- Test - lists.nanog.org

Public Subnet re-assignments
by Scott 26 Jun '19

26 Jun '19

First, sorry if this is a bit of a noob question. I'm trying to find a way of preventing a slew of traffic to an IP, or IP's, when I join two /30 public subnets to a /29. It appears that while the ranges are /30 someone is trying to brute-force the network and/or broadcast addresses for the ranges. When I change them to be a /29, now the router sees the traffic and starts dropping packets. Are there any suggestions for mitigating this behavior or is it just the nature of the beast? -- 101010

3 6

80.67.75.0/24 (Akamai) announced by Kazakhtelecom
by Eric Dugas 25 Jun '19

25 Jun '19

Got alerts for 80.67.75.0/24 (Akamai) normally announced by Tier1 providers routed by a long AS path from our of our peers: 80.67.75.0/24 AS path: 9002 9198 43727 6762 2914 23454 23454 I, validation-state: unknown 80.67.64.0/19 AS path: 1299 3257 34164 I just got home and it seems Akamai already reacted: 80.67.75.0/24 AS path: 174 2914 23454 23454 AS path: 1299 2914 23454 23454 Less damage (as far as I can see) but what a bad week for BGP so far...

2 1

Re: Public Subnet re-assignments
by Scott Weeks 25 Jun '19

25 Jun '19

--- scott(a)viviotech.net wrote: From: Scott <scott(a)viviotech.net> To your previous question, yes .0 and .3 are unused. Once I change the subnet .3 becomes a usable IP and it's getting hammered with traffic, causing packet loss. -------------------------------------- Is it legitimate traffic or DDoS stuff? scott

1 0

BGP filtering study resources (Was: CloudFlare issues?)
by Job Snijders 25 Jun '19

25 Jun '19

Dear Stephen, On Tue, Jun 25, 2019 at 07:04:12AM -0700, Stephen Satchell wrote: > On 6/25/19 2:25 AM, Katie Holly wrote: > > Disclaimer: As much as I dislike Cloudflare (I used to complain > > about them a lot on Twitter), this is something I am absolutely > > agreeing with them. Verizon failed to do the most basic of network > > security, and it will happen again, and again, and again... > > I used to be a quality control engineer in my career, so I have a > question to ask from the perspective of a QC guy: what is the Best > Practice for minimizing, if not totally preventing, this sort of > problem? Is there a "cookbook" answer to this? > > (I only run edge networks now, and don't have BGP to worry about. If > my current $dayjob goes away -- they all do -- I might have to get > back into the BGP game, so this is not an idle query.) > > Somehow "just be careful and clueful" isn't the right answer. Here are some resources which maybe can serve as a starting point for anyone interested in the problem space: presentation: Architecting robust routing policies pdf: https://ripe77.ripe.net/presentations/59-RIPE77_Snijders_Routing_Policy_Arc… video: https://ripe77.ripe.net/archive/video/Job_Snijders-B._BGP_Policy_Update-201… presentation: Practical Everyday BGP filtering "Peerlocking" pdf: http://instituut.net/~job/NANOG67_NTT_peerlocking_JobSnijders.pdf video: https://www.youtube.com/watch?v=CSLpWBrHy10 RFC 8212 ("EBGP default deny") and why we should ask our vendors like Cisco IOS, IOS XE, NX-OS, Juniper, Arista, Brocade, etc... to be compliant with this RFC: slides 2-14: http://largebgpcommunities.net/presentations/ITNOG3-Job_Snijders_Recent_BGP… skip to the rfc8212 part: https://youtu.be/V6Wsq66-f40?t=854 compliance tracker: http://github.com/bgp/RFC8212 The NLNOG Day in Fall 2018 has a wealth of RPKI related presentations and testimonies: https://nlnog.net/nlnog-day-2018/ Finally, there is the NLNOG BGP Filter Guide: http://bgpfilterguide.nlnog.net/ If you spot errors or have suggestions, please submit them via github https://github.com/nlnog/bgpfilterguide Please let me or the group know should you require further information, I love talking about this topic ;-) Kind regards, Job

4 3

AWS 40/100G wholesale Express-Route ?
by Jérôme Nicolle 25 Jun '19

25 Jun '19

Hello everyone, I was wondering, is there any way to get more than a 10G port for a PNI with AWS customers ? Right now I'm looking at 4 ridiculously expensive X-Cos (on two locations, so that makes 8) to establish a redundant 40Gbps backhaul, where I have 40/100G ports available. How could we deal with that ? Is there an "off-market" offering for higher speed interconnects ? Best regards, -- Jérôme Nicolle +33 6 19 31 27 14

2 1

Cost effective time servers
by David Bass 25 Jun '19

25 Jun '19

What are folks using these days for smaller organizations, that need to dole out time from an internal source?

