- Test - lists.nanog.org

Re: "Programmers can't get IPv6 thus that is why they do not have IPv6 in their applications"....
by David Barak 31 Jan '13

31 Jan '13

Comcast removed the "no IPv6" excuse? That removal somehow skipped my house in Washington DC where they installed (last October) a router which does not even support it (an Arrus voice gateway- the one where you can't turn of the crummy 2.4g wireless radio) and none of the folks I've spoken to on the phone can tell me when or if it will be coming. I look forward to Comcast giving me native v6 at home. David Barak

6 9

DDoS Attacks Cause of Game Servers
by Shahab Vahabzadeh 31 Jan '13

31 Jan '13

Hi everybody, Last two days I was under an interesting attack which comes from multiple sources to three of my ADSL users destination. The attack make router to ran out of CPU and we had to reload it to solve. I ask those three users and they said we are only game players and all of them were kids, I think they told the true, they told we are playing: http://intl.garena.com/ Attacks takes only 20 or 30 minutes and it happens only 4 times in two days. I could'nt capture any packet but this is out put of my "show ip accounting" that time: Source Destination Packets Bytes 212.180.138.90 128.141.119.209 117 5148 135.62.255.246 128.141.119.209 117 5148 46.136.27.13 128.141.119.209 117 5148 25.181.84.74 128.141.119.209 117 5148 108.0.207.17 128.141.119.209 117 5148 181.95.89.1 128.141.119.209 117 5148 36.161.28.42 128.141.119.209 117 5148 39.130.139.157 128.141.119.209 117 5148 139.81.4.106 128.141.119.209 117 5148 3.229.28.78 128.141.119.209 117 5148 115.28.11.208 128.141.119.209 117 5148 206.42.151.199 128.141.119.209 117 5148 213.221.149.41 128.141.119.209 117 5148 81.203.234.196 128.140.109.209 117 5148 43.134.71.94 128.141.119.209 117 5148 157.69.74.39 128.141.119.209 117 5148 16.206.47.71 128.141.119.209 117 5148 77.25.17.243 128.141.119.209 117 5148 If you have any information in this field and you can help me to find who is behind this, please share. Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: +1 (415) 871 0742 PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90

6 7

Juniper MX10 and dual stack BGP
by Christopher Rogers 31 Jan '13

31 Jan '13

Does anyone have any sort of performance numbers for the jnpr MX10 series running dual stack ipv4/ipv6? I'm specifically interested in how many BGP prefixes it can handle in dual stacked mode. I've got an environment currently taking 4 full ipv4 tables and a smattering of prefixes coming from a public peering exchange, and I'm curious what will happen if we move to dual stack... thanks! -chris

4 3

Will wholesale-only muni actually bring the boys to your yard?
by Jay Ashworth 31 Jan '13

31 Jan '13

----- Original Message ----- > From: "Jean-Francois Mezei" <jfmezei_nanog(a)vaxination.ca> > It is in fact important for a government (municipal, state/privince or > federal) to stay at a last mile layer 2 service with no retail > offering. Wholesale only. > > Not only is the last mile competitively neutral because it is not > involved in retail, but it them invites competition by allowing many > service providers to provide retail services over the last mile > network. This, Jean-Francois, is the assertion I hear relatively frequently. It rings true to me, in general, and I would go that way... but there is a sting in that tail: Can I reasonably expect that Road Runner will in fact be technically equipped and inclined to meet me to get my residents as subscribers? Especially if they're already built HFC in much to all of my municipality? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

9 17

Re: Suggestions for the future on your web site: (was cookies, and before that Re: Dreamhost hijacking my prefix...)
by Scott Weeks 31 Jan '13

