- NANOG - lists.nanog.org

Avalanche botnet takedown
by John Levine 02 Dec '16

02 Dec '16

Avalanche is a large nasty botnet, which was just disabled by a large coordinated action by industry and law enforcement in multiple countries. It was a lot of work, involving among other things disabling or sinkholing 800,000 domain names used to control it. More info here: https://www.europol.europa.eu/newsroom/news/%E2%80%98avalanche%E2%80%99-net… http://blog.shadowserver.org/2016/12/01/avalanche/ As both items point out, if your users are infected with Avalance, they're still infected, but now if you disinfect them, they won't get reinfected. At least not with that particular flavor of malware. R's, John

11 13

Weekly Routing Table Report
by cscora＠apnic.net 02 Dec '16

02 Dec '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 03 Dec, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 623873 Prefixes after maximum aggregation (per Origin AS): 221154 Deaggregation factor: 2.82 Unique aggregates announced (without unneeded subnets): 303044 Total ASes present in the Internet Routing Table: 55364 Prefixes per ASN: 11.27 Origin-only ASes present in the Internet Routing Table: 36335 Origin ASes announcing only one prefix: 15281 Transit ASes present in the Internet Routing Table: 6530 Transit-only ASes present in the Internet Routing Table: 168 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 40 Max AS path prepend of ASN ( 55644) 36 Prefixes from unregistered ASNs in the Routing Table: 59 Unregistered ASNs in the Routing Table: 15 Number of 32-bit ASNs allocated by the RIRs: 16391 Number of 32-bit ASNs visible in the Routing Table: 12499 Prefixes from 32-bit ASNs in the Routing Table: 50896 Number of bogon 32-bit ASNs visible in the Routing Table: 507 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 409 Number of addresses announced to Internet: 2833731044 Equivalent to 168 /8s, 231 /16s and 77 /24s Percentage of available address space announced: 76.5 Percentage of allocated address space announced: 76.5 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.3 Total number of prefixes smaller than registry allocations: 206138 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 156912 Total APNIC prefixes after maximum aggregation: 43068 APNIC Deaggregation factor: 3.64 Prefixes being announced from the APNIC address blocks: 171108 Unique aggregates announced from the APNIC address blocks: 70433 APNIC Region origin ASes present in the Internet Routing Table: 5191 APNIC Prefixes per ASN: 32.96 APNIC Region origin ASes announcing only one prefix: 1150 APNIC Region transit ASes present in the Internet Routing Table: 938 Average APNIC Region AS path length visible: 4.3 Max APNIC Region AS path length visible: 40 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2523 Number of APNIC addresses announced to Internet: 760055428 Equivalent to 45 /8s, 77 /16s and 134 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 188330 Total ARIN prefixes after maximum aggregation: 89429 ARIN Deaggregation factor: 2.11 Prefixes being announced from the ARIN address blocks: 194748 Unique aggregates announced from the ARIN address blocks: 89435 ARIN Region origin ASes present in the Internet Routing Table: 16118 ARIN Prefixes per ASN: 12.08 ARIN Region origin ASes announcing only one prefix: 5621 ARIN Region transit ASes present in the Internet Routing Table: 1704 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1618 Number of ARIN addresses announced to Internet: 1106558880 Equivalent to 65 /8s, 244 /16s and 191 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 149276 Total RIPE prefixes after maximum aggregation: 72731 RIPE Deaggregation factor: 2.05 Prefixes being announced from the RIPE address blocks: 160495 Unique aggregates announced from the RIPE address blocks: 98387 RIPE Region origin ASes present in the Internet Routing Table: 18161 RIPE Prefixes per ASN: 8.84 RIPE Region origin ASes announcing only one prefix: 7785 RIPE Region transit ASes present in the Internet Routing Table: 3047 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 28 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5098 Number of RIPE addresses announced to Internet: 709672576 Equivalent to 42 /8s, 76 /16s and 190 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 63222 Total LACNIC prefixes after maximum aggregation: 12666 LACNIC Deaggregation factor: 4.99 Prefixes being announced from the LACNIC address blocks: 79653 Unique aggregates announced from the LACNIC address blocks: 37858 LACNIC Region origin ASes present in the Internet Routing Table: 2484 LACNIC Prefixes per ASN: 32.07 LACNIC Region origin ASes announcing only one prefix: 551 LACNIC Region transit ASes present in the Internet Routing Table: 593 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 30 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2981 Number of LACNIC addresses announced to Internet: 170921024 Equivalent to 10 /8s, 48 /16s and 12 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 15177 Total AfriNIC prefixes after maximum aggregation: 3252 AfriNIC Deaggregation factor: 4.67 Prefixes being announced from the AfriNIC address blocks: 17460 Unique aggregates announced from the AfriNIC address blocks: 6564 AfriNIC Region origin ASes present in the Internet Routing Table: 737 AfriNIC Prefixes per ASN: 23.69 AfriNIC Region origin ASes announcing only one prefix: 174 AfriNIC Region transit ASes present in the Internet Routing Table: 179 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 279 Number of AfriNIC addresses announced to Internet: 86055424 Equivalent to 5 /8s, 33 /16s and 26 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5550 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3645 390 252 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2980 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9829 2713 1500 539 BSNL-NIB National Internet Backbone, IN 4766 2699 11132 742 KIXS-AS-KR Korea Telecom, KR 9808 2234 8698 33 CMNET-GD Guangdong Mobile Communication 4755 2045 428 218 TATACOMM-AS TATA