- Test - lists.nanog.org

MikroTik + EAP-TLS + Non-Channel 1 / Apple iOS issues
by Thomas York 03 Apr '13

03 Apr '13

I know a few of you guys are using MikroTik offerings in the enterprise, so I hope to pick your brain(s). I have many, many RB433UAH's deployed worldwide as simple WAPs. I've been looking to move to 802.1x EAP-TLS via an external FreeRadius server. I have our HP Procurves using the FreeRadius server without issue. Infact, the only devices that seem to have issues are the MikroTik devices. For one, only channel 1 seems to work with 802.1x. If I change the channel to ANYTHING else, clients refuse to auth. Secondly, newer iOS devices (iOS 5 and newer, I believe) refuse to auth entirely. I have an older iPod touch that is on iOS4 that can authenticate on channel 1. Have any of you guys seen issues like this? Thanks. -- Thomas York

2 1

Mikrotik visibility
by Beavis 03 Apr '13

03 Apr '13

Hello All, I would like to ask if there are any folks out there that use any specific tool (OpenSource/Closed) that is used for mikrotik routers. I need packet visibility (ala netflow) or anything similar to that effect. any suggestions are greatly appreciated. cheers, -Beavis -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Disclaimer: http://goldmark.org/jeff/stupid-disclaimers/

4 4

public consultation on root zone KSK rollover
by Joe Abley 03 Apr '13

03 Apr '13

Hi all, As advised a month or so ago, the following public comment period is open: http://www.icann.org/en/news/public-comment/root-zone-consultation-08mar13-… We have received a small number of responses which are accessible from that page. The topic at hand and the specific questions that have been asked as part of the consultation are important ones; the decisions taken will have operational consequences to any user of the Internet who validates DNS responses with DNSSEC. If you have experience, opinions or expertise to contribute, it would be greatly appreciated. The window for being able to submit comments closes on 12 April 2013 at 23:59 UTC. Many thanks, Joe

1 0

Re: Speedtest Results speedtest.net vs Mikrotik bandwidth test
by Scott Weeks 03 Apr '13

03 Apr '13

------------------------ You might want to consider putting up a speedtest server internal to your network. I know there is a fee but well worth it I believe. You will ------------------------ I would consider NDT as well: www.internet2.edu/performance/ndt Last I checked, about 3 years ago, speedtest sent only latin text in large packets. NDT tests much more. The customers just use a web browser and the only caveat is they need to have Java working. Here's one to get a feeling of what your customers will see: http://ndt.anl.gov:7123 scott

2 1

Open Resolver Problems
by Jared Mauch 02 Apr '13

02 Apr '13

All, Open resolvers pose a security threat. I wanted to let everyone know about a search tool that can help you find the ones within your organization. Treat it like a big "BETA" stamp is across it, but please try it out and see if you can close down any hosts within your network. This threat is larger than the SMURF amplification attacks in the past and can result in some quite large attacks. I've seen this spilling out into other mailing lists (e.g.: juniper-nap and others). Please send feedback about links that should be included or documentation and spelling errors to me. openresolverproject.org Some basic stats: 27 million resolvers existed as of this dataset collection only 2.1 million of them were "closed". We have a lot to do to close the hosts, please do what you can to help. Thanks, - Jared

45 129

New Product Launch from 2600hz
by Joshua Goldbard 02 Apr '13

02 Apr '13

Hello, Normally I wouldn't bother the respected members of NANOG with a product launch email, but this is such a unique application that I felt it was necessary. 2600hz is saying goodbye to SMS, Voice and even Video. Today we're launching a service we'd like to call BrainRTC. It's going to completely revolutionize communications. Check it out here: http://blog.2600hz.com/post/46886639094/voice-and-video-are-dead-heres-the-… Cheers, Joshua Joshua Goldbard VP of Marketing, 2600hz 116 Natoma Street, Floor 2 San Francisco, CA, 94104 415.886.7923 | j(a)2600hz.com<mailto:j@2600hz.com>

5 4

BCP38 tester?
by Jay Ashworth 02 Apr '13

02 Apr '13

Is there a program which users can run on an end-site workstation which would test whether they are being some link which is doing BCP38, or some related type of source-address ingress filtering? I'm hoping for something that could be downloaded by users and run, and try to forge a few packets to somewhere useful, which could be logged somehow in conjunction with some unforged packets containing a traceroute, so we could build up a database of leaky networks. On a related topic, while I know GRC Research's Steve Gibson is a bit of a polarizing personality, he does have a fairly sizable consumer audience, and might be a great distribution venue for such a thing. Or, perhaps, is there someone on here from Ookla? Patrick? Could Akamai be persuaded to take an interest in this as a research project? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

12 24

FW: Open Resolver Problems
by Milt Aitken 02 Apr '13

02 Apr '13

Most of our DSL customers have modem/routers that resolve DNS externally. And most of those have no configuration option to stop it. So, we took the unfortunate step of ACL blocking DNS requests to & from the DSL network unless the requests are to our DNS servers. Suboptimal, but it stopped the DNS amplification attacks. -----Original Message----- From: Mikael Abrahamsson [mailto:swmike@swm.pp.se] Sent: Monday, April 01, 2013 11:51 AM To: Chris Boyd Cc: nanog(a)nanog.org Subject: Re: Open Resolver Problems On Mon, 1 Apr 2013, Chris Boyd wrote: > Just back to the office, and started checking my networks. Found one of > the resolvers is a Netgear SOHO NAT box. EoL'd, no new firmware > available. Anyone have any feeling for what percentage are these types > of boxes? If you buy "type of box" mean "small SOHO NAT router which does DNS resolving on the WAN interface" then I'd say "a lot". Someone does a rollout of new software and configuration and happens to mess up the config file (or the vendor just happens to enable global dns resolving in the new software) and this slips through testing, then you're there. I believe this happens all the time. That's why the publication of these lists are important, in a lot of cases there are a lot of people who are simply not aware of these devices doing this, and they need to be poked to notice. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

12 27

Re: RFC 1149
by Scott Weeks 02 Apr '13

02 Apr '13

--- eschwei(a)comcast.net wrote: From: "Ed Schweitzer" <eschwei(a)comcast.net> Given we are moving into the hurricanes season in a few months, I was wondering if this is now an accepted standard. I haven't seen many updates - it appears to be complete as is. ---------------------------------------- Itty bitty rocket motors. One on each wing tip. Just have to make sure they're balanced, so they don't go into routing loops. WMAP (wing motor aggregation protocol? :) scott

1 0

Re: New Product Launch from 2600hz
by Scott Weeks 02 Apr '13

02 Apr '13

--- j(a)2600hz.com wrote: From: Joshua Goldbard <j(a)2600hz.com> It's going to completely revolutionize communications. ------------------------------------------- Ummm, yeah. Lemme know how that goes for you... scott (but not on NANOG)

1 0