- NANOG - lists.nanog.org

Re: "Defensive" BGP hijacking?
by Scott Weeks 13 Sep '16

13 Sep '16

--- bryant(a)backconnect.com wrote: From: Bryant Townsend <bryant(a)backconnect.com> @ca & Matt - No, we do not plan to ever intentionally perform a non-authorized BGP hijack in the future. -------------------------------------------- Bryant, Who was the upstream provider? scott

3 2

Re: "Defensive" BGP hijacking?
by Scott Weeks 13 Sep '16

13 Sep '16

--- hugo(a)slabnet.com wrote: On Tue 2016-Sep-13 13:32:56 -0700, Scott Weeks <surfer(a)mauigateway.com> wrote: >--- bryant(a)backconnect.com wrote: >From: Bryant Townsend <bryant(a)backconnect.com> >@ca & Matt - No, we do not plan to ever intentionally perform a >non-authorized BGP hijack in the future. >-------------------------------------------- > >Who was the upstream provider? 3223 / VOXILITY https://bgpstream.com/event/54711 ----------------------------------------------- Oops, I just realized that was mentioned earlier. Apologies for the noise. scott

1 0

"Defensive" BGP hijacking?
by Hugo Slabbert 13 Sep '16

13 Sep '16

Hopefully this is operational enough, though obviously leaning more towards the policy side of things: What does nanog think about a DDoS scrubber hijacking a network "for defensive purposes"? http://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-isr… "For about six hours, we were seeing attacks of more than 200 Gbps hitting us,” Townsend explained. “What we were doing was for defensive purposes. We were simply trying to get them to stop and to gather as much information as possible about the botnet they were using and report that to the proper authorities.” -- Hugo Slabbert | email, xmpp/jabber: hugo(a)slabnet.com pgp key: B178313E | also on Signal

13 16

Re: "Defensive" BGP hijacking?
by Scott Weeks 13 Sep '16

13 Sep '16

--- mel(a)beckman.org wrote: From: Mel Beckman <mel(a)beckman.org> This looks to me like ISP community governance in the best sense. I look forward to thoughtful discussion. ------------------------------------------------ Yes, 100% agree! scott

1 0

Looking for recommendations for a dedicated ping responder
by Dan White 12 Sep '16

12 Sep '16

Are there any products you're using which are dedicated to responding to customer facing pings? -- Dan White BTC Broadband Network Admin Lead Ph 918.366.0248 (direct) main: (918)366-8000 Fax 918.366.6610 email: dwhite(a)olp.net http://www.btcbroadband.com

9 9

Re: "Defensive" BGP hijacking?
by Scott Weeks 12 Sep '16

12 Sep '16

From: NANOG <nanog-bounces(a)nanog.org> on behalf of Blake Hudson <blake(a)ispn.net> My suggestion is that BackConnect/Bryant Townsend should have their ASN revoked for fraudulently announcing another organization's address space. They are not law enforcement, they did not have a warrant or judicial oversight, they were not in immediate mortal peril, etc, etc. ------------------------------------------------- Are the RIRs the internet police? scott

4 3

Re: "Defensive" BGP hijacking?
by Scott Weeks 12 Sep '16

12 Sep '16

--- blake(a)ispn.net wrote: From: Blake Hudson <blake(a)ispn.net> Scott Weeks wrote on 9/12/2016 11:08 AM: > From: NANOG <nanog-bounces(a)nanog.org> on behalf > of Blake Hudson <blake(a)ispn.net> > My suggestion is that BackConnect/Bryant Townsend should have their ASN > revoked for fraudulently announcing another organization's address > space. They are not law enforcement, they did not have a warrant or > judicial oversight, they were not in immediate mortal peril, etc, etc. > ------------------------------------------------- > > > Are the RIRs the internet police? ARIN has policies against fraudulently obtaining resources and has policies for revoking said resources. One could argue that announcing another org's IP resources without authorization is fraud and that said ip resources were fraudulently obtained during the time they were announced by BlackConnect. That said, this ASN was obtained through RIPE (despite the person/company being located in Calfornia, USA) and I did not see any RIPE policies related to fraud. My thought is that if Mr Townsend shows disregard for the stability of the internet by hijacking other's IP space, he should not be allowed to participate. There are comments to the Kreb's article indicating that this was not an isolated incident by Mr Townsend and instead represents one event in a pattern of behavior. ------------------------------------------------- I am somewhat in agreement with Mel: "This thoughtless action requires a response from the community, and an apology from BackConnect. If we can't police ourselves, someone we don't like will do it for us. " But the first part seems to verge on vigilantism. Solutions are hard. BGP filters should be in place. Maybe that's the non-vigilante response. Force filters somehow. However, this has all been discussed over and over here... ;-) scott

3 2

flag/global cloud exchange 15412 contact
by Jared Mauch 12 Sep '16

12 Sep '16

Is there someone out here from 15412 I can talk to regarding some BGP related issues? thanks, - jared

1 0

comcast and msoft ports
by Randy Bush 12 Sep '16

12 Sep '16

anyone know if comcast residential filters 139/445? randy

6 9

Optical transceiver question
by Frank Bulk 12 Sep '16

12 Sep '16

We recently purchased some generic optics from a reputable reseller that were marketed to reach 60 km. But what we found, based on the spec sheets, is that it could only reach that distance if the optics were transmitting on the high side of the transmit power range. For example, if the TX range was 0 to +5 dBm and minimum RX power was -20 dB, the designed optical budget should be no more than 20 dB (0 - -20). Based on the wavelength the appropriate loss would be 0.4 dB/km and results in only 50 km, not 60 km. To get 60 km it would need 24 dB of link margin, and that would only be attainable if it was transmitting on the high side, at +4 dBm. Is it an industry practice to market distance based on the hot optics, not on the worst case, which is minimum TX power? Frank

10 9