- Test - lists.nanog.org

Juniper MX960 with SCB-E vs Cisco ASR9k with RSP400
by Abdelkader Chikh Daho 29 Apr '12

29 Apr '12

Hi everyone, I wan to ask for your feedback about these two devices : Juniper MX960 with SCB-E and Cisco AS9k with RSP400. Best regards, -- Abdelkader Chikh Daho Network Architect iWeb Technologies Email : achikhdaho(a)iweb.com Web : www.iweb.com Tel : 514-286-4242 ext 2309

2 1

Need spamcop/ironport security contact
by Mike 28 Apr '12

28 Apr '12

I have a security incident to report and need to make contact with a senior level contact responsible for spamcop/ironport immediately. Thank you.

3 2

Re: Need spamcop/ironport security contact
by Stephane Bortzmeyer 28 Apr '12

28 Apr '12

On Fri, Apr 27, 2012 at 11:41:57PM -0400, Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> wrote a message of 33 lines which said: > > I have a security incident to report and need to make contact with > > a senior level contact responsible for spamcop/ironport > > immediately. > > And you need a *senior* level contact, why? He probably meant "someone who has seen an IP address before", not level1-support.

2 1

Re: rpki vs. secure dns?
by Stephane Bortzmeyer 28 Apr '12

28 Apr '12

On Sat, Apr 28, 2012 at 12:34:52PM +0200, Alex Band <alexb(a)ripe.net> wrote a message of 41 lines which said: > In reality, since the RIRs launched an RPKI production service on 1 > Jan 2011, adoption has been incredibly good (for example compared to > IPv6 and DNSSEC). More than 1500 ISPs and large organizations > world-wide have opted-in to the system and requested a resource > certificate using the hosted service, or running an open source > package with their own CA. I have an experience with the deployment of DNSSEC and the problem with DNSSEC was not to have signed zones (many are, now) but to have people *using* these signatures to check the data (i.e. validating in a resolver). RPKI has many ROA (signed objects) but how many operators validate routes on their production routers? Zero? > But it's not just that, these ISPs didn't just blindly get > certificate and walk away. Most of the ROAs are very recent. Again, the experience with DNSSEC shows that starting is easy ("DNSSEC in siw minutes"). It's long term management which is *the* problem. Wait until people start to change the routing data and watch the ROAs becoming less and less correct... > Data quality is really good. It's not what you said: "It is safe to say that overall data quality is pretty bad" <https://labs.ripe.net/Members/AlexBand/resource-certification-rpki-in-the-r…> (good paper, by the way, thanks)

2 1

Re: rpki vs. secure dns?
by Stephane Bortzmeyer 28 Apr '12

28 Apr '12

On Sat, Apr 28, 2012 at 01:17:10PM +0300, Saku Ytti <saku(a)ytti.fi> wrote a message of 27 lines which said: > I think ROVER is better solution, doesn't need any changes to BGP > just little software magic when accepting routes. I like Rover but RPKI+ROA does not change BGP either (it will be a different story with BGPsec). > People might scared to rely on DNS on accepting routes, but is this > really an issue? RPKI+ROA depends on DNS too, since rsync://rpki.ripe.net/repository will work only if DNS works. Not a problem in practice, since route origins do not change every minute and the validating ROA cache can work even if it can no longer update its data. Same thing with Rover: temporary glitches in the DNS are not a practical problem (the router keeps the old info). > routes which fail authorization are logged but accepted if there > wasn't pre-existing covering route. Only drop routes if they fail > authorization _AND_ there is pre-existing covering route. It is a bit more complicated: more-specific attacks, and so on. But, yes, you're right. As Alex Band says, Rover, RPKI and the IRR make (authenticated) statements about route origins. You then do what you want (what your boss wants? what the FBI wants?) with these statements (route-map, etc).

1 0

New IETF I-D: Security Implications of IPv6 on IPv4 networks
by Fernando Gont 28 Apr '12

28 Apr '12

Folks, We've published a new IETF I-D entitled "Security Implications of IPv6 on IPv4 networks". The I-D is available at: <http://www.ietf.org/id/draft-gont-opsec-ipv6-implications-on-ipv4-nets-00.t…> The Abstract of the I-D is: ---- cut here ---- This document discusses the security implications of native IPv6 support and IPv6 transition/co-existence technologies on "IPv4-only" networks, and describes possible mitigations for the aforementioned issues. ---- cut here ---- Any feedback will be very welcome. Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 1

Vendor IPv6 RA Guard Support
by Christopher J. Pilkington 28 Apr '12

28 Apr '12

Does there exist a multi-vendor list showing whether a particular switch hardware/software supports or does not support RA Guard? -cjp

3 2

Re: rpki vs. secure dns?
by Stephane Bortzmeyer 28 Apr '12

28 Apr '12

On Sat, Apr 28, 2012 at 03:04:07AM -0700, Randy Bush <randy(a)psg.com> wrote a message of 9 lines which said: > draft-bates-bgp4-nlri-orig-verif-00.txt was '98 > > and we dropped it for good reasons Unfortunately, we have RFCs for good ideas but bad ideas never get documented by the IETF (one of the few exceptions is RFC 3197). So, bad ideas keep coming back and back again. Would you explain in a few words why this was a bad idea? I personally find Rover a very interesting idea, and which seems realistic.

1 0

Squeezing IPs out of ARIN
by admin＠thecpaneladmin.com 28 Apr '12

28 Apr '12

Anyone have any tips for getting IPs from ARIN? For an end-user allocation they are requesting that we provide customer names for existing allocations, which is information that will take a while to obtain. They are insisting that this is standard process and something that everyone does when requesting IPs. Has anyone actually had to do this?

22 49

Re: Operation Ghost Click
by A. Pishdadi 28 Apr '12

28 Apr '12

On Fri, Apr 27, 2012 at 10:55 PM, <Valdis.Kletnieks(a)vt.edu> wrote: > On Fri, 27 Apr 2012 21:39:20 -0500, you said: > > > 3) Many times, there are multiple customer computers behind a NAT. Do you > really want the hassle of an irate user calling in because you just broke > the > dad's VPN to work, because one of their kids has some cruft on their > computer? > (And no, don't try to tell them they should have bought business class > service > or similar crap, that *will* lose you a customer). > > > The malware isn't infecting the end-uses router therefore if there is multiple users behind that NAT'd router as long as there not infected they won't be shut off when those DNS servers go dark. And if daddy is dumb enough to let his 8 year old son use his PC or laptop w/o proper monitoring and gets infected thats his fault. I know I dont let my 10 year old use my work computers , and he knows how to code , but he is still a child and clicks stupid things. Your basically telling me the ISPs should not take any responsibility, well then how can we get pissed off when a host lets a spammer spam for a week straight and is aware and doesn't shut them off, or notices a DDOS attack is stemming from there network, a customer has 5-6 servers he pays for with unmetered gigabit ports and is clearly blasting someone to hell and back with spoofed packets , but because there margins are so thin they shouldn't turn him off and cancel him so they do not have to cut into there 'margins'... In the network world your either on the content side or the eyeball side, and the eyeball networks seem to have double standards when it comes to network abuse. Until this ends and the double standards stop the amount of malware and attacks will never go decrease. I say to your 'it costs the isp money' to do cleanup, that it costs content providers money to do cleanup of constantly being scanned and probed and hacked by what is mostly hacked end-user machines who got owned browsing the internet because they went to a website that had a virus installed by another end-users machine who was compromised the same way, its a vicious circle and as an operator of a content provider im tired of the other half of the internet not taking there share of the responsibility. /End of rant..

1 0