December 2019 - NANOG - lists.nanog.org

End to End testing
by Fawcett, Nick 12 Dec '19

12 Dec '19

Anyone have any suggestions on devices that I can put at two points in the network to test packet loss, latency, jitter etc. I was thinking of maybe engineering my own using a couple of pi's, but the downfall is they don't have SFP ports. I'm looking for something that's portable and easy to configure and drop in. Thanks. ~Nick -- Checked by SOPHOS http://www.sophos.com

10 9

Downtown Boston Dark Fiber Pricing
by Rod Beck 11 Dec '19

11 Dec '19

Hi, I have questions regarding IRU pricing in this market. Please contact off list. Thanks gang. Regards, Roderick. Roderick Beck VP of Business Development United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-70-605-5144 [1467221477350_image005.png]

1 0

DDoS attack
by ahmed.dalaali＠hrins.net 10 Dec '19

10 Dec '19

Dear All, My network is being flooded with UDP packets, Denial of Service attack, soucing from Cloud flare and Google IP Addresses, with 200-300 mbps minimum traffic, the destination in my network are IP prefixes that is currnetly not used but still getting traffic with high volume. The traffic is being generated with high intervals between 10-30 Minutes for each time, maxing to 800 mbps When reached out cloudflare support, they mentioned that there services are running on Nat so they can’t pin out which server is attacking based on ip address alone, as a single IP has more than 5000 server behind it, providing 1 source IP and UDP source port, didn’t help either Any suggestions? Regards, Ahmed Dala Ali

20 22

NFL Sunday Ticket - Online Streaming service
by Justin Krejci 10 Dec '19

10 Dec '19

I am looking for a contact in the network group (may be called National Escalation team or NatEsc team internally) within AT&T/DirecTV pertaining to the NFL Sunday Ticket online streaming service. I have been attempting to work through their normal support process for quite some time, they are extremely isolated and handicapped in the support center and I am so frustrated at the impossibility to get any traction through their call center to deal with a network related issue. I have had 4 cases go to their escalation team and they all mysteriously close with no real or valid resolution. I've spoken with about 4 or 5 supervisors in their Tulsa call center and they are unable to do much. It has been a nightmare and I am hoping someone has a contact they can get me in touch with.

1 0

Re: DDoS attack
by Christopher Morrow 09 Dec '19

09 Dec '19

On Mon, Dec 9, 2019 at 4:08 PM Michael Sherlock <michael.sherlock(a)hrins.net> wrote: > > You asked what is being attacked > > IP addresses that are currently not assigned to end users > > And ip addresses assigned to end users > > End user= Home broadband customers > > We are not hosting any significant servers I'm being unclear or you are being overly pedantic.. neither is helping. "what ip address can I look in netflow for traffic destined to which is part of this attack?" Anyone trying to help you is going to want to know what destination address in your network is receiving this traffic... not providing same after ~15 emails is going to make your situation not get better. I'd suggest you post the addresses to the list though... so other folk can go looking as well. > Regards, > > Michael Sherlock > Mobile: +44 75070 92392 > > Sent from my iPhone > > > On Dec 9, 2019, at 9:04 PM, Christopher Morrow <morrowc.lists(a)gmail.com> wrote: > > > > On Mon, Dec 9, 2019 at 3:42 PM Michael Sherlock > > <michael.sherlock(a)hrins.net> wrote: > >> > >> Cristopher, > >> > >> Ip addresses that are not currently in use, and IP addresses that is currently used for CGNAT for end users > >> > > > > I'm 100% sure that those words mean something to you.. but not > > operating your network they don't mean anything to me. > > > > > >> > >> Regards, > >> > >> Michael Sherlock > >> Mobile: +44 75070 92392 > >> > >> Sent from my iPhone > >> > >> On Dec 9, 2019, at 8:36 PM, "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> wrote: > >> > >> > >> > >> Begin forwarded message: > >> > >> From: Christopher Morrow <morrowc.lists(a)gmail.com> > >> Subject: Re: DDoS attack > >> Date: December 9, 2019 at 11:11:31 PM GMT+3 > >> To: "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> > >> Cc: nanog list <nanog(a)nanog.org> > >> > >> I'd note that: "what prefixes?" isn't answered here... like: "what is > >> the thing on your network which is being attacked?" > >> > >> On Mon, Dec 9, 2019 at 3:08 PM ahmed.dalaali(a)hrins.net > >> <ahmed.dalaali(a)hrins.net> wrote: > >> > >> > >> Dear All, > >> > >> My network is being flooded with UDP packets, Denial of Service attack, soucing from Cloud flare and Google IP Addresses, with 200-300 mbps minimum traffic, the destination in my network are IP prefixes that is currnetly not used but still getting traffic with high volume. > >> The traffic is being generated with high intervals between 10-30 Minutes for each time, maxing to 800 mbps > >> When reached out cloudflare support, they mentioned that there services are running on Nat so they can’t pin out which server is attacking based on ip address alone, as a single IP has more than 5000 server behind it, providing 1 source IP and UDP source port, didn’t help either > >> Any suggestions? > >> > >> Regards, > >> Ahmed Dala Ali > >> > >>

