August 2014 - Test - lists.nanog.org

Re: where to go to understand DDoS attack vector
by Larry Sheldon 26 Aug '14

26 Aug '14

On 8/26/2014 08:31, Roland Dobbins wrote: > > On Aug 26, 2014, at 8:26 PM, Stephen Satchell <list(a)satchell.net> wrote: > >> qotd 17/udp quote > > No, that's the protocol number - 17 is UDP - not the port number. Really? http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers udp DID used to be protocol 17, but it is a fact that quotd runs on udp port 17. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes.

2 1

Urgent
by randy＠psg.com 26 Aug '14

26 Aug '14

Contact for God, please reach out to me offlist. Regards, -AS666 NOC

18 20

where to go to understand DDoS attack vector
by Miles Fidelman 26 Aug '14

26 Aug '14

Hi Folks, Possibly a little off-topic for nanog, but I couldn't think of anywhere else to ask this (suggestions please!): We just discovered a vulnerability the hard way - someone used one of our IPMI boards as a vector for a DDoS attack (well, I guess the real hard way would be to have been on the receiving end, but...). Anyway... aside from some obvious issues, I've been learning a lot about the vulnerabilities of Supermicro IPMI boards (and busily locking them down). The one that's tricky, though, is that this was a reflection/amplification attack. Conveniently, the attackee's data center operator managed to capture incoming packets with tcpdump, and they all looked like this: 8:33:58.482193 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto UDP (17), length 29) x.x.x.x.2072 > x.x.x.x.27015: UDP, length 1 0x0000: 4500 001d 0000 4000 3811 088c cf9a 3b8c E.....@.8 <mailto:E.....@.8>.....;. 0x0010: 405e eebf 0818 6987 0009 10f8 4300 0000 @^....i.....C... 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. (obviously, with the IP addresses removed). It could be that someone planted a bot in the IPMI board (just starting to do some forensics - currently hampered by being on travel, and having blocked all the ports from the outside world - need to get to the datacenter and make some hardwired connections) - but it looks a lot more like a reflection/amplification attack - particularly since the target seems to have been a game host, and port 27015 is used by the game halflife. But.... Now I understand reflected DNS and NTP attacks - but the outbound port, 2072 (registered for GlobeCom msync) is neither, nor is it anything that we're running - which kind of begs the question of how this might be working. Any thoughts? Any pointers? Any starting points? Immediate issue is dealt with (at least for us, target seems to be off the air) - but want to understand this, report it, all of that. Thanks very much, Miles Fidelman -- In theory, there is no difference between theory and practice. In practice, there is. .... Yogi Berra

8 13

network quality measurement probes+reporting
by Saku Ytti 26 Aug '14

26 Aug '14

Anyone can recommend or even just name drop network quality measurement kit? I'm only familiar with IP SLA, RPM and Creanord (and various inhouse tools:) What I'd like to see - 1us or better one-way jitter (no need for clock sync, just accurate clock) - tens or 100us one-way latency (as good as cheaply can get sync, ntp is ok) - 1us or better RTT - any-to-any measurement, not just hub<->spoke (or sufficiently cheap hub) - 100pps to 100 measurement points on 8 CoS (ish, less may be acceptable) - randomized payload pattern + verification (to catch bit mangling) - randomized sport/dport (to put traffic in each ECMP/LAG combo, long term) - programmatic accesss and useful documents to measurement data (e.g. some OSS TSDB) - high quality, fast, useful graphical reporting and alarming - support for TWAMP and OWAMP responders - indicative price <100kEUR CAPEX and <2000EUR YRC for 100 nodes solution -- ++ytti

5 4

Verizon (NY, LEC) issues around 1200 EDT?
by Christopher J. Pilkington 26 Aug '14

26 Aug '14

We saw multiple service outages from Verizon local in NYC, specifically our offices served out of Broad Street (NYCMNYBS). Lost multiple OC as well as local voice PRI. I haven't dug exact times out of the logs yet, but was around noon EDT. Anyone else see similar or know what went on? -cjp

1 1

Optical Transport Platform
by Kenneth McRae 26 Aug '14

26 Aug '14

Greetings Everyone.. Here is one for the transport/backbone/data center guys. Can you tell which manufactures you like for optical transport? I am looking for a solution to provide 8 channels of DWDM using tuned optics in my network gear. DWDM transport will be used for multiplexing only (no amplification or wavelength generation). So far, I have been looking at Fiberstore and PacketLight.. Any suggestions? All feedback is greatly appreciated! Thanks Kenneth

