- Test - lists.nanog.org

IPv6 Extension Headers in the Real World
by Fernando Gont 30 Sep '14

30 Sep '14

Folks, Earlier in September we published a revision of our I-D "IPv6 Extension Headers in the Real World" (<https://tools.ietf.org/html/draft-gont-v6ops-ipv6-ehs-in-real-world>). At this point in time, we're interested in knowing whether our I-D is of value for the IPv6 ops community, such that we can decide whether to continue working/improving it. Additionally, if there's anything you think we've missed in the document, we'd like to hear from you. Overall, our I-D is meant to provide a reality-check with respect to the issues surrounding IPv6 Extension Headers and their use on the public Internet. More specifically, its goals are: 1) Provide data regarding support of IPv6 EHs in the real world. This is interesting data to refer people to (e.g., folks developing protocols) regarding the extent to which IPv6 EHs are usable on the public Internet (at least with web, mail, and name servers). 2) Summarize the issues associated with IPv6 EHs (performance, security, etc.) This is of use for folks concerned with the issues surrounding IPv6 EHs, and covers practical issues. 3) Summarizes the implications of the aforementioned filtering. For example, if you're designing a protocol that is meant to work on the public Internet, you may want to provide some fall-back mechanism that does not employ IPv6 EHs. Yet another of the implications is the security issue that has been discussed on-list: if e.g. IPv6 fragments are dropped and you can be tricked into generating them, you may be subject to a DoS attack. 4) Flag possible further work Here we try to flag areas where the further work may be needed, such as adding fall-back mechanisms to some existing protocols, or avoiding the use of IPv6 EHs where possible. Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Re: update
by Larry Sheldon 30 Sep '14

30 Sep '14

On 9/29/2014 00:32, Pete Carah wrote: > For that matter, has the*specification* of tcp/ip been proven to be > "correct" in any complete way? I find that question in this forum really confusing. I thought all of the RFC-descriptions of protocols were taken to be statements that "if you do it this way, we think we can inter-operate" but at no time to be taken as "right" or "wrong". -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

5 4

Internet in Venezuela
by Paige Thompson 30 Sep '14

30 Sep '14

I have lots of questions, feel free to contact me privately if you have some time or interest in answering some of them. -Paige paigeadele(a)gmail.com PGP: 0x0d5d2688 (keys.gnupg.net) also attached.

1 0

YouTube CDN down?
by Blair Trosper 29 Sep '14

29 Sep '14

Suddenly having an inability to play YouTube videos over IPv4 and IPv6 from multiple ASNs in multiple locations in the United States. Tried multiple operating systems and browsers...all have the same issue. (The very few that do play stall out, even though they're buffered.) Is this just me, or is there an issue afoot?

3 3

update
by Randy Bush 29 Sep '14

29 Sep '14

there is an update out you want. badly. debian/ubuntu admins may want to apt-get update/upgrade or whatever freebsd similarly can not speak for other systems

24 56

Re: Match.com contact - Previously: GMail contact - misroute / security issue
by Anne P. Mitchell, Esq. 29 Sep '14

29 Sep '14

> Does anyone have any Match.com contacts? I'll try going that route to > get the messages stopped. (Including emailing postmaster@ and abuse@ to > see if they can help.) I've contacted Grant offlist to provide him with a contact. Anne Anne P. Mitchell, Esq. CEO/President ISIPP SuretyMail Email Accreditation Your mail system + SuretyMail accreditation = delivered to their inbox! http://www.SuretyMail.com/ Author: Section 6 of the Federal CAN-SPAM Act of 2003 Member, California Bar Cyberspace Law Committee Ret. Professor of Law, Lincoln Law School of San Jose https://www.linkedin.com/in/annemitchell 303-731-2121 | amitchell(a)isipp.com | @AnnePMitchell | Facebook/AnnePMitchell

1 0

Perfsonar and shellshock
by Leif Nixon 29 Sep '14

29 Sep '14

Please guys, If everybody could patch their perfsonar boxen against shellshock LIKE RIGHT NOW, or preferably LAST WEEK, or alternatively put the machines out of their misery with a shotgun, that would be great. Thank you, -- Leif Nixon - Security officer National Supercomputer Centre - Swedish National Infrastructure for Computing Nordic Data Grid Facility - European Grid Infrastructure

3 2

Security Update: Muli-Router Looking Glass (MRLG) version 5.5.0 released
by John Fraizer 28 Sep '14

