October 2016 - Test - lists.nanog.org

Other name resolution impacts, as by-products of the Dyn event (e.g. recursive queries limit reached)
by Stefan 25 Oct '16

25 Oct '16

Have not seen any mentions yet, so thought of asking here: has anybody paid attention to other name resolution issues, even outside the Dyn hosted services directly sourced ones? I am talking about what we observed, as result of: https://community.infoblox.com/t5/Support-Central/Support-Central-KB-118-Wh… i.e. "active queue" filled with the Dyn caused event, but leaving thusly no "room", at times, for valid recursive queries, inclusive of internal name resolution, where the SOA sits in another tier (e.g. GSLBs). One possible mitigation for such scenarios is: https://community.infoblox.com/t5/Support-Central/Support-Central-KB-3451-C… Any other related events, on other platforms or configurations? ***Stefan

1 0

Dyn DDoS this AM?
by Chris Grundemann 25 Oct '16

25 Oct '16

Does anyone have any additional details? Seems to be over now, but I'm very curious about the specifics of such a highly impactful attack (and it's timing following NANOG 68)... https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-red… -- @ChrisGrundemann http://chrisgrundemann.com

41 55

Internal vulnerability hosts scan to prevent DDOS
by marcel.duregards＠yahoo.fr 25 Oct '16

25 Oct '16

Dear members, We are a small tier-2 isp and we would like to monitor any potentials risks at our customers ip (we do not want that our AS could be used as a source for DDOS). One of many measures is to scan, on a regular basis, all our IP (PI and PA) to detect any misconfigured customers hosts which could be used for DDOS. The scan should be able to detect misconfigured ddns resolver, ntp server, ssdp host, etc...and any future cool reflection protocol. If any misconfigured hosts is detected, an alarm should raise on an dashboard, and an email send to the customers contact (RIR info), and to our noc. Radar from qrator provide a similar service via email, but we need our own server/VM, with customizables features (like email in differents languages, recall management, acknowledgement request, history (some customers do not take any actions when we inform them, so we would like to have history to put pressure on them)). Does anybody have a solution for that ? Thank in advance for your input. Best regards, -- Marcel

1 0

Fwd: [apops] APRICOT 2017 Call for Presentations
by Mark Tinka 25 Oct '16

25 Oct '16

FYI. Mark. -------- Forwarded Message -------- Subject: [apops] APRICOT 2017 Call for Presentations Date: Mon, 17 Oct 2016 17:34:19 +0600 From: Philip Smith <pfsinoz(a)gmail.com> To: apops(a)apops.net Hi everyone, Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT) 27th February - 2nd March 2017, Ho Chi Minh City, Vietnam https://2017.apricot.net CALL FOR PAPERS =============== The APRICOT 2017 Programme Committee is now seeking contributions for Presentations and Tutorials for the APRICOT 2017 Conference. We are looking for presenters who would: - Offer a technical tutorial on an appropriate topic; - Participate in the technical conference sessions as a speaker; - Convene and chair panel sessions of relevant topics. Please submit on-line at: http://papers.apricot.net/user/login.php?event=48 CONFERENCE MILESTONES --------------------- Call for Papers Opens: Now Draft Program Published: As Papers Confirmed Final Deadline for Submissions: 30 January 2016 Final Program Published: 6 February 2017 Final Slides Received: 13 February 2017 *NOTE THAT REGARDLESS OF DEADLINES SLOTS ARE FILLED ON A FIRST COME, FIRST SERVED BASIS* PROGRAMME MATERIAL ------------------ The APRICOT Conference Programme consists of three parts, these being the Peering Forum, Tutorials, and Conference Tracks. Topics proposed must be relevant to Internet Operations and Technologies: - IPv4 / IPv6 Routing and operations - IPv6 deployment and transition technologies - Internet backbone operations - ISP and Carrier services - IXPs and Peering - Research on Internet Operations and Deployment - Software Defined Networking / Network Function Virtualisaton - Network security issues (NSP-SEC, DDoS, Anti-Spam, Anti-Malware) - DNS / DNSSEC - Internet policy (Security, Regulation, Content Management, Addressing, etc) - Access and Transport Technologies, including Cable/DSL, 3G/LTE, wireless, metro ethernet, fibre, MPLS - Content & Service Delivery (Multicast, Voice, Video, "telepresence", Gaming) and Cloud Computing CfP SUBMISSION -------------- Draft slides for both tutorials and conference sessions MUST be provided with CfP submissions otherwise the Programme Committee will be unable to review the submission. For avoidance of doubt this means that submissions which do not include slides will be rejected immediately. For work in progress, the most current information available at time of submission is acceptable. All draft and complete slides must be submitted in PDF format only. Final slides are to be provided by the specified deadline for publication on the APRICOT website. Prospective presenters should note that the majority of speaking slots will be filled well before the final submission deadline. The PC may, at their discretion, retain a limited number of slots up to the final submission deadline for presentations that are exceptionally timely, important, or of critical operational importance. Every year we turn away submissions, due to filling up all available programme slots before the deadline. Presenters should endeavour to get material into the PC sooner rather than later. Any questions or concerns should be addressed to the Programme Committee by e-mail at: pc-chairs at apricot.net We look forward to receiving your presentation proposals. Mark Tinka & Philip Smith Co-Chairs, APRICOT 2017 Programme Committee -- _______________________________________________ apops mailing list apops(a)apops.net https://mailman.apnic.net/mailman/listinfo/apops Website: www.apops.net .