1 0

Re: DDoS attack
by Christopher Morrow 09 Dec '19

09 Dec '19

On Mon, Dec 9, 2019 at 3:42 PM Michael Sherlock <michael.sherlock(a)hrins.net> wrote: > > Cristopher, > > Ip addresses that are not currently in use, and IP addresses that is currently used for CGNAT for end users > I'm 100% sure that those words mean something to you.. but not operating your network they don't mean anything to me. > > Regards, > > Michael Sherlock > Mobile: +44 75070 92392 > > Sent from my iPhone > > On Dec 9, 2019, at 8:36 PM, "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> wrote: > > > > Begin forwarded message: > > From: Christopher Morrow <morrowc.lists(a)gmail.com> > Subject: Re: DDoS attack > Date: December 9, 2019 at 11:11:31 PM GMT+3 > To: "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> > Cc: nanog list <nanog(a)nanog.org> > > I'd note that: "what prefixes?" isn't answered here... like: "what is > the thing on your network which is being attacked?" > > On Mon, Dec 9, 2019 at 3:08 PM ahmed.dalaali(a)hrins.net > <ahmed.dalaali(a)hrins.net> wrote: > > > Dear All, > > My network is being flooded with UDP packets, Denial of Service attack, soucing from Cloud flare and Google IP Addresses, with 200-300 mbps minimum traffic, the destination in my network are IP prefixes that is currnetly not used but still getting traffic with high volume. > The traffic is being generated with high intervals between 10-30 Minutes for each time, maxing to 800 mbps > When reached out cloudflare support, they mentioned that there services are running on Nat so they can’t pin out which server is attacking based on ip address alone, as a single IP has more than 5000 server behind it, providing 1 source IP and UDP source port, didn’t help either > Any suggestions? > > Regards, > Ahmed Dala Ali > >

1 0

packet loss on AT&T in the L.A. area
by Francois Lecavalier 09 Dec '19

09 Dec '19

Anybody else is experiencing packet loss since last Tuesday across the AT&T network in the L.A. area? I'm seeing it coming from both Zayo and HE 8. ae2.cs1.lga5.us.zip.zayo.com 0.0% 153 17.8 19.7 17.6 48.4 4.6 9. ae18.ter1.lga5.us.zip.zayo.com 0.0% 153 17.8 17.7 17.5 18.3 0.0 10. 192.205.36.105 10.5% 153 22.3 21.3 19.3 25.0 1.0 11. cr1.n54ny.ip.att.net 1.3% 153 76.5 75.5 73.1 80.7 1.6 12. cgcil22crs.ip.att.net 5.9% 153 75.1 76.1 72.6 80.7 2.0 13. cgcil21crs.ip.att.net 3.9% 153 76.9 76.4 72.0 83.9 2.3 14. dvmco22crs.ip.att.net 3.9% 153 73.9 76.4 72.4 81.1 2.3 15. slkut21crs.ip.att.net 5.9% 153 74.2 76.8 72.9 84.7 2.3 16. la2ca21crs.ip.att.net 4.6% 153 76.7 76.7 72.6 82.6 2.1 17. gar20.la2ca.ip.att.net 8.5% 153 73.6 73.3 72.1 75.7 0.5 4. 12.87.252.89 0.0% 338 1.9 1.8 1.6 3.6 0.2 5. cr1.la2ca.ip.att.net 0.0% 338 2.7 3.5 1.5 6.7 1.0 cr84.la2ca.ip.att.net 6. ggr2.la2ca.ip.att.net 0.0% 338 4.8 3.5 1.6 5.6 1.0 ggr2.la2ca.ip.att.net 7. ae7.mpr1.lax12.us.zip.zayo.com 5.6% 338 73.1 74.2 72.0 133.8 4.4 8. ae13.cs1.lax112.us.eth.zayo.com 8.6% 338 83.7 89.1 72.9 116.7 7.9 This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately. Ce courrier ?lectronique est confidentiel et prot?g?. L'exp?diteur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) d?sign?(s) est interdite. Si vous recevez ce courrier ?lectronique par erreur, veuillez m'en aviser imm?diatement, par retour de courrier ?lectronique ou par un autre moyen.

