- NANOG - lists.nanog.org

Re: New Active Exploit: memcached on port 11211 UDP & TCP being exploited for reflection attacks
by K. Scott Helms 02 Mar '18

02 Mar '18

They use separate service flows and layer 3 interfaces (usually) in DOCSIS networks but they often use the same DNS infrastructure which is why I piped up. Scott Helms On Mar 2, 2018 4:46 PM, "Michel 'ic' Luczak" <lists(a)benappy.com> wrote: The ones I know do so on private VLANs (or ATM circuits on DSL) so anyway unrelated to any client’s address space. Also, french triple play ISPs use RFC1918 space for IPTV but again isolated of any customer network so doesn’t really matter. > On 2 Mar 2018, at 22:18, K. Scott Helms <kscotthelms(a)gmail.com> wrote: > > I won't comment on the sanity of doing so, but _many_ service providers use > EMTAs, ATAs, and other voice devices over RFC1918 space back to their core. >

1 0

New Active Exploit: memcached on port 11211 UDP & TCP being exploited for reflection attacks
by Barry Greene 02 Mar '18

02 Mar '18

Hello Fellow NANOGer, If you have not already seen it, experiences it, or read about it, working to head off another reflection DOS vector. This time it is memcached on port 11211 UDP & TCP. There are active exploits using these ports. Reflection attacks and the memcached is not new. We know how reflection attacks work (send a spoofed packet to a device and have it reflected back (yes please deploy source address validation and BCP 38). Operators are asked to review their networks and consider updating their Exploitable Port Filters (Infrastructure ACLs) to track or block UDP/TCP port 11211 for all ingress and egress traffic. If you do not know about iACLs or Explorable port filters, you can use this white paper details and examples from peers on Exploitable Port Filters: http://www.senki.org/operators-security-toolkit/filtering-exploitable-ports… Enterprises are also asked to update their iACLs, Exploitable Port Filters, and Firewalls to track or block UDP/TCP port 11211 for all ingress and egress traffic. Deploying these filters will help protect your network, your organization, your customers, and the Internet. Ping me 1:1 if you have questions. Sincerely, -- Barry Raveendran Greene Security Geek helping with OPSEC Trust Mobile: +1 408 218 4669 E-mail: bgreene(a)senki.org ---------------------------- Resources on memcached Exploit (to evaluate your risk): More information about this attack vector can be found at the following: • JPCERT – memcached のアクセス制御に関する注意喚起 (JPCERT-AT-2018-0009) http://www.jpcert.or.jp/at/2018/at180009.html • Qrator Labs: The memcached amplification attacks reaching 500 Gbps https://medium.com/@qratorlabs/the-memcached-amplification-attack-reaching-… • Arbor Networks: memcached Reflection/Amplification Description and DDoS Attack Mitigation Recommendations https://www.arbornetworks.com/blog/asert/memcached-reflection-amplification… • Cloudflare: Memcrashed – Major amplification attacks from UDP port 11211 https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-por… • Link11: New High-Volume Vector: Memcached Reflection Amplification Attacks https://www.link11.com/en/blog/new-high-volume-vector-memcached-reflection-… • Blackhat Talk: The New Page of Injections Book: Memcached Injections by Ivan Novikov https://www.blackhat.com/docs/us-14/materials/us-14-Novikov-The-New-Page-Of… • Memcache Exploit http://niiconsulting.com/checkmate/2013/05/memcache-exploit/

29 42

dnswl.org contact
by Randy Bush 02 Mar '18

02 Mar '18

anyone have contact with the dnswl.org folk? my calendar says that it is the time of year i owe them some money, and i can not seem to pay them. randy