Communications formerl 45899 1740 1260 90 VNPT-AS-VN VNPT Corp, VN 4808 1652 2166 472 CHINA169-BJ China Unicom Beijing Provin 24560 1566 542 228 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3577 2968 151 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3259 1333 82 SHAW - Shaw Communications Inc., CA 18566 2196 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 1954 2014 405 CHARTER-NET-HKY-NC - Charter Communicat 30036 1779 335 340 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1740 5069 652 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1678 848 227 ITCDELTA - Earthlink, Inc., US 701 1602 10634 657 UUNET - MCI Communications Services, In 16509 1502 2818 510 AMAZON-02 - Amazon.com, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3141 163 17 ALJAWWALSTC-AS , SA 20940 2953 1117 2097 AKAMAI-ASN1 , US 9121 2043 1691 18 TTNET , TR 34984 1991 328 365 TELLCOM-AS , TR 13188 1605 99 58 TRIOLAN , UA 12479 1392 1032 53 UNI2-AS , ES 8551 1201 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 6849 1199 355 22 UKRTELNET , UA 8402 1132 544 15 CORBINA-AS OJSC "Vimpelcom", RU 12389 958 1136 427 ROSTELECOM-AS , RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3529 544 163 Telmex Colombia S.A., CO 8151 2286 3370 551 Uninet S.A. de C.V., MX 6503 1540 437 54 Axtel, S.A.B. de C.V., MX 7303 1517 964 246 Telecom Argentina S.A., AR 11830 1421 368 66 Instituto Costarricense de Electricidad 6147 1286 377 27 Telefonica del Peru S.A.A., PE 28573 1037 2269 171 CLARO S.A., BR 3816 987 476 185 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 911 126 80 Alestra, S. de R.L. de C.V., MX 18881 873 1036 22 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1219 402 42 LINKdotNET-AS, EG 36903 692 348 117 MT-MPLS, MA 37611 683 67 6 Afrihost, ZA 36992 575 1373 25 ETISALAT-MISR, EG 8452 471 1472 15 TE-AS TE-AS, EG 24835 419 658 16 RAYA-AS, EG 37492 396 288 72 ORANGE-TN, TN 29571 364 37 11 CITelecom-AS, CI 15399 312 35 6 WANANCHI-KE, KE 36974 275 140 11 AFNET-AS, CI Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5550 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3645 390 252 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3577 2968 151 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3529 544 163 Telmex Colombia S.A., CO 6327 3259 1333 82 SHAW - Shaw Communications Inc., CA 39891 3141 163 17 ALJAWWALSTC-AS , SA 17974 2980 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2953 1117 2097 AKAMAI-ASN1 , US 9829 2713 1500 539 BSNL-NIB National Internet Backbone, IN 4766 2699 11132 742 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3577 3426 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 7545 3645 3393 TPG-INTERNET-AP TPG Telecom Limited, AU 10620 3529 3366 Telmex Colombia S.A., CO 6327 3259 3177 SHAW - Shaw Communications Inc., CA 39891 3141 3124 ALJAWWALSTC-AS , SA 17974 2980 2909 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2234 2201 CMNET-GD Guangdong Mobile Communication 9829 2713 2174 BSNL-NIB National Internet Backbone, IN 18566 2196 2087 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 2056 BELLSOUTH-NET-BLK - BellSouth.net Inc., Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 64855 PRIVATE 41.220.200.0/21 36945 mcelISP, MZ 65001 PRIVATE 46.237.32.0/20 13118 ASN-YARTELECOM PJSC Rostelecom Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.128.12.0/22 55763 UNKNOWN 14.128.12.0/24 55763 UNKNOWN 14.128.13.0/24 55763 UNKNOWN 14.128.15.0/24 55763 UNKNOWN 27.100.7.0/24 56096 UNKNOWN 27.110.192.0/22 45664 UNKNOWN 27.110.196.0/22 45664 UNKNOWN 27.110.200.0/22 45664 UNKNOWN 27.110.204.0/22 45664 UNKNOWN 27.110.224.0/22 45664 UNKNOWN Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:102 /12:274 /13:523 /14:1048 /15:1786 /16:13156 /17:7814 /18:13036 /19:25275 /20:38169 /21:40591 /22:72581 /23:60642 /24:347386 /25:523 /26:411 /27:325 /28:69 /29:40 /30:22 /31:1 /32:34 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3055 3259 SHAW - Shaw Communications Inc., CA 39891 2896 3141 ALJAWWALSTC-AS , SA 22773 2784 3577 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2089 2196 MEGAPATH5-US - MegaPath Corporation, US 30036 1594 1779 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 10620 1444 3529 Telmex Colombia S.A., CO 9121 1426 2043 TTNET , TR 6389 1393 2095 BELLSOUTH-NET-BLK - BellSouth.net Inc., 13188 1350 1605 TRIOLAN , UA 6983 1323 1678 ITCDELTA - Earthlink, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1581 2:815 4:24 5:2346 6:32 8:1011 12:1809 13:54 14:1775 15:23 16:2 17:102 18:130 19:1 20:49 23:1940 24:1818 27:2367 31:1812 32:83 33:11 35:3 36:360 37:2429 38:1306 39:42 40:99 41:2965 42:446 43:1926 44:51 45:2231 46:2531 47:108 49:1192 50:946 51:14 52:596 54:354 55:8 56:4 57:40 58:1562 59:979 60:379 61:1842 62:1487 63:1935 64:4558 65:2168 66:4370 67:2255 68:1155 69:3293 70:1296 71:561 72:2072 74:2588 75:400 76:414 77:1432 78:1548 79:916 80:1358 81:1409 82:1018 83:708 84:865 85:1700 86:481 87:1125 88:751 89:2037 90:201 91:6088 92:931 93:2350 94:2432 95:2687 96:575 97:356 98:939 99:94 100:148 101:1189 103:12895 104:2579 105:140 106:468 107:1489 108:783 109:2486 110:1280 111:1659 112:1151 113:1155 114:1054 115:1697 116:1682 117:1570 118:2106 119:1578 120:982 121:1098 122:2288 123:2033 124:1600 125:1847 128:679 129:473 130:430 131:1395 132:616 133:177 134:523 135:208 136:403 137:394 138:1806 139:437 140:621 141:475 142:715 143:927 144:736 145:171 146:951 147:599 148:1391 149:551 150:680 151:840 152:693 153:310 154:691 155:947 156:542 157:571 158:435 159:1323 160:558 161:719 162:2450 163:545 164:788 165:1126 166:356 167:1215 168:2358 169:685 170:2391 171:262 172:829 173:1830 174:764 175:711 176:1751 177:4112 178:2385 179:1145 180:2185 181:1971 182:2128 183:1013 184:842 185:8113 186:3224 187:2232 188:2323 189:1786 190:7951 191:1315 192:9164 193:5739 194:4548 195:3841 196:1879 197:1250 198:5590 199:5828 200:7192 201:3730 202:10183 203:9823 204:4482 205:2756 206:3004 207:3139 208:4055 209:3889 210:3891 211:2064 212:2739 213:2440 214:856 215:66 216:5741 217:1981 218:819 219:599 220:1653 221:883 222:716 223:1365 End of report

