June 2015 - Test - lists.nanog.org

FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation
by Pavel Odintsov 04 Jun '15

04 Jun '15

Hello, Nanog! I'm very pleased to present my open source DoS/DDoS attack monitoring toolkit here! We have spent about 10 months for development of FastNetMon and could present huge feature list now! :) Stop! What is FastNetMon? It's really very fast toolkit which could find attacked host in your network and block it (or redirect to filtering appliance) This solution could save your network and your sleep :) Our site located here: https://github.com/FastVPSEestiOu/fastnetmon We support following engines for traffic capture: - Netflow (v5, v9 and IPFIX) - sFLOW v5 - port mirror/SPAN (PF_RING and netmap supported) Also we have deep integration with ExaBGP (huge thanks to Thomas Mangin) for triggering blackhole on the Core Router or upstream. Since 1.0 version we have added support for following features: - Ability to detect most popular attack types: syn_flood, icmp_flood, udp_flood, ip_fragmentation_flood - Add support for Netmap for Linux (we have prepared special driver for ixgbe users: https://github.com/pavel-odintsov/ixgbe-linux-netmap) and FreeBSD. - Add support for PF_RING ZC (very fast but need license from ntop folks) - Add ability to collect netflow v9/IPFIX data from multiple devices with different templates set - Basic support for IPv6 (we could receive netflow data over IPv6) - Add plugin support for capture engines - Add support of L2TP decapsulation (important for DDoS attack detection inside tunnel) - Add ability to store attack details in Redis - Add Graphite/Grafana integration for traffic visualization - Add systemd unit file - Add ability to unblock host after some timeout - Introduce support of moving average for all counters - Add ExaBGP integration. We could announce attacked host with BGP to border router or uplink - Add so much details in attack report - Add ability to store attack fingerprint in file We have complete support for following platforms: - Fedora 21 - Debian 6, 7, 8 - CentOS 6, 7 - FreeBSD 9, 10, 11 - DragonflyBSD 4 - MacOS X 10.10 >From network equipment side we have tested solution with: - Cisco ASR - Juniper MX - Extreme Summit - ipt_NETFLOW Linux We have binary packages for this operation systems: - CentOS 6: https://github.com/FastVPSEestiOu/fastnetmon/tree/master/packages/CentOS6 - CentOS 7: https://github.com/FastVPSEestiOu/fastnetmon/tree/master/packages/CentOS7 - Fedora 21: https://github.com/FastVPSEestiOu/fastnetmon/tree/master/packages/Fedora21 - FreeBSD: https://github.com/FastVPSEestiOu/fastnetmon/tree/master/src/FreeBSD_port For any other operation systems we recommend automatic installer script: https://github.com/FastVPSEestiOu/fastnetmon/blob/master/docs/INSTALL.md Please join to our mail list or ask about anything here https://groups.google.com/forum/#!forum/fastnetmon Thank you for your attention! -- Sincerely yours, Pavel Odintsov

5 7

Re: BGP in the Washngton Post
by Scott Weeks 03 Jun '15

03 Jun '15

--- larrysheldon(a)cox.net wrote: From: Larry Sheldon <larrysheldon(a)cox.net> On 6/2/2015 00:27, Scott Weeks wrote: > Great article for the WP and they asked good questions from > the correct people, but I have to take issue with the lack > of network operator's participation comments: > > : But getting network operators to participate is proving > : difficult. > > : Many network operators also are cool to taking the further > : step of adopting a secure new routing protocol called BGPSEC > : to replace BGP. > > : “Unless [network] operators can see that the benefits will > : generally outweigh the costs, they just won’t deploy it.” > > It's more that the managers who have no idea what is going on > are forcing operators to focus their attention elsewhere, rather > than the important things until everyone's behind the 8-ball. > Then, all of the sudden, the mostly clueless managers are all > about it. But, by then it's too late. Farting in a hurricane > and hoping it makes a difference... ;-) Pardon me, (and please forgive me if I am wrong), but I think that from the viewpoints of the Washington Post, its readers, and probably all of humanity save the view on this list, the MANAGEMENT of the several ISP firms and organizations IS "the operators". Folks out on the operating floor don't really exist. -------------------------------------------------- No, looking at it the way you phrase it, you're not wrong. To me, the operators are the folks with the technical know how and the admin password. I guess I have been out on the raggedy edges (likely soon to change...) too long and I am not used to managers that have any understanding of network operations/engineering. But I do understand what you're saying. And I'm on the list. ;-) scott

1 0

Re: BGP in the Washngton Post
by Larry Sheldon 03 Jun '15

03 Jun '15

On 6/2/2015 00:27, Scott Weeks wrote: > Great article for the WP and they asked good questions from > the correct people, but I have to take issue with the lack > of network operator's participation comments: > > : But getting network operators to participate is proving > : difficult. > > : Many network operators also are cool to taking the further > : step of adopting a secure new routing protocol called BGPSEC > : to replace BGP. > > : “Unless [network] operators can see that the benefits will > : generally outweigh the costs, they just won’t deploy it.” > > It's more that the managers who have no idea what is going on > are forcing operators to focus their attention elsewhere, rather > than the important things until everyone's behind the 8-ball. > Then, all of the sudden, the mostly clueless managers are all > about it. But, by then it's too late. Farting in a hurricane > and hoping it makes a difference... ;-) Pardon me, (and please forgive me if I am wrong), but I think that from the viewpoints of the Washington Post, its readers, and probably all of humanity save the view on this list, the MANAGEMENT of the several ISP firms and organizations IS "the operators". Folks out on the operating floor don't really exist. -- sed quis custodiet ipsos custodes? (Juvenal)

