February 2014 - Test - lists.nanog.org

Re: Filter NTP traffic by packet size?
by Harry Hoffman 27 Feb '14

27 Feb '14

Most of what I've seen are reset configs on network gear, standalone devices (printers), and the occasional win 98 box with network addons. We put blocks in place for ntp, SNMP for a short time to get things under control. Chargen was so small it was easier to just alert folks directly. HTH. Cheers, Harry On Feb 26, 2014 5:33 PM, Valdis.Kletnieks(a)vt.edu wrote: > > On Wed, 26 Feb 2014 11:44:55 -0600, Brandon Galbraith said: > > > Blocking chargen at the edge doesn't seem to be outside of the realm of > > possibilities. > > What systems are (a) still have chargen enabled and (b) common enough to make > it a viable DDoS vector? Just wondering if I need to go around and find > users of mine that need to be smacked around with a large trout....

1 0

Verizon FIOS and DSL issues in North Texas Area
by Joseph Jackson 25 Feb '14

25 Feb '14

Hey list, Been seeing issues hitting youtube/wikipedia and other random websites from the north texas area when taking Verizon FIOS and DSL. Haven't been able to narrow it down to any traceroutes or pings as they all seem to be OK. Have reports from other Verizon customers seeing the same issues yesterday and today. Thanks Joseph

1 0

Verizon GGC Node
by stuart clark 25 Feb '14

25 Feb '14

Does anyone know how i can connect someone at Verizon in regards to their GGC node i would like to check routing to: 63.88.73.81 (81.73.88.63.ashburn.google-ggc.verizon.com.) NLNOG RING ring-ping script comes back with 91 out of 243 nodes (~37% reachability). That’s somewhat centered around Europe & North America. In contrast, any other address I’d usually see 99% reachability from the NLNOG RING. SC.

2 1

Atlanta - Patch Cables
by Bobby Lacey 25 Feb '14

25 Feb '14

In Atlanta doing an install for a client this weekend and it appears that the fiber/ethernet patch cables won't be delivered in time from supplier. Would anyone know of a good resource for patch cables (both fiber and ethernet) in the metro area? Just wondering if there are any other resources for these? Frys? Offlist please. Thank you! Bobby

2 1

Re: out of band management gear
by Larry Sheldon 25 Feb '14

25 Feb '14

On 2/24/2014 7:59 AM, Vinny_Abello(a)Dell.com wrote: > Dell - Internal Use - Confidential You sent me this by mistake. I have deleted all of the instances of it that know of. Why does the NANOG forwarder forward these things? -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Miami Dade County Public School VPN
by Mario Eirea 24 Feb '14

24 Feb '14

Will someone in MDCPS ITS please contact me off list regarding serious VPN disconnection issues that have been plaguing us for the past week? Thank you, Mario Eirea IT Department Layer 8 Solutions 7701 W 26th Ave Unit 2 Hialeah, FL 33016-5603 25.892545°, -80.335783° U.S.A., Earth , Solar System, Milky Way, Local Group, Universe [https://charterschoolit.com/1up_micro.png] [http://charterschoolit.com/layer8_micro.png]

1 0

The somewhat illegal fix for NTP attacks
by Baldur Norddahl 24 Feb '14

24 Feb '14

Hi The following would probably be illegal so do not actually do this. But what if... there are just 4 billion IPv4 addresses. Scanning that address-space for open NTP is trivially done in a few hours. Abusing these servers for reflection attack is as trivial, hence the problem. How can we get the responsible parties to fix their NTP servers? Answer: DDoS them. With their own service. Or it could be a DDoS defense. As a victim of an ongoing NTP reflection attack, you know exactly the IP-addresses of the vulnerable NTP servers used to attack you. Make them stop by sending back forged NTP packets, so they use up their available bandwidth to DDoS each other instead of you. This could even be automated. If you let them attack their next-hop as discovered by traceroute, it might not even be illegal or harmful. They will only bring down their own link, do no more harm to the internet at large and they can fix it by stopping the NTP service. If they are part of an ongoing DDoS attack it is just self defence to shut them down in the least harmful way possible. Regards, Baldur

6 5

out of band management gear
by Hank Disuko 24 Feb '14

24 Feb '14

Hi folks, I wonder if anyone has good experiences to share with out-of-band hardware? I'm looking for a good OOB hardware vendor. I need to manage my routers/switches/firewalls in a datacenter located overseas, and I'm looking to setup a good serial console server via an OOB link. I've been looking at Lantronix, OpenGear, Raritan...but they all seem to have the same basic features. I'm having trouble really differentiating them. I'm interested in analog modem, cellular options for my OOB link. Or even a secondary internet circuit either wired or wifi if the DC has that option available. Any good suggestions or experiences with a current OOB solution out there? What are you doing for your OOB management? thanks,Hank

17 17

Re: Filter NTP traffic by packet size?
by Brandon Butterworth 24 Feb '14

24 Feb '14

> > What is the business model for the IX? Unauthorized filtering of > > incoming traffic risks collateral damage and outing exchange members > > seems problematic. > > I never proposed for them to filter. What is missing is filtering at IXP not by IXP. Most transits have blackhole communities so you can drop the DoS through them but peers usually do not. You end up shutting peering so your transit will drop it for you, not ideal. We could agree per peer to do the same but with route servers and lots of peers a standard for community and acceptance of it would be handy. Obviously there is risk in doing this with (lots of) peers as they tend to be prefix limited, not address filtered. brandon

1 0

RE: Filter NTP traffic by packet size?
by Phil Bedard 23 Feb '14

23 Feb '14

On Sun, 23 Feb 2014, Chris Laffin wrote: > Ive talked to some major peering exchanges and they refuse to take any action. Possibly if the requests come from many peering participants it will be taken more seriously? If only there was more focus on the BCP38 offenders who are the real root cause of this problem, I would be more happy. I would be more impressed if the IXes would start to use their sFlow capabilities to find out what IX ports the NTP queries are coming to backtrace the traffic to the BCP38 offendors than try to block the NTP packets resulting from these src address forged queries. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

1 0