- Test - lists.nanog.org

Re: Feedback Requested: Routing Resilience Manifesto
by Larry Sheldon 02 Jul '14

02 Jul '14

On 7/2/2014 1:00 PM, Jared Mauch wrote: > > On Jul 2, 2014, at 1:52 PM, William Herrin <bill(a)herrin.us> wrote: > >> People will notice you streaking across a football field. They won't >> pay the slightest attention to what you have to say but they sure will >> notice you. Shall we organize a naked routing run? > > No, but how else do you suggest we work to address these problems? I am no longer active in the field, but back in the day, the ways of successfully selling stuff to management involved some mix of: It will improve sales. It will reduce costs. It will allow you to do something you want to do. It will keep you out of court and jail. No variation "It is the right thing to do" ever worked unless management thought of it. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

4 3

softlayer network contact
by jason matthews 02 Jul '14

02 Jul '14

can someone from softlayer/networklayer contact me off list please. thanks, j. Jason Matthews VP of Technical Operations Apsalar, Inc.

1 0

Re: Feedback Requested: Routing Resilience Manifesto
by Larry Sheldon 02 Jul '14

02 Jul '14

On 7/2/2014 11:20 AM, William Herrin wrote: > Seriously, manifesto? What's next, some routing unabombers? Oh wait, I > guess we already have those, don't we? Seriously. And it is actually a deeper wound than that. The whole document (or as much of it as I was willing to read, anyway) is worded like it had been copied out of the Ernesto Guevara Handbook. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Erroneous Leap Second Introduced at 2014-06-30 23:59:59 UTC
by Tim Heckman 02 Jul '14

02 Jul '14

Hey Everyone, I just was alerted to one of the systems I managed having a time skew greater than 100ms from NTP sources. Upon further investigation it seemed that the time was off by almost exactly 1 second. Looking back over our NTP monitoring, it would appear that this system had a large time adjust at approximately 00:00 UTC: - http://puu.sh/9Rs6O/a514ad7c97.png (times are in Pacific in these graphs, sorry about that) A few of our systems did alert early this morning, indicating they were going to be receiving a leap second today. However, I was unable to determine the exact cause for NTP believing a leap second should be added. And after some time a few of the systems were no longer indicating that a leap second would be introduced. This specific system is hosted in AWS US-WEST-2C and uses the 0.amazon.pool.ntp.org pool. Has anyone else seen any erroneous leap seconds being added to their system? Cheers! -Tim Heckman

3 5

Responsive person on AOL postmasters team
by Jacques Marneweck 01 Jul '14

01 Jul '14

Hi, Can someone on the AOL postmasters team contact me offlist. Having some mail delivery issues from customers and don't seem to be getting anywhere via the normal postmasters contact at getting the issue resolved. Regards --jm

1 0

Intraway Contact
by Alejandro Acosta 01 Jul '14

01 Jul '14

Hi there, Is there anyone from Intraway on here? I would appreciate it if anyone on, or off-list can provide any contact details Thanks, Alejandro Acosta,

1 0

Heads-up on security aspects of looking-glass deployments
by Luca BRUNO 01 Jul '14

