April 2013 - Test - lists.nanog.org

Tier1 blackholing policy?
by Thomas Schmid 01 May '13

01 May '13

Greetings, I know Tier1s are blackholing traffic all the time :) (de-peering, congestion etc.) but did it became a new role for Tier1s to go from transit provider to transit blocker? We received recently customer complaints stating they can't reach certain websites. Investigation showed that the sites were not reachable via Tier1-T, but fine via Tier1-L. I contacted Tier1-T and the answer was something like "yeah, this is a known phishing site and to protect our customers we blackhole that IP" (btw - it was 2 ASes away from Tier1-T). Huh? If I want to block something there, it should me my decision or that of my country's legal entities by court order and not being decided by some Tier1's intransparent security department. (Not even mentioning words like 'CGN', 'legal', 'net neutrality' or 'censorship') This might be an acceptable policy for a cable provider but not for a Tier1. Haven't seen something like this in many years. Did I miss a pardigm-shift here and has this become a common "service" at Tier1s? Thomas

14 22

Mitigating DNS amplification attacks
by Thomas St-Pierre 01 May '13

01 May '13

Hi! I was wondering if anyone had any experience with dealing with open resolvers as a web hoster? We currently have some 40,000 ip's that respond to DNS in our AS, the majority of which are not "open" but do reply with a referral to the root zones. We've been sending emails to our clients but as the servers are not managed by us, there's not much we can do at that level. Recently we've seen a large increase in the number and volume of DNS amplification DDOS's that are being reflected off of our AS. Just today we've seen at least 6 different attacks with between 4 and 10gbps leaving our AS each time. It's not really causing us issues at the moment because we have the capacity, but I'd hate to be on the receiving side. (and indeed, have been on the receiving side in the past, so I know how much it can suck) Has anyone ever tried mitigating/rate-limiting/etc these attacks in the network before? (vs at the server/application level) We have an Arbor peakflow device, but it's not really geared for this scenario I find. It will detect the outgoing attack via the flows, but all we can really do is null-route the victims ip in our AS. Ideally we would need a way to rate-limit DNS packets based on source ip. Maybe a linux box that handles dropping packets from the same source-ip over 1000/sec with some policy-based routing sending the DNS traffic to it? Does such a box exist already? If anyone has any ideas or suggestions, then by all means! There must be a better way to do this, and I'd really like to avoid re-inventing the wheel if it's been invented already. :) Thanks! Thomas

7 10

Comcast Launches IPv6 for Business Customers
by Brzozowski, John 01 May '13

01 May '13

FYI for folks that are interested: http://corporate.comcast.com/comcast-voices/comcast-launches-ipv6-for-busin… John ========================================= John Jason Brzozowski Comcast Cable e) mailto:john_brzozowski@cable.comcast.com w) http://www.comcast6.net =========================================

7 8

"It's the end of the world as we know it" -- REM
by Valdis Kletnieks 01 May '13

01 May '13

I didn't see any mention of this Tony Hain paper: http://tndh.net/~tony/ietf/ARIN-runout-projection.pdf tl;dr: ARIN predicted to run out of IP space to allocate in August this year. Are you ready?

43 97

Andros Island Connectivity?
by Aaron C. de Bruyn 01 May '13

01 May '13

I just had a client drop an interesting requirement on me. They are on Andros Island (Bahamas) for about a year. I'm working on getting an exact address from the adminisphere above me, but all I've been told so far is they are 'near the naval base'. They just called and said "We need internet access yesterday". None of the people on-site are technical, and all their data is accessed via RDP on a server in the United States. Having never been there, I have no idea if it's like downtown San Francisco where the internet grows on trees, or if it's like the Sahara desert which might require dragging your own fiber in on camelback... Does anyone have pointers on who to talk to or how I can get them internet access? -A

