- Test - lists.nanog.org

Re: Confirming source-routed multicast is dead on the public Internet
by John Kristoff 01 Aug '18

01 Aug '18

On Tue, 31 Jul 2018 21:28:31 +0000 Sean Donelan <sean(a)donelan.com> wrote: > I did all the google searches, check all the usual CAIDA and ISP > sites. IP Multicast is used on private enterprise networks, and some > ISPs use it for some closed services. More anecdotal evidence. Probably the best place to know what is going on with multicast is on the mboned list (yea that still exists): <https://mailarchive.ietf.org/arch/browse/mboned/> Second best might be the Internet2 community where a number of institutions that have always had it might still have it turned on. Though there has been only one post in all of 2018 on their list if that tells you anything. There is almost no public multicast monitoring anymore. Practically all dead. You could poke around the I2 router proxies and see what is happening on some of the last of the remaining IP multicast-enabled Internet (hint, mostly noise from odd devices that have strayed outside the local institution): show multicast routes show pim join ... I keep hearing about some research project in the deep blue sea that uses it. You might find a small amount of it out there, but I'd bet overall its usage is teeny tiny and limited to a shrinking number of networks. Turned off interdomain multicast when I returned here in 2016. John

2 1

Re: Confirming source-routed multicast is dead on the public Internet
by John Kristoff 01 Aug '18

01 Aug '18

On Wed, 1 Aug 2018 15:45:44 +0000 Adam Davenport <adam(a)davenpro.com> wrote: > I can confirm that GTT does indeed filter IP sourced from 224.0.0.0/4 at its edge. Do you mean sent to 224/4 or literally anything with a source address of 224/4? For those that are or are considering filtering, you might also want to consider limiting IGMP at router interfaces. The only known use of IGMP past the local link I'm aware of was for mtrace tool, but allowing it can pose some danger in two forms. One is yet another DDoS reflection and amplification vector, another is a some router system and configuration disclosure. See the following for details: <https://ccronline.sigcomm.org/wp-content/uploads/2017/01/p27-sargent.pdf> In experiments I ran in early parts of that work I found that Cogent did not forward IGMP messages through its network in my tests, but this may be due to the routing hardware/software they were using at the time rather than an explicit filtering policy. John

1 0

unwise filtering policy on abuse mailboxes
by Dan Hollis 01 Aug '18

01 Aug '18

can we please just stop this nonsense? ip under your direct control originates sewage. you should accept reports as-is. requiring victims of your sewage to go through special contortions to report it to you is not acceptable. > ----- The following addresses had permanent fatal errors ----- > <abuse(a)psychz.net> > (reason: 550 "The mail server detected your message as spam and has prevented delivery.")

12 15

Windstream Contact
by Michael H Lambert 01 Aug '18

01 Aug '18

Could someone from Windstream please contact me off-list? We have a peering issue. Thanks, Michael ----- Michael H Lambert, GigaPoP Manager Phone: +1 412 268-4960 Pittsburgh Supercomputing Center/3ROX FAX: +1 412 268-5832 300 S Craig St, Pittsburgh, PA 15213 USA lambert(a)psc.edu

1 0

Re: Confirming source-routed multicast is dead on the public Internet
by John Kristoff 01 Aug '18

01 Aug '18

On Wed, 1 Aug 2018 02:43:10 +0000 "Mankamana Mishra (mankamis) via NANOG" <nanog(a)nanog.org> wrote: > other than billing problem, is there any other reasons why multicast > would not be viable for public internet ? Two other significant contributing factors stem from complexity and security issues. Here are some references I'm familiar with: <https://www.nanog.org/meetings/nanog21/presentations/eubanks.ppt> <https://www.nanog.org/meetings/nanog35/presentations/kristoff.pdf> <https://www.cymru.com/jtk/tmp/secure-junos-mcast.html> The last link was briefly maintained on Team Cymru's production template section, but it looks it is now gone and like this is the last copy of it I had before it was published a few years ago. John

