February 2019 - Test - lists.nanog.org

WIndows Updates Fail Via IPv6
by Mark Tinka 07 Mar '19

07 Mar '19

Hi all. Anyone ever figured out why Windows updates fail when the computer has an IPv6 connection? Google has tickets and tickets of this to and outside of Microsoft since 2013, with no real solution or answer as to what the problem actually is. In essence, many of the solutions out there point toward making sure the updates do not occur over IPv6, which, in effect, is the same as disabling it. I have a family PC at home running Windows 10 Pro, and noticed updates would fail in recent months. It took me a moment to realize that this started happening only after I enabled IPv6 in the TCP/IP stack. Disabling it immediately solves the issue. Quite odd that this is happening in 2018... Mark.

20 49

a quick survey about LLDP and similar
by Pierfrancesco Caci 05 Mar '19

05 Mar '19

Hello, having a bit of a debate in my team about turning on LLDP and/or CDP. I would appreciate if you could spend a minute answering this survey so I have some numbers to back up my reasoning, or to accept defeat. https://www.surveymonkey.com/r/TH3WCWP Feel free to cross-post to other relevant lists. Thank you Pf -- Pierfrancesco Caci, ik5pvx

8 8

Re: How to choose a transit provider?
by nanog-isp＠mail.com 05 Mar '19

05 Mar '19

Mike Hammett wrote: > Usually, DIA (as transit delivered to a customer) is more expensive than transport + transit + small colo > (1U\2U stuff) + IX... at least as observed by many of my brethren. Is this really true in the general case? Adding colo and IX to transport and transit involves at least one additional cross connect and an IX port fee. This is likely to push the total above the pure DIA price. However, regardless of how the numbers pencil out, this isn't really a fair comparison. For small ISPs, the yardstick against which adding an IX to the mix is usually measured against is the marginal cost of IP transit. Given that the cost of transport is fixed, is it more economical to buy more IP transit or to join an IX? Transit being so cheap means that joining an IX isn't always so enticing from a financial perspective, although there are other non-monetary benefits. I certainly subscribe to the notion that transport + transit is usually less expensive than DIA, but this does depend on the market and location. Jared

4 4

HULU NOC
by John Alcock 04 Mar '19

04 Mar '19

Afternoon, I have searched the forums and have had no luck. We have just received a new block of ip's. None of my subscribers can get to Hulu. I have started updating all the major GeoIP Databases. I figure I need to get Hulu to update their database. Of course calling regular support is useless Anyone have a contact? John Alcock john(a)alcock.org Network Engineer Highland Communications

2 1

Re: A Deep Dive on the Recent Widespread DNS Hijacking
by James Renken 04 Mar '19

04 Mar '19

On Feb 25, 2019, at 5:20 AM, Bill Woodcock <woody(a)pch.net> wrote: > We know that neither Comodo nor Let's Encrypt were DNSSEC validating before issuing certs. I’d like to clarify that Let’s Encrypt has always validated DNSSEC, dating to before we issued our first publicly trusted certificate in September 2015. -- James Renken (pronouns: he/him) Internet Security Research Group Let's Encrypt: A Free, Automated, and Open CA

2 1

Question about ISP billing procedures
by Daniel Rohan 02 Mar '19

02 Mar '19

Can anyone shed light on how ISPs handle missing samples when calculating p95s for monthly billing cycles? Do they fill null samples with zeros or leave them as null? I’m working on a billing sanity tool and want to make sure to cover my corner cases well. Thanks! Dan -- Thanks, Dan

9 8

RE: A Deep Dive on the Recent Widespread DNS Hijacking
by Montgomery, Douglas (Fed) 27 Feb '19

27 Feb '19

You might have missed reading the very article you cite. "Woodcock said PCH’s reliance on DNSSEC almost completely blocked that attack, but that it managed to snare email credentials for two employees who were traveling at the time. .... Aside from that, DNSSEC saved us from being really, thoroughly owned.” Or maybe ACME .. https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-11.2 "It is therefore RECOMMENDED that ACME-based CAs make all DNS queries via DNSSEC-validating stub or recursive resolvers. This provides additional protection to domains which choose to make use of DNSSEC.” I am not sure how many of the domains listed as being hijacked are DNSSEC signed, but it seems if they were, and had a reasonable long TTL on a DS record at their parent, many if not most of these could have been prevented/detected. ICANN seems to think that is the case: ICANN Calls for Full DNSSEC Deployment https://www.icann.org/news/announcement-2019-02-22-en Of course, DNSSEC is often blamed for not protecting those who did not deploy/use it. Not sure what can be said about that line of reasoning. Dougm -- Doug Montgomery, Manager Internet & Scalable Systems Research @ NIST ============ Date: Sat, 23 Feb 2019 12:13:41 -0700 From: "Keith Medcalf" <kmedcalf(a)dessus.com> To: "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: RE: A Deep Dive on the Recent Widespread DNS Hijacking Attacks Message-ID: <6e31d305aee69c4d85116e6a81d0c91d(a)mail.dessus.com> Content-Type: text/plain; charset="us-ascii" On Saturday, 23 February, 2019 10:03, Stephane Bortzmeyer wrote: >Very good article, very detailed, with a lot of technical precisions, >about the recent domain name hijackings (not using the DNS, just good >old hijackings at registrar or hoster). >https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dn… So in other words this was just an old school script kiddie taking advantage of DNS registrars, the only difference being this was a whole whack of script kiddies acting in concert directed by a not-quite-so-stupid script kiddie, with some "modernz" thrown in for good measure. (Sounds like an NSA operation to me -- and the targets perfectly match those that the NSA would choose -- plus some good old misdirection just for the jollies of it) The second takeaway being that DNSSEC is useless in preventing such an occurrence because the script kiddies can merely turn it off at the same time as they redirect DNS. However, having DNSSEC can protect you from incompetent script-kiddies. It can also give you a false sense of security. Did I miss anything? --- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.

35 79

AWS - amzn-noc-contact
by Luiz Rosas 26 Feb '19

26 Feb '19

Hi, Can someone with amzn-noc contact me off list regarding AWS-ZOOMVIDEOCOMMUNICATIONS. Thx Luiz Luiz Rosas Sr. Network Engineer Race Communications Phone: +1 415-376-3327 luiz.rosas(a)race.com / www.race.com

1 0

Re: A Deep Dive on the Recent Widespread DNS Hijacking
by James Renken 26 Feb '19

26 Feb '19

On Feb 25, 2019, at 1:16 PM, Hank Nussbacher <hank(a)efes.iucc.ac.il> wrote: > Yes if an attacker pwned the DNS then game over no matter what. I go > under the assumption that the attacker was not able to take over the DNS > system but rather other things along the way, in which case CAA should > be of some assistance. I’m excited about a proposed CAA extension (https://tools.ietf.org/html/draft-ietf-acme-caa-06) that would allow domain owners to restrict issuance to a particular ACME account and a particular validation method. This could provide stronger protection against most attacks short of a registry or registrar hijack. It’s implemented in Let’s Encrypt's staging environment, and I hope it’s able to move forward. -- James Renken (pronouns: he/him) Internet Security Research Group Let's Encrypt: A Free, Automated, and Open CA

1 0

Looking for a digitalocean contact with clue.
by Marc Runkel 26 Feb '19

26 Feb '19

Sorry for the noise, Can anyone in digitalocean contact me off-list. I'm having what I believe to be a networking issue with three new droplets that doesn't appear on older droplets out of the Frankfurt datacenter and I can't seem to break through level 1 support. Would be appreciated. Marc Runkel

1 0