28 Sep '14

I was contacted by Luca Bruno a couple of months ago regarding the fastping.c utility that has been included with MRLG for the past 14 years. It seems that fastping.c is vulnerable to a crafted attack that can cause remote memory overwrite/corruption. The fastping.c utility was only used by MRLG in the outside chance that the "router" in question was Zebra/Quagga. Based on Google results, this is a very minuscule minority of installations that utilize MRLG. I was OCONUS with limited connectivity when Luca contacted me, in addition to being up to my eyeballs dealing with a Southeast Asia network redesign. Last night, I had some downtime and was able to put together a (superior?) replacement for fastping.c that utilizes the existing ping utility on the MRLG host system while emulating the Cisco IOS ping facility. I have released MRLG 5.5.0 as of Sat Sep 27 03:16:28 UTC 2014. It is a (nearly) drop-in replacement for all previous versions of MRLG that addresses the issue that Luca Bruno and Mariano Graziano brought to light in CVE-2014-3931. See: http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt The latest MRLG (5.5.0) is available at http://mrlg.op-sec.us/ I know that the details of this CVE was published at: http://mailman.nanog.org/pipermail/nanog/2014-July/068014.html and http://www.s3.eurecom.fr/lg/defcon_looking-glass.pdf http://vrt-blog.snort.org/2014/09/looking-glasses-with-bacon.html http://tools.cisco.com/security/center/viewAlert.x?alertId=35693 https://www.defcon.org/images/defcon-22/dc-22-presentations/Bruno-Graziano/… https://www.usenix.org/system/files/conference/woot14/woot14-bruno.pdf There are likely many other locations at which CVE-2014-3931 is detailed. I ask that the NANOG community make it known - via whatever channels - that this vulnerability has been addressed and mitigated and that you please point folks to http://mrlg.op-sec.us/ for the latest code. Many thanks! -- John Fraizer ΥΣΜΧ

1 0

NANOG College Immersion Program
by Dave Temkin 27 Sep '14

27 Sep '14

I'm excited to announce that for NANOG 63 in San Antonio that we will begin the NANOG College Immersion Program. This program aims to provide the next generation of Network Operators with an edge in today's highly competitive market and allows us a conduit of highly capable operators, engineers, and architects. Please see below for the full program description. Regards, -Dave Temkin, for the NANOG Board of Directors NANOG College Immersion Program Summary: NANOG is committed to ensuring next generation of networking professionals have an opportunity become part of the operational community that makes the internet run. Companies such as Google, Level 3, Microsoft, NTT, Netflix, Yahoo, and Amazon rely on NANOG to discuss key architectural and operational topics relevant to Internet infrastructure. NANOG believes by introducing undergraduates to our vibrant community before entering the job marketplace, they will have a better understanding of how the infrastructure of the Internet works and how they might participate after graduation. Further, students may be able to find internship opportunities they may have not otherwise found. Offering: NANOG will provide an expenses-paid trip to the current meeting for up to 25 students per meeting. The paid expenses will include: - Airfare (up to $500) - Four nights of hotel (must be booked by NANOG staff) - Ground transportation (reasonable cost) - Meal stipend (adjusted for meeting location) NANOG will also, space permitting, allow free admission for students to the NANOG Education Series (https://www.nanog.org/meetings/education/home) class prior to the meeting they are attending. NANOG will provide guidance to students as to what they may and may not attend. Of note, alcohol is served at some NANOG events and there is the expectation that those not legally entitled to consume alcohol will refrain from doing so. NANOG takes no responsibility for those that break the law during their meetings and reserves the right to refuse admission to those that violate our Attendance Charter. Expectation: NANOG will not be involved in any syllabus or coursework for the students. The NANOG organization will provide an agenda and slideware for the materials that the students will be viewing and expects their professor to determine the best way their students can extract educational value from the NANOG program. NANOG asks, in return, that all students complete our surveys in full and that their teaching staff provide us with a summary of how they used our program in the classroom and/or in coursework. A few paragraphs from each student explaining the value that they got from the program and social interactions would also be a good idea. Q&A: Q: What is NANOG and what is the value proposition for sending a student to this conference? A: The North American Network Operators Group or NANOG, is the professional association for Internet engineering and architecture. Our core focus is on the technologies and systems that make the Internet function: core routing and switching; Internet inter-domain routing; the domain name system; peering and interconnection; and Internet core security. We also cover associated areas with a direct impact on Internet architecture such as data centers and optical networking. The value proposition for the student is exposure to all of these subjects and technical material but more importantly to the organizations and individuals. The opportunity for students to make industry contacts is invaluable. Q: How do we select students for this sponsorship? A: Send your best and brightest, highlight that the value is the density of industry representatives in a common location. Q: What do the students owe back to NANOG? A: In addition to the anonymous surveys that all attendees are asked to complete, the NANOG Board would request that all sponsorship recipients provide feedback on their experiences. Lastly, we would like to encourage the students join the mailing list (nanog(a)nanog.org) attend more conferences and get involved in the industry. Q: How do we evaluate our students participation? A: Students could provide a variety of deliverables back to the institution. These could include a writeup of selected presentations from the agenda, an overview of the conference as a whole, or even a list of the individuals they met during the conference. Q: What will be covered in the sponsorship? A: Hotel, conference fee, airfare, and a reasonable stipend for incidentals such as meals. Q: Why are you sponsoring our students for this conference? A: The NANOG organization is keen to encourage the future technology leaders and innovators to get interested and involved in this segment of the industry.

5 5

peeringdb
by Justin Wilson 27 Sep '14

27 Sep '14

Trying to update some records on peeringdb.com and am not getting much response. Just wondering if I am the only one. I am not getting response back from support. Figured this would be a good place to ask. More curious than anything. Thanks, Justin -- Justin Wilson <j2sw(a)mtin.net> http://www.mtin.net <http://www.mtin.net/blog> Managed Services xISP Solutions Data Centers http://www.thebrotherswisp.com Podcast about xISP topics http://www.midwest-ix.com Peering Transit Internet Exchange

2 1