March 2016 - Test - lists.nanog.org

Quanta LB4M
by Mike Hammett 20 Apr '18

20 Apr '18

Has anyone gotten a "non-factory" firmware to go onto these guys? There are a couple threads on Google that are inconclusive. There are rumors that it's the same as a Dell something or an HP something else, but no one has outright said, "I loaded a Dell XXXX firmware onto it and solved all of the random ass bugs." If I didn't already have a couple of stacked Extreme x400s, I'd consider these at home, but they're somewhat buggy. Quanta told me to contact whomever I bought it from... but I don't think the random guy on eBay is going to have much of anything useful to say. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

4 7

Multi-port RFC2544/EtherSAM loopback appliance
by Jason Lixfeld 25 May '17

25 May '17

Group, I'm looking for options and opinions on a cost effective, multi-port (6'ish port SFP/SFP+) RFC2544/EtherSAM rack appliance that can act as the remote/loopback for our field installers' portable RFC2544/EtherSAM enabled Exfo test sets. I came across XenaNetworks XenaCompact which looks like it would fit the bill, but I'm sure there are others (save Ixia, Exfo and Fluke, which I'm pretty much excluding by default because I imagine they are likely completely out to lunch on price relative to the extremely simplified feature set we require). Thanks in advance.

5 4

IPv6 traffic percentages?
by nanog-isp＠mail.com 26 Sep '16

26 Sep '16

Hello all, Would those with IPv6 deployments kindly share some statistics on their percentage of IPv6 traffic? Bonus points for sharing top IPv6 sources. Anything else than the usual suspects, Google/YouTube, Netflix and Facebook? Some public information I've found so far: - Comcast around 25% IPv6 traffic ( http://www.lightreading.com/ethernet-ip/ip-protocols-software/facebook-ipv6… ) - Comcast has over 1 Tb/s (of mostly YouTube traffic) over IPv6 ( http://corporate.comcast.com/comcast-voices/comcast-reaches-key-milestone-i… ) - Swisscom 26% IPv6 traffic, 60% YouTube ( http://www.swinog.ch/meetings/swinog27/p/01_Martin_Gysi.pdf ) I'd be very much interested in hearing from smaller ISPs, especially those having a very limited number of IPv4 addresses and/or running out. Thanks, Jared

9 18

Experience on Wanguard for 'anti' DDOS solutions
by Marcel Duregards 06 Jul '16

06 Jul '16

Dear Nogers, We are currently evaluating some DDOS detection/mitigation solutions. Do you have any inputs/experiences on Wanguard from Andrisoft, please ?https://www.andrisoft.com/software/wanguard Currently we are just interested on the packets/flows sensors with the console for detection and RTBH trigger. Maybe the packet filtering (for scrubbing) will come later. Best Regards,-Marcel Duregards

14 16

Recommendations, Colo Reno, Albuquerque, Phoenix, Las Vegas
by Eric A Louie 21 Jun '16

21 Jun '16

Does anyone have recommendations for Colocation space in any of those 4 cities? thanks Eric

4 3

Public DNS64
by Tim Durack 01 Jun '16

01 Jun '16

Anyone know of a reliable public DNS64 service? Would be cool if Google added a Public DNS64 service, then I could point the NAT64 prefix at appropriately placed boxes in my network. Why? Other people are better than me at running DNS resolvers :-) -- Tim:>

10 21

Network Weathermap
by James Bensley 28 Apr '16

28 Apr '16

Hi All, Those of you that have a network weathermap similar to [1], what software are you using to edit the maps, the built in editor or something custom, 3rd party/external editor? Paid or free editor? I'm look for a better editing tool I can preferably use with that plugin (we are feeding it from Cacti). I'm open to both open source editors and paid commercial ones. Maybe you use a different weathermap tool, again I'd be interested to hear about that too. Doesn't have to be fed from Cacti/RRDs. Maybe I'm just pants at being visual [2] but I'm finding that making large maps isn't that well supported (the 'move' option on nodes and using the 'via' option on links becomes less accurate) and it's difficult to keep "busy" images clean (no grid, or snap-to-grid, scaling for higher res maps for larger networks etc). The main problem is keeping everything neat though. An example would be that we acquire a network, want to extend an existing map to incorporate the new network, I can’t select a bunch of objects and move them along all together I have to painstakingly move each node by hand, align each link and node by hand etc. Cheers, James. [1] http://network-weathermap.com/manual/0.97b/ [2] That is most likely the main problem here

