- NANOG - lists.nanog.org

Re: ddos attacks
by dennis＠justipit.com 19 Dec '13

19 Dec '13

Just about every security, network and ADC vendor out there is claiming anti-dos capabilities. Be careful when going that route and do your own validation. I suggest looking at Radware and Arbor (both leaders in the market). To successfully mitigate an attack the ideal solutions will weed out the attack and allow legitimate traffic to continue. Many of the solutions in the commercial market are not much more than rate limiters and are not very forgiving. Just as important realize while spoofed udp floods are popular they are oftened only the first vector, if successfully mitigated attackers quickly adjust and follow with more complex vectors such as application attacks toward http, ssl, dns query floods, etc.. Remember their goal is to bring you down, , divert your attention while they steal your data or perhaps transfer funds. They will go to far lengths to achieve their end result. As you can imagine it's much harder to identify the attack characteristics or for that matter the attacker in these more complex cases. In summary, I'm a firm believer in a hybrid approach with combination of infrastructure acls, rtbh, qos, URPF, tcp stack hardening, local anti-ddos appliances for application attacks and network floods under link capacity to allow you to stay up while deciding to shift routes into cloud band ability to swing up stream to cloud scrubbing center (in house or third party). Sent from my Sprint phone. ----- Reply message ----- From: "Paul Ferguson" <fergdawgster(a)mykolab.com> To: <nanog(a)nanog.org> Subject: ddos attacks Date: Thu, Dec 19, 2013 2:35 PM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm really surprised no one has mentioned Akamai/Prolexic, especially since their recent marriage. If someone has already mentioned it: Apologies. - - ferg On 12/19/2013 4:08 AM, Adrian M wrote: > Hi, > > You can also test WANGUARD, http://www.andrisoft.com/ for DDoS detection > and BGP triggered blackholing. > > > On Thu, Dec 19, 2013 at 11:32 AM, Eugeniu Patrascu > <eugen(a)imacandi.net>wrote: > >> Hi, >> >> You can also take a look at http://www.packetdam.com/ for DDoS >> protection. >> >> Eugeniu >> >> >> On Thu, Dec 19, 2013 at 10:53 AM, Tore Anderson <tore(a)fud.no> wrote: >> >>> * James Braunegg >>> >>>> Of course for any form of Anti DDoS hardware to be functional you >>>> need to make sure your network can route and pass the traffic so you >>>> can absorb the bad traffic to give you a chance cleaning the >>>> traffic. >>> >>> So in order for an Anti-DDoS appliance to be functional the network >>> needs to be able to withstand the DDoS on its own. How terribly useful. >>> >>> Tore >>> >>> >> > > -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 2317) Charset: utf-8 wj8DBQFSs0qFq1pz9mNUZTMRAlHzAJ4snDXa9MSpzSAniMUKcea0L521jQCgxHLH gBUm4ScmJlf5FsC5kJJrmZs= =tLUd -----END PGP SIGNATURE----- -- Paul Ferguson PGP Public Key ID: 0x63546533

1 0

BGP from Juniper to Cisco ASR
by Philip Lavine 19 Dec '13

19 Dec '13

Dec 18 07:46:33: %BGP-3-NOTIFICATION: received from neighbor <REMOTE PEER> active 2/5 (authentication failure) 0 bytes Dec 18 15:46:33.615: BGP: ses global <REMOTE PEER> (0x7FB1CD209CF0:0) act Receive NOTIFICATION 2/5 (authentication failure) 0 bytes Although I have seem this on the message boards I am little confused in that the ISP is telling me that there is no authentication enabled on the Juniper and I do not have authentication enabled on the ASR. So what is going on here?

5 7

Anyone seeing issues with Abovenet/Zayo in Northeast US?
by Jeffrey Negro 19 Dec '13

19 Dec '13

We have two MPLS circuits malfunctioning, one from DE to NJ, and another from DE to CA. Both are showing high latency and packet loss. Curious to hear if anyone else is having issues. Thanks

1 0

Time to stopy saying there is no IPv6 traffice: was Re: ddos attacks
by cb.list6 19 Dec '13

