May 2022 - Test - lists.nanog.org

Re: NANOG NYC Event
by Fisher, Shawn 30 Jul '25

30 Jul '25

Personally I like dinosaur bbq, great malt beverages as well, and also blue smoke is great and if you like jazz, check out downstairs. -------------------------- Sent using BlackBerry -----Original Message----- From: andrew young To: Scott Brim CC: nanog(a)nanog.org Sent: Sat May 31 18:28:57 2008 Subject: Re: NANOG NYC Event Speaking of food, ill be going to the Big Apple BBQ fest next weekend: http://bigapplebbq.org/2008/ If you love to eat BBQ, this is a big MUST to cap off your stay in NYC. if you do decided to go, be sure to get the Fastpass: http://www.bigapplebbq.org/2008/index.php?s=fastpass You dont want to wait 30 mins online for food. Don't forget a bib and leave your belt at home. :-) - ------------------------------------ Andrew Young Webair Internet Development, Inc Phone: 1 866 WEBAIR 1 FAX: 516.938.5100 http://www.webair.com andrewy(a)webair.com ------------------------------------- We are interested in any feedback you might have about the service you received. Please contact our technical support consumer care manager directly at 1.866.WEBAIR1 or e-mail customercare(a)webair.com ------------------------------------- On Sat, 2008-05-31 at 18:17 -0400, Scott Brim wrote: > On 5/31/08 12:36 PM, Rod Beck allegedly wrote: > > I strongly suggest that those heading to New York visit the great > > musems, architecture (Saint Patrick's Cathedral), and restaurants. > > You have the American Museum of Natural History, which includes an > > excellent Planetarium and just on the other side of Central Park, the > > Metropolitan Museum of Art and the Guggenheim. There are excellent > > Chinese and Indian restaurants in Lower Manhattan. > > Don't forget about Brooklyn in all this Manhattan praise :-). Consider > the Brooklyn Botanic Garden. It's too late for cherries but the rose > collections will be great. And the best pizza in New York (if you can > get in) is at > http://menupages.com/restaurantdetails.asp?areaid=0&restaurantid=31402&neig… >

15 17

Ransom DDoS attack - need help!
by halp us 18 Jul '25

18 Jul '25

All, I've been a NANOG member for many years but I'm emailing from an anonymous account to reduce the chance of the attackers finding me. A company that shall remain anonymous has received a ransom DDoS note from a very well known group that has been in the news lately. Recently they've threatened to carry out a major DDoS attack if they are not paid by a deadline which is approaching. They've performed an attack of a smaller magnitude to prove that they're serious. Based on certain details that I can't reveal here, we believe the magnitude of the upcoming attack may be in the several hundred Gbps. I would really appreciate help in a few areas (primarily with certain provider contacts/intros) so we can execute our strategy (which I can't reveal here for obvious reasons). If you email me off-list with a name/email that you've previously used on-list, I will reply from my real email. Alternatively, if you can post your experiences on-list with large scale high profile ransom DDoS attacks, I'd really appreciate it! Thanks

17 26

Issue with Geolocation in Virginia US
by Raja Sekhar Gullapalli 04 Jan '24

04 Jan '24

Team, We are having issues in our Virginia US office & it shows geolocation in all browsers as Canada instead of US region when we access news.google.com in our PC. Our public ip is 129.46.232.65. This issue is being observed for more than 2 month. Can you help to whom we can contact to resolve the issue. Regards, Raja

