- NANOG - lists.nanog.org

Re: [EXTERNAL] Re: VoIP Provider DDoSes
by Compton, Rich A 22 Sep '21

22 Sep '21

FYI, UTRS (Unwanted Traffic Removal Service https://team-cymru.com/community-services/utrs/) from Team Cymru is a free service where you can send a blackhole advertisement (sacrificing the one IP that’s under attack to save the rest of the network) and they will propagate that via BGP to hundreds of other ASNs which will then blackhole traffic to that IP. This can drastically reduce the amount of DDoS traffic that is received by the victim network. -Rich From: NANOG <nanog-bounces+rich.compton=charter.com(a)nanog.org> on behalf of Mike Hammett <nanog(a)ics-il.net> Date: Wednesday, September 22, 2021 at 9:29 AM To: Terrance Devor <ter.devor(a)gmail.com> Cc: NANOG list <nanog(a)nanog.org> Subject: [EXTERNAL] Re: VoIP Provider DDoSes CAUTION: The e-mail below is from an external source. Please exercise caution before opening attachments, clicking links, or following guidance. Fail2Ban on a couple of dozen servers may not be sufficient to address 400 gigs of traffic. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com ________________________________ From: "Terrance Devor" <ter.devor(a)gmail.com> To: "Mike Hammett" <nanog(a)ics-il.net> Cc: "NANOG" <nanog(a)nanog.org> Sent: Wednesday, September 22, 2021 10:24:07 AM Subject: Re: VoIP Provider DDoSes Fail2Ban and give ourselves a pat on the back.. On Wed, Sep 22, 2021 at 9:12 AM Mike Hammett <nanog(a)ics-il.net<mailto:nanog@ics-il.net>> wrote: https://twit.tv/shows/security-now/episodes/837?autostart=false It looks like Security Now covered this yesterday. They claimed that, "There is currently no provider of large pipe VoIP protocol DDoS protection." Are any of the cloud DDoS mitigation services offering a service like this. ________________________________ From: "Mike Hammett" <nanog(a)ics-il.net<mailto:nanog@ics-il.net>> To: "NANOG" <nanog(a)nanog.org<mailto:nanog@nanog.org>> Sent: Tuesday, September 21, 2021 4:19:42 PM Subject: VoIP Provider DDoSes As many may know, a particular VoIP supplier is suffering a DDoS. https://twitter.com/voipms Are your garden variety DDoS mitigation platforms or services equipped to handle DDoSes of VoIP services? What nuances does one have to be cognizant of? A WAF doesn't mean much to SIP, IAX2, RTP, etc. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

2 1

QVC Contact
by Joshua Pool 22 Sep '21

22 Sep '21

Does anyone have technical contacts for QVC? Our customers are getting Access Denied across all of our subnets. We need to get this resolved and I am looking for anyone that has some contacts as calling their phone number and leaving messages as well as emailing their noc has resulted in crickets. Regards, Josh Thanks, Josh

1 0

Re: [EXTERNAL] VoIP Provider DDoSes
by Compton, Rich A 22 Sep '21

22 Sep '21

Most of the larger DDoS mitigation appliances can block malformed SIP traffic and also can block volumetric/state exhaustion UDP floods. A lot of VoIP companies have Session Border Controllers (SBCs) to protect public facing VoIP services. SBCs are more application aware. Kind of like a proxy based firewall just for VoIP. -Rich From: NANOG <nanog-bounces+rich.compton=charter.com(a)nanog.org> on behalf of Mike Hammett <nanog(a)ics-il.net> Date: Tuesday, September 21, 2021 at 3:31 PM To: NANOG list <nanog(a)nanog.org> Subject: [EXTERNAL] VoIP Provider DDoSes CAUTION: The e-mail below is from an external source. Please exercise caution before opening attachments, clicking links, or following guidance. As many may know, a particular VoIP supplier is suffering a DDoS. https://twitter.com/voipms Are your garden variety DDoS mitigation platforms or services equipped to handle DDoSes of VoIP services? What nuances does one have to be cognizant of? A WAF doesn't mean much to SIP, IAX2, RTP, etc. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

