- Test - lists.nanog.org

FW: BGP TTL Security
by Ben Butler 15 Feb '08

15 Feb '08

Hi Danny, Thanks for you help - no problems. I would agree 192 vs 63/64 it is to much of a coincidence for it not to be related somehow. Weirder and weirder - presumably people trying to hack the BGP session below: neighbor 212.121.34.1 ttl-security hops 192 And the session is up and we get: Extended IP access list ACL-MATCH-TTL-0/254 (Compiled) 10 permit ip any any ttl eq 0 (869 matches) 20 permit ip any any ttl eq 1 (1 match) 260 permit ip any any ttl eq 25 (1 match) 580 permit ip any any ttl eq 57 (1 match) 590 permit ip any any ttl eq 58 600 permit ip any any ttl eq 59 610 permit ip any any ttl eq 60 620 permit ip any any ttl eq 61 (2 matches) 630 permit ip any any ttl eq 62 (2 matches) 640 permit ip any any ttl eq 63 (1 match) <- presumably the foundry 1210 permit ip any any ttl eq 120 (2 matches) 1220 permit ip any any ttl eq 121 (2 matches) 1230 permit ip any any ttl eq 122 (1 match) 1240 permit ip any any ttl eq 123 (1 match) 1250 permit ip any any ttl eq 124 (1 match) 2500 permit ip any any ttl eq 249 (6 matches) 2510 permit ip any any ttl eq 250 (3 matches) This is connected to an ethernet IX and all peers are one hop away. Kind Regards Ben -----Original Message----- From: Danny McPherson [mailto:danny@tcb.net] Sent: 15 February 2008 01:16 To: Ben Butler Cc: Hank Nussbacher Subject: Re: BGP TTL Security On Feb 14, 2008, at 6:12 PM, Ben Butler wrote: > Hi, > > I have put a route map on the interface and matched every TTL from 0 > to > 254 and I am only getting matches on TTL 0. Is the ttl-security check still in place? I believe the way Cisco implemented that is that if the TTL doesn't match the prescribed value then they expire the TTL to drop the packet in the fast path. > The box on the other side in this particular instance is a high end > Foundry. > > I don't really care about the 192 thing because I will never have > mutlihop peers that far away - it was simply an observation. Well, that's quite a coincidence because Foundry's default IP TTL value is 64, which is quit suspicious. > The problem is needing to configure both sides of the peering and > consequently on a per session basis / cordinatition which means a lot > of work and inertia of organising other people to roll out the change. Hrmm... On other thought.. Is the Foundry a multi-hop peer? If so, perhaps in their configuration they're specifying ebgp multli-hop 1, which is triggering this behavior? But I'd suspect the above rather than this, because of the 192 behavior. Thoughts? -danny

1 0

BGP TTL Security
by Ben Butler 15 Feb '08

15 Feb '08

Hi, I am trying to implement BGP TTL security between one of my routers and an eBGP peer that is one hop away over a layer 2 IX. As soon as I add: neighbor 212.121.34.1 ttl-security hops 2 or neighbor 212.121.34.1 ttl-security hops 1 The peer drops to active/open sent with entries in syslog for hold time expired. I have validated via trace in both directions as being 1 hop. I have read another article that implies the default behaviour at the other end will to be send TTL 1 not 255 and consequently I need to configure both ends to get the session to come back up. An access list reveals all the packets I am receiving have a TTL of 0. The session re-establishes if I configure: neighbor 212.121.34.1 ttl-security hops >=192 <=191 and the session stays down. Which is proper bizarre! Is it necessary to configure this on both side for the session to re-establish. Is this a Cisco bug? Kind Regards Ben Butler ++++++++++++++++++++++++++++++++++++++++++ C2 Internet Ltd Globe House, The Gullet, Nantwich, Cheshire, CW5 5RL E mailto:ben.butler@c2internet.net W http://www.c2internet.net/ B1 http://c2internet.blogspot.com/ B2 http://c2noc.blogspot.com/ T +44-(0)845-658-0020 F +44-(0)845-658-0070 All quotes & services from C2 are bound by our standard terms and conditions which are available on our website at: http://www.c2internet.net/legal/main.htm#tandc C2 Internet Limited is a company registered in England and Wales with company number 03910154 Our VAT Registration number is GB 752 7650 17

