June 2016 - Test - lists.nanog.org

Detecting Attacks
by subashini hariharan 12 Jun '16

12 Jun '16

Hello, I am Subashini, a graduate student. I am interested in doing my project in Network Security. I have a doubt related to it. The aim is to detect DoS/DDoS attacks using the application. I am going to use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log Analytics). My doubt is regarding how do we generate logs for detecting this attack? As I am new to this process, I am not sure about it. Also, if it is possible to do any other attacks similar to this, you can please give a hint about it. Could anyone please help with this, it would be a great help!! -- Thank You. With Regards, H.Subashini

2 1

intra-AS messaging for route leak prevention
by Sriram, Kotikalapudi (Fed) 12 Jun '16

12 Jun '16

I am a co-author on a route-leak detection/mitigation/prevention draft in the IDR WG in the IETF: https://tools.ietf.org/html/draft-ietf-idr-route-leak-detection-mitigation-… Based on private conversations with a few major ISPs, the following common practice for intra-AS messaging (using Community tagging in iBGP) for prevention of route leaks is described in Section 3.2 of the draft: <begin quote> “Routes are tagged on ingress to an AS with communities for origin, including the type of eBGP peer it was learned from (customer, transit-provider or peer), geographic location, etc. The community attributes are carried across the AS with the routes. Routes that the AS originates directly are tagged with similar origin communities when they are redistributed into BGP from static, IGP, etc. These communities are used along with additional logic in route policies to determine which routes are to be announced to which eBGP peers and which are to be dropped. Route policy is applied to eBGP sessions based on what set of routes they should receive (transit, full routes, internal-only, default-only, etc.). In this process, the ISP's AS also ensures that routes learned from a transit-provider or a lateral peer (i.e. non-transit) at an ingress router are not leaked at an egress router to another transit-provider or peer. Additionally, in many cases, ISP network operators' outbound policies require explicit matches for expected communities before passing routes. This helps ensure that that if an update has made it into the routing table (i.e. RIB) but has missed its ingress community tagging (due to a missing/misapplied ingress policy), it will not be inadvertently leaked.” <end quote> Question: Are there other means of conveying this information in common use today (i.e. for prevention of route leaks)? Also, the following publicly available references can be possibly cited in support of the above: https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf http://showipbgp.com/bgp-tools/bgp-community-list/91-level3-as3356.html Pointers to any other relevant references would be very welcome as well. Thank you. Sriram

8 20

Re: Detecting Attacks
by alvin nanog 11 Jun '16

11 Jun '16

hi su.. On 06/10/16 at 10:39pm, subashini hariharan wrote: > I am Subashini, a graduate student. I am interested in doing my project in > Network Security. I have a doubt related to it. duh... too broad of a subject ... you'd need to be more specific about which of the hundred's of sub categories ... > The aim is to detect DoS/DDoS attacks using the application. good ... sorta specific but not ... > I am going to > use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log > Analytics). hummm, why that app and not the couple dozen other ways people are using to detect incoming and/or outgoing DDoS attacks if the "professor" says "use ELK" ... you have no ther choice ... if not, there's much better options to detect DDoS attacks ... ( tcpdump -nnvv ) ... if you cannot explain each line, you've got a DDoS problem > My doubt is regarding how do we generate logs for detecting this attack? As > I am new to this process, I am not sure about it. what's the doubt ?? if there is a doubt ... conduct and experiment and see if it confirms your expected result or explain why its different and do more experiments until "its all explained" and no more doubts > Also, if it is possible to do any other attacks similar to this, you can > please give a hint about it. several dozens other types of attacks similar to DDoS, which takes over a server or network offline including no-technical-skill required attacks > Could anyone please help with this, it would be a great help!! google/yahoo/bing is your assistant ready to give you ALL the answer's you need and ant ----------- side notes ... a) if you log all incoming packets ( attacks ), you have increased the effectiveness of ddos attacks since you have now gave them the power to fill up your disk, use your cpu, use your memory, use your time to review the logs, etc, etc all of that is bad bad stuff to have the DDoS attackers do to you b) for logs, etc, there are dozens of other apps that try to detect attacks ( splunk, snort, hundred other apps, including eyeballs ) why are some methodologies better than others ? c) detecting DDoS attacks is nice but, what's the point ?? you're still under attack ... and haven't resolved the issue kinda like cooking dinner but not eating it ... you're still starving d) every computer connected to the internet is under constant 24x7x365 attacks ... a good "ddos detector" will tell you how much traffic is legitimate and how much bandwidth is wasted by the attacks and which server and which ports they are attacking, etc etc script kiddies are already attacking your network ( the one you're using bnow ) .. it's a free and harmless DDoS attacks and you should be able to see what they are doing to you "now" if you cannot "see what" they are attacking, you've got a major problem e) if you want to generate some specific DDoS attacks .. use ping, nping, hping, nmap, etc to start .... that should keep you busy for the next year or few years do NOT ever send packets outside to computers you do not own, or some ominous looking folks might come looking for you f) if you want to detect DDoS attacks .... post process tcpdump's output magic pixie dust alvin # # DDoS-Simulator.net # DDoS-Mitigator.net #

