How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Graham Beneke

Only 0.3 of a /8 left[1] before the rationing policy kicks in.

I hope everyone is ready :-)

[1] http://www.apnic.net/community/ipv4-exhaustion/graphical-information

--
Graham Beneke



Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Tore Anderson
* Graham Beneke

 Only 0.3 of a /8 left[1] before the rationing policy kicks in.

Hi,

Actually, they're already empty. Chinanet Fujian Province Network
allocated 498432 addresses today, spread out over 1102(!) individual
prefixes in the range /21-/24.

Unless any resources has been returned to the free pool today, there's
nothing left in the APNIC pool outside of the 103/8 block, which is the
one set aside for the final /8 policy.

Best regards,
-- 
Tore Anderson
Redpill Linpro AS - http://www.redpill-linpro.com
Tel: +47 21 54 41 27



Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Iljitsch van Beijnum
On 14 apr 2011, at 8:33, Tore Anderson wrote:

 Actually, they're already empty. Chinanet Fujian Province Network
 allocated 498432 addresses today, spread out over 1102(!) individual
 prefixes in the range /21-/24.

Where do you see this? On ftp.apnic.net I see delegated-apnic-20110414 which 
only contains info upto the 13th and has a timestamp of Apr 13 15:15.

Based on that file, APNIC still has 17.57 million regular + 2.27 M legacy = 
19.84 M total address space, so another 0.5 M wouldn't deplete what's left.

I also don't get what they did two days ago:

inetnum:39.192.0.0 - 39.255.255.255
netname:Debogon-prefix
descr:  APNIC Debogon Project

This is address space that's now marked as delegated and removed from the pile 
of unused address space for no obvious reason.


New hijacks, and lots of them

2011-04-14 Thread Ronald F. Guilmette


One particular large and well-distributed snowshoe spamming operation
became the subject of my special scrutiny recently.  After seeing all
of the the various apparently hijacked IP blocks that this particular
snowshoe spamming operation seemed to be relying upon for much of its
IP space, it seemed like the right thing to do for me to report on the
whole mess here.

To begin with here are a couple of files which show the full extent of
this particular rather vast snowshoe operation (including both hijacked
and non-hijacked parts).  By my count we are talking in excess of 6,300
separate second-level gTLD domain names.

   http://www.47-usc-230c2.org/20110414-snowshoe-1.txt
   http://www.47-usc-230c2.org/20110414-snowshoe-2.txt

Dredging into this operation more deeply led me to the following con-
clusions...

Based upon information and belief, the following number resources have
been hijacked, i.e. they either are now, or were in the recent past being
used without proper authorization by a party or parties to whom these
resources were not assigned by any RiR.  (Unless otherwise specified
below, these are all ARIN-assigned number resources.)

AS8143  (1)
AS29987 (2)
AS11756 (3) (4)
AS47024 (5)
AS27906 (6)(7)

198.23.32.0/20 - NET-198-23-32-0-1 (8)
198.57.64.0/20 - NET-198-57-64-0-1 (9)
199.88.32.0/20 - NET-199-88-32-0-1 (10)
199.192.16.0/20 - NET-199-192-16-0-1 (11)
199.196.192.0/19 - NET-199-196-192-0-1 (12)
200.107.216.0/21 - GT-AGSA1-LACNIC (13)
204.147.240.0/20 - NET-204-147-240-0-1 (14)
207.22.224.0/19 - (NET-207-22-192-0-1) (15) (16)

Notes
-
(1) Probable fradulent falsification of JD47-ORG-ARIN - 2010-11-22
(2) Probable fradulent falsification of AS29987  IPADM448-ARIN - 2010-11-04
(3) Probable fradulent falsification of AS11756 - 2011-03-15
(4) Probable fradulent falsification of JR1271-ARIN - 2010-07-08
(5) ARIN unable to validate contact NOC3622-ARIN since 2010-06-19
(6) LACNIC assigned AS
(7) Contact record ERJ3 modified - 2011-04-06 (falsified?)

