanth Maturi 7. Regional IXP Introductions and OPEN-IX Overview 8. Source Routing Re-Imagined | Nick Slabakov 9. Segment Routing – Traffic Engineering | Diptanshu Singh 10. DDoS Threat Landscape | Ron Winward 11. Network Automation, A Practical Approach | Matt Griswold 12. Modern Tools for Visualizing Network Traffic | Jon Dugan 13. NetFlow, Flow-Like Data and Their Many Uses | Avi Freedman 14. The Real Metric in Evaluating CDN Performance | Matt Levine 15. Social Event Detailed agenda can be found at http://chinog.org/meetings/chi-nog-06/agenda/ Registration is still open, but ending soon. For more details please see http://chinog.org Thank you.

1 0

Connecting rural providers: ethernet to large city or nearby transit
by Jean-Francois Mezei 13 Apr '16

13 Apr '16

Generic question. Say you have a municipal provider in small town where the municipality won the subsidy over the incumbent to deploy broadband. The easiest is for the town's ISP to buy transit from the incumbent. But incumbent will not be interested in offering competitive pricing. As a sanity check, would a rural ISP come out ahead getting an ethernet link to large city where cheaper transit is available as well as peering to offload a lot of traffic, or would buying transit at higher price locally end up being better ? Is the difference between the two small, or orders of magnitudes cheaper to go one way or the other ? context: in order to provide affordable backhaul to towns, the CRTC *might consider regulation. The Chairman used a key word today "market failure" indicating they are ready to listen to arguments on this.

3 2

Stop IPv6 Google traffic
by Max Tulyev 13 Apr '16

13 Apr '16

Hi All, I need to stop IPv6 web traffic going from our customers to Google without touching all other IPv6 and without blackhole IPv6 Google network (this case my customers are complaining on long timeouts). What can you advice for that?

25 37

Re: Why the US Government has so many data centers
by Scott Weeks 12 Apr '16

12 Apr '16

--- sean(a)donelan.com wrote: From: Sean Donelan <sean(a)donelan.com> https://fcw.com/articles/2016/04/11/lyngaas-halvorsen-update.aspx --------------------------------------------- Wow, this is big news in that article for the companies that deal with selling network devices and computers to the DoD: (Defense Department CIO is Terry Halvorsen) "Halvorsen also briefed reporters on updates to the department's cybersecurity scorecard and its certification process. He said he expects to announce revisions in the coming weeks to DOD's accreditation and certification process for commercial IT products and services. "I think we have reached a point where we no longer can do specific hardware or software accreditation," he said, meaning a piecemeal approach won't keep up with continual updates to, say, cloud offerings. "Our process wouldn't sustain that," he said of certifying cloud offerings that are always being updated. "We need to look at how we do certification and accreditation by process and at some point maybe even by vendor."" scott

1 0

Why the US Government has so many data centers
by Sean Donelan 12 Apr '16

12 Apr '16

If you've wondered why the U.S. Government has so many data centers, ok I know no one has ever asked. The U.S. Government has an odd defintion of what is a data center, which ends up with a lot of things no rational person would call a data center. If you call every room with even one server a "data center," you'll end up with tens of thousands of rooms now data centers. With this defintiion, I probably have two data centers in my home. Its important because Inspectors General auditors will go around and count things, because that's what they do, and write reports about insane numbers of data centers. https://datacenters.cio.gov/optimization/ "For the purposes of this memorandum, rooms with at least one server, providing services (whether in a production, test, stage, development, or any other environment), are considered data centers. However, rooms containing only routing equipment, switches, security devices (such as firewalls), or other telecommunications components shall not be considered data centers."

18 38

Re: Telco Systems
by Raymond Macharia 12 Apr '16

12 Apr '16

Hi, We have used them on our metro for some years now and they have performed well. They do support Mpls. Pricing is very good for what you get. I am currently using the 7124 and I know of another provide who are running exclusively on the telco devices. We have also managed to get them talking to our Cisco aggregation with no issues so far. Raymond Macharia Internet Solutions Kenya On 12 Apr 2016 16:09, "Colton Conor" <colton.conor(a)gmail.com> wrote: Does anyone use Telco Systems Carrier Ethernet & MPLS Aggregation Switches? I have heard good things about them. Overall, the saying is they price 10G ethernet switches at 1G ethernet pricing. It looks like they support MPLS. http://www.telco.com/index.php?page=product-category&category=ethernet-mpls…

1 0

Any ATT.net mail admins here?
by Jeremy Parr 12 Apr '16

12 Apr '16

I have two spam filters that relay outbound mail for a few dozen companies, and as such generate a fair amount of traffic. We are fairly strict with the spam filtering on outbound mail, but somehow end up blacklisted by ATT/Prodigy/Bellsouth a few times a year.

2 1