September 2016 - Test - lists.nanog.org

The state-level attack on the SSL CA security model
by Martin Millnert 20 Nov '25

20 Nov '25

To my surprise, I did not see a mention in this community of the latest proof of the complete failure of the SSL CA model to actually do what it is supposed to: provide security, rather than a false sense of security. Essentially a state somewhere between Iraq and Pakistan snatched valid certs for: - mail.google.com - www.google.com - login.yahoo.com - login.skype.com - addons.mozilla.org - login.live.com - "global trustee" https://blog.torproject.org/blog/detecting-certificate-authority-compromise… http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html http://www.imperialviolet.org/2011/03/18/revocation.html (on epic failure of cert revocation lists implementations in browsers, failing open (!)) http://blog.mozilla.com/security/2011/03/22/firefox-blocking-fraudulent-cer… http://www.microsoft.com/technet/security/advisory/2524375.mspx For over a week users of browsers, and the internet at large, were/was not informed by COMODO that their security was compromised. "Why not" is beyond many of us. Announcing this high and loud even before fixes were available would not have exposed more users to threats, but less. Conclusion: protecting people must not be a priority in the SSL CA model. In some places, failure of internet security means people die, and it is high time to start serious work to replace this time-and-time again proven flawed model with something that, at the very least, does not fail this tragically. DNSSEC is a good but insufficient start in this particular case. Regards, Martin

28 39

Re: NANOG NYC Event
by Fisher, Shawn 30 Jul '25

30 Jul '25

Personally I like dinosaur bbq, great malt beverages as well, and also blue smoke is great and if you like jazz, check out downstairs. -------------------------- Sent using BlackBerry -----Original Message----- From: andrew young To: Scott Brim CC: nanog(a)nanog.org Sent: Sat May 31 18:28:57 2008 Subject: Re: NANOG NYC Event Speaking of food, ill be going to the Big Apple BBQ fest next weekend: http://bigapplebbq.org/2008/ If you love to eat BBQ, this is a big MUST to cap off your stay in NYC. if you do decided to go, be sure to get the Fastpass: http://www.bigapplebbq.org/2008/index.php?s=fastpass You dont want to wait 30 mins online for food. Don't forget a bib and leave your belt at home. :-) - ------------------------------------ Andrew Young Webair Internet Development, Inc Phone: 1 866 WEBAIR 1 FAX: 516.938.5100 http://www.webair.com andrewy(a)webair.com ------------------------------------- We are interested in any feedback you might have about the service you received. Please contact our technical support consumer care manager directly at 1.866.WEBAIR1 or e-mail customercare(a)webair.com ------------------------------------- On Sat, 2008-05-31 at 18:17 -0400, Scott Brim wrote: > On 5/31/08 12:36 PM, Rod Beck allegedly wrote: > > I strongly suggest that those heading to New York visit the great > > musems, architecture (Saint Patrick's Cathedral), and restaurants. > > You have the American Museum of Natural History, which includes an > > excellent Planetarium and just on the other side of Central Park, the > > Metropolitan Museum of Art and the Guggenheim. There are excellent > > Chinese and Indian restaurants in Lower Manhattan. > > Don't forget about Brooklyn in all this Manhattan praise :-). Consider > the Brooklyn Botanic Garden. It's too late for cherries but the rose > collections will be great. And the best pizza in New York (if you can > get in) is at > http://menupages.com/restaurantdetails.asp?areaid=0&restaurantid=31402&neig… >

15 17

Ransom DDoS attack - need help!
by halp us 18 Jul '25

18 Jul '25

All, I've been a NANOG member for many years but I'm emailing from an anonymous account to reduce the chance of the attackers finding me. A company that shall remain anonymous has received a ransom DDoS note from a very well known group that has been in the news lately. Recently they've threatened to carry out a major DDoS attack if they are not paid by a deadline which is approaching. They've performed an attack of a smaller magnitude to prove that they're serious. Based on certain details that I can't reveal here, we believe the magnitude of the upcoming attack may be in the several hundred Gbps. I would really appreciate help in a few areas (primarily with certain provider contacts/intros) so we can execute our strategy (which I can't reveal here for obvious reasons). If you email me off-list with a name/email that you've previously used on-list, I will reply from my real email. Alternatively, if you can post your experiences on-list with large scale high profile ransom DDoS attacks, I'd really appreciate it! Thanks

17 26

IPv6 Residential Deployment Survey
by John Curran 24 Jan '19

24 Jan '19

NANOGers - If you are providing residential Internet service with IPv6 (or are a customer of same), please take a moment to complete Jordi’s survey - this will help provide insight into the actual technical practices being used in residential IPv6 deployment. More details in attached email - Thanks! /John Begin forwarded message: From: John Curran <jcurran(a)arin.net<mailto:jcurran@arin.net>> Subject: [arin-ppml] IPv6 Residential Deployment Survey Date: May 22, 2016 at 6:24:17 AM GMT+2 To: ARIN PPML <ppml(a)arin.net<mailto:ppml@arin.net>> Folks - Jordi Palet Martínez is conducting a brief survey regarding IPv6 deployment in residential Internet service. Having insight into the various practices that are in use may help to inform IPv6 number resource policy development, and thus I ask that you take a moment to complete the survey if you are providing such services (whether production or trial basis.) Jordi notes - "The results will be published and updated every month or so - No personal data will be published. (If you know your network, it takes less than 2 minutes to complete it) The survey can be responded even if is not yet a commercial service, and customers can also respond, not just the ISP. However, to avoid duplicate data, make sure to include the country and ISP name.” The IPv6 Residential Deployment Survey may be found here - <http://survey.consulintel.es/index.php/175122> Thanks! /John John Curran President and CEO ARIN

