February 2014 - Test - lists.nanog.org

looking for feedback on virtual/dedicated server providers in latin/south america/UK
by Carlos Kamtha 18 Feb '14

18 Feb '14

Hi, Just wondering if anyone could share some experiences with server providers specifically in argentina, columbia and costa rica, and pretty much anywhere in the UK region. Please respond offlist. Any feedback would be greatly appreciated. :) Carlos.

2 1

Re: OpenNTPProject.org
by Derek Andrew 18 Feb '14

18 Feb '14

nmap -sU -pU:123 -Pn -n --script=ntp-monlist serverIP On Mon, Jan 13, 2014 at 3:07 PM, Jared Mauch <jared(a)puck.nether.net> wrote: > Greetings, > > With the recent increase in NTP attacks, I wanted to advise the community > of a few things: > > There are about 1.2-1.5 million of these servers out there. > > 1) You can search your IP space to find NTP servers that respond to the > ‘MONLIST’ queries. > > 2) I’ve found some vendors have old embedded versions of NTP including > ILO/Service Processors and other parts of the “internet of things”. > > 3) You want to upgrade NTP, or adjust your ntp.conf to include ‘limited’ > or ‘restrict’ lines or both. (I defer to someone else to be an expert in > this area, but am willing to learn :) ) > > 4) Please prevent packet spoofing where possible on your network. This > will limit the impact of spoofed NTP or DNS (amongst others) packets from > impacting the broader community. > > 5) Some vendors don’t have an easy way to alter the ntp configuration, or > have not or won’t be updating NTP, you may need to use ACLs, firewall > filters, or other methods to block this traffic. I’ve heard of many > routers being used in attacks impacting the CPU usage. > > Take a moment and see if your devices respond to the following > query/queries: > > ntpdc -n -c monlist 10.0.0.1 > ntpdc -n -c loopinfo 10.0.0.1 > ntpdc -n -c iostats 10.0.0.1 > > 6) If you do VMs/Servers and have a template, please make sure that they > do not respond to NTP requests. > > Thanks! > > - Jared > -- Copyright 2014 Derek Andrew (excluding quotations) +1 306 966 4808 Information and Communications Technology University of Saskatchewan Peterson 120; 54 Innovation Boulevard Saskatoon,Saskatchewan,Canada. S7N 2V3 Timezone GMT-6 Typed but not read.

32 63

Telia contact
by Jay Coley 18 Feb '14

18 Feb '14

Hi, If there are any Telia engineers lurking about could you please contact me off-list regarding a routing question? Thanks! --J

1 0

Telia contact
by Jay Coley 18 Feb '14

18 Feb '14

Hi, If there are any Telia engineers lurking about could you please contact me off-list regarding a routing question? Thanks! --J

1 0

[NANOG-announce] ARIN+NANOG on the Road San Diego reminder
by Betty Burke <betty＠nanog.org> 17 Feb '14

17 Feb '14

Colleagues: A reminder note for those who are, or know of someone local, to San Diego; do not delay, ARIN+NANOG on the Road<http://www.cvent.com/events/arin-nanog-on-the-road-san-diego/event-summary-…>is fast approaching. We have a great program <https://www.nanog.org/meetings/road2/home/agenda> planned for the Tuesday, February 28, 2014 at the Handerly Hotel<http://www.cvent.com/events/arin-nanog-on-the-road-san-diego/location-f8a28…>. There is no fee to attend, however registration for the event is requested. We are expecting strong attendance<http://www.cvent.com/events/arin-nanog-on-the-road-san-diego/attendees-f8a2…> and hope to see many NANOGers next week. Be sure to add your name and register<http://www.cvent.com/events/arin-nanog-on-the-road-san-diego/event-summary-…>today. All best. Betty -- Betty Burke NANOG Executive Director 48377 Fremont Boulevard, Suite 117 Fremont, CA 94538 Tel: +1 510 492 4030 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Monday BCP38.info reminder
by Jay Ashworth 17 Feb '14

17 Feb '14

Standard[1] Monday[2] Reminder[3]: DDOS attacks are bad. DDOS attacks that you can't tell where they're coming from are worse. BCP38 helps eliminate the latter, which helps markedly with the former. BCP38 is usually relatively easy to implement. Most of you people know how to do it already, and we'd really like your help in teaching the rest. http://www.bcp38.info If you know something, write something[4]. Cheers, -- jra [1] Until we move 75% up to like 95%, at least. [2] Unless I forget. [3] And apparently we need one; 3 Really Smart Guys *including Ferg* posted on BCP38 this morning, and none promoted the page. [4] Slogan stolen from a much stupider Security Theatre And Paranoia slogan -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

1 0

Amazon network contact
by Blair Trosper 17 Feb '14

17 Feb '14

Could someone from Amazon Web Services contact me off list? You appear to be having connectivity problems on the private network (10.0.0.0/8) at US-EAST-1 between two or more zones, causing dozens of alarms and failures over the last 2-3 hours...however, there is no notation on the status page or any hint whatsoever of the problem. (The alarms are coming from the instance checks on the instances...which is the network...not the status checks...which would be the instance's health inside the PVM virtualization.)

1 0

ddos attack blog
by Cb B 15 Feb '14

15 Feb '14

Good write up, includes name and shame for AT&T Wireless, IIJ, OVH, DTAG and others http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplifica… Standard plug for http://openntpproject.org/ and http://openresolverproject.org/ and bcp38 , please fix/help. For those of you paying attention to the outage list, this is a pretty big deal that has had daily ramification for some very big networks https://puck.nether.net/pipermail/outages/2014-February/date.html In general, i think UDP is doomed to be blocked and rate limited -- tragedy of the commons. But, it would be nice if folks would just fix the root of the issue so the rest of us don't have go there... Regards, CB

8 11

Re: Permitting spoofed traffic [Was: Re: ddos attack blog]
by Larry Sheldon 15 Feb '14

15 Feb '14

On 2/14/2014 12:42 PM, Paul Ferguson wrote: > Taken to the logical extreme, the "right thing" to do is to deny any > spoofed traffic from abusing these services altogether. Since the 1990s I have argued (ineffectively, it turns out) a case that says that sentence can be edited down to good advantage as: > Taken to the logical extreme, the "right thing" to do is to deny any > spoofed traffic. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

2 1

Re: ddos attack blog
by Hal Murray 14 Feb '14

14 Feb '14

> I was being a bit extreme, I don't expect UDP to be blocked and there are > valid uses for NTP and it needs to pass. Can you imagine the trading > servers not having access to NTP? Sure. They could setup internal NTP servers listening to GPS. Would it be as good overall as using external servers? Probably not, but it might be good enough. I doubt if it would be very high on any trading floors list of nasty problems. They could arrange to poke holes through the generic UDP block - whitelist the few known cases where UDP traffic is expected. Would it be a pain to administer? Probably, but I'll bet it could be made to work. -- These are my opinions. I hate spam.

2 1