- NANOG - lists.nanog.org

Re: One /22 Two ISP no BGP
by Michael Smith 14 Feb '09

14 Feb '09

And/or see if bell canada can sell you something diverse. ----- Original Message ----- From: Seth Mattinen <sethm(a)rollernet.us> To: Charles Regan <charles.regan(a)gmail.com> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Fri Feb 13 18:58:54 2009 Subject: Re: One /22 Two ISP no BGP Charles Regan wrote: > The problem we have now is that we got our /22 from arin to do multihoming. > If we dump tlb, no more multihoming? No /22. Is that correct? > > We also have a contract with tlb. > $$$ 1.5yrs left... > > There's something in there about non-multihomed sites, but I'm not familiar with it. Telebec doesn't appear to be multihomed, though. The only other thing I can think of to avoid horrible hackery is to convince them to colo a router for you to do eBGP to. Honestly, I wouldn't recommend multihoming *without* BGP. One day you'll end up with some really ugly failure mode. ~Seth

3 2

Happy 1234567890 everyone!
by Steve Church 14 Feb '09

14 Feb '09

Just in case you missed it. date -d "Fri Feb 13 23:31:30 UTC 2009" +%s It's like a really geeky y2k without the potential cataclysm. :) Steve

11 12

Chicago Sprint convulsions?
by neal rauhauser 13 Feb '09

13 Feb '09

Is anyone else seeing convulsions via Sprint Chicago? Lightly loaded OC3 and we've got stuff all over the net seeing crazy latency. -- mailto:Neal@layer3arts.com // GoogleTalk: nrauhauser(a)gmail.com IM: nealrauhauser

1 0

Security Assessment of the Transmission Control Protocol (TCP)
by Fernando Gont 13 Feb '09

