June 2010 - NANOG - lists.nanog.org

Todd Underwood was a little late
by Jon Lewis 29 Jun '10

29 Jun '10

I just took a closer look at something odd I'd noticed several days ago. One of our DNS servers was sending crazy amounts of ARP requests for IPs in the /24 its main IP is in. What I've found is we're getting hit with DNS requests that look like they're from "typical internet traffic for someone in China" hitting this DNS server from IPs in its /24 which are currently not in use (at least on our local network). It would appear someone in China is using our IP space, presumably behind a NAT router, and they're leaking some traffic non-NAT'd. 20:53:41.361734 IP 209.208.121.66.41755 > 209.208.121.126.53: 15939+ A? ns5.z.lxdns.com. (33) 20:53:43.523210 IP 209.208.121.95.39393 > 209.208.121.126.53: 15939+ A? www.nanhutravel.com. (37) 20:53:48.411805 IP 209.208.121.66.33390 > 209.208.121.126.53: 15939+ A? test.csxm.cdn20.com. (37) 20:53:50.557680 IP 209.208.121.135.40056 > 209.208.121.126.53: 15939+ A? rextest2.lxdns.com. (36) 20:53:56.918993 IP 209.208.121.135.37291 > 209.208.121.126.53: 15939+ A? www.51seer.com. (32) 20:54:20.033902 IP 209.208.121.95.37544 > 209.208.121.126.53: 15939+ A? image.dhgate.cdn20.com. (40) 20:54:21.900295 IP 209.208.121.66.35144 > 209.208.121.126.53: 15939+ A? static.xn-app.com. (35) 20:54:27.711853 IP 209.208.121.66.33518 > 209.208.121.126.53: 15939+ A? oa.hanhe.com. (30) 20:54:29.642938 IP 209.208.121.135.41723 > 209.208.121.126.53: 15939+ A? pic1.kaixin001.com. (36) 20:54:32.357414 IP 209.208.121.95.38564 > 209.208.121.126.53: 15939+ A? rr.snyu.com. (29) 20:54:38.901315 IP 209.208.121.95.37840 > 209.208.121.126.53: 15939+ A? edu.163.com. (29) 20:54:39.807385 IP 209.208.121.95.36069 > 209.208.121.126.53: 15939+ A? image.dhgate.cdn20.com. (40) 20:54:40.833778 IP 209.208.121.66.34949 > 209.208.121.126.53: 15939+ A? uphn.snswall.com. (34) 20:54:42.070294 IP 209.208.121.95.38405 > 209.208.121.126.53: 15939+ A? zwgk.cma.gov.cn. (33) 20:54:42.189939 IP 209.208.121.135.36637 > 209.208.121.126.53: 15939+ A? btocdn.52yeyou.com. (36) 20:54:45.767299 IP 209.208.121.95.41405 > 209.208.121.126.53: 15939+ A? img1.kaixin001.com.cn. (39) 20:54:48.595582 IP 209.208.121.66.40099 > 209.208.121.126.53: 15939+ A? rextest2.cdn20.com. (36) 20:54:49.480147 IP 209.208.121.95.42363 > 209.208.121.126.53: 15939+ A? www.dameiren.com. (34) 20:54:50.714200 IP 209.208.121.135.41497 > 209.208.121.126.53: 15939+ A? pic1.kaixin001.com.cn. (39) 20:54:54.116841 IP 209.208.121.135.36828 > 209.208.121.126.53: 15939+ A? i.jstv.com. (28) I hope they got a good deal on the IP space...and a better deal on their buggy router. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

21 33

Re: ATT BGP - Advertising my network on accident
by Eric Williams 29 Jun '10

29 Jun '10

This issue has been resolved by breaking up the /22 into /24's. Thanks to all for the advise. Maybe next time I will take someone's advise and advertise one of ATT's /8's. From: Eric Williams/Connectria To: nanog(a)nanog.org Date: 06/24/2010 02:37 PM Subject: ATT BGP - Advertising my network on accident AT&T is currently advertising my address space to the internet accidentally via BGP which they should not be. Since they are advertising my address space on accident, we are dead in the water. Does anybody out there work for ATT or know of the number I can call in order to have them stop advertising my /22 ASAP!!!!