7 6

Verizon Network Engineer please
by Sena, Rich 25 Aug '14

25 Aug '14

Can someone contact me please... -- Richard Sena The MITRE Corporation e: rsena(a)mitre.org<mailto:rsena@mitre.org> Principal Engineer 202 Burlington Road v: +1-781-271-3712 Dept: J86E; MS K319 Bedford, MA 01730-1420 f: +1-781-271-2423

3 2

Route Lookup
by Robert Webb 25 Aug '14

25 Aug '14

Can anyone lookup and IP for me, 194.117.106.129, tell me what you see? It should be an IP belonging to SAP in Germany, but it is not accessible and a BGP lookup from Level 3 in Germany gives me "Network not in table". Thanks...

3 3

127.0.53.53 in logs?
by David Conrad 24 Aug '14

24 Aug '14

Hi, I was wondering if any resolver operators were seeing 127.0.53.53 in log files. For anyone who isn’t aware, seeing that address would suggest a “name collision” (see https://www.icann.org/resources/pages/name-collision-2013-12-06-en if you don’t know what that is). As currently over 300 new generic TLDs have been delegated and there was much ... ‘discussion’ about the risk associated with the delegation of those TLDs, I’d be interested in hearing about anything anyone is seeing related to “name collision". Thanks, -drc