13 Feb '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello, folks, The United Kingdom's Centre for the Protection of National Infrastructure has just released the document "Security Assessment of the Transmission Control Protocol (TCP)", on which I have had the pleasure to work during the last few years. The motivation to produce this document is explained in the Preface of the document as follows: - ---- cut here ---- The TCP/IP protocol suite was conceived in an environment that was quite different from the hostile environment they currently operate in. However, the effectiveness of the protocols led to their early adoption in production environments, to the point that to some extent, the current world?s economy depends on them. While many textbooks and articles have created the myth that the Internet protocols were designed for warfare environments, the top level goal for the DARPA Internet Program was the sharing of large service machines on the ARPANET. As a result, many protocol specifications focus only on the operational aspects of the protocols they specify, and overlook their security implications. While the Internet technology evolved since it early inception, the Internet?s building blocks are basically the same core protocols adopted by the ARPANET more than two decades ago. During the last twenty years, many vulnerabilities have been identified in the TCP/IP stacks of a number of systems. Some of them were based on flaws in some protocol implementations, affecting only a reduced number of systems, while others were based in flaws in the protocols themselves, affecting virtually every existing implementation. Even in the last couple of years, researchers were still working on security problems in the core protocols. The discovery of vulnerabilities in the TCP/IP protocol suite usually led to reports being published by a number of CSIRTs (Computer Security Incident Response Teams) and vendors, which helped to raise awareness about the threats and the best mitigations known at the time the reports were published. Unfortunately, this also led to the documentation of the discovered protocol vulnerabilities being spread among a large number of documents, which are sometimes difficult to identify. For some reason, much of the effort of the security community on the Internet protocols did not result in official documents (RFCs) being issued by the IETF (Internet Engineering Task Force). This basically led to a situation in which ?known? security problems have not always been addressed by all vendors. In addition, in many cases vendors have implemented quick ?fixes? to the identified vulnerabilities without a careful analysis of their effectiveness and their impact on interoperability. Producing a secure TCP/IP implementation nowadays is a very difficult task, in part because of the lack of a single document that serves as a security roadmap for the protocols. Implementers are faced with the hard task of identifying relevant documentation and differentiating between that which provides correct advice, and that which provides misleading advice based on inaccurate or wrong assumptions. There is a clear need for a companion document to the IETF specifications that discusses the security aspects and implications of the protocols, identifies the existing vulnerabilities, discusses the possible countermeasures, and analyses their respective effectiveness. This document is the result of a security assessment of the IETF specifications of the Transmission Control Protocol (TCP), from a security point of view. Possible threats are identified and, where possible, countermeasures are proposed. Additionally, many implementation flaws that have led to security vulnerabilities have been referenced in the hope that future implementations will not incur the same problems. This document does not aim to be the final word on the security aspects of TCP. On the contrary, it aims to raise awareness about a number of TCP vulnerabilities that have been faced in the past, those that are currently being faced, and some of those that we may still have to deal with in the future. Feedback from the community is more than encouraged to help this document be as accurate as possible and to keep it updated as new vulnerabilities are discovered. - ---- cut here ---- The document is available at CPNI's web site: http://www.cpni.gov.uk/Products/technicalnotes/Feb-09-security-assessment-T… Additionally, I have posted a copy of the document on my personal web site: http://www.gont.com.ar Any comments will be more than welcome. Kind regards, - -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iQEcBAEBCAAGBQJJlLWeAAoJEJbuqe/Qdv/xRBMIANfq3pfTFauzFacTyjzzdu7+ g0XP76J6qThEjUZzzjEtSAS0hi9u+rODEp5Cujk0y/QK0Wnyoc6ZHOn91q0cuOtA UC+YqfTrW72bJL0+JEHxYSRkASEwtfULyfnyzx3ZMoiN/gMTG/PAQ4WDvNu5ORhf nmbTiRkpdc3S6FmsMnxzwbNJrklAwGuJKIIOmGTGwrI4D1G9lOc0A6xqArIvkwma L6a2YIGOZBePpI8yj4baKk1qvXH9gk+oH5bjJDXyXZNWOIFeM5lDeJaiEQHWCbF+ k+P/plO5TImzQtmKqGGVNoRJa4scw9ZLxYz2zLkJ6dZtUzGriyi0RwvPj1ZKQR4= =sV1Y -----END PGP SIGNATURE-----

2 2

anyone knows about extreme switch
by ann kok 13 Feb '09

13 Feb '09

Hi I have old model extreme switch Anyone knows about hyperterminal setting. ls null modem cable same as HP serial cables? I try both cables in this switch and can see the boot information but keyboard is not responsing ! Thank you __________________________________________________________________ Looking for the perfect gift? Give the gift of Flickr! http://www.flickr.com/gift/

2 3

Re: One /22 Two ISP no BGP
by Charles Regan 13 Feb '09

13 Feb '09

Just got final confirmation from ISP1 that they will not do BGP with us. ISP1 is Telebec. http://www.iptools.com/dnstools.php?tool=ipwhois&user_data=142.217.0.0&subm… My subnet http://www.iptools.com/dnstools.php?tool=ipwhois&user_data=204.144.60.0&sub… What can we do now ? Any suggestions ? Charles

4 5

TeliaSonera AS1299
by German Martinez 13 Feb '09

13 Feb '09

Hello, If anyone from TeliaSonera is around please contact me off-list Thanks German

1 0

Dark Fiber in Parker Arizona
by Holmes,David A 13 Feb '09

13 Feb '09

I am in need of dark fiber in the Parker, Arizona area. If anyone can help please contact me off list. Thanks, David

