- NANOG - lists.nanog.org

Update to BCP-38?
by Stephen Satchell 08 Oct '19

08 Oct '19

Is anyone working on an update to include IPv6?

12 35

Spoofer Report for NANOG for Sep 2019
by CAIDA Spoofer Project 08 Oct '19

08 Oct '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Sep 2019: ASN Name Fixed-By 13427 SOFTCOM-INTERNET-COMMUNICATION 2019-09-12 3807 UMTNET-ASN 2019-09-16 8047 GCI 2019-09-16 225 VIRGINIA 2019-09-18 16787 CHARTER-16787-DC 2019-09-23 22402 NEXTCO 2019-09-23 2828 XO-AS15 2019-09-26 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Sep 2019: ASN Name First-Spoofed Last-Spoofed 40065 CNSERVERS 2016-05-01 2019-09-04 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-09-25 6128 CABLE-NET-1 2016-09-03 2019-09-25 27364 ACS-INTERNET 2016-09-27 2019-09-19 20412 CLARITY-TELECOM 2016-09-30 2019-09-27 6181 FUSE-NET 2016-10-10 2019-09-29 15305 SYRINGANETWORKS 2016-10-21 2019-09-19 14971 PINETEL 2016-10-21 2019-09-19 25787 ROWE-NETWORKS 2016-10-21 2019-09-29 174 COGENT-174 2016-10-21 2019-09-26 32440 LONI 2016-11-03 2019-09-26 12083 WOW-INTERNET 2016-11-09 2019-09-30 39939 RISE-CO-AS39939 2016-11-11 2019-09-12 1403 EBOX 2016-11-12 2019-09-27 2828 XO-AS15 2016-11-21 2019-09-11 9009 M247 2017-01-10 2019-09-04 701 UUNET 2017-06-14 2019-09-30 63296 AMARILLO-WIRELESS 2017-09-01 2019-09-27 546 PARSONS-PGS-1 2017-11-20 2019-09-12 54540 INCERO-HVVC 2018-01-15 2019-09-16 12222 AKAMAI 2018-02-14 2019-09-30 4201 ORST 2018-04-19 2019-09-25 11827 WSU 2018-05-07 2019-09-26 19016 WCG 2018-05-19 2019-09-01 225 VIRGINIA 2018-06-18 2019-09-27 33452 RW 2018-09-19 2019-09-28 20448 VPNTRANET-LLC 2018-09-20 2019-09-10 63275 RADIOWIRE 2019-02-07 2019-09-23 15290 ALLST-15290 2019-04-09 2019-09-19 8047 GCI 2019-04-11 2019-09-24 10745 ARIN-ASH-CHA 2019-04-29 2019-09-30 38235 MEKONGNET-ADC 2019-05-09 2019-09-22 32 STANFORD 2019-08-21 2019-09-24 21709 IMPLEX-NET 2019-09-24 2019-09-24 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

dns cache beyond ttl - viasat / exede
by Mike 08 Oct '19

08 Oct '19

Hello, I am moving a number of web sites from one colo to another, re-numbering them in the process, and I have run into an interesting issue I'd like to solicit feedback on. My dns TTL's are all 300 seconds, and I have noticed that once I update the A records with the new addresses, most (but not all) web clients begin using the new address within 5 minutes or so. However, there is a persistent set of stragglers who continue accessing the site(s) on their old addresses for far in excess of this - up to a week in fact. And, what I have noted, all of these clients have something in common - they all appear to be satellite users of viasat/exede. This is based on whois lookups of the ip addresses of the clients. Note, I am NOT expecting 'turn on a time' - just looking for clients to refresh within a reasonable time. I am wondering if perhaps this is due to some kind of (known?) bug in the embedded dns cache/client in the client satellite modem, or if there is another plausible explanation I am not seeing. It compounds my problem slightly since I have to continue running the web sites at both the old and new addresses while these things time out I guess and it's just inconvenient. Thanks. MIke-

7 11

Automated Abuse Reports
by Matt Corallo 08 Oct '19

08 Oct '19

How do people view the automated generation of abuse reports? I’ve seen lots of (understandable) moaning about large providers not handling abuse reports, and lots of (understandable) suggestions that ARIN test for the reachability of abuse contacts. On the flip side, I run a Tor exit node (as well as bridge nodes, which appear to be used exclusively by Chinese, Russian, and Iranian IPs, indicating Tor is, contrary to popular belief, used in large part for its intended purpose). Because people seem to include “you tried three to log in three times and got the password wrong” in their definition of abuse, I’ve had to provide bogus abuse contacts (and include actual abuse comments in the comments section). I’ve tried reaching out to other operators suggesting that they cut it out, as they are the reason many operators do not provide functional abuse contacts, usually with a response of “so stop attacking my serverz!!!1one”. Is it time to have ARIN add a “abuse contact available only after captcha” option? Matt

3 2

Re: Poor mans TAP
by John Kristoff 07 Oct '19

07 Oct '19

On Mon, 7 Oct 2019 14:16:31 +0000 Dovid Bender <dovid(a)telecurve.com> wrote: > Funds at my 9-5 are limited. Has anyone tried this and how well does > it work? We plan on mirroring about 800 megs of traffic at peak. > https://www.amazon.com/Dualcomm-1000Base-T-Ethernet-Regeneration-Network/dp… I don't know if it still works on modern switches, but many years ago I was able to have Cisco LAN switches configured such that a single L2 MAC address could be statically associated with multiple interfaces (i.e. router interface). This made it possible to duplicate all traffic to destined to one station to appear on two (maybe more?) ports. You might try this also if you have an unused and available switch. John

4 5

This DNS over HTTP thing
by Jay R. Ashworth 07 Oct '19

07 Oct '19

I've been embroiled in my first house-move in 28 years, and just got back to the table. I don't see any threads here about whatever this thing-which- appears-to-me-to-be-a-monstrosity; has it been discussed here and I missed it? Is there an official name for it I should be searching for? Is it in fact not a monstrosity, and I'm just not smart enough? :-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

39 86

Poor mans TAP
by Dovid Bender 07 Oct '19

07 Oct '19

Hi, Funds at my 9-5 are limited. Has anyone tried this and how well does it work? We plan on mirroring about 800 megs of traffic at peak. https://www.amazon.com/Dualcomm-1000Base-T-Ethernet-Regeneration-Network/dp… TIA. Dovid

2 1

Equipment needed plea!
by James Laszko 07 Oct '19

07 Oct '19

Probably gonna get yelled at for this, but does anyone by chance have a Cisco N5548P-FAN module in the Atlanta area? We have a customer with critical infrastructure down and can’t find one anywhere! Any assistance would be appreciated. Thanks, James Laszko Mythos Technology Inc jamesl(a)mythostech.com

1 0

Clueful Abuse Contact at Tucows
by james jones 05 Oct '19

05 Oct '19

Looking for someone on the abuse team at Tucows. Major scam in progress via a domain registered through them. -James

1 0

hairpin attempts
by Randy Bush 05 Oct '19

05 Oct '19

for some months, our border routers log attempts to connect from the outside using a source address that is internal to my network. e.g. Oct 3 06:48:12 r0 7833: Oct 3 06:48:11.267: %FMANFP-6-IPACCESSLOGP: SIP0: fman_fp_image: list serial-in4 denied udp 147.28.0.223(3465) -> 147.28.0.222(53), 1 packet some days, we see a *lot* of this. anyone else seeing similar? randy

2 2