- NANOG - lists.nanog.org

Re: PlayStationNetwork blocking of CGNAT public addresses
by Alexander Maassen 22 Sep '16

22 Sep '16

So you ignore/don't deal with the abuse coz it's shipped in a format you refuse to handle? And you don't even bother telling the reporter you would like it in a per ip format? Or make attempts to make it work the way they report it (split out the ip's and modify the to be forwarded mail to only contain the ip's belonging to that customer)???? Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Baldur Norddahl <baldur.norddahl(a)gmail.com> Datum: 21-09-16 10:37 (GMT+01:00) Aan: nanog(a)nanog.org Onderwerp: Re: PlayStationNetwork blocking of CGNAT public addresses Hi We have the opposite problem with PSN: Sometimes they will send abuse reports with several of our IP addresses listed. The problem with that is that we can not give data about one customer to another customer. By listing multiple IP addresses we are prevented from forwarding the email to the customer. Which means we may ignore it instead. Regards, Baldur

5 6

Livestream of NYNOG Meetup #2 today
by Joly MacFie 22 Sep '16

22 Sep '16

10:45am EDT https://livestream.com/internetsociety/nynog2 -- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast -------------------------------------------------------------- -

1 0

Re: PlayStationNetwork blocking of CGNAT public addresses
by Alexander Maassen 22 Sep '16

22 Sep '16

Both gamers and content providers do not care. The gamers as they only care about the game itself and don't care about the technical mumbo jumbo. And the makers coz they only care about making money by producing content the gamers want. And you service providers are left with the headache of attempts to please both sides. If this wasn't the case, then why after 20 years, ipv6 ain't rolled out. Hence again I'd be voting for an ipv6 only day, but that will never happen..... Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Mark Andrews <marka(a)isc.org> Datum: 21-09-16 03:29 (GMT+01:00) Aan: Justin Wilson <lists(a)mtin.net> Cc: NANOG <nanog(a)nanog.org> Onderwerp: Re: PlayStationNetwork blocking of CGNAT public addresses In message <09342130-874F-4FA4-B410-B7B66A75FA4D(a)mtin.net>, Justin Wilson write s: > PSN is one reason I am not a fan of CGNAT. All they see are tons of > connections from the same IP. This results in them banning folks. Due > to them being hacked so many times getting them to actually communicate > is almost impossible. My .02 is just get the gamers a true public if at > all possible. > > Justin Wilson > j2sw(a)mtin.net What we need is business tech reporters to continually report on these failures of content providers to deliver their services over IPv6. 20 years lead time should be enough for any service. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

3 2

Re: PlayStationNetwork blocking of CGNAT public addresses
by Alexander Maassen 22 Sep '16

22 Sep '16

Ipv6 is there for 20+ years, cgnat is needed coz the net grows kinda exponentially due to stuff like IoT/mobiles/m2m, and isp's need to provide users with the ability to talk ipv4 simply because the other side refuses to deploy v6 abilities. Do the math if they really care. Also the servers itself hosting the gameserver probably already are dual stacked. But the gamecode itself misses the support. Then there is the issue of you as isp not being able or daring to show a fist and simply saying: screw you. Because you are risking to loose customers. And as long as the company's earn plenty of money using outdated code, they won't change it, coz that would imply spending money that won't flow into fancy buildings, fast cars and all that other useless luxury. Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Mike Hammett <nanog(a)ics-il.net> Datum: 22-09-16 13:23 (GMT+01:00) Aan: Alexander Maassen <outsider(a)scarynet.org> Cc: NANOG <nanog(a)nanog.org> Onderwerp: Re: PlayStationNetwork blocking of CGNAT public addresses If you told them they would have fewer NAT issues if they supported IPv6, they'd start to care. ;-) They know enough to hate NAT. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP From: "Alexander Maassen" <outsider(a)scarynet.org> Cc: "NANOG" <nanog(a)nanog.org> Sent: Thursday, September 22, 2016 3:35:01 AM Subject: Re: PlayStationNetwork blocking of CGNAT public addresses Both gamers and content providers do not care. The gamers as they only care about the game itself and don't care about the technical mumbo jumbo. And the makers coz they only care about making money by producing content the gamers want. And you service providers are left with the headache of attempts to please both sides. If this wasn't the case, then why after 20 years, ipv6 ain't rolled out. Hence again I'd be voting for an ipv6 only day, but that will never happen..... Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Mark Andrews <marka(a)isc.org> Datum: 21-09-16 03:29 (GMT+01:00) Aan: Justin Wilson <lists(a)mtin.net> Cc: NANOG <nanog(a)nanog.org> Onderwerp: Re: PlayStationNetwork blocking of CGNAT public addresses In message <09342130-874F-4FA4-B410-B7B66A75FA4D(a)mtin.net>, Justin Wilson write s: > PSN is one reason I am not a fan of CGNAT. All they see are tons of > connections from the same IP. This results in them banning folks. Due > to them being hacked so many times getting them to actually communicate > is almost impossible. My .02 is just get the gamers a true public if at > all possible. > > Justin Wilson > j2sw(a)mtin.net What we need is business tech reporters to continually report on these failures of content providers to deliver their services over IPv6. 20 years lead time should be enough for any service. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

