March 2016 - Test - lists.nanog.org

Why the US Government has so many data centers
by Sean Donelan 12 Apr '16

12 Apr '16

If you've wondered why the U.S. Government has so many data centers, ok I know no one has ever asked. The U.S. Government has an odd defintion of what is a data center, which ends up with a lot of things no rational person would call a data center. If you call every room with even one server a "data center," you'll end up with tens of thousands of rooms now data centers. With this defintiion, I probably have two data centers in my home. Its important because Inspectors General auditors will go around and count things, because that's what they do, and write reports about insane numbers of data centers. https://datacenters.cio.gov/optimization/ "For the purposes of this memorandum, rooms with at least one server, providing services (whether in a production, test, stage, development, or any other environment), are considered data centers. However, rooms containing only routing equipment, switches, security devices (such as firewalls), or other telecommunications components shall not be considered data centers."

18 38

Re: how to deal with port scan and brute force attack from AS 8075 ?
by Todd Crane 11 Apr '16

11 Apr '16

I must have missed that… my bad. > On Mar 31, 2016, at 2:01 AM, Dan Hollis <goemon(a)sasami.anime.net> wrote: > > It's right there in his email: > > "We have sent email to abuse(a)microsoft.com, but no answer." > > -Dan > > On Thu, 31 Mar 2016, Todd Crane wrote: > >> Oh and, >> >> I’m assuming you contacted Microsoft’s abuse? If not, it’s not cool, not to mention unprofessional, to publicly call them out on such a public forum without giving them an opportunity to correct it first. >> >>> On Mar 31, 2016, at 1:15 AM, Todd Crane <todd.crane(a)n5tech.com> wrote: >>> >>> Marcel >>> >>> Depending on what is on those machines, I would just recommend using fail2ban. The default is that if an ip address fails ssh auth 3 times in 5 minutes, their ip gets blocked via iptables for 5 minutes. This is enough to thwart most scripted attacks, especially those from a certain government in Asia. This is configurable to various applications, timing schemes, and blocking/jailing mechanisms. >>> >>> -Todd >>>> On Mar 31, 2016, at 1:02 AM, marcel.duregards--- via NANOG <nanog(a)nanog.org> wrote: >>>> >>>> Dear Nanog'er, >>>> >>>> We are facing a lot of port scan and brute force attack on port 22 (but >>>> not limited to) from Microsoft AS 8075 range toward our own infra, or >>>> toward our customers. >>>> We have sent email to abuse(a)microsoft.com, but no answer. >>>> >>>> source ip are: >>>> NetRange: 40.74.0.0 - 40.125.127.255 >>>> CIDR: 40.74.0.0/15, 40.112.0.0/13, 40.124.0.0/16, >>>> 40.76.0.0/14, 40.80.0.0/12, 40.125.0.0/17, 40.96.0.0/12, 40.120.0.0/14 >>>> NetName: MSFT >>>> >>>> >>>> >>>> We consider port scan and brute force on ssh port as an attack, and even >>>> as a pre-DDOS phase (could be use to install botnet, detect unpatched >>>> host, and so one). >>>> >>>> It's one thing to propose services and make money over an infra, it's an >>>> other thing to take care that you clients do not use this infra to make >>>> illegal stuffs. >>>> >>>> >>>> How do you deal with such massive amount of 'illegal' traffic ? >>>> >>>> Thank, >>>> Best Regards >>>> Marcel >>>> >>>> >>>> >>>> >>>> >>>> He are some examples (we have more than 3000 such packets per day just >>>> from them, probably Azure), and source ip is always differents of course: >>>> >>>> >>>> Flow Filtering Expression >>>> src AS 8075 and dst port 22 and packets=1 >>>> Limit Flows >>>> 40000 >>>> Sorting >>>> By Date >>>> >>>> Date_first_seen Duration Proto _IP_Addr:Port >>>> Dst_IP_Addr:Port Flags Packets >>>> 2016-02-29 14:55:20.108 0.000 6 104.45.210.69:1160 -> >>>> x.x.231:22 ...... 1 >>>> 2016-02-29 14:55:20.611 0.000 6 104.45.210.69:1161 -> >>>> x.x.231:22 ...... 1 >>>> 2016-02-29 14:56:41.004 0.000 6 40.76.55.204:1090 -> >>>> x.x..14:22 ...... 1 >>>> 2016-02-29 14:56:41.324 0.000 6 40.76.55.204:1091 -> >>>> x.x..14:22 ...... 1 >>>> 2016-02-29 15:00:05.670 0.000 6 40.76.55.204:1088 -> >>>> x.x.125:22 ...... 1 >>>> 2016-02-29 15:00:06.003 0.000 6 40.76.55.204:1089 -> >>>> x.x.125:22 ...... 1 >>>> 2016-02-29 15:01:17.358 0.000 6 40.76.70.58:1168 -> >>>> x.x..80:22 ...... 1 >>>> 2016-02-29 15:01:17.676 0.000 6 40.76.70.58:1169 -> >>>> x.x..80:22 ...... 1 >>>> 2016-02-29 15:02:42.637 0.000 6 40.76.55.204:1176 -> >>>> x.x.193:22 ...... 1 >>>> 2016-02-29 15:02:42.878 0.000 6 40.76.55.204:1177 -> >>>> x.x.193:22 ...... 1 >>>> 2016-02-29 15:02:48.067 0.000 6 104.45.210.69:1160 -> >>>> x.x.173:22 ...... 1 >>>> 2016-02-29 15:02:48.394 0.000 6 104.45.210.69:1161 -> >>>> x.x.173:22 ...... 1 >>>> 2016-02-29 15:03:18.854 0.000 6 40.121.53.153:1041 -> >>>> x.x..88:22 ...... 1 >>>> 2016-02-29 15:03:19.172 0.000 6 40.121.53.153:1042 -> >>>> x.x..88:22 ...... 1 >>>> 2016-02-29 15:06:36.248 0.000 6 40.76.55.204:1056 -> >>>> x.x..45:22 ...... 