February 2021 - Test - lists.nanog.org

DNSSEC question
by Randy Carpenter 10 Feb '21

10 Feb '21

Any DNSSEC experts that could help with a question about a specific domain? Off-list please. thanks, -Randy

1 0

cogent issues in texas?
by aaron1＠gvtc.com 09 Feb '21

09 Feb '21

Anyone else having cogent internet issues in south central Texas or the region? I called Cogent and they mentioned a few spans down between el paso, fort worth, san Antonio and Houston My 100 gig link to them took a lot of loss. I had to bring down bgp for preferring other sp Aaron aaron1(a)gvtc.com

2 1

Problems with newish IP block assignment issues from ARIN
by Justin Wilson (Lists) 09 Feb '21

09 Feb '21

Folks, Have a gremlin we have been chasing around for several months now and it’s becoming a major issue as we are getting tighter on IPV4 and needing to give some provider assigned space back. In June we received a /22 from ARIN. As is my workflow I started announcing it but waited a month while I checked out the geolocation databases for correct info, did testing ,etc. All this time our test accounts could browse web-sites, etc. We put one of the pools into production and things ran good for awhile. Then we started getting the occasional web-site was not working. After several of these we started assigning the customer an IP out of one of our other ARIN blocks and the web-site would be fine and reachable. The issue seems to reside just on this /22. We have other blocks from ARIN and they are just fine. We can assign an IP out of this new block and can’t reach certain web-sites. We turn around and assign out of another block and web-site works just fine. We have two upstreams and an IX on this network. We have tried withdrawing the route on this particular /22 and isolating to one upstream alone and the problems still persist. Many of the web-sites in question are government (both state and local), online universities, and the occasional local news station. They are diverse enough to not be traced down to a common point, except the IP block. We announce the IP block via BGP the same exact way we announce the other blocks. Traceroutes show the path going the same way no matter what IP block the customer has. It acts like the IP block was blacklisted at some point and got on some bad lists but I don’t want ti limit myself to that theory. I have opened up a ticket with ARIN asking for any guidance. Has anyone ran into this with new space assigned? Any tools, sites, etc. I can use to do further troubleshooting. The IP block does not appear to have any blacklisted IPs according to MX toolbox, and some others. The block in question is 134.195.44.0/22. It has been RPKI certified and has IRR entries. Thanks in advance Justin Wilson j2sw(a)mtin.net — https://j2sw.com - All things jsw (AS209109) https://blog.j2sw.com - Podcast and Blog

8 9

Retalitory DDoS
by Mike Hammett 09 Feb '21

09 Feb '21

Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

5 10

Internet Routing Registry folks - Important - (Fwd: [arin-announce] Consultation Now Open on the Future of ARIN’s IRR)
by John Curran 08 Feb '21

08 Feb '21

NANOGers - If you make use of ARIN’s unauthenticated IRR service or the NONAUTH data stream in your route filtering, please take note of the following ARIN consultation. Thanks! /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] Consultation Now Open on the Future of ARIN’s IRR Date: 8 February 2021 at 10:46:18 AM EST To: "arin-announce(a)arin.net<mailto:arin-announce@arin.net>" <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> ARIN has been engaged in a multi-year project to create and deploy a new and improved Internet Routing Registry (IRR). On 10 June 2020 (https://www.arin.net/announcements/20200610-irr/) we launched IRR-online, an authenticated and web-based service designed to make it simple for users to publish routing information via ARIN’s website. At that time, the existing IRR-email system was temporarily left in place to allow organizations to continue using email-based updates to publish routing information (in the ARIN-NONAUTH data stream). On 1 February 2021 (https://www.arin.net/announcements/20210201-rn/) we deployed a RESTful API to provide a way to securely automate updates to objects in ARIN’s authenticated IRR service. With the availability of automation for ARIN’s new IRR system, we intend to retire ARIN’s previous non-authenticated, email-based IRR service at the end of September 2021. We are providing advance notice of this plan so that organizations using the non-authenticated and email-based IRR will have time to switch publication of their routing registry information to a more current solution. Similarly, by establishing a firm end date for the non-authenticated and email-based IRR, organizations making use of the outdated and non-authenticated IRR data stream can be ready for when ARIN ceases publishing the ARIN-NONAUTH data stream. The authenticated IRR is available to all ARIN resource holders that have resources covered by a signed Registration Services Agreement (RSA) or Legacy Registration Services Agreement (LRSA). Organizations with resources not currently under an RSA/LRSA that wish to use the authenticated IRR may contact ARIN’s Registration Services Department for assistance with bringing those registrations under an RSA/LRSA. We recognize that this change will have significant impacts on our customers and, as always, we’re interested in your feedback regarding this proposed transition. In particular, we would appreciate hearing from the ARIN community regarding these aspects of the proposed transition: 1. For those using ARIN’s email-based and non-authenticated IRR system, does the proposed shutdown date of 30 September 2021 provide sufficient time for migration to another IRR system? 2. For those making use of the ARIN-NONAUTH data stream, is there any reason to provide this information beyond the system shutdown date? The community feedback provided during this consultation will help inform how we move forward. Please provide comments to arin-consult(a)arin.net<mailto:arin-consult@arin.net>. You can subscribe to this mailing list at: http://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on Monday, 8 March. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN)

