- Test - lists.nanog.org

Reachability issue 193.56.43.0/24AS25186 from AS701
by Jérôme Nicolle 02 Apr '12

02 Apr '12

Hi, Just changed the upstream for this network and a few customers can't reach our services anymore. According to RIPE stats, reachability, is not optimal on the north american zone, but is perfect everywhere else (see https://stat.ripe.net/193.56.43.124) One of the complaining customer is on AS1660 and the route breaks within AS701. Could anyone confirm the reachability for this prefix from the US ? Anyone at Verizon to check and fix if necessary ? Thanks ! -- Jérôme Nicolle +33 6 19 31 27 14

2 2

French Regulator to ask all your information about your Peering
by Raphael MAUNIER 02 Apr '12

02 Apr '12

Hello All, This is now the end. The French regulator ( Arcep ) is now asking all the people with an ASN in France ( with a L33 license ) to get all their information on their peering. The Arcep claim it's for the "net neutrality" and still don't understand it works because it's self regulated. So, some of US network with a L33 License will also have to respond ( obligation because you have the L33-1) The documents can be downloaded here http://www.arcep.fr/index.php?id=8571&L=&tx_gsactualite_pi1[uid]=1508&tx_gs actualite_pi1[backID]=1&cHash=ed82d44a55 : ( french for now, english courtesy version will come soon ) The document is asking for informations like : BW, Prices, contract or not, level of use, date of the contract S You have to give them information twice a year We ( @Neo Telecoms ) and other folks in France will probably setup something with other carriers ( I already had some discussion with some of you ) to talk to them on a single voice. -- Raphaël Maunier NEO TELECOMS CTO / Directeur Ingénierie AS8218

12 17

[NANOG-announce] NANOG 55 - Vancouver: Call For Presentations
by Dave Temkin 02 Apr '12

02 Apr '12

NANOG Community, After an awesome meeting in San Diego, we're already starting to get ready for NANOG 55 in Vancouver. If you have a topic you'd like to speak about, we'd love to consider it. Please watch http://www.nanog.org/meetings/nanog55/callforpresentations.html for more information. Please keep these important dates in mind: Presentation Abstracts and Draft Slides Due: 02-Apr-2012 Final Slides Due: 09-Apr-2012 Draft Program Published: 27-Apr-2012 Final Agenda Published: 15-May-2012 Please submit your materials to http://pc.nanog.org Looking forward to seeing everyone in San Diego. -Dave Temkin (Chair, NANOG Program Committee) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 1

RE: airFiber
by Nick Olsen 02 Apr '12

02 Apr '12

It will need perfect line of site. And won't deal with NLOS like most 2/5 ghz gear can. It's 24ghz. They claim 15Km. Maybe in the desert. In any climate with rain, Like our's here in Florida even 2 miles is going to be a stretch as 24ghz will rain fade easy. A great application for this would be like between two buildings requiring highspeed backhaul. (Were talking roof-top to roof-top of maybe a few thousand feet or more between them. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Drew Weaver" <drew.weaver(a)thenap.com> Sent: Thursday, March 29, 2012 1:27 PM To: "Jared Mauch" <jared(a)puck.nether.net>, "Eugen Leitl" <eugen(a)leitl.org> Subject: RE: airFiber I've read that it requires perfect line of sight, which makes it sometimes tricky. Thanks, -Drew -----Original Message----- From: Jared Mauch [mailto:jared@puck.nether.net] Sent: Thursday, March 29, 2012 12:45 PM To: Eugen Leitl Cc: NANOG list Subject: Re: airFiber On Thu, Mar 29, 2012 at 06:34:21PM +0200, Eugen Leitl wrote: > > Claim: 1.4 GBit/s over up to 13 km, 24 GHZ, @3 kUSD/link price point. > > http://www.ubnt.com/airfiber Yeah, I got this note the other day. I am very interested in hearing about folks experience with this hardware once it ships. I almost posted it in the last-mile thread. Even compared to other hardware in the space the price-performance of it for the bitrate is amazing. I also recommend watching the video they posted: http://www.ubnt.com/themes/ubiquiti/air-fiber-video.html You are leaving out that it's an unlicensed band, so you can use this to have a decent backhaul to your house just by rigging it yourself on each end. - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