9 16

Quanta LB4M
by Mike Hammett 20 Apr '18

20 Apr '18

Has anyone gotten a "non-factory" firmware to go onto these guys? There are a couple threads on Google that are inconclusive. There are rumors that it's the same as a Dell something or an HP something else, but no one has outright said, "I loaded a Dell XXXX firmware onto it and solved all of the random ass bugs." If I didn't already have a couple of stacked Extreme x400s, I'd consider these at home, but they're somewhat buggy. Quanta told me to contact whomever I bought it from... but I don't think the random guy on eBay is going to have much of anything useful to say. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

4 7

Why the internal network delays, Gmail?
by Nate Metheny 21 Jun '17

21 Jun '17

Help (and hi)! I work in higher education and we've been experiencing problems with Google delaying or queuing email for delivery to our domain. Here's some truncated email headers: ** Example 1: X-Received: by 10.237.55.65 with SMTP id i59mr10986018qtb.62.1472137448952; Thu, 25 Aug 2016 08:04:08 -0700 (PDT) Received: by mail-qt0-f175.google.com with SMTP id u25so27419242qtb.1 for <@***>; Thu, 25 Aug 2016 12:05:46 -0700 (PDT) ** Example 2: X-Received: by 10.36.1.75 with SMTP id 72mr5275579itk.40.1472130531887; Thu, 25 Aug 2016 06:08:51 -0700 (PDT) Received: by mail-it0-f48.google.com with SMTP id x131so289116132ite.0 for <@***>; Thu, 25 Aug 2016 11:50:42 -0700 (PDT) In both of these examples, these emails haven't even left Google's internal network yet; I'm getting blamed for these delays, however there is no delay in receiving these emails after they leave Google's network. Are other people having this same problem? I've tested delivery to my network from many outside sources and all SMTP requests go through without delay; this issue seems be exclusive to Google-hosted and Gmail accounts and domains. -- Nate <natemetheny(a)gmail.com>nate(a)dopedesign.com

14 21

Multi-port RFC2544/EtherSAM loopback appliance
by Jason Lixfeld 25 May '17

25 May '17

Group, I'm looking for options and opinions on a cost effective, multi-port (6'ish port SFP/SFP+) RFC2544/EtherSAM rack appliance that can act as the remote/loopback for our field installers' portable RFC2544/EtherSAM enabled Exfo test sets. I came across XenaNetworks XenaCompact which looks like it would fit the bill, but I'm sure there are others (save Ixia, Exfo and Fluke, which I'm pretty much excluding by default because I imagine they are likely completely out to lunch on price relative to the extremely simplified feature set we require). Thanks in advance.

5 4

nested prefixes in Internet
by Martin T 21 Nov '16

21 Nov '16

Hi, let's assume that there is an ISP "A" operating in Europe region who has /19 IPv4 allocation from RIPE. From this /19 they have leased /24 to ISP "B" who is multi-homed. This means that ISP "B" would like to announce this /24 prefix to ISP "A" and also to ISP "C". AFAIK this gives two possibilities: 1) Deaggregate /19 in ISP "A" network and create "inetnum" and "route" objects for all those networks to RIPE database. This means that ISP "A" announces around dozen IPv4 prefixes to Internet except this /24 and ISP "B" announces this specific /24 to Internet. 2) ISP "A" continues to announce this /19 to Internet and at the same time ISP "B" starts to announce /24 to Internet. As this /24 is more-specific than /19, then traffic to hosts in this /24 will end up in ISP "B" network. Which approach is better? To me the second one seems to be better because it keeps the IPv4 routing-table smaller and requires ISP "A" to make no deaggregation related configuration changes. Only bit weird behavior I can see with the second option is that if ISP "B" stops for some reason announcing this /24 network to Internet, then traffic to hosts in this /24 gets to ISP "A" network and is blackholed there. thanks, Martin

15 30

DNS Services for a registrar
by Ryan Finnesey 02 Nov '16

02 Nov '16

We need to provide DNS services for domains we offer as a registrar. We were discussing internally the different options for the deployment. Does anyone see a down side to using IaaS on AWS and Azure? We were also kicking around the idea of a PaaS offering and using Azure DNS or AWS Route 53. Cheers Ryan

19 29

Krebs on Security booted off Akamai network after DDoS attack proves pricey
by Grant Ridder 10 Oct '16

10 Oct '16

Didn't realize Akamai kicked out or disabled customers http://www.zdnet.com/article/krebs-on-security-booted-off-akamai-network-af… "Security blog Krebs on Security has been taken offline by host Akamai Technologies following a DDoS attack which reached 665 Gbps in size." -Grant

51 125