1 >>>> 2016-02-29 15:07:31.882 0.000 6 40.76.80.17:44895 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 15:07:32.245 0.000 6 40.76.80.17:44896 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 15:09:08.433 0.000 6 40.76.70.58:1168 -> >>>> x.x..31:22 ...... 1 >>>> 2016-02-29 15:09:08.744 0.000 6 40.76.70.58:1169 -> >>>> x.x..31:22 ...... 1 >>>> 2016-02-29 15:11:45.668 0.000 6 40.76.80.17:47993 -> >>>> x.x.157:22 ...... 1 >>>> 2016-02-29 15:11:45.987 0.000 6 40.76.80.17:47994 -> >>>> x.x.157:22 ...... 1 >>>> 2016-02-29 15:12:09.543 0.000 6 40.76.70.58:1168 -> >>>> x.x..24:22 ...... 1 >>>> 2016-02-29 15:12:09.925 0.000 6 40.76.70.58:1169 -> >>>> x.x..24:22 ...... 1 >>>> 2016-02-29 15:17:05.920 0.000 6 40.76.70.58:1168 -> >>>> x.x.243:22 ...... 1 >>>> 2016-02-29 15:17:06.241 0.000 6 40.76.70.58:1169 -> >>>> x.x.243:22 ...... 1 >>>> 2016-02-29 15:19:21.364 0.000 6 40.83.121.211:62936 -> >>>> x.x..81:22 ...... 1 >>>> 2016-02-29 15:19:21.704 0.000 6 40.83.121.211:62937 -> >>>> x.x..81:22 ...... 1 >>>> 2016-02-29 15:19:45.891 0.000 6 40.76.70.58:1168 -> >>>> x.x..39:22 ...... 1 >>>> 2016-02-29 15:19:46.273 0.000 6 40.76.70.58:1169 -> >>>> x.x..39:22 ...... 1 >>>> 2016-02-29 15:21:52.030 0.000 6 40.76.70.58:1168 -> >>>> x.x.120:22 ...... 1 >>>> 2016-02-29 15:21:52.349 0.000 6 40.76.70.58:1169 -> >>>> x.x.120:22 ...... 1 >>>> 2016-02-29 15:24:07.614 0.000 6 40.76.55.204:1048 -> >>>> x.x.237:22 ...... 1 >>>> 2016-02-29 15:24:07.933 0.000 6 40.76.55.204:1128 -> >>>> x.x.237:22 ...... 1 >>>> 2016-02-29 15:27:31.289 0.000 6 40.121.53.153:1041 -> >>>> x.x.133:22 ...... 1 >>>> 2016-02-29 15:27:31.544 0.000 6 40.121.53.153:1042 -> >>>> x.x.133:22 ...... 1 >>>> 2016-02-29 15:27:59.120 0.000 6 40.76.70.58:1168 -> >>>> x.x.9.3:22 ...... 1 >>>> 2016-02-29 15:27:59.440 0.000 6 40.76.70.58:1169 -> >>>> x.x.9.3:22 ...... 1 >>>> 2016-02-29 15:29:30.933 0.000 6 40.76.70.58:1168 -> >>>> x.x.211:22 ...... 1 >>>> 2016-02-29 15:29:31.031 0.000 6 40.76.70.58:1169 -> >>>> x.x.211:22 ...... 1 >>>> 2016-02-29 15:29:33.729 0.000 6 40.76.55.204:1142 -> >>>> x.x.166:22 ...... 1 >>>> 2016-02-29 15:29:34.032 0.000 6 40.76.55.204:1143 -> >>>> x.x.166:22 ...... 1 >>>> 2016-02-29 15:31:41.947 0.000 6 40.76.70.58:1168 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 15:31:42.266 0.000 6 40.76.70.58:1169 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 15:32:10.044 0.000 6 40.121.53.153:1041 -> >>>> x.x..71:22 ...... 1 >>>> 2016-02-29 15:32:10.348 0.000 6 40.121.53.153:1042 -> >>>> x.x..71:22 ...... 1 >>>> 2016-02-29 15:32:10.442 0.000 6 104.45.210.69:1161 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 15:32:10.475 0.000 6 104.45.210.69:1160 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 15:32:29.165 0.000 6 40.121.143.132:1040 -> >>>> x.x..62:22 ...... 1 >>>> 2016-02-29 15:32:29.466 0.000 6 40.121.143.132:1041 -> >>>> x.x..62:22 ...... 1 >>>> 2016-02-29 15:37:07.616 0.000 6 40.76.80.17:56902 -> >>>> x.x..51:22 ...... 1 >>>> 2016-02-29 15:37:07.925 0.000 6 40.76.80.17:56903 -> >>>> x.x..51:22 ...... 1 >>>> 2016-02-29 15:40:04.546 0.000 6 40.121.53.153:1041 -> >>>> x.x.186:22 ...... 1 >>>> 2016-02-29 15:40:04.866 0.000 6 40.121.53.153:1042 -> >>>> x.x.186:22 ...... 1 >>>> 2016-02-29 15:40:28.870 0.000 6 40.76.70.58:1168 -> >>>> x.x.171:22 ...... 1 >>>> 2016-02-29 15:40:29.125 0.000 6 40.76.70.58:1169 -> >>>> x.x.171:22 ...... 1 >>>> 2016-02-29 15:41:57.034 0.000 6 40.76.55.204:1128 -> >>>> x.x.181:22 ...... 1 >>>> 2016-02-29 15:41:57.354 0.000 6 40.76.55.204:1176 -> >>>> x.x.181:22 ...... 1 >>>> >>>> >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.163:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.176:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.206:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.158:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.185:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.251:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.255:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.141:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.136:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.235:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.242:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.240:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.100:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.244:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.217:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x..72:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.221:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.5.4:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.150:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.145:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.119:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..52:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.127:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..22:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..77:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..85:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..35:22 ...... 1 >>>> >>>> >>>> >>>> >>> >>

