- Test - lists.nanog.org

Re: Anyone else having trouble reaching thepiratebay.se? AS39138
by courtneysmith＠comcast.net 26 Nov '14

26 Nov '14

Only one of their /24's is in TATA's(AS6453) table. http://bgp.he.net/AS51040#_prefixes http://lg.as6453.net Router: gin-aeq-tcore1 Site: US, Ashburn, AEQ Command: show route protocol bgp 194.71.107.0/24 terse exact {master} Router: gin-aeq-tcore1 Site: US, Ashburn, AEQ Command: show route protocol bgp 194.14.56.0/24 terse exact inet.0: 520187 destinations, 3597636 routes (519993 active, 9 holddown, 1053 hidden) Restart Complete + = Active Route, - = Last Active, * = Both A V Destination P Prf Metric 1 Metric 2 Next hop AS path * ? 194.14.56.0/24 B 197595 51040 I unverified >216.6.87.1 ? B 197595 51040 I unverified >216.6.87.1 ? B 197595 51040 I unverified >216.6.87.1 ? B 1239 1257 197595 51040 I unverified >144.232.7.61 {master} On 11/26/14, 2:01 PM, " eric-list(a)truenet.com " < eric-list(a)truenet.com > wrote: Javier, I can't get to www.rrbone.net, an upstream provider to the IP I was given for thepiratebay.se. I tested on VZ FiOS and Wireless in Philadelphia area and both die within the VZ network. For Comcast, it looks like the space isn't showing up in the BGP table: route-server.newyork.ny.ibone>show ip bgp 194.71.107.27 % Network not in table No clue what the cause is, but it bigger than just the PirateBay. Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300 F: 610-429-3222 -----Original Message----- From: NANOG [ mailto:nanog-bounces@nanog.org ] On Behalf Of Javier J Sent: Wednesday, November 26, 2014 1:44 PM To: nanog(a)nanog.org Subject: Re: Anyone else having trouble reaching thepiratebay.se? AS39138 I confirmed It is also blocked for Comcast users. Even Comcast business users. This is starting to look like censorship to me.

1 0

Craigslist hacked?
by Brian Henson 26 Nov '14

26 Nov '14

Is anyone else seeing their local craigslist redirected to another site other than craigslist? I see it loading http://digitalgangster.com/5um.

25 39

abuse reporting tools
by Mike 26 Nov '14

26 Nov '14

Hello, I provide broadband connectivity to mostly residential users. Over the past few years, instances of DDoS against the network - specfically targeting end users - has been on the rise, and today I can qualify many of these as simple acts of revenge where someone will engage a dos (possibly, services like 'booters' or similar) because they lost an online game or had some interactive in a forum they didn't like. I have good 'consumer broadband' filtering rules in place which make sense and protect against quite a lot of obviously ddos oriented traffic streams. The next step I want to engage, for those types of traffic which I can positively identify as not spoofed, is to send out abuse reports to owners of ip ranges used to launch these attacks. Ideally I'd like to be able to write up some form letter describing the attack, the source ip(s) of note, some disassembled sample packets, and then feed a list of IP source addresses and have it mail it out to the abuse contact at each source network. I am wondering if anyone has a pointer or reference to any tools which might help facillitate this? Thank you. Mike-