2 2

Re: Network Notifcation - SMS via Verizon
by Henry Linneweh 15 Feb '08

15 Feb '08

I found this product of particular interest... http://www.scomobile.com/hipcheck/ -Henry ----- Original Message ---- From: "Bowman, Jonathan" <jbowman(a)virtela.net> To: nanog(a)merit.edu Sent: Tuesday, February 12, 2008 10:24:55 AM Subject: RE: Network Notifcation - SMS via Verizon I've used <10 digit number>@vtext.com with my Verizon phone for several years now without any issues or dropped SMS messages. Obviously that's an in-band solution, but it's simple to implement and fairly (in my experience) reliable. -Jonathan -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gregory Boehnlein Sent: Friday, February 08, 2008 7:03 PM To: nanog(a)merit.edu Subject: Network Notifcation - SMS via Verizon Hello, We have been discussing adding a wireless SMS based option to our TAP and SMTP delivery systems. We are running Nagios. In looking at the list archives, I found the following thread: http://www.irbs.net/internet/nanog/0408/0039.html Lots of great suggestions.. In looking at the options, it seems that Gnokii seems to be a well used solution to integrate a GSM or GPRS based phone/modem for text messaging. However, I am trying to determine if anyone is doing this with Verizon right now. Our existing Cell contract is w/ Verizon and so we want to avoid the potential of lost SMS messages in hopping from say T-mobile or Cingular to Verizon. So.. anyone doing SMS notification to Verizon w/ a wireless GSM/GPRS or Cell Phone solution? If so, you want to share how you are doing it? Thanks in advance..

1 0

remote hands / contractor / courier needed in Tokyo
by Alexander Koch 14 Feb '08

14 Feb '08

Folks, does anyone know or can refer to someone in Tokyo to do remote hands work, rack servers, fetch a server and bring from A to B etc? If no- one is coming to your mind, can someone refer to a courier service one can instruct/ sort things out with by email / credit card Ah, yeah, speaking English in a good way would be needed. If in doubt we also accept German, Dutch, French, or Italian, but that might get a bit more tricky. :-) Thanks in advance! Alexander

1 0

Re: Area Social Activity
by Gregory Hicks 14 Feb '08

14 Feb '08

> Date: Thu, 14 Feb 2008 11:20:53 -0800 > From: Jay Hennigan <jay(a)west.net> > To: nanog(a)merit.edu > Subject: Re: Area Social Activity > > > Rod Beck wrote: > > I am suggesting a Certified Drinkers Event in the hotel bar Sunday evening. > > Any Hash House Harriers in our midst? I partook whilst deployed to HongKong and Spain (some 12 years ago...). Haven't had occasion since then though. > > -- > Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net > Impulse Internet Service - http://www.impulse.net/ > Your local telephone and internet company - 805 884-6323 - WB6RDV ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 2655 Seely Ave M/S 9A1 San Jose, CA 95134 I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

173/8 and 174/8 allocated to ARIN
by Leo Vegoda 14 Feb '08

14 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The IANA IPv4 registry has been updated to reflect the allocation of two /8 IPv4 blocks to ARIN in February 2008: 173/8 and 174/8. You can find the IANA IPv4 registry at: http://www.iana.org/assignments/ipv4-address-space Please update your filters as appropriate. Kind regards, Leo Vegoda Manager, Number Resources - IANA -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iD8DBQFHtItTvBLymJnAzRwRAq4hAJsF7zELnkKFSHvGccPpoCK+ypwOLgCfZYgA YJOrIPDwVY2rkq7tQ+wXPAo= =Ame2 -----END PGP SIGNATURE-----

1 0

Novell DNS+DHCP server -- any experience?
by MARLON BORBA 14 Feb '08

14 Feb '08

Dear sirs, We are considering Novell Netware DNS+DHCP servers (over Netware 6.5) to replace our old ISC BIND and DHCP Linux servers. Could someone with experience in those products shed some light on their pros and cons? Please answer directly to my mailbox in order to keep NANOG clean. Abraços, Marlon Borba, CISSP, APC DataCenter Associate Técnico Judiciário - Segurança da Informação TRF 3 Região (11) 3012-1683 -- Practically no IT system is risk free. (NIST Special Publication 800-30) --

1 0

ride share
by Randy Bush 14 Feb '08

14 Feb '08

is there a ride share wiki or whatever? wiki.cluepon.net seems not to even have a nanog page this time. like how are we gonna log which remaining vietnamese restaurant is good? i'm getting in to sfo from tokyo about noon, by the time i get luggage, and do not like car rentals. randy

2 2

cacti -- Multiple security vulnerabilities have been discovered (fwd)
by Gadi Evron 14 Feb '08

14 Feb '08

I'm an MRTG guy, but many aren't. ---------- Forwarded message ---------- Date: Tue, 12 Feb 2008 14:42:01 -0200 From: Mario Sergio Candian <mscandian(a)freebsdbrasil.com.br> To: bugtraq(a)securityfocus.com Subject: cacti -- Multiple security vulnerabilities have been discovered Affected packages: cacti < 0.8.7b Multiple security vulnerabilities have been discovered in Cacti's web interface: * XSS vulnerabilities * Path disclosure vulnerabilities * SQL injection vulnerabilities * HTTP response splitting vulnerabilities References: http://forums.cacti.net/about25749.html -- Mario Sergio Candian - Live your dreams and face your fears

1 0

RE: IBM report reviews Internet crime
by Scott Weeks 13 Feb '08

13 Feb '08

These statements (and others in it) are very telling about the type of report this is: "...percent of Internet content was classified as unwanted..." "...hosting source of adult, socially deviant and criminal content on the Internet" take with a grain of salt... scott

2 1