Re: Survey about RPKI/DNSSEC

Hi folks, we already received 140 replies. Many thanks! We hope to gather some more responses. If you didn't participate in the survey so far, please help us to better understand the deployment of RPKI and DNSSEC: http://eSurv.org?u=rpkidnssec The survey is anonymous an

Re: wifi blocking [was Re: Marriott wifi blocking]

On 10/7/2014 10:35 PM, Larry Sheldon wrote: On 10/7/2014 23:44, valdis.kletni...@vt.edu wrote: On Tue, 07 Oct 2014 23:10:15 -0500, Larry Sheldon said: The cell service is not a requirement placed upon them, I am pretty sure. However, once having chosen to provide it, and thus create an expec

Re: wifi blocking [was Re: Marriott wifi blocking]

On Wed, Oct 8, 2014 at 8:42 AM, Roy wrote: > On 10/7/2014 10:35 PM, Larry Sheldon wrote: >> On 10/7/2014 23:44, valdis.kletni...@vt.edu wrote: >>> On Tue, 07 Oct 2014 23:10:15 -0500, Larry Sheldon said: The cell service is not a requirement placed upon them, I am pretty sure. >>> >>> How

Megapath contact

Could someone from Megapath contact me offlist? I'm fighting with some very strange routing for a customer.

PLDT on the list?

This may be a long shot, but if there's anyone on-list from PLDT who can help out with PLDT I-Gate customer prefix filtering updates, I'd appreciate some help with an issue that's been dragging on for weeks. -- Jon Lewis, MCP

Unwanted Traffic Removal Service (UTRS)

Friends and colleagues, Yesterday I briefly discussed a new project we've recently launched and for which invited participation from the NANOG 62 attendees. This is a not so subtle wider request for consideration. UTRS is essentially a community RTBH that people have suggested to us would be a g

Re: Belkin Router issues this morning?

On 10/7/14 10:14 PM, "Christopher Morrow" wrote: >On Tue, Oct 7, 2014 at 8:56 PM, Larry Sheldon >wrote: >> I am having trouble understanding why a router would need a heartbeat >>from >> some foreign location. Or even what it would do with one. > >One, not crazy, line of thinking is that: "In

Re: Belkin Router issues this morning?

On Wed, Oct 8, 2014 at 10:18 AM, Lee Howard wrote: > > > On 10/7/14 10:14 PM, "Christopher Morrow" wrote: > >>On Tue, Oct 7, 2014 at 8:56 PM, Larry Sheldon >>wrote: >>> I am having trouble understanding why a router would need a heartbeat >>>from >>> some foreign location. Or even what it would

Re: Unwanted Traffic Removal Service (UTRS)

Dear John, On Wed, Oct 08, 2014 at 08:59:00AM -0500, John Kristoff wrote: > UTRS is essentially a community RTBH that people have suggested to us > would be a good service to provide, so we're giving it a go. FYI, there are various projects which are similar to this concept: http://www.de-ci

netfilter/iptables synproxy; need help deciding

Hi, I guess syncookies wasn't enough and the SYNPROXY target is a relatively new addition to netfilter. If I remember correctly this has been a part of BSD PF for quite some time and is pretty easy to get up and working. I recently tried to set this up on one of my gateways considering that it's j

netfilter/iptables synproxy; need help deciding

Hi, I guess syncookies wasn't enough and the SYNPROXY target is a relatively new addition to netfilter. If I remember correctly this has been a part of BSD PF for quite some time and is pretty easy to get up and working. I recently tried to set this up on one of my gateways considering that it's j

Re: Unwanted Traffic Removal Service (UTRS)

On Wed, 8 Oct 2014 16:42:38 +0200 Job Snijders wrote: > Just like chicory, personally I don't like it. Yes, Cymru has build a > reputation as clearing house for redistribution of security related > information. But... (aside from any local safety net filter), it's > quite a leap to allow a single

Re: netfilter/iptables synproxy; need help deciding

On Oct 8, 2014, at 9:43 PM, Paige Thompson wrote: > Any thoughts on this are appreciated, pp. 30-36. -- Roland D

