- NANOG - lists.nanog.org

Re: Sunday night social?
by Matt Ryanczak 13 Jun '16

13 Jun '16

Remember that social != sociable! ~Matt On Jun 12, 2016 15:22, "Todd Underwood" <toddunder(a)gmail.com> wrote: huh. today we learn that social is subject to particular people's view of social. please author an RFC to explain the scope that counts as social. thanks! t On Sun, Jun 12, 2016 at 6:18 PM, Randy Bush <randy(a)psg.com> wrote: > This may surprise some, but social != frat boys. > > randy, on a phone > >> On Jun 12, 2016, at 15:08, Todd Underwood <toddunder(a)gmail.com> wrote: >> >> surely this is not the same randy bush that loves to point out that >> humans are social animals! >> >> t >> >> On Sun, Jun 12, 2016 at 2:31 PM, Randy Bush <randy(a)psg.com> wrote: >>>>> Is Wednesday night the only social? >>>> Yes. >>> >>> damn! if i had known there was a chance of folk acting more like sober >>> adults than the usual frat boys i might have scheduled chicago. >>> >>> randy

1 0

Fwd: Sunday night social?
by Matthew Petach 12 Jun '16

12 Jun '16

> I just finished registering for NANOG 67, and answered Yes to "Will you be attending the sunday evening social" and booked my flight accordingly...but now i can't seem to find any details on what time it starts on the website. Does anyone know what time it starts? > > Thanks! > > Matt > >

6 8

phish platform ?
by Julien T 12 Jun '16

12 Jun '16

Hello, I'm reviewing the process how to manage phish report at a customer and am looking for tools ideally opensource. Recently, OVH released https://github.com/ovh/cerberus-ux and maybe AbuseHelper can do http://abusehelper.be/ I also checked APWG but didn't find reference to such a tool. Quick constraints: multiple types of input+garbage, metrics, API, SIEM integration Any advices of a public tool? or mostly in-house dev? Thanks a lot. Cheers, Jul

1 0

Netflix VPN detection - actual engineer needed
by Matthew Kaufman 12 Jun '16

12 Jun '16

Every device in my house is blocked from Netflix this evening due to their new "VPN blocker". My house is on my own IP space, and the outside of the NAT that the family devices are on is 198.202.199.254, announced by AS 11994. A simple ping from Netflix HQ in Los Gatos to my house should show that I'm no farther away than Santa Cruz, CA as microwaves fly. Unfortunately, when one calls Netflix support to talk about this, the only response is to say "call your ISP and have them turn off the VPN software they've added to your account". And they absolutely refuse to escalate. Even if you tell them that you are essentially your own ISP. So... where's the Netflix network engineer on the list who all of us can send these issues to directly? Matthew Kaufman

31 70

Detecting Attacks
by subashini hariharan 12 Jun '16

12 Jun '16

Hello, I am Subashini, a graduate student. I am interested in doing my project in Network Security. I have a doubt related to it. The aim is to detect DoS/DDoS attacks using the application. I am going to use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log Analytics). My doubt is regarding how do we generate logs for detecting this attack? As I am new to this process, I am not sure about it. Also, if it is possible to do any other attacks similar to this, you can please give a hint about it. Could anyone please help with this, it would be a great help!! -- Thank You. With Regards, H.Subashini

5 4

Detecting Attacks
by subashini hariharan 12 Jun '16

12 Jun '16

Hello, I am Subashini, a graduate student. I am interested in doing my project in Network Security. I have a doubt related to it. The aim is to detect DoS/DDoS attacks using the application. I am going to use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log Analytics). My doubt is regarding how do we generate logs for detecting this attack? As I am new to this process, I am not sure about it. Also, if it is possible to do any other attacks similar to this, you can please give a hint about it. Could anyone please help with this, it would be a great help!! -- Thank You. With Regards, H.Subashini

2 1

intra-AS messaging for route leak prevention
by Sriram, Kotikalapudi (Fed) 12 Jun '16