2 1

Weekly Routing Table Report
by cscora＠apnic.net 02 Mar '18

02 Mar '18

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG, CaribNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG, IRNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 03 Mar, 2018 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 687961 Prefixes after maximum aggregation (per Origin AS): 266895 Deaggregation factor: 2.58 Unique aggregates announced (without unneeded subnets): 331711 Total ASes present in the Internet Routing Table: 59983 Prefixes per ASN: 11.47 Origin-only ASes present in the Internet Routing Table: 51808 Origin ASes announcing only one prefix: 22740 Transit ASes present in the Internet Routing Table: 8175 Transit-only ASes present in the Internet Routing Table: 257 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 37 Max AS path prepend of ASN (262865) 25 Prefixes from unregistered ASNs in the Routing Table: 58 Number of instances of unregistered ASNs: 58 Number of 32-bit ASNs allocated by the RIRs: 21677 Number of 32-bit ASNs visible in the Routing Table: 17438 Prefixes from 32-bit ASNs in the Routing Table: 72349 Number of bogon 32-bit ASNs visible in the Routing Table: 10 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 326 Number of addresses announced to Internet: 2855228258 Equivalent to 170 /8s, 47 /16s and 83 /24s Percentage of available address space announced: 77.1 Percentage of allocated address space announced: 77.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.8 Total number of prefixes smaller than registry allocations: 228105 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 189669 Total APNIC prefixes after maximum aggregation: 54076 APNIC Deaggregation factor: 3.51 Prefixes being announced from the APNIC address blocks: 188647 Unique aggregates announced from the APNIC address blocks: 77563 APNIC Region origin ASes present in the Internet Routing Table: 8675 APNIC Prefixes per ASN: 21.75 APNIC Region origin ASes announcing only one prefix: 2459 APNIC Region transit ASes present in the Internet Routing Table: 1284 Average APNIC Region AS path length visible: 4.3 Max APNIC Region AS path length visible: 27 Number of APNIC region 32-bit ASNs visible in the Routing Table: 3589 Number of APNIC addresses announced to Internet: 768016418 Equivalent to 45 /8s, 199 /16s and 0 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 205098 Total ARIN prefixes after maximum aggregation: 98253 ARIN Deaggregation factor: 2.09 Prefixes being announced from the ARIN address blocks: 205932 Unique aggregates announced from the ARIN address blocks: 97158 ARIN Region origin ASes present in the Internet Routing Table: 18084 ARIN Prefixes per ASN: 11.39 ARIN Region origin ASes announcing only one prefix: 6690 ARIN Region transit ASes present in the Internet Routing Table: 1797 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2314 Number of ARIN addresses announced to Internet: 1104806432 Equivalent to 65 /8s, 218 /16s and 2 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 186339 Total RIPE prefixes after maximum aggregation: 90949 RIPE Deaggregation factor: 2.05 Prefixes being announced from the RIPE address blocks: 182630 Unique aggregates announced from the RIPE address blocks: 109299 RIPE Region origin ASes present in the Internet Routing Table: 24943 RIPE Prefixes per ASN: 7.32 RIPE Region origin ASes announcing only one prefix: 11325 RIPE Region transit ASes present in the Internet Routing Table: 3499 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 28 Number of RIPE region 32-bit ASNs visible in the Routing Table: 6729 Number of RIPE addresses announced to Internet: 714026880 Equivalent to 42 /8s, 143 /16s and 47 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 88435 Total LACNIC prefixes after maximum aggregation: 19571 LACNIC Deaggregation factor: 4.52 Prefixes being announced from the LACNIC address blocks: 89797 Unique aggregates announced from the LACNIC address blocks: 40020 LACNIC Region origin ASes present in the Internet Routing Table: 6880 LACNIC Prefixes per ASN: 13.05 LACNIC Region origin ASes announcing only one prefix: 1899 LACNIC Region transit ASes