- Test - lists.nanog.org

Re: Death of the Internet, Film at 11
by Larry Sheldon 26 Oct '16

26 Oct '16

On 10/25/2016 08:26, Rich Kulawiec wrote: > On Fri, Oct 21, 2016 at 10:53:42PM -0700, Ronald F. Guilmette wrote: >> Recent events, like the Krebs DDoS and the even bigger OVH DDoS, and >> today's events make it perfectly clear to even the most blithering of >> blithering idiots that network operators, en mass, have to start scanning >> their own networks for insecurities. > > And start monitoring their own networks for *outbound* attacks. Too many > people focus exclusively on inbound attacks, never realizing that every > attack inbound to them is outbound from somewhere else. What is it? 20 years? since the first time I was banned from NANOG for saying that the world would be a nicer place if EVERY true router refused to forward a packet whose SOURCE could not be reached from the port question. (May not be stated clearly, but idea seems simple enough: If the proposed ICMP message would not be routed to the port the packet came from, the best plan is probably to log the event and drop the ICMP and the rogue packet on the floor.) -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

2 1

Other name resolution impacts, as by-products of the Dyn event (e.g. recursive queries limit reached)
by Stefan 25 Oct '16

25 Oct '16

Have not seen any mentions yet, so thought of asking here: has anybody paid attention to other name resolution issues, even outside the Dyn hosted services directly sourced ones? I am talking about what we observed, as result of: https://community.infoblox.com/t5/Support-Central/Support-Central-KB-118-Wh… i.e. "active queue" filled with the Dyn caused event, but leaving thusly no "room", at times, for valid recursive queries, inclusive of internal name resolution, where the SOA sits in another tier (e.g. GSLBs). One possible mitigation for such scenarios is: https://community.infoblox.com/t5/Support-Central/Support-Central-KB-3451-C… Any other related events, on other platforms or configurations? ***Stefan

1 0

Dyn DDoS this AM?
by Chris Grundemann 25 Oct '16

25 Oct '16

Does anyone have any additional details? Seems to be over now, but I'm very curious about the specifics of such a highly impactful attack (and it's timing following NANOG 68)... https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-red… -- @ChrisGrundemann http://chrisgrundemann.com

41 55

Internal vulnerability hosts scan to prevent DDOS
by marcel.duregards＠yahoo.fr 25 Oct '16

25 Oct '16

Dear members, We are a small tier-2 isp and we would like to monitor any potentials risks at our customers ip (we do not want that our AS could be used as a source for DDOS). One of many measures is to scan, on a regular basis, all our IP (PI and PA) to detect any misconfigured customers hosts which could be used for DDOS. The scan should be able to detect misconfigured ddns resolver, ntp server, ssdp host, etc...and any future cool reflection protocol. If any misconfigured hosts is detected, an alarm should raise on an dashboard, and an email send to the customers contact (RIR info), and to our noc. Radar from qrator provide a similar service via email, but we need our own server/VM, with customizables features (like email in differents languages, recall management, acknowledgement request, history (some customers do not take any actions when we inform them, so we would like to have history to put pressure on them)). Does anybody have a solution for that ? Thank in advance for your input. Best regards, -- Marcel