5 6

JANOG38 Meeting Call for Presentations
by Hiroya Kaneko 08 Apr '16

08 Apr '16

Hello, JANOG38 Meeting will take place on 6-8 July 2016 in OKINAWA, Japan. JANOG is making a call for presentations until 15 April 2016. Our meetings are in Japanese, but we have had several non-Japanese speakers who made presentations in the past. We are looking forward to your proposals for presentations. Shishio Tsuchiya,Hiroya Kaneko JANOG38 Programme Committee Co-Chairs ---------------------------------------------------------------------- ** JANOG38 MEETING ---------------------------------------------------------------------- - Host : OKIT Corporation - Date : 6 July., 2016 - 8 July., 2016 - Venue : TBD (Naha, Okinawa) - Fees : Conference(6-8 July): Free Banquet(in the evening on 7th): TBD ---------------------------------------------------------------------- ** HOW TO SUBMIT PRESENTATIONS ---------------------------------------------------------------------- If you are interested to give a presentation, submissions are welcome via e-mail at:"meeting-38[at]janog.gr.jp" with the following information. 1. Speaker's name(s) 2. Speaker's organization(s) 3. Preferred contact email address 4. Submission category (General Session or Panel Session) * If your choice is panel, please tell us the number of speakers 5. Presentation title 6. Abstract 7. Desired presentation time and discussion time 8. Slides (attachment or URL), in PowerPoint or PDF format. Our Meetings are in Japanese, so non-Japanese speakers usually arrange an informal interpreter. If you are interested in making a presentation at JANOG but cannot arrange an interpreter by yourself, you could consult with us at: "meeting-38[at]janog.gr.jp". Although we cannot guarantee, we may be able to help you on volunteer basis. Let us know if you have any questions : meeting-38[at]janog.gr.jp ---------------------------------------------------------------------- ** THE KEY DATE FOR JANOG38 SUBMISSIONS ---------------------------------------------------------------------- CFP Deadline : 15 April 23:59 JST The Program Committee will notify you after 25th April about your submission. ---------------------------------------------------------------------- ** VISA ---------------------------------------------------------------------- Foreign visitor entering Japan must have a passport which has valid period during you stay in Japan. Passport holders from some countries are required to have a visa to visit Japan before they depart toward Japan. Many are exempt from this requirement and can get their visa on entry to Japan. Please determine whether you are exempt from the visa requirement. Please refer to the official website from Ministry of Foreign Affairs of Japan or any other appropriate website to get more information about Visa application. Ministry of Foreign Affairs of Japan - Guide to Japanese Visas http://www.mofa.go.jp/j_info/visit/visa/index.html List of Countries and Regions for Visa Exemptions http://www.mofa.go.jp/j_info/visit/visa/short/novisa.html Please note that JANOG can not assist you with your visa application. If you have any questions about the meeting, please feel free to contact meeting-38[at]janog.gr.jp. ---------------------------------------------------------------------- ** ABOUT JANOG ---------------------------------------------------------------------- JANOG webpage in English is available at: http://www.janog.gr.jp/en/ ---------------------------------------------------------------------- ******************************************************* Hiroya Kaneko NEC Cloud System Research Laboratories 1753, Shimonumabe, Nakahara-ku, Kawasaki Kanagawa 211-8666, Japan TEL +8150-3381-7597 Mail: h-kaneko(a)dr.jp.nec.com

2 1

how to deal with port scan and brute force attack from AS 8075 ?
by marcel.duregards＠yahoo.fr 07 Apr '16

