September 2016 - NANOG - lists.nanog.org

Domain renawals
by Jeff Jones 22 Sep '16

22 Sep '16

Hello All, Sorry if this is low level. But are people sick of registrars jacking up prices? Who is the cheapest and most reliable? I have been using whois.com, networksolutions.com and am looking for input on who is cheap, secure, reliable registrar. Thanks for your input. ~Jeff

20 26

Re: CDN Overload?
by Scott Weeks 21 Sep '16

21 Sep '16

:: I have made this into a Google Form to make it easier to :: track compared to randomly formatted responses on multiple :: mailing lists, Facebook Groups, etc. Yeah, because... but I don't do email like that why is it hard to read? it's really hard to read email this way. because it's out of order umm, ok. I fixed it for you scott

1 0

importance of fiber cleaning
by Mikael Abrahamsson 21 Sep '16

21 Sep '16

https://www.sunet.se/blogg/long-read-cleanliness-is-a-virtue/ This is an excellent article regarding fiber cleaning and its importance. Please do share with other people in our business. I'm sure lack of proper fiber cleaning causes a lot of unneccessary outages and operational problems worldwide, partly because people aren't aware of its importance. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

4 3

Yahoo as#10310 reachability problem
by Mohamed Kamal 21 Sep '16

21 Sep '16

Can someone from Yahoo as#10310 contact me off-list, we have some problems reaching Yahoo through Telia and GTT. Thanks. -- Mohamed Kamal Core Network Sr. Engineer

1 0

Re: "Defensive" BGP hijacking?
by Bryant Townsend 21 Sep '16

21 Sep '16

Hello Everyone, I would like to give as much insight as I can in regards to the BGP hijack being discussed in this thread. I won’t be going into specific details of the attack, but we do plan to release more information on our website when we are able to. I also wanted to let Hugo (who started the thread) know that we harbor no hard feelings about bringing this topic up, as it is relevant to the community and does warrant discussion. Hugo, you may owe me a beer the next time we meet. :) We agree with others that NANOG is the most appropriate venue to answer any questions and discuss the topic at hand. I have been attending NANOG for the past 3-4 years, and I can assure you that it is of the utmost importance to me how the community views my company, my employees, and myself. There are many people in this community that I personally have the upmost respect for, and it would sadden me If I were to lose the respect of mentors, colleagues, and friends by not responding. That being said, I think there are a fair number of people in NANOG that would vouch for my character and ethics relating to the intent of my actions, even if I were to remain silent. I would also like to preface that my explanation of the events that occurred and actions taken by BackConnect are not to justify or provide excuses. My goal is to simply show what happened and give insight into our actions. I will start with a little background to bring anyone up to speed that is not aware of the events that transpired. *About the company, BackConnect, Inc.*: We are a new (~4 months old) open-sourced based DDoS mitigation and network security provider that specializes in custom intrusion detection and prevention systems. We also provide threat intelligence services, with an emphasis on active botnets, new and upcoming DDoS attack patterns, and boot services. From time to time, this information flows through our network for collection purposes. *Events leading to the Hijack*: On 9/6/2016, ~10:30AM PST, one of our clients and our website received a large and relatively sophisticated DDoS attack. The attack targeted entire subnets and peaked over 200 Gbps and 40Mpps. Although the attack was automatically detected and mostly filtered, there was initially a small leak. In response we quickly applied new security rules that rendered it entirely ineffective. The attackers continued to attack our network and client for roughly 6 hours before giving up. *Events that caused us to perform the BGP hijack*: After the DDoS attacks subsided, the attackers started to harass us by calling in using spoofed phone numbers. Curious to what this was all about, we fielded various calls which allowed us to ascertain who was behind the attacks by correlating e-mails with the information they provided over the phone. Throughout the day and late into the night, these calls and threats continued to increase in number. Throughout these calls we noticed an increasing trend of them bringing up personal information of myself and employees. At this point I personally filled a police report in preparation to a possible SWATing attempt. As they continued to harass our company, more and more red flags indicated that I would soon be targeted. This was the point where I decided I needed to go on the offensive to protect myself, my partner, visiting family, and my employees. The actions proved to be extremely effective, as all forms of harassment and threats from the attackers immediately stopped. In addition to our main objective, we were able to collect intelligence on the actors behind the bot net as well as identify the attack servers used by the booter service. *Afterthoughts*: The decision to hijack the attackers IP space was not something I took lightly. I was fully aware there were services that reported such actions and knew that this could potentially be brought up in discussion and hurt BackConnect’s image. Even though we had the capacity to hide our actions, we felt that it would be wrong to do so. I have spent a long time reflecting on my decision and how it may negatively impact the company and myself in some people’s eyes, but ultimately I stand by it. The experience and feedback I have gained from these events has proven invaluable and will be used to shape the policies surrounding the future handling of similar situations. I am happy to field questions, but cannot promise any answers, disclosure of further information, or when they will be responded to. Sincerely, Bryant Townsend