12 Jun '16

I am a co-author on a route-leak detection/mitigation/prevention draft in the IDR WG in the IETF: https://tools.ietf.org/html/draft-ietf-idr-route-leak-detection-mitigation-… Based on private conversations with a few major ISPs, the following common practice for intra-AS messaging (using Community tagging in iBGP) for prevention of route leaks is described in Section 3.2 of the draft: <begin quote> “Routes are tagged on ingress to an AS with communities for origin, including the type of eBGP peer it was learned from (customer, transit-provider or peer), geographic location, etc. The community attributes are carried across the AS with the routes. Routes that the AS originates directly are tagged with similar origin communities when they are redistributed into BGP from static, IGP, etc. These communities are used along with additional logic in route policies to determine which routes are to be announced to which eBGP peers and which are to be dropped. Route policy is applied to eBGP sessions based on what set of routes they should receive (transit, full routes, internal-only, default-only, etc.). In this process, the ISP's AS also ensures that routes learned from a transit-provider or a lateral peer (i.e. non-transit) at an ingress router are not leaked at an egress router to another transit-provider or peer. Additionally, in many cases, ISP network operators' outbound policies require explicit matches for expected communities before passing routes. This helps ensure that that if an update has made it into the routing table (i.e. RIB) but has missed its ingress community tagging (due to a missing/misapplied ingress policy), it will not be inadvertently leaked.” <end quote> Question: Are there other means of conveying this information in common use today (i.e. for prevention of route leaks)? Also, the following publicly available references can be possibly cited in support of the above: https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf http://showipbgp.com/bgp-tools/bgp-community-list/91-level3-as3356.html Pointers to any other relevant references would be very welcome as well. Thank you. Sriram

8 20

Re: Detecting Attacks
by alvin nanog 11 Jun '16

11 Jun '16

hi su.. On 06/10/16 at 10:39pm, subashini hariharan wrote: > I am Subashini, a graduate student. I am interested in doing my project in > Network Security. I have a doubt related to it. duh... too broad of a subject ... you'd need to be more specific about which of the hundred's of sub categories ... > The aim is to detect DoS/DDoS attacks using the application. good ... sorta specific but not ... > I am going to > use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log > Analytics). hummm, why that app and not the couple dozen other ways people are using to detect incoming and/or outgoing DDoS attacks if the "professor" says "use ELK" ... you have no ther choice ... if not, there's much better options to detect DDoS attacks ... ( tcpdump -nnvv ) ... if you cannot explain each line, you've got a DDoS problem > My doubt is regarding how do we generate logs for detecting this attack? As > I am new to this process, I am not sure about it. what's the doubt ?? if there is a doubt ... conduct and experiment and see if it confirms your expected result or explain why its different and do more experiments until "its all explained" and no more doubts > Also, if it is possible to do any other attacks similar to this, you can > please give a hint about it. several dozens other types of attacks similar to DDoS, which takes over a server or network offline including no-technical-skill required attacks > Could anyone please help with this, it would be a great help!! google/yahoo/bing is your assistant ready to give you ALL the answer's you need and ant ----------- side notes ... a) if you log all incoming packets ( attacks ), you have increased the effectiveness of ddos attacks since you have now gave them the power to fill up your disk, use your cpu, use your memory, use your time to review the logs, etc, etc all of that is bad bad stuff to have the DDoS attackers do to you b) for logs, etc, there are dozens of other apps that try to detect attacks ( splunk, snort, hundred other apps, including eyeballs ) why are some methodologies better than others ? c) detecting DDoS attacks is nice but, what's the point ?? you're still under attack ... and haven't resolved the issue kinda like cooking dinner but not eating it ... you're still starving d) every computer connected to the internet is under constant 24x7x365 attacks ... a good "ddos detector" will tell you how much traffic is legitimate and how much bandwidth is wasted by the attacks and which server and which ports they are attacking, etc etc script kiddies are already attacking your network ( the one you're using bnow ) .. it's a free and harmless DDoS attacks and you should be able to see what they are doing to you "now" if you cannot "see what" they are attacking, you've got a major problem e) if you want to generate some specific DDoS attacks .. use ping, nping, hping, nmap, etc to start .... that should keep you busy for the next year or few years do NOT ever send packets outside to computers you do not own, or some ominous looking folks might come looking for you f) if you want to detect DDoS attacks .... post process tcpdump's output magic pixie dust alvin # # DDoS-Simulator.net # DDoS-Mitigator.net #

1 0

RE: Netflix banning HE tunnels
by Scott Weeks 11 Jun '16

11 Jun '16

--- chuckchurch(a)gmail.com wrote: From: "Chuck Church" <chuckchurch(a)gmail.com> The true jerks who used HE to bypass geo-lockout probably changed to something else the next day. But we suffer still. The FCC or some other federal entity probably needs to step in. ------------------------------------------ Yeah, because the US federal government does such a great job fixing problems like this... scott

3 2

Akamai GeoIP
by Josh Reynolds 10 Jun '16

10 Jun '16

Can somebody from Akamai contact me offlist about a GeoIP location change for a block please? Thank you.

2 1