- NANOG - lists.nanog.org

NTT NOC Contact
by james jones 27 Nov '14

27 Nov '14

Looking to discuss a routing issue going through NTT's link to JP.

4 5

Seeking IPv6 Security Resources
by Chris Grundemann 27 Nov '14

27 Nov '14

Hail NANOG! I am looking for IPv6 security resources to add to: http://www.internetsociety.org/deploy360/ipv6/security/ These could be best current practice documents, case-studies, lessons-learned/issues-found, research/evaluations, RFCs, or anything else focused on IPv6 security really. I'm not requesting that anyone do any new work, just that you point me to solid public documents that already exist. Feel free to share on-list or privately, both documents you may have authored and those you have found helpful. Thanks! ~Chris Note: Not every document shared will get posted to the Deploy360 site. -- @ChrisGrundemann http://chrisgrundemann.com

7 6

Re: Anyone else having trouble reaching thepiratebay.se? AS39138
by Courtney Smith 27 Nov '14

27 Nov '14

> No problem here in Los Angeles either, but seeing a lone route through Atrato only. > > flags destination gateway lpref med aspath origin > *> 194.71.107.0/24 <> 100 0 3491 5580 39138 22351 2.207 51040 i > * 194.71.107.0/24 <> 100 0 174 5580 39138 22351 2.207 51040 i > > > On 11/27/2014 午前 11:24, Tony Wicks wrote: >> >> No problem here in New Zealand >> >> tonyw@vrhost1-w> show route 194.71.107.0/24 >> >> icore1-w.inet.0: 519451 destinations, 525214 routes (519437 active, 14 >> holddown, 0 hidden) >> + = Active Route, - = Last Active, * = Both >> >> 194.71.107.0/24 *[BGP/170] 10:25:44, MED 0, localpref 90 >> AS path: 4826 5580 39138 22351 131279 51040 I, >> validation-state: unverified >> > to 175.45.102.9 via ae1.526 >> Hopefully the body cones thru this time. The issue isn't city or country based. In my last post I pointed out the do not announce to peers community AS5580 was sending to Cogent, Level3 and who knows who else. So any ASN that is not a customer of Cogent or Level3 wont learn the 5580 path from them. When I checked a few hours ago, Comcast, Centurylink, AT&T, TATA, and possibly Sprint were not seeing the /24 based on their public looking glasses or route servers. Have not had time to run bgplay to see if routeviews data shows how they previously saw the /24 in past 30 days. Finding the ASN(s) they used to see from would shed light on why they stopped seeing. Checking bgplay and contacting AS51040 to reach out to their upstreams is my suggestion.

1 0

Re: Anyone else having trouble reaching thepiratebay.se? AS39138
by Courtney Smith 27 Nov '14

27 Nov '14

1 0

Re: Anyone else having trouble reaching thepiratebay.se? AS39138
by Courtney Smith 27 Nov '14