14 20

Re: PlayStationNetwork blocking of CGNAT public addresses
by Mark Andrews 21 Sep '16

21 Sep '16

Mark Andrews writes: > > In message <09342130-874F-4FA4-B410-B7B66A75FA4D(a)mtin.net>, Justin Wilson wri > te > s: > > PSN is one reason I am not a fan of CGNAT. All they see are tons of > > connections from the same IP. This results in them banning folks. Due > > to them being hacked so many times getting them to actually communicate > > is almost impossible. My .02 is just get the gamers a true public if at > > all possible. > > > > Justin Wilson > > j2sw(a)mtin.net > > What we need is business tech reporters to continually report on > these failures of content providers to deliver their services over > IPv6. 20 years lead time should be enough for any service. Additionally is the a role for the SEC in ensuring that companies take IPv6 seriously? If I remember correctly they got involved with Y2K. Just because there isn't a hard date it doesn't mean that IPv6 is any less important than Y2K to your business's survival. > Mark > -- > Mark Andrews, ISC > 1 Seymour St., Dundas Valley, NSW 2117, Australia > PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

1 0

Level 3 GBLX / Legacy Twt IPv6 Issue
by Jeff Waddell 20 Sep '16

20 Sep '16

I am having an issue where since the the old twt convergence by Level 3 to the GBLX network/AS3549 our v6 prefix isn't being announced outside of Level 3. I have had a ticket open for a week and had one engineer who seemed to be on to fixing it (regarding an export policy) but then that went silent and now I am getting no-where with support (other than promised call backs) Can someone from Level 3 reach out off list and help me out? Thanks Jeff jeff(a)waddellsolutions.com

1 0

Re: "Defensive" BGP hijacking?
by Scott Weeks 20 Sep '16

20 Sep '16

--- dougm.work(a)gmail.com wrote: From: Doug Montgomery <dougm.work(a)gmail.com> If only there were a global system, with consistent and verifiable security properties, to permit address holders to declare the set of AS's authorized to announce their prefixes, and routers anywhere on the Internet to independently verify the corresponding validity of received announcements. *cough https://www.nanog.org/meetings/abstract?id=2846 cough* ------------------------------------------------ Yes, RPKI. That's what I was waiting for. Now we can get to a real discussion... ;-) scott

8 15

Customers announcing communities to SP of SP
by Jason Lixfeld 20 Sep '16

20 Sep '16

Hi, Consider the following scenario: - Customer A is a customer of SP A - SP A is a customer of SP B - SP B has a traffic engineering community implementation With regards to using BGP communities for TE: - Does SP A write their own community implementation that maps to (some portion of) the community implementation of SP B? - Does SP A write their own community implementation that has no mappings at all to the community implementation of SP B; any TE that is required to be pushed to SP B is done by some dialog and coordination between Customer A and SP A? - Does SP A allow Customer A to announce prefixes tagged with SP B’s communities[1][2] - Is this sort of thing really complicated today, but one of the goals of draft-heitz-idr-large-community? [1] Customer A has knowledge of SP A’s upstream SP B [2] This opens up a can of worms where SP A or SP B implements some communities prefixed with reserved ASes, so we’ll assume that SP A implements some method of allowing communities prefixed with ASes of SP A and SP B only. Thanks!

4 3

ATT contact about BGP leak
by Fabien V. 19 Sep '16

19 Sep '16

Hi the list =) Someone from AT&T on the list ? We have a potential BGP leak on a recently transfered /16 Sent email to noc @ but no reply since 6 hours. Perhaps someone can contact me directly ? fabien AT beufa DOT net Thanks ----- Fabien VINCENT ------------------------------------------------------------------- Twitter : @beufanet Website : https://beufa.net

1 0