- Test - lists.nanog.org

Network anomaly survey - evaluation and results
by Jan Rejchrt 06 Mar '14

06 Mar '14

Dear network experts, few months ago we conducted a survey regarding network anomalies. We'd like to provide you with our findings that you can find at RIPE Labs page: https://labs.ripe.net/Members/jan_rejchrt/network-anomaly-detection-2013-su… I'd like to thank all the participants. Best regards, Jan Rejchrt On behalf of CSIRT-MU -- Mgr. Jan Rejchrt rejchrt(a)ics.muni.cz Security Department, CSIRT-MU group http://csirt.muni.cz Institute of Computer Science, Masaryk University, Brno, Czech Republic PGP Key ID: 0x9B5724C8

1 0

Fwd: [ PRIVACY Forum ] Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping
by Jay Ashworth 06 Mar '14

06 Mar '14

Oh hell. Is this the *same* bug that just broke in Apple code last week? Cheers, -- jra ----- Forwarded Message ----- > From: "PRIVACY Forum mailing list" <privacy(a)vortex.com> > To: privacy-list(a)vortex.com > Sent: Tuesday, March 4, 2014 3:17:43 PM > Subject: [ PRIVACY Forum ] Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping > Critical crypto bug leaves Linux, hundreds of apps open to > eavesdropping > > http://j.mp/1jPcVOr (Ars Technica) > > "Hundreds of open source packages, including the Red Hat, Ubuntu, and > Debian distributions of Linux, are susceptible to attacks that > circumvent the most widely used technology to prevent eavesdropping on > the Internet, thanks to an extremely critical vulnerability in a > widely used cryptographic code library. The bug in the GnuTLS library > makes it trivial for attackers to bypass secure sockets layer (SSL) > and Transport Layer Security (TLS) protections available on websites > that depend on the open source package. Initial estimates included in > Internet discussions such as this one indicate that more than 200 > different operating systems or applications rely on GnuTLS to > implement crucial SSL and TLS operations, but it wouldn't be > surprising if the actual number is much higher. Web applications, > e-mail programs, and other code that use the library are vulnerable to > exploits that allow attackers monitoring connections to silently > decode encrypted traffic passing between end users and servers. The > bug is the result of commands in a section of the GnuTLS code that > verify the authenticity of TLS certificates, which are often known > simply as X509 certificates." > > - - - > > --Lauren-- > Lauren Weinstein (lauren(a)vortex.com) http://www.vortex.com/lauren > Co-Founder: People For Internet Responsibility: > http://www.pfir.org/pfir-info > Founder: > - Network Neutrality Squad: http://www.nnsquad.org > - PRIVACY Forum: http://www.vortex.com/privacy-info > Member: ACM Committee on Computers and Public Policy > Lauren's Blog: http://lauren.vortex.com > Google+: http://google.com/+LaurenWeinstein > Twitter: http://twitter.com/laurenweinstein > Tel: +1 (818) 225-2800 / Skype: vortex.com > _______________________________________________ > privacy mailing list > http://lists.vortex.com/mailman/listinfo/privacy -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

6 9

Any CenturyLink IPv6 engineers/tech people around?
by Brielle Bruns 05 Mar '14

05 Mar '14

Hello all, Don't suppose there's any CenturyLink engineers/tech people on this list that can look into a problem with their IPv6 6rd service? Got multiple customers on CenturyLink (including myself), with IPv6 through their 6rd service since native isn't available yet. IPv6 assignments from one customer can't talk to IPv6 assignments on another CL customer. Seems to be in the 6rd server end doing it, as I can set up a direct tunnel between customers and it passes IPv6 traffic normally. I can provide more details and some tests if needed from my end. Thanks! -- Brielle Bruns The Summit Open Source Development Group http://www.sosdg.org / http://www.ahbl.org

1 1

AT&T uverse ipv6 engineer
by Andrew D Kirch 05 Mar '14

05 Mar '14

Would an AT&T engineer who deals with uverse IPv6 please contact me off list? I'm getting horrible throughput on your 6RD. Thanks! Andrew

1 0

Hackers hijack 300, 000-plus wireless routers, make malicious changes | Ars Technica
by Jay Ashworth 04 Mar '14

04 Mar '14

http://arstechnica.com/security/2014/03/hackers-hijack-300000-plus-wireless… Is there any valid reason not to black hole those /32s on the back bone? -- Sent from my Android phone with K-9 Mail. Please excuse my brevity.

