January 2012 - Test - lists.nanog.org

DNS Attacks
by toor 18 Feb '12

18 Feb '12

Hi list, I am wondering if anyone else has seen a large amount of DNS queries coming from various IP ranges in China. I have been trying to find a pattern in the attacks but so far I have come up blank. I am completly guessing these are possibly DNS amplification attacks but I am not sure. Usually what I see is this: - Attacks most commonly between the hours of 4AM-4PM UTC - DNS queries appear to be for real domains that the DNS servers in question are authoritive for (I can't really see any pattern there, there are about 150,000 zones on the servers in question) - From a range of IP's there will be an attack for approximately 5-10 minutes before stopping and then a break of 30 minutes or so before another attack from a different IP range - Every IP range has been from China I have limited the number of queries that can be done to mitigate this but its messing up my pretty netflow graphs due to the spikes in flows/packets being sent. Does anyone have any ideas what the reasoning behind this could be? I would also be interested to hear from anyone else experiencing this too. I can provide IP ranges from where I am seeing the issue but it does vary a lot between the attacks with the only pattern every time being the source address is located in China. I read a thread earlier, http://seclists.org/nanog/2011/Nov/920, which sounds like the exact thing I am seeing. Thanks

10 9

SSL Certificates
by Michael Carey 16 Feb '12

16 Feb '12

Looking for a recommendation on who to buy affordable and reputable SSL certificates from? Symantec, Thawte, and Comodo are the names that come to mind, just wondering if there are others folks use. Thanks, -- Michael D. Carey KINBER Network Engineer mcarey(a)kinber.org M: 814.777.5027 GV: (814) 205-6773 <https://www.google.com/voice#phones> Skype: KINBER.Mike.Carey KINBER - Keystone Initiative for Network Based Education and Research - www.kinber.org PennREN - Pennsylvania's Research and Education Network

18 22

Wireless Recommendations
by Jim Gonzalez 16 Feb '12

16 Feb '12

Hi, I am looking for a Wireless bridge or Router that will support 600 wireless clients concurrently (mostly cell phones). I need it for a proof of concept. Thanks in advance Jim

8 13

10G switchrecommendaton
by Deric Kwok 09 Feb '12

09 Feb '12

Hi all I would like to have 10G switchrecommendaton Ipref software can test around 9.2G but we can have congestion over 6G in single port! Thank you

26 41

RoadRunner/Adelphia AS14065 contact
by chk 08 Feb '12

08 Feb '12

If there is a Roadrunner contact monitoring the list can you please contact me off list regarding a routing issue from ns1/2.adelphia.net Thanks.

3 2

Hijacked Network Ranges
by Kelvin Williams 06 Feb '12

06 Feb '12

Greetings all. We've been in a 12+ hour ordeal requesting that AS19181 (Cavecreek Internet Exchange) immediately filter out network blocks that are being advertised by ASAS33611 (SBJ Media, LLC) who provided to them a forged LOA. The routes for networks: 208.110.48.0/20, 63.246.112.0/20, and 68.66.112.0/20 are registered in various IRRs all as having an origin AS 11325 (ours), and are directly allocated to us. The malicious hijacking is being announced as /24s therefore making route selection pick them. Our customers and services have been impaired. Does anyone have any contacts for anyone at Cavecreek that would actually take a look at ARINs WHOIS, and IRRs so the networks can be restored and our services back in operation? Additionally, does anyone have any suggestion for mitigating in the interim? Since we can't announce as /25s and IRRs are apparently a pipe dream. -- Kelvin Williams Sr. Service Delivery Engineer Broadband & Carrier Services Altus Communications Group, Inc. "If you only have a hammer, you tend to see every problem as a nail." -- Abraham Maslow

21 34

Please help our simple bgp
by Ann Kwok 04 Feb '12

04 Feb '12

Hello Our router is running simple bgp. "one BGP router, two upstreams (each 100M from ISP A and ISP B) We are getting full feeds tables from them We discover the routes is going to ISP A only even the bandwidth 100M is full Can we set the weight to change to ISP B to use ISP B as preference routes? Can the following configuration work? What suggest to this weight no. too? neighbor 1.2.3.4 description ISP B neighbor 1.2.3.4 remote-as 111 neighbor 1.2.3.4 weight 2000 If this works, how is ISP B upstream connection is down? Can it still be failover to ISP A automatically? If it won't work, Do you have any suggestion? Thank you for your help

7 6

Re: US DOJ victim letter
by Jay Hennigan 02 Feb '12

02 Feb '12

On 1/19/12 1:01 PM, Dave Ellis wrote: > I've also received the emails, I assumed they were fake as our normal > contacts haven't mentioned anything. The body of the email indeed reads like a poorly-executed phish including elements such as "null" and "<personalized code here>" but headers seem legit. -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

25 30

Console Server Recommendation
by Ray Soucy 01 Feb '12

01 Feb '12

What are people using for console servers these days? We've historically used retired routers with ASYNC ports, but it's time for an upgrade. OpenGear seems to have some nice stuff, anyone else? -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-3526 Networkmaine, a Unit of the University of Maine System http://www.networkmaine.net/

26 35

Fiber outage in Miami
by Jimmy Changa 01 Feb '12

01 Feb '12

Was anyone impacted by a botched fiber move in Miami this weekend? I lost 2 pieces of dark fiber for over almost 24 hours due to a fiber move being performed by FiberLight. I'm curious if anyone else was impacted. Sent from mobile device

6 12