- NANOG - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 04 Dec '15

04 Dec '15

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, PaNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 05 Dec, 2015 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 571357 Prefixes after maximum aggregation (per Origin AS): 212309 Deaggregation factor: 2.69 Unique aggregates announced (without unneeded subnets): 278305 Total ASes present in the Internet Routing Table: 52177 Prefixes per ASN: 10.95 Origin-only ASes present in the Internet Routing Table: 36655 Origin ASes announcing only one prefix: 15946 Transit ASes present in the Internet Routing Table: 6383 Transit-only ASes present in the Internet Routing Table: 165 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 35 Max AS path prepend of ASN ( 55644) 31 Prefixes from unregistered ASNs in the Routing Table: 1028 Unregistered ASNs in the Routing Table: 367 Number of 32-bit ASNs allocated by the RIRs: 11965 Number of 32-bit ASNs visible in the Routing Table: 9139 Prefixes from 32-bit ASNs in the Routing Table: 34775 Number of bogon 32-bit ASNs visible in the Routing Table: 14 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 421 Number of addresses announced to Internet: 2802085056 Equivalent to 167 /8s, 4 /16s and 108 /24s Percentage of available address space announced: 75.7 Percentage of allocated address space announced: 75.7 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 97.8 Total number of prefixes smaller than registry allocations: 188133 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 144487 Total APNIC prefixes after maximum aggregation: 39866 APNIC Deaggregation factor: 3.62 Prefixes being announced from the APNIC address blocks: 152684 Unique aggregates announced from the APNIC address blocks: 60777 APNIC Region origin ASes present in the Internet Routing Table: 5113 APNIC Prefixes per ASN: 29.86 APNIC Region origin ASes announcing only one prefix: 1190 APNIC Region transit ASes present in the Internet Routing Table: 895 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 34 Number of APNIC region 32-bit ASNs visible in the Routing Table: 1719 Number of APNIC addresses announced to Internet: 756067456 Equivalent to 45 /8s, 16 /16s and 172 /24s Percentage of available APNIC address space announced: 88.4 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 131072-135580 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 180946 Total ARIN prefixes after maximum aggregation: 88978 ARIN Deaggregation factor: 2.03 Prefixes being announced from the ARIN address blocks: 184304 Unique aggregates announced from the ARIN address blocks: 86632 ARIN Region origin ASes present in the Internet Routing Table: 16512 ARIN Prefixes per ASN: 11.16 ARIN Region origin ASes announcing only one prefix: 5973 ARIN Region transit ASes present in the Internet Routing Table: 1717 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 27 Number of ARIN region 32-bit ASNs visible in the Routing Table: 859 Number of ARIN addresses announced to Internet: 1102523072 Equivalent to 65 /8s, 183 /16s and 42 /24s Percentage of available ARIN address space announced: 58.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-395164 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 137500 Total RIPE prefixes after maximum aggregation: 68502 RIPE Deaggregation factor: 2.01 Prefixes being announced from the RIPE address blocks: 145455 Unique aggregates announced from the RIPE address blocks: 90245 RIPE Region origin ASes present in the Internet Routing Table: 18032 RIPE Prefixes per ASN: 8.07 RIPE Region origin ASes announcing only one prefix: 7990 RIPE Region transit ASes present in the Internet Routing Table: 2987 Average RIPE Region AS path length visible: 4.8 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 4264 Number of RIPE addresses announced to Internet: 701905536 Equivalent to 41 /8s, 214 /16s and 58 /24s Percentage of available RIPE address space announced: 102.0 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-204287 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 