- Test - lists.nanog.org

Ebay/Paypal blocking HTTP access based on SORBS DUHL / Spamhaus PBL
by Tarko Tikan 27 Aug '14

27 Aug '14

hey, For a while now, we have been getting complains from our broadband customers about not being able to reach ebay.com/paypal.com We have nailed it down to some small prefixes and they are all listed in SORBS DUHL / Spamhaus PBL and have been listed for ages. These are indeed dynamic IP pools and should not send any email (not that SMTP has anything to do with HTTP). For some reason, it looks like ebay/paypal is now blocking HTTP access based on these blacklists. Does anyone have working contact in their NOC or with security people? All emails to public contacts have not been answered to. -- tarko

4 6

centurylink chi2 and level3 -- network issues
by Nick 27 Aug '14

27 Aug '14

Is anyone else having network issue over the past week with centurylink and their peer level3? I spoke with centurylinks noc team. They are not being helpful and blame level3. I'm seeing period of high packet loss and poor throughput speeds. From what I can tell. Its a problem between qwest and level3 border routers. Host Loss% Snt Last Avg Best Wrst StDev .... 2. cer-core-02.inet.qwest.net 0.0% 663 0.5 0.8 0.4 35.0 2.9 3. vlan52.ebr2.Chicago2.Level3.net 2.7% 662 196.0 196.5 192.2 209.2 1.5 4. ??? 5. ae-46-46.ebr2.Washington1.Level3 1.8% 662 196.8 196.0 191.2 201.1 1.1 .... [not the complete traceroute] At the moment, I moved most of my traffic from centurylink. The remaining services are being greatly impacted by the poor network performance. What do you think my next steps should be? Any advice would be greatly appreciated. - Nick

2 1

RPKI
by Pelsser Cristel 27 Aug '14

27 Aug '14

Hi, With Daniele Iamartino, we are validating BGP routes with the objects stored in the RPKI. On 2014/07/26, for the routes at the LINX RouteViews monitor, we observe the following set of prefixes that are announced both with the correct origin AS and a wrong origin AS. There are very few of them. We believe they could be anycast where there is no ROA for some origin ASs or they could be misconfiguration/attacks. RIB Dump time: 2014/08/26 08:00 UTC prefix,valid AS,invalid AS 5.128.0.0/14,31200,50923 37.19.8.0/21,49964,198585 94.199.232.0/21,49413,5089 179.61.194.0/23,61440,37692 190.94.182.0/24,262195,18678 193.42.215.0/24,30880,50827 193.227.174.0/24,9051,24634 195.69.144.0/22,1200,41313 200.35.183.0/24,26617,27742 213.192.242.0/23,8903,12541 217.113.242.0/24,197860,20721 217.113.244.0/24,197860,20721 217.113.245.0/24,20721,197860 2a02:2928::/32,39288,197530 Prefixes containing private AS numbers prefix,valid AS,invalid AS 176.56.192.0/19,8426,65489 185.36.76.0/22,8426,65489 194.45.46.0/24,286,64951 2a00:fd00::/32,29695,65026 Any feedback is welcome, Cristel

1 0

Cisco Tech needed in San Franscisco
by JoeSox 27 Aug '14

27 Aug '14

Hi Everyone, Took over a new network and they have no onsite Cisco tech help for one of my remote locations. Can someone email me directly a company I can contract with to get help this Wed night in downtown San Francisco (we can push maintenance to Friday night as well but shooting for tomorrow)? -- Thank You, Joe

1 1

Best US Tunnelbroker for Youtube
by Ryan Shea 27 Aug '14

27 Aug '14

Just one man's experience, but my YouTube performance over my Hurricane Electric tunnel has been strikingly poor lately - so much so that I was thinking of squashing v6 in my house entirely. Looking for your experiences/thoughts on whether cutting over to SixXS or Routinghouse could be a path to 1080p cat video bliss instead.