27 Nov '14

I just posted TATA as a single example. This route is missing from multiple networks. I could not find the specific /24 on, Sprint(1239) AT&T(7018) and Centurylink either. rviews(a)route-server.ip.att.net> show route 194.71.107.0/24 rviews(a)route-server.ip.att.net> from https://www.sprint.net/lg/lg_start.php Query Results: Sprint Source Region: New York, NY (sl-gw27-nyc) Performing: Show Route % Network not in table Completed - Wed Nov 26 21:11:51 EST 2014 Basic troubleshooting of your two example ASN's. Notice the community 174:991 on the Cogent path? Go look that up in Cogent's community guide. Level3's looking glass actually does the translation of communities for you. I'm not going to try to map out all the possible paths this prefix could be reach. At the moment, the /24 is not reachable from several networks. Either an outage or a change at AS51040 or their upstreams has caused the traffic engineering of one of the networks upstream of 51040 to break connectivity for a group of networks. from http://www.cogentco.com/en/network/looking-glass BGP routing table entry for 194.71.107.0/24, version 2977032097 Paths: (1 available, best #1, table Default-IP-Routing-Table) 5580 39138 22351 2.207 51040 38.104.73.58 (metric 10111041) from 154.54.66.76 (154.54.66.76) Origin IGP, metric 0, localpref 130, valid, internal, best Community: 174:991 174:10004 174:20999 174:21001 174:22013 Originator: 66.28.1.248, Cluster list: 154.54.66.76, 66.28.1.69, 66.28.1.103, 66.28.1.9, 154.54.66.49 Route results for 194.71.107.0/24 from Atlanta, GA BGP routing table entry for 194.71.107.0/24 Paths: (2 available, best #1) 5580 39138 22351 23456 51040 AS-path translation: { ATRATO-IP OPENAP-WIRELESS-NETWORKS-AS INTELSAT AS23456 PIRATE-AS } ear1.Atlanta2 (metric 20000) Origin IGP, metric 0, localpref 100, valid, internal, best Community: North_America Lclprf_100 Level3_Customer United_States Atlanta Level3:10074 5580:25215 Suppress_to_Peers Originator: ear1.Atlanta2 5580 39138 22351 23456 51040 AS-path translation: { ATRATO-IP OPENAP-WIRELESS-NETWORKS-AS INTELSAT AS23456 PIRATE-AS } ear1.Atlanta2 (metric 20000) Origin IGP, metric 0, localpref 100, valid, internal Community: North_America Lclprf_100 Level3_Customer United_States Atlanta Level3:10074 5580:25215 Suppress_to_Peers Originator: ear1.Atlanta2 On Nov 26, 2014, at 7:32 PM, Eric Tykwinski wrote: > Courtney, > > No offense, and I can’t really verify Comcast’s network. But Verizon peers with the same ASNs I do 3356 and 174 which both have routes to thepiratebay’s prefixes, and I can almost guarantee that Comcast has those routes within your network. What’s up really? Just because TATA is blocking routes shouldn’t effect the whole internet, or this whole thing would have been screwed a long time ago. > > Sincerely, > > Eric Tykwinski > TrueNet, Inc. > P: 610-429-8300 > F: 610-429-3222 > >> On Nov 26, 2014, at 2:11 PM, courtneysmith(a)comcast.net wrote: >> >> Only one of their /24's is in TATA's(AS6453) table. >> >> http://bgp.he.net/AS51040#_prefixes >> >> >> http://lg.as6453.net >> >> Router: gin-aeq-tcore1 >> Site: US, Ashburn, AEQ >> Command: show route protocol bgp 194.71.107.0/24 terse exact >> >> >> {master} >> >> >> Router: gin-aeq-tcore1 >> Site: US, Ashburn, AEQ >> Command: show route protocol bgp 194.14.56.0/24 terse exact >> >> >> inet.0: 520187 destinations, 3597636 routes (519993 active, 9 holddown, 1053 hidden) >> Restart Complete >> + = Active Route, - = Last Active, * = Both >> >> A V Destination P Prf Metric 1 Metric 2 Next hop AS path >> * ? 194.14.56.0/24 B 197595 51040 I >> unverified >216.6.87.1 >> ? B 197595 51040 I >> unverified >216.6.87.1 >> ? B 197595 51040 I >> unverified >216.6.87.1 >> ? B 1239 1257 197595 51040 I >> unverified >144.232.7.61 >> >> {master} >> >> >> >> >> >> >> On 11/26/14, 2:01 PM, " eric-list(a)truenet.com " < eric-list(a)truenet.com > wrote: >> >> >> Javier, >> >> >> I can't get to www.rrbone.net, an upstream provider to the IP I was given for thepiratebay.se. >> I tested on VZ FiOS and Wireless in Philadelphia area and both die within the VZ network. >> >> >> For Comcast, it looks like the space isn't showing up in the BGP table: >> route-server.newyork.ny.ibone>show ip bgp 194.71.107.27 >> % Network not in table >> >> >> No clue what the cause is, but it bigger than just the PirateBay. >> >> >> Sincerely, >> >> >> Eric Tykwinski >> TrueNet, Inc. >> P: 610-429-8300 >> F: 610-429-3222 >> >> >> >> >> -----Original Message----- >> From: NANOG [ mailto:nanog-bounces@nanog.org ] On Behalf Of Javier J >> Sent: Wednesday, November 26, 2014 1:44 PM >> To: nanog(a)nanog.org >> Subject: Re: Anyone else having trouble reaching thepiratebay.se? AS39138 >> >> >> I confirmed It is also blocked for Comcast users. Even Comcast business users. This is starting to look like censorship to me. > > Courtney Smith courtneysmith(a)comcast.net I wanna devise a virus To bring dire straits to your environment Crush your corporations with a mild touch Trash your whole computer system and revert you to papyrus

