February 2012 - Test - lists.nanog.org

UDP port 80 DDoS attack
by Ray Gasnick III 10 Feb '12

10 Feb '12

We just saw a huge flux of traffic occur this morning that spiked one of our upstream ISPs gear and killed the layer 2 link on another becuase of a DDoS attack on UDP port 80. Wireshark shows this appears to be from a compromised game server (call of duty) with source IPs in a variety of different prefixes. Only solution thus far was to dump the victim IP address in our block into the BGP Black hole community with one of our 2 providers and completely stop advertising to the other. Anybody see this recently and have any tips on mitigation, reply on or off list. Thank You, Ray Gasnick III CISSP, Technology Specialist: Network Security & Infrastructure Miles Technologies www.milestechnologies.com<http://www.milestechnologies.com/> Phone: (856) 439-0999 x127 Direct: (856) 793-3821 How am I doing? Email my manager at itmanager(a)milestechnologies.com<mailto:itmanager@milestechnologies.com> Computer Networking – IT Support – Business Software – Website Design – Online Marketing & PR

16 46

Middlebox Report and Thank You!
by Justine Sherry 10 Feb '12

10 Feb '12

Hello NANOG! I emailed you a few months ago asking for help understanding typical middlebox deployments in enterprise networks. 57 of you responded - thank you so much! Several of you asked if I'd share the data post-study; I've put together a brief report on our findings here: http://www.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-24.pdf If you have any questions, comments, or feedback, please don't hesitate to contact me. Thanks again for your help and support for our research! Best, Justine

3 2

10G switchrecommendaton
by Deric Kwok 09 Feb '12

09 Feb '12

Hi all I would like to have 10G switchrecommendaton Ipref software can test around 9.2G but we can have congestion over 6G in single port! Thank you

26 41

Slow IN-ADDR.ARPA responses
by John Levine 09 Feb '12

09 Feb '12

I'm seeing surprisingly slow responses from some of the IN-ADDR servers, like 300ms or more. Are they being attacked by script kiddies of something? R's, John

4 5

BGP history in enterprise?
by Andrey Khomyakov 09 Feb '12

09 Feb '12

Looking for something to keep track of BGP route changes in a large enterprise. Found http://www.ibgplay.org/, but I can't seem to get in touch with them to obtain that free license needed to start the service. Does anyone know of something that would do what bgplay does or alternatively how to get in touch with the ibgplay folks for that license... Thanks, --Andrey

2 1

Firewalls in service provider environments
by Matthew Reath 09 Feb '12

09 Feb '12

All, Looking for some recommendations on firewall placement in service provider environments. I'm of the school of thought that in my SP network I do as little firewalling/packet filtering as possible. As in none, leave that to my end users or offer a "managed" firewall solution where if a customer signs up for the extra service I put him in a VRF or VLAN that is "behind" a firewall and manage that solution for them. Otherwise I don't prefer to have a firewall inline in my service provider network for all customer traffic to go through. I can accomplish filtering of known bad ports on my edge routers either facing my customers or upstream providers. What is the group's thought on this? -Matt -- Matt Reath CCIE #27316 (SP) matt(a)mattreath.com | http://mattreath.com Twitter: http://twitter.com/mpreath

13 19

report botnet C&C?
by Ryan Rawdon 09 Feb '12

09 Feb '12

Assuming it is not a futile/wasted effort, where is the current best place/resource to report an active botnet C&C to?

6 5

RoadRunner/Adelphia AS14065 contact
by chk 09 Feb '12

09 Feb '12

If there is a Roadrunner contact monitoring the list can you please contact me off list regarding a routing issue from ns1/2.adelphia.net Thanks.

3 2

2012.02.08 NANOG54 day 3 morning session notes
by Matthew Petach 08 Feb '12

08 Feb '12

I've posted my notes from this morning's session at http://kestrel3.netflight.com/2012.02.08-nanog54-morning-session.txt I wonder if perhaps we don't keep asking for NEBS compliance just because we don't have another easy acronym to put on the RFQs that represents what *our* industry needs, vs the telco industry? Thanks again for another awesome NANOG! Matt

2 1

remote participation - IETF sidr wg interim meeting
by Murphy, Sandra 08 Feb '12

08 Feb '12

A WebEx session has been arranged for remote participation in the interim sidr meeting Thu 9 Mar. Below is the WebEx announcement of the meeting. --Sandy ======================================================= The IETF SIDR co-chairs invite you to attend this online meeting. Topic: IETF WebEx Date: Thursday, February 9, 2012 Time: 9:00 am, Pacific Standard Time (San Francisco, GMT-08:00) Meeting Number: 969 770 530 Meeting Password: (This meeting does not require a password.) ------------------------------------------------------- To join the online meeting (Now from mobile devices!) ------------------------------------------------------- 1. Go to https://workgreen.webex.com/workgreen/j.php?ED=190625237&UID=0&RT=MiM0 2. If requested, enter your name and email address. 3. If a password is required, enter the meeting password: (This meeting does not require a password.) 4. Click "Join". To view in other time zones or languages, please click the link: https://workgreen.webex.com/workgreen/j.php?ED=190625237&UID=0&ORT=MiM0 ------------------------------------------------------- To join the audio conference only ------------------------------------------------------- To receive a call back, provide your phone number when you join the meeting, or call the number below and enter the access code. Call-in toll-free number (US/Canada): 1-877-668-4490 Call-in toll number (US/Canada): 1-408-792-6300 Global call-in numbers: https://workgreen.webex.com/workgreen/globalcallin.php?serviceType=MC&ED=19… Toll-free dialing restrictions: http://www.webex.com/pdf/tollfree_restrictions.pdf Access code:969 770 530 ------------------------------------------------------- For assistance ------------------------------------------------------- 1. Go to https://workgreen.webex.com/workgreen/mc 2. On the left navigation bar, click "Support". You can contact support at: amorris(a)amsl.com 1-510-492-4081 To add this meeting to your calendar program (for example Microsoft Outlook), click this link: https://workgreen.webex.com/workgreen/j.php?ED=190625237&UID=0&ICS=MI&LD=1&… The playback of UCF (Universal Communications Format) rich media files requires appropriate players. To view this type of rich media files in the meeting, please check whether you have the players installed on your computer by going to https://workgreen.webex.com/workgreen/systemdiagnosis.php. Sign up for a free trial of WebEx http://www.webex.com/go/mcemfreetrial http://www.webex.com CCP:+14087926300x969770530# IMPORTANT NOTICE: This WebEx service includes a feature that allows audio and any documents and other materials exchanged or viewed during the session to be recorded. By joining this session, you automatically consent to such recordings. If you do not consent to the recording, discuss your concerns with the meeting host prior to the start of the recording or do not join the session. Please note that any such recordings may be subject to discovery in the event of litigation.

1 0