1 0

BGP offloading (fixing legacy router BGP scalability issues)
by Frederik Kriewitz 03 Jun '15

03 Jun '15

Hello, We've a lot of customers with Cisco 6500 routers (mostly with SUP720 supervisors) in operation. They are very popular with smaller ISPs in Africa/middle east due to their cheap price on the used marked and their fully sufficient routing performance for the given tasks. In practice the biggest problem with them is their poor BGP scalability due to the CPU/memory limitations. We're looking into options for a cheap fix for this problem. The idea is to offload BGP IPv4/IPv6 RIB calculation from the router to a standard server. All BGP sessions will be handled by the server. The server takes care of the RIB calculation and aggregates the result as much as possible (the aggregation potential of the global tables should be very high if it can completely ignore the AS path and only care about the next hop). The final optimized RIB is then pushed to the Router via an iBGP session (the only BGP session configured on the router). If there's room in the transfer net for the server and the router, the setup is simple (eBGP session is established with the server and next-hop is set to the router). In other peering situations the setup might be more challenging. E.g. with typical IXP constrains (only a single MAC address/IP address allowed) the session would have to be a multihop session and an additional static route (host route for the server) on the peer router should be installed. Another way to make the server appear completely transparent for other peers (no special configuration on the peer side) might be NAT for the BGP port to the server or proxy ARP. But we would like to avoid doing NAT with a SUP720 and proxy ARP would make us the default gateway for any incorrectly configured IXP participant router and a configuration error on our side might cause severe harm to the IXP. And of course both ideas won't work for IPv6 (SUP720 doesn't support NAT for IPv6 or proxy NDP). The only solution to make it fully transparent for IPv4 and IPv6 we came up with it is to configure the IXP router interface as unnumbered + static route for the IXP nets + host routes for the assigned IXP IPs to the server. In that case the server would have to monitor the IXP vlan and take care of responding to ARP and Neighbor Solicitation requests for the IXP IPs (using the MAC of the router). Additionally it might be necessary to inject the ARP/IPv6 neighbors into the cisco using static entries (to avoid sending ARP/NS requests with a non IXP IP). We're wondering if anyone has experience with such a setup? Best Regards, Freddy

25 56

nanog website down
by Eric Oosting 03 Jun '15

03 Jun '15

This morning we suffered a hardware failure in our production environment. The outage affected nanog mail and web services. While mail services have recovered, web services are still down. We apologize for the inconvenience. -e

1 1

nanog.org Website down ?
by Bob Evans 03 Jun '15

03 Jun '15

Not sure what's up - however I see what's down this AM. From the hotel nanog.org was not reachable. Soooo, I tunneled out of the hotel to my office, still not reachable at 6:15 AM nanog.org (50.31.151.73) www.nanog.org (50.31.151.73) Bob Evans CTO Fiber Internet Center

2 1

Re: Password Decryption Methods?
by Bacon Zombie 03 Jun '15

03 Jun '15

Grab the firmware and run it through BinWalk. Your should be able to pull out the firmware and see what it does to the password before storing it. On 2 Jun 2015 22:03, "Landon Stewart" <landonstewart(a)gmail.com> wrote: On Jun 2, 2015, at 9:23 AM, Michael O Holstein <michael.holstein(a)csuohio.edu> wrote: > If you can share the other details (make, model, firmware revision, processor type, etc.) .. whatever you know and can share) .. it would be more helpful. Also, how'd you get the hash? .. from a config file backup or from another device that used it to access this one? If so, what software, etc. Serial # too. :-D

1 0

WiFi courses/vendors recommendation
by Abdullah Medhat 03 Jun '15

03 Jun '15

Good day all, We are looking forward to establish MetroWifi network as a new business line in our company, in addition to small/medium events Wifi coverage. I have two questions: 1. What are the required resources/material/training curriculum to let our engineers start educating in this? We are looking for the vendor-agnostic materials that will give our engineers the WiFi essentials/fundamentals to start building a good foundation before evolving to the professional level. 2. What vendors do you recommend? We need to find a cost-effective yet competent option with good pre/post sales service. Thanks, -- Abdullah Medhat

14 15

Re: BGP Multihoming 2 providers full or partial?
by Scott Weeks 02 Jun '15

02 Jun '15

but I don't do email like that why is it hard to read? it's really hard to read email this way. because it's out of order umm, ok. I fixed it for you ----------------------------------------- You've obviously never been hounded by sales folks scraping this list that believe they should never give up. It's painful to say the least. If every "Product Evangelist" were allowed to do this, NANOG would be a nightmare. <snip> To others out there thinking of doing the same, again I say Please read #5 https://www.nanog.org/list ------------------------------------------ --------- nanog(a)ics-il.net wrote: ---------- From: Mike Hammett <nanog(a)ics-il.net> Probably not NANOG, but I have way more traffic on many other lists over the last 12+ years. I'm no stranger to over-zealous sales guys. I've started blocking the ones that call my support line and talking to the call center, despite the warning that support is only for my customers. ------------------------------------------ So, why-oh-why encourage them here? I'm done with this non-thread and fixing out of order postings. Way too much work for me, but I'm sure it's easier for you. No matter what either of us thinks NANOG's AUP specifically states "Product marketing is prohibited." and "Using list as source for private marketing initiatives is prohibited." [FIN, ACK, Seq=2many, Len=0] scott

2 1

Password Decryption Methods?
by Lorell Hathcock 02 Jun '15

02 Jun '15

All: I have a video camera that I need to recover the password. I have a password hash that is stored in a database, but any online decryption sites are not working. Can someone push me in the right direction on where I go from here? Thanks, Lorell

3 2