4 3

Re: kohls.com issues
by oz＠columbus.rr.com 27 Nov '14

27 Nov '14

Thanks - it's good now. Just earlier seemed to be some issues. http://www.isitdownrightnow.com/kohls.com.html Guess it could have been a hosting issue. From: Javier J <javier(a)advancedmachines.us> Date: Wednesday, November 26, 2014 at 9:25 PM To: Steven Parsons <oz(a)columbus.rr.com> Subject: Re: kohls.com issues Works for me on FIOS in the NYC area. On Wed, Nov 26, 2014 at 9:18 PM, <oz(a)columbus.rr.com> wrote: Anyone know what’s up ? Looks like they are still working thru issues where I am. Not sure if their domain was hijacked or what exactly. If someone has a list where this is already being discussed id appreciate that info. Thanks, Steve

1 0

kohls.com issues
by oz＠columbus.rr.com 27 Nov '14

27 Nov '14

Anyone know what’s up ? Looks like they are still working thru issues where I am. Not sure if their domain was hijacked or what exactly. If someone has a list where this is already being discussed id appreciate that info. Thanks, Steve

2 1

Re: Anyone else having trouble reaching thepiratebay.se? AS39138
by courtneysmith＠comcast.net 26 Nov '14

26 Nov '14

Only one of their /24's is in TATA's(AS6453) table. http://bgp.he.net/AS51040#_prefixes http://lg.as6453.net Router: gin-aeq-tcore1 Site: US, Ashburn, AEQ Command: show route protocol bgp 194.71.107.0/24 terse exact {master} Router: gin-aeq-tcore1 Site: US, Ashburn, AEQ Command: show route protocol bgp 194.14.56.0/24 terse exact inet.0: 520187 destinations, 3597636 routes (519993 active, 9 holddown, 1053 hidden) Restart Complete + = Active Route, - = Last Active, * = Both A V Destination P Prf Metric 1 Metric 2 Next hop AS path * ? 194.14.56.0/24 B 197595 51040 I unverified >216.6.87.1 ? B 197595 51040 I unverified >216.6.87.1 ? B 197595 51040 I unverified >216.6.87.1 ? B 1239 1257 197595 51040 I unverified >144.232.7.61 {master} On 11/26/14, 2:01 PM, " eric-list(a)truenet.com " < eric-list(a)truenet.com > wrote: Javier, I can't get to www.rrbone.net, an upstream provider to the IP I was given for thepiratebay.se. I tested on VZ FiOS and Wireless in Philadelphia area and both die within the VZ network. For Comcast, it looks like the space isn't showing up in the BGP table: route-server.newyork.ny.ibone>show ip bgp 194.71.107.27 % Network not in table No clue what the cause is, but it bigger than just the PirateBay. Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300 F: 610-429-3222 -----Original Message----- From: NANOG [ mailto:nanog-bounces@nanog.org ] On Behalf Of Javier J Sent: Wednesday, November 26, 2014 1:44 PM To: nanog(a)nanog.org Subject: Re: Anyone else having trouble reaching thepiratebay.se? AS39138 I confirmed It is also blocked for Comcast users. Even Comcast business users. This is starting to look like censorship to me.

1 0

Craigslist hacked?
by Brian Henson 26 Nov '14

26 Nov '14

Is anyone else seeing their local craigslist redirected to another site other than craigslist? I see it loading http://digitalgangster.com/5um.

25 39

abuse reporting tools
by Mike 26 Nov '14

26 Nov '14

Hello, I provide broadband connectivity to mostly residential users. Over the past few years, instances of DDoS against the network - specfically targeting end users - has been on the rise, and today I can qualify many of these as simple acts of revenge where someone will engage a dos (possibly, services like 'booters' or similar) because they lost an online game or had some interactive in a forum they didn't like. I have good 'consumer broadband' filtering rules in place which make sense and protect against quite a lot of obviously ddos oriented traffic streams. The next step I want to engage, for those types of traffic which I can positively identify as not spoofed, is to send out abuse reports to owners of ip ranges used to launch these attacks. Ideally I'd like to be able to write up some form letter describing the attack, the source ip(s) of note, some disassembled sample packets, and then feed a list of IP source addresses and have it mail it out to the abuse contact at each source network. I am wondering if anyone has a pointer or reference to any tools which might help facillitate this? Thank you. Mike-

11 13