- Test - lists.nanog.org

RADB down?
by John van Oppen 05 Mar '08

05 Mar '08

Anyone else seeing the radb whois server as being down? -John

1 0

NANOG 42 IPv4 Exhaustion BoF
by Owen DeLong 04 Mar '08

04 Mar '08

The same text below was just posted to the ARIN PPML. It is being posted here because it relates to a BoF session held at NANOG 42. Follow-up should be exclusively on the ARIN PPML. Instructions for subscribing to PPML are at the bottom of this message. ================================ As most of you already know, members of the ARIN AC conducted a BoF session at NANOG 42 to try and gather additional community feedback about IPv4 Exhaustion, and, specifically, the AC Authored IPv4 transfer policy. Due to last minute scheduling, the BoF was held at a time which conflicted with the Peering BoF and the IPv6 Tutorial. Despite these conflicts, the BoF was surprisingly well attended and we were able to have a good and productive discussion. Early in the discussion, it was discovered that most present had not come to a clear understanding of the Transfer Policy Proposal. Some explanation and clarification was provided by various members of the AC. Some key provisions that were discussed were: + Requirement for both parties in a transfer to sign an RSA This is in keeping with preserving contractual parity in the transfer process. + Intent of the listing service The details of the listing service were omitted from the policy proposal due to time constraints and to preserve some flexibility to work with ARIN staff on the design and criteria to fully meet the needs of ARIN and the community. Generally, the expectation is that the listing service data will be as open and public as possible with the intent of allowing as much information as possible to potential transferors/transferees prior to engaging in the process. + Effects on Current policy Current merger/acquisition/divestiture policy remains unchanged. The proposed re-titling of the policy focused on merger/acquisition merely as an oversight, not in an intent to change the handling of such transfers. Hopefully this will be addressed in the next revision of the policy proposal. + Implementation date IANA Free pool runout was chosen because it is objectively factual. ARIN runout will be staggered with ARIN unable to issue larger blocks before it runs out of smaller ones. Additionally, using IANA runout allows the policy and associated market to kind of spin up and gain some experience before ARIN runs out. + Potential Legal Issues Nobody present at the BoF was prepared or qualified to speak on behalf of ARIN from a legal perspective. As a result, questions regarding legal ramifications were deferred as out of scope for the BoF session. ARIN Counsel will present a review of the proposed policy at the ARIN meeting in Denver. It will also be posted to the PPML. In general, the idea of a transfer policy was received with a neutral to positive response. There were no strong negative reactions expressed. There were several questions about likely efficacy and whether this policy would actually accomplish anything. Leo Bicknell made the point that without this policy or something like it, the world becomes set in stone after IPv4 runout. Haves have and have nots have not and there's no way for that to change. With this proposal, there's at least the possibility if folks can come to agreement on the subject. Thanks to everyone who attended the BoF. Your input was very useful to the AC. I encourage anyone interested in further participating in the policy process to subscribe to the ARIN PPML (http://lists.arin.net/mailman/listinfo/ppml) and post your comments there. Respectfully submitted, Owen DeLong ARIN AC

1 0

spammed by a hardware resale outfit...
by Robert E. Seastrom 03 Mar '08

03 Mar '08

Hi all, Received a spam-and-cold-call-to-my-cell-phone one-two-punch this morning by an unrepentant Michael Andolino from Network Liquidators, Inc. of Oldsmar, FL. Anyone else get an unlucky start to their Monday? I'm beginning to think that nanog.cluepon.net needs "good guys" and "bad guys" pages so that we can all make doubly sure we're not doing business with spammers (and just as importantly, a community resource for reviews of used equipment vendors). Thoughts? ---Rob

6 5

OT: One Wilshire photos.
by Roland Dobbins 03 Mar '08

03 Mar '08

<http://www.wired.com/techbiz/it/multimedia/2008/03/ gallery_one_wilshire> ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)cisco.com> // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcolm Forbes

