December 2018 - Test - lists.nanog.org

Looking for an compromise of an enterprise network from a mobile device
by Christopher J. Wolff 12 Dec '18

12 Dec '18

Hello NANOG, I'm working on a presentation and need your help. I'm looking for a case study where a compromised iOS, Android or other mobile device was utilized as a backdoor to compromise an enterprise network. Any help will be appreciated. Regards, Christopher

2 1

A few GPON questions...
by Nick Bogle 12 Dec '18

12 Dec '18

Hello fellow NANOG members :) Let me start with a little bit of background, my day job is a Network Engineer for a local university where we have primarily a Cisco environment from phones to switching to routing, etc. Before my time, we hired a contractor to design a GPON LAN system for a new building as a cost saving measure (though I am not sure how successful that was). Either way, the contractor is about to hand the system off to us, and we have gone through the training and such, and I feel confident in my ability to manage the system, but we have a few questions that the manufacturer of our equipment and our contractor didn't really want to answer. We are currently using a Dasan Zhone MXK-F1419 with several different downstream ONT models (all Zhone). -We would like to consider use of 3rd party GPON B+ Optics on the linecards to add redundancy to the splitter (as the cost of 1st party are too high). Does anyone have experience with 3rd party vendors/compatibility/stability issues? We were told they theoretically should work and just throw a log event, but it hasn't been tested. If so, what vendors would you recommend? So far all we've really seen are Ubiquiti and Fiberstore optics. -As GPON is a standard itself, I'm aware interoperability between OLT and ONT vendors is heavily limited.. Does anyone have any experience using say, Zhone ONT's with a different model OLT, or Zhone ONT's with a different model OLT? I've heard word that Zhone ONT's may be able to work with Nokia OLT's but it's technically not supported. -We've already experienced some pretty big stability issues (have replaced 1 line card 5 times..), our contractor is saying it's just because we were a pretty early adopter of this line and that they've fixed it and fixed internal policies to add additional QA and testing before shipping to customers. Does anyone have any experience with working with Zhone and their overall stability of components? - Any other thoughts/gotchas/advice for deploying a GPON environment in a corporate LAN? (or about deploying a Zhone solution) It's pretty service provider oriented, and is incredible noticeable in the CLI. Feel free to contact me offlist if you have any pertinent info that you don't want on the list. Thanks, Nick Bogle nick(a)bogle.se

17 33

IXPDB
by Bryce Wilson 11 Dec '18

11 Dec '18

Hello, I am one of the operators of EVIX and we recently made data available via IX-F Member Export JSON which is also sometimes known as IXPDB JSON. Someone, who I am unclear if it is IX-F, Euro-IX, someone else, or maybe all of them are the same people, has a list of IXPs, especially those with this JSON data. Accompanying that, are participants to these exchanges, all of the route servers or all the exchanges in one large list, and IXP switches, which is slightly odd. This resource is available at https://ixpdb.euro-ix.net/en/ixpdb/providers/. Now that we have the JSON data available we are wondering how to become part of the list. Does anyone have a contact for someone affiliated with this list? At this point the best we can do is email the contacts listed at the bottom of the github page for the schema (https://github.com/euro-ix/json-schemas) Thank you to anyone that can assist. Thanks ~ Bryce Wilson, AS202313, EVIX AS137933

1 0

Steam and Fortnite network contacts
by Mehmet Akcin 11 Dec '18

11 Dec '18

hi there, i am looking for fortnite and steam network/performance team contacts to discuss a performance issue. thank you

1 0

Should ISP block child pornography?
by Lotia, Pratik M 11 Dec '18

11 Dec '18

Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it. On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it. Wondering if any operator is actively doing it or has ever considered doing it? Thanks. With Gratitude, Pratik Lotia “Information is not knowledge.” E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

24 42

Re: Unsolicited LinkedIn requests
by M. Omer GOLGELI 11 Dec '18

11 Dec '18

Well, that must be my curse... Even when adblocker doesn't notify me, I have stuff blocking stuff... :) M. OMER GOLGELI --- AS202365 [1] https://as202365.peeringdb.com [2] https://bgp.he.net/AS202365 [1] NOC: Phone: +90-533-2600533 Email: omer(a)chronos.com.tr On 2018-12-12 00:57, Daniel Corbe wrote: > at 4:48 PM, M. Omer GOLGELI <omer(a)chronos.com.tr> wrote: > Well said... > > But I can't see that on his website... > > M. OMER GOLGELI > --- > AS202365 > > On 2018-12-12 00:39, Daniel Corbe wrote: > If you don't want people contacting you on Linkedin then why do you > have a link to your profile on your website? > at 4:08 PM, Alfie Pates <alfie(a)fdx.services> wrote: > Hi folks, > I'm not going to name-and-shame, but I just got a LinkedIn connection request completely out of the blue from somebody with the comment "Greetings from another NANOG user!" > I didn't recognise the name, and a quick search of my email history suggests we haven't interacted before. > Please don't do this: It's not very polite. > ~A Links: ------ [1] https://bgp.he.net/AS202365 [2] https://as202365.peeringdb.com/