present in the Internet Routing Table: 1262 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 37 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 4413 Number of LACNIC addresses announced to Internet: 172137888 Equivalent to 10 /8s, 66 /16s and 157 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 18360 Total AfriNIC prefixes after maximum aggregation: 4000 AfriNIC Deaggregation factor: 4.59 Prefixes being announced from the AfriNIC address blocks: 20629 Unique aggregates announced from the AfriNIC address blocks: 7410 AfriNIC Region origin ASes present in the Internet Routing Table: 1119 AfriNIC Prefixes per ASN: 18.44 AfriNIC Region origin ASes announcing only one prefix: 366 AfriNIC Region transit ASes present in the Internet Routing Table: 229 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 21 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 393 Number of AfriNIC addresses announced to Internet: 95837440 Equivalent to 5 /8s, 182 /16s and 93 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5442 4195 92 ERX-CERNET-BKB China Education and Rese 7545 4057 408 415 TPG-INTERNET-AP TPG Telecom Limited, AU 4766 2858 11132 774 KIXS-AS-KR Korea Telecom, KR 9829 2802 1499 540 BSNL-NIB National Internet Backbone, IN 17974 2710 934 80 TELKOMNET-AS2-AP PT Telekomunikasi Indo 7552 2638 1161 59 VIETEL-AS-AP Viettel Group, VN 9394 2630 4923 29 CTTNET China TieTong Telecommunications 45899 2561 1561 160 VNPT-AS-VN VNPT Corp, VN 9808 2180 8699 32 CMNET-GD Guangdong Mobile Communication 4755 2083 417 215 TATACOMM-AS TATA Communications formerl Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6327 3383 1323 84 SHAW - Shaw Communications Inc., CA 22773 3276 2988 149 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2167 405 108 MEGAPATH5-US - MegaPath Corporation, US 20115 2095 2483 435 CHARTER-NET-HKY-NC - Charter Communicat 16509 2027 4371 603 AMAZON-02 - Amazon.com, Inc., US 30036 1928 338 196 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1927 5055 619 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6389 1841 3671 36 BELLSOUTH-NET-BLK - BellSouth.net Inc., 11492 1740 227 574 CABLEONE - CABLE ONE, INC., US 7018 1684 20187 1249 ATT-INTERNET4 - AT&T Services, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3520 187 21 ALJAWWALSTC-AS, SA 12479 3058 1316 804 UNI2-AS, ES 20940 2855 846 2071 AKAMAI-ASN1, US 8551 2066 378 43 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2037 1864 704 ROSTELECOM-AS, RU 34984 1992 332 474 TELLCOM-AS, TR 9121 1922 1692 19 TTNET, TR 13188 1606 100 46 TRIOLAN, UA 6849 1241 355 21 UKRTELNET, UA 8402 1215 544 14 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 4161 3388 587 Uninet S.A. de C.V., MX 10620 3594 541 253 Telmex Colombia S.A., CO 11830 2639 370 66 Instituto Costarricense de Electricidad 6503 1625 437 53 Axtel, S.A.B. de C.V., MX 7303 1507 1026 191 Telecom Argentina S.A., AR 28573 1021 2246 189 CLARO S.A., BR 6147 1010 377 27 Telefonica del Peru S.A.A., PE 3816 1007 506 120 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 923 126 85 Alestra, S. de R.L. de C.V., MX 18881 907 1072 29 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1162 398 49 LINKdotNET-AS, EG 37611 809 91 8 Afrihost, ZA 36903 739 371 135 MT-MPLS, MA 36992 681 1380 38 ETISALAT-MISR, EG 8452 615 1730 18 TE-AS TE-AS, EG 24835 557 850 15 RAYA-AS, EG 29571 466 68 12 ORANGE-COTE-IVOIRE, CI 37492 453 376 80 ORANGE-, TN 15399 361 35 7 WANANCHI-, KE 37342 360 32 1 MOVITEL, MZ Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5442 4195 92 ERX-CERNET-BKB China Education and Rese 8151 4161 3388 587 Uninet S.A. de C.V., MX 7545 4057 408 415 TPG-INTERNET-AP TPG Telecom Limited, AU 10620 3594 541 253 Telmex Colombia S.A., CO 39891 3520 187 21 ALJAWWALSTC-AS, SA 6327 3383 1323 84 SHAW - Shaw Communications Inc., CA 22773 3276 2988 149 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 12479 3058 1316 804 UNI2-AS, ES 4766 2858 11132 774 KIXS-AS-KR Korea Telecom, KR 20940 2855 846 2071 AKAMAI-ASN1, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 7545 4057 3642 TPG-INTERNET-AP TPG Telecom Limited, AU 8151 4161 3574 Uninet S.A. de C.V., MX 39891 3520 3499 ALJAWWALSTC-AS, SA 