1 0

RE: Netflix banning HE tunnels
by Scott Weeks 11 Jun '16

11 Jun '16

--- chuckchurch(a)gmail.com wrote: From: "Chuck Church" <chuckchurch(a)gmail.com> The true jerks who used HE to bypass geo-lockout probably changed to something else the next day. But we suffer still. The FCC or some other federal entity probably needs to step in. ------------------------------------------ Yeah, because the US federal government does such a great job fixing problems like this... scott

3 2

Akamai GeoIP
by Josh Reynolds 10 Jun '16

10 Jun '16

Can somebody from Akamai contact me offlist about a GeoIP location change for a block please? Thank you.

2 1

Maybe Telia issues?
by Jeff McAdams 10 Jun '16

10 Jun '16

Not quite sure whether this should go to outages, or here. I'm not confident that there actually *is* an outage of any sort...having a tough time characterizing it. I have an IPSec tunnel between 64.6.220.219 (upstreams Sprint, AT&T, and LeveL3/legacy TWTelecom) and 64.199.98.162 (upstream Windstream). Egress from 64.6.220.219 was going through Sprint until I turned that session down. traceroute to 64.199.98.162 (64.199.98.162), 30 hops max, 60 byte packets 1 1a-1-vlan11.int.appriss.com (10.10.35.1) 0.995 ms 0.965 ms 0.947 ms 2 lsces03-e-1-13.office.appriss.com (10.9.3.45) 0.283 ms 0.344 ms 0.421 ms 3 lscorpfw01a-ge2-0-0-0.int.appriss.com (64.6.219.41) 0.275 ms 0.299 ms 0.272 ms 4 clinetedge01-ge-0-3-0-0.appriss.net (64.6.221.157) 0.731 ms 0.762 ms 0.752 ms 5 sl-gw10-nsh-0-1-0-0-si204.sprintlink.net (144.228.97.29) 45.753 ms 45.782 ms 45.772 ms 6 144.232.11.73 (144.232.11.73) 44.496 ms 44.321 ms 44.296 ms 7 144.232.5.212 (144.232.5.212) 46.955 ms 45.695 ms 46.958 ms 8 144.232.2.225 (144.232.2.225) 42.132 ms 144.232.15.111 (144.232.15.111) 41.922 ms 144.232.10.218 (144.232.10.218) 41.928 ms 9 atl-bb1-link.telia.net (62.115.49.157) 42.872 ms 42.863 ms 42.955 ms 10 * * * 11 * * * traceroute from the 64.199.98.162 side back towards 64.6.220.219: Type escape sequence to abort. Tracing the route to 64.6.220.219 1 64.199.98.161 0 msec 10 msec 0 msec 2 205.147.221.153 0 msec 10 msec 0 msec 3 40.128.249.156 10 msec 0 msec 0 msec 4 40.136.117.74 0 msec 0 msec 10 msec 5 40.128.10.138 10 msec 20 msec 40.128.248.62 10 msec 6 40.128.10.150 10 msec 40.128.10.146 10 msec 40.128.10.150 10 msec 7 80.239.194.41 20 msec 10 msec 10 msec 8 213.248.87.254 10 msec 10 msec 30 msec 9 12.122.133.34 20 msec 20 msec 20 msec 10 12.122.152.137 20 msec 20 msec 20 msec 11 12.122.152.209 50 msec 20 msec 20 msec 12 12.118.107.122 40 msec 40 msec 40 msec 13 170.75.217.4 50 msec 40 msec 50 msec 14 * * * 15 * * * (the 170.75.217.4 is my edge facing AT&T) When I shut down my BGP session to Sprint, my traffic shifted to AT&T and the tunnel came up. Anyone else seeing any issues around this area (I know, pretty vague), seemingly specifically related to interconnections between Sprint, Telia, and Windstream? I know Telia experienced some issues yesterday that were apparently resolved, maybe some lingering issues resulting from that? Shot in the dark, here. -- Jeff