11 10

April fools joke?
by Leigh Porter 02 Apr '12

02 Apr '12

http://www.bbc.co.uk/news/uk-politics-17576745 It's sad when you just can't tell with things like this.. -- Leigh ______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________

11 11

Outdoor Wireless Access Point
by Shahab Vahabzadeh 02 Apr '12

02 Apr '12

Hi there, I asked for a wireless solution for a university, in which they want indoor wireless solution for more than 5 building (at least two floor) and outdoor wireless solution for near 160m*280m garden. As I look for maps we need at least 3 or 4 outdoor radio, I think in these networks the best solution is to have only one SSID in whole network to give mobility for the network, is this called ad-hoc? or it has an other name? I do not know if I could ask question clearly or not, suppose we have 4 radio but only one SSID is broadcasting and when you are near the radio is near to you you will get service from that one, as this solution must be implement for indoor ones too. And if there is any good company which can both indoor and outdoor solution and they have shipping to Iran too or reseller in Iran please give me the url. Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: +1 (415) 871 0742 PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90

14 21

Handling of L2 broadcast, L3 unicast frames
by Saku Ytti 02 Apr '12

02 Apr '12

If you try % sudo ip route add 194.100.7.227/32 dev eth0 % sudo arp -i eth0 -s 194.100.7.227 ff:ff:ff:ff:ff:ff % ping 194.100.7.227 Chances are that you get ping replies (Cisco VXR, Cisco ISR, Juniper SRX, Juniper M10i, Juniper M7i, Linksys e4200) But you also might not be getting replies (Catalyst 7600, 3560, EX4200) RFC[0] says in rather unambiguous way, that this should not be working. I don't think catalyst/EX guys were lot smarter and honoured the RFC. Rather I think it's hardware limitation they work like this. At least 7600 (as per ELAM capture) acts like switch and tries to normally broadcast the frame in the VLAN, but as it is L3 interface, there is only one port in the VLAN, so net effect is, frame is dropped. Now I'm facing loop, which is caused by ill-configured network, by any networker definition of ill-configured. However, if our router would behave like RFC says, then the ill-configured network would not cause loops. This puts me in bit of a pickle, I can't call cisco and juniper and tell them to fix all their routers and give me fixed release tomorrow, since this behaviour seems very standard/de-facto behaviour. Customer refuses to do any of the fixes in the ill-configured network, as problem only started after swapping catalyst to ISR, so customer understandably does not grasp the fault is not in our end (it's not, fault is caused by mismatching L2/L3 topologies with directed-broadcast in customer router) Anyone else ever had problems due to router vendors not implementing rfc1812 5.3.4? [0] http://tools.ietf.org/html/rfc1812#section-5.3.4 -- ++ytti

1 0

Was b.root-servers.net under attack on Mar 31?
by Che-Hoo CHENG 02 Apr '12

02 Apr '12

http://dnsmon.ripe.net/dns-servmon/server/plot?server=b.root-servers.net;ty… There were quite a few unanswered queries from around 06:15 to around 09:15 UTC on Mar 31. Che-Hoo

2 1

RE: Outdoor Wireless Access Point
by Hal Murray 01 Apr '12

01 Apr '12

> Hi...How do I do it! > I'm utterly amazed how many people give away free consultant work. > We need to keep people working... not giving it away. > Ethics... Security... etc... > Does the university give away free diploma's? I don't think so. I don't expect a free diploma, but many universities are offering free internet videos of various classes. If you want a sample, here are a few good starting points: http://ocw.mit.edu/ http://oyc.yale.edu/ http://webcast.berkeley.edu/ -- These are my opinions, not necessarily my employer's. I hate spam.