11 13

Re: Seeking IPv6 Security Resources
by Scott Weeks 25 Nov '14

25 Nov '14

--- cgrundemann(a)gmail.com wrote: From: Chris Grundemann <cgrundemann(a)gmail.com> I am looking for IPv6 security resources to add to: http://www.internetsociety.org/deploy360/ipv6/security/ These could be best current practice documents, case-studies, lessons-learned/issues-found, research/evaluations, RFCs, or anything else focused on IPv6 security really. I'm not requesting that anyone do any new work, just that you point me to solid public documents that already exist. Feel free to share on-list or privately, both documents you may have authored and those you have found helpful. ------------------------------ http://www.si6networks.com/tools/ipv6toolkit/index.html List of Tools •addr6: An IPv6 address analysis and manipulation tool. •flow6: A tool to perform a security asseessment of the IPv6 Flow Label. •frag6: A tool to perform IPv6 fragmentation-based attacks and to perform a security assessment of a number of fragmentation-related aspects. •icmp6: A tool to perform attacks based on ICMPv6 error messages. •jumbo6: A tool to assess potential flaws in the handling of IPv6 Jumbograms. •na6: A tool to send arbitrary Neighbor Advertisement messages. •ni6: A tool to send arbitrary ICMPv6 Node Information messages, and assess possible flaws in the processing of such packets. •ns6: A tool to send arbitrary Neighbor Solicitation messages. •ra6: A tool to send arbitrary Router Advertisement messages. •rd6: A tool to send arbitrary ICMPv6 Redirect messages. •rs6: A tool to send arbitrary Router Solicitation messages. •scan6: An IPv6 address scanning tool. •tcp6: A tool to send arbitrary TCP segments and perform a variety of TCP-based attacks. scott

1 0

eBGP Graceful-Restart and GR Helper Mode with external networks.
by Chris Costa 24 Nov '14

24 Nov '14

Is there a BCOP (or substantiated opinion) for negotiating eBGP Graceful-Restart and Graceful-Restart Helper-Mode with external networks? Implementation looks varied across a few larger transit providers, and in some cases implemented inconsistently within the same provider. Seeing most IX peers with GR disabled, although I don't see they've disabled GR Helper Mode. Apparently, Junos (12.3, at least) doesn't offer disabling GR Helper Mode for BGP. Thanks.

2 1

Re: Craigslist hacked?
by Harry Hoffman 24 Nov '14

24 Nov '14

Probably a good time to remind folks of HTTPS everywhere plugin for Chrome and Firefox :-) Cheers, Harry On Nov 24, 2014 1:04 AM, Christopher Morrow <morrowc.lists(a)gmail.com> wrote: > > On Sun, Nov 23, 2014 at 11:51 PM, Randy Bush <randy(a)psg.com> wrote: > > and what tasty things did the hijacker's web site serve? > > probably not much for very long... :( CL traffic is a bit crushy.

2 1

Help, need Verizon fiber outage phone number
by Matthew Crocker 23 Nov '14

23 Nov '14

Does anyone have a phone number for Verizon-NE (Massachusetts)? I have a fiber outage between two Verizon COs and their stupid VTAG system is worthless. I can’t get a trouble ticket entered to save my life. All of the numbers I have either go nowhere or get stuck in music on hold hell then disconnect. Thanks -Matt -- Matthew S. Crocker President Crocker Communications, Inc. PO BOX 710 Greenfield, MA 01302-0710 E: matthew(a)crocker.com P: (413) 746-2760 F: (413) 746-3704 W: http://www.crocker.com

1 0

Outbound traffic on a circuit?
by Justin Wilson 23 Nov '14

23 Nov '14

I am looking at an order for a well known upstream provider. They are handing me a circuit at a data center. The contract reads if we use more than 50% of the outbound the price gets re-priced and almost doubles. How many folks have ran into this? Justin -- Justin Wilson <j2sw(a)mtin.net> http://www.mtin.net <http://www.mtin.net/blog> Managed Services xISP Solutions Data Centers http://www.thebrotherswisp.com Podcast about xISP topics http://www.midwest-ix.com Peering Transit Internet Exchange