1 0

Anyone have contact info for NOC of PlayStation Network?
by Edmond M 02 Dec '16

02 Dec '16

Hello, I'm getting a lot of auto abuse notices stemming from 'account takeover attempts' via 443 and would like to resolve it with someone directly there. All I have is snei-noc-abuse(a)am.sony.com and not getting any response. Thanks in advance

1 0

Extreme Networks Technical Contact
by Allan Liska 02 Dec '16

02 Dec '16

Sorry to bother the whole list, but I am looking for help with a mail issue from someone at Extreme Networks, if you work there would you mind reaching out to me off-list? Thanks! allan

1 0

Looking for some Quagga experience to discuss 32 bit ASN + community issue with
by Eric Germann 02 Dec '16

02 Dec '16

Good evening, I’m looking for someone who’s familiar with Quagga and is using 32 bit ASN’s. Trying to do some work with communities with it and having no success. If you have some experience and would like to chat, email me off list or reply on-list if the demand is there. Basically trying to advertise 4 byte ASN’s + communities, and then pick them off elsewhere in a private network. Can’t get the config right for the route map to import them on the “receiving” side. Help much appreciated. Thanks EKG

3 4

OT - Looking for a EU based equipment vendor
by Chris Boyd 02 Dec '16

02 Dec '16

Sorry for the noise, but I need to find a company similar to ServerMonkey.com or Teksavers.com that’s based in France or Switzerland. My google-fu seems to be weak on this. Thanks! —Chris