(8) Probable fradulent falsification of NET-199-88-32-0-1  SH174-ARIN - 
2010-11-03
(9) ARIN unable to valiadate contact GW449-ARIN since 2010-07-18
(10) ARIN unable to valiadate contact DM126-ARIN since 2010-07-16
(11) ARIN unable to valiadate contact RP56-ARIN since 2010-07-22
(12) ARIN unable to valiadate contact FB43-ARIN since 2010-07-17
(13) LACNIC assigned IPv4 block
(14) ARIN unable to valiadate contact LT127-ORG-ARIN since 2010-07-20
(15) Only the 207.22.224.0/19 portion of 207.22.192.0/18 is being routed
(16) ARIN unable to valiadate contact MH521-ARIN since 2010-07-12


Discussion
--

The entire scope of this particular spamming operation spans both the
aforementioned (hijacked) IP ranges and also a number of IP ranges that
are clearly NOT hijacked.  I have attempted to list below all ranges
that either are now in use by this operation, or that have been in use
by this operation, in the relatively recent past.

The various IP blocks listed below are connected, in one way or another,
to several entities that have been caught doing IP block hijacking in
the past, in particular:

   *)  Joytel Wireless of Florida... which apparently has some significant
   connection to an entity called GoRack, also of South Florida, and

   *)  Xeex aka AS27524 aka Nishant Ramachandran, and

   *)  last but by no means least, Media Breakaway, LLC aka JKS Media, LLC,
   aka Dynamic Dolphin (ICANN Accredited Registrar) aka OptInRealBig
   aka the notorious Scott Richter.

   (Essentially all of the domains of this operation are, apparently,
   registered anonymously with Dynamic Dophin, and as noted below, A
   portion of them are also being routed by JKS Media, and a subset of
   those are either hosted in and/or are getting DNS service from IP
   blocks registered to Media Breakaway.)

As you will see below, a few of the ranges that I have identified as
having been hijacked were already/previously blacklisted by Spamhaus
some months ago.  Also, in at least one case, Spamhaus records indicate
that they too believe that the block in question was indeed hijacked.
(It is always nice to have a second, confirming opinion.)

I could speculate on the identity of the person or company which might
most accurately be said to be behind all this, but I actually do not
feel the need to do so in this instance.  The data speaks for itself,
and I do believe that any diligent researcher who really wants to dredge
into it all will likely reach what I consider to be the proper conclusion(s).

===
All IP ranges containing assets of this specific snowshoe operation:


8.24.248.0/21 - via AS19844 (gorack.net)

66.115.166.0/24 - NET-66-115-166-0-1 - via AS22384 (nationalnet.com)
66.115.167.0/24 - NET-66-115-167-0-1 - via AS22384 (nationalnet.com)
66.115.168.0/24 - NET-66-115-168-0-1 - via AS22384

Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Tore Anderson
* Iljitsch van Beijnum

 On 14 apr 2011, at 8:33, Tore Anderson wrote:
 
 Actually, they're already empty. Chinanet Fujian Province Network 
 allocated 498432 addresses today, spread out over 1102(!)
 individual prefixes in the range /21-/24.
 
 Where do you see this? On ftp.apnic.net I see
 delegated-apnic-20110414 which only contains info upto the 13th and
 has a timestamp of Apr 13 15:15.
 
 Based on that file, APNIC still has 17.57 million regular + 2.27 M
 legacy = 19.84 M total address space, so another 0.5 M wouldn't
 deplete what's left.

Hi,

APNIC has for some time now made available an extended version of the
delegated file that explicitly says which blocks are available:

ftp://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-extended-latest

Disregarding 103/8, there were 1104 remaining available prefixes before
APNIC's offices opened today. Now they're closed, and by looking in
whois.apnic.net I can tell that every single one of the prefixes that
were marked in the delegated-extended file as available is now allocated
- 1102 of them to Chinanet Fujian Province Network, and two
(106.0.32.0/19 and 116.90.0.0/18) to the APNIC Debogon Project.