1 0

Elephant in the room - Akamai
by Kaiser, Erich 09 Dec '19

09 Dec '19

Lets talk Akamai They have shifted 90% of their traffic off IXs and onto our full route DIA, anyone else seeing this issue or have insight as to what is going on over there? We have been asking for help on resolution for weeks and all we get is we are working on it and now we get no response. We were even sent an LOA and when the DC went to go put in the x-connect their patch panel was full. How do they not know if they have ports open or not? I have even reached out to an engineer who is on this list and he does not even respond. The last two nights the traffic levels to them has skyrocketed as well. Any insight? Erich Kaiser The Fusion Network

27 45

Spoofer Report for NANOG for Nov 2019
by CAIDA Spoofer Project 08 Dec '19

08 Dec '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Nov 2019: ASN Name Fixed-By 8047 GCI 2019-11-20 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Nov 2019: ASN Name First-Spoofed Last-Spoofed 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-11-29 6128 CABLE-NET-1 2016-09-03 2019-11-28 7459 GRANDECOM-AS1 2016-09-26 2019-11-06 20412 CLARITY-TELECOM 2016-09-30 2019-11-29 6181 FUSE-NET 2016-10-10 2019-11-30 25787 ROWE-NETWORKS 2016-10-21 2019-11-11 174 COGENT-174 2016-10-21 2019-11-26 32440 LONI 2016-11-03 2019-11-29 12083 WOW-INTERNET 2016-11-09 2019-11-30 18451 LESNET 2017-02-22 2019-11-05 701 UUNET 2017-06-14 2019-11-23 63296 AMARILLO-WIRELESS 2017-09-01 2019-11-26 546 PARSONS-PGS-1 2017-11-20 2019-11-25 11827 WSU 2018-05-07 2019-11-29 393564 SPOKANE 2018-06-05 2019-11-19 225 VIRGINIA 2018-06-18 2019-11-20 33452 RW 2018-09-19 2019-11-27 20448 VPNTRANET-LLC 2018-09-20 2019-11-11 63275 RADIOWIRE 2019-02-07 2019-11-05 8047 GCI 2019-04-11 2019-11-26 10745 ARIN-ASH-CHA 2019-04-29 2019-11-15 20381 CABLELABS-LV 2019-05-01 2019-11-01 46300 HSC-WAP 2019-10-30 2019-11-28 53424 PUREPAGES 2019-11-05 2019-11-05 2886 EC-813-2886 2019-11-05 2019-11-29 26827 EPBTELECOM 2019-11-07 2019-11-07 54646 HARDYNET 2019-11-10 2019-11-10 11293 UCOP-ASN 2019-11-23 2019-11-23 53641 TOMALESBAYLAN 2019-11-29 2019-11-29 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Puerto Rico IX (operational)
by Mehmet Akcin 08 Dec '19

08 Dec '19

Hey there, Puerto Rico IX , famously known as PRIX , is now operational. You can visit www.puertoricoix.net to see sites you can connect to PRIX, members and join Ix mailing list. There are no fees to join the IX. We hope to keep this, this way until there is enough interest to form a non profit org. I would like to thank once again Aeronet, Arista and Cloudsmash for their donations of equipment , time and energy! Now, we are looking for those who want to deploy 1-2RU caching boxes anything from DNS to Content. We are working on more stats/looking glass, etc soon! Mehmet -- Mehmet +1-424-298-1903

3 6