8 13

FW: softlayer.com
by Travis Garrison 23 Sep '23

23 Sep '23

Traceroute from here if it helps Tracing route to 138-43-128-1.reserved.highland.net [138.43.128.1] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms [REDACTED] 2 <1 ms <1 ms <1 ms [REDACTED] 3 1 ms 1 ms <1 ms [REDACTED] 4 1 ms <1 ms <1 ms [REDACTED] 5 6 ms 6 ms 6 ms v313.core1.mci3.he.net [216.218.213.141] 6 16 ms 16 ms 16 ms 100ge10-2.core1.dal1.he.net [184.105.81.206] 7 26 ms 26 ms 26 ms xo-as15-as2828.10gigabitethernet6-7.core1.dal1.he.net [184.105.255.78] 8 40 ms 39 ms 40 ms 207.88.14.198.ptr.us.xo.net [207.88.14.198] 9 40 ms 39 ms 40 ms 207.88.12.178.ptr.us.xo.net [207.88.12.178] 10 39 ms 39 ms 39 ms 216.156.16.239.ptr.us.xo.net [216.156.16.239] 11 48 ms 48 ms 48 ms ip65-46-198-198.z198-46-65.customer.algx.net [65.46.198.198] 12 41 ms 41 ms 41 ms occm-6.dhcp.grp1-rng1.tncsvl.blomand.net.57.131.192.in-addr.arpa [192.131.57.6] 13 * * * Request timed out. Thanks Travis From: NANOG <nanog-bounces(a)nanog.org<mailto:nanog-bounces@nanog.org>> On Behalf Of Siyuan Miao Sent: Friday, March 22, 2019 9:22 AM To: Nikolas Geyer <nik(a)neko.id.au<mailto:nik@neko.id.au>> Cc: nanog(a)nanog.org<mailto:nanog@nanog.org> Subject: Re: softlayer.com Perhaps it won't work because their customer support will ask you for bi-directional traceroute and refused to forward to backbone team. Then they'll say it's not their fault and you can see the packet is dropped outside our network. Here's a sample traceroute from SoftLayer Washington, San Jose and Seattle in case someone needs it: aveline@iad02-sl01:~$ mtr 138.43.128.1 --report-wide Start: Fri Mar 22 17:20:42 2019 HOST: iad02-sl01 Loss% Snt Last Avg Best Wrst StDev 1.|-- [REDACTED] 0.0% 10 1.4 1.5 0.8 3.7 1.0 2.|-- ae13.dar02.wdc01.networklayer.com<http://ae13.dar02.wdc01.networklayer.com> 0.0% 10 0.5 3.3 0.4 28.6 8.8 3.|-- ae9.bbr01.eq01.wdc02.networklayer.com<http://ae9.bbr01.eq01.wdc02.networklayer.com> 0.0% 10 0.8 0.8 0.7 1.0 0.0 4.|-- eqix-dc5.intellifiber.com<http://eqix-dc5.intellifiber.com> 0.0% 10 0.8 1.2 0.8 2.2 0.3 5.|-- ae13-0.cr02.asbn01-va.us.windstream.net<http://ae13-0.cr02.asbn01-va.us.windstream.net> 0.0% 10 0.9 0.9 0.9 1.0 0.0 6.|-- ae11-0.cr01.atln02-ga.us.windstream.net<http://ae11-0.cr01.atln02-ga.us.windstream.net> 0.0% 10 15.6 16.1 15.6 17.4 0.5 7.|-- ae0-0.pe06.atln02-ga.us.windstream.net<http://ae0-0.pe06.atln02-ga.us.windstream.net> 0.0% 10 17.4 16.1 15.9 17.4 0.3 8.|-- h43.88.198.64.static.ip.windstream.net<http://h43.88.198.64.static.ip.windstream.net> 0.0% 10 24.7 24.8 24.6 24.9 0.0 9.|-- east.tndodge-21.static.tncsvl.blomand.net<http://east.tndodge-21.static.tncsvl.blomand.net> 0.0% 10 22.6 22.8 22.5 23.8 0.0 10.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 aveline@sjc03-sl01:~$ mtr 138.43.128.1 --report-wide Start: Fri Mar 22 16:21:04 2019 HOST: sjc03-sl01 Loss% Snt Last Avg Best Wrst StDev 1.|-- [REDACTED] 0.0% 10 2.4 2.0 0.3 14.3 4.3 2.|-- ae0.dar02.sjc01.networklayer.com<http://ae0.dar02.sjc01.networklayer.com> 0.0% 10 1.0 0.5 0.3 1.3 0.0 3.|-- ae9.bbr01.eq01.sjc02.networklayer.com<http://ae9.bbr01.eq01.sjc02.networklayer.com> 0.0% 10 0.8 0.8 0.7 0.9 0.0 4.|-- eqix-sv1.windstream.com<http://eqix-sv1.windstream.com> 0.0% 10 0.9 0.9 0.8 1.1 0.0 5.|-- ae6-0.cr02.lsaj01-ca.us.windstream.net<http://ae6-0.cr02.lsaj01-ca.us.windstream.net> 0.0% 10 11.6 11.5 11.5 11.6 0.0 6.|-- ae-11-0.cr01.dlls01-tx.us.windstream.net<http://ae-11-0.cr01.dlls01-tx.us.windstream.net> 0.0% 10 42.6 42.7 42.5 43.4 0.0 7.|-- ae7-0.cr02.atln02-ga.us.windstream.net<http://ae7-0.cr02.atln02-ga.us.windstream.net> 0.0% 10 64.0 65.6 63.9 74.2 3.4 8.