5 6

Re: DDOS, IDS, RTBH, and Rate limiting
by freedman＠freedman.net 22 Nov '14

22 Nov '14

> > On the contrary - SPAN nee port mirroring cuts into the > > frames-per-second budget of linecards, as the traffic is in essence > > being duplicated. It is not 'free', and it has a profound impact on > > the the switch's data-plane traffic forwarding capacity. > > > > Unlike NetFlow. > > In hosting case mirroring usually done for uplink port, but i have to > agree, it might be a problem. Have you seen any issues with SPANning? We usually advise something like a $1k netoptis tap or to be cheaper there are actually $50 fiber cables with 30/70 taps embedded (so two such, one for RX tap and one for TX tap). Of course, that only grabs a single 10gig whereas with SPAN you can potentially do more - but the issues we've seen across vendors is that if you try to send more traffic into a SPAN port than its size, bad things can happen. Head of line blocking, random congestion, and other strange failures. And you trade off potential catastrophic downtime for SPAN-related network destabilization, for guaranteed downtime to bring links down to tap them. > "Major" expenses - tuning server according author recommendations, and > writing shell script that will send to 4948 command to blackhope IP. For > qualified sysadmin it is 2 hours of work, and $500 max as a "labor" > cost. Thats it. What can be cheaper than $2000 in this case? I guess i > wont get answer. I think the issue is not with your providing the info about fastnetmon, its genesis, and what you see as the great use cases for it - more around the statements on flow as an unusable source of data for various purposes. Things seem to have died down around that though, which is good :) > --- > Best regards, > Denys Avi Freedman | Your flow has something to show you; can you see it? | CEO, CloudHelix | (avi at cloudhelix dot com) | my name one word on skype |

