Re: NDP DoS attack

2011-07-17 Thread Florian Weimer
* Jared Mauch: > Solving a local attack is something I consider different in scope > than the current draft being discussed in 6man, v6ops, ipv6@ etc... That's not going to happen because it's a layering violation between the IETF and IEEE. It has not been solved during thirty years of IPv4 over

Re: OT: Given what you know now, if you were 21 again...

2011-07-17 Thread Florian Weimer
* Larry Stites: > Given what you know now, if you were 21 and just starting into > networking / communications industry which areas of study or > specialty would you prioritize? Law. _ NANOG mailing list NANOG@nanog.org https://mailman.nanog.org/mailman/listinfo/nanog

Re: NDP DoS attack (was Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?))

2011-07-17 Thread Dobbins, Roland
On Jul 15, 2011, at 10:24 AM, Jimmy Hess wrote: > In most cases if you have a DoS attack coming from the same Layer-2 network > that a router is attached to, > it would mean there was already a serious security incident that occured to > give the attacker that special point to attack fr This s

Re: NDP DoS attack

2011-07-17 Thread Dobbins, Roland
On Jul 17, 2011, at 4:15 PM, Florian Weimer wrote: > In practice, the IPv4 vs IPv6 difference is that some vendors provide DHCP > snooping, private VLANs and unicast flood protection in IPv4 > land, which seems to provide a scalable way to build Ethernet networks with > address validation---but

Re: NDP DoS attack

2011-07-17 Thread Mikael Abrahamsson
On Sun, 17 Jul 2011, Florian Weimer wrote: > In practice, the IPv4 vs IPv6 difference is that some vendors provide > DHCP snooping, private VLANs and unicast flood protection in IPv4 land, > which seems to provide a scalable way to build Ethernet networks with > address validation---but there i

Re: NDP DoS attack

2011-07-17 Thread Florian Weimer
* Mikael Abrahamsson: > On Sun, 17 Jul 2011, Florian Weimer wrote: > >> In practice, the IPv4 vs IPv6 difference is that some vendors >> provide DHCP snooping, private VLANs and unicast flood protection in >> IPv4 land, which seems to provide a scalable way to build Ethernet >> networks with addre

Re: NDP DoS attack

2011-07-17 Thread Mikael Abrahamsson
On Sun, 17 Jul 2011, Florian Weimer wrote: > Others use tunnels, PPPoE or lots of scripting, so certainly something > can be done about it. To my knowledge, SAVI SEND is still at a similar > stage. Pointers to vendor documentation would be appreciated if this is > not the case. -- Mikael

Re: NDP DoS attack

2011-07-17 Thread Florian Weimer
* Mikael Abrahamsson: > On Sun, 17 Jul 2011, Florian Weimer wrote: > >> Others use tunnels, PPPoE or lots of scripting, so certainly >> something can be done about it. To my knowledge, SAVI SEND is still >> at a similar stage. Pointers to vendor documentation would be >> appreciated if this is n

Re: NDP DoS attack

2011-07-17 Thread Mikael Abrahamsson
On Sun, 17 Jul 2011, Florian Weimer wrote: > Interesting, thnaks. It's not the vendors I would expect, and it's not > based on SEND (which is not surprising at all and actually a good > thing). Personally I think SEND is never going to get any traction. > Is this actually secure in the sense

Re: NDP DoS attack

2011-07-17 Thread Florian Weimer
* Mikael Abrahamsson: > On Sun, 17 Jul 2011, Florian Weimer wrote: > >> Interesting, thnaks. It's not the vendors I would expect, and it's >> not based on SEND (which is not surprising at all and actually a >> good thing). > > Personally I think SEND is never going to get any traction. Last time

[no subject]

2011-07-17 Thread Uri Joskovitch
_ NANOG mailing list NANOG@nanog.org https://mailman.nanog.org/mailman/listinfo/nanog

Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?)

2011-07-17 Thread Eliot Lear
We all make mistakes in not questioning our own positions, from time to time. You, Jeff, seem to be making that very same mistake. Please keep these points in mind: * Rome wasn't built in a day. The current system didn't come ready-made pre-built with all the bells and whistles you are us

Re: NDP DoS attack (was Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?))

2011-07-17 Thread William Herrin
On Mon, Jul 11, 2011 at 8:17 PM, Karl Auer wrote: > RFC3756 IPv6 Neighbor Discovery (ND) Trust Models and Threats > >   In this attack, the attacking node begins fabricating addresses with >   the subnet prefix and continuously sending packets to them.  The last >   hop router is obligated to reso

Re: NDP DoS attack (was Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?))

2011-07-17 Thread Jeff Wheeler
On Sun, Jul 17, 2011 at 11:42 AM, William Herrin wrote: > My off-the-cuff naive solution to this problem would be to discard the > oldest incomplete solicitation to fit the new one and, upon receiving > an apparently unsolicited response to a discarded solicitation, > restart the process flagging

Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?)

