August 2016 - Test - lists.nanog.org

Can someone from Amazon please answer.
by Mark Andrews 15 Sep '16

15 Sep '16

I'm curious. What are you trying to achieve by blocking EDNS version negotiation? Is it really too hard to return BADVERS to a EDNS query with version != 0 along with the version of EDNS you support in the version field? Are you deliberately trying to prevent the IETF from deciding to bump the EDNS version in the future? Do you have firewalls that have this behaviour hard coded? Do you even test for RFC compliance? Mark lostoncampus.com.au. @205.251.195.156 (ns-924.awsdns-51.net.) dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok,nsid,subnet signed=ok ednstcp=ok lostoncampus.com.au. @205.251.192.78 (ns-78.awsdns-09.com.) dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok,nsid,subnet signed=ok ednstcp=ok lostoncampus.com.au. @205.251.196.198 (ns-1222.awsdns-24.org.) dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok,nsid,subnet signed=ok ednstcp=ok lostoncampus.com.au. @205.251.199.20 (ns-1812.awsdns-34.co.uk.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok,nsid,subnet signed=ok ednstcp=ok -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

5 8

Chinese root CA issues rogue/fake certificates
by Eric Kuhnke 08 Sep '16

08 Sep '16

http://www.percya.com/2016/08/chinese-ca-wosign-faces-revocation.html One of the largest Chinese root certificate authority WoSign issued many fake certificates due to an vulnerability. WoSign's free certificate service allowed its users to get a certificate for the base domain if they were able to prove control of a subdomain. This means that if you can control a subdomain of a major website, say percy.github.io, you're able to obtain a certificate by WoSign for github.io, taking control over the entire domain.

8 16

Root and ARPA DNSSEC operational message -- signature validity period
by Wessels, Duane 06 Sep '16

06 Sep '16

DNSSEC signatures in the Root and ARPA zones are currently given a validity period of 10 days. The validity period is being increased to 13 days, per the recommendations of RSSAC's Report on Root Zone TTLs [1] (aka RSSAC003). Note that we are not aware of any cases where the 10-day signature validity period has caused problems for DNSSEC validators. This is a precautionary measure designed to accommodate a worst-case scenario. This change will be implemented on September 6, 2016. Please feel free to contact us at RZM(a)verisign.com with concerns or questions, and to forward this notice to others who may not have already received it. [1] https://www.icann.org/en/system/files/files/rssac-003-root-zone-ttls-21aug1… DW

1 1

Optical Wave Providers
by tim＠29lagrange.com 02 Sep '16

02 Sep '16

I have been looking at optical wave carriers for some long haul 1G/10G across the US. All to major cities and well known POP's. I am finding that there are not a lot of carriers who are offering wave services, usually just ethernet/MPLS. Particularly across the North west. Can someone shed some light on who some of the bigger carriers are and any challenges you have encountered with services like this? Who actually owns the fiber across the US? Thanks Tim

8 7

Arbor Reports 540Gbps "Sustained" Attack
by Dennis B 01 Sep '16

01 Sep '16

https://www.arbornetworks.com/blog/asert/rio-olympics-take-gold-540gbsec-su… I've used SP Peakflow before and I have my opinions. With all the intelligence out there about DDoS attacks, DDoS attackers, DDoS tools and techniques this article leaves me with ton's of questions. IE: What industry was the attack target? Was it a single customer or multiple customers at the same time? What was the attack vector? Was it multi-vector? What was the duration of the 540Gbps attack? Did you actually block the attack or did you just report on it from your cloud signaling alliance aka cloud offering? Could you help explain if the peak of the attack lasted X minutes, Y hours, Z days? What was the attack targeted protocol? Was it TCP against TCP or UDP against UDP or UDP against TCP? I have to be honest, IDK if Arbor is attempting to claim the largest recorded DDoS attack in the world cup of DDoS attacks but the fact that your a local appliance shop. Selling to the global 100 and T1-3 ISPs - I'd hope for more than a marketing ploy to take the top attack vector. Thought I'd ask Nanog if they heard any whispers about this "white buffalo", which ISPs were Transiting the event, what course of actions were taken. Thanks!

2 1

Don't press the big red buttom on the wall!
by Sean Donelan 01 Sep '16

01 Sep '16

See that big red button on the wall under the sign "Do Not Push This Button!".... DC 911 outage caused by contractor error http://wtop.com/dc/2016/08/dc-911-outage-caused-by-contractor-who-pulled-wr… WASHINGTON — D.C. is now operating two separate 911 centers after a power outage caused by human error left the nation’s capital without any emergency phone service for almost an hour on a busy weekend night. A contractor working Saturday night inadvertently pulled an emergency power shut off switch that cut electricity to the 911 phone system and a call routing system at the District’s Unified Communications Center, said the center’s Director Karima Holmes. “Unfortunately because it was human error we weren’t prepared for it,” Holmes said. [...]

11 16

IPv4 Broker
by Lorenzo Mainardi 01 Sep '16

01 Sep '16

Do you know any good IPv4 broker? I need a /20. Regards

7 7

routing at IXPs privacy survey
by Marco Chiesa 31 Aug '16

31 Aug '16

Hi all, as part of our academic effort to devise more powerful routing services at Internet eXchange Points (IXPs), we aim to understand the privacy considerations of network operators in the context of peering with other networks, in general, and at IXPs in particular. We created a short survey for gathering some real-world operational information and we need help from you - network operators - to fill it. The survey will take less than 5 minutes. Link to the survey: http://goo.gl/1e7cDG The survey is fully anonymized (unless you explicitly choose to reveal your identity) and the resulting data analysis will only be presented via aggregate statistics and in an anonymized format. We look forward to receiving your responses! You can find more information, including a short paper about our current research work, on our website: http://six-pack.bitbucket.org/ Thanks for your help, Marco Chiesa (UC Louvain), Marco Canini (UC Louvain), Daniel Demmler (TU Darmstadt), Michael Schapira (Hebrew University of Jerusalem) & Thomas Schneider (TU Darmstadt)

1 0

Need abuse/postmaster contact for AT&T to resolve IP block
by Webhosting.net Admin 31 Aug '16

31 Aug '16

A few of our exchange IPs get blocked intermittently, but only by ATT. Ips are clean, no issues, we’re diligent about finding and fixing these types of issues as it has a large impact. It would be very helpful to know why the IP below got blocked so we can find and fix the problem to prevent further listing. We have a few ips in rotation and some have no issue. It’s a “blind” listing, so we only find out about it when customers complain that they getting blocked. ff-ip4-mx-vip1.prodigy.net #<ff-ip4-mx-vip1.prodigy.net #5.3.0 smtp; 553 5.3.0 flph399 DNSBL:ATTRBL 521< 67.215.167.170 >_is_blocked.__For_information_see_http://att.net/blocks> #SMTP# Any info/help would be most helpful. Many thanks, Webhosting.net Postmaster

4 3

Cloudflare reverse DNS SERVFAIL, normal?
by Jeremy 31 Aug '16

31 Aug '16

We're seeing a huge uptick in reverse dns lookup failures across an app, 99% are all for Cloudflare ip addresses. Instead of seeing a PTR or NXDOMAIN we're getting back SERVFAIL. Does anyone know if this is a standard response from them? Do they not have reverse DNS setup for their networks? Trying to narrow this down to see if it's a result in a change in how our application handles these errors or if there's an issue going on with cloudflare's DNS setup. Thanks! Jeremy

8 13