4 3

NANOG 43 Brooklyn -- Call For Presenatations
by Todd Underwood 03 Mar '08

03 Mar '08

[puts NANOG Program Committee Chair hat on...] [Note the timeline below--this is an extremely compressed schedule]. The NANOG 43 conference will be held in Brooklyn, NY on June 1-3, 2008, to be sponsored by Telx (http://www.telx.com/) This is a particularly exciting NANOG for many attendees because it is the first time that NANOG has been held in New York City. This gives residents of that city (and the surrounding areas) an opportunity to attend NANOG on their home turf, and perhaps the opportunity to suggest content for the conference of particular relevance to the NYC area. It gives the rest of us a great reason to visit a city where mass transit doesn't shut down at night. The NANOG Program Committee (PC) is actively soliciting talks for that event and we have an extremely tight submission schedule. Some (of the many) ideas that we're considering for this NANOG include: * submarine cable systems. optics, phsysics, martime conditions, economics, services * interconnections. IXes, intra-building, MMR, metro-wide connections, peering, transit purchasing tactics and strategies * security. routing security (hijacking), route filtering of large peers/customers. inter-as security and cooperation. * dns. using dns data for network metrics, botnet discovery, geolocation and other fun. * ipv6. real-world deployment challenges. NAT-PT implementations that work and scale. allocation strategies. In general, we are seeking presentations by and for network operators of all sizes. We want to see presentations about difficult problems (and interesting solutions) that you encounter in the course of your job. We know it's always easier to get presentations from people who are paid to do it (vendors, marketing people) but attendees of previous NANOG conferences tell us that the best presentations are frequently by fellow operators. If you think you have an interesting topic but want some feedback or some help working it into a presentation, please email me and I'll make sure that someone on the PC gives you the feedback you need to work your idea into a presenatation worth giving. What do you get if you present? A free pass to NANOG, rock star status among your peers, and a permanent place of fame on the Internet. Also note that NANOG44 will be held in Los Angeles, jointly with ARIN on October 12-14. So mark your calendars. If you cannot present at NANOG43 Brooklyn, the PC is already actively soliciting talks for Los Angeles as well. Key dates for NANOG 43: NOW Web tool open to accept submissions http://www.nanogpc.org/ ***** [Rolling evaluation of talks begins] ***** ***** [Talks submitted earliest have the best chance of acceptance] ***** 14-Mar-08 Deadline for submissions. Talks submitted by the point will receive full consideration for a slot at NANOG43. 31-Mar-08 Draft Agenda Posted 4-Apr-08 Deadline for late submissions. Talks submitted by this deadline may be considered for open spots in the agenda. 24-Apr-08 Last scheduled PC call to finalize agenda. 29-Apr-08 Final agenda posted to NANOG mailing list. [Lighting talk evaluations begins] 01-June-08 - NANOG 43 begins! thanks, t. [that hat was bugging me] -- _____________________________________________________________________ todd underwood +1 603 643 9300 x101 renesys corporation general manager babbledog todd(a)renesys.com http://www.renesys.com/blog

2 2

RE: YouTube IP Hijacking
by Tomas L. Byrnes 03 Mar '08

03 Mar '08

Which means that, by advertising routes more specific than the ones they are poisoning, it may well be possible to restore universal connectivity to YouTube. > -----Original Message----- > From: Michael Smith [mailto:msmith@internap.com] > Sent: Sunday, February 24, 2008 1:23 PM > To: neil.fenemor(a)fx.net.nz; Tomas L. Byrnes > Cc: will(a)harg.net; nanog(a)merit.edu > Subject: Re: YouTube IP Hijacking > > Exactly... They inadvertently made the details of their > oppression more readily apparent... > > > ----- Original Message ----- > From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> > To: Tomas L. Byrnes <tomb(a)byrneit.net> > Cc: Will Hargrave <will(a)harg.net>; nanog(a)merit.edu <nanog(a)merit.edu> > Sent: Sun Feb 24 16:00:35 2008 > Subject: Re: YouTube IP Hijacking > > > While they are deliberately blocking Youtube nationally, I > suspect the wider issue has no malice, and is a case of > poorly constructed/ implemented outbound policies on their > part, and poorly constructed/ implemented inbound polices on > their upstreams part. > > On 25/02/2008, at 9:49 AM, Tomas L. Byrnes wrote: > > > > > Pakistan is deliberately blocking Youtube. > > > > http://politics.slashdot.org/article.pl?sid=08/02/24/1628213 > > > > Maybe we should all block Pakistan. > > > > > > > >> -----Original Message----- > >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > On Behalf > >> Of Will Hargrave > >> Sent: Sunday, February 24, 2008 12:39 PM > >> To: nanog(a)nanog.org > >> Subject: Re: YouTube IP Hijacking > >> > >> > >> Sargun Dhillon wrote: > >> > >>> So, it seems that youtube's ip block has been hijacked by a more > >>> specific prefix being advertised. This is a case of IP > >> hijacking, not > >>> case of DNS poisoning, youtube engineers doing something > >> stupid, etc. > >>> For people that don't know. The router will try to get the most > >>> specific prefix. This is by design, not by accident. > >> > >> You are making the assumption of malice when the more > likely cause is > >> one of accident on the part of probably stressed NOC staff > at 17557. > >> > >> They probably have that /24 going to a gateway walled garden box > >> which replies with a site saying 'we have banned this', > and that /24 > >> route is leaking outside of their AS via PCCW due to dodgy > >> filters/communities. > >> > >> Will > >> > > Neil Fenemor > FX Networks > > >