07 Apr '16

Dear Nanog'er, We are facing a lot of port scan and brute force attack on port 22 (but not limited to) from Microsoft AS 8075 range toward our own infra, or toward our customers. We have sent email to abuse(a)microsoft.com, but no answer. source ip are: NetRange: 40.74.0.0 - 40.125.127.255 CIDR: 40.74.0.0/15, 40.112.0.0/13, 40.124.0.0/16, 40.76.0.0/14, 40.80.0.0/12, 40.125.0.0/17, 40.96.0.0/12, 40.120.0.0/14 NetName: MSFT We consider port scan and brute force on ssh port as an attack, and even as a pre-DDOS phase (could be use to install botnet, detect unpatched host, and so one). It's one thing to propose services and make money over an infra, it's an other thing to take care that you clients do not use this infra to make illegal stuffs. How do you deal with such massive amount of 'illegal' traffic ? Thank, Best Regards Marcel He are some examples (we have more than 3000 such packets per day just from them, probably Azure), and source ip is always differents of course: Flow Filtering Expression src AS 8075 and dst port 22 and packets=1 Limit Flows 40000 Sorting By Date Date_first_seen Duration Proto _IP_Addr:Port Dst_IP_Addr:Port Flags Packets 2016-02-29 14:55:20.108 0.000 6 104.45.210.69:1160 -> x.x.231:22 ...... 1 2016-02-29 14:55:20.611 0.000 6 104.45.210.69:1161 -> x.x.231:22 ...... 1 2016-02-29 14:56:41.004 0.000 6 40.76.55.204:1090 -> x.x..14:22 ...... 1 2016-02-29 14:56:41.324 0.000 6 40.76.55.204:1091 -> x.x..14:22 ...... 1 2016-02-29 15:00:05.670 0.000 6 40.76.55.204:1088 -> x.x.125:22 ...... 1 2016-02-29 15:00:06.003 0.000 6 40.76.55.204:1089 -> x.x.125:22 ...... 1 2016-02-29 15:01:17.358 0.000 6 40.76.70.58:1168 -> x.x..80:22 ...... 1 2016-02-29 15:01:17.676 0.000 6 40.76.70.58:1169 -> x.x..80:22 ...... 1 2016-02-29 15:02:42.637 0.000 6 40.76.55.204:1176 -> x.x.193:22 ...... 1 2016-02-29 15:02:42.878 0.000 6 40.76.55.204:1177 -> x.x.193:22 ...... 1 2016-02-29 15:02:48.067 0.000 6 104.45.210.69:1160 -> x.x.173:22 ...... 1 2016-02-29 15:02:48.394 0.000 6 104.45.210.69:1161 -> x.x.173:22 ...... 1 2016-02-29 15:03:18.854 0.000 6 40.121.53.153:1041 -> x.x..88:22 ...... 1 2016-02-29 15:03:19.172 0.000 6 40.121.53.153:1042 -> x.x..88:22 ...... 1 2016-02-29 15:06:36.248 0.000 6 40.76.55.204:1056 -> x.x..45:22 ...... 1 2016-02-29 15:07:31.882 0.000 6 40.76.80.17:44895 -> x.x..75:22 ...... 1 2016-02-29 15:07:32.245 0.000 6 40.76.80.17:44896 -> x.x..75:22 ...... 1 2016-02-29 15:09:08.433 0.000 6 40.76.70.58:1168 -> x.x..31:22 ...... 1 2016-02-29 15:09:08.744 0.000 6 40.76.70.58:1169 -> x.x..31:22 ...... 1 2016-02-29 15:11:45.668 0.000 6 40.76.80.17:47993 -> x.x.157:22 ...... 1 2016-02-29 15:11:45.987 0.000 6 40.76.80.17:47994 -> x.x.157:22 ...... 1 2016-02-29 15:12:09.543 0.000 6 40.76.70.58:1168 -> x.x..24:22 ...... 1 2016-02-29 15:12:09.925 0.000 6 40.76.70.58:1169 -> x.x..24:22 ...... 1 2016-02-29 15:17:05.920 0.000 6 40.76.70.58:1168 -> x.x.243:22 ...... 1 2016-02-29 15:17:06.241 0.000 6 40.76.70.58:1169 -> x.x.243:22 ...... 1 2016-02-29 15:19:21.364 0.000 6 40.83.121.211:62936 -> x.x..81:22 ...... 1 2016-02-29 15:19:21.704 0.000 6 40.83.121.211:62937 -> x.x..81:22 ...... 1 2016-02-29 15:19:45.891 0.000 6 40.76.70.58:1168 -> x.x..39:22 ...... 1 2016-02-29 15:19:46.273 0.000 6 40.76.70.58:1169 -> x.x..39:22 ...... 1 2016-02-29 15:21:52.030 0.000 6 40.76.70.58:1168 -> x.x.120:22 ...... 1 2016-02-29 15:21:52.349 0.000 6 40.76.70.58:1169 -> x.x.120:22 ...... 1 2016-02-29 15:24:07.614 0.000 6 40.76.55.204:1048 -> x.x.237:22 ...... 1 2016-02-29 15:24:07.933 0.000 6 40.76.55.204:1128 -> x.x.237:22 ...... 