So unless some new blocks (for example returned space) has made it into
the free pool today, they are down to their last /8. Actually, they're a
bit under one /8, as there's been some assignments made to the Debogon
Project in 103/8 already.

 I also don't get what they did two days ago:
 
 inetnum:39.192.0.0 - 39.255.255.255
 netname:Debogon-prefix
 descr:  APNIC Debogon Project
 
 This is address space that's now marked as delegated and removed from
 the pile of unused address space for no obvious reason.

I believe they are using those prefixes for research. According to the
APNIC whois database, 53 individual assignments have been made to the
Debogon Project (including the three we've mentioned). In any case, when
looking at the graph at

http://www.apnic.net/community/ipv4-exhaustion/graphical-information

and the delegated-extended file, it appears that these prefixes do count
as assigned space like any other assignment. I would assume that when
the research project is over, they will be returned to the free pool and
assigned under the last /8 policy just like any other space that enters
the pool after the last /8 policy has been implemented.

Best regards,
-- 
Tore Anderson
Redpill Linpro AS - http://www.redpill-linpro.com/
Tel: +47 21 54 41 27



Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Iljitsch van Beijnum
On 14 apr 2011, at 13:50, Tore Anderson wrote:

 This is address space that's now marked as delegated and removed from
 the pile of unused address space for no obvious reason.

 I believe they are using those prefixes for research.

 and the delegated-extended file, it appears that these prefixes do count
 as assigned space like any other assignment. I would assume that when
 the research project is over, they will be returned to the free pool and
 assigned under the last /8 policy

That is extremely curious. How can they justify taking 4 million addresses for 
research two days before running out of regularly allocatable address space? 
They could have taken that /10 out of the final /8 rather than taking it from 
the last scraps of regular space if they really need a /10 for research, which 
is already dubious in and of itself.

Of course they didn't bother to respond to my request for information about all 
of this.




Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Rubens Kuhl
 That is extremely curious. How can they justify taking 4 million addresses 
 for research two days before running out of regularly allocatable address 
 space? They could have taken that /10 out of the final /8 rather than taking 
 it from the last scraps of regular space if they really need a /10 for 
 research, which is already dubious in and of itself.

Debogon usually means they will establish beacons to detect networks
that will incorrectly filter that block, and is an indication that
such block will soon start being distributed to LIRs.


Rubens



Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Owen DeLong

On Apr 14, 2011, at 5:47 AM, Iljitsch van Beijnum wrote:

 On 14 apr 2011, at 13:50, Tore Anderson wrote:
 
 This is address space that's now marked as delegated and removed from
 the pile of unused address space for no obvious reason.
 
 I believe they are using those prefixes for research.
 
 and the delegated-extended file, it appears that these prefixes do count
 as assigned space like any other assignment. I would assume that when
 the research project is over, they will be returned to the free pool and
 assigned under the last /8 policy
 
 That is extremely curious. How can they justify taking 4 million addresses 
 for research two days before running out of regularly allocatable address 
 space? They could have taken that /10 out of the final /8 rather than taking 
 it from the last scraps of regular space if they really need a /10 for 
 research, which is already dubious in and of itself.
 
 Of course they didn't bother to respond to my request for information about 
 all of this.
 

I believe that rather than research, those are prefixes which are particularly 
dirty and
they have allocated them to the project to try and get them cleaned up so that 
they can
be subsequently issued.

Owen




switch networking help

2011-04-14 Thread Deric Kwok
Hello

I would like to ask general question about switch speed experience.

How can I increase speed in switch port?

ls it to combine more than one port? Any other solution?

In combing ports, what are the advantages and disadvantages?

Any info and experience.  Thank you for your sharing.



Re: switch networking help

2011-04-14 Thread Thomas Donnelly
On Thu, 14 Apr 2011 08:47:32 -0500, Deric Kwok deric.kwok2...@gmail.com  
wrote:



Hello

I would like to ask general question about switch speed experience.