10 22

Breakpoint 2013 Call For Papers
by cfp＠ruxcon.org.au 30 Apr '13

30 Apr '13

Breakpoint 2013 Call For Papers Melbourne, Australia, October 24th-25th Intercontinental Rialto http://www.ruxconbreakpoint.com .[x]. Introduction .[x]. The Ruxcon team is pleased to announce Call For Papers for Breakpoint 2013. Breakpoint showcases the work of expert security researchers from around the world on a wide range of topics. This conference is organised by the Ruxcon team and offers a specialised security conference to complement and lead into the larger and more casual Ruxcon weekend conference. Breakpoint caters towards security researchers and industry professionals alike, with a focus on cutting edge security research. Breakpoint presents a great opportunity for our selected speakers to receive a complimentary trip to Australia and experience both the Breakpoint and Ruxcon conferences, not to mention the great weather, awesome parties, and friendly people. Melbourne is a city of many subcultures, personalities and styles. Melbourne has a vibrant arts and music scene, eccentric cafes, intimate bars and restaurants, and is known as Australia's cultural capital. .[x]. Important Dates .[x]. May 1 - Call For Presentations Open August 23 - Call For Presentations Close October 22-23 - Breakpoint Training October 24-25 - Breakpoint Conference October 26-27 - Ruxcon Conference .[x]. Topic Scope .[x]. Topics of interest include, but are not limited to: o Mobile Device Security o Exploitation Techniques o Reverse Engineering o Vulnerability Discovery o Rootkit Development o Malware Analysis o Code Analysis o Virtualisation, Hypervisor Security o Cloud Security o Embedded Device Security o Hardware Security o Telecommunications Security o Wireless Network Security o Web Application Security o Law Enforcement Activities o Forensics o Threat Intelligence o You get the idea .[x]. Submission Guidelines .[x]. In order for us to process your submission we will require the following information: 1. Presentation title 2. Detailed summary of your presentation material 3. Name/Nickname 4. Mobile phone number 5. Brief personal biography 6. Description of any demonstrations involved in presentation 7. Information on where the presentation material has or will be presented before Breakpoint * Preference will be given to presentations that contain original research that will be first presented at Breakpoint. * As a general guideline, Breakpoint presentations are between 45 and 60 minutes, including question time. If you have any questions about submissions, or would like to make a submission, please send an email to bpx(a)ruxconbreakpoint.com .[x]. Speaker Benefits .[x]. Speakers at Breakpoint will be entitled to the following benefits: - A return economy airfare to Melbourne (total cost limit applies) - Three nights accommodation at the Intercontinental Rialto - Complimentary registration for Breakpoint and Ruxcon conferences - Invitation to all Breakpoint and Ruxcon parties - Unlock 'Presented on world's smallest continent' achievement * All speaker benefits apply to a single speaker per submission. .[x]. Contact .[x]. If you have any questions or inqueries, contact us at: * Email: bpx(a)ruxconbreakpoint.com * Twitter: @ruxconbpx

1 0

Re: Tier1 blackholing policy?
by Jared Mauch 30 Apr '13

30 Apr '13

On Apr 30, 2013, at 2:50 PM, bmanning(a)vacation.karoshi.com wrote: > Phone? You mean like Jitsi or Skype? > Fax? > > I'd like to see some numbers to back your assertion of "Typical" restoration > times of days. my vendors deliver software fixes for "BGP" doesn't work in weeks, so I think that the following timeline and process I'm going to outline exceeds their BGP problems. 0 hour - Issue Reported 0-24 hours - triage; send to customer/internal customer to mitigate/remediate 25-48 hours - Customer responds, host taken down if hacked, etc.. 48-96 hours+ - If no response, IP null0'ed per AUP as network security risk 48-96 hours is also where the customer freaks out and quickly fixes their problem to come in compliance with AUP. This is a natural process. Null0 or ACLs don't stay up for days or weeks on end. That doesn't mean this catches 100% of all cases, but many ISPs get a daily report of phishing sites and malware hosted on their network each morning. You can get one too! http://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork You can get a daily ATLAS report from Arbor as well: http://atlas.arbor.net/ (Although I can't get anyone to fix a problem with it, so anyone there can email me if you have the power to fix it). There are other aggregators of data as well, such as SIE. If you don't know the health of your network, take a look. Many folks will email you these reports automatically, or provide you a direct feed (some in realtime, such as SIE). - Jared

1 0

Office 365 broken on ipv6
by Nick Hilliard 30 Apr '13

30 Apr '13

https://outlook.office365.com does not work on ipv6; looks like this has been broken for some while. Can someone from Microsoft please fix? > crumpet:/Users/nick% telnet -6 outlook.office365.com 443 > Trying 2a01:111:f400:1000::9... > telnet: connect to address 2a01:111:f400:1000::9: Connection refused > Trying 2a01:111:f400:8000::2... > telnet: connect to address 2a01:111:f400:8000::2: Connection refused > Trying 2a01:111:f400:9800::6... > telnet: connect to address 2a01:111:f400:9800::6: Connection refused > Trying 2a01:111:f400:9814::12... > telnet: connect to address 2a01:111:f400:9814::12: Connection refused > telnet: Unable to connect to remote host > crumpet:/Users/nick% Nick

9 9

80 km BiDi XFPs
by Frank Bulk 30 Apr '13

30 Apr '13

Is anyone aware of a reputable supplier of 80 km BiDi XFPs? My regular supplier of generics doesn't have an option for us, but I would really like to avoid leasing additional fibers. Frank

10 13

Need someone from telia NOC Ops
by Beavis 29 Apr '13

29 Apr '13

Hi, Can someone from telia.net ops contact me offlist please. thank you, Beavis. $ traceroute www.cnn.com traceroute to www.cnn.com (157.166.249.11), 30 hops max, 60 byte packets 1 190.106.69.113 (190.106.69.113) 16.792 ms 17.686 ms 18.049 ms 2 186.32.189.69 (186.32.189.69) 103.475 ms 103.676 ms 103.796 ms 3 mai-noa-I1-link.telia.net (213.248.72.161) 101.505 ms 101.635 ms 106.750 ms 4 atl-bb1-link.telia.net (80.91.251.28) 106.466 ms atl-bb1-link.telia.net (80.91.245.43) 103.891 ms atl-bb1-link.telia.net (80.91.251.28) 106.578 ms 5 level3-ic-149649-atl-bb1.c.telia.net (80.239.167.74) 88.384 ms 88.397 ms 88.628 ms 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Disclaimer: http://goldmark.org/jeff/stupid-disclaimers/

1 0