September 2016 - Test - lists.nanog.org

is someone with BCP38.info update privs summarizing this discussion?
by Stephen Satchell 26 Sep '16

26 Sep '16

I think some pretty good information has surfaced, that would be WONDERFUL to have on that site.

1 0

Lightower (ASN:46887) RTBH community info
by Matthew Crocker 26 Sep '16

26 Sep '16

Hello, Does anyone know the RTBH community for Lightower? I’ve tried 46887:666 but that doesn’t work. I have a /32 I need to blackhole, Lightower is the last ISP and it doesn’t appear they support RTBH ☹ Thanks -Matt -- Matthew Crocker President – Crocker Communications matthew(a)corp.crocker.com<mailto:matthew@corp.crocker.com>

5 4

Re: IP addresses being attacked in Krebs DDoS?
by Alexander Maassen 26 Sep '16

26 Sep '16

Just give me thise ips so i can add em in dronebl Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Brett Glass <nanog(a)brettglass.com> Datum: 25-09-16 22:01 (GMT+01:00) Aan: NANOG <nanog(a)nanog.org> Onderwerp: IP addresses being attacked in Krebs DDoS? As an ISP who is pro-active when it comes to security, I'd like to know what IP address(es) are being hit by the Krebs on Security DDoS attack. If we know, we can warn customers that they are harboring infected PCs and/or IoT devices. (And if all ISPs did this, it would be possible to curtail such attacks and plug the security holes that make them possible.) --Brett Glass, LARIAT.NET

1 0

AS4233852001 advertising 192.0.0.0/2?
by Adam Greene 26 Sep '16

26 Sep '16

We were alerted to this by https://radar.qrator.net. This seems wrong from a number of angles . Adam

3 2

Re: Krebs on Security booted off Akamai network after DDoS attack proves pricey
by John Kristoff 26 Sep '16

26 Sep '16

On Sun, 25 Sep 2016 22:59:15 +0000 Stephen Satchell <list(a)satchell.net> wrote: > In short, I have yet to see a "cookbook" for BGP38 filtering, for ANY > filtering system -- BSD, Linux, Cisco. There is some here for integrating Team Cymru's bogon BGP service into various router platforms: <http://www.team-cymru.org/bogon-reference-bgp.html> John

1 0

IPv6 traffic percentages?
by nanog-isp＠mail.com 26 Sep '16

26 Sep '16

Hello all, Would those with IPv6 deployments kindly share some statistics on their percentage of IPv6 traffic? Bonus points for sharing top IPv6 sources. Anything else than the usual suspects, Google/YouTube, Netflix and Facebook? Some public information I've found so far: - Comcast around 25% IPv6 traffic ( http://www.lightreading.com/ethernet-ip/ip-protocols-software/facebook-ipv6… ) - Comcast has over 1 Tb/s (of mostly YouTube traffic) over IPv6 ( http://corporate.comcast.com/comcast-voices/comcast-reaches-key-milestone-i… ) - Swisscom 26% IPv6 traffic, 60% YouTube ( http://www.swinog.ch/meetings/swinog27/p/01_Martin_Gysi.pdf ) I'd be very much interested in hearing from smaller ISPs, especially those having a very limited number of IPv4 addresses and/or running out. Thanks, Jared

9 18

One Year On: IPv4 Exhaust
by Jay R. Ashworth 26 Sep '16

26 Sep '16

One year ago today, at 12:36pm EDT, Facebook On This Day reminds me, John Curran announced that the last IPv4 address block in ARIN's Free Pool had been assigned. How's that been workin' out for everyone? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

8 15

IP addresses being attacked in Krebs DDoS?
by Brett Glass 25 Sep '16

25 Sep '16

As an ISP who is pro-active when it comes to security, I'd like to know what IP address(es) are being hit by the Krebs on Security DDoS attack. If we know, we can warn customers that they are harboring infected PCs and/or IoT devices. (And if all ISPs did this, it would be possible to curtail such attacks and plug the security holes that make them possible.) --Brett Glass, LARIAT.NET

3 4

Re: Krebs on Security booted off Akamai network after DDoS attack proves pricey
by Brandon Butterworth 25 Sep '16

25 Sep '16

> From deleskie(a)gmail.com Sun Sep 25 20:26:56 2016 > Sorry you don't understand how multinational companies and > peering agreements work Right, thanks for letting me know. > nor any of the relationships my past networks would of had with akamai I don't care what yours were in the past, if peering agreements don't account for ddos maybe it's time they changed to do so. ddos protection is getting like anti virus where it's a big enough business the companies selling protection would like it to carry on forever (noting you have a stake in ddos don't take it personally) brandon

1 0

Re: Krebs on Security booted off Akamai network after DDoS attack proves pricey
by Brandon Butterworth 25 Sep '16

25 Sep '16

> From: jim deleskie <deleskie(a)gmail.com> > Sorry but you are mistaken. I've worked at Sr. levels for several LARGE and > medium sized networks. What does it cost and what do we make doing it, > over rules what is "good for the internet" every time it came up. "nice network you have there, shame if something were to happen to it" one day they may be the target themselves then they can explain to shareholders their part in enabling so much business disruption Sadly it seems there will always be an exploding Pinto on the internet Perhaps Akamai could present them with a bill for unwanted traffic as they're monetising ddos they may as well charge both sides and having dropped Krebs due to the disruption a court may agree damages too. brandon

2 1