March 2014 - Test - lists.nanog.org

Hackers hijack 300, 000-plus wireless routers, make malicious changes | Ars Technica
by Jay Ashworth 04 Mar '14

04 Mar '14

http://arstechnica.com/security/2014/03/hackers-hijack-300000-plus-wireless… Is there any valid reason not to black hole those /32s on the back bone? -- Sent from my Android phone with K-9 Mail. Please excuse my brevity.

13 15

Re: Hackers hijack 300, 000-plus wireless routers, make malicious changes | Ars Technica
by Jay Ashworth 04 Mar '14

04 Mar '14

----- Original Message ----- > From: "Andrew Latham" <lathama(a)gmail.com> > > you wanted to say "blackhole those 5.45.72.0/22 and 5.45.76.0/22", > Jay is right, it is just the /32s at the moment... Dropping the /22s > could cause other sites to be blocked. > > inetnum: 5.45.72.0 - 5.45.75.255 > netname: INFERNO-NL-DE > descr: ******************************************************** > descr: * We provide virtual and dedicated servers on this Subnet. > descr: * > descr: * Those services are self managed by our customers > descr: * therefore, we are not using this IP space ourselves > descr: * and it could be assigned to various end customers. > descr: * > descr: * In case of issues related with SPAM, Fraud, > descr: * Phishing, DDoS, portscans or others, > descr: * feel free to contact us with relevant info > descr: * and we will shut down this server: abuse(a)3nt.com > descr: ******************************************************** > country: NL > admin-c: TNTS-RIPE > tech-c: TNTS-RIPE > status: ASSIGNED PA > mnt-by: MNT-3NT > mnt-routes: serverius-mnt > source: RIPE # Filtered Though, for the record, I see I have ssh bruteforce in my logs this week from 5.39.223.8; what it is with 5/8 this month? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

1 0

ISP inbound failover without BGP
by Eric A Louie 04 Mar '14

04 Mar '14

This may sound like dumb question, but... I'm used to asking those. Here's the scenario Another ISP, say AT&T, is the primary ISP for a customer. Customer has publicly accessible servers in their office, using the AT&T address space. I am the customer's secondary ISP. Now, if AT&T link fails, I can provide the customer outbound Internet access fairly easily. So they can surf and get to the Internet. What about the publicly accessible servers that have AT&T addresses, though? One thought I had was having them use Dynamic DNS service. Are there any other solutions, short of using BGP multihoming and having them try to get their own ASN and IPv4 /24 block? It looks like a few router manufacturers have devices that might work, but it looks like a short DNS TTL (or Dynamic DNS) needs to be set so when the primary ISP fails, the secondary ISP address is advertised.

13 16

AS path not optimal
by ku po 04 Mar '14

04 Mar '14

One of my client has peering with nlayer and a provider from Asia. It seems from one major ISP in US, the best path is through this Asia provider, instead of through nlayer which we want it to be. It seems this major ISP does not have a direct peering with nlayer AS 4436 is the cause of this problem. What is the best way to address this problem?

3 2

Re: ISP inbound failover without BGP
by Hank Nussbacher 04 Mar '14

04 Mar '14

Have them look at radware linkproof which is designed for small shops that don't want to do bgp and getting their own ASN and pi address space. Been around since 1999. http://www.radware.com/Products/LinkProof/ Hank On Mar 4, 2014 3:11 AM, Eric A Louie <elouie(a)yahoo.com> wrote: > > This may sound like dumb question, but... I'm used to asking those. > > Here's the scenario > > Another ISP, say AT&T, is the primary ISP for a customer. > > Customer has publicly accessible servers in their office, using the AT&T address space. > > I am the customer's secondary ISP. > > Now, if AT&T link fails, I can provide the customer outbound Internet access fairly easily. So they can surf and get to the Internet. > > What about the publicly accessible servers that have AT&T addresses, though? > > One thought I had was having them use Dynamic DNS service. > > Are there any other solutions, short of using BGP multihoming and having them try to get their own ASN and IPv4 /24 block? > > It looks like a few router manufacturers have devices that might work, but it looks like a short DNS TTL (or Dynamic DNS) needs to be set so when the primary ISP fails, the secondary ISP address is advertised.

1 0

re: DSLAM
by Nick Olsen 03 Mar '14

03 Mar '14

Thanks to all that replied. Specially Eric @ Luma Optics. We've reached the cut off date for day. We're working on fixing the DSLAM we have on hand for use. I appreciate all the replies. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Nick Olsen" <nick(a)flhsi.com> Sent: Monday, March 03, 2014 3:40 PM To: nanog(a)nanog.org Subject: DSLAM Hey Guys, I need a 24 port ADSL (2, +, It's all the same in my book) DSLAM. And I need it by tomorrow. Normal channels seem to be impacted by weather. Not to mention we've been pretty unhappy with our current models (Versa, And Planet). Any options? Unicast is acceptable. Nick Olsen Network Operations (855) FLSPEED x106

1 0

Re: DSLAM
by Nick Olsen 03 Mar '14

03 Mar '14

Cocoa, Florida. Sorry. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: Valdis.Kletnieks(a)vt.edu Sent: Monday, March 03, 2014 4:05 PM To: nick(a)flhsi.com Cc: nanog(a)nanog.org Subject: Re: DSLAM On Mon, 03 Mar 2014 15:40:35 -0500, "Nick Olsen" said: > Hey Guys, I need a 24 port ADSL (2, +, It's all the same in my book) DSLAM. > And I need it by tomorrow. Bonus points if you tell us what continent/timezone you need this in. Getting said device to 60 Hudson and to Nowhere Island, Tahiti are 2 very different things...

1 0

DSLAM
by Nick Olsen 03 Mar '14

03 Mar '14

Hey Guys, I need a 24 port ADSL (2, +, It's all the same in my book) DSLAM. And I need it by tomorrow. Normal channels seem to be impacted by weather. Not to mention we've been pretty unhappy with our current models (Versa, And Planet). Any options? Unicast is acceptable. Nick Olsen Network Operations (855) FLSPEED x106

3 2

New AS Number Blocks allocated to the RIPE NCC
by Andrea Cima 03 Mar '14

03 Mar '14

Dear Colleagues, The RIPE NCC has received the following AS Number Blocks from the IANA in February 2014. 200192-201215 201216-202239 You may want to update your records accordingly. Best regards, Andrea Cima Registration Services Manager RIPE NCC

1 0

Filter NTP traffic by packet size?
by Edward Roels 03 Mar '14

03 Mar '14

Curious if anyone else thinks filtering out NTP packets above a certain packet size is a good or terrible idea. >From my brief testing it seems 90 bytes for IPv4 and 110 bytes for IPv6 are typical for a client to successfully synchronize to an NTP server. If I query a server for it's list of peers (ntpq -np <ip>) I've seen packets as large as 522 bytes in a single packet in response to a 54 byte query. I'll admit I'm not 100% clear of the what is happening protocol-wise when I perform this query. I see there are multiple packets back forth between me and the server depending on the number of peers it has? Would I be breaking something important if I started to filter NTP packets > 200 bytes into my network?

42 82