3 5

New Switches with Broadcom StrataDNX
by Colton Conor 19 Apr '16

19 Apr '16

Does anyone know when the switching and router vendors will release their new models with the Broadcom BCM88370 and BCM88670 chips? It looks like these chips could be used as a carrier grade router and/or metro E device. More information here: http://www.broadcom.com/press/release.php?id=s902223 and here: http://www.nextplatform.com/2015/03/19/new-dune-chips-enable-heftier-switch…

9 17

Why the US Government has so many data centers
by Sean Donelan 12 Apr '16

12 Apr '16

If you've wondered why the U.S. Government has so many data centers, ok I know no one has ever asked. The U.S. Government has an odd defintion of what is a data center, which ends up with a lot of things no rational person would call a data center. If you call every room with even one server a "data center," you'll end up with tens of thousands of rooms now data centers. With this defintiion, I probably have two data centers in my home. Its important because Inspectors General auditors will go around and count things, because that's what they do, and write reports about insane numbers of data centers. https://datacenters.cio.gov/optimization/ "For the purposes of this memorandum, rooms with at least one server, providing services (whether in a production, test, stage, development, or any other environment), are considered data centers. However, rooms containing only routing equipment, switches, security devices (such as firewalls), or other telecommunications components shall not be considered data centers."

18 38

Re: how to deal with port scan and brute force attack from AS 8075 ?
by Todd Crane 11 Apr '16

