August 2014 - Test - lists.nanog.org

Best US Tunnelbroker for Youtube
by Ryan Shea 27 Aug '14

27 Aug '14

Just one man's experience, but my YouTube performance over my Hurricane Electric tunnel has been strikingly poor lately - so much so that I was thinking of squashing v6 in my house entirely. Looking for your experiences/thoughts on whether cutting over to SixXS or Routinghouse could be a path to 1080p cat video bliss instead.

19 30

Re: where to go to understand DDoS attack vector
by Larry Sheldon 27 Aug '14

27 Aug '14

On 8/26/2014 08:31, Roland Dobbins wrote: > > On Aug 26, 2014, at 8:26 PM, Stephen Satchell <list(a)satchell.net> wrote: > >> qotd 17/udp quote > > No, that's the protocol number - 17 is UDP - not the port number. Really? http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers udp DID used to be protocol 17, but it is a fact that quotd runs on udp port 17. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes.

2 1

Urgent
by randy＠psg.com 26 Aug '14

26 Aug '14

Contact for God, please reach out to me offlist. Regards, -AS666 NOC

18 20

where to go to understand DDoS attack vector
by Miles Fidelman 26 Aug '14

26 Aug '14

Hi Folks, Possibly a little off-topic for nanog, but I couldn't think of anywhere else to ask this (suggestions please!): We just discovered a vulnerability the hard way - someone used one of our IPMI boards as a vector for a DDoS attack (well, I guess the real hard way would be to have been on the receiving end, but...). Anyway... aside from some obvious issues, I've been learning a lot about the vulnerabilities of Supermicro IPMI boards (and busily locking them down). The one that's tricky, though, is that this was a reflection/amplification attack. Conveniently, the attackee's data center operator managed to capture incoming packets with tcpdump, and they all looked like this: 8:33:58.482193 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto UDP (17), length 29) x.x.x.x.2072 > x.x.x.x.27015: UDP, length 1 0x0000: 4500 001d 0000 4000 3811 088c cf9a 3b8c E.....@.8 <mailto:E.....@.8>.....;. 0x0010: 405e eebf 0818 6987 0009 10f8 4300 0000 @^....i.....C... 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. (obviously, with the IP addresses removed). It could be that someone planted a bot in the IPMI board (just starting to do some forensics - currently hampered by being on travel, and having blocked all the ports from the outside world - need to get to the datacenter and make some hardwired connections) - but it looks a lot more like a reflection/amplification attack - particularly since the target seems to have been a game host, and port 27015 is used by the game halflife. But.... Now I understand reflected DNS and NTP attacks - but the outbound port, 2072 (registered for GlobeCom msync) is neither, nor is it anything that we're running - which kind of begs the question of how this might be working. Any thoughts? Any pointers? Any starting points? Immediate issue is dealt with (at least for us, target seems to be off the air) - but want to understand this, report it, all of that. Thanks very much, Miles Fidelman -- In theory, there is no difference between theory and practice. In practice, there is. .... Yogi Berra

8 13

network quality measurement probes+reporting
by Saku Ytti 26 Aug '14

26 Aug '14

Anyone can recommend or even just name drop network quality measurement kit? I'm only familiar with IP SLA, RPM and Creanord (and various inhouse tools:) What I'd like to see - 1us or better one-way jitter (no need for clock sync, just accurate clock) - tens or 100us one-way latency (as good as cheaply can get sync, ntp is ok) - 1us or better RTT - any-to-any measurement, not just hub<->spoke (or sufficiently cheap hub) - 100pps to 100 measurement points on 8 CoS (ish, less may be acceptable) - randomized payload pattern + verification (to catch bit mangling) - randomized sport/dport (to put traffic in each ECMP/LAG combo, long term) - programmatic accesss and useful documents to measurement data (e.g. some OSS TSDB) - high quality, fast, useful graphical reporting and alarming - support for TWAMP and OWAMP responders - indicative price <100kEUR CAPEX and <2000EUR YRC for 100 nodes solution -- ++ytti

5 4

Verizon (NY, LEC) issues around 1200 EDT?
by Christopher J. Pilkington 26 Aug '14

26 Aug '14

We saw multiple service outages from Verizon local in NYC, specifically our offices served out of Broad Street (NYCMNYBS). Lost multiple OC as well as local voice PRI. I haven't dug exact times out of the logs yet, but was around noon EDT. Anyone else see similar or know what went on? -cjp

1 1

Optical Transport Platform
by Kenneth McRae 26 Aug '14

26 Aug '14

Greetings Everyone.. Here is one for the transport/backbone/data center guys. Can you tell which manufactures you like for optical transport? I am looking for a solution to provide 8 channels of DWDM using tuned optics in my network gear. DWDM transport will be used for multiplexing only (no amplification or wavelength generation). So far, I have been looking at Fiberstore and PacketLight.. Any suggestions? All feedback is greatly appreciated! Thanks Kenneth

7 6

Verizon Network Engineer please
by Sena, Rich 25 Aug '14

25 Aug '14

Can someone contact me please... -- Richard Sena The MITRE Corporation e: rsena(a)mitre.org<mailto:rsena@mitre.org> Principal Engineer 202 Burlington Road v: +1-781-271-3712 Dept: J86E; MS K319 Bedford, MA 01730-1420 f: +1-781-271-2423

3 2

Route Lookup
by Robert Webb 25 Aug '14

25 Aug '14

Can anyone lookup and IP for me, 194.117.106.129, tell me what you see? It should be an IP belonging to SAP in Germany, but it is not accessible and a BGP lookup from Level 3 in Germany gives me "Network not in table". Thanks...

3 3

127.0.53.53 in logs?
by David Conrad 24 Aug '14

24 Aug '14

Hi, I was wondering if any resolver operators were seeing 127.0.53.53 in log files. For anyone who isn’t aware, seeing that address would suggest a “name collision” (see https://www.icann.org/resources/pages/name-collision-2013-12-06-en if you don’t know what that is). As currently over 300 new generic TLDs have been delegated and there was much ... ‘discussion’ about the risk associated with the delegation of those TLDs, I’d be interested in hearing about anything anyone is seeing related to “name collision". Thanks, -drc

1 0