1 0

Equinix IX Port Moves
by Mike Hammett 10 Jun '16

10 Jun '16

Who has moved an Equinix IX port? We're told that it's a full cancellation, re-order, re IPs, re-peering, etc. Can anyone lend any input either way on that? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

5 6

Local Loop Provider
by Rod Beck 10 Jun '16

10 Jun '16

Hi, I am looking for on-net tail providers between the sites below. Need both 100 and 1000 meg Layer 2 Ethernet point-to-point quotes. Two year terms. A point: 12101 Tukwila International Blvd, Seattle, WA 98168. Z point: 2001 6th Avenue, Westin Bld. A point: 4300 Brighton Blvd, Denver, CO 80216. Z point: 910 15th Street, Denver (Coresite). Regards, Roderick. Roderick Beck Sales Contractor - Europe and the Americas Hibernia Networks http://www.hibernianetworks.com Budapest and New York 36-30-859-5144 rod.beck(a)hibernianetworks.com This e-mail and any attachments thereto is intended only for use by the addressee(s) named herein and may be proprietary and/or legally privileged. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this email, and any attachments thereto, without the prior written permission of the sender is strictly prohibited. If you receive this e-mail in error, please immediately telephone or e-mail the sender and permanently delete the original copy and any copy of this e-mail, and any printout thereof. All documents, contracts or agreements referred or attached to this e-mail are SUBJECT TO CONTRACT. The contents of an attachment to this e-mail may contain software viruses that could damage your own computer system. While Hibernia Networks has taken every reasonable precaution to minimize this risk, we cannot accept liability for any damage that you sustain as a result of software viruses. You should carry out your own virus checks before opening any attachment.

1 0

Participation IEEE R8 | TSP 2016 39th Int. Conf. on Telecommunications and Signal Processing | June 27-29, 2016 Vienna, Austria
by TSP 2016 09 Jun '16