38 67

The Router Hacking Challenge is Over! (fwd)
by Gadi Evron 02 Mar '08

02 Mar '08

For those interested. ---------- Forwarded message ---------- Date: Sat, 1 Mar 2008 22:08:29 +0000 From: Petko D. Petkov <pdp.gnucitizen(a)googlemail.com> To: full-disclosure(a)lists.grok.org.uk, bugtraq(a)securityfocus.com Subject: The Router Hacking Challenge is Over! http://www.gnucitizen.org/projects/router-hacking-challenge/ The Router Hacking Challenge is Over! We've got some very interesting results which prove that routers', and in general embedded devices', security is poor. There is definitely more room for further development and we urge security researchers and hobbyists to keep the challenge alive with new submissions. I hope that the challenge was as educational and entertaining as practical and useful to all of us. Here is a quick summary, in no particular order, of the types of vulnerabilities we are exhibiting: * authentication bypass * a-to-c attacks * csrf (cross-site request forgeries) * xss (cross-site scripting) * call-jacking - like making your phone dial numbers or even survey room's sound where the phone resides * obfuscation/encryption deficiencies * UPnP, DHCP and mDNS problems - although not officially reported, most devices are affected * SNMP injection attacks due to poor SNMP creds. * memory overwrites - well it is possible to overwrite the admin password while being in memory and therefore be able to login as admin * stealing config files * cross-file upload attacks - this is within the group of csrf attacks * remote war-driving - way cool * factory restore attacks * information disclosure * etc, etc, etc Please check the project page for more information and be sure that we will continue posting interesting info on that subject in the future. Also, if you have some findings on your own, pls let us know as we are very interested to learn about. pdp -- http://www.gnucitizen.org http://www.gnucitizen.com http://www.hakiri.org GNUCITIZEN

1 0

AboveNet Global Routing issue
by Ross Vandegrift 01 Mar '08

01 Mar '08

Hi Everyone, Just received a light-up of calls about general connectivity, a call to AboveNet got us the answer that they are having "global routing issues". Has anyone received any more details? -- Ross Vandegrift ross(a)kallisti.us "The good Christian should beware of mathematicians, and all those who make empty prophecies. The danger already exists that the mathematicians have made a covenant with the devil to darken the spirit and to confine man in the bonds of Hell." --St. Augustine, De Genesi ad Litteram, Book II, xviii, 37

8 8

Prefix filtering for Cisco SUP2
by Henry Futzenburger 01 Mar '08

01 Mar '08

I am hoping to help an ISP keep a couple of Cisco 6500's with SUP2's in production for a while longer. They are currently just about at the FIB limit of 250,000 entries, mostly composed of BGP routes. I'm considering two alternatives to reduce the number of entries. 1. Accept only default and partial routes from upstream. a. Accept directly-connected routes, reject everything else and rely on the default route. b. Assume a reduction to about 30,000 unique routes per upstream ISP (currently 3). 2. Accept only default and RIR minimum routes from upstream. a. Filter based on RIR minimums, rely on default for unaggregated routes. b. Assume a reduction of about 50,000-100,000 total routes. Does anyone have any opinions as to whether one option is better than the other? Are there options that would be better than either of these? Are there serious risks to either option? My sense is that either of these would be a fairly benign change, only having a marginal impact on routing efficiency in either case. It seems like the better option is the one that retains the greater number of routes within some margin of safety. What do you think?

4 3

RIPE NCC publishes case study of youtube.com hijack
by Tom Quilling 29 Feb '08

29 Feb '08

for those interested in the matter tom Dear Colleagues, As you may be aware from recent news reports, traffic to the youtube.com website was 'hijacked' on a global scale on Sunday, 24 February 2008. The incident was a result of the unauthorised announcement of the prefix 208.65.153.0/24 and caused the popular video sharing website to become unreachable from most, if not all, of the Internet. The RIPE NCC conducted an analysis into how this incident was seen and tracked by the RIPE NCC's Routing Information Service (RIS) and has published a case study at: http://www.ripe.net/news/study-youtube-hijacking.html The RIPE NCC RIS is a service that collects Border Gateway Protocol (BGP) routing information from roughly 600 peers at 16 Internet Exchange Points (IXPs) across the world. Data is stored in near real-time and can be instantly queried by anyone to provide multiple views of routing activity for any point in time. The RIS forms part of the RIPE NCC's suite of Information Services, which together provide a deeper insight into the workings of the Internet. The RIPE NCC is a neutral and impartial organisation, and commercial interests therefore do not influence the data collected. The RIPE NCC Information Services suite also includes the Test Traffic Measurement (TTM) service, the DNS Monitoring (DNSMON) service and Hostcount. All of these services are available to anyone, and most of them are offered free of charge. More information about RIPE NCC Information Services can be found at: http://is-portal.ripe.net Regards, Daniel Karrenberg Chief Scientist, RIPE NCC

4 5