RE: netfilter/iptables synproxy; need help deciding

I set up a bridge at home to filter traffic using iptables with synproxy. I tried to adjust the lines so that it would log hits but that wouldn't work It gave me a message to read dmesg why it didn't work but dmesg had no information in it. However, when I turned on the lines in my iptables confi

Re: netfilter/iptables synproxy; need help deciding

On 10/08/14 18:06, Thijs Stuurman wrote: > I set up a bridge at home to filter traffic using iptables with synproxy. I > tried to adjust the lines so that it would log hits but that wouldn't work > It gave me a message to read dmesg why it didn't work but dmesg had no > information in it. > Howev

RE: netfilter/iptables synproxy; need help deciding

Sorry I am doing multiple things at once and my setup is at home... just a bit more information. I used a fresh latest version centos 7 installation for my bridge (3 nics, 2 in bridge). In my case the output of /proc/net/stat/synproxy you show on http://pastie.org/private/xwct5opbb0aajcko2tnpw d

Re: Unwanted Traffic Removal Service (UTRS)

On Wed, Oct 8, 2014 at 10:42 AM, Job Snijders wrote: > Just like chicory, personally I don't like it. Yes, Cymru has build a > reputation as clearing house for redistribution of security related > information. But... (aside from any local safety net filter), it's quite > a leap to allow a single e

RE: netfilter/iptables synproxy; need help deciding

Try the examples given here: https://r00t-services.net/knowledgebase/14/Homemade-DDoS-Protection-Using-IPTables-SYNPROXY.html Your line make no sense to me: """ -A PREROUTING -d 172.16.20.98/32 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CT --notrack """ The first entry should register

Re: netfilter/iptables synproxy; need help deciding

On 10/08/14 17:54, Roland Dobbins wrote: > On Oct 8, 2014, at 9:43 PM, Paige Thompson wrote: > >> Any thoughts on this are appreciated, > > > pp. 30-36. > >

Re: netfilter/iptables synproxy; need help deciding

On Oct 8, 2014, at 10:24 PM, Paige Thompson wrote: > Re pp: 30-36 I think I catch your drift (ie: using cisco netflow to detect a > synflood?) but would you care to summarize just in case because > I am not this savvy, but would like to understand. Yes, you can do that - there are plenty of op

Re: Unwanted Traffic Removal Service (UTRS)

>information. But... (aside from any local safety net filter), it's quite >a leap to allow a single entity to inject blackholes for any prefix. Spamhaus has been distributing their DROP list by BGP for years. The world hasn't ended, and I can't recall the last time it had a plausible false positi

Re: Unwanted Traffic Removal Service (UTRS)

On Wed, Oct 08, 2014 at 04:02:21PM -, John Levine wrote: > >information. But... (aside from any local safety net filter), it's quite > >a leap to allow a single entity to inject blackholes for any prefix. > > Spamhaus has been distributing their DROP list by BGP for years. The > world hasn't

Re: Unwanted Traffic Removal Service (UTRS)

On Wed, Oct 08, 2014 at 04:42:38PM +0200, Job Snijders wrote: > > There are various flavors at the moment in terms of validation (please > correct me if I am wrong): The Polish blackholing project only allows > blackholes which fall within the set of prefixes which an ASN > originates, the DE-CIX

Re: Unwanted Traffic Removal Service (UTRS)

On Wed, Oct 8, 2014 at 9:59 AM, John Kristoff wrote: > If you think this is a terrible idea and want to express all that is > wrong with it, tell me that too, I can take it. Hi John, It's a good idea, I think, but it has a problem: it's an escalation in an arms race that doesn't end well for the

2014.10.08 NANOG62 notes

So, I suspect I'm going to spend a little time tonight renaming the files to make more sense; I'm uploading the rest of my notes now to http://nanog.cluepon.net/index.php/NANOG62 but you should probably ignore the more specific links I sent out earlier, as those will end up changing. Starting fro

Re: wifi blocking [was Re: Marriott wifi blocking]

On 10/8/2014 08:47, William Herrin wrote: On Wed, Oct 8, 2014 at 8:42 AM, Roy wrote: On 10/7/2014 10:35 PM, Larry Sheldon wrote: On 10/7/2014 23:44, valdis.kletni...@vt.edu wrote: On Tue, 07 Oct 2014 23:10:15 -0500, Larry Sheldon said: The cell service is not a requirement placed upon them,