13 15

Re: Hackers hijack 300, 000-plus wireless routers, make malicious changes | Ars Technica
by Jay Ashworth 04 Mar '14

04 Mar '14

----- Original Message ----- > From: "Andrew Latham" <lathama(a)gmail.com> > > you wanted to say "blackhole those 5.45.72.0/22 and 5.45.76.0/22", > Jay is right, it is just the /32s at the moment... Dropping the /22s > could cause other sites to be blocked. > > inetnum: 5.45.72.0 - 5.45.75.255 > netname: INFERNO-NL-DE > descr: ******************************************************** > descr: * We provide virtual and dedicated servers on this Subnet. > descr: * > descr: * Those services are self managed by our customers > descr: * therefore, we are not using this IP space ourselves > descr: * and it could be assigned to various end customers. > descr: * > descr: * In case of issues related with SPAM, Fraud, > descr: * Phishing, DDoS, portscans or others, > descr: * feel free to contact us with relevant info > descr: * and we will shut down this server: abuse(a)3nt.com > descr: ******************************************************** > country: NL > admin-c: TNTS-RIPE > tech-c: TNTS-RIPE > status: ASSIGNED PA > mnt-by: MNT-3NT > mnt-routes: serverius-mnt > source: RIPE # Filtered Though, for the record, I see I have ssh bruteforce in my logs this week from 5.39.223.8; what it is with 5/8 this month? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

1 0

ISP inbound failover without BGP
by Eric A Louie 04 Mar '14

04 Mar '14

This may sound like dumb question, but... I'm used to asking those. Here's the scenario Another ISP, say AT&T, is the primary ISP for a customer. Customer has publicly accessible servers in their office, using the AT&T address space. I am the customer's secondary ISP. Now, if AT&T link fails, I can provide the customer outbound Internet access fairly easily. So they can surf and get to the Internet. What about the publicly accessible servers that have AT&T addresses, though? One thought I had was having them use Dynamic DNS service. Are there any other solutions, short of using BGP multihoming and having them try to get their own ASN and IPv4 /24 block? It looks like a few router manufacturers have devices that might work, but it looks like a short DNS TTL (or Dynamic DNS) needs to be set so when the primary ISP fails, the secondary ISP address is advertised.

13 16

AS path not optimal
by ku po 04 Mar '14

04 Mar '14

One of my client has peering with nlayer and a provider from Asia. It seems from one major ISP in US, the best path is through this Asia provider, instead of through nlayer which we want it to be. It seems this major ISP does not have a direct peering with nlayer AS 4436 is the cause of this problem. What is the best way to address this problem?

3 2

Re: ISP inbound failover without BGP
by Hank Nussbacher 04 Mar '14

04 Mar '14

Have them look at radware linkproof which is designed for small shops that don't want to do bgp and getting their own ASN and pi address space. Been around since 1999. http://www.radware.com/Products/LinkProof/ Hank On Mar 4, 2014 3:11 AM, Eric A Louie <elouie(a)yahoo.com> wrote: > > This may sound like dumb question, but... I'm used to asking those. > > Here's the scenario > > Another ISP, say AT&T, is the primary ISP for a customer. > > Customer has publicly accessible servers in their office, using the AT&T address space. > > I am the customer's secondary ISP. > > Now, if AT&T link fails, I can provide the customer outbound Internet access fairly easily. So they can surf and get to the Internet. > > What about the publicly accessible servers that have AT&T addresses, though? > > One thought I had was having them use Dynamic DNS service. > > Are there any other solutions, short of using BGP multihoming and having them try to get their own ASN and IPv4 /24 block? > > It looks like a few router manufacturers have devices that might work, but it looks like a short DNS TTL (or Dynamic DNS) needs to be set so when the primary ISP fails, the secondary ISP address is advertised.

1 0

re: DSLAM
by Nick Olsen 03 Mar '14

03 Mar '14

Thanks to all that replied. Specially Eric @ Luma Optics. We've reached the cut off date for day. We're working on fixing the DSLAM we have on hand for use. I appreciate all the replies. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Nick Olsen" <nick(a)flhsi.com> Sent: Monday, March 03, 2014 3:40 PM To: nanog(a)nanog.org Subject: DSLAM Hey Guys, I need a 24 port ADSL (2, +, It's all the same in my book) DSLAM. And I need it by tomorrow. Normal channels seem to be impacted by weather. Not to mention we've been pretty unhappy with our current models (Versa, And Planet). Any options? Unicast is acceptable. Nick Olsen Network Operations (855) FLSPEED x106

1 0