1 2016-02-29 15:27:31.289 0.000 6 40.121.53.153:1041 -> x.x.133:22 ...... 1 2016-02-29 15:27:31.544 0.000 6 40.121.53.153:1042 -> x.x.133:22 ...... 1 2016-02-29 15:27:59.120 0.000 6 40.76.70.58:1168 -> x.x.9.3:22 ...... 1 2016-02-29 15:27:59.440 0.000 6 40.76.70.58:1169 -> x.x.9.3:22 ...... 1 2016-02-29 15:29:30.933 0.000 6 40.76.70.58:1168 -> x.x.211:22 ...... 1 2016-02-29 15:29:31.031 0.000 6 40.76.70.58:1169 -> x.x.211:22 ...... 1 2016-02-29 15:29:33.729 0.000 6 40.76.55.204:1142 -> x.x.166:22 ...... 1 2016-02-29 15:29:34.032 0.000 6 40.76.55.204:1143 -> x.x.166:22 ...... 1 2016-02-29 15:31:41.947 0.000 6 40.76.70.58:1168 -> x.x.137:22 ...... 1 2016-02-29 15:31:42.266 0.000 6 40.76.70.58:1169 -> x.x.137:22 ...... 1 2016-02-29 15:32:10.044 0.000 6 40.121.53.153:1041 -> x.x..71:22 ...... 1 2016-02-29 15:32:10.348 0.000 6 40.121.53.153:1042 -> x.x..71:22 ...... 1 2016-02-29 15:32:10.442 0.000 6 104.45.210.69:1161 -> x.x.246:22 ...... 1 2016-02-29 15:32:10.475 0.000 6 104.45.210.69:1160 -> x.x.246:22 ...... 1 2016-02-29 15:32:29.165 0.000 6 40.121.143.132:1040 -> x.x..62:22 ...... 1 2016-02-29 15:32:29.466 0.000 6 40.121.143.132:1041 -> x.x..62:22 ...... 1 2016-02-29 15:37:07.616 0.000 6 40.76.80.17:56902 -> x.x..51:22 ...... 1 2016-02-29 15:37:07.925 0.000 6 40.76.80.17:56903 -> x.x..51:22 ...... 1 2016-02-29 15:40:04.546 0.000 6 40.121.53.153:1041 -> x.x.186:22 ...... 1 2016-02-29 15:40:04.866 0.000 6 40.121.53.153:1042 -> x.x.186:22 ...... 1 2016-02-29 15:40:28.870 0.000 6 40.76.70.58:1168 -> x.x.171:22 ...... 1 2016-02-29 15:40:29.125 0.000 6 40.76.70.58:1169 -> x.x.171:22 ...... 1 2016-02-29 15:41:57.034 0.000 6 40.76.55.204:1128 -> x.x.181:22 ...... 1 2016-02-29 15:41:57.354 0.000 6 40.76.55.204:1176 -> x.x.181:22 ...... 1 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> x.x.163:22 ...... 1 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> x.x.176:22 ...... 1 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> x.x.206:22 ...... 1 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> x.x.158:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.185:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.251:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.255:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.141:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.136:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.235:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.242:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.240:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.100:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.244:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.217:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x..72:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.221:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.5.4:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.150:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.145:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.119:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..52:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..75:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.127:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..22:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..77:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.246:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.137:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..85:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..35:22 ...... 1

