- Test - lists.nanog.org

BGP Route Recorder suggestions
by Ben Bartsch 02 May '13

02 May '13

Hi all: I am curious what you RENs out there are using for BGP (and IGP) route recording. We did a demo of Packet Design's Route Explorer. While I loved the functionality and ease of use, we simply can not afford it. I am attracted to iBGPlay since we use the BGPlayer at routeviews all the time, but I can't seem to get a privacy statement from the software authors. Any other (cheap) route recorders out there? Any recommendations on what y'all are using that you like / don't like? Thanks in advance for any input. -ben

1 0

Tier1 blackholing policy?
by Thomas Schmid 01 May '13

01 May '13

Greetings, I know Tier1s are blackholing traffic all the time :) (de-peering, congestion etc.) but did it became a new role for Tier1s to go from transit provider to transit blocker? We received recently customer complaints stating they can't reach certain websites. Investigation showed that the sites were not reachable via Tier1-T, but fine via Tier1-L. I contacted Tier1-T and the answer was something like "yeah, this is a known phishing site and to protect our customers we blackhole that IP" (btw - it was 2 ASes away from Tier1-T). Huh? If I want to block something there, it should me my decision or that of my country's legal entities by court order and not being decided by some Tier1's intransparent security department. (Not even mentioning words like 'CGN', 'legal', 'net neutrality' or 'censorship') This might be an acceptable policy for a cable provider but not for a Tier1. Haven't seen something like this in many years. Did I miss a pardigm-shift here and has this become a common "service" at Tier1s? Thomas

14 22

Mitigating DNS amplification attacks
by Thomas St-Pierre 01 May '13

01 May '13

Hi! I was wondering if anyone had any experience with dealing with open resolvers as a web hoster? We currently have some 40,000 ip's that respond to DNS in our AS, the majority of which are not "open" but do reply with a referral to the root zones. We've been sending emails to our clients but as the servers are not managed by us, there's not much we can do at that level. Recently we've seen a large increase in the number and volume of DNS amplification DDOS's that are being reflected off of our AS. Just today we've seen at least 6 different attacks with between 4 and 10gbps leaving our AS each time. It's not really causing us issues at the moment because we have the capacity, but I'd hate to be on the receiving side. (and indeed, have been on the receiving side in the past, so I know how much it can suck) Has anyone ever tried mitigating/rate-limiting/etc these attacks in the network before? (vs at the server/application level) We have an Arbor peakflow device, but it's not really geared for this scenario I find. It will detect the outgoing attack via the flows, but all we can really do is null-route the victims ip in our AS. Ideally we would need a way to rate-limit DNS packets based on source ip. Maybe a linux box that handles dropping packets from the same source-ip over 1000/sec with some policy-based routing sending the DNS traffic to it? Does such a box exist already? If anyone has any ideas or suggestions, then by all means! There must be a better way to do this, and I'd really like to avoid re-inventing the wheel if it's been invented already. :) Thanks! Thomas

7 10

Comcast Launches IPv6 for Business Customers
by Brzozowski, John 01 May '13

01 May '13

FYI for folks that are interested: http://corporate.comcast.com/comcast-voices/comcast-launches-ipv6-for-busin… John ========================================= John Jason Brzozowski Comcast Cable e) mailto:john_brzozowski@cable.comcast.com w) http://www.comcast6.net =========================================

7 8

"It's the end of the world as we know it" -- REM
by Valdis Kletnieks 01 May '13

01 May '13

I didn't see any mention of this Tony Hain paper: http://tndh.net/~tony/ietf/ARIN-runout-projection.pdf tl;dr: ARIN predicted to run out of IP space to allocate in August this year. Are you ready?

43 97

Andros Island Connectivity?
by Aaron C. de Bruyn 01 May '13

01 May '13

I just had a client drop an interesting requirement on me. They are on Andros Island (Bahamas) for about a year. I'm working on getting an exact address from the adminisphere above me, but all I've been told so far is they are 'near the naval base'. They just called and said "We need internet access yesterday". None of the people on-site are technical, and all their data is accessed via RDP on a server in the United States. Having never been there, I have no idea if it's like downtown San Francisco where the internet grows on trees, or if it's like the Sahara desert which might require dragging your own fiber in on camelback... Does anyone have pointers on who to talk to or how I can get them internet access? -A