10620 3594 3341 Telmex Colombia S.A., CO 6327 3383 3299 SHAW - Shaw Communications Inc., CA 22773 3276 3127 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 17974 2710 2630 TELKOMNET-AS2-AP PT Telekomunikasi Indonesia, I 9394 2630 2601 CTTNET China TieTong Telecommunications Corpora 7552 2638 2579 VIETEL-AS-AP Viettel Group, VN 11830 2639 2573 Instituto Costarricense de Electricidad y Telec Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65456 PRIVATE 31.171.126.0/23 199311 AZRT-LX Local Internet Exchang 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 64513 PRIVATE 62.150.101.0/24 9155 QNET Kuwait, KW 419333 UNALLOCATED 84.17.91.0/24 41933 IPRAGAZ-AS Istanbul/ TURKEY, T 65024 PRIVATE 87.103.234.0/24 39407 CHITATELECOM-AS, RU 65000 PRIVATE 95.179.2.0/24 65001 -Private Use AS-, ZZ 65000 PRIVATE 95.179.3.0/24 65001 -Private Use AS-, ZZ 65000 PRIVATE 95.179.69.0/24 65001 -Private Use AS-, ZZ 65000 PRIVATE 95.179.70.0/24 65001 -Private Use AS-, ZZ 65000 PRIVATE 95.179.92.0/24 65001 -Private Use AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 100.66.224.0/19 209 CENTURYLINK-US-LEGACY-QWEST - Qwest Communicati Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.128.14.0/23 10247 NETLINE, ZA 14.192.50.0/23 10247 NETLINE, ZA 14.192.58.0/23 10247 NETLINE, ZA 27.100.7.0/24 56096 UNKNOWN 36.255.250.0/23 10247 NETLINE, ZA 37.44.224.0/20 48666 AS-MAROSNET Moscow, Russia, RU 41.78.180.0/23 37265 -Reserved AS-, ZZ 43.228.144.0/22 9829 BSNL-NIB National Internet Backbone, IN 43.251.20.0/22 9381 WTT-AS-AP WTT HK Limited, HK 43.251.84.0/22 133676 PNPL-AS Precious netcom pvt ltd, IN Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:14 /9:11 /10:37 /11:100 /12:289 /13:563 /14:1094 /15:1896 /16:13317 /17:7834 /18:13616 /19:25232 /20:39103 /21:45091 /22:84770 /23:68868 /24:383905 /25:839 /26:597 /27:652 /28:35 /29:19 /30:17 /31:4 /32:58 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3175 3383 SHAW - Shaw Communications Inc., CA 39891 2946 3520 ALJAWWALSTC-AS, SA 22773 2532 3276 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 18566 2061 2167 MEGAPATH5-US - MegaPath Corporation, US 11830 1986 2639 Instituto Costarricense de Electricidad y Telec 12479 1890 3058 UNI2-AS, ES 30036 1683 1928 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 10620 1594 3594 Telmex Colombia S.A., CO 8551 1529 2066 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 11492 1522 1740 CABLEONE - CABLE ONE, INC., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1569 2:831 4:19 5:2798 6:59 7:1 8:1100 9:1 12:1872 13:206 14:1755 15:26 16:3 17:187 18:69 20:48 21:3 23:2549 24:2175 25:2 27:2346 31:1950 32:88 35:25 36:497 37:2648 38:1463 39:247 40:103 41:3005 42:545 43:1951 44:100 45:3785 46:3029 47:198 49:1357 50:1043 51:48 52:978 54:353 55:3 56:8 57:42 58:1595 59:1023 60:427 61:2135 62:1800 63:1802 64:4694 65:2225 66:4542 67:2340 68:1169 69:3195 70:1193 71:557 72:2100 74:2670 75:401 76:424 77:1535 78:1669 79:1809 80:1486 81:1418 82:1080 83:778 84:1016 85:2035 86:559 87:1260 88:915 89:2299 90:190 91:6304 92:1186 93:2373 94:2403 95:2734 96:651 97:356 98:928 99:124 100:80 101:1474 102:28 103:17266 104:3274 105:221 106:563 107:1795 108:708 109:2691 110:1588 111:1775 112:1316 113:1379 114:1111 115:1650 116:1646 117:1707 118:2186 119:1674 120:967 121:1072 122:2458 123:1815 124:1460 125:1877 128:975 129:613 130:444 131:1602 132:647 133:194 134:999 135:225 136:440 137:491 138:1950 139:573 140:402 141:686 142:783 143:972 144:799 145:456 146:1159 147:745 148:1535 149:709 150:744 151:1046 152:750 153:308 154:1035 155:753 156:843 157:778 158:623 159:1629 160:869 161:730 162:2550 163:527 164:1025 165:1379 166:397 167:1386 168:3091 169:807 170:3689 171:416 172:1059 173:1925 174:879 175:755 176:1919 177:3927 178:2420 179:1176 180:2237 181:2138 182:2462 183:1132 184:910 185:12725 186:3482 187:2319 188:2702 189:1974 190:8118 191:1450 192:9768 193:5889 194:4774 195:3968 196:2439 197:1428 198:5520 199:5887 200:7311 201:4876 202:10391 203:10083 204:4535 205:2855 206:3062 207:3123 208:3988 209:3932 210:4038 211:2119 212:3010 213:2665 214:903 215:63 216:5852 217:2131 218:899 219:621 220:1735 221:996 222:1053 223:1242 End of report

