- Test - lists.nanog.org

Contact for Road Runner
by Faisal Imtiaz 27 May '14

27 May '14

Hello, I am looking to get in touch with anyone who is responsible for Routing Registry Objects at Road Runner Cable. Can you please reply back to me off list. (We need to have an older ASN RR Object Created by rr.com to be removed please). Thanks. Faisal Imtiaz Snappy Internet & Telecom 7266 SW 48 Street Miami, FL 33155 Tel: 305 663 5518 x 232 Help-desk: (305)663-5518 Option 2 or Email: Support(a)Snappytelecom.net

1 0

Re: Large DDoS, small extortion
by Larry Sheldon 25 May '14

25 May '14

On 5/24/2014 11:29 AM, Anne P. Mitchell, Esq. wrote: > >> Law enforcement and victims have different objectives. Law >> enforcement wants to find the criminal, gather sufficient evidence >> to prove their guilt, then prosecute them. More attacks helps law >> enforcement. >> >> The victims, in general, want the attacks to stop. > > Actually, our experience in this particular case (it is the same > person(s) hitting all of the targets, even using the same email > addresses, etc.) is that the victims want to find the guy too. In > fact, I can say with a fair degree of certainty that the coordinated > efforts of a dedicated group of "victims", who have come together > without regards to the fact that they are otherwise 'competitors' in > business, and who have furnished the agencies with useable technical > information about the attacks, have given the agencies a substantial > leg up in the investigation. All that from a far greater authority than I. But lest my weak words be misunderstood, I have no objection what ever to providing technical information (and facilities, even)--it is ONLY the paying of ransom that I object to. And I think I would say that if I were the captive. I think over the long haul the odds are that if you DO pay the ransom, the victim will be dead anyway. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Linkedin Peering Contact
by Faisal Imtiaz 24 May '14

24 May '14

Hello, I am trying to contact the folks responsible for Linkedin Peering. Can you please send me you contact info off list. (emails to addresses listed in peeringdb are being bounced back by the mail server) Thanks Faisal Imtiaz Snappy Internet & Telecom 7266 SW 48 Street Miami, FL 33155 Tel: 305 663 5518 x 232 Help-desk: (305)663-5518 Option 2 or Email: Support(a)Snappytelecom.net

1 1

Large DDoS, small extortion
by Beleaguered Admin 24 May '14

24 May '14

Apologies for the non-personal email address, but I don't want to give our attacker any additional information than I need to. I'd be happy to send personal contact/ASN information to any nanog admins or regular members of nanog if it's useful. Over the past year or so, we (a decent sized tier 2 with a nationwide US backbone) have had several large DDoS attacks from what appear to be the same person who is (we presume) going down something like the alexa list of top sites, attacking them, and asking for small amounts of money to stop. This has been going on for a long time -- almost every detail is exactly the same as what is described here: http://it.slashdot.org/story/12/11/03/1846252/ask-slashdot-how-to-deal-with… and more recently: http://techcrunch.com/2014/03/03/meetup-suffering-significant-ddos-attack-t… and: https://gist.github.com/dhh/9741477 And I believe attacks including vimeo, github, and others. The attacker is smarter than many random attackers, or at least has better tools. He watches when you mitigate the attack, and shifts his attack to something new. He (or his tools) also watch DNS for the thing he's attacking and the attack moves as DNS changes. We've seen UDP amplification (NTP and DNS mainly), syn flood, syn/ack flood, layer 7 cache busting (https://isc.sans.edu/forums/diary/Wordpress+Pingback+DDoS+Attacks/17801/) and others we haven't been able to fully mitigate/identify. The largest we've seen (which isn't the largest we've read about) attacks are over 50Gbit and 10s of millions of pps. He is in regular communication (via whois info and other collected contact data) asking for <$1000 USD sums to stop the attacks. While we are interested in technical means to mitigate the attacks (the syn and syn/acks are brutal, all cores pegged on multicore 10G nic servers just dealing with interrupts), what I'd really like to find out is how to help fix the problem. We've tried to engage upstream providers to help trace the attacks, but have gotten nowhere (they didn't seem to understand that the syn attacks were spoofed, and looking at source IPs didn't matter, we wanted to know the ingress points on their network.) What are the best practices for this? Are there secret code words (http://xkcd.com/806/) we can use to get to someone at our upstreams who might know what we're talking about? Is it worth the time? Is it worth talking to law enforcement? Some of these have been >500k costs to the customer, but we assume the person doing it isn't in any western country, so maybe it doesn't even matter? Thanks.

