December 2019 - Test - lists.nanog.org

DHS/CISA may get administrative subpoena authority for subscriber information
by Sean Donelan 13 Dec '19

13 Dec '19

https://fcw.com/articles/2019/12/12/cisa-bill-new-authority-johnson.aspx The Cybersecurity Vulnerability Identification and Notification Act of 2019 would allow CISA to subpoena subscriber information for enterprise devices or systems [...] Subpoenas would be issued when the director of CISA identifies internet connected systems with specific vulnerabilities, is unable to identify the entity at risk and "has reason to believe" it relates to critical infrastructure. The Senate bill, which was obtained by FCW, adds a provision not included in the original DHS proposal specifying that the authority cannot not be used for information relating to "personal devices and systems, such as consumer mobile devices, home computers, residential wireless routers, or residential Internet enabled consumer devices." [...]

1 0

Facebook's Middle Mile Infrastructure
by Drew Weaver 12 Dec '19

12 Dec '19

Does anyone have any contacts at Facebook that are working on their Middle Mile infrastructure project? All attempts to figure out whom to talk to in that regard have been met with failure. Thanks, -Drew

3 2

End to End testing
by Fawcett, Nick 12 Dec '19

12 Dec '19

Anyone have any suggestions on devices that I can put at two points in the network to test packet loss, latency, jitter etc. I was thinking of maybe engineering my own using a couple of pi's, but the downfall is they don't have SFP ports. I'm looking for something that's portable and easy to configure and drop in. Thanks. ~Nick -- Checked by SOPHOS http://www.sophos.com

10 9

Downtown Boston Dark Fiber Pricing
by Rod Beck 11 Dec '19

11 Dec '19

Hi, I have questions regarding IRU pricing in this market. Please contact off list. Thanks gang. Regards, Roderick. Roderick Beck VP of Business Development United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-70-605-5144 [1467221477350_image005.png]

1 0

DDoS attack
by ahmed.dalaali＠hrins.net 10 Dec '19

10 Dec '19

Dear All, My network is being flooded with UDP packets, Denial of Service attack, soucing from Cloud flare and Google IP Addresses, with 200-300 mbps minimum traffic, the destination in my network are IP prefixes that is currnetly not used but still getting traffic with high volume. The traffic is being generated with high intervals between 10-30 Minutes for each time, maxing to 800 mbps When reached out cloudflare support, they mentioned that there services are running on Nat so they can’t pin out which server is attacking based on ip address alone, as a single IP has more than 5000 server behind it, providing 1 source IP and UDP source port, didn’t help either Any suggestions? Regards, Ahmed Dala Ali

20 22

NFL Sunday Ticket - Online Streaming service
by Justin Krejci 10 Dec '19

10 Dec '19

I am looking for a contact in the network group (may be called National Escalation team or NatEsc team internally) within AT&T/DirecTV pertaining to the NFL Sunday Ticket online streaming service. I have been attempting to work through their normal support process for quite some time, they are extremely isolated and handicapped in the support center and I am so frustrated at the impossibility to get any traction through their call center to deal with a network related issue. I have had 4 cases go to their escalation team and they all mysteriously close with no real or valid resolution. I've spoken with about 4 or 5 supervisors in their Tulsa call center and they are unable to do much. It has been a nightmare and I am hoping someone has a contact they can get me in touch with.

1 0

Re: DDoS attack
by Christopher Morrow 09 Dec '19

09 Dec '19

On Mon, Dec 9, 2019 at 4:08 PM Michael Sherlock <michael.sherlock(a)hrins.net> wrote: > > You asked what is being attacked > > IP addresses that are currently not assigned to end users > > And ip addresses assigned to end users > > End user= Home broadband customers > > We are not hosting any significant servers I'm being unclear or you are being overly pedantic.. neither is helping. "what ip address can I look in netflow for traffic destined to which is part of this attack?" Anyone trying to help you is going to want to know what destination address in your network is receiving this traffic... not providing same after ~15 emails is going to make your situation not get better. I'd suggest you post the addresses to the list though... so other folk can go looking as well. > Regards, > > Michael Sherlock > Mobile: +44 75070 92392 > > Sent from my iPhone > > > On Dec 9, 2019, at 9:04 PM, Christopher Morrow <morrowc.lists(a)gmail.com> wrote: > > > > On Mon, Dec 9, 2019 at 3:42 PM Michael Sherlock > > <michael.sherlock(a)hrins.net> wrote: > >> > >> Cristopher, > >> > >> Ip addresses that are not currently in use, and IP addresses that is currently used for CGNAT for end users > >> > > > > I'm 100% sure that those words mean something to you.. but not > > operating your network they don't mean anything to me. > > > > > >> > >> Regards, > >> > >> Michael Sherlock > >> Mobile: +44 75070 92392 > >> > >> Sent from my iPhone > >> > >> On Dec 9, 2019, at 8:36 PM, "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> wrote: > >> > >> > >> > >> Begin forwarded message: > >> > >> From: Christopher Morrow <morrowc.lists(a)gmail.com> > >> Subject: Re: DDoS attack > >> Date: December 9, 2019 at 11:11:31 PM GMT+3 > >> To: "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> > >> Cc: nanog list <nanog(a)nanog.org> > >> > >> I'd note that: "what prefixes?" isn't answered here... like: "what is > >> the thing on your network which is being attacked?" > >> > >> On Mon, Dec 9, 2019 at 3:08 PM ahmed.dalaali(a)hrins.net > >> <ahmed.dalaali(a)hrins.net> wrote: > >> > >> > >> Dear All, > >> > >> My network is being flooded with UDP packets, Denial of Service attack, soucing from Cloud flare and Google IP Addresses, with 200-300 mbps minimum traffic, the destination in my network are IP prefixes that is currnetly not used but still getting traffic with high volume. > >> The traffic is being generated with high intervals between 10-30 Minutes for each time, maxing to 800 mbps > >> When reached out cloudflare support, they mentioned that there services are running on Nat so they can’t pin out which server is attacking based on ip address alone, as a single IP has more than 5000 server behind it, providing 1 source IP and UDP source port, didn’t help either > >> Any suggestions? > >> > >> Regards, > >> Ahmed Dala Ali > >> > >>