How can I increase speed in switch port?


The speed of the switch port is limited by the hardware. Make sure you are  
running a nic capable of the maximum switchport speed and that they are  
configured to be the maximum speed either by negotiation or manually.


Most switches now days are 100mbps or 1000mbps. If it is too slow for you,  
try upgrading both the end point and replacing the switch to 10G. If you  
give us a make/model number, it is much easier to tell you what your  
switch can do.




ls it to combine more than one port? Any other solution?


Yes, there are a few ways and they vary by vendor, but the most common way  
is LACP etherchannel.


http://en.wikipedia.org/wiki/Link_aggregation#Link_Aggregation_Control_Protocol




In combing ports, what are the advantages and disadvantages?


The advantage is increased bandwidth (naturally), also increased  
redundancy. Unfortunately LACP does not give a true 2gbps capability, it  
simply load balances between the two links based on various factors. So a  
single connection will only go up to 1gbps, even if the nic connecting it  
to the switch is a 10gbps connection. However for switch uplinks this is  
rarely a problem (so long as the correct load balancing algorithm is  
selected) as multiple hosts are connected at 1gbps trying to go upstream.




Any info and experience.  Thank you for your sharing.



This is a 60 second overview and there is much more to this topic than I  
have said, but hopefully this will get you on your feet.


-=Tom Donnelly

--
Using Opera's revolutionary email client: http://www.opera.com/mail/



Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Iljitsch van Beijnum
On 14 apr 2011, at 13:02, Iljitsch van Beijnum wrote:

 Based on that file, APNIC still has 17.57 million regular + 2.27 M legacy = 
 19.84 M total address space, so another 0.5 M wouldn't deplete what's left.

I just got the 15 apr file which has the info for 14 apr (sigh...) and indeed 
1100 blocks adding up to 0.52 million addresses were given out today. And that 
still leaves 2.27 million legacy addresses available, including all of 
43.224.0.0/11 except 43.244 and 43.253, as well as 0.34 million non-legacy, 
non-103/8 addresses.

103/8 is apparently going to be the special final /8. It's still wide open 
except a /16, a /22 and a /24 that are registered to the debogon project (as of 
a week and a half ago).


Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Franck Martin
Recently, Microsoft Australia has been refused a temp allocation (like
they had every year) for one of their conferences.

On 4/15/11 9:01 , Iljitsch van Beijnum iljit...@muada.com wrote:

On 14 apr 2011, at 13:02, Iljitsch van Beijnum wrote:

 Based on that file, APNIC still has 17.57 million regular + 2.27 M
legacy = 19.84 M total address space, so another 0.5 M wouldn't deplete
what's left.

I just got the 15 apr file which has the info for 14 apr (sigh...) and
indeed 1100 blocks adding up to 0.52 million addresses were given out
today. And that still leaves 2.27 million legacy addresses available,
including all of 43.224.0.0/11 except 43.244 and 43.253, as well as 0.34
million non-legacy, non-103/8 addresses.

103/8 is apparently going to be the special final /8. It's still wide
open except a /16, a /22 and a /24 that are registered to the debogon
project (as of a week and a half ago).




Contact for City of Panama City Beach, FL?

2011-04-14 Thread Nathan Eisenberg
Could someone from the IT department for the City of Panama City Beach, Florida 
please contact me off-list?

Best Regards,
Nathan Eisenberg






RE: Contact for City of Panama City Beach, FL?

2011-04-14 Thread Dan Dill
http://www.pcbgov.com/city_directory.htm

Seems like it wouldn't be hard to track down that information...


-Original Message-
From: Nathan Eisenberg [mailto:nat...@atlasnetworks.us] 
Sent: Thursday, April 14, 2011 2:21 PM
To: nanog@nanog.org
Subject: Contact for City of Panama City Beach, FL?

Could someone from the IT department for the City of Panama City Beach, Florida 
please contact me off-list?

Best Regards,
Nathan Eisenberg









Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Skeeve Stevens
All… as of early this morning, APNIC is empty.