Re: wifi blocking [was Re: Marriott wifi blocking]

On 10/8/14 1:29 PM, Larry Sheldon wrote: > On 10/8/2014 08:47, William Herrin wrote: >> On Wed, Oct 8, 2014 at 8:42 AM, Roy wrote: >>> On 10/7/2014 10:35 PM, Larry Sheldon wrote: On 10/7/2014 23:44, valdis.kletni...@vt.edu wrote: > On Tue, 07 Oct 2014 23:10:15 -0500, Larry Sheldon said: >

Re: wifi blocking [was Re: Marriott wifi blocking]

On Wed, Oct 8, 2014 at 4:37 PM, joel jaeggli wrote: > On 10/8/14 1:29 PM, Larry Sheldon wrote: >> On 10/8/2014 08:47, William Herrin wrote: >>> BART would not have had an FCC license. They'd have had contracts with >>> the various phone companies to co-locate equipment and provide wired >>> backha

Re: wifi blocking [was Re: Marriott wifi blocking]

There is a provision in the regulations somewhere that allows underground/tunnel transmitters on licensed bands without a license, provided certain power limits are honoured outside of the tunnel. Perhaps they are operating under these provisions? K On 10/08/2014 02:11 PM, William Herrin wrote: >

RADB

Hi, I really don't know where else to post this. I recently subscribed to RADB and added route objects and route6 objects for our prefixes we announce. Of course an aut-num object was created and I created a list of ASN's that are downstream customers in an as-set list. But, since this is my fi

Re: RADB

On 08/10/2014 21:44, Brandon Wade wrote: > My next question is, why would RADB offer zero support for confirming > this? And lastly, why should my organization pay $500 per year to a > service that is unwilling to assist in making sure their subscriber is > using their service properly? radb.net c

Re: wifi blocking [was Re: Marriott wifi blocking]

On 10/8/2014 16:11, William Herrin wrote: On Wed, Oct 8, 2014 at 4:37 PM, joel jaeggli wrote: On 10/8/14 1:29 PM, Larry Sheldon wrote: On 10/8/2014 08:47, William Herrin wrote: BART would not have had an FCC license. They'd have had contracts with the various phone companies to co-locate equi

Re: wifi blocking [was Re: Marriott wifi blocking]

On 10/8/2014 16:17, Keenan Tims wrote: There is a provision in the regulations somewhere that allows underground/tunnel transmitters on licensed bands without a license, provided certain power limits are honoured outside of the tunnel. Perhaps they are operating under these provisions? Which, i

Re: wifi blocking [was Re: Marriott wifi blocking]

On Oct 7, 2014, at 6:10 PM, Jimmy Hess wrote: > On Tue, Oct 7, 2014 at 7:43 PM, Keenan Tims wrote: >> I don't think it changes much. Passive methods (ie. Faraday cage) would >> likely be fine, as would layer 8 through 10 methods. > > Well... actually... passive methods are probably fine, as l

Re: wifi blocking [was Re: Marriott wifi blocking]

On Oct 7, 2014, at 6:36 PM, valdis.kletni...@vt.edu wrote: > On Tue, 07 Oct 2014 20:10:44 -0500, Jimmy Hess said: > >> The only way to legally block cell phone RF would likely be on behalf >> of the licensee In other words, possibly, persuade the cell >> phone companies to allow this, th

Re: RADB

You can also verify the object configurations from another IRRd, such as Level(3) whois -h filtergen.level3.net "RADB::YOUR-AS-SET -searchpath=RIPE;ARIN;RADB -recurseok -warnonly" You can limit the searchpath to just include RADB if you wish, but it's good to know what else is out there. charles

Re: RADB

I can relate to this, having gone thru a similar process/experience fairly recently in using IRRd.. So the real question Brandon is asking.. For a newbie, how does one go about learning the basic's of IRRd. Speaking for myself, if there is a good answer, I would welcome it. Here is what I had

IPv6 Default Allocation - What size allocation are you giving out

I am planning out our IPv6 deployment right now and I am trying to figure out our default allocation for customer LAN blocks. So what is everyone giving for a default LAN allocation for IPv6 Customers. I guess the idea of handing a customer /56 (256 /64s) or a /48 (65,536 /64s) just makes me c

Re: IPv6 Default Allocation - What size allocation are you giving out

Give them a /48. This is IPv6 not IPv4. Take the IPv4 glasses off and put on the IPv6 glasses. Stop constraining your customers because you feel that it is a waste. It is not a waste It will also reduce the number of exceptions you need to process and make over all administration easier.

verizon postmaster here?