11 12

Some doubts on large scale BGP/AS design and black hole routing risk
by magicboiz＠hotmail.com 05 Apr '16

05 Apr '16

Hi everybody! as part of laboratory work at the university, I'm working on a BGP design study, and I would like to post some questions regarding IP address space allocation and its impact on BGP which are breaking my mind :) Let's suppose we have an ISP/AS with two POPs: PARIS and LONDON. These two POPs are connected with redundant leased lines. Each POP has a BGP router speaking eBGP to different ISP providers/upstreams and also, each POP run its own OSPF area/ISIS area. Something like this: <INET> ---eBGP---<LONDON POP-ospf area1>===redundant leased lines (ospf area0)===<PARIS POP- ospf area2>---eBGP---<INET> Now, this AS/ISP gets one /22 prefix from it RIR (RIPE in this case), and starts to announce it to its upstreams in PARIS and LONDON at the same time. My questions are: 1. What could happen in the case of total failure in the redundant leased lines? Black hole routing between POPs? 2. What are the best design methods to avoid this scenario? 2.1: adding a third POP creating a triangle? What if a POP looses connection with the other two POPs at the same time? Another black hole? 2.2: requesting another prefix and allocating 1:1 prefix:POP, so in the scenario each POP only would announce its prefix to the upstreams? 2.3: other? Thanks in advance! J.

