- NANOG - lists.nanog.org

Slight recurring Packet Loss at Equinix Ashburn
by Laurent 27 Apr '18

27 Apr '18

Hi everyone, Apologies for the noise and feel-free to reply off-list. We have a transit link to Equinix Ashburn where we see regular 12-20% packet loss on "some" of the peers there. We are working with the transit partner and Equinix NOC for the past few days. I can provide graph and IPs off-list if needed but I just wanted to do a quick cursosy check if anyone else saw similar issues over the past two weeks. Thank you

1 0

Re: Is WHOIS going to go away?
by keith＠contoocook.net 26 Apr '18

26 Apr '18

Well, personally for me, I use secret registration because I was tired of all the spam I got. Spammers scrape whois data for email addresses. I not trying to hide my identity on the web, I just don't like spam. I'm not some dark evil force. Cheers, Keith ----- Original Message ----- From: "Rich Kulawiec" <rsk(a)gsp.org> To: <nanog(a)nanog.org> Sent: Wednesday, April 25 2018 09:18:54 AM Subject: Re: Is WHOIS going to go away? > On Fri, Apr 20, 2018 at 07:31:20PM +0000, Naslund, Steve wrote: > > I don't see why there should not be a way to know who is publishing data on the Internet. > > +1 for this and what follows. Allow me, please, to piggyback on it > with a similar thought: > > With great power, comes great responsibility. > > There is no difference between someone who runs a global network or > a worldwide collection of datacenters, and someone who runs a tiny > web server or a single domain, other than scale. Both of them enjoy > extraordinary power, power that was difficult to imagine even for > people with reliable and accurate crystal balls, a quarter century ago. > They both operate a piece of the Internet that we share. > > And they are both responsible to each other -- whatever that means > in context. They have to be accountable, because when people are > unaccountable we get spam factories and network hijacking and DoS > attacks and all the other myriad crap that chews up enormous amounts > of time and money. > > This responsibility, this accountability isn't for everyone. And that's > fine. But anyone who isn't up for it *should not sign up to operate a > piece of the Internet*. There are a zillion other ways to participate > without becoming an operator. > > ---rsk >

8 8

China Showdown Huawei vs ZTE
by Colton Conor 26 Apr '18

26 Apr '18

Of the two large Chinese Vendors, which has the better network operating system? Huawei is much larger that ZTE is my understanding, but larger does not always mean better. Both of these manufactures have switches and routers. I doubt we will use their routing products anytime soon, but the switching products with MPLS are what we are exploring. Price wise both of these vendors seem to have 10G MPLS capable switches that are a 1/4 of the price of a Cisco or Juniper wants to charge. On the Huawei side looks like the S6720 is a fit. On the ZTE side, it looks like the ZXR10 5960 Series is a fit. Has anyone had experience with either of these two switches? How do they compare? Also, for each independent brand, is their switching network operating system the same as their routing network operating system that their routers run?

9 17

Comcast and DGA like behavior
by J. Oquendo 25 Apr '18

25 Apr '18

Anyone else seeing DGA (1) like behavior for Comcast based customers? If so, is there any information on it? Seeing a lot of traffic to bogus domains all synonymous with their networks. 1: https://en.wikipedia.org/wiki/Domain_generation_algorithm -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM, GNFA "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 0A96 6318 EA49 4032 21C9 A7A8 81E9 3E95 414F 356E https://pgp.mit.edu/pks/lookup?op=get&search=0x81E93E95414F356E

3 2

Is WHOIS going to go away?
by Brian Kantor 25 Apr '18

25 Apr '18

There is concern that the WHOIS database service will be in violation of the new European GDPR which takes effect May 25th, and may have to shut down. http://www.theregister.co.uk/2018/04/14/whois_icann_gdpr_europe/ https://www.icann.org/en/system/files/correspondence/jelinek-to-marby-11apr… - Brian

21 71

Can someone from instagram contact me off list?
by Payam Poursaied 25 Apr '18

25 Apr '18

1 0

Re: The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.
by Hank Nussbacher 25 Apr '18