|-- ae1-0.pe06.atln02-ga.us.windstream.net<http://ae1-0.pe06.atln02-ga.us.windstream.net> 0.0% 10 62.3 62.7 62.2 66.9 1.5 9.|-- h43.88.198.64.static.ip.windstream.net<http://h43.88.198.64.static.ip.windstream.net> 0.0% 10 71.9 72.0 71.9 72.2 0.0 10.|-- east.tndodge-21.static.tncsvl.blomand.net<http://east.tndodge-21.static.tncsvl.blomand.net> 0.0% 10 69.9 68.8 68.6 69.9 0.3 11.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 aveline@sea04-sl01:~$ mtr 138.43.128.1 --report-wide Start: Fri Mar 22 08:19:09 2019 HOST: sea04-sl01 Loss% Snt Last Avg Best Wrst StDev 1.|-- [REDACTED] 0.0% 10 0.7 1.2 0.7 1.8 0.0 2.|-- ae12.dar02.sr01.sea01.networklayer.com<http://ae12.dar02.sr01.sea01.networklayer.com> 0.0% 10 0.6 0.7 0.5 1.3 0.0 3.|-- ae9.bbr01.wb01.sea02.networklayer.com<http://ae9.bbr01.wb01.sea02.networklayer.com> 0.0% 10 1.2 1.0 0.7 1.5 0.0 4.|-- six.seattle-wa.us.windstream.net<http://six.seattle-wa.us.windstream.net> 0.0% 10 1.5 1.0 0.7 1.7 0.0 5.|-- ae12-0.cr01.chcg01-il.us.windstream.net<http://ae12-0.cr01.chcg01-il.us.windstream.net> 0.0% 10 41.1 41.2 41.0 41.6 0.0 6.|-- ae17-0.cr02.chcg01-il.us.windstream.net<http://ae17-0.cr02.chcg01-il.us.windstream.net> 0.0% 10 41.1 41.4 41.1 42.0 0.0 7.|-- ae10-0.cr01.atln02-ga.us.windstream.net<http://ae10-0.cr01.atln02-ga.us.windstream.net> 0.0% 10 63.8 64.4 63.5 71.1 2.3 8.|-- ae0-0.pe06.atln02-ga.us.windstream.net<http://ae0-0.pe06.atln02-ga.us.windstream.net> 0.0% 10 63.7 63.7 63.5 64.0 0.0 9.|-- h43.88.198.64.static.ip.windstream.net<http://h43.88.198.64.static.ip.windstream.net> 0.0% 10 71.6 71.8 71.5 72.8 0.0 10.|-- east.tndodge-21.static.tncsvl.blomand.net<http://east.tndodge-21.static.tncsvl.blomand.net> 0.0% 10 71.8 70.8 70.2 71.8 0.3 11.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 Regards, Siyuan Miao On Fri, Mar 22, 2019 at 10:10 PM Nikolas Geyer <nik(a)neko.id.au<mailto:nik@neko.id.au>> wrote: This is the best approach. Have run into this problem a few times and had zero success getting the filters removed without having SL customers log tickets with support. Verbiage needs to be “this prefix is blocked, please escalate to your backbone team”. Sent from my iPhone On Mar 22, 2019, at 9:56 AM, Forrest Christian (List Account) <lists(a)packetflux.com<mailto:lists@packetflux.com>> wrote: Another idea... Have you tried reaching out to some of the blocked sites? They likely have better contact information than is available publicly, especially a larger one like indeed. On Thu, Mar 21, 2019, 3:41 PM John Alcock <john(a)alcock.org<mailto:john@alcock.org>> wrote: Still looking for anyone from softlayer.com<http://softlayer.com> It has been a challenge. Anything hosted by softlayer.com<http://softlayer.com> is being blocked. Here is a small list so far windowbook.tpondemand.com<http://windowbook.tpondemand.com> ahainstructornetwork.americanheart.org<http://ahainstructornetwork.americanheart.org> clover.com<http://clover.com> Cebroker.com<http://Cebroker.com> Softlayer.com<http://Softlayer.com> indeed.com<http://indeed.com> & Enforce Staffing It is growing every day. John On Wed, Mar 20, 2019 at 12:35 PM John Alcock <john(a)alcock.org<mailto:john@alcock.org>> wrote: Afternoon, Thought I would start a new thread. After researching, traceroutes, etc, I think I found my problem. 9 out of the 10 sites that subscribers on my new block is being hosted by softlayer. Anyone on the list have contacts with softlayer. Right now I have an email to abuse. The support line will not help me out. John