2 1

STEP Security (RFC4012012)
by J. Oquendo 01 Apr '12

01 Apr '12

Interweb Re-Engineering Task Force J. Oquendo Request for Comments 4012012 E-Fensive Security Strategies Category: Informational Expires: 2020 STEP by STEP Security Status of this Memo This Internet-Draft is submitted in full nonconformance with provisions of BCP 78 and BCP 79. This document may not be modified, and derivative works of it may not be created, except to publish it as an RFC and to translate it into languages other than English. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html This Internet-Draft will expire on April 01, 2020. Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Oquendo Expires Apr 01, 2020 [Page 1] Internet-Draft Security Step by STEP RFC 4012012 Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Abstract This framework describes a practical methodology for ensuring security in otherwise insecure environments. The goal is to provide a rapid response mechanism to defend against the advanced persistent threats in the wild. Table of Contents 1. Introduction..................................................2 2. Conventions used in this document.............................4 3. Threats Explained.............................................4 3.1. Possible Actors..........................................4 4. STEP Explained................................................5 5. STEP in Action................................................6 6. Security Considerations.......................................7 7. IANA Considerations...........................................7 8. Conclusions...................................................8 8.1. Informative References...................................8 9. Acknowledgments...............................................8 Appendix A. Copyright............................................9 1. Introduction In the network and computing industry, malicious actions, applications and actors have become more pervasive. Response times to anomalous events are burdening today's infrastructures and often strain resources. As networks under attack are often saturated with malicious traffic and advanced persistent threat actors engage in downloading terabytes of data, resources to combat these threats have diminished. Additionally, the threats are no longer just anonymized actors engaging in juvenile behavior, there are many instances of State Actors, disgruntled employees, contractors, third party vendors and criminal organizations. Each with separate agendas, each consistently targeting devices on the Internet. Oquendo Informational [Page 2] Internet-Draft Security Step by STEP RFC 4012012 The intent behind this document is to define a methodology for rapid response to these threats. In this document, security will be achieved using a new methodology and protocol henceforth named Scissor To Ethernet Protocol (STEP). Initially designed as a last approach for security, STEP ensures that no attacker can disaffect any of the Confidentiality, Integrity, Availability of data as a whole. Many variables are involved in security, but the STEP methodology focuses on the following: o FUD (Fear Uncertainty and Doubt) o SCAM (Security Compliance and Management) o APT (Another Possible Threat) This methodology proposes STEP that SHOULD be performed at the onset of a cyber attack before more terabytes of data are exfiltrated from a network. 1. Industry Standard IP connection +-----------+ +-----------+ +-----------+ | | IP | | INGRESS | | | Rogue |-------> | Internet | ------> | Target | | A | | | | B | | | | | EGRESS | | +-----------+ +-----------+ <------ +-----------+ Figure 1 Example session between a rogue attacker and target Figure 1 illustrates the connection via the Internet from a rogue attacker, towards a target. Irrespective of the attack used, IP will ALWAYS be used as the attack vector. Oquendo Informational [Page 3] Internet-Draft Security Step by STEP RFC 4012012 2. Conventions used in this document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC-2119 [RFC2119]. In this document, these words will appear with that interpretation only when in ALL CAPS. Lower case uses of these words are not to be interpreted as carrying RFC-2119 significance. 3. Threats Explained A security threat is a theoretical happening that may not occur but should be considered as part of a proper security architecture and design. For example, the threat always exists that your systems will become the target of a denial of service attack. A threat may or may not have a method to mitigate the possibility of attack. Vendors across the security spectrum offer FUD based solutions often promoting SCAM based systems to mitigate against APT. While some of the available solutions may minimize the potential for catastrophic transfers of terabytes of data, these solutions SHOULD NOT be used as an all-inclusive solution for security. Engineers MUST NOT rely on FUD, or SCAMs against the APT. 3.1. Possible Actors Both malicious attacks and unintended (non-malicious) attacks can occur from anywhere in the world including local attacks inside of the infrastructure. In the barest threat explanation above, the threat that someone can commit a typographical error, causing a disruption in service, is as severe as a Distributed Denial of Service attack from the public Internet. Actors can never be easily identified unless one is