1 0

Re: PlayStationNetwork blocking of CGNAT public addresses
by Alexander Maassen 22 Sep '16

22 Sep '16

As long as their is no international accepted standard as to how to report abuse and everyone cooking up his/her own methods.. I think you have either the choice of adapting and thus be able to deal with the abuse. Or be lazy and stubborn, ignore it, wait for the bad reputation to say hi to your company and face the effects it might cause. Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Tom Beecher <beecher(a)beecher.cc> Datum: 21-09-16 17:13 (GMT+01:00) Aan: Justin Wilson <lists(a)mtin.net> Cc: NANOG <nanog(a)nanog.org> Onderwerp: Re: PlayStationNetwork blocking of CGNAT public addresses I have a hard time accepting that service providers should re-engineer their networks because other companies cannot properly engineer their abuse tooling. On Tue, Sep 20, 2016 at 11:33 AM, Justin Wilson <lists(a)mtin.net> wrote: > PSN is one reason I am not a fan of CGNAT. All they see are tons of > connections from the same IP. This results in them banning folks. Due to > them being hacked so many times getting them to actually communicate is > almost impossible. My .02 is just get the gamers a true public if at all > possible. > > Justin Wilson > j2sw(a)mtin.net > > --- > http://www.mtin.net Owner/CEO > xISP Solutions- Consulting – Data Centers - Bandwidth > > http://www.midwest-ix.com COO/Chairman > Internet Exchange - Peering - Distributed Fabric > > > On Sep 20, 2016, at 8:24 AM, Danijel Starman <theghost101(a)gmail.com> > wrote: > > > > Something similar happened to a local FantasyConon I was helping set up, > we > > had only two PS4 machines there and accounts provided by Blizzard for > > Overwatch. Outside IP of the LAN (as it was NATed) was banned by PSN in > > about 8h. There was no other traffic other then those two accounts > playing > > Overwatch so my guess is that they have some too aggressive checks. I've > > managed to convince our ISP there to change the outside IP of the link so > > we got them working the next day but it happened again in 8h. > > > > -- > > *blap* > > > > On Fri, Sep 16, 2016 at 3:12 PM, Simon Lockhart <simon(a)slimey.org> > wrote: > > > >> All, > >> > >> We operate an access network with several hundred thousand users. > >> Increasingly > >> we're putting the users behind CGNAT in order to continue to give them > an > >> IPv4 > >> service (we're all dual-stack, so they all get public IPv6 too). Due to > the > >> demographic of our users, many of them are gamers. > >> > >> We're hitting a problem with PlayStationNetwork 'randomly' blocking some > >> of our > >> CGNAT outside addresses, because they claim to have received anomalous, > or > >> 'attack' traffic from that IP. This obviously causes problems for the > other > >> legitimate users who end up behind the same public IPv4 address. > >> > >> Despite numerous attempts to engage with PSN, they are unwilling to > give us > >> any additional information which would allow us to identify the 'rogue' > >> users > >> on our network, or to identify the 'unwanted' traffic so that we could > >> either > >> block it, or use it to identify the rogue users ourselves. > >> > >> Has anyone else come up against the problem, and/or have any > suggestions on > >> how best to resolve it? > >> > >> Many thanks in advance, > >> > >> Simon > >> > >> > > > >

1 0

Domain renawals
by Jeff Jones 22 Sep '16

22 Sep '16

Hello All, Sorry if this is low level. But are people sick of registrars jacking up prices? Who is the cheapest and most reliable? I have been using whois.com, networksolutions.com and am looking for input on who is cheap, secure, reliable registrar. Thanks for your input. ~Jeff