6 9

Colocation Server Lifts
by Jason Lee 04 Apr '16

04 Apr '16

Hi NANOG community, A few questions I have for the community regarding server lifts at colo facilities. 1. Is a server lift something you would typically expect a colo facility to provide? if yes, 2. Do colo facilities typically allow customers to just use them or provide an operator? 3. Is it a free offering or something they rent out? 4. What would be the typical device weight you would lift? 5. What would be the max device weight you would lift? Thanks, Jason

5 4

shipping from US to Telstra (ex-Pacnet) facility, 11 Chun Kwong St, Hong Kong
by Joe Abley 31 Mar '16

31 Mar '16

Hi all, If anybody has recently managed to ship equipment from the US to the Pacnet (now Telstra) facility at 11 Chun Kwong St, Hong Kong and doesn't mind comparing notes, any chance you could drop me a line off-list? We have some shipping confusion, and it would be great to see an example of paperwork that is known not to have failed. Thanks, Joe

1 0

Capacity planning , transit vs last mile
by Jean-Francois Mezei 31 Mar '16

31 Mar '16

Canada is to hold a 3 week long hearing on discussing whether the internet is important and whether the farcical 5/1 speed promoted by the government is adequate. In this day and age, it would be easy to just set FTTP as target technology and be done with it, but too many want to have a policy that is technologically neutral. To this end, I will not only be proposing that subsidized deployments not only meet advertised service speed standards, but also a capacity per end user metric for the last mile technology as well as for the backhaul/transit. (One of the often subsidized companies deploys fixed wireless which delivers the advertised speed for the first week, but routinely gets oversubscribed after a while and customers feel like on dialup.) I know that for sufficiently large ISPs, they currently provision just over 1mbps of transit capacity per end user (so 800-1000 customers per 1gbps of transit). The number rises by over 30% a year as usage grows. (The CRTC can get exact figure from telecom operators and generate aggregate industry-wide growth in traffic to do yearly standard adjustment). QUESTION: Say the policy is 1mbps per customer if 1000 customer or more. Is there some formula (approx or precise) to calculate how that 1mbps changes for smaller samples ? (like 500 customers, 200 ? ) And on the last mile portion where one has typically few users on each shared capacity segment (fixed wireless, FTTP, cable), are there fairly standard oversubscription ratios based on average service speed that is sold in that neighbourhood ? (for instance if I have 100 customers with average subscibed speed of 15mbps, how much capacity should the antenna serving those customers have ? I realise that each ISP guards its oversubscription ratios as very proprietary, but aren't there generic industry-wide recommendations ? My goal is to have some basic standards that prevent gross over subscription that result in unusable service. As well, I want that a company pitching a broadband deployment be able to demonstrate that the technology being deployed will last X years because it has sufficient capacity to handle the number of customers as well as the predicted growth in usage each year. Any help ? comments on whether this is crazy ? sanity check ?

5 6

tel script
by Robert Drake 29 Mar '16

29 Mar '16

This is a program for logging into devices. You can find it here: https://github.com/rfdrake/tel I don't like to self promote things, but I'm interested in feedback. I'm also interested in alternatives if someone wrote something better. I started it a long time ago as a lighter clogin which didn't hang as much. Moving from expect to perl cut and bunch of the cruft out because of how verbose the TCL language is. My script is now larger than clogin and no longer consists of a single file. It's also arguably much cruftier in places, but it's gained some features I think people may like: Color syntax highlighting for "show interface" and some other commands An attempt to make backspace work on platforms with differing opinions of ^H vs ^? Run multiple script files and multiple devices in the same command (tel -x script1.txt -x script2.txt router router2 router3) Unified logout command: ctrl-d send slow (tel -s .5 -x script1.txt router) for sending scripts to devices with buffering issues send slow interactively (tel -S .5 router) for cut and paste to devices with buffering issues (some terminal emulators will do this if it's the only thing you need) change your device profile after login (tel -A zhone oob-test-lab:2004) helpful if you login through an out of band console which is made by one vendor into a device made by another vendor Support for KeePass, Pass, PWSafe3, and Gnome/KDE/MacOS Keyring, as well as a combination of these for storing passwords in encrypted files The entire thing is very customizeable for people who know perl or scripting languages. It's designed for NOC use on bounce servers where the administrator might setup the global profile in /etc/telrc, then the individual users would make their own profiles in their home directories to override individual settings. Limitations: I'm pretty sure I tried to build this on Cygwin once and it failed for reasons that probably can never be fixed. I've also never tested on MacOSX. I've run it successfully on various Linux as well as FreeBSD and OpenBSD.

1 0

AWS Contact
by Mike Hammett 27 Mar '16

27 Mar '16

Could anyone with AWS Direct Connect or AWS Partner Network reach out to me? I filled out the form on the web site almost a month ago that promised a five day turn around. I also had someone else in here at Amazon poking the Direct Connect people, but no response there either. :-\ ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

1 0