19 Dec '13

On Wed, Dec 18, 2013 at 5:03 PM, Jon Lewis <jlewis(a)lewis.org> wrote: > On Wed, 18 Dec 2013 Valdis.Kletnieks(a)vt.edu wrote: > > On Wed, 18 Dec 2013 15:12:28 -0800, "cb.list6" said: >> >> I am strongly considering having my upstreams to simply rate limit ipv4 >>> UDP. It is the simplest solution that is proactive. >>> >> >> What are the prospects for ipv6 UDP not suffering the same fate? >> > > Roughly 0%, but there's so little v6 traffic compared to v4, you probably > don't have to worry about v6 attack traffic yet...particularly if you're > not dual stack yet. :) > > I understand that your answer about nil IPv6 traffic may be appropriate for your network, but for many of us IPv6 is currently a non-trivial amount of traffic that is growing quickly. And, in some cases, IPv6 is the dominate amount of traffic. Here are some quick stats of a few select familiar names from http://www.worldipv6launch.org/measurements/ Google Fiber 70% Virginia Tech 61% Verizon Wireless 40% Comcast 20% AT&T Wireline 15% T-Mobile US 6% > ---------------------------------------------------------------------- > Jon Lewis, MCP :) | I route > | therefore you are > _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ >

1 0

IPv6 /48 advertisements
by Cliff Bowles 19 Dec '13

19 Dec '13

I accidentally sent this to nanog-request yesterday. I could use some feedback from anyone that can help, please. Question: will carriers accept IPv6 advertisements smaller than /48? Our org was approved a /36 based on number of locations. The bulk of those IPs will be in the data centers. As we were chopping up the address space, it was determined that the remote campus locations would be fine with a /60 per site. (16 networks of /64). There are usually less than 50 people at the majority of these locations and only about 10 different functional VLANs (Voice, Data, Local Services, Wireless, Guest Wireless, etc...). Now, there has been talk about putting an internet link in every campus rather than back hauling it all to the data centers via MPLS. However, if we do this, then would we need a /48 per campus? That is massively wasteful, at 65,536 networks per location. Is the /48 requirement set in stone? Will any carriers consider longer prefixes? I know some people are always saying that the old mentality of conserving space needs to go away, but I was bitten by that IPv4 issue back in the day and have done a few VLSM network overhauls. I'd rather not massively allocate unless it's a requirement. Thanks in advance. CWB ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

10 13

Re: wireless ISP in Santa Fe
by Tri Tran 18 Dec '13

18 Dec '13

Great site. Thank you sir! On 12/18/2013 12:14 PM, Jerimiah Cole wrote: > On 12/18/2013 11:14 AM, Tri Tran wrote: >> The only known option is with Cibola for 7M/1M. >> If anyone know of an alternate provider with higher bandwidth please >> advise. > http://nmbbmapping.org/mapping/ > > Jerimiah > > --Tri Tran

1 0

wireless ISP in Santa Fe
by Tri Tran 18 Dec '13

18 Dec '13

The only known option is with Cibola for 7M/1M. If anyone know of an alternate provider with higher bandwidth please advise. --Tri Tran

4 3

Re: wireless ISP in Santa Fe
by Tri Tran 18 Dec '13

18 Dec '13

Thanks Brandon. I'll give them a call. On 12/18/2013 10:22 AM, Brandon Galbraith wrote: > Have you talked to Cybermesa[1] or LC Wireless (co-op)[2]? > > [1] http://www.cybermesa.com/ > > [2] http://www.lcwireless.us/ > > > On Wed, Dec 18, 2013 at 12:14 PM, Tri Tran <tritran(a)cox.net > <mailto:tritran@cox.net>> wrote: > > The only known option is with Cibola for 7M/1M. > If anyone know of an alternate provider with higher bandwidth > please advise. > > --Tri Tran > > > --Tri Tran

1 0

do ISPs keep track of end-user IP changes within thier network?
by Carlos Kamtha 17 Dec '13

17 Dec '13

Hi, just a general curiousity question. it's been a long time since ive worked at an ISP. back then it was non-expiring DHCP leases and in some cases static IP for all.. (yes it was long ago..) Any feedback would be greatly appreciated.. Carlos.

21 26

AS209 / Qwest / CenturyLink
by Kenny Kant 16 Dec '13

16 Dec '13

Could someone from Qwest/CenturyLink AS209 contact me off list. We have two prefixes which are incorrectly being announced from this AS. I'm sure its an old configuration from days gone by. If there is a better / correct procedure to request help for this please let me know. Thanks! Kenny

1 0