1 0

Any Google Cloud people on the list?
by Eric Dugas 24 Oct '16

24 Oct '16

Any Google Cloud people or people really used to work with GC/GCI on the list? Please contact me off-list Thanks Eric ![](https://link.nylas.com/open/4sk3yzfka4ymj01d79p0ldahw/local- f01e8d07-1e4e?r=bmFub2dAbmFub2cub3Jn)

1 0

BGP route instabilities
by Matthew Huff 24 Oct '16

24 Oct '16

We saw a slight uptick in routes today (at least since the last time I looked), but a large number of route flaps coming out of the APNIC region. Anyone else notice anything? ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577

3 2

Re: Death of the Internet, Film at 11
by Josh Reynolds 24 Oct '16

24 Oct '16

And then what? The labor to clean up this mess is not free. Who's responsibility is it? The grandma who got a webcam for Christmas to watch the squirrels? The ISP?... No... The vendor? What if the vendor had released a patch to fix the issue months back, and grandma hadn't installed it? Making grandma and auntie Em responsible for the IT things in their house is likely not going to go well. Making the vendor responsible might work for the reputable ones to a point, but won't work for the fly by night shops that will sell the same products under different company names and model names until they get sued or "one starred" into oblivion. Then they just change names and start all over. The ISPs won't do it because of the cost to fix... The labor and potential loss of customers. So once identified, how do you suggest this gets fixed? On Oct 22, 2016 5:11 PM, "Mark Andrews" <marka(a)isc.org> wrote: One way to deal with this would be for ISP's to purchase DoS attacks against their own servers (not necessarially hosted on your own network) then look at which connections from their network attacking these machines then quarantine these connections after a delay period so that attacks can't be corollated with quarantine actions easily. This doesn't require a ISP to attempt to break into a customers machine to identify them. It may take several runs to identify most of the connections associated with a DoS provider. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

10 14

Re: Death of the Internet, Film at 11
by Larry Sheldon 24 Oct '16

24 Oct '16

On 10/23/2016 21:02, David Conrad wrote: > Shut down subnets of your own customers? That was the problem I broke my pick on 20 years or more ago. ISPs absolute refusal to put in filters at no-revenue-expense since it would cost money to install and maintain, and worst of all MIGHT conceivably block revenue-producing-abuse traffic. No matter that paying customers were not able to use the service they were paying for. -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

1 0

Re: Death of the Internet, Film at 11
by Keith Medcalf 24 Oct '16

24 Oct '16

Why would the provider want to do anything? They suuport (make money from) their cudtomers. And the more traffic the send/receive, the more money the providers make. Wouldn't surprise me if the providers were selling access to their customers networks to the botherders so they could make money from both ends. --- Sent from Samsung Mobile <div>-------- Original message --------</div><div>From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> </div><div>Date:2016-10-23 17:20 (GMT-07:00) </div><div>To: </div><div>Cc: nanog(a)nanog.org </div><div>Subject: Re: Death of the Internet, Film at 11 </div><div> </div>

3 2

Death of the Internet, Film at 11
by Ronald F. Guilmette 23 Oct '16

23 Oct '16

VICTOR LASZLO: If we stop fighing our enemies, the world will die. RICK BLAINE: Well, what of it? It will be out of its misery. -- From the movie "Casablanca" (1942) Sorry, but some days I just can't help thinking to myself "Oh well, as much fun as it has been, this whole lab experiment called The Internet was never really going last or stand the test of time anyway." The problem isn't the technology. It's the politics. It's fragility by design. Oh! And by the way, one news source that I was just reading a few minutes ago stated that all of the carnage at Dyn today was caused by something on the order of just 1/10th of the known CCTV bots out there. And I'm thinking, like, "Gee! I guess that we ought to count ourselves as lucky that whoever was running this thing, for whatever reason, just didn't much feel like firing up the whole entire bloody thing today. Otherwise, you know, we might have REALLY had a problem." :-) Regards, rfg P.S. To all of you Ayn Rand devotees out there who still vociferously argue that it's nobody else's business how you monitor or police your "private" networks, and who still refuse to take even minimalist steps (like BCP 38), congratulations. Via your inaction and self-centered intransigence you have today moved us all one step closer to the day when the relevant decisions will be taken out of your hands. You are succeding brilliantly at creating the exact thing that you most abhor, i.e. government control. Clemenceau said that war is too important to be left to the generals. Well, guess what? The Internet is too important to be left to the [[fill in the blank]]. It has already begun... https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-… This is just the first timid step. A few more days like today and more, much more, will follow.

11 13