3 2

SentryPeer: A distributed peer to peer list of bad IP addresses and phone numbers collected via a SIP Honeypot
by Gavin Henry 04 Jul '23

04 Jul '23

Hi all, I hope you don't mind the post, but thought this might be of use and in the spirit of release early, release often I've done an alpha release: https://github.com/SentryPeer/SentryPeer There's a presentation too if you'd like to watch/read where I hope to go with this: https://blog.tadsummit.com/2021/11/17/sentrypeer/ Working on the API and web UI next, then the p2p part of it. Feel free to submit any feature requests or have a play :-) Thanks for reading and any feedback is welcome! -- Kind Regards, Gavin Henry.

3 7

202203071610.AYC Re: Making Use of 240/4 NetBlock
by Abraham Y. Chen 16 Jan '23

16 Jan '23

Dear Colleagues: 0) I was made aware of a recent discussion on this Forum that cited our work on the 240/4 NetBlock, nicknamed EzIP (Phonetic for Easy IPv4). (Please see, at the end of this MSG, the URL to the discussion and the highlighted text where the citation was made.) 1) As the lead investigator of the EzIP Project, I would like to formally introduce our solution by bringing your attention to an overview whitepaper: https://www.avinta.com/phoenix-1/home/RevampTheInternet.pdf In a nutshell, EzIP proposes to disable the program codes in current routers that have been disabling the use of the 240/4 NetBlock. The cost of this software engineering should be minimal. The EzIP deployment architecture is the same as that of the existing CG-NAT (Carrier Grade Network Address Translation). Consequently, there is no need to modify any hardware equipment. There is an online setup description (Reference II), called RAN (Regional Area Network), that demonstrates the feasibility of this approach. 2) There are additional consequential benefits by deploying EzIP, such as those mentioned by our comment to Reference III in the above whitepaper. I look forward to addressing your thoughts. Regards, Abe (2022-03-07 17:14 EST) VP Engineering Avinta Communications, Inc. Milpitas, CA 95035 USA +1(408)942-1485 Skype: Abraham.Y.Chen eMail: AYChen(a)Avinta.com WebSite: www.Avinta.com *********************** https://mailman.nanog.org/pipermail/nanog/2021-November/216766.html Class D addresses? was: Redploying most of 127/8 as unicast public *Greg Skinner* gregskinner0 at icloud.com <mailto:nanog%40nanog.org?Subject=Re%3A%20Class%20D%20addresses%3F%20was%3A%20Redploying%20most%20of%20127/8%20as%20unicast%20public&In-Reply-To=%3CFEDBF677-BC75-47F3-A92D-2611F43283BA%40icloud.com%3E> /Mon Nov 29 18:47:14 UTC 2021/ * Previous message (by thread): Class D addresses? was: Redploying most of 127/8 as unicast public <https://mailman.nanog.org/pipermail/nanog/2021-November/216640.html> * Next message (by thread): Class E addresses? 240/4 history <https://mailman.nanog.org/pipermail/nanog/2021-November/216602.html> * *Messages sorted by:* [ date ] <https://mailman.nanog.org/pipermail/nanog/2021-November/date.html#216766> [ thread ] <https://mailman.nanog.org/pipermail/nanog/2021-November/thread.html#216766> [ subject ] <https://mailman.nanog.org/pipermail/nanog/2021-November/subject.html#216766> [ author ] <https://mailman.nanog.org/pipermail/nanog/2021-November/author.html#216766> ------------------------------------------------------------------------ >/On Nov 24, 2021, at 5:08 PM, William Herrin <bill at herrin.us <https://mailman.nanog.org/mailman/listinfo/nanog>> wrote: />//>/On Wed, Nov 24, 2021 at 4:36 PM David Conrad <drc at