11 Apr '16

I must have missed that… my bad. > On Mar 31, 2016, at 2:01 AM, Dan Hollis <goemon(a)sasami.anime.net> wrote: > > It's right there in his email: > > "We have sent email to abuse(a)microsoft.com, but no answer." > > -Dan > > On Thu, 31 Mar 2016, Todd Crane wrote: > >> Oh and, >> >> I’m assuming you contacted Microsoft’s abuse? If not, it’s not cool, not to mention unprofessional, to publicly call them out on such a public forum without giving them an opportunity to correct it first. >> >>> On Mar 31, 2016, at 1:15 AM, Todd Crane <todd.crane(a)n5tech.com> wrote: >>> >>> Marcel >>> >>> Depending on what is on those machines, I would just recommend using fail2ban. The default is that if an ip address fails ssh auth 3 times in 5 minutes, their ip gets blocked via iptables for 5 minutes. This is enough to thwart most scripted attacks, especially those from a certain government in Asia. This is configurable to various applications, timing schemes, and blocking/jailing mechanisms. >>> >>> -Todd >>>> On Mar 31, 2016, at 1:02 AM, marcel.duregards--- via NANOG <nanog(a)nanog.org> wrote: >>>> >>>> Dear Nanog'er, >>>> >>>> We are facing a lot of port scan and brute force attack on port 22 (but >>>> not limited to) from Microsoft AS 8075 range toward our own infra, or >>>> toward our customers. >>>> We have sent email to abuse(a)microsoft.com, but no answer. >>>> >>>> source ip are: >>>> NetRange: 40.74.0.0 - 40.125.127.255 >>>> CIDR: 40.74.0.0/15, 40.112.0.0/13, 40.124.0.0/16, >>>> 40.76.0.0/14, 40.80.0.0/12, 40.125.0.0/17, 40.96.0.0/12, 40.120.0.0/14 >>>> NetName: MSFT >>>> >>>> >>>> >>>> We consider port scan and brute force on ssh port as an attack, and even >>>> as a pre-DDOS phase (could be use to install botnet, detect unpatched >>>> host, and so one). >>>> >>>> It's one thing to propose services and make money over an infra, it's an >>>> other thing to take care that you clients do not use this infra to make >>>> illegal stuffs. >>>> >>>> >>>> How do you deal with such massive amount of 'illegal' traffic ? >>>> >>>> Thank, >>>> Best Regards >>>> Marcel >>>> >>>> >>>> >>>> >>>> >>>> He are some examples (we have more than 3000 such packets per day just >>>> from them, probably Azure), and source ip is always differents of course: >>>> >>>> >>>> Flow Filtering Expression >>>> src AS 8075 and dst port 22 and packets=1 >>>> Limit Flows >>>> 40000 >>>> Sorting >>>> By Date >>>> >>>> Date_first_seen Duration Proto _IP_Addr:Port >>>> Dst_IP_Addr:Port Flags Packets >>>> 2016-02-29 14:55:20.108 0.000 6 104.45.210.69:1160 -> >>>> x.x.231:22 ...... 1 >>>> 2016-02-29 14:55:20.611 0.000 6 104.45.210.69:1161 -> >>>> x.x.231:22 ...... 1 >>>> 2016-02-29 14:56:41.004 0.000 6 40.76.55.204:1090 -> >>>> x.x..14:22 ...... 1 >>>> 2016-02-29 14:56:41.324 0.000 6 40.76.55.204:1091 -> >>>> x.x..14:22 ...... 1 >>>> 2016-02-29 15:00:05.670 0.000 6 40.76.55.204:1088 -> >>>> x.x.125:22 ...... 1 >>>> 2016-02-29 15:00:06.003 0.000 6 40.76.55.204:1089 -> >>>> x.x.125:22 ...... 1 >>>> 2016-02-29 15:01:17.358 0.000 6 40.76.70.58:1168 -> >>>> x.x..80:22 ...... 1 >>>> 2016-02-29 15:01:17.676 0.000 6 40.76.70.58:1169 -> >>>> x.x..80:22 ...... 1 >>>> 2016-02-29 15:02:42.637 0.000 6 40.76.55.204:1176 -> >>>> x.x.193:22 ...... 1 >>>> 2016-02-29 15:02:42.878 0.000 6 40.76.55.204:1177 -> >>>> x.x.193:22 ...... 1 >>>> 2016-02-29 15:02:48.067 0.000 6 104.45.210.69:1160 -> >>>> x.x.173:22 ...... 1 >>>> 2016-02-29 15:02:48.394 0.000 6 104.45.210.69:1161 -> >>>> x.x.173:22 ...... 1 >>>> 2016-02-29 15:03:18.854 0.000 6 40.121.53.153:1041 -> >>>> x.x..88:22 ...... 1 >>>> 2016-02-29 15:03:19.172 0.000 6 40.121.53.153:1042 -> >>>> x.x..88:22 ...... 1 >>>> 2016-02-29 15:06:36.248 0.000 6 40.76.55.204:1056 -> >>>> x.x..45:22 ...... 1 >>>> 2016-02-29 15:07:31.882 0.000 6 40.76.80.17:44895 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 15:07:32.245 0.000 6 40.76.80.17:44896 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 15:09:08.433 0.000 6 40.76.70.58:1168 -> >>>> x.x..31:22 ...... 1 >>>> 2016-02-29 15:09:08.744 0.000 6 40.76.70.58:1169 -> >>>> x.x..31:22 ...... 1 >>>> 2016-02-29 15:11:45.668 0.000 6 40.76.80.17:47993 -> >>>> x.x.157:22 ...... 1 >>>> 2016-02-29 15:11:45.987 0.000 6 40.76.80.17:47994 -> >>>> x.x.157:22 ...... 1 >>>> 2016-02-29 15:12:09.543 0.000 6 40.76.70.58:1168 -> >>>> x.x..24:22 ...... 1 >>>> 2016-02-29 15:12:09.925 0.000 6 40.76.70.58:1169 -> >>>> x.x..24:22 ...... 