16 26

help with CF card on Catalyst 6500 with Sup720
by Martin Hotze 24 May '14

24 May '14

Hi, can anyone provide a dd-image from a CF card from a Catalyst 6500 with Sup720, please. We have a refurbished 6500 w/ Sup720-3BXL with an old rommon which is not able to format a CF card. (various other methods with formatting FAT16 on Linux etc. did not work; google search only pointed to format within a running system, but we do not have such a system nearby) IOS image is already present. any help appreciated. thanks, martin

2 1

Re: Large DDoS, small extortion
by Anne P. Mitchell, Esq. 24 May '14

24 May '14

> Law enforcement and victims have different objectives. Law enforcement > wants to find the criminal, gather sufficient evidence to prove their > guilt, then prosecute them. More attacks helps law enforcement. > > The victims, in general, want the attacks to stop. Actually, our experience in this particular case (it is the same person(s) hitting all of the targets, even using the same email addresses, etc.) is that the victims want to find the guy too. In fact, I can say with a fair degree of certainty that the coordinated efforts of a dedicated group of "victims", who have come together without regards to the fact that they are otherwise 'competitors' in business, and who have furnished the agencies with useable technical information about the attacks, have given the agencies a substantial leg up in the investigation. Anne Anne P. Mitchell, Attorney at Law CEO/President Institute for Social Internet Public Policy Member, Cal. Bar Cyberspace Law Committee Author: Section 6 of the Federal CAN-SPAM Act of 2003 Ret. Professor of Law, Lincoln Law School of San Jose

1 0

Re: Oddity
by Larry Sheldon 24 May '14

24 May '14

On 5/23/2014 9:00 PM, Larry Sheldon wrote: > Odd that "comics.com" is dead and "gocomics.com" is "down for Scheduled > Maintenance" at 2000 Central USA time. > > No the Intertubes are not down--lots of stuff is working, but those and > some others are not. (Cox customer out of Omaha). Yes, I considered that they might be the same place. No I have not checked it out. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Oddity
by Larry Sheldon 24 May '14

24 May '14

Odd that "comics.com" is dead and "gocomics.com" is "down for Scheduled Maintenance" at 2000 Central USA time. No the Intertubes are not down--lots of stuff is working, but those and some others are not. (Cox customer out of Omaha). -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: Large DDoS, small extortion
by Larry Sheldon 23 May '14

23 May '14

On 5/23/2014 1:09 PM, Barry Shein wrote: > > On May 24, 2014 at 00:38 rdobbins(a)arbor.net (Roland Dobbins) wrote: > > Never, under any circumstances, pay. Not even if you've persuaded > > the Men from U.N.C.L.E. to help you, and they suggest you pay > > because they think they can trace the money, do not pay. > > Ok, you're recommending $VICTIM ignores or resists the advice of law > enforcement authorities, right? Given the the current status of reputation, ordinary, run-of-the-mill common sense, and a calm, reflective consideration of the obvious, I would say yes, follow the advice that makes sense, but pay NO money, not even as bait. If they want to put up taxpayer money from their budget, I would still worry for the reasons given. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