31 Jan '13

------- mpalmer(a)hezmatt.org wrote: ------- From: Matt Palmer <mpalmer(a)hezmatt.org> [Cookies on stat.ripe.net] On Wed, Jan 16, 2013 at 11:36:25AM -0800, Shrdlu wrote: > The cookie stays around for a YEAR (if I let it), and has the > following stuff: CSRF protection is one of the few valid uses of a cookie. <snip> By the way, if anyone *does* know of a good and reliable way to prevent CSRF without the need for any cookies or persistent server-side session state, I'd love to know how. Ten minutes with Google hasn't provided any useful information. ----------------------------------------- But, if I understand correctly, it only only if you are authenticated can anything bad be made to happen: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 "CSRF attacks generally target functions that cause a state change on the server but can also be used to access sensitive data. For most sites, browsers will automatically include with such requests any credentials associated with the site, such as the user's session cookie, basic auth credentials, IP address, Windows domain credentials, etc. Therefore, if the user is currently authenticated to the site, the site will have no way to distinguish this from a legitimate user request. In this way, the attacker can make the victim perform actions that they didn't intend to, such as logout, purchase item, change account information, retrieve account information, or any other function provided by the vulnerable website." So, if someone is just looking around, why is the cookie needed? scott

13 27

Calix optics for Muni
by Jay Ashworth 31 Jan '13

31 Jan '13

The box Jason was telling me about was the Calix 836GE, which, Leo, will make you happy cause it's a router/wifi/bridge with what looks to me like a Duplex-LC connector on the back. Its companion is their E7-20, a 20-slot chassis that will do (presently) 480 home-run ports or 10k GPONs in what looks like about 10U; double density linecards (which might well be just bidirectional optics, though the front panels don't look at all crowded just now) are in the pipe. If anyone's got this stuff deployed, and can whisper in my ear offlist a rough estimate of what price class it's in, that'd be neat. Yes, Calix reps are on the list; remember; I'm a 24-month client, minimum. Probably 36. Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

1 0

Looking for contact at COGENT routing team
by tglassey 31 Jan '13

31 Jan '13

I am looking for a contact at Cogent's route management team if you have one? Todd -- Regards TSG "Ex-Cruce-Leo" //Confidential Mailing - Please destroy this if you are not the intended recipient.

1 0

Time warner cable contact
by Emil Fredriksson 30 Jan '13

30 Jan '13

Hi Could someone from TWC contact me off list please. Trying to diagnose an issue where TWC customers can not reach my network. Much appreciated //Emil

1 0

IPV6 in enterprise best practices/white papaers
by Pavel Dimow 30 Jan '13

30 Jan '13

Hi, I have read many of those ipv6 documents and they are great but I still luck to find something like "real word" scenario. What I mean is that for example I want to start implementation of ipv6 in my enterprise according to mu knowledge so far my first step is to create address plan, then implement security on routers/switches then on hosts, and after that I can start to create AAAA record and PTR recors in DNS and after that I should configure my dhcp servers and after all has been done I can test ipv6 in LAN and after that I can start configure bgp with ISP. Is this correct procedure? Any thoughts? If all is correct I have a few questions.. Regarding DNS, if I give a /64 to host using SLAAC or DHCP how do I maintain PTR for this /64? I should use DDNS? What do you use in your enterprise SLAAC or DHCP? If SLAAC why not DHCP? Any other hints/tips?

23 49

Google's Public DNS does DNSSEC validation
by Marco Davids 30 Jan '13

30 Jan '13

This is interesting news; it seems that Google's Public DNS is performing DNSSEC validation (when the DO-bit is set): dig +dnssec +multi www.dnssec.nl @8.8.8.8 ; <<>> DiG 9.9.1-vjs163.18-P1 <<>> +dnssec +multi www.dnssec.nl @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51937 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;www.dnssec.nl. IN A ;; ANSWER SECTION: www.dnssec.nl. 21580 IN A 213.154.228.160 www.dnssec.nl. 21580 IN RRSIG A 8 3 86400 ( 20130227071505 20130128071505 33084 dnssec.nl. J9MzudQJHT7UEFZDxioAeOSARqvN87stHIiXLdl1f6ZB I3UGSqKIOlYpuaM7a6jk8k8oajUkGEHGOxa9ypJQHvlv mAE6noaI5sZh6R6lnkd48zGs/xPg4BNODG2zNb3I/lQ3 2ojQtcs9AIMDEtH5+XISuwvPre5hhYkneM6mtUc= ) ;; Query time: 28 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Tue Jan 29 08:03:53 2013 ;; MSG SIZE rcvd: 227 -- Marco Davids

5 4