Last /8 Policy is now in effect.


...Skeeve



--

Skeeve Stevens, CEO - eintellego Pty Ltd - The Networking Specialists

ske...@eintellego.net ; www.eintellego.net

Phone: 1300 753 383 ; Fax: (+612) 8572 9954

Cell +61 (0)414 753 383 ; skype://skeeve

facebook.com/eintellego or eintell...@facebook.com

twitter.com/networkceoau ; www.linkedin.com/in/skeeve

PO Box 7726, Baulkham Hills, NSW 1755 Australia


--

eintellego - The Experts that the Experts call

- Juniper - HP Networking - Cisco - Brocade - Arista - Allied Telesis

On 15/04/11 7:01 AM, Iljitsch van Beijnum 
iljit...@muada.commailto:iljit...@muada.com wrote:

On 14 apr 2011, at 13:02, Iljitsch van Beijnum wrote:

Based on that file, APNIC still has 17.57 million regular + 2.27 M legacy = 
19.84 M total address space, so another 0.5 M wouldn't deplete what's left.

I just got the 15 apr file which has the info for 14 apr (sigh...) and indeed 
1100 blocks adding up to 0.52 million addresses were given out today. And that 
still leaves 2.27 million legacy addresses available, including all of 
43.224.0.0/11 except 43.244 and 43.253, as well as 0.34 million non-legacy, 
non-103/8 addresses.

103/8 is apparently going to be the special final /8. It's still wide open 
except a /16, a /22 and a /24 that are registered to the debogon project (as of 
a week and a half ago).



Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Iljitsch van Beijnum
On 15 apr 2011, at 0:04, Skeeve Stevens wrote:

 All… as of early this morning, APNIC is empty.

Why do you say that? Do you have information that contradicts my numbers?


Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Skeeve Stevens
Just an email from APNIC 3 hours ago to all regional mailing lists.

Kinda authoritative I would say.

---

On 15/04/11 6:25 AM, APNIC Secretariat 
apnic-no-re...@apnic.netmailto:apnic-no-re...@apnic.net wrote:


___

APNIC IPv4 Address Pool Reaches Final /8
___


Dear APNIC community

We are writing to inform you that as of Friday, 15 April 2011, the APNIC
pool reached the Final /8 IPv4 address block, bringing us to Stage Three
of IPv4 exhaustion in the Asia Pacific. For more information about Stage
Three, please refer to:

http://www.apnic.net/ipv4-exhaustion/stages


Last /8 address policy
--

IPv4 requests will now be assessed under section 9.10 in Policies
for IPv4 address space management in the Asia Pacific region:

 http://www.apnic.net/policy/add-manage-policy#9.10

APNIC's objective during Stage Three is to provide IPv4 address space
for new entrants to the market and for those deploying IPv6.

 http://www.apnic.net/ipv4-stage3-faq

From now, all new and existing APNIC account holders will be entitled
to receive a maximum allocation of a /22 from the Final /8 address
space.

For more details on the eligibility criteria according to the Final /8
policy, please refer to:

http://www.apnic.net/criteria


Act NOW on IPv6
---

We encourage Asia Pacific Internet community members to deploy IPv6
within their organizations. You can refer to APNIC for information
regarding IPv6 deployment, statistics, training, and related regional
policies at:

http://www.apnic.net/ipv6

To apply for IPv6 addresses now, please visit:

http://www.apnic.net/kickstart


___

APNIC Secretariat 
secretar...@apnic.netmailto:secretar...@apnic.net
Asia Pacific NetworkInformation Centre (APNIC)   Tel: +61 7 3858 3100
PO Box 3646 South Brisbane, QLD 4101 AustraliaFax: +61 7 3858 3199
6 Cordelia Street, South Brisbane, QLD
http://www.apnic.nethttp://www.apnic.net/
___
* Sent by email to save paper. Print only if necessary.


