- NANOG - lists.nanog.org

Re: "Defensive" BGP hijacking?
by Scott Weeks 14 Sep '16

14 Sep '16

--- Bryan(a)bryanfields.net wrote: From: Bryan Fields <Bryan(a)bryanfields.net> I'm a bit ambivalent about BGP hijacking as a DDOS mitigation strategy. Really there is no authority to say it's wrong. If your peers are cool with it, and their peers are cool with it who's to say it's wrong? --------------------------------------- Pretty much the entire BGP speaking world. scott

1 0

Re: "Defensive" BGP hijacking?
by Scott Weeks 14 Sep '16

14 Sep '16

--- jfmezei_nanog(a)vaxination.ca wrote: From: Jean-Francois Mezei <jfmezei_nanog(a)vaxination.ca> I got to think about this (dangerous thing :-( Ideally, law enforcement should have the smarts and tools to get involved in DDoS and other similar situations and have the power to compell upstream provider(s) to shut service to a suspect. --------------------------------------------------------- Yes, getting law enforcement involved in BGP and network engineering in any way is a dangerous thing. I agree 100%. scott

1 0

Akamai Edgescape query
by Janusz Jezowicz 13 Sep '16

13 Sep '16

Hello, We are doing some network research to various cloud/CDNs and we need to run few tests on Akamai Edgescape. Does anyone has access to run few queries to geo-locate IPs using Edgescape for us? We don't have Akamai contract and it would take us lot of time (and money) to get one just to run few tests. Many thanks for any help! Janusz Jezowicz *Speedchecker Ltd* *email*: janusz(a)speedchecker.xyz *skype*: jezowicz *phone*: +442032863573 *web*: www.speedchecker.xyz The Black Church, St. Mary’s Place, Dublin 7, D07 P4AX, Ireland

2 1

Re: "Defensive" BGP hijacking?
by Scott Weeks 13 Sep '16

13 Sep '16

--- bryant(a)backconnect.com wrote: From: Bryant Townsend <bryant(a)backconnect.com> @ca & Matt - No, we do not plan to ever intentionally perform a non-authorized BGP hijack in the future. -------------------------------------------- Bryant, Who was the upstream provider? scott

3 2

Re: "Defensive" BGP hijacking?
by Scott Weeks 13 Sep '16

13 Sep '16

--- hugo(a)slabnet.com wrote: On Tue 2016-Sep-13 13:32:56 -0700, Scott Weeks <surfer(a)mauigateway.com> wrote: >--- bryant(a)backconnect.com wrote: >From: Bryant Townsend <bryant(a)backconnect.com> >@ca & Matt - No, we do not plan to ever intentionally perform a >non-authorized BGP hijack in the future. >-------------------------------------------- > >Who was the upstream provider? 3223 / VOXILITY https://bgpstream.com/event/54711 ----------------------------------------------- Oops, I just realized that was mentioned earlier. Apologies for the noise. scott

1 0

"Defensive" BGP hijacking?
by Hugo Slabbert 13 Sep '16

13 Sep '16

Hopefully this is operational enough, though obviously leaning more towards the policy side of things: What does nanog think about a DDoS scrubber hijacking a network "for defensive purposes"? http://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-isr… "For about six hours, we were seeing attacks of more than 200 Gbps hitting us,” Townsend explained. “What we were doing was for defensive purposes. We were simply trying to get them to stop and to gather as much information as possible about the botnet they were using and report that to the proper authorities.” -- Hugo Slabbert | email, xmpp/jabber: hugo(a)slabnet.com pgp key: B178313E | also on Signal

13 16

Re: "Defensive" BGP hijacking?
by Scott Weeks 13 Sep '16

13 Sep '16

--- mel(a)beckman.org wrote: From: Mel Beckman <mel(a)beckman.org> This looks to me like ISP community governance in the best sense. I look forward to thoughtful discussion. ------------------------------------------------ Yes, 100% agree! scott

1 0

Looking for recommendations for a dedicated ping responder
by Dan White 12 Sep '16

12 Sep '16

Are there any products you're using which are dedicated to responding to customer facing pings? -- Dan White BTC Broadband Network Admin Lead Ph 918.366.0248 (direct) main: (918)366-8000 Fax 918.366.6610 email: dwhite(a)olp.net http://www.btcbroadband.com

9 9

Re: "Defensive" BGP hijacking?
by Scott Weeks 12 Sep '16

12 Sep '16

From: NANOG <nanog-bounces(a)nanog.org> on behalf of Blake Hudson <blake(a)ispn.net> My suggestion is that BackConnect/Bryant Townsend should have their ASN revoked for fraudulently announcing another organization's address space. They are not law enforcement, they did not have a warrant or judicial oversight, they were not in immediate mortal peril, etc, etc. ------------------------------------------------- Are the RIRs the internet police? scott

4 3

Re: "Defensive" BGP hijacking?
by Scott Weeks 12 Sep '16

12 Sep '16

--- blake(a)ispn.net wrote: From: Blake Hudson <blake(a)ispn.net> Scott Weeks wrote on 9/12/2016 11:08 AM: > From: NANOG <nanog-bounces(a)nanog.org> on behalf > of Blake Hudson <blake(a)ispn.net> > My suggestion is that BackConnect/Bryant Townsend should have their ASN > revoked for fraudulently announcing another organization's address > space. They are not law enforcement, they did not have a warrant or > judicial oversight, they were not in immediate mortal peril, etc, etc. > ------------------------------------------------- > > > Are the RIRs the internet police? ARIN has policies against fraudulently obtaining resources and has policies for revoking said resources. One could argue that announcing another org's IP resources without authorization is fraud and that said ip resources were fraudulently obtained during the time they were announced by BlackConnect. That said, this ASN was obtained through RIPE (despite the person/company being located in Calfornia, USA) and I did not see any RIPE policies related to fraud. My thought is that if Mr Townsend shows disregard for the stability of the internet by hijacking other's IP space, he should not be allowed to participate. There are comments to the Kreb's article indicating that this was not an isolated incident by Mr Townsend and instead represents one event in a pattern of behavior. ------------------------------------------------- I am somewhat in agreement with Mel: "This thoughtless action requires a response from the community, and an apology from BackConnect. If we can't police ourselves, someone we don't like will do it for us. " But the first part seems to verge on vigilantism. Solutions are hard. BGP filters should be in place. Maybe that's the non-vigilante response. Force filters somehow. However, this has all been discussed over and over here... ;-) scott

3 2