1 0

Re: Unsolicited LinkedIn requests
by M. Omer GOLGELI 11 Dec '18

11 Dec '18

Well, that must be my curse... Even when adblocker doesn't notify me, I have stuff blocking stuff... :) M. OMER GOLGELI --- AS202365 [1] https://as202365.peeringdb.com [2] https://bgp.he.net/AS202365 [1] NOC: Phone: +90-533-2600533 Email: omer(a)chronos.com.tr On 2018-12-12 00:57, Daniel Corbe wrote: > at 4:48 PM, M. Omer GOLGELI <omer(a)chronos.com.tr> wrote: > Well said... > > But I can't see that on his website... > > M. OMER GOLGELI > --- > AS202365 > > On 2018-12-12 00:39, Daniel Corbe wrote: > If you don't want people contacting you on Linkedin then why do you > have a link to your profile on your website? > at 4:08 PM, Alfie Pates <alfie(a)fdx.services> wrote: > Hi folks, > I'm not going to name-and-shame, but I just got a LinkedIn connection request completely out of the blue from somebody with the comment "Greetings from another NANOG user!" > I didn't recognise the name, and a quick search of my email history suggests we haven't interacted before. > Please don't do this: It's not very polite. > ~A Links: ------ [1] https://bgp.he.net/AS202365 [2] https://as202365.peeringdb.com/

1 0

RE: Unsolicited LinkedIn requests
by Phillip Carroll 11 Dec '18

11 Dec '18

Don't complain about people adding you on social media when you sign-up for social media. I can only assume you are complaining to get more views on your social media. I help in your endeavors I have listed your social media's I could find in a quick search. https://www.alfiepates.me/ https://www.linkedin.com/in/alfiepates/ https://en.wikipedia.org/wiki/File:Alfie_Pates_Self-Portrait_2017.jpg https://github.com/alfiepates https://pgp.cs.uu.nl/stats/654a98a79ac41734.html https://www.instagram.com/alfiepates/?hl=en https://www.flickr.com/photos/alfiepates/ https://keybase.io/alfiepates https://www.youtube.com/channel/UCI_1D5aDl30EnvQI6JsOmBw https://soundcloud.com/alfie-pates https://wiki.edinburghhacklab.com/people:alfie https://twitter.com/AlfiePates https://foursquare.com/alfiepates v1apates(a)inf.ed.ac.uk alfie(a)alfiepates.me http://lmgtfy.com/?q=alfiepates -----Original Message----- From: NANOG <nanog-bounces(a)nanog.org> On Behalf Of Alfie Pates Sent: Tuesday, December 11, 2018 3:08 PM To: nanog(a)nanog.org Subject: Unsolicited LinkedIn requests Hi folks, I'm not going to name-and-shame, but I just got a LinkedIn connection request completely out of the blue from somebody with the comment "Greetings from another NANOG user!" I didn't recognise the name, and a quick search of my email history suggests we haven't interacted before. Please don't do this: It's not very polite. ~A

1 0

Monitoring service that has a human component?
by David H 11 Dec '18

11 Dec '18

Hey all, was curious if anyone knows of a website monitoring service that has the option to incorporate a human component into the decision and escalation tree? I’m trying to help a customer find a way around false positives bogging down their NOC staff, by having a human determine the difference between a real error, desired (but different) content, or something in between like “Hey it’s 3am and we’ve taken our website offline for maintenance, we’ll be back up by 6am.” Automated systems tend to only know if test A, or steps A through C, are failing, then this is ‘down’ and do my preconfigured thing, but that ends up needlessly taking NOC time if the customer themselves is performing work on their own site, or just changed it and whatever content was being watched, is now gone. So, the goal would be to have the end user be the first point of contact if it looks like more of a customer-side issue. If they can’t be reached to confirm, THEN contact NOC, and unlike email alerts, keep contacting until a human acknowledges receipt of the alert. Thanks

7 6

Security issues based on post RIR allocation rules
by Spurling, Shannon 11 Dec '18

11 Dec '18

Hey, I lurk a bit, and try to stay out of stuff if I can, but I've had a bout of problems that appear to have a common source. I work in the Educational networking area, and a lot of our members are pre-RIR formation internet users. They have IP ranges that were allocated from the 150/8 through 170/8 blocks. Unfortunately, a bunch of those are part of the legacy ranges handled by APNIC and AFRINIC. Here in the US, mention of either of those makes security people have dreams of Nigerian princes and Korean/Chinese hackers. Don't get me wrong, these are long term US based governmental and educational institutions. Bonified, accredited institutions. When I call a health care organization, or a web hosting provider, the first thing I get is that they think we are trying to pull one over on them and all these ranges must be in Africa or Asia. I show them the ARIN information for the specific /16, and sometimes I can make some headway. Sometimes there's no convincing them. This issue appears to be getting worse over time, so I was wondering if some misguided organization or group is going around pressing for the rules that are triggering these issues? Is there a public information forum that might be able to educate security administrators to not cut off wide swaths of the US internet from taking advantage of their products and services? It's very frustrating Thanks Shannon Spurling shannon(a)more.net

4 3