1 0

Re: DDoS attack
by Christopher Morrow 09 Dec '19

09 Dec '19

On Mon, Dec 9, 2019 at 3:42 PM Michael Sherlock <michael.sherlock(a)hrins.net> wrote: > > Cristopher, > > Ip addresses that are not currently in use, and IP addresses that is currently used for CGNAT for end users > I'm 100% sure that those words mean something to you.. but not operating your network they don't mean anything to me. > > Regards, > > Michael Sherlock > Mobile: +44 75070 92392 > > Sent from my iPhone > > On Dec 9, 2019, at 8:36 PM, "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> wrote: > > > > Begin forwarded message: > > From: Christopher Morrow <morrowc.lists(a)gmail.com> > Subject: Re: DDoS attack > Date: December 9, 2019 at 11:11:31 PM GMT+3 > To: "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> > Cc: nanog list <nanog(a)nanog.org> > > I'd note that: "what prefixes?" isn't answered here... like: "what is > the thing on your network which is being attacked?" > > On Mon, Dec 9, 2019 at 3:08 PM ahmed.dalaali(a)hrins.net > <ahmed.dalaali(a)hrins.net> wrote: > > > Dear All, > > My network is being flooded with UDP packets, Denial of Service attack, soucing from Cloud flare and Google IP Addresses, with 200-300 mbps minimum traffic, the destination in my network are IP prefixes that is currnetly not used but still getting traffic with high volume. > The traffic is being generated with high intervals between 10-30 Minutes for each time, maxing to 800 mbps > When reached out cloudflare support, they mentioned that there services are running on Nat so they can’t pin out which server is attacking based on ip address alone, as a single IP has more than 5000 server behind it, providing 1 source IP and UDP source port, didn’t help either > Any suggestions? > > Regards, > Ahmed Dala Ali > >

1 0

packet loss on AT&T in the L.A. area
by Francois Lecavalier 09 Dec '19

09 Dec '19

Anybody else is experiencing packet loss since last Tuesday across the AT&T network in the L.A. area? I'm seeing it coming from both Zayo and HE 8. ae2.cs1.lga5.us.zip.zayo.com 0.0% 153 17.8 19.7 17.6 48.4 4.6 9. ae18.ter1.lga5.us.zip.zayo.com 0.0% 153 17.8 17.7 17.5 18.3 0.0 10. 192.205.36.105 10.5% 153 22.3 21.3 19.3 25.0 1.0 11. cr1.n54ny.ip.att.net 1.3% 153 76.5 75.5 73.1 80.7 1.6 12. cgcil22crs.ip.att.net 5.9% 153 75.1 76.1 72.6 80.7 2.0 13. cgcil21crs.ip.att.net 3.9% 153 76.9 76.4 72.0 83.9 2.3 14. dvmco22crs.ip.att.net 3.9% 153 73.9 76.4 72.4 81.1 2.3 15. slkut21crs.ip.att.net 5.9% 153 74.2 76.8 72.9 84.7 2.3 16. la2ca21crs.ip.att.net 4.6% 153 76.7 76.7 72.6 82.6 2.1 17. gar20.la2ca.ip.att.net 8.5% 153 73.6 73.3 72.1 75.7 0.5 4. 12.87.252.89 0.0% 338 1.9 1.8 1.6 3.6 0.2 5. cr1.la2ca.ip.att.net 0.0% 338 2.7 3.5 1.5 6.7 1.0 cr84.la2ca.ip.att.net 6. ggr2.la2ca.ip.att.net 0.0% 338 4.8 3.5 1.6 5.6 1.0 ggr2.la2ca.ip.att.net 7. ae7.mpr1.lax12.us.zip.zayo.com 5.6% 338 73.1 74.2 72.0 133.8 4.4 8. ae13.cs1.lax112.us.eth.zayo.com 8.6% 338 83.7 89.1 72.9 116.7 7.9 This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately. Ce courrier ?lectronique est confidentiel et prot?g?. L'exp?diteur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) d?sign?(s) est interdite. Si vous recevez ce courrier ?lectronique par erreur, veuillez m'en aviser imm?diatement, par retour de courrier ?lectronique ou par un autre moyen.

1 0

Elephant in the room - Akamai
by Kaiser, Erich 09 Dec '19

09 Dec '19

Lets talk Akamai They have shifted 90% of their traffic off IXs and onto our full route DIA, anyone else seeing this issue or have insight as to what is going on over there? We have been asking for help on resolution for weeks and all we get is we are working on it and now we get no response. We were even sent an LOA and when the DC went to go put in the x-connect their patch panel was full. How do they not know if they have ports open or not? I have even reached out to an engineer who is on this list and he does not even respond. The last two nights the traffic levels to them has skyrocketed as well. Any insight? Erich Kaiser The Fusion Network

27 45