60468 Total LACNIC prefixes after maximum aggregation: 11827 LACNIC Deaggregation factor: 5.11 Prefixes being announced from the LACNIC address blocks: 73119 Unique aggregates announced from the LACNIC address blocks: 34095 LACNIC Region origin ASes present in the Internet Routing Table: 2455 LACNIC Prefixes per ASN: 29.78 LACNIC Region origin ASes announcing only one prefix: 599 LACNIC Region transit ASes present in the Internet Routing Table: 544 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 22 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2126 Number of LACNIC addresses announced to Internet: 170315776 Equivalent to 10 /8s, 38 /16s and 208 /24s Percentage of available LACNIC address space announced: 101.5 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-265628 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 13096 Total AfriNIC prefixes after maximum aggregation: 3095 AfriNIC Deaggregation factor: 4.23 Prefixes being announced from the AfriNIC address blocks: 15374 Unique aggregates announced from the AfriNIC address blocks: 6200 AfriNIC Region origin ASes present in the Internet Routing Table: 734 AfriNIC Prefixes per ASN: 20.95 AfriNIC Region origin ASes announcing only one prefix: 194 AfriNIC Region transit ASes present in the Internet Routing Table: 164 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 20 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 171 Number of AfriNIC addresses announced to Internet: 70910720 Equivalent to 4 /8s, 58 /16s and 3 /24s Percentage of available AfriNIC address space announced: 70.4 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5502 4192 75 China Education and Research 7545 3019 346 154 TPG Telecom Limited 4766 2994 11135 990 Korea Telecom 17974 2725 914 96 PT Telekomunikasi Indonesia 9829 2214 1413 315 National Internet Backbone 4755 2065 431 234 TATA Communications formerly 9808 1684 8639 18 Guangdong Mobile Communicatio 4808 1568 2273 500 CNCGROUP IP network China169 9583 1519 163 85 Sify Limited 9498 1401 335 112 BHARTI Airtel Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3244 2964 143 Cox Communications Inc. 3356 2574 10691 525 Level 3 Communications, Inc. 6389 2508 3687 42 BellSouth.net Inc. 18566 2213 394 277 MegaPath Corporation 20115 1889 1897 401 Charter Communications 6983 1697 849 238 EarthLink, Inc. 30036 1656 331 355 Mediacom Communications Corp 4323 1578 1021 396 tw telecom holdings, inc. 209 1486 4327 1235 Qwest Communications Company, 701 1392 11415 664 MCI Communications Services, Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 2473 129 7 SaudiNet, Saudi Telecom Compa 20940 2241 888 1608 Akamai International B.V. 34984 1912 319 410 TELLCOM ILETISIM HIZMETLERI A 8551 1241 376 44 Bezeq International-Ltd 8402 1185 544 15 OJSC "Vimpelcom" 13188 1075 97 79 TOV "Bank-Inform" 12479 1051 967 77 France Telecom Espana SA 31148 1041 47 41 Freenet Ltd. 9198 958 349 25 JSC Kazakhtelecom 6830 898 2712 468 Liberty Global Operations B.V Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3407 540 157 Telmex Colombia S.A. 8151 2113 3347 500 Uninet S.A. de C.V. 7303 1580 941 241 Telecom Argentina S.A. 6503 1386 437 57 Axtel, S.A.B. de C.V. 28573 1261 2164 119 NET Serviços de Comunicação S 11830 1094 364 24 Instituto Costarricense de El 6147 1039 376 34 Telefonica del Peru S.A.A. 26615 1000 2325 34 Tim Celular S.A. 7738 994 1882 41 Telemar Norte Leste S.A. 3816 970 459 186 COLOMBIA TELECOMUNICACIONES S Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1117 1470 14 TE-AS 24863 1038 409 38 Link Egypt (Link.NET) 37611 577 39 42 Afrihost-Brevis Computer Serv 36903 522 263 102 Office National des Postes et 36992 427 1229 31 ETISALAT MISR 37492 323 192 74 Orange Tunisie 29571 244 21 11 Cote d'Ivoire Telecom 3741 221 837 183 Internet Solutions 24835 201 146 12 Vodafone Data 15706 171 32 6 Sudatel (Sudan Telecom Co. Lt Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5502 4192 75 China Education and Research 10620 3407 540 157 Telmex Colombia S.A. 22773 3244 2964 143 Cox Communications Inc. 7545 3019 346 154 TPG Telecom Limited 4766 2994 11135 990 Korea Telecom 17974 2725 914 96 PT Telekomunikasi Indonesia 3356 2574 10691 525 Level 3 Communications, Inc. 6389 2508 3687 42 BellSouth.net Inc. 39891 2473 129 7 SaudiNet, Saudi Telecom Compa 20940 2241 888 1608 Akamai International B.V. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 10620 3407 3250 Telmex Colombia S.A. 22773 3244 3101 Cox Communications Inc. 7545 3019 2865 TPG Telecom Limited 17974 2725 2629 PT Telekomunikasi Indonesia 6389 2508 2466 BellSouth.net Inc. 39891 2473 2466 SaudiNet, Saudi Telecom Compa 3356 2574 2049 Level 3 Communications, Inc. 4766 2994 2004 Korea Telecom 18566 2213 1936 MegaPath Corporation 9829 2214 1899 National Internet Backbone Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 8655 UNALLOCATED 1.3.3.0/24 4134 No.31,Jin-rong Stree 30662 UNALLOCATED 8.2.129.0/24 3356 Level 3 Communicatio 47092 UNALLOCATED 8.8.204.0/24 16410 The Reynolds and Rey 53506 UNALLOCATED 8.17.102.0/23 3356 Level 3 Communicatio 46467 UNALLOCATED 8.19.192.0/24 46887 Lightower Fiber Netw 18985 UNALLOCATED 8.21.68.0/22 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.122.0/24 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.124.0/24 3356 Level 3 Communicatio 27205 UNALLOCATED 8.38.16.0/21 3356 Level 3 Communicatio 15347 UNALLOCATED 8.224.147.0/24 12064 Cox Communications I Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.226.112.0/20 62788 >>UNKNOWN<< 23.249.144.0/20 40430 colo4jax, LLC 23.249.144.0/21 40430 colo4jax, LLC 23.249.152.0/21 40430 colo4jax, LLC 27.100.7.0/24 56096 >>UNKNOWN<< 31.170.96.0/23 23456 32bit Transition AS 31.217.248.0/21 44902 COVAGE NETWORKS SASU 37.46.8.0/23 13768 Peer 1 Network (USA) Inc. 37.46.10.0/23 36351 SoftLayer Technologies Inc. 37.46.14.0/24 36351 SoftLayer Technologies Inc. Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:11 /10:36 /11:98 /12:264 /13:507 /14:1009 /15:1765 /16:12937 /17:7374 /18:12563 /19:25583 /20:37612 /21:39750 /22:62943 /23:54469 /24:312855 /25:541 /26:580 /27:382 /28:16 /29:16 /30:9 /31:0 /32:21 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 22773 2435 3244 Cox Communications Inc. 39891 2432 2473 SaudiNet, Saudi Telecom Compa 18566 2115 2213 MegaPath Corporation 6389 1553 2508 BellSouth.net Inc. 30036 1473 1656 Mediacom Communications Corp 6983 1344 1697 EarthLink, Inc. 10620 1285 3407 Telmex Colombia S.A. 34984 1209 1912 TELLCOM ILETISIM HIZMETLERI A 11492 1134 1219 CABLE ONE, INC. 31148 960 1041 Freenet Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1645 2:701 4:100 5:2037 6:25 8:1409 12:1803 13:28 14:1550 15:23 16:2 17:57 18:19 20:48 23:1323 24:1740 27:2129 31:1681 32:54 33:2 34:4 35:5 36:192 37:2223 38:1122 39:22 40:74 41:2894 42:365 43:1615 44:36 45:1520 46:2338 47:63 49:1028 50:816 52:33 54:93 55:7 56:8 57:44 58:1414 59:822 60:514 61:1762 62:1448 63:1918 64:4408 65:2189 66:4032 67:2138 68:1078 69:3244 70:1035 71:463 72:1991 74:2548 75:356 76:407 77:1382 78:1259 79:803 80:1339 81:1356 82:845 83:650 84:780 85:1482 86:454 87:1042 88:540 89:1900 90:167 91:5988 92:861 93:2302 94:2179 95:2236 96:473 97:352 98:909 99:45 100:79 101:851 103:8953 104:2188 105:73 106:358 107:1136 108:635 109:2122 110:1223 111:1519 112:859 113:1101 114:892 115:1512 116:1472 117:1347 118:1976 119:1494 120:506 121:1155 122:2129 123:1853 124:1563 125:1736 128:707 129:369 130:389 131:1272 132:589 133:169 134:451 135:119 136:344 137:248 138:1539 139:190 140:247 141:456 142:638 143:727 144:571 145:147 146:798 147:612 148:1288 149:446 150:621 151:811 152:569 153:271 154:473 155:906 156:453 157:446 158:342 159:1057 160:420 161:674 162:2209 163:493 164:706 165:1086 166:312 167:889 168:1331 169:545 170:1502 171:261 172:357 173:1557 174:705 175:759 176:1511 177:3933 178:2341 179:1076 180:2022 181:1598 182:1874 183:656 184:770 185:5035 186:3049 187:1860 188:2075 189:1706 190:7525 191:1211 192:8713 193:5709 194:4311 195:3696 196:2238 197:1109 198:5484 199:5545 200:6682 201:3504 202:9848 203:9243 204:4567 205:2746 206:3032 207:3022 208:4004 209:3968 210:3748 211:2008 212:2684 213:2179 214:842 215:73 216:5763 217:1879 218:743 219:542 220:1631 221:808 222:639 223:861 End of report