20 26

Re: CDN Overload?
by Scott Weeks 21 Sep '16

21 Sep '16

:: I have made this into a Google Form to make it easier to :: track compared to randomly formatted responses on multiple :: mailing lists, Facebook Groups, etc. Yeah, because... but I don't do email like that why is it hard to read? it's really hard to read email this way. because it's out of order umm, ok. I fixed it for you scott

1 0

importance of fiber cleaning
by Mikael Abrahamsson 21 Sep '16

21 Sep '16

https://www.sunet.se/blogg/long-read-cleanliness-is-a-virtue/ This is an excellent article regarding fiber cleaning and its importance. Please do share with other people in our business. I'm sure lack of proper fiber cleaning causes a lot of unneccessary outages and operational problems worldwide, partly because people aren't aware of its importance. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

4 3

Yahoo as#10310 reachability problem
by Mohamed Kamal 21 Sep '16

21 Sep '16

Can someone from Yahoo as#10310 contact me off-list, we have some problems reaching Yahoo through Telia and GTT. Thanks. -- Mohamed Kamal Core Network Sr. Engineer

1 0

Re: "Defensive" BGP hijacking?
by Bryant Townsend 21 Sep '16

21 Sep '16

Hello Everyone, I would like to give as much insight as I can in regards to the BGP hijack being discussed in this thread. I won’t be going into specific details of the attack, but we do plan to release more information on our website when we are able to. I also wanted to let Hugo (who started the thread) know that we harbor no hard feelings about bringing this topic up, as it is relevant to the community and does warrant discussion. Hugo, you may owe me a beer the next time we meet. :) We agree with others that NANOG is the most appropriate venue to answer any questions and discuss the topic at hand. I have been attending NANOG for the past 3-4 years, and I can assure you that it is of the utmost importance to me how the community views my company, my employees, and myself. There are many people in this community that I personally have the upmost respect for, and it would sadden me If I were to lose the respect of mentors, colleagues, and friends by not responding. That being said, I think there are a fair number of people in NANOG that would vouch for my character and ethics relating to the intent of my actions, even if I were to remain silent. I would also like to preface that my explanation of the events that occurred and actions taken by BackConnect are not to justify or provide excuses. My goal is to simply show what happened and give insight into our actions. I will start with a little background to bring anyone up to speed that is not aware of the events that transpired. *About the company, BackConnect, Inc.*: We are a new (~4 months old) open-sourced based DDoS mitigation and network security provider that specializes in custom intrusion detection and prevention systems. We also provide threat intelligence services, with an emphasis on active botnets, new and upcoming DDoS attack patterns, and boot services. From time to time, this information flows through our network for collection purposes. *Events leading to the Hijack*: On 9/6/2016, ~10:30AM PST, one of our clients and our website received a large and relatively sophisticated DDoS attack. The attack targeted entire subnets and peaked over 200 Gbps and 40Mpps. Although the attack was automatically detected and mostly filtered, there was initially a small leak. In response we quickly applied new security rules that rendered it entirely ineffective. The attackers continued to attack our network and client for roughly 6 hours before giving up. *Events that caused us to perform the BGP hijack*: After the DDoS attacks subsided, the attackers started to harass us by calling in using spoofed phone numbers. Curious to what this was all about, we fielded various calls which allowed us to ascertain who was behind the attacks by correlating e-mails with the information they provided over the phone. Throughout the day and late into the night, these calls and threats continued to increase in number. Throughout these calls we noticed an increasing trend of them bringing up personal information of myself and employees. At this point I personally filled a police report in preparation to a possible SWATing attempt. As they continued to harass our company, more and more red flags indicated that I would soon be targeted. This was the point where I decided I needed to go on the offensive to protect myself, my partner, visiting family, and my employees. The actions proved to be extremely effective, as all forms of harassment and threats from the attackers immediately stopped. In addition to our main objective, we were able to collect intelligence on the actors behind the bot net as well as identify the attack servers used by the booter service. *Afterthoughts*: The decision to hijack the attackers IP space was not something I took lightly. I was fully aware there were services that reported such actions and knew that this could potentially be brought up in discussion and hurt BackConnect’s image. Even though we had the capacity to hide our actions, we felt that it would be wrong to do so. I have spent a long time reflecting on my decision and how it may negatively impact the company and myself in some people’s eyes, but ultimately I stand by it. The experience and feedback I have gained from these events has proven invaluable and will be used to shape the policies surrounding the future handling of similar situations. I am happy to field questions, but cannot promise any answers, disclosure of further information, or when they will be responded to. Sincerely, Bryant Townsend

14 20