- Test - lists.nanog.org

Calculator written in route-map
by Job Snijders 01 Apr '14

01 Apr '14

Hi all, Do you often find yourself in need of a simple calculator, and all you have available to you is a Brocade or Cisco IOS router? No longer will you experience the horror and dread of mental arithmetics. The route-map calculator is here! Brocade : http://instituut.net/~job/calculator-route-map.brocade.txt Cisco IOS : http://instituut.net/~job/calculator-route-map.ioscisco.txt (file size ~ 12 megabyte) In general I don't find route-maps useful to accomplish, well, anything. However, this is a striking example of re-usable configuration that has a measurable impact on daily operations! Calculations can be performed with integers between 1 and 256. The answer will be presented as a rounded positive integer. In case the calculation would result in a negative integer, larger than 2^16 (65536), an helpful error message is generated: 65000:7777. For divisions and substractions the order of the BGP communities is relevant, one must always place the operator first! arithmetic operators: 'add' operator community: 65000:1 'multiply' operator community: 65000:2 'substract' operator community: 65000:3 'divide' operator community: 65000:4 example output: telnet@input-router#show ip bgp routes detail 10.1.1.1 | i COMMUNITIES COMMUNITIES: 65000:2 0:63 0:113 ! calculate 63 * 113 telnet@input-router# telnet@calculator#show ip bgp routes detail 10.1.1.1 | i COMMUNITIES COMMUNITIES: 0:7119 ! result: 7119 telnet@calculator# Super convenient right?! WARNING: due to IOS/Ironware architecture this route-map consumes quite some memory. Always test in a lab before deploying in production! Kind regards, Job

3 2

RE: [mailop] IPv6 DNSBL
by David Hofstee 01 Apr '14

01 Apr '14

Maybe you did not understand my message. I know what you say. However: I see a message from a list as a message-from-a-list , not as a forwarded-message-from-a-list-user. Because: How can a user authorize someone to send a message on behalf of his/her name (by sending an email). This should not ever happen. Example: A bank sends me an email which was authorized (in some way). I now forward this message. The message is genuinely not modified. But it still does not authorize me to send this email pretending to be the bank, even if it is the same message. Conclusion: If an email was sent by me, it should be authorized/authenticated by me. For mailing lists you might want to indicate that the message can be interpreted as being forwarded for a specific user. In that way the user-interface of the email client can reply to a user directly instead of the mailing list. If that is what one wants. David Hofstee Deliverability Management MailPlus B.V. Netherlands (ESP) -----Oorspronkelijk bericht----- Van: John Levine [mailto:johnl@taugh.com] Verzonden: Monday, March 31, 2014 4:47 PM Aan: mailop(a)mailop.org CC: David Hofstee Onderwerp: Re: [mailop] IPv6 DNSBL >I don't see how forwarding should break authentication. This is SPF's famous limitation. It's been debated to death, no need to rerun the argument again. DKIM survives normal forwarding, which was one of its design goals, but mailing lists typically modify the message by adding subject tags or message footers, stripping attachments, and the like, which breaks the incoming signature. That's been debated to death, too. It always seemed to me that lists should sign their mail, publish SPF for the lists's bounce addresses, and recipients would use the list's reputation to filter, Some people apparently have a security model I don't understand that evaluates the spamminess of list messages by the presence of signatures from the individual contributors. R's, John

1 0

Just wondering
by Joe 01 Apr '14

01 Apr '14

Pardon for the ignorance regarding this. If folks can point me to something I may have missed as a participant for over 14 years, to powering this Alzheimers. I received several reports today regarding some scans for udp items from shadowservers hosted out of H.E. Seems to claim to be checking for issues regarding udp issues, amp issues, which I am all fine for, but my issue is this. It trips several IDP/IPS traps pretty much causing issues that I have to resolve. I have one user that is a home user (outside one of my /16) that has seen this as well. Now with that said are these folks that do this going to pay for one of my users that pay per bit for this? Does garbage in to this really provide a garbage clean? I see they are planing on a bunch of other protocols too, so that's nice. I'm not sure where to go with this other than to advise my other folks to drop this traffic from their 184.105.139.64/26 networks and hope for the best regarding my FAP folks. Regards, -Joe

4 3

3356 leaking routes out 3549 lately?
by David Hubbard 31 Mar '14

31 Mar '14

Has anyone had issues with Level 3 leaking advertisements out their Global Crossing AS3356 for customers of 3549, but not accepting the traffic back? We've been encountering this more and more recently, bgpmon always detects it, and all we ever get from them is there's nothing wrong. Today it affected CloudFlare's ability to talk to us. It seems to happen mostly with Europe and Asian peering points. Typically lasts five to ten minutes which makes me think someone working on merging the two networks is doing some 'no one will notice this' changes in the middle of the night. David