watching the Academy Awards on television. Oquendo Informational [Page 4] Internet-Draft Security Step by STEP RFC 4012012 4. STEP Explained o S - Scissors Scissors as defined by wikipedia are" hand-operated cutting instruments. They consist of a pair of metal blades pivoted so that the sharpened edges slide against each other when the handles (bows) opposite to the pivot are closed. Scissors are used for cutting various thin materials, such as paper, cardboard, metal foil, thin plastic, cloth, rope, and wire. Scissors can also be used to cut hair and food. Scissors and shears are functionally equivalent, but larger implements tend to be called shears. Scissors is a critical component for STEP security and MUST be readily available 99.99999% with redundant scissors within arm�..s reach. | | X X / \ O O (Opened) (Closed) o T - To To: [preposition] (Used for expressing direction or motion or direction toward something) in the direction of; toward: from north to south. o E - Ethernet Ethernet via Wikiepedia is described as a family of computer networking technologies for local area networks (LANs) commercially introduced in 1980. Standardized in IEEE 802.3, Ethernet has largely replaced competing wired LAN technologies. For clarity in our protocol, Ethernet is defined as the cabling between a device and a network component such as a router or a switch. o P - Protocol A communications protocol is a system of digital message formats and rules for exchanging those messages in or between computing systems and in telecommunications. A protocol may have a formal description. Oquendo Informational [Page 5] Internet-Draft Security Step by STEP RFC 4012012 Protocols may include signaling, authentication and error detection and correction capabilities. A protocol definition defines the syntax, semantics, and synchronization of communication; the specified behavior is typically independent of how it is to be implemented. A protocol can therefore be implemented as hardware or software or both. In STEP, Protocol is a rule an engineer MUST follow in order to complete STEP. S MUST be in a closed state. Actor -----> | Target (secured from the threat) X O O (Closed) 5. STEP in Action The following illustrates a remote APT attack against a webserver located in the demilitarized zone of an infrastucture. In the example, an APT attacker is launching a SQLI, XSS and CSRF against a target over the Internet. The attacks are common and according to statistics, are the same attacks used to leverage access against major Fortune 500 companies in the past decade. +-------+ +-----+ +-----+ +--------+ | | SQLi | | + + INGRESS | | | APT | -------> | ISP | ---> + ISP + ------> | Target | | | XSS/CSRF | A | + B + | www | | | | | + + | | +-------+ +-----+ +-----+ +--------+ o Figure 5.1 Attacker launching attacks +-------+ +-----+ +-----+ +--------+ | | TCP | | + + Reverse | | | APT | <------ | ISP | <--- + ISP + <------ | Target | | | | A | + B + Shell | www | | | | | + + | | +-------+ +-----+ +-----+ +--------+ o Figure 5.2 Attacker executing a reverse shell Oquendo Informational [Page 6] Internet-Draft Security Step by STEP RFC 4012012 In the illustration, an attacker is almost certainly attempting to obtain a reverse shell. This enables an attacker to access a device as if one were physically present at the device itself. Using STEP we can mitigate and deny this attack from various points: +-------+ +-----+ +-----+ +--------+ | | SQLi | | + + | | | | APT | -------> | ISP | ---> + ISP + -->| | Target | | | XSS/CSRF | A | + B + x | www | | | | | + + o o | | +-------+ +-----+ +-----+ +--------+ o Figure 5.2 Ingress STEP +-------+ +-----+ +-----+ +--------+ | | Attack | | | + + | | | APT | ------> | ISP | ->| + ISP + | Target | | | | A | x + B + | www | | | | | o o + + | | +-------+ +-----+ +-----+ +--------+ o Figure 5.4 Provider based STEP Both instances of STEP successfully demonstrate the power of the STEP protocol. In no case, can an attacker successfully launch any attack against a target as the security posture has now been hardened. 6. Security Considerations Cutting any Ethernet cable could potentially lead to shock and degradation of IP services on your network. Please ensure there are additional Ethernet cables for redundancy. Otherwise there is nothing to consider. 7. IANA Considerations There are no alternative considerations. STEP is the ultimate in security. Oquendo Informational [Page 7] Internet-Draft Security Step by STEP RFC 4012012 8. Conclusions Step defends against APT while minimizing your exposure to SCAMs and FUD. 8.1. Informative References [1] http://www.amazon.com/b?ie=UTF8&node=689392011 [2] http://ha.ckers.org/xss.html [3] http://en.wikipedia.org/wiki/Advanced_persistent_threat [4] http://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt 9. Acknowledgments Sofia Vergara Kenji, Saki and Coco Oquendo Informational [Page 8] Internet-Draft Security Step by STEP RFC 4012012 Appendix A. Copyright Copyright (c) 2012 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: o Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. o Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. o Neither the name of Internet Society, IETF or IETF Trust, nor the names of specific contributors, may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Author's Addresses Jesus Oquendo E-Fensive Security Strategies Oquendo Informational [Page 9]

2 1