November 2014 - Test - lists.nanog.org

Re: Incident notification
by Derek Andrew 21 Nov '14

21 Nov '14

While we do not do this ourseleves, I wonder why we would not use Twitter. You can receive SMS, or texts in the app on a smart phone, or look at a webpage. You can make them private and have lots of subscribers. I find Twitter more reliable that our local SMS providers too. d On Fri, Nov 21, 2014 at 9:52 AM, Thijs Stuurman <Thijs.Stuurman(a)is.nl> wrote: > Nanog list members, > > I was looking at some statistic and noticed we are sending out a massive > amount of SMS messages from our monitoring systems. > This left me wondering if there isn't a better (and cheaper) alternative > to this, something just as reliant but IP based. We all have smartphones > these days anyway. > > Therefore my question, what are you using to notify admins of incidents? > > Kind regards / Met vriendelijke groet, > > Thijs Stuurman > > > > [IS Logo] > > > ________________________________ > > IS Group > > Wielingenstraat 8 > > T > > +31 (0)299 476 185 > > info(a)is.nl<mailto:info@is.nl> > > 1441 ZR Purmerend > > F > > +31 (0)299 476 288 > > www.is.nl<http://www.is.nl> > > ________________________________ > > IS Group is ISO 9001:2008, ISO/IEC 27001:2005, ISO 20.000-1:2005, ISAE > 3402 certified. De datacenters zijn PCI DSS en ISO 14001 compliant. > > > -- Copyright 2014 Derek Andrew (excluding quotations) +1 306 966 4808 Information Systems University of Saskatchewan Peterson 120; 54 Innovation Boulevard Saskatoon,Saskatchewan,Canada. S7N 2V3 Timezone GMT-6 Typed but not read.

1 0

Transit, Exchange Point Agreements, and Acceptable Use?
by Paul Ferguson 21 Nov '14

21 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I'll apologize up front if this offends anyone's sensitivities as to what is relevant for list conversation... but one sentence in this Channel4 News story (from what I understand, Channel4 is a very popular news source in the UK) struck me as perhaps in violation of some sort of peering and/or transit agreement. Cable and Wireless: "...even went as far as providing traffic from a rival foreign communications company, handing information sent by millions of internet users worldwide over to spies." The entire article is here: http://www.channel4.com/news/spy-cable-revealed-how-telecoms-firm-worked-wi… My question is this: Do willful actions such as these violate peering, transit, and/or exchange agreements in any way? Thanks, - - ferg - -- Paul Ferguson VP Threat Intelligence, IID PGP Public Key ID: 0x54DC85B2 Key fingerprint: 19EC 2945 FEE8 D6C8 58A1 CE53 2896 AC75 54DC 85B2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlRvUzsACgkQKJasdVTchbKc3AD+OBNKXfYJ/Vjsa2pYL7+ewvql 629C4Ie5jzPgIpAgrToA/1gdeKQX69OHOc79RwsI6uUq99cRoDsHOSf3zTDnwsZy =7Xps -----END PGP SIGNATURE-----

3 4

DDOS, IDS, RTBH, and Rate limiting
by Pavel Odintsov 21 Nov '14

21 Nov '14

Hello, folks! I'm author of fastnetmon, thank you for some PR for my toolkit :) I use this tool for similar type of attacks and we do analyze all traffic from uplinks ports using port mirroring. You can look at this network diagram: https://raw.githubusercontent.com/FastVPSEestiOu/fastnetmon/master/network_… I tried to use netflow many years ago but it's not accurate enough and not so fast enough and produce big overhead on middle class network routers. It's because I wrote this tool and do every packet analyze. It can detect attack in 2 seconds max and call BGP blackhole as quick as thought. It can detect three types of attacks: 1) Speed attack for certain IP (we ban every IP which exceed 1 Gbps) 2) Packet per second attack for certain IP (we ban every IP which exceed 100 000 ppps) 3) And flow flood (very useful mode in networks with big bandwidth/pps per client) FastNetMon can handle 2-3 million of packets per second and ~20Gbps on standard i7 2600 Linux box with Intel 82599 NIC. If you need any help or suggestions you can email me directly or ask via GitHub. Thank you! -- Sincerely yours, Pavel Odintsov

7 13

Clueful Jive Communications Contact?
by chris 21 Nov '14

21 Nov '14

Sorry for the noise but If anyone from Jive Communications is on the list or if anyone has any clueful technical contacts please contact me offlist. I have a very frustrated mutual customer we provide network services to who utilizes Jive for their voice and we can see that there is intermittent reachability problems and all attempts to go through normal support with the information we have provided are going nowhere. Thanks chris

2 3

Level3 rwhois broken
by Suresh Ramasubramanian 21 Nov '14

21 Nov '14

Anybody? Makes it a pain to perform surgical spam blocking when this happens :) suresh@samwise 01:52:24 <~> $ telnet rwhois.level3.net 4321 Trying 209.244.1.179... ^C -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

4 4

Anyone heard from Jared lately?
by Jay Ashworth 20 Nov '14

20 Nov '14

He generally provides same-day service on email, but... Hope all is well. Cheers, -- jra Moderator @ outages -- Sent from my Android phone with K-9 Mail. Please excuse my brevity.