Hi, is there a verizon postmaster around who could contact me off-list? thx -- Mark E. Jeftovic Founder & CEO, easyDNS Technologies Inc. +1-(416)-535-8672 ext 225 Read my blog: http://markable.com

Re: IPv6 Default Allocation - What size allocation are you giving out

There seem to be lots of various opinions still on this subject. What type of customer are you dealing with, what service are they receiving? We are allocating a /64 per customer (VPS / dedicated server / small co-lo) but doing them on /56 boundaries so that we can easily expand their allocation

Re: IPv6 Default Allocation - What size allocation are you giving out

Erik, On Oct 8, 2014, at 6:18 PM, Erik Sundberg wrote: > I guess the idea of handing a customer /56 (256 /64s) or a /48 (65,536 /64s) > just makes me cringe at the waste. Don’t cringe. Yeah, a /48 is a crazy amount of space, but that isn’t the resource we are likely to ever need to conserve i

speaking of wifi

Speaking of wifi and the NANOG conference that just finished in Baltimore, we have some words from Maryland Governor Martin O'Malley: http://www.washingtonpost.com/blogs/the-fix/wp/2014/10/08/martin-omalley-and-the-human-right-to-wifi/ -- William Herrin her...@dirtside.com b.

Re: RADB

>> For a newbie, how does one go about learning the basic's of IRRd. That pretty much sums it up. I feel like I'm stuck reading RFC's that are too overly complex for something that seems like it shouldn't be complex. Anyone know of a quick 101 intro to routing registries with a simple example

Re: IPv6 Default Allocation - What size allocation are you giving out

On Oct 8, 2014, at 9:18 PM, Erik Sundberg wrote: > I am planning out our IPv6 deployment right now and I am trying to figure out > our default allocation for customer LAN blocks. So what is everyone giving > for a default LAN allocation for IPv6 Customers. I guess the idea of handing > a cust

Re: IPv6 Default Allocation - What size allocation are you giving out

I'm allocating /64s in /56 boundaries per customer. Allows me to give the client more should they need it without fuss. On 10/9/2014 午前 10:18, Erik Sundberg wrote: I am planning out our IPv6 deployment right now and I am trying to figure out our default allocation for customer LAN blocks. So w

Re: IPv6 Default Allocation - What size allocation are you giving out

We are going thru a similar process.. from all of my reading, best practice discussions etc.. Here is what i have understood so far:- Residential Customers: /64 Small & Medium size Business Customers: /56 Large Business size or a multi-location Business Customer: /48 Don't skimp on allocati

Re: IPv6 Default Allocation - What size allocation are you giving out

In message <126729399.131320.1412825855138.javamail.zim...@snappytelecom.net>, Faisal Imtiaz writes: > We are going thru a similar process.. from all of my reading, best practice d > iscussions etc.. > > Here is what i have understood so far:- > > Residential Customers: /64 N

Re: IPv6 Default Allocation - What size allocation are you giving out

Why would you only allocate a residential customer a single /64? That's totally short sighted in my view. On Thu, Oct 9, 2014 at 2:07 PM, Faisal Imtiaz wrote: > We are going thru a similar process.. from all of my reading, best > practice discussions etc.. > > Here is what i have understood so

Re: IPv6 Default Allocation - What size allocation are you giving out

On Thu, Oct 9, 2014 at 1:18 AM, Erik Sundberg wrote: > I am planning out our IPv6 deployment right now and I am trying to figure out > our default allocation for customer LAN blocks. So what is everyone giving > for a default LAN allocation for IPv6 Customers. I guess the idea of handing > a c

Re: IPv6 Default Allocation - What size allocation are you giving out

You should probably increase those allocations. Residential & Small Business Customers: /56 Medium & Large size Business Customers: /48 Multi-location Business Customer: /48 per site On Wed, Oct 8, 2014 at 10:37 PM, Faisal Imtiaz wrote: > We are going thru a similar process.. from all of my