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 13 Feb '09

13 Feb '09

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 14 Feb, 2009 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 279513 Prefixes after maximum aggregation: 133074 Deaggregation factor: 2.10 Unique aggregates announced to Internet: 136951 Total ASes present in the Internet Routing Table: 30575 Prefixes per ASN: 9.14 Origin-only ASes present in the Internet Routing Table: 26606 Origin ASes announcing only one prefix: 12952 Transit ASes present in the Internet Routing Table: 3969 Transit-only ASes present in the Internet Routing Table: 93 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 25 Max AS path prepend of ASN (18678) 21 Prefixes from unregistered ASNs in the Routing Table: 530 Unregistered ASNs in the Routing Table: 181 Number of 32-bit ASNs allocated by the RIRs: 100 Prefixes from 32-bit ASNs in the Routing Table: 15 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 229 Number of addresses announced to Internet: 2001869152 Equivalent to 119 /8s, 82 /16s and 25 /24s Percentage of available address space announced: 54.0 Percentage of allocated address space announced: 63.2 Percentage of available address space allocated: 85.5 Percentage of address space in use by end-sites: 75.7 Total number of prefixes smaller than registry allocations: 137208 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 64538 Total APNIC prefixes after maximum aggregation: 23028 APNIC Deaggregation factor: 2.80 Prefixes being announced from the APNIC address blocks: 61376 Unique aggregates announced from the APNIC address blocks: 27784 APNIC Region origin ASes present in the Internet Routing Table: 3532 APNIC Prefixes per ASN: 17.38 APNIC Region origin ASes announcing only one prefix: 955 APNIC Region transit ASes present in the Internet Routing Table: 550 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 19 Number of APNIC addresses announced to Internet: 401272544 Equivalent to 23 /8s, 234 /16s and 238 /24s Percentage of available APNIC address space announced: 79.7 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 123310 Total ARIN prefixes after maximum aggregation: 65208 ARIN Deaggregation factor: 1.89 Prefixes being announced from the ARIN address blocks: 92830 Unique aggregates announced from the ARIN address blocks: 35508 ARIN Region origin ASes present in the Internet Routing Table: 12768 ARIN Prefixes per ASN: 7.27 ARIN Region origin ASes announcing only one prefix: 4910 ARIN Region transit ASes present in the Internet Routing Table: 1219 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 20 Number of ARIN addresses announced to Internet: 414191136 Equivalent to 24 /8s, 176 /16s and 14 /24s Percentage of available ARIN address space announced: 79.6 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 63332 Total RIPE prefixes after maximum aggregation: 37311 RIPE Deaggregation factor: 1.70 Prefixes being announced from the RIPE address blocks: 58109 Unique aggregates announced from the RIPE address blocks: 38768 RIPE Region origin ASes present in the Internet Routing Table: 12667 RIPE Prefixes per ASN: 4.59 RIPE Region origin ASes announcing only one prefix: 6658 RIPE Region transit ASes present in the Internet Routing Table: 1917 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 22 Number of RIPE addresses announced to Internet: 388763232 Equivalent to 23 /8s, 44 /16s and 14 /24s Percentage of available RIPE address space announced: 82.8 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-49151 