1 >>>> 2016-02-29 15:17:05.920 0.000 6 40.76.70.58:1168 -> >>>> x.x.243:22 ...... 1 >>>> 2016-02-29 15:17:06.241 0.000 6 40.76.70.58:1169 -> >>>> x.x.243:22 ...... 1 >>>> 2016-02-29 15:19:21.364 0.000 6 40.83.121.211:62936 -> >>>> x.x..81:22 ...... 1 >>>> 2016-02-29 15:19:21.704 0.000 6 40.83.121.211:62937 -> >>>> x.x..81:22 ...... 1 >>>> 2016-02-29 15:19:45.891 0.000 6 40.76.70.58:1168 -> >>>> x.x..39:22 ...... 1 >>>> 2016-02-29 15:19:46.273 0.000 6 40.76.70.58:1169 -> >>>> x.x..39:22 ...... 1 >>>> 2016-02-29 15:21:52.030 0.000 6 40.76.70.58:1168 -> >>>> x.x.120:22 ...... 1 >>>> 2016-02-29 15:21:52.349 0.000 6 40.76.70.58:1169 -> >>>> x.x.120:22 ...... 1 >>>> 2016-02-29 15:24:07.614 0.000 6 40.76.55.204:1048 -> >>>> x.x.237:22 ...... 1 >>>> 2016-02-29 15:24:07.933 0.000 6 40.76.55.204:1128 -> >>>> x.x.237:22 ...... 1 >>>> 2016-02-29 15:27:31.289 0.000 6 40.121.53.153:1041 -> >>>> x.x.133:22 ...... 1 >>>> 2016-02-29 15:27:31.544 0.000 6 40.121.53.153:1042 -> >>>> x.x.133:22 ...... 1 >>>> 2016-02-29 15:27:59.120 0.000 6 40.76.70.58:1168 -> >>>> x.x.9.3:22 ...... 1 >>>> 2016-02-29 15:27:59.440 0.000 6 40.76.70.58:1169 -> >>>> x.x.9.3:22 ...... 1 >>>> 2016-02-29 15:29:30.933 0.000 6 40.76.70.58:1168 -> >>>> x.x.211:22 ...... 1 >>>> 2016-02-29 15:29:31.031 0.000 6 40.76.70.58:1169 -> >>>> x.x.211:22 ...... 1 >>>> 2016-02-29 15:29:33.729 0.000 6 40.76.55.204:1142 -> >>>> x.x.166:22 ...... 1 >>>> 2016-02-29 15:29:34.032 0.000 6 40.76.55.204:1143 -> >>>> x.x.166:22 ...... 1 >>>> 2016-02-29 15:31:41.947 0.000 6 40.76.70.58:1168 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 15:31:42.266 0.000 6 40.76.70.58:1169 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 15:32:10.044 0.000 6 40.121.53.153:1041 -> >>>> x.x..71:22 ...... 1 >>>> 2016-02-29 15:32:10.348 0.000 6 40.121.53.153:1042 -> >>>> x.x..71:22 ...... 1 >>>> 2016-02-29 15:32:10.442 0.000 6 104.45.210.69:1161 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 15:32:10.475 0.000 6 104.45.210.69:1160 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 15:32:29.165 0.000 6 40.121.143.132:1040 -> >>>> x.x..62:22 ...... 1 >>>> 2016-02-29 15:32:29.466 0.000 6 40.121.143.132:1041 -> >>>> x.x..62:22 ...... 1 >>>> 2016-02-29 15:37:07.616 0.000 6 40.76.80.17:56902 -> >>>> x.x..51:22 ...... 1 >>>> 2016-02-29 15:37:07.925 0.000 6 40.76.80.17:56903 -> >>>> x.x..51:22 ...... 1 >>>> 2016-02-29 15:40:04.546 0.000 6 40.121.53.153:1041 -> >>>> x.x.186:22 ...... 1 >>>> 2016-02-29 15:40:04.866 0.000 6 40.121.53.153:1042 -> >>>> x.x.186:22 ...... 1 >>>> 2016-02-29 15:40:28.870 0.000 6 40.76.70.58:1168 -> >>>> x.x.171:22 ...... 1 >>>> 2016-02-29 15:40:29.125 0.000 6 40.76.70.58:1169 -> >>>> x.x.171:22 ...... 1 >>>> 2016-02-29 15:41:57.034 0.000 6 40.76.55.204:1128 -> >>>> x.x.181:22 ...... 1 >>>> 2016-02-29 15:41:57.354 0.000 6 40.76.55.204:1176 -> >>>> x.x.181:22 ...... 1 >>>> >>>> >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.163:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.176:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.206:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.158:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.185:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.251:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.255:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.141:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.136:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.235:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.242:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.240:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.100:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.244:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.217:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x..72:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.221:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.5.4:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.150:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.145:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.119:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..52:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.127:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..22:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..77:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..85:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..35:22 ...... 1 >>>> >>>> >>>> >>>> >>> >>

5 6