1 0

Fwd: [apops] APRICOT 2017 Call for Presentations
by Mark Tinka 25 Oct '16

25 Oct '16

FYI. Mark. -------- Forwarded Message -------- Subject: [apops] APRICOT 2017 Call for Presentations Date: Mon, 17 Oct 2016 17:34:19 +0600 From: Philip Smith <pfsinoz(a)gmail.com> To: apops(a)apops.net Hi everyone, Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT) 27th February - 2nd March 2017, Ho Chi Minh City, Vietnam https://2017.apricot.net CALL FOR PAPERS =============== The APRICOT 2017 Programme Committee is now seeking contributions for Presentations and Tutorials for the APRICOT 2017 Conference. We are looking for presenters who would: - Offer a technical tutorial on an appropriate topic; - Participate in the technical conference sessions as a speaker; - Convene and chair panel sessions of relevant topics. Please submit on-line at: http://papers.apricot.net/user/login.php?event=48 CONFERENCE MILESTONES --------------------- Call for Papers Opens: Now Draft Program Published: As Papers Confirmed Final Deadline for Submissions: 30 January 2016 Final Program Published: 6 February 2017 Final Slides Received: 13 February 2017 *NOTE THAT REGARDLESS OF DEADLINES SLOTS ARE FILLED ON A FIRST COME, FIRST SERVED BASIS* PROGRAMME MATERIAL ------------------ The APRICOT Conference Programme consists of three parts, these being the Peering Forum, Tutorials, and Conference Tracks. Topics proposed must be relevant to Internet Operations and Technologies: - IPv4 / IPv6 Routing and operations - IPv6 deployment and transition technologies - Internet backbone operations - ISP and Carrier services - IXPs and Peering - Research on Internet Operations and Deployment - Software Defined Networking / Network Function Virtualisaton - Network security issues (NSP-SEC, DDoS, Anti-Spam, Anti-Malware) - DNS / DNSSEC - Internet policy (Security, Regulation, Content Management, Addressing, etc) - Access and Transport Technologies, including Cable/DSL, 3G/LTE, wireless, metro ethernet, fibre, MPLS - Content & Service Delivery (Multicast, Voice, Video, "telepresence", Gaming) and Cloud Computing CfP SUBMISSION -------------- Draft slides for both tutorials and conference sessions MUST be provided with CfP submissions otherwise the Programme Committee will be unable to review the submission. For avoidance of doubt this means that submissions which do not include slides will be rejected immediately. For work in progress, the most current information available at time of submission is acceptable. All draft and complete slides must be submitted in PDF format only. Final slides are to be provided by the specified deadline for publication on the APRICOT website. Prospective presenters should note that the majority of speaking slots will be filled well before the final submission deadline. The PC may, at their discretion, retain a limited number of slots up to the final submission deadline for presentations that are exceptionally timely, important, or of critical operational importance. Every year we turn away submissions, due to filling up all available programme slots before the deadline. Presenters should endeavour to get material into the PC sooner rather than later. Any questions or concerns should be addressed to the Programme Committee by e-mail at: pc-chairs at apricot.net We look forward to receiving your presentation proposals. Mark Tinka & Philip Smith Co-Chairs, APRICOT 2017 Programme Committee -- _______________________________________________ apops mailing list apops(a)apops.net https://mailman.apnic.net/mailman/listinfo/apops Website: www.apops.net .

1 0

Any Google Cloud people on the list?
by Eric Dugas 24 Oct '16

24 Oct '16

Any Google Cloud people or people really used to work with GC/GCI on the list? Please contact me off-list Thanks Eric ![](https://link.nylas.com/open/4sk3yzfka4ymj01d79p0ldahw/local- f01e8d07-1e4e?r=bmFub2dAbmFub2cub3Jn)

1 0

BGP route instabilities
by Matthew Huff 24 Oct '16

24 Oct '16

We saw a slight uptick in routes today (at least since the last time I looked), but a large number of route flaps coming out of the APNIC region. Anyone else notice anything? ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577

3 2

Re: Death of the Internet, Film at 11
by Josh Reynolds 24 Oct '16

24 Oct '16

And then what? The labor to clean up this mess is not free. Who's responsibility is it? The grandma who got a webcam for Christmas to watch the squirrels? The ISP?... No... The vendor? What if the vendor had released a patch to fix the issue months back, and grandma hadn't installed it? Making grandma and auntie Em responsible for the IT things in their house is likely not going to go well. Making the vendor responsible might work for the reputable ones to a point, but won't work for the fly by night shops that will sell the same products under different company names and model names until they get sued or "one starred" into oblivion. Then they just change names and start all over. The ISPs won't do it because of the cost to fix... The labor and potential loss of customers. So once identified, how do you suggest this gets fixed? On Oct 22, 2016 5:11 PM, "Mark Andrews" <marka(a)isc.org> wrote: One way to deal with this would be for ISP's to purchase DoS attacks against their own servers (not necessarially hosted on your own network) then look at which connections from their network attacking these machines then quarantine these connections after a delay period so that attacks can't be corollated with quarantine actions easily. This doesn't require a ISP to attempt to break into a customers machine to identify them. It may take several runs to identify most of the connections associated with a DoS provider. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

10 14

Re: Death of the Internet, Film at 11
by Larry Sheldon 24 Oct '16

24 Oct '16

On 10/23/2016 21:02, David Conrad wrote: > Shut down subnets of your own customers? That was the problem I broke my pick on 20 years or more ago. ISPs absolute refusal to put in filters at no-revenue-expense since it would cost money to install and maintain, and worst of all MIGHT conceivably block revenue-producing-abuse traffic. No matter that paying customers were not able to use the service they were paying for. -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

1 0

Re: Death of the Internet, Film at 11
by Keith Medcalf 24 Oct '16

24 Oct '16

Why would the provider want to do anything? They suuport (make money from) their cudtomers. And the more traffic the send/receive, the more money the providers make. Wouldn't surprise me if the providers were selling access to their customers networks to the botherders so they could make money from both ends. --- Sent from Samsung Mobile <div>-------- Original message --------</div><div>From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> </div><div>Date:2016-10-23 17:20 (GMT-07:00) </div><div>To: </div><div>Cc: nanog(a)nanog.org </div><div>Subject: Re: Death of the Internet, Film at 11 </div><div> </div>

3 2