- NANOG - lists.nanog.org

Experiences with DDoS platforms...
by Fergie 29 Aug '06

29 Aug '06

So, it would appear to me that simply analyzing netflow data, etc., at the time of a (D)DoS attack, and then black-holing (by hand) the offending source addresses may not be the most scalable and efficient way of dealing/coping/mitigating/staying-on-the-air during an attack. Of course, depending where you are on the food chain, the resources one is trying to protect, the volume of DDoS traffic, etc, plays into the equation, etc. I was looking to see what opinions folks on the list may have on the DDoS "appliance" vendor products available -- I'm particularly looking for a stand-alone (or in conjunction with a 'traffic analysis' box) to off-load DoS "mitigation" -- real-world experiences welcome. Please direct responses to me off-list, or not... Thanks, - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

HTTP issues between TWC and Cogent
by David Coulson 29 Aug '06

29 Aug '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Someone pointed out a weird issue to me tonight, which I'm still trying to figure out. It's one of those thing where you run a test, and you just look at it totally confused. Adelphia recently started to move their network over to TWC's, in that, peering between carriers was done with TWC rather than direct with Adelphia - When I traceroute out now, I see TWC in there, where as when I did it a week ago, it wasn't. No big deal, happens all the time. No idea if it has anything useful to do with this problem, other than that I have the problem when using Adelphia/TWC. At least since 11pm EDT tonight, HTTP across TWC is spotty. I've got a network on Cogent & XO (traceroutes seem to indicate that TWC likes Cogent better). If I run a wget from a server on Qwest (Gets to me via COgent), I get ~5Mb/sec, which is about what I'd expect (Qwest box is maxed by a DS-3). From TWC at home, I get 9k/sec. Whacky thing is, if I tunnel across IPSec via TWC, I get 400k/sec. Logic would therefore dictate that I'm able to max my cable modem when using TWC, but something is playing with HTTP traffic along the way. Now I've got Cogent turned down, and I get 400k/sec normally via TWC across XO. I've seen Cogent do some crazy stuff, but I've never seen IPSec have full throughput and HTTP being lame. I've only been able to replicate the issue using TWC, and I've confirmed another network has the same issues (although, they use XO and Cogent too out of the same POPs, so it doesn't help much, other than tell me it's nothing I screwed up :-) My thinking is that Cogent have a confused peering location somewhere that is causing traffic issues, but So, while I'm sitting on hold with Cogent on one phone, and having Adelphia tell me they're unable to take my call on another, is anyone else seeing wacky stuff going on with either network tonight? David -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFE88PkTIgPQWnLowkRAmYyAKCyWd7m03s64UnitdtFmAza/T47hwCgx286 3IdVManRmwLwIpqFC7jY2/k= =QXOw -----END PGP SIGNATURE-----

1 1

Re: ICANN to remove fee restrictions on .INFO, .ORG, .BIZ?
by Michael Loftis 29 Aug '06

29 Aug '06

--On August 28, 2006 9:52:30 PM +0000 John Levine <nanog(a)johnlevine.com> wrote: > You're confusing registrars and registries. Every TLD has a single > monopoly registry to which all registrars funnel the registrations. > Switching registrars wouldn't help. AH! That's what I was missing now it makes sense. I wasn't thinking about it carefully enough. So yeah, decidedly bad juju. :/ > > I have a longer blog entry on this at http://weblog.johnlevine.com. > > R's, > John > -- "Genius might be described as a supreme capacity for getting its possessors into trouble of all kinds." -- Samuel Butler

1 0

Calling Volunteers to Download (Out Brazil Performance Tests)
by Eduardo Ascenco Reis 28 Aug '06

28 Aug '06

Dear Fellows, We need help from volunteers outside Brazil with an Internet connection >= 2Mbps that could do just a few downloads and report the expense time (and attach a traceroute). The main idea is to analyse the upload performance to international (out Brazil) sites because some customers are reporting a significative difference in comparison to others ISP. Anyone that can help please contact me in private. Thanks in advance. Regards, Eduardo Ascenço Reis

1 0

Earthlink playing Sitefinder
by David Lesher 28 Aug '06

28 Aug '06

FYI: I see discussion on DSLReports that Earthlink is deploying a Sitefinder-ish DNS scheme. It bounces people to a "barefruit.com" that then sprays ads back at you. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

3 2

Re: Is it my imagination or are countless operations impacted today with mysql meltdowns
by Jeb Bush 27 Aug '06

27 Aug '06

On 8/27/06, Larry grunt Brower <grunt(a)euhosts.net> wrote: > Fergie: I happen to like the articles. I usualy dont have time to look for them myself every day. > Gadi: The botnet reports can be usefull Botnet's is a very specific subject and Nanog hasn't got the time or resources to fill it. If we say yes to all Botnet subject and discussion the Nanog list would serve no other purpose and non Botnet discussion wouldn't get a look in. There should be a Botnet dedicated list to deal with Botnet issues. As for Fergie no, he was also told to get off the list for posting news articles. There is no excuse for posting news articles, we all have access to the same resources off list as he has in respect of news web sites and RSS feeds, so it really serves no purpose to turn Nanog into a wash of web links to news articles. Can we just have people posting information to Nanog that cannot be obtained elsewhere, which justifies a reason for posting. -Jeb

6 5

Is it my imagination or are countless operations impacted today with mysql meltdowns
by Henry Linneweh 27 Aug '06

27 Aug '06

Every where I go that uses MySql is hozed and I can not access the pages -Henry

8 8

Trying to reach someone at Brookings.net
by Dave Pooser 27 Aug '06

27 Aug '06

Spammers are using one of your servers as a download center for a virus. Check 66_17_96_42 in the ~identity directory (address underscored because it's already being flagged by some spam filters). -- Dave Pooser, ACSA Manager of Information Services Alford Media http://www.alfordmedia.com

1 0

Registration for NANOG 38
by Steve Feldman 25 Aug '06

25 Aug '06

Registration is now open for NANOG 38, to be held October 8-10, 2006, in St. Louis! For more information and to register, go to: http://www.nanog.org We are using new registration software for this meeting, which will assist with the NANOG voting process. There are also a few new optional demographic questions. Note that the early registration discount period ends September 15, and the hotel room block expires on September 22. Confirmed agenda topics are available at: http://www.nanog.org/mtg-0610/topics.html There are still a few openings left for presentations, especially tutorials and BOFs. If you are interested in submitting a talk proposal, review the call for presentations at: http://www.nanog.org/mtg-0610/cfp38.html and submit your proposal at http://www.nanogpc.org The deadline for this round of submissions completed is Thursday, August 31. Submissions made after that will only be considered if agenda space remains available. Steve Feldman program chair

1 0

Re: Billing Humor
by Fergie 25 Aug '06

25 Aug '06

This kind of takes the edge off of the humor (or maybe not): FCC Questions Verizon, BellSouth 'Fee Swapping' http://money.cnn.com/2006/08/25/news/companies/verizon_bellsouth.reut/index… :-) - ferg -- "Crist Clark" <Crist.Clark(a)globalstar.com> wrote: New plan? We used to have similar contracts with MCI and AT&T. http://www.theonion.com/content/node/51834 [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0