1 0

RE: Comcast NOC Contact
by Robert Webb 02 Mar '18

02 Mar '18

Thanks to all off list replies. Comcast rep was able to help out getting info over to the NOC. -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Robert Webb Sent: Friday, March 2, 2018 10:53 AM To: nanog(a)nanog.org Subject: Comcast NOC Contact I know Virginia is having wind issues today. But can anyone from Comcast comment on intermittent routing issues between Charlottesville, VA and Ashburn, VA on their backbone? Issue appears to be between 69.139.206.9 ae-45-ar02.charlvilleco.va.ibone.comcast.net and 68.86.91.53 be-21508-cr02.ashburn.va.ibone.comcast.net Off list is fine.

1 0

Re: New Active Exploit: memcached on port 11211 UDP & TCP being exploited for reflection attacks
by Stephen Satchell 02 Mar '18

02 Mar '18

Testing on a recently-load VM of CentOS 7.3: [root@localhost odd]# netstat -tan | grep 11211 [root@localhost odd]# netstat -uan | grep 11211 [root@localhost odd]# yum install memcached [root@localhost odd]# systemctl start memcached.service [root@localhost odd]# netstat -tan | grep 11211 tcp 0 0 0.0.0.0:11211 0.0.0.0:* LISTEN tcp6 0 0 :::11211 :::* LISTEN [root@localhost odd]# netstat -uan | grep 11211 udp 0 0 0.0.0.0:11211 0.0.0.0:* udp6 0 0 :::11211 :::* Since CentOS is supposed to be a near bit-by-bit copy of Red Hat Enterprise, this shows that when one loads memcached without modifying the configuration, plus expose 11211/udp to the world, one is now part of the problem. It also suggests that other near-clones of RHEL may also exhibit the problem. So I pulled the memcached repository from GitHub, and looked through the commits. NOTHING about updates to prevent DDoS. So I started looking around for the config file in the maintainer GIT project. Here is what I found: > # These defaults will be used by every memcached instance, unless overridden > # by values in /etc/sysconfig/memcached.<port> > USER="nobody" > MAXCONN="1024" > CACHESIZE="64" > OPTIONS="" > > # The PORT variable will only be used by memcached.service, not by > # memcached@xxxxx services, which will use the xxxxx > PORT="11211" Here is what CentOS has: > PORT="11211" > USER="memcached" > MAXCONN="1024" > CACHESIZE="64" > OPTIONS="" What's missing from both of these system configuration files? OPTIONS="-U 0" From the memcached man page: > -U <num> > Listen on UDP port <num>, the default is port 11211, 0 is off. So this answers the question about how anyone loading memcached fresh from a distribution can be a major player in the DDoS game. Now, in a lame defense of Red Hat, when one turns on the firewalld daemon, that daemon implements a mostly-closed access policy. "memcached" is not listed in the named services. Furthermore, looking at the output of 'iptables -vnL' I saw no way that a 11211/udp packet would make its way through the firewall. The policy of "defense in depth" would argue that setting the default to disable 11211/udp is still the right thing(r) to do.

1 0

Comcast NOC Contact
by Robert Webb 02 Mar '18

02 Mar '18

I know Virginia is having wind issues today. But can anyone from Comcast comment on intermittent routing issues between Charlottesville, VA and Ashburn, VA on their backbone? Issue appears to be between 69.139.206.9 ae-45-ar02.charlvilleco.va.ibone.comcast.net and 68.86.91.53 be-21508-cr02.ashburn.va.ibone.comcast.net Off list is fine.