1 0

issues through CGNat (juniper ms-mpc-128g in mx960)
by Aaron Gould 31 Jul '18

31 Jul '18

(please forgive cross-posting between jnsp and nanog.looking for anyone who could help shed light) I moved customers behind MS-MPC-128G (MX960) CGNat boundary a few nights ago. for the most part it went well. with these couple issues. please let me know what you know about this and how to fix. I don't know if it's fixed on the endpoints, or in the cgnat config or what. 1 - IPSEC VPN - Customer said the vpn connect light on cisco vpn router blinks (not connected to vpn) - I found out the vpn addresses that this cisco vpn router is trying to connect to. - I did a fix in cgnat rule stanza where all UDP 500 and 4500 traffic to that distant vpn endpoint(s) will always be natted to one and only one ip address (I did this thinking that the changing ip of the public pool assigned ip addresses for udp 500 and 4500 was possible breaking it) 2 - PS4 gaming - Customer said playing a few games (call of duty, etc) with Internet players now doesn't work. - They said the PS4 nat type is nat type 3 (strict) whereas before the moved them to cgnat, it was NAT type 2 moderate and worked. -Aaron

5 5

Security team objectives
by Ramy Hashish 31 Jul '18

31 Jul '18

Good day all, If you are going to start a security team in a newly founded IT organization, what will the objectives/results be? Thanks, Ramy

4 4

TIMELY - Nominations close today at 5PM ET for NRO Number Council position
by John Curran 31 Jul '18

31 Jul '18

Folks - Nominations are still being accepted until 5:00 PM EDT today, Tuesday, 31 July 2018 for candidates from the ARIN region to fill one seat on the Number Resource Organization Number Council (NRO NC) that will become vacant when Louie Lee’s term expires on 31 December 2018. If you aware of anyone who would be good at serving on the NRO NC and is interested in running, please nominate them ASAP! For more information see <https://lists.arin.net/pipermail/arin-announce/2018-July/002248.html>, or review the details attached to this message. Thanks! /John John Curran President and CEO ARIN === Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] 2018 Call for Nominations: NRO NC Date: 31 July 2018 at 10:45:45 AM EDT To: <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> Nominations are still being accepted until 5:00 PM EDT today, Tuesday, 31 July 2018 for candidates from the ARIN region to fill one seat on the Number Resource Organization Number Council (NRO NC) that will become vacant when Louie Lee’s term expires on 31 December 2018. Nominees for the NRO NC must reside within the ARIN region and be willing and available to serve a three-year term beginning 1 January 2019. Incumbents may be nominated for consecutive terms. NRO NC representatives are expected to attend all regularly-scheduled ARIN, ICANN, and ASO in-person meetings and teleconferences and serve as representatives from the ARIN region on the ICANN Address Supporting Organization Advisory Council (ASOAC). To view the role of the NRO NC and the function of the ASO, please visit: https://www.arin.net/about_us/nronc.html To view initial requirements and responsibilities of the NRO NC, please visit: https://www.arin.net/about_us/nronc_requirements.html Any individual, regardless of ARIN Member affiliation, may self-nominate or nominate one or more candidates for any open NRO NC position. All nominations must be received by 5:00 PM EDT, today, Tuesday, 31 July. Nominees who accept their nomination will have until 5:00 PM EDT Friday, 3 August to complete and submit their questionnaire. A final slate of NRO NC candidates will be announced on Monday, 24 September and elections will open to North American Network Operators Group (NANOG) and ARIN meeting attendees only on Monday, 1 October. Elections open to all eligible ARIN Member organizations’ Voting Contacts on Thursday, 4 October. To submit a nomination now, please click on the following link: https://www.surveymonkey.com/r/ARIN2018Nominations For more information on the nomination process and nominee eligibility requirements and responsibilities, including viewing ARIN’s region, please visit: https://www.arin.net/participate/elections/nronumbercouncil.html For questions or to request additional information, please email the ARIN Member Services team at members(a)arin.net. Regards, Wendy Leedy Member Engagement Coordinator American Registry for Internet Numbers (ARIN) _______________________________________________ ARIN-Announce You are receiving this message because you are subscribed to the ARIN Announce Mailing List (ARIN-announce(a)arin.net) Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-announce Please contact info(a)arin.net if you experience any issues.