19 30

Re: where to go to understand DDoS attack vector
by Larry Sheldon 27 Aug '14

27 Aug '14

On 8/26/2014 08:31, Roland Dobbins wrote: > > On Aug 26, 2014, at 8:26 PM, Stephen Satchell <list(a)satchell.net> wrote: > >> qotd 17/udp quote > > No, that's the protocol number - 17 is UDP - not the port number. Really? http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers udp DID used to be protocol 17, but it is a fact that quotd runs on udp port 17. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes.

2 1

Urgent
by randy＠psg.com 26 Aug '14

26 Aug '14

Contact for God, please reach out to me offlist. Regards, -AS666 NOC

18 20

where to go to understand DDoS attack vector
by Miles Fidelman 26 Aug '14

26 Aug '14

Hi Folks, Possibly a little off-topic for nanog, but I couldn't think of anywhere else to ask this (suggestions please!): We just discovered a vulnerability the hard way - someone used one of our IPMI boards as a vector for a DDoS attack (well, I guess the real hard way would be to have been on the receiving end, but...). Anyway... aside from some obvious issues, I've been learning a lot about the vulnerabilities of Supermicro IPMI boards (and busily locking them down). The one that's tricky, though, is that this was a reflection/amplification attack. Conveniently, the attackee's data center operator managed to capture incoming packets with tcpdump, and they all looked like this: 8:33:58.482193 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto UDP (17), length 29) x.x.x.x.2072 > x.x.x.x.27015: UDP, length 1 0x0000: 4500 001d 0000 4000 3811 088c cf9a 3b8c E.....@.8 <mailto:E.....@.8>.....;. 0x0010: 405e eebf 0818 6987 0009 10f8 4300 0000 @^....i.....C... 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. (obviously, with the IP addresses removed). It could be that someone planted a bot in the IPMI board (just starting to do some forensics - currently hampered by being on travel, and having blocked all the ports from the outside world - need to get to the datacenter and make some hardwired connections) - but it looks a lot more like a reflection/amplification attack - particularly since the target seems to have been a game host, and port 27015 is used by the game halflife. But.... Now I understand reflected DNS and NTP attacks - but the outbound port, 2072 (registered for GlobeCom msync) is neither, nor is it anything that we're running - which kind of begs the question of how this might be working. Any thoughts? Any pointers? Any starting points? Immediate issue is dealt with (at least for us, target seems to be off the air) - but want to understand this, report it, all of that. Thanks very much, Miles Fidelman -- In theory, there is no difference between theory and practice. In practice, there is. .... Yogi Berra

8 13

network quality measurement probes+reporting
by Saku Ytti 26 Aug '14

26 Aug '14

Anyone can recommend or even just name drop network quality measurement kit? I'm only familiar with IP SLA, RPM and Creanord (and various inhouse tools:) What I'd like to see - 1us or better one-way jitter (no need for clock sync, just accurate clock) - tens or 100us one-way latency (as good as cheaply can get sync, ntp is ok) - 1us or better RTT - any-to-any measurement, not just hub<->spoke (or sufficiently cheap hub) - 100pps to 100 measurement points on 8 CoS (ish, less may be acceptable) - randomized payload pattern + verification (to catch bit mangling) - randomized sport/dport (to put traffic in each ECMP/LAG combo, long term) - programmatic accesss and useful documents to measurement data (e.g. some OSS TSDB) - high quality, fast, useful graphical reporting and alarming - support for TWAMP and OWAMP responders - indicative price <100kEUR CAPEX and <2000EUR YRC for 100 nodes solution -- ++ytti

5 4

Verizon (NY, LEC) issues around 1200 EDT?
by Christopher J. Pilkington 26 Aug '14

26 Aug '14

We saw multiple service outages from Verizon local in NYC, specifically our offices served out of Broad Street (NYCMNYBS). Lost multiple OC as well as local voice PRI. I haven't dug exact times out of the logs yet, but was around noon EDT. Anyone else see similar or know what went on? -cjp

1 1