1 0

[NANOG-announce] Program Committee appointments
by Ryan Donnelly 01 Mar '18

01 Mar '18

*Greetings, fellow NANOG enthusiasts,I’m pleased to announce that the board has appointed 11 individuals to the Program Committee. As always, making these appointments is an exercise in difficult choices; and these appointments were made especially challenging by this cycle’s 18 highly-qualified applicants.We are, at our core, a volunteer organization. It is through the interest and commitment of volunteers like these that we are able to deliver the exceptional program quality expected by our members, attendees and sponsors. We’d like to thank each of the 18 individuals that applied, and for those not selected, we would be delighted to entertain your candidacy during the next appointment cycle.The 11 members appointed to the Program Committee are:Vincent Celindro, Michaela Clifford, Michael Costello, Philippe Couture, Tom Kacprzynski, Ognian Mitev, Chris Pennisi, Steven Schechter, Benson Schliesser, Edward Winstead, Chris WoodfieldPlease join me in congratulating them.We’d also like to thank and recognize the contributions of Kevin Blumberg, Anna Claiborne, Allison Feese-Strickland, Steve Plote, Dani Roisman, Michael K. Smith, and Jesse Sowell for their service on the Program Committee.In the coming weeks, the new Program Committee will hold its first meeting and select a chair and a vice chair.I know I speak for the rest of the board when I say that we can’t wait to experience the output of our new PC in Denver for NANOG 73.See you in June!Best Regards,--ryan(for the NANOG Board of Directors)* _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Removing the four stale TAL from the APNIC RPKI validation set.
by George Michaelson 01 Mar '18

01 Mar '18

Updating RPKI trust anchor configuration ------------------------------------------------------- APNIC has completed the process of transitioning from its previous Resource Public Key Infrastructure (RPKI) trust anchor arrangement to a new single trust anchor configuration. Each RIR will publish an 'all resources' global trust anchor, under which its own regional resources (IP addresses and ASNs) will be certified. APNICs trust anchor is one of the previous five, which has been retained as the sole trust anchor over all APNIC resource certificate products. If you are using relying-party software, such as the Dragon Research Labs RPKI Toolkit, RPSTIR or the RIPE NCC’s RPKI Validator, you are advised to update your software’s configuration to use only the current APNIC trust anchor, rather than the set of five APNIC trust anchors that were previously in use. The update is to remove four of the five: One has been retained as the current live Trust Anchor. Note: this update is not critical. However, if it is not done, the software will log or report warnings about being unable to retrieve the trust anchors that are no longer being used. All resources now validate under the single active trust anchor and no orphan products are valid under the other prior trust anchors. The current APNIC TAL is as follows: ------ rsync://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9RWSL61YAAYumEiU8z8 qH2ETVIL01ilxZlzIL9JYSORMN5Cmtf8V2JblIealSqgOTGjvSjEsiV73s67zYQI 7C/iSOb96uf3/s86NqbxDiFQGN8qG7RNcdgVuUlAidl8WxvLNI8VhqbAB5uSg/Mr LeSOvXRja041VptAxIhcGzDMvlAJRwkrYK/Mo8P4E2rSQgwqCgae0ebY1CsJ3Cjf i67C1nw7oXqJJovvXJ4apGmEv8az23OLC6Ki54Ul/E6xk227BFttqFV3YMtKx42H cCcDVZZy01n7JjzvO8ccaXmHIgR7utnqhBRNNq5Xc5ZhbkrUsNtiJmrZzVlgU6Ou 0wIDAQAB ------ Configuring Relying Party Software ----------------------------------------------- RIPE NCC RPKI Validator: If you upgrade to RIPE validator rpki-validator-app-2.24 the correct Trust Anchor is configured. No further work is required. Dragon Research Labs Rcynic Validator: If you run rcynic, you need to remove all the TAL, TA or CER entries in rcynic.conf except ones which point to apnic-rpki-root-iana-origin.cer or the related TAL. If you use the trusted-certs/ directory, simply remove the four files which are named for the non-APNIC RIR as follows: cd /etc/trust-anchors # or wherever you place the TAL files rm apnic-rpki-root-ripe-origin.tal rm apnic-rpki-root-arin-origin.tal rm apnic-rpki-root-lacnic-origin.tal rm apnic-rpki-root-afrinic-origin.tal RPSTIR To modify an installed RPSTIR system, locate the /usr/local/etc/rpstir directory and remove all but the current live APNIC TAL. More information is in the attached PDF describing how to update the trust anchor configuration in these three popular relying-partner software systems. -George

2 1

ALTDB maintainer creation
by Jacob Slater 28 Feb '18

28 Feb '18

Hello all, Any chance anyone has a contact for any of the ALTDB admins? I put in a maintainer creation request several months ago and haven't heard back. Working with an upstream who will only take ALTDB or LOAs and would like to avoid having to due LOAs in the future. Thanks all, Jacob Slater

1 0