virtualized.org <https://mailman.nanog.org/mailman/listinfo/nanog>> wrote: />>>/I like research but what would the RIRs study? The percentage of the />>//>>/Lots of people said similar things when 1.0.0.0/8 was allocated to APNIC />>/and they said similar things when 1.1.1.0/24 was stood up as an />>/experiment by Cloudflare and APNIC, yet 1.1.1.1 seems to be pretty popular. />//>/Hi David, />//>/I don't recall there being any equipment or software compatibility />/concerns with 1.0.0.0/8. If you do, feel free to refresh my memory. As />/I recall it, there were concerns with prior local use and potential />/trash traffic. It seemed likely those concerns could be addressed with />/experiments, and the experiments in fact addressed them. />//>/The prior local use worry reared its head again with 240/4 but given />/the prior experience with 1.0.0.0/8 I don't personally believe we need />/to re-run that experiment just because the numbers are part of a />/different block. />//>//>>/Seems to me that a number of folks on this list and during this />>/discussion would disagree with a blanket assertion that 240/4 />>/is “dysfunctional on the 2021 Internet” - some of them even />>/wrote a draft discussing the possibility. />//>/Line them up. Show of hands. Who really thinks that if we assign />/240.0.0.1 to a customer tomorrow without waiting for anyone to clean />/up their software and hardware, you won't get enough complaints about />/things not working that you have to take it back and assign a />/different address instead? />//>//>>/1. Move 240/4 from "reserved" to "unallocated unicast" />>//>>/OK, but this seems like a quibble. The status for 240/4 is “ />>/RESERVED: designated by the IETF for specific non-global-unicast />>/purposes as noted.” The “as noted” part is “Future Use”. />//>/It's not a quibble. Some vendors take the current status to mean />/"treat it like unicast until we're told otherwise." Others take the />/status to mean, "packets with these addresses are bogons without a />/defined routing behavior until we're told otherwise." The result is />/incompatible behavior between vendors. Changing that direction to />/"treat it like unicast" without ambiguity is not a quibble. />//>/Regards, />/Bill Herrin />//>/-- />/William Herrin />/bill at herrin.us <https://mailman.nanog.org/mailman/listinfo/nanog> />/https://bill.herrin.us/ / For what it’s worth, I’ve been tracking this issue on other netops mailing lists. There is a recent post on the LACNOG list from Leandro Bertholdo <https://mail.lacnic.net/pipermail/lacnog/2021-November/008895.html> referencing https://datatracker.ietf.org/doc/draft-chen-ati-adaptive-ipv4-address-space/ <https://datatracker.ietf.org/doc/draft-chen-ati-adaptive-ipv4-address-space/>, a draft proposing another way to make additional IPv4 address space available I haven’t had time to read the draft closely, but I noticed that it involves the use of 240/4. Subsequent googling about the draft turned up a presentation <https://www.avinta.com/phoenix-1/home/RegionalAreaNetworkArchitecture.pdf> describing how the techniques described could be deployed. I noticed that the presentation made reference to OpenWRT, so perhaps the authors are aware of the work that the authors of the IPv4 Unicast Extensions Project have done in that area. The adaptive-ipv4 draft will expire sometime next month, so anyone interested in seeing it move forward should contact the authors. —gregbo ******************* -- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