25 Apr '18

On 24/04/2018 21:35, Fredrik Korsbäck wrote: > TLDR; So it seems that AS10297 (some small hostingprovider in the US) suddenly started to announce de-aggregated AWS > IP-space, containing quite alot of Route53 infrastructure, put up resolvers on their own on the hijacked IP-space and > pointed *ATLEAST* www.myetherwallet.com to a ip-address that seems to be some kind of transparent proxy out of russia > with a bogus SSL-cert (but still pretty good) (https://46.161.42.42/) > > I did digging in my own logs and played it through BGP-play - seems like it was in fact only Hurricane Electric (6939) > that actually propagated this prefix to the Internet. Which makes sense since we have seen them being part of the > problem in almost all recent hijacks. In addition to HE there was AS19151 -WV Fiber that accepted the /24s, but based on BGPlay (attached) it seems that the main culprit was HE that propagated it onward. -Hank

1 1

Amazon Geolocation
by Sam Norris 24 Apr '18

24 Apr '18

Hey all, Having a hard time finding someone within Amazon to understand geolocation problems. We have lots of customers that started getting the amazon prime video message about not being able to watch because of geolocation / vpn restrictions. We are a wisp. We run BGP with our own netblocks and upstream netblocks. We have at least 15 customers that have reported this problem - many of which opened tickets directly with amazon but they have no clue. My guess is its related to entire netblocks. MaxMind shows the correct info and always has. Can someone point me to a contact at Amazon that can help? Thx, Sam

4 4

Re: The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.
by Fredrik Korsbäck 24 Apr '18

24 Apr '18

Well there is quite abit of data around that particular server. So it definitely happened. https://twitter.com/GossiTheDog/status/988873775285460992 This tweet is a good start. The server answer to me right now and google safe browsing has flagged it as well for being insecure (no the regular cert-fail warning but deceptivness warning) The SSL-cert is a self-signed one impersonating MyEtherWallet.com. Id take it that 15169 accepted the prefix for some reason over a bilateral peering-sesssion (to the best of my knowledge the equinix routeservers does indeed do filter, but please correct me on this one) with 10297 and hence poisoned the 8.8.8.8 resolver for some time with the wrong ip-addr. > On Tue, Apr 24, 2018 at 08:35:17PM +0200, > Fredrik Korsbäck <hugge(a)nordu.net> wrote > a message of 28 lines which said: > >> Surprised this hasnt "made the news" over at this list yet. > > It was discussed several hours before on the Outages mailing list. > > Also, there are not a lot of hard facts. The BGP hijacking is clear > and easy to find in the usual places. > > The supposed rogue DNS server is much more elusive. Nobody apparently > thought of querying it with dig during the hijack. There are reports > of people being directed to a rogue www.myetherwallet.com but, again, > no detail, no IP address, not the certificate of the rogue server, > nothing. > >> seems to be some kind of transparent proxy out of russia with a >> bogus SSL-cert (but still pretty good) (https://46.161.42.42/) > > DNSDB does not confirm this: > > % isc-dnsdb-query rdata ip 46.161.42.42 > pigroot.sciencesupply.eu. IN A 46.161.42.42 > value.rollliquid.com. IN A 46.161.42.42 > campsprings.collaspepaw.com. IN A 46.161.42.42 > bronchopneumonic.collaspepaw.com. IN A 46.161.42.42 > server42.woodorganism.com. IN A 46.161.42.42 > ;;; Returned 5 RRs in 0.03 seconds. > ;;; DNSDB > > Currently, this machine does not accept connections. > > > > -- hugge

2 1

The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.
by Fredrik Korsbäck 24 Apr '18

24 Apr '18

Aloha. Surprised this hasnt "made the news" over at this list yet. https://doublepulsar.com/hijack-of-amazons-internet-domain-service-used-to-… https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/2teeVLJ44… https://twitter.com/barton_paul/status/988788348272734217 TLDR; So it seems that AS10297 (some small hostingprovider in the US) suddenly started to announce de-aggregated AWS IP-space, containing quite alot of Route53 infrastructure, put up resolvers on their own on the hijacked IP-space and pointed *ATLEAST* www.myetherwallet.com to a ip-address that seems to be some kind of transparent proxy out of russia with a bogus SSL-cert (but still pretty good) (https://46.161.42.42/) I did digging in my own logs and played it through BGP-play - seems like it was in fact only Hurricane Electric (6939) that actually propagated this prefix to the Internet. Which makes sense since we have seen them being part of the problem in almost all recent hijacks. Can we do some collaborative digging in other tools you have handy (i guess thousand eyes probes etc could be of help here) to track how big the propagation was? Being abit involved in the Ethereum world it could be noted that the login to MyEtherWallet.com is abit special since you actually login with you wallet-seed and not user/pass to the site... giving the possibility to make really swift transfers without having actual access to the real site (for good ....and bad). -- hugge @ 2603

4 4