6 6

Global Crossing POC
by Steven Fischer 28 Jun '10

28 Jun '10

Can someone from Global Crossing contact me off-list regarding some routing anomolies we are seeing? Thanks. -- To him who is able to keep you from falling and to present you before his glorious presence without fault and with great joy

1 0

Re: BGP Tool for Simulation
by Tom Pipes 28 Jun '10

28 Jun '10

Hello Giuliano, Along with the recommendation of dynamips, I would suggest downloading gns3, which ties into dynamips. You can run the same version of IOS that you are working with in production, and there are versions for Windows/*nix. http://www.gns3.net/ It acts more like an emulators at first glance, and does not seem to have the same limitations as some of the other simulators out there. Just make sure you have the hardware to support it. Thanks, --- Tom Pipes T6 Broadband/ Essex Telcom Inc tom.pipes(a)t6mail.com ----- Original Message ----- From: "Bill Fehring" <lists(a)billfehring.com> To: giulianocm(a)uol.com.br Cc: "North American Network Operators Group" <nanog(a)merit.edu> Sent: Sunday, June 27, 2010 11:37:17 PM Subject: Re: BGP Tool for Simulation Oi Giulianao, I've used this in the past to dump a lot of routes into test networks: http://code.google.com/p/bgpsimple/ Tutorial: http://evilrouters.net/2009/08/21/getting-bgp-routes-into-dynamips-with-vid… There's a similar project written in python, but I can't find it right now. HTH, -Bill Fehring On Sun, Jun 27, 2010 at 18:32, GIULIANOCM (UOL) <giulianocm(a)uol.com.br> wrote: > People, > > I am looking for a tool (free or not) to simulate BGP full internet route > table peering and injection using real CISCO and JUNIPER routers. > > We have found some power tools like Spirent or Agilent but they are a too > expensive to acquire for now. > > The main idea is to have a software tool for unix or linux system, that > supports to simulate a cloud a carrier or an ISP, to work with real routers, > establishing connection using BGP protocol and injecting on this real > routers the full internet routing table - ipv4 or ipv6. > > Do you know some collection of tools (software tools) that we can use to do > this kind of work ? > > It is possible to collect full internet routing table and inject it to a > real router using a software for simulate real conditions ? > > Besides, the tool will need some additional features in simulation like the > set of communities, local preference, med and other BGP attributes. > > What do you recommend for this tasks ? > > Thanks a lot, > > Giuliano > >

2 1

Penetration test vendors
by George Bonser 28 Jun '10

28 Jun '10

I would like to thank everyone who provided their recommendations both on and off list. There was a lot of off-list response but not exactly what I had expected to see. I had expected to see a lot of different vendors but also expected to see a couple that several would recommend. That really didn't happen. Practically every single suggestion was a different vendor. There was one vendor that got multiple recommendations but it was also the only vendor that multiple people recommended avoiding. In fact, it was the only vendor that anyone recommended to avoid. As I now have a list of many vendors that I didn't know existed, I will sort through the mail later today or tomorrow and consolidate the list. The lesson seems to be that everyone seems to have someone different that they trust to test their network and that a more in-depth look at the recommendations is in order. Thanks again, everyone. George