2011-07-17 Thread Jeff Wheeler
On Sun, Jul 17, 2011 at 11:07 AM, Eliot Lear wrote: > We all make mistakes in not questioning our own positions, from time to > time.  You, Jeff, seem to be making that very same mistake. > Rome wasn't built in a day.  The current system didn't come ready-made > pre-built with all the bells and w

Re: NDP DoS attack (was Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?))

2011-07-17 Thread Owen DeLong
On Jul 17, 2011, at 10:35 AM, Jeff Wheeler wrote: > On Sun, Jul 17, 2011 at 11:42 AM, William Herrin wrote: >> My off-the-cuff naive solution to this problem would be to discard the >> oldest incomplete solicitation to fit the new one and, upon receiving >> an apparently unsolicited response to

Re: NDP DoS attack (was Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?))

2011-07-17 Thread Jeff Wheeler
On Sun, Jul 17, 2011 at 3:40 PM, Owen DeLong wrote: > Basically an ND entry would have the following states and timers: I've discussed what you have described with some colleagues in the past. The idea has merit and I would certainly not complain if vendors included it (as a knob) on their boxes

Re: NDP DoS attack (was Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?))

2011-07-17 Thread William Herrin
On Sun, Jul 17, 2011 at 1:35 PM, Jeff Wheeler wrote: > On Sun, Jul 17, 2011 at 11:42 AM, William Herrin wrote: >> My off-the-cuff naive solution to this problem would be to discard the >> oldest incomplete solicitation to fit the new one and, upon receiving >> an apparently unsolicited response t

Re: NDP DoS attack (was Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?))

2011-07-17 Thread Owen DeLong
On Jul 17, 2011, at 1:17 PM, Jeff Wheeler wrote: > On Sun, Jul 17, 2011 at 3:40 PM, Owen DeLong wrote: >> Basically an ND entry would have the following states and timers: > > I've discussed what you have described with some colleagues in the > past. The idea has merit and I would certainly no

Re: NDP DoS attack (was Re: Anybody can participate in the IETF (Was: Why is IPv6 broken?))

2011-07-17 Thread Owen DeLong
On Jul 17, 2011, at 1:32 PM, William Herrin wrote: > On Sun, Jul 17, 2011 at 1:35 PM, Jeff Wheeler wrote: >> On Sun, Jul 17, 2011 at 11:42 AM, William Herrin wrote: >>> My off-the-cuff naive solution to this problem would be to discard the >>> oldest incomplete solicitation to fit the new one a

NetFlix Down

2011-07-17 Thread Scott, Robert D.
There appears to be a login issue at Netflix. Calls to their 1-866-579-7113 number only yields a recording that they are experiencing a higher than normal call volume, try again later. Widespread? Robert D. Scott rob...@ufl.edu Senior Network Engineer 352-273-0113 Phone CNS - Network

Re: NetFlix Down

2011-07-17 Thread Mikeal Clark
I am unable to login as well. 2011/7/17 Scott, Robert D. > There appears to be a login issue at Netflix. Calls to their > 1-866-579-7113 number only yields a recording that they are experiencing a > higher than normal call volume, try again later. Widespread? > > Robert D. Scott rob..

Re: NetFlix Down

2011-07-17 Thread kristopher . doyen
Ipad app says "Service Temporarily Unavailable" at the moment. Netflix claims to be operating about 90% of their services out of aws and the only issue on the aws status page is a vpn end point issue from yesterday. -Original Message- From: "Scott, Robert D." Date: Sun, 17 Jul 2011 22

Re: NetFlix Down

2011-07-17 Thread jim deleskie
Unreachable from eastern Canada as well 2011/7/17 : > Ipad app says "Service Temporarily Unavailable" at the moment. > > Netflix claims to be operating about 90% of their services out of aws and the > only issue on the aws status page is a vpn end point issue from yesterday. > > -Original Me

Re: NetFlix Down

2011-07-17 Thread Paul Graydon
On 7/17/2011 12:36 PM, Scott, Robert D. wrote: > There appears to be a login issue at Netflix. Calls to their 1-866-579-7113 > number only yields a recording that they are experiencing a higher than > normal call volume, try again later. Widespread? Likewise from Hawaii. Guess this'll be anot

Re: NetFlix Down

2011-07-17 Thread Andrew Kirch
On 7/17/2011 6:36 PM, Scott, Robert D. wrote: > There appears to be a login issue at Netflix. Streaming works here. Andrew _ NANOG mailing list NANOG@nanog.org https://mailman.nanog.org/mailman/listinfo/nanog

RE: best practices for management nets in IPv6

2011-07-17 Thread Ryan Finnesey
We our designing a new hosted exchange environment as well as Multi-Tenant Desktop as a Service environment and we are going to use IPv6 public address. Cheers Ryan -Original Message- From: James Harr [mailto:james.h...@gmail.com] Sent: Wednesday, July 13, 2011 11:22 AM To: Joel Maslak