August 2026 - NANOG - lists.nanog.org

how about a well-known DOWNGRADE BGP Community? (Was: RTBH Support Across the Industry)
by Job Snijders 06 Aug '26

06 Aug '26

Dear all, Following up on the RTBH thread, we'd like to put forward an different strategy for DoS attack mitigation. Perhaps just as an extra tool in the toolbox. Abstract -- This document outlines a method to mitigate Denial of Service (DoS) attacks by using a well-known BGP community named "DOWNGRADE" as signal to neighboring networks to treat traffic destined towards "DOWNGRADE" tagged IP prefixes with low precedence. The "downgrade" strategy offers an appealing alternative to Remote Triggered Blackhole (RTBH) filtering, because RTBH filtering completes the DoS attack and hampers the defender's ability to monitor whether the attack is still ongoing. Read the full draft document here: https://datatracker.ietf.org/doc/html/draft-spaghetti-grow-downgrade-bgp-co… Your feedback is most welcome! Kind regards, Job

5 10

Recommendations for public-facing automated status page?
by David Hubbard 05 Aug '26

05 Aug '26

Hi all, curious if anyone has made use of an automated status page system that’s public-facing, and you both like it and find it reasonably priced? This would be one of those systems that makes use of API’s to pull, or we can push to it, to reflect the nearly real time state of circuits, systems, API’s, etc. I’ve found numerous options out there, but most seem to have ridiculous pricing around allowing people to subscribe to the status page, or even worse if you begin to make use of SMS notifications. That SMS pricing is often two orders of magnitude higher for the same quantity of transactional texts as you’d pay to have them sent through a dedicated SMS provider. Thanks, David

5 6

Carpet bombing, what's it look like now
by Mike Hammett 01 Aug '26

01 Aug '26

The single destination case is easy enough. You RTBH the /32, renumber the customer, and move on. Carpet bombing takes that option away, since there's nowhere to move anyone to and nothing crosses a per-host threshold to trigger on in the first place. I'm curious what it actually looks like for those of you dealing with it regularly. Everything I've read says ports and packet sizes are randomized wide enough now that signature matching isn't worth much, though I'd rather hear that from someone watching it happen than from a vendor report. Does destination prefix plus protocol and port still get you something tight enough to act on, and if so, how many rules do you end up carrying mid-attack? Somewhat related, does packet length matching actually work on your hardware? I've been reminded lately that documented and functional aren't always the same thing. What are you feeding detection with, and does it keep up? sFlow, IPFIX, port mirror, something else. With attacks routinely over inside a couple of minutes I'm not convinced sampled telemetry is fast enough to matter, and I'd like to know whether people are installing rules after the thing already ended. If you're sampling, has any ratio worked well enough that the low per-host rates of a carpet bomb still trip an aggregate threshold in time to act? The other half of this is lifecycle. How long do you leave rules installed, and what tells you it's safe to pull them? Pull too early and you re-detect the same attack. Leave them in and you're carrying stale state indefinitely. Once you've got a signature, what do you actually do with it? Drop outright, rate limit, or hand it to a scrubber? I'd expect that to track how confident you are that nothing legitimate matches, but I'm curious where people really draw those lines. Our bar is customers not noticing rather than stopping every packet, and those turn out to be different targets. What's everyone doing for v6? Flowspec support looks thin enough there that a carpet bomb against v6 space puts you back to blackholing hosts one at a time. Separate question: is anyone pairing FastNetMon or similar detection with a self-hosted scrubber like VPP or Gatekeeper, rather than handing the traffic off to a provider? Interested in the outbound direction as well, catching a compromised customer before the traffic leaves. If you do answer, rough network size helps. Forty rules at 10G and forty rules at 1T aren't the same finding. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

4 10