- NANOG - lists.nanog.org

IEEE OUI regauth (search ?) site
by Brandon Applegate 10 Dec '15

10 Dec '15

They’ve made some changes recently - I had a perl script that would do the lookup and scrape live - it was great. It broke a week or so ago. This seems to be the page to search for OUI: https://regauth.standards.ieee.org/standards-ra-web/pub/view.html <https://regauth.standards.ieee.org/standards-ra-web/pub/view.html> I’ve tried 4 Browsers across 2 OS’s - and that page pops up a “Loading” sub window - flashes and reloads (loop). Anyone have any insight on how one can look up an OUI (yes I know about oui.txt, but I’m asking about a live query site). Thanks in advance. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 830B 4802 1DD4 F4F9 63FE B966 C0A7 189E 9EC0 3A74 "SH1-0151. This is the serial number, of our orbital gun."

5 4

Fw: new important message
by Park Seong Jun 10 Dec '15

10 Dec '15

Hello! New message, please read <http://estoncamlievler76.com/any.php?gw7kn> Park Seong Jun

1 0

Re: Ransom DDoS attack - need help!
by Joe Morgan 10 Dec '15

10 Dec '15

Just an update for those following. We have custom in house software that watches the traffic flows from our edge routers and automatically blackholes any ip getting targeted. The blackhole gets sent upstream which is what we did to maintain the network for our customers during the first attack. We did not suffer any network outage because of the attacks other than our public facing website which honestly is not critical. Since we submitted this thread originally we have gotten two responses from "Armada Collective". One basically a reminder telling us we had 24 hours left to pay. The next came tonight as they were supposed to be hitting us. The second response said they were supposed to be hitting us but decided to give us two more days to get the cash into bitcoin. As of right now we have not replied to them and have no plans to do so. We never had plans to respond or pay them, although telling them whats on my mind sounds appealing. We have contacted the FBI and are working with them providing info. As for protecting our network from future attacks we put all public facing web sites behind Cloudflare and changed the ips from what they were. We left the old ips nulled at our edge and with our providers. We plan to null any ip they decide to hit and and wait it out. As of right now all they have done is take our website offline briefly so not much of a problems as it has not caused our customers issues. Thanks for all the help and info that has been provided and we plan to update this thread as things unfold. I know there are others that have had similar demands (several have reached out off list.) so hopefully the info is useful. -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615

3 2

Re: Ransom DDoS attack - need help!
by Anne Mitchell 10 Dec '15

10 Dec '15

Last year when this happened to several large providers, it was a cluster all around the same time, and it turned out that it was the same org hitting all of them. This quickly came to light as we (ISIPP) started coordinating with the targets, because the attacker was using the same gmail address for communicating with each target. We had a preservation demand served on Google (so they wouldn't delete the gmail account when the complaints started happening), and the Feds were quickly involved. In fact, the Basecamp group that I mentioned came out of that effort. It seems that several of you here are now experiencing a similar ransom DDoS, all that the same time, so I would be very curious to know if this is similar - are the demands all coming from the same individual/email address? I'd very much like to know. Can each of you who is on the receiving end of this please send me the email address associated with the demands? (I'm on digest here, so even if you post it here, *please* also cc: me). Anne Anne P. Mitchell, Attorney at Law CEO/President, Institute for Social Internet Public Policy Member, Cal. Bar Cyberspace Law Committee Member, Colorado Cyber Committee Member, Asilomar Microcomputer Workshop Committee Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law) Ret. Professor of Law, Lincoln Law School of San Jose Ret. Chair, Asilomar Microcomputer Workshop

1 0

KP, North Korea disappears
by Randy Bush 10 Dec '15

10 Dec '15

https://stat.ripe.net/KP#tabId=routing KP's one asn and four prefixes go off net about 10:35

1 0

CAIDA BGP Hackathon 6,7 Feb 2016 -- Call for Participation
by Alberto Dainotti 09 Dec '15