1 0

RE: Re: BGP Tool for Simulation
by Lynchehaun, Patrick (Patrick) 28 Jun '10

28 Jun '10

You could use load sbgp/mrtd script to load route dumps. There is also bgpsimple http://code.google.com/p/bgpsimple/wiki/README This also brings up another question, anyone know of v6 rib tool on unix to load v6 route dumps. Tks, Patrick. Message: 8 Date: Sun, 27 Jun 2010 22:04:54 -0400 From: Jack Carrozzo <jack(a)crepinc.com> Subject: Re: BGP Tool for Simulation To: giulianocm(a)uol.com.br Cc: North American Network Operators Group <nanog(a)merit.edu> Message-ID: <AANLkTik_iMlcU-GbwJim4VbqT0BtEeAd6AfNBBTn9ArS(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Roll quagga / BGPd on *nix and bring up sessions with whatever you like. For full tables, you can either hack up a few lines of perl to output a bunch of 'network a.b.c.d' lines from any of the available text looking glasses into the bgpd conf, or just bring up ebgp-multihop session with one of your borders or one of your friends. Prefix lists, communities, etc are all supported. -Jack Carrozzo On Sun, Jun 27, 2010 at 9:32 PM, GIULIANOCM (UOL) <giulianocm(a)uol.com.br>wrote: > People, > > I am looking for a tool (free or not) to simulate BGP full internet > route table peering and injection using real CISCO and JUNIPER routers. > > We have found some power tools like Spirent or Agilent but they are a > too expensive to acquire for now. > > The main idea is to have a software tool for unix or linux system, > that supports to simulate a cloud a carrier or an ISP, to work with > real routers, establishing connection using BGP protocol and injecting > on this real routers the full internet routing table - ipv4 or ipv6. > > Do you know some collection of tools (software tools) that we can use > to do this kind of work ? > > It is possible to collect full internet routing table and inject it to > a real router using a software for simulate real conditions ? > > Besides, the tool will need some additional features in simulation > like the set of communities, local preference, med and other BGP attributes. > > What do you recommend for this tasks ? > > Thanks a lot, > > Giuliano > > ------------------------------ _______________________________________________ NANOG mailing list NANOG(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog End of NANOG Digest, Vol 29, Issue 79 *************************************

2 1

BGP Tool for Simulation
by GIULIANOCM (UOL) 28 Jun '10

28 Jun '10

People, I am looking for a tool (free or not) to simulate BGP full internet route table peering and injection using real CISCO and JUNIPER routers. We have found some power tools like Spirent or Agilent but they are a too expensive to acquire for now. The main idea is to have a software tool for unix or linux system, that supports to simulate a cloud a carrier or an ISP, to work with real routers, establishing connection using BGP protocol and injecting on this real routers the full internet routing table - ipv4 or ipv6. Do you know some collection of tools (software tools) that we can use to do this kind of work ? It is possible to collect full internet routing table and inject it to a real router using a software for simulate real conditions ? Besides, the tool will need some additional features in simulation like the set of communities, local preference, med and other BGP attributes. What do you recommend for this tasks ? Thanks a lot, Giuliano

3 3

Re: Very Strange - TCP SWEEP Alerts / Inconsistent with traffic onsystem
by khatfield＠socllc.net 28 Jun '10

28 Jun '10

Excellent! Thanks John. We have seen this sort of signature before but we couldn't find the reference source in our library. I don't believe this is one we had. Thanks! Kevin ------Original Message------ From: John Kristoff To: Kevin Hatfield Cc: nanog(a)nanog.org Subject: Re: Very Strange - TCP SWEEP Alerts / Inconsistent with traffic onsystem Sent: Jun 27, 2010 9:32 PM On Sun, 27 Jun 2010 17:22:51 -0400 (EDT) khatfield(a)socllc.net wrote: > Here is an example report we received from AT&T: > 04:29:27 x.x.x.x 0.0.0.0 [TCP-SWEEP] > (total=23,dp=1024,min=212.1.185.6,max=212.1.191.127,Jun27-04:21:01,Jun27-04:29:26) > (USI-amsxaid01) 04:29:27 x.x.x.x 0.0.0.0 [TCP-SWEEP] > (total=16,dp=3072,min=212.1.189.1,max=212.1.188.118,Jun27-04:21:15,Jun27-04:29:09) > (USI-amsxaid01) 04:36:44 x.x.x.x 0.0.0.0 [TCP-SWEEP] This looks like the trademark signature of back scatter as a result of someone using the juno.c or derivative code to SYN flood a host. You are most likely getting this traffic from a host that is getting attacked. In the junos.c code you'll see this: syn->sport = htons(1024 + (random() & 2048)); A random number is ANDed against 2048, the result is then added to 1024. What will be added is always either 0 or 2048, because 2048 has only one bit set. 1024 + 2048 = 3072. Therefore, syn-sport will only ever equal 1024 or 3072. Or in your case, it shows up as the dport on the way back. John

1 0

Very Strange - TCP SWEEP Alerts / Inconsistent with traffic on system
by khatfield＠socllc.net 28 Jun '10