---



...Skeeve



--

Skeeve Stevens, CEO - eintellego Pty Ltd - The Networking Specialists

ske...@eintellego.net ; www.eintellego.net

Phone: 1300 753 383 ; Fax: (+612) 8572 9954

Cell +61 (0)414 753 383 ; skype://skeeve

facebook.com/eintellego or eintell...@facebook.com

twitter.com/networkceoau ; www.linkedin.com/in/skeeve

PO Box 7726, Baulkham Hills, NSW 1755 Australia


--

eintellego - The Experts that the Experts call

- Juniper - HP Networking - Cisco - Brocade - Arista - Allied Telesis

On 15/04/11 8:09 AM, Iljitsch van Beijnum 
iljit...@muada.commailto:iljit...@muada.com wrote:

On 15 apr 2011, at 0:04, Skeeve Stevens wrote:

All… as of early this morning, APNIC is empty.

Why do you say that? Do you have information that contradicts my numbers?


RE: Contact for City of Panama City Beach, FL?

2011-04-14 Thread Nathan Eisenberg
 -Original Message-
 From: Dan Dill [mailto:d...@harsch.com]
 Sent: Thursday, April 14, 2011 3:03 PM
 To: Nathan Eisenberg; nanog@nanog.org
 Subject: RE: Contact for City of Panama City Beach, FL?
 
 http://www.pcbgov.com/city_directory.htm
 
 Seems like it wouldn't be hard to track down that information...

I did utilize that page prior to posting to NANOG - sorry for not stating that 
explicitly.

Thanks Dan!




Re: Contact for City of Panama City Beach, FL?

2011-04-14 Thread William Pitcock
On Thu, 14 Apr 2011 15:02:36 -0700
Dan Dill d...@harsch.com wrote:

 http://www.pcbgov.com/city_directory.htm
 
 Seems like it wouldn't be hard to track down that information...

Can you identify where on that page it lists a contact for the IT
department of the Panama City government?

I can't, because it does not list such a contact.

William



Re: Contact for City of Panama City Beach, FL?

2011-04-14 Thread Jay Ashworth
- Original Message -
 From: William Pitcock neno...@systeminplace.net

 On Thu, 14 Apr 2011 15:02:36 -0700
 Dan Dill d...@harsch.com wrote:
  http://www.pcbgov.com/city_directory.htm
 
  Seems like it wouldn't be hard to track down that information...
 
 Can you identify where on that page it lists a contact for the IT
 department of the Panama City government?
 
 I can't, because it does not list such a contact.

Aw, c'mon, guys...

We just *finished* Please don't top post; it's annoying a day or two ago;
is it really time for why can't people just pick up the phone and call
*already*?  :-)

Cheers,
-- jra



Contact for va.gov

2011-04-14 Thread Nathan Eisenberg
Yes, two in one day.  Wholesalers don't wipe device configs, apparently.

Anyways, would a technical contact for va.gov please contact me off-list?

Best Regards,
Nathan Eisenberg




Re: Contact for va.gov

2011-04-14 Thread Bret Palsson
Wouldn't the world be a better place if the ARIN contact information
was correct and usable. It would be nice to have an easy place for
these types of requests. I guess maybe this list is that place.

Sent from my iPhone

On Apr 14, 2011, at 7:33 PM, Nathan Eisenberg nat...@atlasnetworks.us wrote:

 Yes, two in one day.  Wholesalers don't wipe device configs, apparently.

 Anyways, would a technical contact for va.gov please contact me off-list?

 Best Regards,
 Nathan Eisenberg





RE: Contact for va.gov

2011-04-14 Thread Stephens, Josh
I pinged a buddy of mine at the VA. No word yet and I'm working from Sydney 
this week so a bit delayed anyhow...

Josh

-Original Message-
From: Bret Palsson [mailto:b...@getjive.com] 
Sent: Friday, April 15, 2011 11:46 AM
To: Nathan Eisenberg
Cc: nanog@nanog.org
Subject: Re: Contact for va.gov

Wouldn't the world be a better place if the ARIN contact information
was correct and usable. It would be nice to have an easy place for
these types of requests. I guess maybe this list is that place.