09 Jun '16

************************************************************************************ *** CALL FOR PARTICIPATION *** ************************************************************************************ 2016 39th International Conference on Telecommunications and Signal Processing (TSP) June 27-29, 2016, Hilton Garden Inn Vienna South, Hertha-Firnberg-Strasse 5, 1100 Vienna, Austria http://tsp.vutbr.cz/ Technically co-sponsored by IEEE Region 8 <http://www.ieeer8.org/>, EEE Austria Section <http://www.ieee-austria.org/>, IEEE Czechoslovakia Section <http://ieee.cz/en>, IEEE Czechoslovakia Section SP/CAS/COM Joint Chapter <http://ieee.cz/cascom>, and IEEE Croatia Section Communications Chapter <http://www.ieee.hr/ieeesection/odjeli_chapteri/com19>. The TSP 2016 Proceedings, containing presented papers at the Conference, will be sent for indexing in the IEEE Xplore® <http://ieeexplore.ieee.org/> digital library registered under _IEEE Conference Record #38642 <http://www.ieee.org/conferences_events/conferences/conferencedetails/index.…>_, SCOPUS <http://www.scopus.com/>, Conference Proceedings Citation Index (CPCI) of Thomson Reuters <http://isiknowledge.com/>, DBLP <http://www.informatik.uni-trier.de/%7Eley/db/index.html>, and Google Scholar <http://scholar.google.com/> databases. ************************************************************************************ Dear Colleague, On behalf of the organizing committee of the conference, we would like to invite you to participate in the *2016 39th International Conference on Telecommunications and Signal Processing (TSP - *http://tsp.vutbr.cz/*)*, which will be held on *June 27-29, 2016, in Vienna, Austria*. Continuing the tradition of TSP, the 2016 edition of the conference will be an excellent opportunity for networking with international experts and to experience a rich mix of excellent technical and social programs. The TSP Conference serves as a premier annual international forum to promote the exchange of the latest advances in telecommunication technology and signal processing. The aim of the Conference is to bring together both novice and experienced scientists, developers, and specialists, to meet new colleagues, collect new ideas, and establish new cooperation between research groups from universities, research centers, and private sectors from the whole Europe, America, Asia, Australia, and Africa. *CONFERENCE PROGRAMME: * TSP 2016 programme includes outstanding plenary talks, superb technical sessions, and wonderful networking and social events. */_Conference highlights include: _/* _Invited Keynotes: _ - /Professor Ray-Guang Cheng/ (Department of Electronic and Computer Engineering, National Taiwan University of Science and Technology (NTUST), Taipei, Taiwan) - /Title/: Machine Type Communications: Challenges and Perspectives - /Professor Ram M. Narayanan/ (Department of Electrical Engineering, The Pennsylvania State University, USA) - /Title/: Sensing and Communications Using Ultrawideband Random Noise and Chaotic Waveforms - /Professor Ahmed Elwakil/ (Department of Electrical and Computer Engineering, College of Engineering, University of Sharjah, UAE) - /Title/: Fractional-Order Circuits and Systems: An Emerging Interdisciplinary Research Topic _Technical Program: _ 23 technical sessions consisting of oral lecture and poster sessions _Special Sessions: _* */Special Session 1/: Fractional-Order Systems: Theory, Design and Applications /Special Session 2/: Signal and Image Processing for Biometric Human Recognition: Theory, Methods, Applications and Systems /Special Session 3/: Monitoring and Control Based on Image Processing /Special Session 4/: Photonic Networks and Services: Theory, Design, Modeling, and Applications _Social and Networking Events_: One per each day. *CONFERENCE TOPICS: *Topics of TSP 2016 Conference include: /AREA 1: Telecommunications / 1. Information Systems 2. Network Services 3. Network Technologies 4. Telecommunication Systems 5. Modelling, Simulation and Measurement /AREA 2: Signal Processing / 6. Analog Signal Processing 7. Audio, Speech and Language Processing 8. Biomedical Signal Processing 9. Digital Signal Processing 10. Image and Video Signal Processing *COMMITTEES: * - Karol Molnár, Honeywell International, s.r.o., Czech Republic, IEEE Member - General Chair - Norbert Herencsár, Brno University of Technology, Czech Republic, IEEE Senior Member – IEEE Czechoslovakia Section CAS/COM/SP Joint Chapter Chair - Deputy Chair - Philipp Svoboda, Vienna University of Technology, Austria, IEEE Senior Member - Local Arrangement Chair - Jiří Hošek, Brno University of Technology, Czech Republic, IEEE Member - Industrial & Exhibition Chair - Jaroslav Koton, Brno University of Technology, Czech Republic, IEEE Senior Member - Publication Chair - Nándor Mátrai, Asszisztencia Congress Bureau, Hungary - Finance Chair /Steering Committee: / - Ram M. Narayanan, The Pennsylvania State University, USA - Full Professor, IEEE Fellow - Markus Rupp, Vienna University of Technology, Austria - Dean, IEEE Fellow - Ismail Kaya, Karadeniz Technical University, Turkey, IEEE Member - Sridhar Krishnan, Ryerson University, Canada - Associate Dean, IEEE Senior Member - Mario Kušek, University of Zagreb, Croatia, IEEE Member - IEEE Croatia Section Communications Chapter Chair - Shahram Minaei, Dogus University, Turkey - Full Professor, IEEE Senior Member - Kimio Oguchi, Seikei University, Japan - Full Professor, IEEE Member - Jakub Pęksiński, West Pomeranian University of Technology, Poland - Hector Perez-Meana, National Polytechnic Institute, Mexico - Full Professor, IEEE Senior Member - Vladimir Poulkov, Technical University of Sofia, Bulgaria - Dean, IEEE Senior Member - Zdeněk Smékal, Brno University of Technology, Czech Republic - Full Professor, IEEE Senior Member - Attila Vidács, Budapest University of Technology and Economics, Hungary - Deputy Head of Department - Miroslav Vozňák, VŠB-Technical University of Ostrava, Czech Republic - Department Chair, IEEE Member - Drago Žagar, University of Osijek, Croatia - Dean, IEEE Senior Member *ORGANIZERS: *The TSP 2016 is IEEE technically co-sponsored Conference organized in cooperation with eleven universities: - Department of Telecommunications, Brno University of Technology, Brno, Czech Republic - Department of Telecommunications and Media Informatics, Budapest University of Technology and Economics, Budapest, Hungary - Department of Electrical and Electronics Engineering, Karadeniz Technical University, Trabzon, Turkey - Faculty of Electrical Engineering, West Pomeranian University of Technology, Szczecin, Poland - Department of Telecommunications, VSB - Technical University of Ostrava, Ostrava, Czech Republic - Institute of Telecommunications, Slovak University of Technology, Bratislava, Slovak Republic - Laboratory for Telecommunications, University of Ljubljana, Ljubljana, Slovenia - Department of Telecommunication Engineering, Czech Technical University in Prague, Prague, Czech Republic - Faculty of Electrical Engineering, University of Osijek, Osijek, Croatia - Faculty of Telecommunications, Technical University of Sofia, Sofia, Bulgaria - Information Networking Laboratory, Graduate School and Faculty of Science and Technology, Seikei University, Tokyo, Japan *REGISTRATION DEADLINES: Listeners' Registration and Payment: *June 27, 2016 *CONTACTS: *Formore information please visit the Conference website at http://tsp.vutbr.cz/. We are also ready to answer your questions emailed to tsp(a)feec.vutbr.cz <mailto:tsp@feec.vutbr.cz>. Looking forward to meeting you in Vienna, Austria. With best regards, Norbert Herencsar and Karol Molnar TSP 2016 Organizing Committee Members Web: http://tsp.vutbr.cz/ E-mail: tsp(a)feec.vutbr.cz <mailto:tsp@feec.vutbr.cz> Follow us on: - Facebook https://www.facebook.com/tspconf - Twitter https://twitter.com/TSPconf =============================================================== Department of Telecommunications Faculty of Electrical Engineering and Communication Brno University of Technology Technicka 3082/12 616 00 Brno Czech Republic

1 0

Telia
by Anthony Francis - Handy Networks LLC 09 Jun '16

09 Jun '16

Hello All, It looks like they resolved the issue: “Dear Customer, Our core team has resolved an issue on our backbone causing U.S. customers packet loss. The root cause analysis will follow and we expect no further packet loss due to this issue.” — Anthony Francis // Handy Networks LLC Hosting Support Manager Providing Dedicated Server, IaaS and Colocation Hosting Solutions Tel: 303-414-6904 | Fax: 303-414-6912 www.handynetworks.com<http://www.handynetworks.com/>

1 0