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 178/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 23309 Total LACNIC prefixes after maximum aggregation: 5725 LACNIC Deaggregation factor: 4.07 Prefixes being announced from the LACNIC address blocks: 21464 Unique aggregates announced from the LACNIC address blocks: 11842 LACNIC Region origin ASes present in the Internet Routing Table: 1064 LACNIC Prefixes per ASN: 20.17 LACNIC Region origin ASes announcing only one prefix: 343 LACNIC Region transit ASes present in the Internet Routing Table: 178 Average LACNIC Region AS path length visible: 4.0 Max LACNIC Region AS path length visible: 25 Number of LACNIC addresses announced to Internet: 60696704 Equivalent to 3 /8s, 158 /16s and 40 /24s Percentage of available LACNIC address space announced: 60.3 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 4526 Total AfriNIC prefixes after maximum aggregation: 1392 AfriNIC Deaggregation factor: 3.25 Prefixes being announced from the AfriNIC address blocks: 4100 Unique aggregates announced from the AfriNIC address blocks: 1391 AfriNIC Region origin ASes present in the Internet Routing Table: 284 AfriNIC Prefixes per ASN: 14.44 AfriNIC Region origin ASes announcing only one prefix: 86 AfriNIC Region transit ASes present in the Internet Routing Table: 58 Average AfriNIC Region AS path length visible: 4.0 Max AfriNIC Region AS path length visible: 19 Number of AfriNIC addresses announced to Internet: 9995264 Equivalent to 0 /8s, 152 /16s and 132 /24s Percentage of available AfriNIC address space announced: 29.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 1654 6924 381 Korea Telecom (KIX) 17488 1524 110 98 Hathway IP Over Cable Interne 4755 1208 429 178 TATA Communications formerly 9583 1083 107 362 Sify Limited 4134 904 16247 368 CHINANET-BACKBONE 18101 754 190 27 Reliance Infocom Ltd Internet 7545 720 158 97 TPG Internet Pty Ltd 9498 682 297 53 BHARTI BT INTERNET LTD. 24560 671 228 174 Bharti Airtel Ltd. 9829 639 491 19 BSNL National Internet Backbo Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4368 3433 344 bellsouth.net, inc. 209 2833 4035 615 Qwest 1785 1786 733 139 PaeTec Communications, Inc. 4323 1638 1081 375 Time Warner Telecom 20115 1592 1417 726 Charter Communications 7018 1439 5877 993 AT&T WorldNet Services 2386 1253 714 895 AT&T Data Communications Serv 6478 1235 293 501 AT&T Worldnet Services 11492 1226 192 12 Cable One 3356 1141 10976 439 Level 3 Communications, LLC Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8452 1075 188 7 TEDATA 3292 443 1762 388 TDC Tele Danmark 30890 439 88 201 SC Kappa Invexim SRL 12479 397 578 6 Uni2 Autonomous System 3320 339 7064 290 Deutsche Telekom AG 3301 338 1669 304 TeliaNet Sweden 8866 336 109 22 Bulgarian Telecommunication C 3215 331 2946 103 France Telecom Transpac 29049 331 26 3 AzerSat LLC. 8551 312 288 40 Bezeq International Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1484 2834 230 UniNet S.A. de C.V. 10620 747 163 92 TVCABLE BOGOTA 11830 694 299 9 Instituto Costarricense de El 22047 619 302 14 VTR PUNTO NET S.A. 7303 511 255 79 Telecom Argentina Stet-France 6471 439 95 42 ENTEL CHILE S.A. 16814 427 27 11 NSS, S.A. 11172 407 118 75 Servicios Alestra S.A de C.V 7738 397 794 28 Telecomunicacoes da Bahia S.A 28573 371 506 23 NET Servicos de Comunicao S.A Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 651 74 39 LINKdotNET AS number 20858 276 34 3 This AS will be used to conne 3741 271 857 229 The Internet Solution 2018 242 215 142 Tertiary Education