BGP Update Report
by cidr-report＠potaroo.net 23 May '14

23 May '14

BGP Update Report Interval: 15-May-14 -to- 22-May-14 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS9829 116359 3.4% 70.5 -- BSNL-NIB National Internet Backbone,IN 2 - AS45514 90170 2.6% 332.7 -- TELEMEDIA-SMB-AS-AP Bharti Airtel Ltd., TELEMEDIA Services, for SMB customers,IN 3 - AS13238 75821 2.2% 257.0 -- YANDEX Yandex LLC,RU 4 - AS8402 46535 1.4% 26.9 -- CORBINA-AS OJSC "Vimpelcom",RU 5 - AS28573 44405 1.3% 11.5 -- NET Serviços de Comunicação S.A.,BR 6 - AS4775 35456 1.0% 285.9 -- GLOBE-TELECOM-AS Globe Telecoms,PH 7 - AS10620 25281 0.7% 8.8 -- Telmex Colombia S.A.,CO 8 - AS27738 24997 0.7% 43.3 -- Ecuadortelecom S.A.,EC 9 - AS23752 24978 0.7% 181.0 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 10 - AS41691 19795 0.6% 549.9 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 11 - AS3816 19145 0.6% 22.9 -- COLOMBIA TELECOMUNICACIONES S.A. ESP,CO 12 - AS16625 17281 0.5% 36.5 -- AKAMAI-AS - Akamai Technologies, Inc.,US 13 - AS14259 15757 0.5% 58.8 -- Gtd Internet S.A.,CL 14 - AS25184 14882 0.4% 118.1 -- AFRANET AFRANET Co. Tehran, Iran,IR 15 - AS9583 14774 0.4% 10.2 -- SIFY-AS-IN Sify Limited,IN 16 - AS35819 13516 0.4% 25.0 -- MOBILY-AS Etihad Etisalat Company (Mobily),SA 17 - AS17974 12798 0.4% 4.6 -- TELKOMNET-AS2-AP PT Telekomunikasi Indonesia,ID 18 - AS7552 12552 0.4% 10.1 -- VIETEL-AS-AP Viettel Corporation,VN 19 - AS31148 12438 0.4% 12.2 -- FREENET-AS Freenet Ltd.,UA 20 - AS4766 12243 0.3% 4.2 -- KIXS-AS-KR Korea Telecom,KR TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS60345 10049 0.3% 5024.5 -- NBITI-AS Nahjol Balagheh International Research Institution,IR 2 - AS4 3939 0.1% 824.0 -- ISI-AS - University of Southern California,US 3 - AS45590 2901 0.1% 2901.0 -- HGCINTNET-AS-AP Hutch Connect,HK 4 - AS16321 6691 0.2% 2230.3 -- AICONET-AS Aiconet Ltd.,RU 5 - AS60134 1848 0.1% 1848.0 -- FRESHNET-AS FreshNet Ltd.,UA 6 - AS3 1453 0.0% 1987.0 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 7 - AS54465 7022 0.2% 1404.4 -- QPM-AS-1 - QuickPlay Media Inc.,US 8 - AS52879 7016 0.2% 779.6 -- ABM INFORMATICA E TELECOM,BR 9 - AS37626 1365 0.0% 682.5 -- OceanBrave-AS,NG 10 - AS55393 1320 0.0% 660.0 -- MIDOKURA Midokura Co., Ltd,JP 11 - AS3 640 0.0% 1550.0 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 12 - AS41691 19795 0.6% 549.9 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 13 - AS60135 488 0.0% 488.0 -- WEBSTAR-NET WebStar Ltd.,RU 14 - AS2 5673 0.2% 1131.0 -- UDEL-DCN - University of Delaware,US 15 - AS40173 463 0.0% 463.0 -- IRBS-ASN - IRBS Engineering, Inc.,US 16 - AS22416 441 0.0% 441.0 -- -Reserved AS-,ZZ 17 - AS35093 1251 0.0% 417.0 -- RO-HTPASSPORT HighTech Passport Ltd SUA California San Jose SUCURSALA BUCURESTI ROMANIA,RO 18 - AS45688 1197 0.0% 399.0 -- UT-NSRG The University of Tokyo Interfaculty Initiative in Information Studies,JP 19 - AS11504 380 0.0% 380.0 -- WHITE-CASE-1155 - White & Case,US 20 - AS42561 749 0.0% 374.5 -- GRAD-AS OOO "NTS GRADIENT",RU TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 89.221.206.0/24 19588 0.5% AS41691 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 2 - 202.70.88.0/21 11319 0.3% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 3 - 202.70.64.0/21 11209 0.3% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 4 - 192.58.232.0/24 10690 0.3% AS6629 -- NOAA-AS - NOAA,US 5 - 78.109.192.0/20 10233 0.3% AS25184 -- AFRANET AFRANET Co. Tehran, Iran,IR 6 - 120.28.62.0/24 7829 0.2% AS4775 -- GLOBE-TELECOM-AS Globe Telecoms,PH 7 - 222.127.0.0/24 7639 0.2% AS4775 -- GLOBE-TELECOM-AS Globe Telecoms,PH 8 - 205.247.12.0/24 7614 0.2% AS6459 -- TRANSBEAM - I-2000, Inc.,US 9 - 115.170.128.0/17 7155 0.2% AS4847 -- CNIX-AP China Networks Inter-Exchange,CN 10 - 206.152.15.0/24 7006 0.2% AS54465 -- QPM-AS-1 - QuickPlay Media Inc.,US 11 - 42.83.48.0/20 5921 0.2% AS18135 -- JPNIC-ASBLOCK-AP JPNIC,JP 12 - 78.158.184.0/24 5026 0.1% AS60345 -- NBITI-AS Nahjol Balagheh International Research Institution,IR 13 - 5.160.10.0/24 5023 0.1% AS60345 -- NBITI-AS Nahjol Balagheh International Research Institution,IR 14 - 186.237.56.0/22 3939 0.1% AS4 -- ISI-AS - University of Southern California,US 15 - 112.137.16.0/20 2901 0.1% AS45590 -- HGCINTNET-AS-AP Hutch Connect,HK 16 - 84.205.66.0/24 2754 0.1% AS12654 -- RIPE-NCC-RIS-AS Reseaux IP Europeens Network Coordination Centre (RIPE NCC),EU 17 - 66.171.233.0/24 2542 0.1% AS4436 -- AS-GTT-4436 - nLayer Communications, Inc.,US 18 - 66.171.236.0/24 2542 0.1% AS4436 -- AS-GTT-4436 - nLayer Communications, Inc.,US 19 - 185.27.8.0/22 2531 0.1% AS42525 -- GlobalConnect a/s,DK 20 - 176.116.240.0/20 2233 0.1% AS16321 -- AICONET-AS Aiconet Ltd.,RU Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0