1 0

BGP Update Report
by cidr-report＠potaroo.net 22 Aug '14

22 Aug '14

BGP Update Report Interval: 14-Aug-14 -to- 21-Aug-14 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS23752 210640 4.4% 1698.7 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 2 - AS12041 178113 3.7% 1060.2 -- AS-AFILIAS1 - Afilias Canada, Corp.,CA 3 - AS16024 148726 3.1% 148726.0 -- GELSEN-NET GELSEN-NET Kommunikationsgesellschaft mbH,DE 4 - AS9829 143997 3.0% 140.1 -- BSNL-NIB National Internet Backbone,IN 5 - AS8402 86700 1.8% 291.9 -- CORBINA-AS OJSC "Vimpelcom",RU 6 - AS7552 81262 1.7% 64.4 -- VIETEL-AS-AP Viettel Corporation,VN 7 - AS28573 58333 1.2% 16.5 -- NET Serviços de Comunicação S.A.,BR 8 - AS4775 53283 1.1% 619.6 -- GLOBE-TELECOM-AS Globe Telecoms,PH 9 - AS38197 49270 1.0% 59.9 -- SUNHK-DATA-AS-AP Sun Network (Hong Kong) Limited,HK 10 - AS1659 48064 1.0% 223.6 -- ERX-TANET-ASN1 Tiawan Academic Network (TANet) Information Center,TW 11 - AS17885 42238 0.9% 406.1 -- JKTXLNET-AS-AP PT Excelcomindo Pratama,ID 12 - AS6713 41377 0.9% 63.1 -- IAM-AS,MA 13 - AS4 39401 0.8% 874.0 -- ISI-AS - University of Southern California,US 14 - AS2706 39057 0.8% 1027.8 -- PI-HK Pacnet Internet (Hong Kong) Limited,JP 15 - AS41691 30392 0.6% 1519.6 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 16 - AS45899 29976 0.6% 75.5 -- VNPT-AS-VN VNPT Corp,VN 17 - AS23342 29840 0.6% 4973.3 -- UNITEDLAYER - Unitedlayer, Inc.,US 18 - AS55702 28963 0.6% 7240.8 -- EIT-AS-AP 501 Gloucester Street,NZ 19 - AS6147 23053 0.5% 24.5 -- Telefonica del Peru S.A.A.,PE 20 - AS42525 22960 0.5% 441.5 -- GlobalConnect a/s,DK TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS16024 148726 3.1% 148726.0 -- GELSEN-NET GELSEN-NET Kommunikationsgesellschaft mbH,DE 2 - AS6629 9474 0.2% 9474.0 -- NOAA-AS - NOAA,US 3 - AS15657 15019 0.3% 7509.5 -- SPEEDBONE-AS Speedbone Internet & Connectivity GmbH,DE 4 - AS55702 28963 0.6% 7240.8 -- EIT-AS-AP 501 Gloucester Street,NZ 5 - AS10098 13521 0.3% 6760.5 -- HENDERSON-HK Henderson Data Centre Limited,HK 6 - AS23342 29840 0.6% 4973.3 -- UNITEDLAYER - Unitedlayer, Inc.,US 7 - AS4 4660 0.1% 1486.0 -- ISI-AS - University of Southern California,US 8 - AS12559 8946 0.2% 4473.0 -- ISIDE-AS I.S.I.D.E. S.p.A.,IT 9 - AS61765 4462 0.1% 4462.0 -- VIVA TELECOMUNICAÇÕES LTDA- ME,BR 10 - AS1767 21863 0.5% 4372.6 -- ILIGHT-NET - Indiana Higher Education Telecommunication System,US 11 - AS37620 4173 0.1% 4173.0 -- VIETTEL-CM-AS,CM 12 - AS62174 3872 0.1% 3872.0 -- INTERPAN-AS INTERPAN LTD.,BG 13 - AS38267 3808 0.1% 3808.0 -- FIBRENET-BD FibreNet Communications Ltd.,BD 14 - AS42449 3660 0.1% 3660.0 -- ASN-MAIRIE_MULHOUSE Commune de Mulhouse,FR 15 - AS25003 21731 0.5% 3621.8 -- INTERNET_BINAT Internet Binat Ltd,IL 16 - AS53168 10772 0.2% 3590.7 -- CIA ESTADUAL DE GERAÇÃO E TRANSMISSÃO DE ENERGIA E,BR 17 - AS32336 16684 0.3% 3336.8 -- IPASS-2 - iPass Incorporated,US 18 - AS4 18007 0.4% 834.0 -- ISI-AS - University of Southern California,US 19 - AS47680 2780 0.1% 2780.0 -- NHCS EOBO Limited,IE 20 - AS33643 2697 0.1% 2697.0 -- JELLYBELLY - Jelly Belly Candy Company,US TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 185.47.232.0/22 148726 3.0% AS16024 -- GELSEN-NET GELSEN-NET Kommunikationsgesellschaft mbH,DE 2 - 202.70.88.0/21 105031 2.1% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 3 - 202.70.64.0/21 104693 2.1% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 4 - 46.53.64.0/19 40627 0.8% AS24814 -- SCS-AS Syrian Computer Society, scs,SY AS29386 -- EXT-PDN-STE-AS Syrian Telecommunications Establishment,SY 5 - 89.221.206.0/24 30248 0.6% AS41691 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 6 - 64.29.130.0/24 29811 0.6% AS23342 -- UNITEDLAYER - Unitedlayer, Inc.,US 7 - 120.28.62.0/24 26364 0.5% AS4775 -- GLOBE-TELECOM-AS Globe Telecoms,PH 8 - 222.127.0.0/24 26331 0.5% AS4775 -- GLOBE-TELECOM-AS Globe Telecoms,PH 9 - 192.115.44.0/22 21722 0.4% AS25003 -- INTERNET_BINAT Internet Binat Ltd,IL 10 - 216.231.194.0/24 16676 0.3% AS32336 -- IPASS-2 - iPass Incorporated,US 11 - 202.123.88.0/24 13513 0.3% AS10098 -- HENDERSON-HK Henderson Data Centre Limited,HK 12 - 42.83.48.0/20 13216 0.3% AS18135 -- BTV BTV Cable television,JP 13 - 205.247.12.0/24 12173 0.2% AS6459 -- TRANSBEAM - I-2000, Inc.,US 14 - 112.215.16.0/24 11882 0.2% AS17885 -- JKTXLNET-AS-AP PT Excelcomindo Pratama,ID AS24203 -- NAPXLNET-AS-ID PT Excelcomindo Pratama (Network Access Provider),ID 15 - 185.27.8.0/22 11700 0.2% AS42525 -- GlobalConnect a/s,DK 16 - 185.27.10.0/24 11050 0.2% AS42525 -- GlobalConnect a/s,DK 17 - 65.22.158.0/24 10925 0.2% AS12041 -- AS-AFILIAS1 - Afilias Canada, Corp.,CA 18 - 65.22.66.0/24 10759 0.2% AS12041 -- AS-AFILIAS1 - Afilias Canada, Corp.,CA 19 - 65.22.157.0/24 10567 0.2% AS12041 -- AS-AFILIAS1 - Afilias Canada, Corp.,CA 20 - 65.22.65.0/24 10296 0.2% AS12041 -- AS-AFILIAS1 - Afilias Canada, Corp.,CA Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0