1 0

Re: Ransom DDoS attack - need help!
by Anne Mitchell 04 Dec '15

04 Dec '15

Sorry this is so late, I get NANOG in Digest Mode... > I would really appreciate help in a few areas (primarily with certain > provider contacts/intros) so we can execute our strategy (which I can't > reveal here for obvious reasons). If you email me off-list with a > name/email that you've previously used on-list, I will reply from my real > email. > > Alternatively, if you can post your experiences on-list with large scale > high profile ransom DDoS attacks, I'd really appreciate it! Please contact me offlist, and I will introduce you to the person who says the below - they are from $ENORMOUS-ESP, and were deeply involved in the efforts during last year's rounds of ransom DDoSs which saw many different targets coordinating in fending off the attacks (and working with the FBI). The basecamp group to which he refers is the group of all of the different NOC and architect folks from the various companies, who strategized together, and all of their info is still there. I'm familiar with this all as I was part of the coordination efforts, as so many of the targets also happened to be customers of ours and, you know, lawyer. ;-) He says: "I'm happy to invite him to the basecamp if he wants access, just need his email. Otherwise, feel free to share with him that others ended up using prolexic OR whatever the other large provider is out there. that seems to be the universal solution if they don't want to buy gear and roll their own solution. Amazon and Google cloud environments aren't impervious from this stuff, but they are getting better, and using some of the same technology." --- Anne Anne P. Mitchell, Attorney at Law CEO/President, SuretyMail Email Reputation Certification Is Email You Send Being Junked? Get to the Inbox Using Your Own Mail System! http://www.SuretyMail.com/ http://www.SuretyMail.eu/ "Email marketing is the one place where it's better to ask permission than forgiveness." - Me Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law) Member, California Bar Cyberspace Law Committee Member, Colorado Cybersecurity Consortium Ret. Professor of Law, Lincoln Law School of San Jose 303-731-2121 | amitchell(a)isipp.com | @AnnePMitchell Facebook/AnnePMitchell | LinkedIn/in/annemitchell