2 1

Re: SP security knowledge build up
by Ramy Hashish 31 Jul '18

31 Jul '18

> > Message: 6 > Date: Tue, 24 Jul 2018 07:59:58 -0500 > From: "Douglas C. Stephens" <stephend(a)ameslab.gov> > To: nanog(a)nanog.org > Subject: SP security knowledge build up > Message-ID: <6efd278f-31a0-7d0b-d755-8e14bf344cd8(a)ameslab.gov> > Content-Type: text/plain; charset=utf-8 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > To add to Suresh's list, Iowa State University (iastate.edu) offers a > graduate major program and an undergraduate minor program in cyber > security (a.k.a. Information Assurance). They also run an annual > cyber defense competition (ISEAGE). > > > > On 7/24/2018 4:06 AM, Suresh Ramasubramanian wrote: > > Not a MOOC. But several schools now have graduate programs in > > security. Off the top of my head, Georgia Tech, UAB, GMU .. > > > > > > > > They might offer some shorter courses as well, for working > > professionals. Take a look. > > > > > > > Message: 7 > Date: Tue, 24 Jul 2018 12:43:12 -0400 > From: Rich Kulawiec <rsk(a)gsp.org> > To: nanog(a)nanog.org > Subject: Re: SP security knowledge build up > Message-ID: <20180724164312.GA6933(a)gsp.org> > Content-Type: text/plain; charset=us-ascii > > On Mon, Jul 23, 2018 at 03:22:46PM +0200, Ramy Hashish wrote: > > I am planning to build up a security team of fresh engineers whom are > > "network oriented", any advice on the knowledge resources we can start > > with? > > 1. Start with one or more engineers who aren't "fresh". This is more > expensive, potentially much more expensive, but it's much more likely > to result in success than trying to feed a crash course in security > into the brains of people who've never done any of this before. Even if > all > those experienced people do is stop you from making well-known mistakes, > then the investment will be more than worth it. > > 2. I see that several academic programs were mentioned downthread; > one that I'd add to the list is UMBC, which is excellent. > > ---rsk > > > Message: 10 > Date: Tue, 24 Jul 2018 17:31:01 +0000 > From: "Lotia, Pratik M" <Pratik.Lotia(a)charter.com> > To: "nanog(a)nanog.org" <nanog(a)nanog.org> > Subject: RE: SP security knowledge build up > Message-ID: > <f1219858442343df8d632b785b62fccb(a)SC58MEXGP014.CORP.CHARTERCOM.com > > > Content-Type: text/plain; charset="iso-8859-1" > > On Mon, Jul 23, 2018 at 03:22:46PM +0200, Ramy Hashish wrote: > > I am planning to build up a security team of fresh engineers whom are > > "network oriented", any advice on the knowledge resources we can start > > with? > > To add to the academic programs - > > CU Boulder has an excellent telecom program for network security and > network engineering; one of their courses focuses solely on SP networks > (full disclosure: I am a CU Boulder alumnus). > > > With Gratitude, > > Pratik Lotia | Security Engineer III > Charter Communications > > Thank you guys for all your academic recommendation, unfortunately we are not US residents, so can you recommend the references/books/curriculum used in the mentioned programs? Thanks, Ramy

3 3

NTT US contact
by Michel Py 30 Jul '18

30 Jul '18

Can someone from NTT US contact me off-list please ? Preferably someone with some RPKI clue. Thanks, Michel Py | Sr. Network Engineer TSI Semiconductors 7501 Foothills Blvd. Roseville, CA 95747 T: (916) 789-4951 M: (916) 297-0534 michel.py(a)tsisemi.com<mailto:michel.py@tsisemi.com> | www.tsisemi.com<http://www.tsisemi.com/> MHP10-ARIN [tsi] [cid:image004.gif@01D1EBEE.F4F11880] Please consider the environment before printing this email. TSI Disclaimer: This message and any files or text attached to it are intended only for the recipients named above and contain information that may be confidential or privileged. If you are not the intended recipient, you must not forward, copy, use or otherwise disclose this communication or the information contained herein. In the event you have received this message in error, please notify the sender immediately by replying to this message, and then delete all copies of it from your system. Thank you!

3 2