1 0

ATT Wireless
by Mark Stevens 02 Dec '16

02 Dec '16

Good Morning, If anyone from ATT wireless that is on this list, it would be appreciated if you could contact me offline concerning OCN routing problems with your network. Thanks Mark Stevens

1 0

Re: Death of the Internet, Film at 11
by Ronald F. Guilmette 02 Dec '16

02 Dec '16

Laszlo Hanyecz wrote: >What does BCP38 have to do with this? Your're right. That's not specifically related to *this* attack. Nobody needs to spoof anything when you've got a zillion fire hoses just lying around where any 13 year old can command them from the TRS 80 in his mom's basement. (I've seen different estimates today. One said there's about a half million of these things, but I think I saw where Dyn itself put the number of unique IPs in the attack at something like ten million.) I just threw out BCP 38 as an example of something *very* minimal that the collective Internet, if it had any brains, would have made de rigueur for everyone ten+ years ago. BCP 38 is something that I personally view as a "no brainer", that is already widely accepted as being necessary, and yet is a critical security step that some (many?) are still resisting. So, it's like "Well, if the Internet-at-large can't even do *this* simple and relatively non-controversial thing, then we haven't got a prayer in hell of ever seeing a world-wide determined push to find and neutralize all of these bloody damn stupid CCTV things. And when the day comes when somebody figures out how to remotely pop a default config Windoze XP box... boy oh boy, will *that* be a fun day... NOT! Because we're not ready. Nobody's ready. Except maybe DoD, and I'm not even taking bets on that one." I didn't intend to focus on BCP 38. Everybody knows that's only one thing, designed to deal with just one part of the overall problem. The overall problem, in my view, is the whole mindset which says "Oh, we just connect the wires. Everything else is somebody else's problem." Ok, so this mailing list is a list of network operators. Swell. Every network operator who can do so, please raise your hand if you have *recently* scanned you own network and if you can -honestly- attest that you have taken all necessary steps to insure that none of the numerous specific types of CCVT thingies that Krebs and others identified weeks or months ago as being fundamentally insecure can emit a single packet out onto the public Internet. And, cue the crickets... Recent events, like the Krebs DDoS and the even bigger OVH DDoS, and today's events make it perfectly clear to even the most blithering of blithering idiots that network operators, en mass, have to start scanning their own networks for insecurities. And you'd all better get on that, not next fiscal year or even next quarter, but right effing now, because the next major event is right around the corner. And remember, *you* may not be scanning your networks for easily pop'able boxes, but as we should all be crystal clear on by now, that *does not* mean that nobody else is doing so. Regards, rfg P.S. The old saying is that idle hands are the devil's playground. In the context of the various post-invasion insurgancies, etc., in Iraq, is is often mentioned that it was a somewhat less than a brilliant move for the U.S. to have disbanded the Iraq army, thereby leaving large numbers of trained young men on the streets with no jobs and nothing to do. To all of the network operators who think that (or argue that) it will be too expensive to hire professionals to come in an do the work to scan your networks for known vulnerabilities, I have a simple suggestion. Go down to your local high school, find the schmuck who teaches the kids about computers, and ask him for the name of his most clever student. Then hire that student and put him to work, scanning your network. As in Iraq, it will be *much* better to have capable young men inside the tent, pissing out, rather than the other way around.

55 165

Re: Avalanche botnet takedown
by Scott Weeks 01 Dec '16

01 Dec '16

--- rfg(a)tristatelogic.com wrote: From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> The Internet, viewed as an organism, quite clearly has, at present, numerous autoimmune diseases. It is attacking itself. And its immune system, such as it is, clearly ain't working. There's going to come a day of reckoning when it will no longer be possible to paper over this sad and self-evident fact. (And no, I'm *not* talking about the fabled "Digital Pearl Harbor". I'm talking instead about the Internet equivalent of the meteor that wiped out the dinosaurs.) --------------------------------------------------- What is your suggestion to keep the sky from falling? scott

3 2

10G switch drops traffic for a split second
by TJ Trout 01 Dec '16

01 Dec '16

I recently upgraded my core network from 1G to 10G and after the upgrade I have noticed that my 10G switch during peak traffic (1500mbps, 100,000pps) seems to be dropping traffic for a split second across all ports and all vlans. I immediately replaced the switch with a different brand/model and the problem persists. Sometimes traffic drops to zero, others it drops to 50%, problem is very random but seems to occur with much more frequency during high PPS (pushing high traffic / iperf does not induce problem) Could this be MTU? I've tried flow control, hard code duplex, stp on/off etc I'm at a loss any ideas? TJ Trout Volt Broadband

9 13