Re: IPv6 Default Allocation - What size allocation are you giving out

Like I said, this was my understanding I am glad that it is being pointed out to be in-correct I don't have a reason for why a /64 as much as I also don't have any reason Why NOT So, let me ask the question in a different manner... What is the wisdom / reasoning behind needing to

Re: IPv6 Default Allocation - What size allocation are you giving out

Fair point just as a follow up question... is giving a /64 to a Residential Customer not a good idea, because it would not allow them to have additional routed segments ? (since Best Practices is to use a /64 on each link as link connectivity address) or is there some other reasoning that

Re: IPv6 Default Allocation - What size allocation are you giving out

On Wed, Oct 8, 2014 at 8:07 PM, Faisal Imtiaz wrote: > Like I said, this was my understanding I am glad that it is being > pointed out to be in-correct > > I don't have a reason for why a /64 as much as I also don't have any > reason Why NOT > > So, let me ask the question in a differ

Re: IPv6 Default Allocation - What size allocation are you giving out

> What is the wisdom / reasoning behind needing to give a /56 to a Residential > customer (vs a /64). What happens when the resident pulls their car into their garage and their car requests a unique /64 so the various computers on the CAN can start syncing with the Internet? Car's media center st

Re: IPv6 Default Allocation - What size allocation are you giving out

Awesome, Thank you Royce, the missing piece has clicked in place... :) Faisal Imtiaz Snappy Internet & Telecom 7266 SW 48 Street Miami, FL 33155 Tel: 305 663 5518 x 232 Help-desk: (305)663-5518 Option 2 or Email: supp...@snappytelecom.net - Original Message - > From: "Royce Wil

Re: IPv6 Default Allocation - What size allocation are you giving out

Yep, understood... in the ipv6 world we are looking at needing a significantly more 'routing' connectivity, than we do in the current ipv4 world. Thank you. Faisal Imtiaz Snappy Internet & Telecom - Original Message - > From: "Kenneth Finnegan" > To: "Faisal Imtiaz" , nanog@nanog

Re: IPv6 Default Allocation - What size allocation are you giving out

The biggest issue I see with only giving a /64 is that many residential customers may have have two routers, if the modem is not bridged and does not have WiFi. Another issue would be for people who want to use the guest SSID of many routers. With IPv6 I could see each SSID getting a /64.

Re: IPv6 Default Allocation - What size allocation are you giving out

haha.. email timing delay .. The follow up question has been answered by a few others there, in their previous emails with appropriate explanations. Thank you to everyone who responded. :) Faisal Imtiaz Snappy Internet & Telecom - Original Message - > From: "Faisal Imtiaz" > To:

Re: IPv6 Default Allocation - What size allocation are you giving out

In message <1627782497.131675.1412827629110.javamail.zim...@snappytelecom.net>, Faisal Imtiaz writes: > Like I said, this was my understanding I am glad that it is being pointed > out to be in-correct > > I don't have a reason for why a /64 as much as I also don't have any reason W > h

Re: IPv6 Default Allocation - What size allocation are you giving out

> A /60, /56, /52 or /48 allows the client to run multiple SLAAC > subnets (16, 256, 4096 or 65536) and to have the reverse ip6.arpa > zone delegated on a nibble boundary. Understood... > There is plenty of address space even handing out /48's to everyone. Also Understood. >Only short sighted

Re: IPv6 Default Allocation - What size allocation are you giving out

In message <482678376.131852.1412829159356.javamail.zim...@snappytelecom.net>, Faisal Imtiaz writes: > > A /60, /56, /52 or /48 allows the client to run multiple SLAAC > > subnets (16, 256, 4096 or 65536) and to have the reverse ip6.arpa > > zone delegated on a nibble boundary. > > Understood..

Re: IPv6 Default Allocation - What size allocation are you giving out

== > > >Only short sighted ISP's hand out /56's to residential customers. > > > > I am curious as to why you say it is short sighted? what is the technical > > or > > otherwise any other reasoning for such statement ? > > 256 is *not* a big number of subnets.

