May 2014 - Test - lists.nanog.org

crave your indulgence
by manning bill 28 May '14

28 May '14

If you wouldn’t mind a quick tracerooute - Can you confirm reachability to the following: 2001:500:84::b Thanks in advance. /bill Neca eos omnes. Deus suos agnoscet.

10 9

Cogent / Internap issue ??
by Matthew Huff 27 May '14

27 May '14

We are having troubles reaching services on the other side of cogent/internap peering. Anyone else seeing issues? Basically 14607 -> 6128 -> 174 -> 14744. Type escape sequence to abort. Tracing the route to 72.5.52.199 VRF info: (vrf in name/id, vrf out name/id) 1 24.157.32.249 [AS 6128] 4 msec 4 msec 4 msec 2 24.38.117.6 [AS 6128] 4 msec 8 msec 4 msec 3 167.206.183.29 [AS 6128] 4 msec 4 msec 8 msec 4 * * * 5 * * * 6 154.54.47.17 [AS 174] 4 msec 154.54.47.29 [AS 174] 8 msec 154.54.44.69 [AS 174] 4 msec 7 66.28.4.202 [AS 174] 28 msec 28 msec 154.54.6.190 [AS 174] 28 msec 8 154.54.6.85 [AS 174] 40 msec 154.54.24.81 [AS 174] 36 msec 154.54.6.117 [AS 174] 40 msec 9 154.54.26.113 [AS 174] 52 msec 154.54.26.121 [AS 174] 52 msec 154.54.26.129 [AS 174] 48 msec 10 154.54.25.70 [AS 174] 64 msec 154.54.25.66 [AS 174] 60 msec 154.54.25.70 [AS 174] 60 msec 11 154.54.2.197 [AS 174] 92 msec 88 msec 84 msec 12 154.54.0.249 [AS 174] 80 msec 154.54.0.253 [AS 174] 80 msec 154.54.0.249 [AS 174] 84 msec 13 154.54.41.142 [AS 174] 152 msec 224 msec 92 msec 14 38.122.90.42 [AS 174] 84 msec 84 msec 38.104.124.82 [AS 174] 80 msec 15 63.251.160.18 [AS 14744] 76 msec 76 msec 72 msec 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039

2 2

RIPE Atlas data parsing
by Ca By 27 May '14

27 May '14

Folks, Yes, RIPE Atlas is great. It generates output as JSON. Is there dummy tool for summarizing this JSON data and possibly visualizing it? I could write my own, but i imagine someone has already done this somewhere. No? CB

4 3

Re: crave your indulgence
by Hank Nussbacher 27 May '14

27 May '14

At 14:47 27/05/2014 -0400, Christopher Morrow wrote: >Measurement: 1666834 should be bill's measurement request... 50 >icmptraceroutes from around the globez. Or ring-ping and ring-trace: https://ring.nlnog.net/toolbox/ -Hank >On Tue, May 27, 2014 at 2:35 PM, Brian Rak <brak(a)gameservers.com> wrote: > > This seems like a perfect use for ATLAS: https://atlas.ripe.net/ > > > > > > On 5/27/2014 2:28 PM, manning bill wrote: > >> > >> If you wouldn't mind a quick tracerooute - Can you confirm reachability > >> to the following: > >> > >> 2001:500:84::b > >> > >> Thanks in advance. > >> > >> /bill > >> Neca eos omnes. Deus suos agnoscet. > >> > >

2 1

re: Contact for Road Runner
by Nick Olsen 27 May '14

27 May '14

Hey Faisal, We use to have peering with Road Runner (Bright House Networks) ~6 years ago. At that time, They created a RR object (RADB) for our AS that specifically said ROAD RUNNER. Which caused all kinds of havoc as some databases would pull that over the "AS NAME" when listing our network. They even updated the registry a couple of times in the years following our termination of their service. Emails to their RADB email, As well as to their direct support went completely unanswered. The solution for me was asking Merit (RADB's Parent company..whatever they are). To forcibly remove the entry, They did so about two hours after my email to them and were extremely helpful. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Faisal Imtiaz" <faisal(a)snappytelecom.net> Sent: Tuesday, May 27, 2014 9:52 AM To: "NANOG" <nanog(a)nanog.org> Subject: Contact for Road Runner Hello, I am looking to get in touch with anyone who is responsible for Routing Registry Objects at Road Runner Cable. Can you please reply back to me off list. (We need to have an older ASN RR Object Created by rr.com to be removed please). Thanks. Faisal Imtiaz Snappy Internet & Telecom 7266 SW 48 Street Miami, FL 33155 Tel: 305 663 5518 x 232 Help-desk: (305)663-5518 Option 2 or Email: Support(a)Snappytelecom.net