70 306

Geo-IP Sling.com and/or Dish Network Contact.
by Nicholas Warren 08 Nov '22

08 Nov '22

Does anyone know how to get ahold of Sling.com or Dish to update location information on IPv4 addresses? I don’t know if meta discussion is allowed on-list, but maybe geolocation contacts could be listed on the community site? 😊 - Nich Warren

3 4

Getting Fiber to My Town by Jared Mauch
by Jared Brown 11 Aug '22

11 Aug '22

I believe this belongs here: Getting Fiber to My Town by Jared Mauch https://www.youtube.com/watch?v=ASXJgvy3mEg (YouTube video of NLnog presentation) https://nlnog.net/static/live/nlnog_live_sep_2020_jared.pdf (slides for presentation) https://news.ycombinator.com/item?id=24424910#24430901 (discussion on Hacker News with Jared participating) https://washftth.com/ (project homepage) I find this an interesting description of how to apply skills that we normally only use at work to solve connectivity issues at home. Quite timely too, as home connectivity is needed more than ever. Highlights: - location: just outside of Ann Arbor - no fixed broadband since 2002 -> build own network - pre-wire neighbors with fiber drops and feed them off WISP first - lots of work to sign up customers, having to resort to snailmail to reach all - 70% of homes passed signed up - Have ASN, get IPv6 and IPv4 allocation, multihome and connect to local IXP - purchase equipment: fusion splicer, OTDR, materials, directional drill(!) - hire contractors, deal with all manner of problems, theft, stop work orders, unbudgeted costs, unmarked/badly marked utilities, hitting (own) utilities - build own fiber blower(!) for blowing in fiber in ducts - splice, OTDR, resplice, schedule installs ... which don't always go to plan - Upstream very helpful, offered a Cisco 6500 as CPE, however respectfuly declined and went with Arista - Link up! Network is now live with 17 subscribers hooked up. More waiting to be connected - Mixed Active Ethernet and GPON - latency drops from 30 ms to 8 ms, bandwidth from 20-30M to 730M, total commit 1.5G on 10G port, plans from 50M to 500M - SPAM! IPv4 brokers and the usual unsolicited contacts from bottom of the baller IP transit providers - Costs: $126k in 2020, $95k contractors, $32k materials and equipment. Total outlay ~$150k + years of sweat equity. Important to spread out costs over longer period of time to be able to afford. Offset costs by using pre-pay model (Can pay $5,000 up-front and receive $50 credit for 100 months) All in all it was an excellent presentation. I only wish Jared had spent some more time on how he had to become a telco and how this got him better access to the public right of way. Of course, some more details on his directional boring and some nice video of him running the drill would have been a cherry on top :) I'd like to congratulate Jared on lighting up his network and wish him success in running it. I did a similar build almost twenty years ago and regret I didn't have the forethought to document the effort better then. Not that there was a YouTube to put it all on then :) You can find the other presentations from NLnog live September 2020 at https://www.youtube.com/channel/UCVz78FbsOJ6v6xb6S2GpvWQ Jared, not the Mauch one

10 13

FCC proposes higher speed goals (100/20 Mbps) for USF providers
by Sean Donelan 09 Jun '22

09 Jun '22

https://www.fcc.gov/document/fcc-proposes-higher-speed-goals-small-rural-br… The Federal Communications Commission voted [May 19, 2022] to seek comment on a proposal to provide additional universal service support to certain rural carriers in exchange for increasing deployment to more locations at higher speeds. The proposal would make changes to the Alternative Connect America Cost Model (A-CAM) program, with the goal of achieving widespread deployment of faster 100/20 Mbps broadband service throughout the rural areas served by rural carriers currently receiving A-CAM support.