16 20

Re: CloudFlare issues?
by Scott Weeks 25 Jun '19

25 Jun '19

--- beecher(a)beecher.cc wrote: From: Tom Beecher <beecher(a)beecher.cc> :: Shouldn’t we be working on facts? Nah, this is NANOG... >;-) :: But this industry is one big ass glass house. What’s that :: thing about stones again? We all have broken windows? :) scott

1 0

Russian Anal Probing + Malware
by Ronald F. Guilmette 24 Jun '19

24 Jun '19

https://twitter.com/GreyNoiseIO/status/1129017971135995904 https://twitter.com/JayTHL/status/1128718224965685248 Friday Questionaire: Is there anybody on this list who keeps firewall logs and who DOESN'T have numerous hits recorded therein from one or more of the following IP addresses? 80.82.64.21 scanner29.openportstats.com 80.82.70.2 scanner8.openportstats.com 80.82.70.198 scanner21.openportstats.com 80.82.70.216 scanner13.openportstats.com 80.82.78.104 scanner151.openportstats.com 89.248.160.132 scanner15.openportstats.com 89.248.162.168 scanner5.openportstats.com 89.248.168.62 scanner1.openportstats.com 89.248.168.63 scanner2.openportstats.com 89.248.168.73 scanner3.openportstats.com 89.248.168.74 scanner4.openportstats.com 89.248.168.170 scanner17.openportstats.com 89.248.168.196 scanner16.openportstats.com 89.248.171.38 scanner7.openportstats.com 89.248.171.57 scanner20.openportstats.com 89.248.172.18 scanner25.openportstats.com 89.248.172.23 scanner27.openportstats.com 93.174.91.31 scanner10.openportstats.com 93.174.91.34 scanner11.openportstats.com 93.174.91.35 scanner12.openportstats.com 93.174.93.98 scanner18.openportstats.com 93.174.93.149 scanner6.openportstats.com 93.174.93.241 scanner14.openportstats.com 93.174.95.37 scanner19.openportstats.com 93.174.95.42 scanner8.openportstats.com 94.102.51.31 scanner31.openportstats.com 94.102.51.98 scanner55.openportstats.com 94.102.52.245 scanner9.openportstats.com NOTE: Dshield has already assigned an 8 rating on their Badness Richter Scale to the specific one of the above addresses that's been poking me personally in recent days: https://www.dshield.org/ipinfo.html?ip=89.248.162.168 https://www.dshield.org/ipdetails.html?ip=89.248.162.168 And the Dshield rating is *just* based on the probing. The addition of malware slinging also puts this whole mess over the top entirely. Oh! And I'll save you all the time looking it up.... 100% of the IPs listed above are on AS202425 "IP Volume, Inc. allegedly of the Seychelles Islands, where the employees and management are no doubt enjoying their luxurious and expansive new corporate headquarters... https://bit.ly/2ZBayc4 Regards, rfg P.S. This is the kind of thing that everybody really should expect when the U.S. Department of Defense takes it upon itself to start up its own little private and unauthorized (cyber)war on Russia, wthout first obtaining the consent of Congress... you know, kinda like that ancient yellowed document that nobody in this country reads anymore says they should. And apparently, the DoD was understandably not anxious to brief even the President about all this... https://www.businessinsider.com/us-officials-hide-russia-cyber-operation-tr… (Not that anybody can really blame them for THAT.)

11 13

Re: CloudFlare issues?
by Max Tulyev 24 Jun '19

24 Jun '19

24.06.19 19:04, Matthew Walster пише: > > > On Mon, 24 Jun 2019, 16:28 Max Tulyev, <maxtul(a)netassist.ua > <mailto:maxtul@netassist.ua>> wrote: > > 1. Why Cloudflare did not immediately announced all their address space > by /24s? This can put the service up instantly for almost all places > Probably RPKI and that being a really bad idea that takes a long time to > configure across every device, especially when you're dealing with an > anycast network. Good idea is to prepare it and provisioning tools before ;) > 2. Why almost all carriers did not filter the leak on their side, but > waited for "a better weather on Mars" for several hours? > > > Probably most did not notice immediately, or trusted their fellow large > carrier peers to fix the matter faster than their own change control > process would accept such a drastic change that had not been fully > analysed and identified. The duration was actually quite low, on a human > scale... Did not notice a lot of calls "I can't access ..."? Really? OK, then another question. Which time from that calls starts to "people who know BGP know about it" is good?

1 0

Cellular backup connections
by Dovid Bender 24 Jun '19

24 Jun '19

Hi All, I finally got around to setting up a cellular backup device in our new POP. I am currently testing with T-Mobile where the cell signal strength is at 80%. The connection is 4G. When SSH'ing in remotely the connection seems rather slow. Ping times seem to be all over the place (for instance now I am seeing: rtt min/avg/max/mdev = 174.142/336.792/555.574/99.599 ms) . Is that just cellular or is that more related to the provider and the location where I am? I could in theory test with VZ and ATT as well. With Verizon they charge $500.00 just to get a public IP and I want to avoid that if possible. Thanks and sorry in advance if this is off topic.

15 19