October 2011 - Test - lists.nanog.org

Outsourcing DDOS
by samuel.cunningham＠wellsfargo.com 25 Oct '11

25 Oct '11

We are considering using Prolexic to 'defend' our Internet-facing network from DDOS attacks. Anyone have any known issues or word of warnings before we proceed? Chris Cunningham Network Engineering Secure Connectivity 704-427-3557 (Desk) 704-701-6924 (Cell) Samuel.Cunningham(a)Wellsfargo.com<mailto:Samuel.cunningham@wellsfargo.com> [X] This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient. Any review, use, distribution, or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message.

7 12

IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 24 Oct '11

24 Oct '11

The IPv6 version of www.qwest.com has been down for 10 days. Wget shows a 301 to www.centurylink.com, but that also fails. Emails to the nocs at both companies have gone unanswered. Unless HE is deployed in a web browser, this behavior leads to a bad end-user experience. If anyone can prod either of these two companies that would be much appreciated. Frank nagios:/home/fbulk# wget -6 www.qwest.com --2011-08-18 00:32:40-- http://www.qwest.com/ Resolving www.qwest.com... 2001:428:b21:1::20 Connecting to www.qwest.com|2001:428:b21:1::20|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: http://www.centurylink.com/ [following] --2011-08-18 00:32:40-- http://www.centurylink.com/ Resolving www.centurylink.com... 2001:428:b21:1::22 Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:02-- (try: 2) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:25-- (try: 3) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:49-- (try: 4) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. Etc...

5 6

HE.Net 6TO4 relay
by Meftah Tayeb 24 Oct '11

24 Oct '11

hello HE.NET did you drop the 6to4 delegated prefix 192.88.99.0/24 ? if yes please would you drop it from your BGP routing table anounced ? thank you Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6573 (20111025) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

2 2

Juniper DOS/Blackhole question
by Jack Bates 23 Oct '11

23 Oct '11

Considered j-nsp, but this just feels more nanog appropriate. I'm told by one of my NSPs that I'm connected to a juniper. We were dealing with a DOS, and for some reason remote triggered DOS prevention via BGP wasn't working. The NOC said they had to enable multihop to my peering to make it work, otherwise it wouldn't accept the route. This seems strange to me. Any idea why a route would be rejected unless multihop was enabled? Also, any idea why a Juniper couldn't handle a simple 750mbit/s, 1.5Mpps DOS? Don't get me wrong, it could have been more than that. I was just receiving that much of the DOS and my lower end m120 didn't seem to think it an issue, so I'm curious why I was dropping packets on the link to begin with. Interestingly, I have an OC-12 to another NSP who was also dropping after around 1.2Mpps (last time I asked, they said the oc-12 hit a cisco 7600). Jack

4 5

Comcast security please contact me off list
by N Rauhauser 23 Oct '11

23 Oct '11

I do some protective service work, one client is the head of a Washington D.C. NGO that faced a credible death threat last month. Tonight I received information that the source of this threat traced one of the NGO's volunteers to her home address via Comcast IP, and the location is a relatively short drive away from a man who was arrested last month for criminal harassment almost five hundred miles from his home. I have some genuine concerns for the physical safety of this Comcast customer, and I'd like to talk to someone immediately. We've got an annoyed FBI agent who will confirm the back story on this Monday, but the subjects know they're under some sort of investigation and I'm afraid of what might happen if further info leaks over the weekend. This is a junk box for me - nrauhauser at gmail is the address I check regularly.