2 1

USA Power Grid compromised?
by JoeSox 20 Nov '14

20 Nov '14

Am I the only Network Admin wondering how this can happen and why its still an issue if it was discovered in 2011? Now I never worked in the Energy field so I am in the dark (pun intended I guess) on how serious the Public utilities address these issues. They should have redundant systems so they can clean (reimage, etc) whatever is there and be done with it?? ref: NSA chief admits China could cripple U.S. power grid, financial networks http://www.zdnet.com/nsa-chief-admits-china-could-cripple-u-s-power-grid-fi… http://abcnews.go.com/US/trojan-horse-bug-lurking-vital-us-computers-2011/s… -- Later, Joe

1 0

Need Godaddy Contact
by Larry Krone 20 Nov '14

20 Nov '14

I have a question that Godaddy support will not answer. My son moved a word press site to Godaddy from another host. Apparently, unbeknowest to him, the original wordpress site was also the email host. The mail was moved from the old server to the new server but the email was never properly set up via the GoDaddy Cpanel Question for a Godaddy Guru. if we set up the email through the cpanel, will it erase any mail currently in the accounts on the linux wordpress machine, or even acknowledge that the exist email is there? Any help would be GREATLY appreciated and Thanks.. Larry

3 2

FYI, Level 3 issues in Dallas
by David Hubbard 20 Nov '14

20 Nov '14

We have some customers unable to access their websites, seeing this on the way to them: 4 ae-0-11.bar2.Tampa1.Level3.net (4.69.137.110) 0.343 ms 0.423 ms 0.406 ms 5 ae-12-12.ebr1.Dallas1.Level3.net (4.69.137.118) 23.940 ms 23.470 ms 23.426 ms 6 ae-71-71.csw2.Dallas1.Level3.net (4.69.151.137) 24.026 ms ae-81-81.csw3.Dallas1.Level3.net (4.69.151.149) 24.007 ms ae-61-61.csw1.Dallas1.Level3.net (4.69.151.125) 23.855 ms 7 ae-3-80.edge10.Dallas1.Level3.net (4.69.145.146) 23.361 ms ae-4-90.edge2.Dallas1.Level3.net (4.69.145.203) 23.329 ms ae-1-60.edge2.Dallas1.Level3.net (4.69.145.11) 23.936 ms 8 vlan90.csw4.Dallas1.Level3.net (4.69.145.254) 23.378 ms vlan70.csw2.Dallas1.Level3.net (4.69.145.126) 23.387 ms vlan80.csw3.Dallas1.Level3.net (4.69.145.190) 23.963 ms 9 ae-1-60.edge2.Dallas1.Level3.net (4.69.145.11) 23.357 ms ae-1-60.edge9.Dallas1.Level3.net (4.69.145.16) 22.779 ms ae-4-90.edge2.Dallas1.Level3.net (4.69.145.203) 62.640 ms 10 vlan70.csw2.Dallas1.Level3.net (4.69.145.126) 24.179 ms 23.297 ms 23.403 ms 11 ae-1-60.edge2.Dallas1.Level3.net (4.69.145.11) 65.617 ms ae-2-70.edge2.Dallas1.Level3.net (4.69.145.75) 23.286 ms ae-1-60.edge10.Dallas1.Level3.net (4.69.145.18) 23.553 ms 12 vlan70.csw2.Dallas1.Level3.net (4.69.145.126) 23.303 ms vlan60.csw1.Dallas1.Level3.net (4.69.145.62) 24.027 ms 24.028 ms 13 ae-3-80.edge2.Dallas1.Level3.net (4.69.145.139) 24.018 ms ae-3-80.edge10.Dallas1.Level3.net (4.69.145.146) 23.374 ms ae-4-90.edge2.Dallas1.Level3.net (4.69.145.203) 23.342 ms 14 vlan90.csw4.Dallas1.Level3.net (4.69.145.254) 24.068 ms vlan70.csw2.Dallas1.Level3.net (4.69.145.126) 23.361 ms 23.348 ms 15 ae-1-60.edge2.Dallas1.Level3.net (4.69.145.11) 24.023 ms ae-1-60.edge9.Dallas1.Level3.net (4.69.145.16) 22.740 ms ae-4-90.edge10.Dallas1.Level3.net (4.69.145.210) 23.963 ms 16 vlan80.csw3.Dallas1.Level3.net (4.69.145.190) 23.420 ms vlan70.csw2.Dallas1.Level3.net (4.69.145.126) 23.400 ms vlan60.csw1.Dallas1.Level3.net (4.69.145.62) 25.317 ms 17 ae-2-70.edge10.Dallas1.Level3.net (4.69.145.82) 23.985 ms ae-3-80.edge2.Dallas1.Level3.net (4.69.145.139) 23.476 ms ae-3-80.edge9.Dallas1.Level3.net (4.69.145.144) 51.762 ms 18 vlan60.csw1.Dallas1.Level3.net (4.69.145.62) 23.416 ms vlan90.csw4.Dallas1.Level3.net (4.69.145.254) 24.062 ms vlan60.csw1.Dallas1.Level3.net (4.69.145.62) 24.051 ms 19 ae-3-80.edge9.Dallas1.Level3.net (4.69.145.144) 44.798 ms ae-3-80.edge10.Dallas1.Level3.net (4.69.145.146) 22.856 ms ae-1-60.edge10.Dallas1.Level3.net (4.69.145.18) 22.891 ms 20 vlan80.csw3.Dallas1.Level3.net (4.69.145.190) 23.433 ms vlan60.csw1.Dallas1.Level3.net (4.69.145.62) 25.333 ms vlan70.csw2.Dallas1.Level3.net (4.69.145.126) 23.367 ms 21 ae-2-70.edge2.Dallas1.Level3.net (4.69.145.75) 23.475 ms ae-4-90.edge9.Dallas1.Level3.net (4.69.145.208) 23.476 ms ae-1-60.edge9.Dallas1.Level3.net (4.69.145.16) 64.753 ms 22 vlan80.csw3.Dallas1.Level3.net (4.69.145.190) 24.008 ms 24.043 ms vlan90.csw4.Dallas1.Level3.net (4.69.145.254) 23.508 ms 23 ae-3-80.edge2.Dallas1.Level3.net (4.69.145.139) 23.505 ms ae-3-80.edge9.Dallas1.Level3.net (4.69.145.144) 23.958 ms ae-4-90.edge9.Dallas1.Level3.net (4.69.145.208) 24.058 ms 24 vlan70.csw2.Dallas1.Level3.net (4.69.145.126) 23.429 ms vlan90.csw4.Dallas1.Level3.net (4.69.145.254) 23.623 ms 25.547 ms 25 ae-2-70.edge10.Dallas1.Level3.net (4.69.145.82) 23.491 ms ae-3-80.edge9.Dallas1.Level3.net (4.69.145.144) 23.551 ms ae-1-60.edge2.Dallas1.Level3.net (4.69.145.11) 24.078 ms 26 vlan60.csw1.Dallas1.Level3.net (4.69.145.62) 24.472 ms 24.144 ms 24.080 ms 27 ae-1-60.edge10.Dallas1.Level3.net (4.69.145.18) 28.121 ms ae-3-80.edge10.Dallas1.Level3.net (4.69.145.146) 22.848 ms ae-4-90.edge9.Dallas1.Level3.net (4.69.145.208) 24.090 ms 28 vlan60.csw1.Dallas1.Level3.net (4.69.145.62) 23.509 ms 24.056 ms vlan80.csw3.Dallas1.Level3.net (4.69.145.190) 23.522 ms 29 ae-2-70.edge2.Dallas1.Level3.net (4.69.145.75) 24.161 ms 24.153 ms ae-4-90.edge9.Dallas1.Level3.net (4.69.145.208) 24.130 ms 30 vlan70.csw2.Dallas1.Level3.net (4.69.145.126) 23.606 ms 23.482 ms vlan80.csw3.Dallas1.Level3.net (4.69.145.190) 23.580 ms

5 6

Brian Krebs' new book is out.
by Roland Dobbins 20 Nov '14

20 Nov '14

This is an important book - well worth your time, and, more importantly, accessible to non-specialists (such as BDMs): <http://www.amazon.com/Spam-Nation-Organized-Cybercrime--Epidemic-ebook/dp/B…> <http://www.amazon.com/Spam-Nation-Organized-Cybercrime--Epidemic/dp/1402295…> It's not about spam, per se. It's about the global underground economy, and includes a lot of insight into internecine warfare amongst online criminals, including DDoS attacks with huge collateral damage footprints; and also talks about the origins of the Blue Security fiasco and subsequent DDoS, DDoS attacks against Spamhaus, etc. ----------------------------------- Roland Dobbins <rdobbins(a)arbor.net>

2 1