5 4

misunderstanding scale (was: Ipv4 end, its fake.)
by TJ 31 Mar '14

31 Mar '14

Millions of IPs don't matter in the face of X billions of people, and XX-XXX billions of devices - and this is just the near term estimate. (And don't forget utilization efficiency - Millions of IPs is not millions of customers served.) Do IPv6. /TJ On Mar 22, 2014 3:09 AM, "Bryan Socha" <bryan(a)digitalocean.com> wrote: > > As someone growing in the end of ipv4, its all fake. Sure, the rirs will > run out, but that's boring. Don't believe the fake auction sites. > Fair price of IP at the end is $1 for bad Rep $2 for barely used, $3 for no > spam and $4 for legacy. Stop the inflation. Millions of IPS exist, > there is no shortage and don't lie for rirs with IPS left.

70 316

Re: why IPv6 isn't ready for prime time, SMTP edition
by Larry Sheldon 31 Mar '14

31 Mar '14

On 3/30/2014 11:17 PM, Patrick W. Gilmore wrote: > On Mar 30, 2014, at 16:40 , Måns Nilsson <mansaxel(a)besserwisser.org> wrote: >> Subject: Re: why IPv6 isn't ready for prime time, SMTP edition Date: Sat, Mar 29, 2014 at 11:06:11AM -0400 Quoting Patrick W. Gilmore (patrick(a)ianai.net) >>>> On Mar 29, 2014, at 3:15, Måns Nilsson <mansaxel(a)besserwisser.org> wrote: >>>> Quoting John R. Levine (johnl(a)iecc.com) >>>>>> Ergo, ad hominem. Please quit doing that. >>>>>> As a side note I happen to run my own mail server without spam filters >>>>>> -- it works for me. I might not be the norm, but then again, is there [snip] > However, I think you'll find your definition of "undue" and most of the rest of the Internet's is vastly different. > Seems like I got chased off of NANOG for less, in years gone by....... -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Can I borrow some MTA address traces?
by John R. Levine 30 Mar '14

30 Mar '14

As noted about a zillion messages ago, one of the concerns about IPv6 mail is whether DNSBLs will be workable, with one of the questions being whether the lookups will blow away DNS caches. As far as I can tell, there is basically no research on DNS cache behavior other than a few very old papers that said for normal loads, a reasonable sized cache is big enough to work. For the DNSBL stuff I'm doing some simulations, which need data to drive the lookups. The data is really simple, a sequence of pairs: [ IP address, timestamp ] IPv4 traces are currently more useful than IPv6, since v6 doesn't have the botnet traffic that makes the DNSBL lookups interesting. Traces from medium sized systems, say a million connections a day, would be great. If you consider the IP addresses confidential you can hash them, although real ones would be better so I can test tweaks that treat known high volume senders (gmail etc.) differently. Thanks. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. http://jl.ly PS: I hope it's OK if we take a break from reinventing patented anti-spam techniques that have failed repeatedly before to talk about something else.

1 0

Re: why IPv6 isn't ready for prime time, SMTP edition
by Larry Sheldon 30 Mar '14

30 Mar '14

On 3/29/2014 12:59 PM, Jimmy Hess wrote: > *Postage schemes as proposed with end users email clients 'attaching > postage' simply not workable Not in IPv4. Not in IPv6. Not in IPng > Not in any conceivable future version of IP. And I insist that we are all wasting our time trying to make SMTP and its supporting protocols (and their kin under IPX/SPC, Sperrylink, UUCP, et alia) are not at the transport layer and nothing at the transport layer is responsible for nor rich with solutions for their problems. IF the overriding problem is due to an inability to identify and authenticate the identification of the sender, then let us work on establishing a protocol for identifying the sender and authenticating the identification of the sender and permitting the receiver to accept or deny acceptance of traffic by reference to that identification. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

4 3

Re: Cisco Security Advisory
by Scott Weeks 29 Mar '14

29 Mar '14

--- rdrake(a)direcpath.com wrote: From: Robert Drake <rdrake(a)direcpath.com> because seeing 5 advisories at once is like a giant line break in NANOG discussions, so it's harder to tune it out and skip the emails :) They could Bcc: all the lists they are sending to in one set of emails so the message-id is the same, then you could filter duplicates at least. Or they could do the summary email like you guys want, whichever makes people happy. :) ------------------------------------------------------------ You got 5 (actually 6 this time) perhaps because you're only on NANOG. I got over 30 this time and once when there were 9 vulnerabilities I got almost 50 emails from cisco. scott

3 2

Re: Cisco Security Advisory
by Larry Sheldon 29 Mar '14

29 Mar '14

On 3/29/2014 12:43 AM, Mark Tinka wrote: > But clearly, this is one of those issues where you have a > good amount of folk on either side of the fence. I wonder what the ratio of "I don't want that info here" (for various values of "here") to "Geeeeeez! WHY didn't somebody tell me" is. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0