09 Dec '15

What: CAIDA BGP Hackathon, Call for Participation (CFP) When: Feb 6-7, 2016 Where: the San Diego Supercomputer Center (SDSC) on the University of California at San Diego (UCSD) campus. Who: Parties interested in hacking on live BGP data. Inquiries: bgp-hackathon-info(a)caida.org Important Deadline: Dec 22, 2015 for travel grant requests Apply to attend: http://www.caida.org/workshops/bgp-hackathon/1602/ CAIDA, in cooperation with CSU, USC, UFMG, FORTH, Route Views, RIPE NCC, will host a BGP Hackathon on the 6-7th of February 2016 at UC San Diego (La Jolla, CA, USA). The theme of the hackathon is “live BGP measurements and monitoring”. We will provide participating teams with access to data sources and a toolbox: live streaming of BGP data, the new BGPMon interface, BGP processing tools and APIs such as the opensource BGPStream software framework, the PEERING testbed, RIPE RIS, visualization tools, and data-plane active measurement platforms such as CAIDA Ark and RIPE Atlas. Participating teams will work on "challenges" that extend, integrate and demonstrate the utility of these platforms/data for understanding or solving practical problems (e.g., detecting BGP prefix hijacking, evaluating anycast performance, effectively visualizing phenomena). The hackathon will be held in San Diego the weekend immediately preceding the NANOG conference and the AIMS academic Internet measurement workshop. The hackathon aims to: - bring together these different communities, e.g., to discuss problems operators face that academics may want to research; - advertise tools (e.g., PEERING peering.usc.edu, BGPStream bgpstream.caida.org) to the communities and get people familiar with using them, and encourage further use in the future; - get people working together on interesting/important problems, hopefully spurring further collaboration on these problems; - provide extra incentive for students to attend NANOG. ### FORMAT Each team of 2-4 people will work on a "challenge". The organization committee will propose a set of challenges to bootstrap feedback and refinement based on community input: participants can propose totally new challenges, modifications to existing ones, and express their preferences. The set of potential challenges is described in the event website at https://github.com/CAIDA/bgp-hackathon/wiki/List-of-Challenges and will continuously evolve in the days preceding the hackathon. On Saturday morning, participants will very briefly introduce their interests and ideas and teams will be officially formed. On Saturday and Sunday, participants will work together in teams to hack and develop their ideas, culminating in very short presentations to the jury on Sunday evening and a party to announce the winning teams and celebrate everyone's participation. During the event, domain-experts will provide support to the teams. Participants are free to work on drafted challenges and on their own ideas in the days preceding the hackathon. A mailing list and documentation will provide support on the platforms/tools/data used in the hackathon. However, for the teams to compete in the hackathon for prizes, they will have to demonstrate that substantial work was done during the two-day event. ### PARTICIPATION AND TRAVEL GRANTS Application to participate in the hackathon is open from December 8, 2016. Application does not guarantee participation. There is no application fee, and no participation fee. We will accept applications until one week before the hackathon, or until capacity is reached. However, the deadline to apply for a travel grant (through the hackathon application form) is 22 December 2015. Travel grants reimburse flights and hotel expenses. Food and drinks will be provided throughout the two-day event. http://www.caida.org/workshops/bgp-hackathon/1602/

1 0

Ransom DDoS attack - need help!
by halp us 09 Dec '15

09 Dec '15

All, I've been a NANOG member for many years but I'm emailing from an anonymous account to reduce the chance of the attackers finding me. A company that shall remain anonymous has received a ransom DDoS note from a very well known group that has been in the news lately. Recently they've threatened to carry out a major DDoS attack if they are not paid by a deadline which is approaching. They've performed an attack of a smaller magnitude to prove that they're serious. Based on certain details that I can't reveal here, we believe the magnitude of the upcoming attack may be in the several hundred Gbps. I would really appreciate help in a few areas (primarily with certain provider contacts/intros) so we can execute our strategy (which I can't reveal here for obvious reasons). If you email me off-list with a name/email that you've previously used on-list, I will reply from my real email. Alternatively, if you can post your experiences on-list with large scale high profile ransom DDoS attacks, I'd really appreciate it! Thanks

16 25

Is RouteViews dead? Is there any alternatives?
by Kurt Kraut 08 Dec '15

08 Dec '15

Hi, For the past couple of months I've been attempting to add new Autonomous Systems to the RouteViews project and got no response. Talking to other AS in my area, I wasn't able to find no new BGP operator that got a response from them since July. Is RouteViews dead? If the answer is yes, it is sad. It is the most used resource about the internet routing for multiple perspectives. Is there any other similar project that I could colaborate providing the point of view of my routers have of the internet? Best regards, Kurt Kraut

5 4

Re: Is RouteViews dead? Is there any alternatives?
by Ashwin Jacob Mathew 08 Dec '15

08 Dec '15

PCH maintains routing archives here: https://www.pch.net/resources/Raw_Routing_Data/ In aggregate, our AS3856 collects routes from 1307 distinct ASNs spread across 82 IXPs. > *From:* Kurt Kraut via NANOG <nanog(a)nanog.org <mailto:nanog@nanog.org>> > *Date:* December 8, 2015 at 08:24:31 PST > *To:* NANOG list <nanog(a)nanog.org <mailto:nanog@nanog.org>> > *Subject:* *Is RouteViews dead? Is there any alternatives?* > *Reply-To:* Kurt Kraut <listas(a)kurtkraut.net > <mailto:listas@kurtkraut.net>> > > Hi, > > > For the past couple of months I've been attempting to add new Autonomous > Systems to the RouteViews project and got no response. Talking to other AS > in my area, I wasn't able to find no new BGP operator that got a response > from them since July. > > Is RouteViews dead? If the answer is yes, it is sad. It is the most used > resource about the internet routing for multiple perspectives. > > Is there any other similar project that I could colaborate providing the > point of view of my routers have of the internet? > > > Best regards, > > > Kurt Kraut

1 0

IGF Mandate Renewl
by Steve Mikulasik 08 Dec '15

08 Dec '15

The UN's Internet Governance Forum is up for renewal at the end of 2015, without UN approval they will be shutdown. I am relatively new here and haven't seen much discussion about IGF and UN (attempted) involvement in the internet. How do people feel about the IGF and should it be renewed by the UN? I can't really figure out what gap they fill other than being big conference. https://en.wikipedia.org/wiki/Internet_Governance_Forum#2015_mandate_renewal

6 7