01 Jul '14

Hi all, we recently performed a broad-scope security review of some commonly deployed open-source looking-glass software, and we discovered several bugs and misconfigurations which you may want to check if concerning your infrastructure. Firstly, affected software and issues are as follow: * mrlg4php - CVE-2014-3927: Remote command injection to router's console via "argument" parameter * cougar-lg - CVE-2014-3926: XSS in <title> via "addr" parameter - CVE-2014-3928: Unsafe configuration file path/ACL - CVE-2014-3929: Unsafe SSH keypairs path in default config * cistron-lg - CVE-2014-3930: Unsafe configuration file path/ACL * mrlg - CVE-2014-3931: Remote memory corruption in fastping (SUID binary) Some of these bugs (in particular 3927, 3928, 3929, 3930) may directly or indirectly result in exposed IPs, usernames, passwords, SSH private keys and remote command injection to router's console. Depending on the specific infrastructure setup, this may translate into an attacker having live access to routers CLI. During the study, we detected around 45 incidents somehow related to above bugs, which we have already reported to concerned NOC contacts, whois contacts and national FSIRTs for further handling. Advanced private disclosure to concerned entities was performed on 06/02. For specific details, full advisories are available for each issue: * http://www.s3.eurecom.fr/cve/CVE-2014-3926.txt * http://www.s3.eurecom.fr/cve/CVE-2014-3927.txt * http://www.s3.eurecom.fr/cve/CVE-2014-3928.txt * http://www.s3.eurecom.fr/cve/CVE-2014-3929.txt * http://www.s3.eurecom.fr/cve/CVE-2014-3930.txt * http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt Apart from one case where the author is unreachable and one that as been marked as "wontfix", all the issues have been fixed by software authors. Incidents related to misconfigurations have been handled on a case-by-case basis, and no disclosure-delaying cases exist at this time (to the best of our knowledge). If you have any specific questions on the topic, feel free to ask either here on NANOG or by reaching me in private. Cheers, Luca & Mariano -- .''`. | ~<[ Luca BRUNO ~ (kaeso) ]>~ : :' : | Email: lucab (AT) debian.org ~ Debian Developer `. `'` | GPG Key ID: 0x3BFB9FB3 ~ Free Software supporter `- | HAM-radio callsign: IZ1WGT ~ Networking sorcerer

1 0

Comcast Business Internet Options
by Phil Gardner 30 Jun '14

30 Jun '14

Hi all - Probably like a lot of people on the list, I depend on my home internet connection for many things including my primary job, and the numerous side projects I work on. I'd really a appreciate a connection that would have a shorter response time if something were to go wrong. Unfortunately, I just moved and now I'm out of the service area of my previous provider, who was actually able to compete with Comcast (FTTH). Now I'm stuck with one option. I really don't plan on spending more than a year where I currently am, so I don't want be locked into a contract for more than a year, especially with Comcast's crap termination fee (75% of the remainder on the contract). I called and talked to a sales rep, who was just a kid, and an arrogant one at that. He knew of the monopoly for a decent internet connection in my area, so I had little bargaining power. The offer he gave me was: minimum 2 year contract, with a $99 installation fee, and his "supervisor" "approved" a $300 Visa giftcard if I agreed to this. The other option is a 1 year contract, with a $199 installation fee, with no giftcard. This is for the 50Mbit option, and he didn't seem to care about my counter offer to bump it up to 75Mbit if he waived the install fee. Come on...$199 to plug in a modem. The address already had Comcast before I got there... Is there anyone out there that has ideas about how to waive or lower that installation fee while only having a 1 year contract? -- _____________________ Phil Gardner PGP Key ID 0xFECC890C OTR Fingerprint 6707E9B8 BD6062D3 5010FE8B 36D614E3 D2F80538

5 5

MACsec SFP
by Pieter Hulshoff 30 Jun '14

30 Jun '14

All, Last year some people on this list expressed interest in smart SFP options, like e.g. MACsec. As a network consultant and systems architect with AimValley in the Netherlands, I'm currently in the process of gathering feature and market information for such a device, and I would welcome some feedback from interested people. Discussion about other types of smart SFPs would also be welcome. Feel free to contact me directly using the contact information below. Kind regards, Pieter Hulshoff Network Consultant & Systems Architect Aimvalley B.V. Utrechtseweg 38 1213 TV Hilversum +31 35 689 1936 phulshof(a)aimvalley.nl http://www.aimvalley.com

13 40

Looking for a maxcdn contact.
by Bryan Socha 30 Jun '14

30 Jun '14

Does anyone have a contact for maxcdn's noc/routing/peering group? We're seeing routes that are note coming over certain providers and from some locations we're seeing private asn's in the as path. Thanks, Bryan Socha Network Engineer DigitalOcean

1 0