1 0

Re: Staring Down the Armada Collective
by dennis 04 Dec '15

04 Dec '15

I agree Protonmail took a stance and believe many others can learn from their experience. But let's not over simplify the problem. According to their blogs the attacks were over 100G and went on for hours at a time over several days. Attacks can go on for days and months. Protonmail found themselves up against varying attack tactics and ultimately took a defense in depth approach to mitigate the attack. Null routing original ip completes the attack, game over , sever is down. Granted this can help prevent colateral damages. Combined with proxies can work well for dns redirect to route through cloud scrubbing but these solutions can add latency and impact legitimate traffic also. With redirection there is also the complexity of TLS/SSL (certificate management, privacy, etc.) And then you must also consider ip based (non proxied) targets. These dns redirect/proxy methods don't handle ip based attack targets and cause the need to swing ip prefixes via bgp. Bottom line, attackers can impact the infrastructure by varying their tactics and the approach should be well thought out and multilayered. Sent via the Samsung GALAXY S® 5, an AT&T 4G LTE smartphone -------- Original message -------- From: Lyndon Nerenberg <lyndon(a)orthanc.ca> Date: 12/4/2015 12:14 AM (GMT-05:00) To: North American Network Operators' Group <nanog(a)nanog.org> Subject: Re: Staring Down the Armada Collective On Dec 3, 2015, at 6:28 PM, Lyndon Nerenberg <lyndon(a)orthanc.ca> wrote: > Are we perhaps, finally, reaching the cusp where everyone has realized that if we all, collectively, tell the rodents to f*** off, they just might? I should also mention that, despite their bluster, they can't keep it up for more than half an hour. By then, the upstream networks have figured it out and have null routed anything of consequence - far upstream. Meanwhile, back haul your traffic in via a private network and they won't be able to do shit to you. (E.g. the standard Cloudflare model.) They are not as smart as they make themselves out to be. Don't let fear drive your decisions. --lyndon

1 0

Netflow parameters and data that comes from CDNs
by Jean-Francois Mezei 04 Dec '15

04 Dec '15

Hopefully this should be a simple question ... (Note: Akamai used as a generic CDN name in the context of this email and could be any CDN provider) Context: regulatory filings where wireless carriers states that zero rating of certain selected streaming music is done based on the "from IP" in packets coming into its network. When a content provider such as jf_music.com (fictitious) makes use of one or more content distribution networks, does the "from IP" in packets belong to the CDN, or to jf_music.com ? (if Akamai uses IPs provided by jf_music, this has inteteresting routing questions). If I setup such a service with Akamai, does Akamai provide me with an authoritative list of IPs that will be generating my traffic in various cities ? Are these IPs stable or would they typically change fairly often as Akamai builds more nodes etc ? And do various CDNs have very different implementations ? And in fictitious case of jf_music.com hiring Akamai, would the Akamai server(s) have a dedicated IP for jf_music in each city (or re-use same IP via anycast) or would the CDN servers use the same IP address to deliver multiple services from totally different content providers ? (Considering BGP routing limits , I have to assume that routing of individual IPs can't be done). I need more of a sanity check on this.

3 2

Staring Down the Armada Collective
by Lyndon Nerenberg 04 Dec '15

04 Dec '15

Typically, businesses hide from admitting they've been hit by drive-by attacks like Armada is trying to pull off. It has been interesting to see the public reaction from the post-Protonmail targets, many of whom are being very visible about 1) admitting they have been hit by the attacks, and 2) making it very clear the Armada crew can f*** right off as far as collecting ransom is concerned. (Also, 3) the amazing support from customers who understand why we are working on putting up defences instead of just paying, and therefore put up with the inevitable downtime as we reconfigure sometimes large chunks of our networks.) The money asked for was a pittance (around USD$6K) for the attacks I'm personally aware of. The targeted were willing to spend far in excess of that to deploy the necessary wall of DDoS protection to keep their services running. If they didn't have it there, already. What does that say for the business model of the botnet handlers? They can't up their ransom demands, because nobody is paying at the current rates. And they can't lower them, for the same reason. And if they change their targets to sites than might potentially pay a few hundred dollars at best, those sites will just shut down anyway. Are we perhaps, finally, reaching the cusp where everyone has realized that if we all, collectively, tell the rodents to f*** off, they just might? Happy Holidays! --lyndon