1 0

Contact for Road Runner
by Faisal Imtiaz 27 May '14

27 May '14

Hello, I am looking to get in touch with anyone who is responsible for Routing Registry Objects at Road Runner Cable. Can you please reply back to me off list. (We need to have an older ASN RR Object Created by rr.com to be removed please). Thanks. Faisal Imtiaz Snappy Internet & Telecom 7266 SW 48 Street Miami, FL 33155 Tel: 305 663 5518 x 232 Help-desk: (305)663-5518 Option 2 or Email: Support(a)Snappytelecom.net

1 0

Re: Large DDoS, small extortion
by Larry Sheldon 24 May '14

24 May '14

On 5/24/2014 11:29 AM, Anne P. Mitchell, Esq. wrote: > >> Law enforcement and victims have different objectives. Law >> enforcement wants to find the criminal, gather sufficient evidence >> to prove their guilt, then prosecute them. More attacks helps law >> enforcement. >> >> The victims, in general, want the attacks to stop. > > Actually, our experience in this particular case (it is the same > person(s) hitting all of the targets, even using the same email > addresses, etc.) is that the victims want to find the guy too. In > fact, I can say with a fair degree of certainty that the coordinated > efforts of a dedicated group of "victims", who have come together > without regards to the fact that they are otherwise 'competitors' in > business, and who have furnished the agencies with useable technical > information about the attacks, have given the agencies a substantial > leg up in the investigation. All that from a far greater authority than I. But lest my weak words be misunderstood, I have no objection what ever to providing technical information (and facilities, even)--it is ONLY the paying of ransom that I object to. And I think I would say that if I were the captive. I think over the long haul the odds are that if you DO pay the ransom, the victim will be dead anyway. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Linkedin Peering Contact
by Faisal Imtiaz 24 May '14

24 May '14

Hello, I am trying to contact the folks responsible for Linkedin Peering. Can you please send me you contact info off list. (emails to addresses listed in peeringdb are being bounced back by the mail server) Thanks Faisal Imtiaz Snappy Internet & Telecom 7266 SW 48 Street Miami, FL 33155 Tel: 305 663 5518 x 232 Help-desk: (305)663-5518 Option 2 or Email: Support(a)Snappytelecom.net

1 1

Large DDoS, small extortion
by Beleaguered Admin 24 May '14

24 May '14

Apologies for the non-personal email address, but I don't want to give our attacker any additional information than I need to. I'd be happy to send personal contact/ASN information to any nanog admins or regular members of nanog if it's useful. Over the past year or so, we (a decent sized tier 2 with a nationwide US backbone) have had several large DDoS attacks from what appear to be the same person who is (we presume) going down something like the alexa list of top sites, attacking them, and asking for small amounts of money to stop. This has been going on for a long time -- almost every detail is exactly the same as what is described here: http://it.slashdot.org/story/12/11/03/1846252/ask-slashdot-how-to-deal-with… and more recently: http://techcrunch.com/2014/03/03/meetup-suffering-significant-ddos-attack-t… and: https://gist.github.com/dhh/9741477 And I believe attacks including vimeo, github, and others. The attacker is smarter than many random attackers, or at least has better tools. He watches when you mitigate the attack, and shifts his attack to something new. He (or his tools) also watch DNS for the thing he's attacking and the attack moves as DNS changes. We've seen UDP amplification (NTP and DNS mainly), syn flood, syn/ack flood, layer 7 cache busting (https://isc.sans.edu/forums/diary/Wordpress+Pingback+DDoS+Attacks/17801/) and others we haven't been able to fully mitigate/identify. The largest we've seen (which isn't the largest we've read about) attacks are over 50Gbit and 10s of millions of pps. He is in regular communication (via whois info and other collected contact data) asking for <$1000 USD sums to stop the attacks. While we are interested in technical means to mitigate the attacks (the syn and syn/acks are brutal, all cores pegged on multicore 10G nic servers just dealing with interrupts), what I'd really like to find out is how to help fix the problem. We've tried to engage upstream providers to help trace the attacks, but have gotten nowhere (they didn't seem to understand that the syn attacks were spoofed, and looking at source IPs didn't matter, we wanted to know the ingress points on their network.) What are the best practices for this? Are there secret code words (http://xkcd.com/806/) we can use to get to someone at our upstreams who might know what we're talking about? Is it worth the time? Is it worth talking to law enforcement? Some of these have been >500k costs to the customer, but we assume the person doing it isn't in any western country, so maybe it doesn't even matter? Thanks.

16 26

help with CF card on Catalyst 6500 with Sup720
by Martin Hotze 24 May '14

24 May '14

Hi, can anyone provide a dd-image from a CF card from a Catalyst 6500 with Sup720, please. We have a refurbished 6500 w/ Sup720-3BXL with an old rommon which is not able to format a CF card. (various other methods with formatting FAT16 on Linux etc. did not work; google search only pointed to format within a running system, but we do not have such a system nearby) IOS image is already present. any help appreciated. thanks, martin

2 1