3 3

QVC
by Joshua Pool 21 Sep '21

21 Sep '21

Does anyone have a technical contacts for QVC? Our customers are getting Access Denied across our entire /20. We need to get this resolved and I am looking for anyone that has some contacts as calling their phone number and leaving messages as well as emailing their noc has resulted in crickets. Thanks, Josh

1 0

IRR Upstream\Downstream
by Mike Hammett 21 Sep '21

21 Sep '21

I'm trying to firm up my grasp of how I define my neighbor ASes in my IRR entries. https://bgp.he.net/AS40764#_irr In my aut-num, I've defined my two upstreams (Intercarrier and Cogent). I've used their AS-Set or just their AS and used that in the export lines. I'd assume I'd do the reverse in the import fields for any downstream customers. I realized after looking at this that I need to add an export to IX and other peering connections. What else do I need to change? Yes, I realized that I just asked NANOG to criticize me. Hopefully, I get more help than flames. ;-) ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

3 2

Four years since Hurricane Maria hit Puerto Rick/US Virgin Islands
by Sean Donelan 21 Sep '21

21 Sep '21

Wednesday, September 20, 2017, Hurricane Maria struck Puerto Rico with sustained winds of 155 mph. An estimated 2,975 people died in PR, 3 in USVI, and 81 the other parts of the carribean. It caused over $90 billion in property damage. The Puerto Rico power grid was effectively destroyed by the hurricane, leaving millions without electricity. It still has not been fully restored, with rolling blackouts still occuring. Over 95% of the islands had no cell service, and other telecommunications service was limited mostly to San Juan metro area. Only a handful of radio stations were still operating. Only about $18 billion of the $63 billion allocated by Congress for disaster relief and recovery has actually been disbursed. Most of the remaining funds are not expected to be disbursed until after fiscal year 2025.

1 0

Fwd: [safnog] Reminder: SAFNOG-6 Virtual Conference
by Mark Tinka 20 Sep '21

20 Sep '21

FYI. Mark. -------- Forwarded Message -------- Subject: [safnog] Reminder: SAFNOG-6 Virtual Conference Date: Mon, 20 Sep 2021 16:23:37 +0200 From: SAFNOG Conference <conference(a)safnog.org> To: safnog(a)lists.safnog.org Hello Everyone, SAFNOG-6 Virtual Conference is just one week away! This is a reminder to join us for SAFNOG's sixth annual meeting, SAFNOG-6 Virtual Conference <https://safnog.org/virtual-meetings/index.html#1%23hero-13> next week on the 27 and 28 September at 13h00 SAST/ 11h00 UTC. Don't miss this opportunity to engage with and learn from our industry experts such as our *keynote speaker*, *Eddy Kayihura from AFRINIC.* Visit https://safnog.org/virtual-meetings/agenda <https://safnog.org/virtual-meetings/agenda.html> for the full agenda. We are grateful to our SAFNOG-6 sponsors, Akamai, FLEXOPTIX, Team Cymru, Africa Data Centres, Internet Society, Workonline, INX-ZA and NAPAfrica for their support. Register now: https://safnog.org/virtual-meetings/ <https://safnog.org/virtual-meetings/index.html#1%23hero-13> Regards, SAFNOG OC