28 Jun '10

Folks, We have a strange situation occurring lately where we are getting some reports of TCP Sweeps from some one of our IP's, yet the IP is one of many specifically configured for inbound traffic and do not emit outbound traffic unless for response. Specifically, these are ddos mitigation IP's so they are attacked fairly frequently. With this in mind, the last few days one of the IP's being reported has been under constant attack. Here is an example report we received from AT&T: 04:29:27 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=23,dp=1024,min=212.1.185.6,max=212.1.191.127,Jun27-04:21:01,Jun27-04:29:26) (USI-amsxaid01) 04:29:27 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=16,dp=3072,min=212.1.189.1,max=212.1.188.118,Jun27-04:21:15,Jun27-04:29:09) (USI-amsxaid01) 04:36:44 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=16,dp=1024,min=212.1.188.1,max=212.1.185.126,Jun27-04:29:51,Jun27-04:35:53) (USI-amsxaid01) 04:20:47 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=25,dp=1024,min=212.1.190.11,max=212.1.189.120,Jun27-04:12:37,Jun27-04:20:40) (USI-amsxaid01) 04:20:47 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=18,dp=3072,min=212.1.189.3,max=212.1.186.118,Jun27-04:13:15,Jun27-04:20:37) (USI-amsxaid01) 04:12:36 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=34,dp=1024,min=212.1.191.8,max=212.1.191.121,Jun27-03:56:28,Jun27-04:12:29) (USI-amsxaid01) 04:12:36 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=28,dp=3072,min=212.1.186.6,max=213.244.176.119,Jun27-03:56:48,Jun27-04:11:45) (USI-amsxaid01) ------------------------ Report from DK*CERT: If nothing else mentioned below, timezone is believed to be UTC+0200(CEST) Destination address(es): Adresser i nettene 130.225.16.0/22 og 130.225.2.128/25 Security logs: #Jun 27 18:13:40 2010 .. Jun 27 18:58:13 2010 # Scan from x.x.x.x affecting at least # 81 addresses targeting TCP:1024, TCP:3072. # ------------------------ I have removed our IP and replaced it with x.x.x.x. To be a bit more clear, this is a reverse-proxy IP address. This IP is in a NAT type configuration where it is sent back to filtering clusters. No outbound traffic is configured on these IP's except where requests / responses flow through it. I know a year or two ago there was a bug in Cisco IOS that would report a sweep when extreme packet load occurred or a burst hit. At the time of this report we saw an attack burst to around 310,000PPS on this IP (inbound). Is it simply likely the networks reporting have several IP's being used in the attack and that is what they are seeing? That's what we originally thought but the port scans throw that theory off... Our security team has gone through all PCAPs during the mentioned time frames and we are not showing any sort of outbound scan traffic. Any ideas why this would be showing as a sweep? Our IDS systems do not scan requesting IP's originating systems. Any help is appreciated, we're simply trying to get to the bottom of the reports. Kevin

3 3

Whois-RWS Release Update
by Mark Kosters 27 Jun '10

27 Jun '10

<Apologies for the duplicate email but want to keep you informed about changes occurring at ARIN. This particular upgrade may be of interest to those who are not subscribed to arin-announce.> ----- Forwarded message from Member Services <info(a)arin.net> ----- From: Member Services <info(a)arin.net> Date: Sun, 27 Jun 2010 07:11:54 -0400 To: "arin-announce(a)arin.net" <arin-announce(a)arin.net> Subject: [arin-announce] Whois-RWS Release Update On 26 June, ARIN rolled out Whois-RWS. Unfortunately, we experienced a very significant increase in traffic after rollout which exceeded our load capacity and caused the new service to degrade to an unacceptable level. To ensure customers could continue to access ARIN's Whois data, we have reverted to the old service which degrades more gracefully under load. We are examining the data gathered on the traffic patterns we experienced and are making the necessary changes to deploy Whois-RWS the near future. We thank you for your patience, and we look forward to making the Whois-RWS service available for community use very soon. Regards, Mark Kosters Chief Technical Officer American Registry for Internet Numbers (ARIN) ----- End forwarded message -----

1 0