1 0

BGP Update Report
by cidr-report＠potaroo.net 21 Nov '14

21 Nov '14

BGP Update Report Interval: 13-Nov-14 -to- 20-Nov-14 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS12897 1723660 29.3% 246237.1 -- HEAGMEDIANET HSE Medianet GmbH,DE 2 - AS23752 278395 4.7% 2899.9 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 3 - AS9829 193219 3.3% 153.8 -- BSNL-NIB National Internet Backbone,IN 4 - AS7029 79518 1.4% 36.4 -- WINDSTREAM - Windstream Communications Inc,US 5 - AS53249 73466 1.2% 36733.0 -- LAWA-AS - Los Angeles World Airport,US 6 - AS9587 56535 1.0% 1949.5 -- DTACNETWORK-TH-AP 26th Floor 333/3 Moo 14 Chai Building,TH 7 - AS48159 38843 0.7% 125.3 -- TIC-AS Telecommunication Infrastructure Company,IR 8 - AS28885 36232 0.6% 218.3 -- OMANTEL-NAP-AS OmanTel NAP,OM 9 - AS8402 36115 0.6% 22.9 -- CORBINA-AS OJSC "Vimpelcom",RU 10 - AS38197 35819 0.6% 35.0 -- SUNHK-DATA-AS-AP Sun Network (Hong Kong) Limited,HK 11 - AS37693 30493 0.5% 272.3 -- TUNISIANA,TN 12 - AS42337 28878 0.5% 178.3 -- RESPINA-AS Respina Networks & Beyond PJSC,IR 13 - AS14420 28436 0.5% 118.5 -- CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP,EC 14 - AS3816 26128 0.4% 51.8 -- COLOMBIA TELECOMUNICACIONES S.A. ESP,CO 15 - AS3 23691 0.4% 1306.0 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 16 - AS23342 21980 0.4% 21980.0 -- UNITEDLAYER - Unitedlayer, Inc.,US 17 - AS10620 21295 0.4% 10.7 -- Telmex Colombia S.A.,CO 18 - AS60725 20028 0.3% 4005.6 -- O3B-AS O3b Limited,JE 19 - AS25003 20025 0.3% 667.5 -- INTERNET_BINAT Internet Binat Ltd,IL 20 - AS45899 19807 0.3% 45.6 -- VNPT-AS-VN VNPT Corp,VN TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS12897 1723660 29.3% 246237.1 -- HEAGMEDIANET HSE Medianet GmbH,DE 2 - AS53249 73466 1.2% 36733.0 -- LAWA-AS - Los Angeles World Airport,US 3 - AS23342 21980 0.4% 21980.0 -- UNITEDLAYER - Unitedlayer, Inc.,US 4 - AS3 23691 0.4% 1306.0 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 5 - AS18135 10850 0.2% 10850.0 -- BTV BTV Cable television,JP 6 - AS62174 4107 0.1% 4107.0 -- INTERPAN-AS INTERPAN LTD.,BG 7 - AS60725 20028 0.3% 4005.6 -- O3B-AS O3b Limited,JE 8 - AS23752 278395 4.7% 2899.9 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 9 - AS10674 2629 0.0% 2629.0 -- GRUCOM - Gainesville Regional Utilities,US 10 - AS56636 2230 0.0% 2230.0 -- ASVEDARU VEDA Ltd.,RU 11 - AS4 2067 0.0% 1465.0 -- ISI-AS - University of Southern California,US 12 - AS12521 3930 0.1% 1965.0 -- NOVA_INTERNET_AS12521 Nova Internet Network,ES 13 - AS9587 56535 1.0% 1949.5 -- DTACNETWORK-TH-AP 26th Floor 333/3 Moo 14 Chai Building,TH 14 - AS35093 3604 0.1% 1802.0 -- RO-HTPASSPORT High Tech Passport Ltd SUA California San Jose SUCURSALA BUCURESTI ROMANIA,RO 15 - AS38808 1721 0.0% 1721.0 -- IMZAK-TRANSIT-AS-AP DSL Service Provider Servers,PK 16 - AS30944 1657 0.0% 1657.0 -- DKD-AS Bendra Lietuvos, JAV ir Rusijos imone uzdaroji akcine bendrove "DKD",LT 17 - AS3328 15997 0.3% 1599.7 -- -Reserved AS-,ZZ 18 - AS11728 1424 0.0% 1424.0 -- INTERNETXT - Internet Exchange Technology, Inc.,US 19 - AS56133 8072 0.1% 1345.3 -- TASMANET-AS-AP Tasmanet Pty Ltd,AU 20 - AS61708 1257 0.0% 1257.0 -- INFOCAT INFORMÁTICA LTDA,BR TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 94.16.64.0/21 247495 4.0% AS12897 -- HEAGMEDIANET HSE Medianet GmbH,DE 2 - 94.16.80.0/20 247386 4.0% AS12897 -- HEAGMEDIANET HSE Medianet GmbH,DE 3 - 94.16.72.0/21 247305 4.0% AS12897 -- HEAGMEDIANET HSE Medianet GmbH,DE 4 - 185.9.28.0/22 246034 4.0% AS12897 -- HEAGMEDIANET HSE Medianet GmbH,DE 5 - 194.127.204.0/23 245774 4.0% AS12897 -- HEAGMEDIANET HSE Medianet GmbH,DE 6 - 194.99.108.0/23 245433 4.0% AS12897 -- HEAGMEDIANET HSE Medianet GmbH,DE 7 - 194.45.104.0/23 244233 4.0% AS12897 -- HEAGMEDIANET HSE Medianet GmbH,DE 8 - 202.70.64.0/21 142246 2.3% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 9 - 202.70.88.0/21 135152 2.2% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 10 - 198.140.114.0/24 36755 0.6% AS53249 -- LAWA-AS - Los Angeles World Airport,US 11 - 198.140.115.0/24 36711 0.6% AS53249 -- LAWA-AS - Los Angeles World Airport,US 12 - 130.0.192.0/21 23689 0.4% AS3 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 13 - 64.29.130.0/24 21980 0.4% AS23342 -- UNITEDLAYER - Unitedlayer, Inc.,US 14 - 192.115.44.0/22 19956 0.3% AS25003 -- INTERNET_BINAT Internet Binat Ltd,IL 15 - 111.84.20.0/24 14443 0.2% AS10089 -- DTNCORP-TH-AP Total Access Communication PLC.,TH AS9587 -- DTACNETWORK-TH-AP 26th Floor 333/3 Moo 14 Chai Building,TH 16 - 111.84.22.0/24 14140 0.2% AS10089 -- DTNCORP-TH-AP Total Access Communication PLC.,TH AS9587 -- DTACNETWORK-TH-AP 26th Floor 333/3 Moo 14 Chai Building,TH 17 - 111.84.24.0/24 14065 0.2% AS10089 -- DTNCORP-TH-AP Total Access Communication PLC.,TH AS9587 -- DTACNETWORK-TH-AP 26th Floor 333/3 Moo 14 Chai Building,TH 18 - 162.249.183.0/24 11018 0.2% AS60725 -- O3B-AS O3b Limited,JE 19 - 42.83.48.0/20 10850 0.2% AS18135 -- BTV BTV Cable television,JP 20 - 192.58.232.0/24 10619 0.2% AS6629 -- NOAA-AS - NOAA,US Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0