2 4

Re: [EXTERNAL] Re: Retalitory DDoS
by Compton, Rich A 08 Feb '21

08 Feb '21

FYI, that looks like a Web Services Dynamic Discovery UDP amplification DDoS attack. https://blogs.akamai.com/sitr/2019/09/new-ddos-vector-observed-in-the-wild-… Very easily executed by a booter service. You may want to have your hosting provider block all inbound traffic from reaching your server IP except TCP port 443 (or 80 or whatever port you actually use) somewhere upstream. This can help reduce the impact of DDoS attacks on your server. -Rich From: NANOG <nanog-bounces+rich.compton=charter.com(a)nanog.org> on behalf of Mike Hammett <nanog(a)ics-il.net> Date: Monday, February 8, 2021 at 10:58 AM To: Jean St-Laurent <jean(a)ddostest.me> Cc: NANOG list <nanog(a)nanog.org> Subject: [EXTERNAL] Re: Retalitory DDoS CAUTION: The e-mail below is from an external source. Please exercise caution before opening attachments, clicking links, or following guidance. I don't have RTBH, no. It's just a web server. Now how my hosting provider handled it, I'm not sure. I don't know if they just dropped me internally, or if they used RTBH with their upstreams and peers. Only being 2.5 gigs, that should be well within their ability to handle internally, but I guess why would you if you didn't have to? ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Jean St-Laurent" <jean(a)ddostest.me> To: "Mike Hammett" <nanog(a)ics-il.net> Cc: "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 11:53:43 AM Subject: RE: Retalitory DDoS You got RTBH? From: Mike Hammett <nanog(a)ics-il.net> Sent: February 8, 2021 12:50 PM To: Jean St-Laurent <jean(a)ddostest.me> Cc: NANOG list <nanog(a)nanog.org> Subject: Re: Retalitory DDoS In my case, it was against a server not on my own network, so my impact was a blackhole for an hour at 4 AM local time. I likely wouldn't have even noticed it, had I not received the threat email, nor the ticket my web host's NOC opened. ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Jean St-Laurent" <jean(a)ddostest.me> To: "Mike Hammett" <nanog(a)ics-il.net>, "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 11:42:12 AM Subject: RE: Retalitory DDoS Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me(a)nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog(a)nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437<callto:1259961437> Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Mike Hammett" <nanog(a)ics-il.net> To: "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

3 2

Spoofer Report for NANOG for Jan 2021
by CAIDA Spoofer Project 08 Feb '21

08 Feb '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Jan 2021: ASN Name Fixed-By 54825 PACKET 2021-01-12 7859 PAIR-NETWORKS 2021-01-31 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jan 2021: ASN Name First-Spoofed Last-Spoofed 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2021-01-25 7459 GRANDECOM-AS1 2016-09-26 2021-01-28 20412 CLARITY-TELECOM 2016-09-30 2021-01-31 6181 FUSE-NET 2016-10-10 2021-01-31 14971 PINETEL 2016-10-21 2021-01-30 11427 TWC-11427-TEXAS 2016-10-21 2021-01-27 30036 MEDIACOM-ENTERPRISE-BUSINESS 2016-11-16 2021-01-29 63296 AWBROADBAND 2017-09-01 2021-01-27 12222 AKAMAI 2018-02-14 2021-01-14 393564 SPOKANE 2018-06-05 2021-01-26 33452 RW 2018-09-19 2021-01-30 20448 VPNTRANET-LLC 2018-09-20 2021-01-28 8047 GCI 2019-04-11 2021-01-29 6391 URBAN-15 2020-05-29 2021-01-09 11814 DISTRIBUTEL-AS11814 2020-11-22 2021-01-16 208188 PUGET-SOUND-NETWORKS 2020-12-04 2021-01-30 13886 CLOUD-SOUTH 2021-01-05 2021-01-05 33749 ATMC 2021-01-05 2021-01-05 7885 YUKONCOLLEGE 2021-01-14 2021-01-22 53703 KWIKOM 2021-01-17 2021-01-26 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Merhaba
by M. Omer GOLGELI 06 Feb '21

06 Feb '21

Selamlar M. Omer GOLGELI --- AS202365 https://as202365.peeringdb.com https://bgp.he.net/AS202365 NOC: Phone: +90-533-2600533 Email: omer(a)chronos.com.tr

1 0

Suspicious IP reporting
by JoeSox 05 Feb '21

05 Feb '21

This IP is hitting devices on cellular networks for the past day or so. https://www.abuseipdb.com/whois/79.124.62.86 I think this is the info to report it to the ISP. Any help or if everyone can report it, I would be a happy camper. abuse(a)4cloud.mobi; abuse(a)fiberinternet.bg https://en.asytech.cn/check-ip/79.124.62.25#gsc.tab=0 -- Thank You, Joe

8 17

Comcast routine maintenance.
by Andrey Khomyakov 05 Feb '21

05 Feb '21

Who thought that doing a routine maintenance that covers a whole business day during a pandemic stay at home order was a better option than doing it, say, I don’t know, at midnight on Sunday for example? This is the message right now on Comcast status webpage “Internet unavailable We're currently performing routine system maintenance. This may cause an interruption to your service. We began work on 02/05/2021 09:42 AM (Pacific), and this is expected to end on 02/05/2021 03:30 PM (Pacific). We appreciate your patience.”

2 1