Network 33783 150 10 8 EEPAD TISP TELECOM & INTERNET 6713 144 135 11 Itissalat Al-MAGHRIB 29571 128 15 8 Ci Telecom Autonomous system 5536 119 7 20 Internet Egypt Network 33776 118 6 3 Starcomms Nigeria Limited 5713 115 523 64 Telkom SA Ltd Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4368 3433 344 bellsouth.net, inc. 209 2833 4035 615 Qwest 1785 1786 733 139 PaeTec Communications, Inc. 4766 1654 6924 381 Korea Telecom (KIX) 4323 1638 1081 375 Time Warner Telecom 20115 1592 1417 726 Charter Communications 17488 1524 110 98 Hathway IP Over Cable Interne 8151 1484 2834 230 UniNet S.A. de C.V. 7018 1439 5877 993 AT&T WorldNet Services 2386 1253 714 895 AT&T Data Communications Serv Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 209 2833 2218 Qwest 1785 1786 1647 PaeTec Communications, Inc. 17488 1524 1426 Hathway IP Over Cable Interne 4766 1654 1273 Korea Telecom (KIX) 4323 1638 1263 Time Warner Telecom 8151 1484 1254 UniNet S.A. de C.V. 11492 1226 1214 Cable One 8452 1075 1068 TEDATA 18566 1061 1051 Covad Communications 4755 1208 1030 TATA Communications formerly Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic 32326 UNALLOCATED 12.40.49.0/24 7018 AT&T WorldNet Servic 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.75.116.0/22 10796 ServiceCo LLC - Road Runner 24.75.160.0/19 7843 Adelphia Corp. 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 41.220.16.0/20 8668 TelOne Zimbabwe P/L 41.223.112.0/22 5713 Telkom SA Ltd 41.223.188.0/24 22351 Intelsat 41.223.189.0/24 26452 Local Communications Networks 62.12.96.0/19 15834 Menanet Communications 62.61.220.0/24 24974 Tachyon Europe BV - Wireless Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:10 /10:20 /11:54 /12:162 /13:311 /14:575 /15:1128 /16:10327 /17:4585 /18:7857 /19:16906 /20:19888 /21:19496 /22:24720 /23:24959 /24:146354 /25:677 /26:830 /27:515 /28:104 /29:8 /30:1 /31:0 /32:7 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2844 4368 bellsouth.net, inc. 209 1576 2833 Qwest 4766 1379 1654 Korea Telecom (KIX) 17488 1305 1524 Hathway IP Over Cable Interne 1785 1196 1786 PaeTec Communications, Inc. 11492 1188 1226 Cable One 8452 1049 1075 TEDATA 18566 1042 1061 Covad Communications 2386 941 1253 AT&T Data Communications Serv 9583 931 1083 Sify Limited Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:13 8:181 12:2192 13:2 15:21 16:3 17:5 20:35 24:1108 32:51 38:543 40:96 41:1805 43:1 44:2 47:11 52:3 55:2 56:3 57:25 58:529 59:610 60:460 61:1097 62:1120 63:2008 64:3428 65:2431 66:3539 67:1470 68:652 69:2479 70:507 71:159 72:1612 73:2 74:1420 75:203 76:305 77:777 78:545 79:321 80:968 81:823 82:547 83:397 84:604 85:989 86:400 87:624 88:349 89:1386 90:42 91:1967 92:278 93:1083 94:1097 95:415 96:91 97:179 98:192 99:16 109:1 110:1 111:1 112:79 113:83 114:175 115:221 116:1161 117:477 118:269 119:647 120:137 121:703 122:945 123:514 124:849 125:1279 128:223 129:222 130:134 131:410 132:75 133:9 134:343 135:37 136:224 137:139 138:145 139:78 140:412 141:105 142:377 143:319 144:319 145:38 146:373 147:147 148:535 149:227 150:141 151:198 152:152 153:132 154:10 155:258 156:171 157:294 158:156 159:240 160:282 161:138 162:274 163:142 164:516 165:502 166:274 167:351 168:682 169:161 170:471 171:39 172:10 173:212 174:64 178:1 186:5 187:60 189:305 190:2557 192:5813 193:4198 194:3337 195:2694 196:1068 198:3683 199:3279 200:5513 201:1492 202:7812 203:7985 204:3859 205:2166 206:2354 207:2776 208:3825 209:3477 210:2612 211:1122 212:1509 213:1713 214:68 215:30 216:4560 217:1202 218:372 219:407 220:1209 221:459 222:306 End of report