Re: IPv6 Default Allocation - What size allocation are you giving out

Faisal, On Oct 8, 2014, at 9:45 PM, Faisal Imtiaz wrote: > So, this is more of a 'opinion' / 'feel' (with all due respect) comment, and > not something which has a (presently) compelling technical reasoning behind > it ? The technical reasoning behind /48 has been documented in many places. L

RE: IPv6 Default Allocation - What size allocation are you giving out

To paraphrase a post on this list a while ago (my apologies for lack of reference). There are two kinds of waste: - the first kind of waste is providing 'too many' subnets for someone; - the second kind of waste is leaving the space unallocated forever. If we choose the first option and someh

Re: RADB

On 10/8/14 7:35 PM, Brandon Wade wrote: > > >>> For a newbie, how does one go about learning the basic's of IRRd. > > That pretty much sums it up. I feel like I'm stuck reading RFC's that are too > overly complex for something that seems like it shouldn't be complex. Anyone > know of a > quic

Re: RADB

Take a look: https://www.arin.net/resources/routing/ charles On Wed, Oct 8, 2014 at 10:35 PM, Brandon Wade wrote: > > >>> For a newbie, how does one go about learning the basic's of IRRd. > > That pretty much sums it up. I feel like I'm stuck reading RFC's that are too > overly complex for so

Re: IPv6 Default Allocation - What size allocation are you giving out

In message <2083423091.131955.1412829918586.javamail.zim...@snappytelecom.net>, Faisal Imtiaz writes: > == > > > >Only short sighted ISP's hand out /56's to residential customers. > > > > > > I am curious as to why you say it is short sighted? what is the tech

Re: IPv6 Default Allocation - What size allocation are you giving out

Mark, >Only short sighted ISP's hand out /56's to residential customers. I am curious as to why you say it is short sighted? what is the technical or otherwise any other reasoning for such statement ? 256 is *not* a big number of subnets. By restricting the number of subnets residences ge

Re: IPv6 Default Allocation - What size allocation are you giving out

On Thu, Oct 9, 2014 at 4:45 AM, Faisal Imtiaz wrote: > So, this is more of a 'opinion' / 'feel' (with all due respect) comment, and > not something which has a (presently) compelling technical reasoning behind > it ? Think of something like HIPnet https://tools.ietf.org/html/draft-grunde

Re: IPv6 Default Allocation - What size allocation are you giving out

This makes no sense. I have two /48s routed to my house. ..to my house. The idea that anyone is giving anything less than a 64 is unreasonable and will lead to an exponential growth in routing tables.. it's asinine and very short sighted. Sure, back in the day, I had a server, a couple desktops

Re: IPv6 Default Allocation - What size allocation are you giving out

(PS If I wake up in the morning and find out that someone has hacked my CatGenie litter boxes, I will hunt you down). "NANOG: From Cat Poo to IPv6, We've Got It Covered" On Thu, Oct 9, 2014 at 12:09 AM, jamie rishaw wrote: > This makes no sense. > > I have two /48s routed to my house. > > ..to

Re: IPv6 Default Allocation - What size allocation are you giving out

On Thu, Oct 9, 2014 at 5:16 AM, jamie rishaw wrote: > (PS If I wake up in the morning and find out that someone has hacked my > CatGenie litter boxes, I will hunt you down). I am sure any hacking will result in taking a dump.

Re: IPv6 Default Allocation - What size allocation are you giving out

On Thu, Oct 9, 2014 at 5:09 AM, jamie rishaw wrote: . > These arguments and debates make me sad. I suppose it's my own fault for > assuming that everyone in this ML is a forward thinker. Get used to disappointment.

Re: IPv6 Default Allocation - What size allocation are you giving out

On Thu, 9 Oct 2014, Erik Sundberg wrote: I am planning out our IPv6 deployment right now and I am trying to figure out our default allocation for customer LAN blocks. So what is everyone giving for a default LAN allocation for IPv6 Customers. I guess the idea of handing a customer /56 (256 /

Re: IPv6 Default Allocation - What size allocation are you giving out

On (2014-10-09 15:25 +1100), Mark Andrews wrote: Hi, > Because /64 only allows for a single subnet running SLAAC with > currently defined specifications. I fully agree that larger than 64 must be allocation, in mobile internet, residental DSL, everywhere. I don't think it will happen, but I thin