Sent from my iPhone

On Apr 14, 2011, at 7:33 PM, Nathan Eisenberg nat...@atlasnetworks.us wrote:

 Yes, two in one day.  Wholesalers don't wipe device configs, apparently.

 Anyways, would a technical contact for va.gov please contact me off-list?

 Best Regards,
 Nathan Eisenberg






Re: Contact for va.gov

2011-04-14 Thread Jon Auer
On Thu, Apr 14, 2011 at 8:32 PM, Nathan Eisenberg
nat...@atlasnetworks.us wrote:
 Yes, two in one day.  Wholesalers don't wipe device configs, apparently.

 Anyways, would a technical contact for va.gov please contact me off-list?

 Best Regards,
 Nathan Eisenberg


Is tracking down the original user and letting them know about the
config leak a standard practice, necessary or the right thing to do?

I've always just wiped flash and carried on.



Re: Contact for va.gov

2011-04-14 Thread Jim Duncan
It would be far more effective if more organizations set up and maintained a 
slash-security page (see the NIAC Vulnerability Disclosure Framework for 
details). This is _exactly_ the kind of information that should be posted there.

Jim


--
James N. Duncan, CISSP
Manager, Juniper Networks Security Incident Response Team (Juniper SIRT)
E-mail: jdun...@juniper.net  Mobile: +1 919 608 0748
PGP key fingerprint:  E09E EA55 DA28 1399 75EB  D6A2 7092 9A9C 6DC3 1821


- Original Message -
From: Bret Palsson [mailto:b...@getjive.com]
Sent: Thursday, April 14, 2011 09:45 PM
To: Nathan Eisenberg nat...@atlasnetworks.us
Cc: nanog@nanog.org nanog@nanog.org
Subject: Re: Contact for va.gov

Wouldn't the world be a better place if the ARIN contact information
was correct and usable. It would be nice to have an easy place for
these types of requests. I guess maybe this list is that place.

Sent from my iPhone

On Apr 14, 2011, at 7:33 PM, Nathan Eisenberg nat...@atlasnetworks.us wrote:

 Yes, two in one day.  Wholesalers don't wipe device configs, apparently.

 Anyways, would a technical contact for va.gov please contact me off-list?

 Best Regards,
 Nathan Eisenberg






RE: Contact for va.gov

2011-04-14 Thread Nathan Eisenberg
 Is tracking down the original user and letting them know about the
 config leak a standard practice, necessary or the right thing to do?
 
Municipal networks often provide some emergency services, and we all know what 
the VA provides.  Once you know whose gear it is, I guess you have to decide if 
you'd be willing to have a little bit of that organization's (or their patrons) 
blood on your hands.

Especially in the case of the VA, for me, the answer is 'hell no'.  If it was 
Joes defunct sprocket startup, I'd likely just format flash: and move on. 

Nathan


Re: Contact for va.gov

2011-04-14 Thread Mike

On 04/14/2011 07:54 PM, Nathan Eisenberg wrote:

Is tracking down the original user and letting them know about the
config leak a standard practice, necessary or the right thing to do?


Municipal networks often provide some emergency services, and we all know what 
the VA provides.  Once you know whose gear it is, I guess you have to decide if 
you'd be willing to have a little bit of that organization's (or their patrons) 
blood on your hands.

Especially in the case of the VA, for me, the answer is 'hell no'.  If it was Joes 
defunct sprocket startup, I'd likely just format flash: and move on.




A few months back I had exactly this situation - I bought a switch off 
ebay that was still loaded with it's config, and it had come from 
yahoo.com. Now, I am the good netizen and I flagged them about this and 
was able to help them find the source which I assume they 'fixed' this 
leak. The data in the fig file could have been (mis)used to yahoo's 
network security disadvantage and wherever you stand I think we all can 
agree that cluing them in was the right thing to do. But for someone 
else's startup, probably would not have bothered.


Mike-