1 0

RE: Global Blackhole Service
by Skywing 13 Feb '09

13 Feb '09

Of course, whomever hosts such a service becomes an attractive DoS target themselves if it were ever to gain real traction in the field. There is also the "reverse-DoS" issue of an innocent party getting into the feed if anyone can peer with it. - S -----Original Message----- From: Nuno Vieira - nfsi telecom <nuno.vieira(a)nfsi.pt> Sent: Friday, February 13, 2009 07:13 To: Jens Ott - PlusServer AG <j.ott(a)plusserver.de> Cc: nanog <nanog(a)nanog.org> Subject: Re: Global Blackhole Service Hi Jens, I think we are in the same boat. We suffered the same problem often, on a lower magnitude, but if a project like this exists those DDoS could even be almost near zero. This is somewhat similar to what Spamcop, and other folks do with SPAM today, but applied on a diferent scope, say, BGP Blackhole. This service can span wide after just peers, opening the opportunity to edge-to-edge DDoS mitigation. Say, a network in .pt or .de is beign attacked at large, and dst operators inject the dst attacked source on the blackhole bgp feed... say that 100+ other ops around the world use a cenário like this... this might be very useful. concers: the "autohority" or the "responsible" for maintaining this project, must assure that OP A or OP B can *only* annouce chunks that below to him, avoiding any case of hijack. We would be interested in participating in something like this. So, > My questions to all of you: > > - - What do you think about such service? It will be great. We are available to help. > - - Would you/your ASN participate in such a service? Yes. > - - Do you see some kind of usefull feature in such a service? Yes, a few thoughts above, some more might come up. > - - Do you have any comments? For starters, a few above. Regards, --- Nuno Vieira nfsi telecom, lda. nuno.vieira(a)nfsi.pt Tel. (+351) 21 949 2300 - Fax (+351) 21 949 2301 http://www.nfsi.pt/ ----- "Jens Ott - PlusServer AG" <j.ott(a)plusserver.de> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi, > > in the last 24 hours we received two denial of service attacks with > something > like 6-8GBit volume. It did not harm us too much, but e.g. one of our > upstreams got his Amsix-Port exploded. > > With our upstreams we have remote-blackhole sessions running where we > announce > /32 prefixes to blackhole at their edge, but this does not work with > our > peers. Also our Decix-Port received something like 2Gbit extra-traffic > during > this DoS. > > I can imagine, that for some peers, especially for the once having > only a thin > fiber (e.g. 1GBit) to Decix, it's not to funny having it flooded with > a DoS > and that they might be interested in dropping such traffic at their > edge. > > Well I could discuss with my peers (at least the once who might get in > trouble > with such issue) to do some individual config for some > blackhole-announcement, > but most probably I'm not the only one receiving DoS and who would be > interested in such setup. > > Therefore I had the following idea: Why not taking one of my old > routers and > set it up as blackhole-service. Then everyone who is interested could > set up a > session to there and > > 1.) announce /32 (/128) routes out of his prefixes to blackhole them > 2.) receive all the /32 (/128) announcements from the other peers with > the IPs > they want to have blackholed and rollout the blackhole to their > network. > > My questions to all of you: > > - - What do you think about such service? > - - Would you/your ASN participate in such a service? > - - Do you see some kind of usefull feature in such a service? > - - Do you have any comments? > > Thank you for telling me your opinions and best regards > > - -- > =================================================================== > > Jens Ott > Leiter Network Management > > Tel: +49 22 33 - 612 - 3501 > Fax: +49 22 33 - 612 - 53501 > > E-Mail: j.ott(a)plusserver.de > GPG-Fingerprint: 808A EADF C476 FABE 2366 8402 31FD 328C C2CA 7D7A > > PlusServer AG > Daimlerstraße 9-11 > 50354 Hürth > > Germany > > HRB 58428 / Amtsgericht Köln, USt-ID DE216 740 823 > Vorstand: Jochen Berger, Frank Gross, Jan Osthues, Thomas Strohe > Aufsichtsratsvorsitz: Claudius Schmalschläger > > =================================================================== > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.9 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iEYEARECAAYFAkmVilwACgkQMf0yjMLKfXpNuQCeKcicthIadISe7I+Xs5ZNHS+1 > 0qUAnRDkOY9/6kokq3Hf68BRQFfkP3xy > =jKUA > -----END PGP SIGNATURE-----

2 1