2 1

Can this bgp work?
by Deric Kwok 23 Oct '11

23 Oct '11

Hello We would like to split our network advertising with same AS no. in different our bgp routers to same or different upstream provider eg: 66.70.0.0/20 in bgpRouterA 67.170.0.0/20 in bgpRouterB 174.70.0.0/20 in bgpRouterC ls it working? Thank you

4 3

Re: Outsourcing DDOS
by Dennis 22 Oct '11

22 Oct '11

Good points Steven. I'd suggest a deep dive on the technologies implemented by the vendor today as times and attack methods have evolved. Many attacks today are not Volumetric or easily detected or mitigated by traditional methods. Stefan Fouant <sfouant(a)shortestpathfirst.net> wrote: >Although a bit dated, I did a pretty exhaustive comparison of offerings >from AT&T, Verizon, Prolexic, and a few others a while back. > >Don't forget there is also the go-it-yourself approach which is always a >fun option, guaranteed to keep you up at night and give you a few >additional gray hairs... > >Let me know if you're interested in the slides... > >Stefan Fouant >JNCIE-SEC, JNCIE-SP, JNCIE-ER, JNCI >Technical Trainer, Juniper Networks > >Follow us on Twitter @JuniperEducate > >On 10/20/2011 4:43 PM, Hank Nussbacher wrote: >> At 09:13 19/10/2011 -0400, samuel.cunningham(a)wellsfargo.com wrote: >>> We are considering using Prolexic to 'defend' our Internet-facing >>> network from DDOS attacks. Anyone have any known issues or word of >>> warnings before we proceed? >> >> Things to check: >> >> - DDOS service caps >> - outage remedy credits >> - service trial period >> - monitoring - you will want some external mutually agreeable monitoring >> service like gomez/compuware. Who pays for it? >> >> Regards, >> Hank >> >> >> >>> Chris Cunningham >>> Network Engineering >>> Secure Connectivity >>> 704-427-3557 (Desk) >>> 704-701-6924 (Cell) >>> Samuel.Cunningham(a)Wellsfargo.com<mailto:Samuel.cunningham@wellsfargo.com> >>> [X] >>> >>> This e-mail, including any attached files, may contain confidential >>> and privileged information for the sole use of the intended recipient. >>> Any review, use, distribution, or disclosure by others is strictly >>> prohibited. If you are not the intended recipient (or authorized to >>> receive information for the intended recipient), please contact the >>> sender by reply e-mail and delete all copies of this message. >> >> > >

1 0

Re: Outsourcing DDOS
by Hank Nussbacher 22 Oct '11

22 Oct '11

At 09:13 19/10/2011 -0400, samuel.cunningham(a)wellsfargo.com wrote: >We are considering using Prolexic to 'defend' our Internet-facing network >from DDOS attacks. Anyone have any known issues or word of warnings >before we proceed? Things to check: - DDOS service caps - outage remedy credits - service trial period - monitoring - you will want some external mutually agreeable monitoring service like gomez/compuware. Who pays for it? Regards, Hank >Chris Cunningham >Network Engineering >Secure Connectivity >704-427-3557 (Desk) >704-701-6924 (Cell) >Samuel.Cunningham(a)Wellsfargo.com<mailto:Samuel.cunningham@wellsfargo.com> >[X] > >This e-mail, including any attached files, may contain confidential and >privileged information for the sole use of the intended recipient. Any >review, use, distribution, or disclosure by others is strictly prohibited. >If you are not the intended recipient (or authorized to receive >information for the intended recipient), please contact the sender by >reply e-mail and delete all copies of this message.

2 1

OT: ISPs in Brazil and Chile
by Jeff Cartier 22 Oct '11

22 Oct '11

Hi Group, A little off topic, but I was looking for a recommendation on an ISP in both Brazil and Chile. Thanks!! __________________________________________________________________ DISCLAIMER: This e-mail contains proprietary information some or all of which may be legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail. If you are not the intended recipient you must not use, disclose, distribute, copy, print, or rely on this e-mail. This message has been scanned for the presence of computer viruses, Spam, and Explicit Content.

3 2

Frontier IPv6 website unavailable
by Chris Curwick 22 Oct '11

22 Oct '11

When visiting www.frontier.com using an ipv6 tunnel from HE I am getting the following result: Service Unavailable A quick poll of my peers without ipv6 shows the site rendering. It looks like this is limited just to the IPv6 side.

2 1