49 133

FYI - 2FA to be come mandatory for ARIN Online? (was: Fwd: [arin-announce] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts
by John Curran 30 May '22

30 May '22

NANOGers - A consultation opened today on potentially requiring use of 2-factor authentication to login into ARIN Online – this would take place once SMS 2FA is deployed. If you think that this is: a) a great idea, b) a bad idea, c) anything else, then feel free to subscribe to the arin-consult mailing list (open to all at http://lists.arin.net/mailman/listinfo/arin-consult) and provide your feedback. Best wishes, /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts Date: 24 May 2022 at 12:45:48 PM EDT To: "arin-announce(a)arin.net<mailto:arin-announce@arin.net>" <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> **Background** In 2015, ARIN deployed a Time-Based One-Time password (TOTP) implementation of Two-Factor Authentication (2FA). Since the time of implementing that login security feature, 3.2 percent of ARIN Online users have opted to use 2FA with their accounts. Since October 2020, the ARIN Online system has been subject to a series of dictionary-based password guessing attacks. In March of 2021, we conducted ACSP Consultation 2021.2: Password Security for ARIN Online Accounts (https://www.arin.net/participate/community/acsp/consultations/2021/2021-2/) on proposed improvements to increase account security. This consultation resulted in an agreement to move forward with several improvements that have subsequently been deployed. However, we continue to see frequent attacks on our log-in systems, and ARIN staff continues to be heavily engaged in mitigating these attacks. Accounts not using 2FA are susceptible to these attacks. We recently updated the community on this topic during ARIN 49 held in Nashville and online in April. You can review this information from the ARIN 49 Meeting Report (https://www.arin.net/participate/meetings/ARIN49/) by looking for the presentation titled “Brute Force Login Attacks”. It is our intention to make 2FA mandatory for all existing and new ARIN Online accounts going forward. The security of ARIN Online accounts is paramount to the success of the registry, and we do not believe it is tenable to continue without making 2FA required for all ARIN Online accounts. We are currently developing a second method of 2FA use with ARIN Online to add to our long-deployed TOTP implementation. In the coming months, we will deploy a Short Message Service (SMS) 2FA implementation, thereby adding a second 2FA option for ARIN Online users. At that time, users will be able to choose between two types of 2FA – SMS and TOTP. Adoption of TOTP 2FA has been limited in part due to perceived complexity, and the addition of SMS-based 2FA will provide a second option that is easier to use for many customers – and provide much more protection than the simple username-password condition of many ARIN Online user accounts today. (ARIN also plans on adding support for a third 2FA option in the future – Fast Identity Online 2 (FIDO2) – in response to community suggestions, but we do not believe it is prudent to delay requiring 2FA on ARIN Online accounts until that third option becomes available.) **Requiring 2FA For ARIN Online Accounts** By requiring 2FA for ARIN Online accounts that control number resources, the ARIN community should see stronger security for the registry, reduced risk of account fraud attempts, and increased confidence in the integrity of their ARIN resources. ARIN intends to require 2FA for all ARIN Online accounts shortly after SMS-based 2FA authentication is generally available. We are seeking confirmation from the ARIN community regarding this plan, and ask the following consultation question: ------------------- Once SMS-based two-factor authentication (2FA) is available for ARIN Online, do you believe ARIN *should not* proceed with requiring 2FA authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, why? ------------------- The feedback you provide during this consultation will help form our path forward to increasing the security of ARIN Online for all customers. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult(a)arin.net<mailto:arin-consult@arin.net>. You can subscribe to this mailing list at: http://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 24 June 2022. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) _______________________________________________ ARIN-Announce You are receiving this message because you are subscribed to the ARIN Announce Mailing List (ARIN-announce(a)arin.net) Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-announce Please contact info(a)arin.net if you experience any issues.

16 18