2 3

Re: Ransom DDoS attack - need help!
by dennis 04 Dec '15

04 Dec '15

Many online business have learned how to deal with these threats. Just recently Protonmail hit the news and found out the hard way whether to pay or NOT. Have a quick read at the log of events for yourself. http://arstechnica.com/security/2015/11/how-extorted-e-mail-provider-got-ba… Sent via the Samsung GALAXY S® 5, an AT&T 4G LTE smartphone -------- Original message -------- From: Roland Dobbins <rdobbins(a)arbor.net> Date: 12/3/2015 3:10 PM (GMT-05:00) To: NANOG <nanog(a)nanog.org> Subject: Re: Ransom DDoS attack - need help! On 3 Dec 2015, at 22:04, Josh Reynolds wrote: > None of those names you just mentioned have made the international news. Of course they have. ----------------------------------- Roland Dobbins <rdobbins(a)arbor.net>

1 0

TWC RR contact off list ?
by Brandon Applegate 04 Dec '15

04 Dec '15

Could someone from TWC RR contact me off-list ? I have an IPv6 / DNS question / request. I’m in Cincinnati, OH and this is residential if that matters. Otherwise - if anyone non-TWC on list can point me to a person/address etc that will let me leap frog frontline support that would be great. There’s no way the support folks are going to know what I’m asking or who/how to escalate. Thanks in advance. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 830B 4802 1DD4 F4F9 63FE B966 C0A7 189E 9EC0 3A74 "SH1-0151. This is the serial number, of our orbital gun."

2 1

Multi-core clamp on ammeter
by Rob Seastrom 03 Dec '15

03 Dec '15

Hi folks, I own a Megger MMC850 which will read amps in a multi-core cable, such as the 10 gauge SEOOW cable one often finds feeding rack PDUs. Datasheet here: http://www.mouser.com/ds/2/263/MMC850_DS_en_V02-15853.pdf Apparently they've been discontinued. Pity. Anyone know of a suitable replacement? I need more. -r

2 1

Re: Ransom DDoS attack - need help!
by Robban 03 Dec '15

03 Dec '15

Hi! This is my first mail to the list. Afaik, the DDoS is "only" a UDP based one (or much of the attack), you should be able to mitigate some to much of the damage caused by filled pipes by blocking incomming UDP trafic at your ISP level. //Robban > * On Thu, Dec 03, 2015 at 03:15:04AM -0500, halp us <throwaway1958251(a)gmail.com> wrote: > > All, > > > > I've been a NANOG member for many years but I'm emailing from an anonymous > > account to reduce the chance of the attackers finding me. > > > > A company that shall remain anonymous has received a ransom DDoS note from > > a very well known group that has been in the news lately. Recently they've > > threatened to carry out a major DDoS attack if they are not paid by a > > deadline which is approaching. They've performed an attack of a smaller > > magnitude to prove that they're serious. > > > > Based on certain details that I can't reveal here, we believe the magnitude > > of the upcoming attack may be in the several hundred Gbps. > > > > I would really appreciate help in a few areas (primarily with certain > > provider contacts/intros) so we can execute our strategy (which I can't > > reveal here for obvious reasons). If you email me off-list with a > > name/email that you've previously used on-list, I will reply from my real > > email. > > > > Alternatively, if you can post your experiences on-list with large scale > > high profile ransom DDoS attacks, I'd really appreciate it! > > > > Thanks -- Robert Soderlund

2 1

SevOne Monitoring
by Paul Stewart 03 Dec '15

03 Dec '15

Hey folks. Looking for feedback from actual customers on SevOne for network monitoring . anyone using them and willing to share thoughts online/offline? They have an appealing system for network monitoring and considering it as a replacement to Solarwinds. Cheers, Paul

6 7