March 2022 - Test - lists.nanog.org

Conflicts and fiber cuts
by Hank Nussbacher 07 Mar '22

07 Mar '22

As the discussion rages on NANOG, RIPE, CENTR and many other uber-technical forums, I would like to see whether we can focus on what we know best - networking. Perhaps a weekly report of fiber cuts throughout Europe (starting from Feb 15) and the RFO that the carrier provided. Of especial interest would be undersea/underocean cuts or strange outages that the carrier cannot explain. Perhaps we can then map where some nation/state is sabotaging fiber or tapping into such fiber. Anyone willing to run with this? -Hank

4 5

Re: Russia to disconnect from global Internet
by Jared Brown 07 Mar '22

07 Mar '22

Accidentally put the wrong link for the translation. Here is the correct link to the machine translation: https://twitter.com/JiriVysin/status/1500560017640067077 ---------------------------------- According to Nexta (Belorussian media outlet: https://nexta.tv , https://en.wikipedia.org/wiki/Nexta ) Russia has begun active preparations to disconnection from the global Internet. No later than March 11, all servers and domains must be transferred to the Russian zone. In addition, detailed data on the network infrastructure of the sites is being collected. Source: https://twitter.com/nexta_tv/status/1500553480548892679 Machine translation of decree: https://twitter.com/nexta_tv/status/1500553480548892679 Cogent exiting the Russian market is probably not related, but interesting nevertheless. - Jared

9 9

Transmission of tornado warnings delayed by major NWS tech issue
by Sean Donelan 07 Mar '22

07 Mar '22

Weather Service tornado warnings were delayed during deadly Iowa outbreak https://www.washingtonpost.com/weather/2022/03/06/nws-tornado-warning-disse… [...] Susan Buchanan, the Weather Service’s director of public affairs, wrote that “a technical issue caused a delay of between 2-7 minutes for some transmissions,” noting that “system engineers quickly took action as soon as the problem was detected.” She emphasized that warning lead times averaged approximately 20 minutes during the outbreak. “The National Weather Service is investigating this issued to determine the root cause and prevent it from happening in the future,” she wrote. [...] Weather radio was inaccessible in west-central Iowa as the transmitter tower in Denison, Iowa, suffered a “communications failure” Friday that knocked it “off the air.” There was no word of the transmitter being back online by Sunday. [...] Amazon Alexa and Microsoft Widgets now include severe weather alerts. Google Search and Maps also include severe weather alerts. Other streaming services do not have severe weather alerts.

1 0

Russia to disconnect from global Internet
by Jared Brown 06 Mar '22

06 Mar '22

According to Nexta (Belorussian media outlet: https://nexta.tv , https://en.wikipedia.org/wiki/Nexta ) Russia has begun active preparations to disconnection from the global Internet. No later than March 11, all servers and domains must be transferred to the Russian zone. In addition, detailed data on the network infrastructure of the sites is being collected. Source: https://twitter.com/nexta_tv/status/1500553480548892679 Machine translation of decree: https://twitter.com/nexta_tv/status/1500553480548892679 Cogent exiting the Russian market is probably not related, but interesting nevertheless. - Jared

1 0

identity.cisco.com certificate has expired
by Matthew Huff 06 Mar '22

06 Mar '22

Arghh... Just an FYI, id.cisco.com is fubar'ed. Hopefully cisco has already fixed it and the proxies/caches/cdns just need to timeout, but just in case anyone knows a contact at Cisco's ops group... [cid:image001.png@01D8309A.75491410] Matthew Huff | Director of Technical Operations | OTA Management LLC Office: 914-460-4039 mhuff(a)ox.com<mailto:mhuff@ox.com> | www.ox.com<http://www.ox.com> ...........................................................................................................................................

2 1

Washington–Moscow Direct Communications Link
by Sean Donelan 06 Mar '22

06 Mar '22

Since 2008, the Washington-Moscow Direct Communications Link (also known as "The Washington-Moscow Hotline") uses redundant circuits of two satellite links and a fiber-optic cable. They use commercial facilities for at least part of the circuits. Past accidents have interrupted previous hotline circuits. A Danish bulldozer operator once cut the line near Copenhagen. A Finnish farmer once plowed it up. A fire in a Baltimore Maryland manhole took it out of service temporarily. Yep, even the hotline experienced cable cuts.

4 3

Re: RU evidently hijacked UA netblock
by Scott Weeks 05 Mar '22

05 Mar '22

--- jay(a)west.net wrote: On 3/4/22 18:03, Scott Weeks wrote: > It looks like a 'too many' AS prepends, but it is only 250 prepends. In most reasonable scenarios I'd say that this qualifies as too many. --------------------------------------------- Yeah, technically, but it was not 256 or something where I'd expect an issue to happen. Just curious as to why only that ASN caused the buffer overflow messages as I got them from no other AS ever and wondered if anyone else has seen them. Other ASNs almost certainly have sent 250+ prepends to me before, but they did not cause the overflow. Like I said, I have a ticket open because I am curious: BGP-WARNING-tBgp4RouteInvalid-2007 <stuff> Route invalid reason - Cannot add/prepend AS-path. Buffer overflow\nNRLI - <prefix> where prefixes are several and different lengths. Probably nothing, but I always look into stuff I see in the syslog server's router.log. scott

2 1

Is soliciting money/rewards for 'responsible' security disclosures when none is stated a thing now?
by Brie 05 Mar '22

05 Mar '22

I just got this in my e-mail... ------ From: xxxxxxx <xxxxxxxxxx6(a)iqra.edu.pk> Date: Thu, 3 Mar 2022 03:14:03 +0500 Message-ID: <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx(a)mail.gmail.com> Subject: Found Security Vulnerability To: undisclosed-recipients:; Bcc: sxxxxxxxxx(a)ahbl.org Hi Team I am a web app security hunter. I spent some time on your website and found some vulnerabilities. I see on your website you take security very passionately. Tell me will you give me rewards for my finding and responsible disclosure? if Yes, So tell me where I send those vulnerability reports? share email address. Thank you Good day, I truly hope it treats you awesomely on your side of the screen :) xxxxx Security ------ Is soliciting for money/rewards when the site makes no indication they offer them a common thing now? If you want to see a copy of the original message, let me know off list and I'll send it to you. -- Brielle Bruns The Summit Open Source Development Group http://www.sosdg.org / http://www.ahbl.org

6 5

Re: RU evidently hijacked UA netblock
by Scott Weeks 05 Mar '22

05 Mar '22

--- george.herbert(a)gmail.com wrote: https://bgpstream.com/event/287556 Beware of further such activity… --------------------------------------- I have a ticket open with my vendor, but I see strange NLRI buffer overflow syslog messages about Khazkstan's AS21299 (TNSPLUS) announcements. It looks like a 'too many' AS prepends, but it is only 250 prepends. Could be a mistake or intentional. I get those from no other ASNs and I am sure some AS sent 250 AS path prepends before. Anyone else see stuff from them? scott

3 2

RU evidently hijacked UA netblock
by George Herbert 05 Mar '22

05 Mar '22

https://bgpstream.com/event/287556 Beware of further such activity… -george Sent from my iPhone

1 0