1 0

Re: IPv6 woes - RFC
by Stephen Satchell 20 Sep '21

20 Sep '21

I concur that the problem is not a routing hardware problem. It's a perception problem with the various ISPs. I have fiber service with AT&T. My little server farm endpoints all have IPv6 addresses, including the edge router. I also have a plan to allocate IPv6 addresses to my LAN devices, and to protect the LAN devices from outside interference by rules in the NFTABLES firewall that include connection tracking on outbound requests. (IPv4 will still use NAT to keep nefarious people from probing my internals.) Specifically, when I was doing my mail server refresh (moving from Red Hat to Canonical) I decided it was time to offer IPv6 connectivity in the mail server to "future proof" my setup. That included adding AAAA records in my DNS zone files. Failure! The issues: 1. I learned that there are no "static addresses" in IPv6, as far as AT&T was concerned. By all appearances, though, the IPv6 /64 is relatively static, for now, similar to the way that early cable modem deployments kept the same IPv4 addresses. (Until the cable people started forcing changes on DHCP lease renewal, that is.) 2. My request for PTR records was denied, which means I can't satisfy Best Practices for a mail server in the IPv6 space. No PTR records, no redirection of ip6.apra space, nothing. I include AT&T's refusal below. 3. I don't know how to get an IPv6 allocation from ARIN, how to request AT&T to route it, or how to deal with the DNS server issues. Oh, I know how to configure BIND9; I would prefer using a 24/7/365 provider. For example, my master zone files are with Register.com, so if my circuit goes down the name resolution still happens. Register.com appears not to provide reverse-DNS PTR zone support (in6.arpa). A Google search turned up NOTHING for in6.arpa hosting. That tells me that IPv6 is not "Internet Ready" for small users. Given the level of FU responses I get trying to work with it, I will stop banging my head against the wall. So I stick with IPv4, because that will be the "standard" until the day I die, as far as I can tell. (I removed the AAAA record, so as not to confuse mail server that DO operate IPv6.) > Subject: RE: Need IPv6 PTR record for my IPv6 mail server > Date: Mon, 19 Jul 2021 12:52:53 +0000 > From: Prov-DNS <prov-dns(a)att.com> > To: Prov-DNS <prov-dns(a)att.com>, att(a)satchell.net <att(a)satchell.net> > > > Hello > We don't process DNS request on IPv6 addresses. We only process DNS > request on IPv4 static assigned addresses. If you would like us to > process a DNS request for you on a IPv4 address please provide the > following information. > > IPv4 address you would like the record created for Host name you would > like that IP address pointed to > > Thanks > Michael AT&T Prov-DNS > > -----Original Message----- > From: Stephen Satchell <att(a)satchell.net> > Sent: Friday, July 16, 2021 5:42 PM > To: DNSUpdates cB <g12988(a)att.com> > Subject: Need IPv6 PTR record for my IPv6 mail server > > Here is the record I need inserted into your ip6.arpa DNS zone: > >> 2.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.c.d.d.0.b.9.7.0.0.7.1.0.0.6.2.ip6.arpa. 0 IN PTR smtp.satchell.net. > > This is the result from the question section of a dig(1) request for the PTR record for my IPv6 address 2600:1700:79b0:ddc0::32, and the fully-qualified domain name of the server. > > You can verify the information using dig smtp.satchell.net AAAA and > checking the reverse. > > This is the only server in my collection that needs the IPv6 pointer.

4 5

The great Netflix vpn debacle!
by John Alcock 19 Sep '21

19 Sep '21

Well, It happened. I have multiple subscribers calling in. They can not access Netflix. Any contacts on list for Netflix that I can use to get my up blocks whitelisted? John

25 50

Never push the Big Red Button (New York City subway failure)
by Sean Donelan 17 Sep '21

17 Sep '21

NEW YORK CITY TRANSIT RAIL CONTROL CENTER POWER OUTAGE ISSUE ON AUGUST 29, 2021 Key Findings September 8, 2021 https://www.governor.ny.gov/sites/default/files/2021-09/WSP_Key_Findings_Su… Key Findings [...] 3. Based on the electrical equipment log readings and the manufacturer’s official assessment, it was determined that the most likely cause of RCC shutdown was the “Emergency Power Off” button being manually activated. Secondary Findings 1. The “Emergency Power Off” button did not have a protective cover at the time of the shutdown or the following WSP investigation. [...] Mitigation Steps 1. Set up the electrical equipment Control and Communication systems properly to stay active so that personnel can monitor RCC electrical system operations. [...]

24 32