10 22

Re: Andros Island Connectivity?
by alejandroacostaalamo＠gmail.com 01 May '13

01 May '13

Hi, Please also note that modern VSAT hubs (idirect, viasat) -some better than other- can emulate SCPC. They also support QoS, tcp spoofing and many other nice features. Regards, ------Original Message------ From: Rob Seastrom To: TR Shaw Cc: Aaron C. de Bruyn Cc: NANOG mailing list Subject: Re: Andros Island Connectivity? Sent: Apr 30, 2013 8:43 PM Protracted discussion (and promotion) has glossed over one key point: >> None of the people on-site are technical, and all their data is accessed >> via RDP on a server in the United States. They will not be happy with VSAT latency (typically 700ms though physics says you can never do better than 550, and that's for the space segment alone) if they are running RDP, VNC, Citrix, or similar technologies. Sorry for being a buzzkill, Warren. :) -r Este mensaje ha sido enviado gracias al servicio BlackBerry de Movilnet

1 0

Re: Andros Island Connectivity?
by Joel M Snyder 01 May '13

01 May '13

> > Protracted discussion (and promotion) has glossed over one key point: > >>> None of the people on-site are technical, and all their data is accessed >>> via RDP on a server in the United States. > > They will not be happy with VSAT latency (typically 700ms though > physics says you can never do better than 550, and that's for the > space segment alone) if they are running RDP, VNC, Citrix, or similar > technologies. Sorry for being a buzzkill, Warren. :) Actually, Citrix (in particular) works quite well over satellite latencies. The network project I'm working on right now is wrapping up an app rollout to about 100 countries, many of which we can only reach via VSAT. Testing showed that Citrix performance is much better for AJAX-y web apps than pure HTTP. Citrix has a bunch of intelligence built-in specifically to deal with issues related to high-latency/low-bandwidth circuits, including local mouse, local echo, click/movement aggregation into large packets, and of course compression-before-encryption. It's not quite Memorex, but it's very usable. I'd be happy to share the data with anyone who is interested; I also showed that F5 Big-IP load balancers can make really horrible ERP apps (*ahem* Oracle eBusiness *cough* *cough* *cough*) work a lot better as well, if you decide not to use Citrix. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

3 4

Breakpoint 2013 Call For Papers
by cfp＠ruxcon.org.au 30 Apr '13

30 Apr '13

Breakpoint 2013 Call For Papers Melbourne, Australia, October 24th-25th Intercontinental Rialto http://www.ruxconbreakpoint.com .[x]. Introduction .[x]. The Ruxcon team is pleased to announce Call For Papers for Breakpoint 2013. Breakpoint showcases the work of expert security researchers from around the world on a wide range of topics. This conference is organised by the Ruxcon team and offers a specialised security conference to complement and lead into the larger and more casual Ruxcon weekend conference. Breakpoint caters towards security researchers and industry professionals alike, with a focus on cutting edge security research. Breakpoint presents a great opportunity for our selected speakers to receive a complimentary trip to Australia and experience both the Breakpoint and Ruxcon conferences, not to mention the great weather, awesome parties, and friendly people. Melbourne is a city of many subcultures, personalities and styles. Melbourne has a vibrant arts and music scene, eccentric cafes, intimate bars and restaurants, and is known as Australia's cultural capital. .[x]. Important Dates .[x]. May 1 - Call For Presentations Open August 23 - Call For Presentations Close October 22-23 - Breakpoint Training October 24-25 - Breakpoint Conference October 26-27 - Ruxcon Conference .[x]. Topic Scope .[x]. Topics of interest include, but are not limited to: o Mobile Device Security o Exploitation Techniques o Reverse Engineering o Vulnerability Discovery o Rootkit Development o Malware Analysis o Code Analysis o Virtualisation, Hypervisor Security o Cloud Security o Embedded Device Security o Hardware Security o Telecommunications Security o Wireless Network Security o Web Application Security o Law Enforcement Activities o Forensics o Threat Intelligence o You get the idea .[x]. Submission Guidelines .[x]. In order for us to process your submission we will require the following information: 1. Presentation title 2. Detailed summary of your presentation material 3. Name/Nickname 4. Mobile phone number 5. Brief personal biography 6. Description of any demonstrations involved in presentation 7. Information on where the presentation material has or will be presented before Breakpoint * Preference will be given to presentations that contain original research that will be first presented at Breakpoint. * As a general guideline, Breakpoint presentations are between 45 and 60 minutes, including question time. If you have any questions about submissions, or would like to make a submission, please send an email to bpx(a)ruxconbreakpoint.com .[x]. Speaker Benefits .[x]. Speakers at Breakpoint will be entitled to the following benefits: - A return economy airfare to Melbourne (total cost limit applies) - Three nights accommodation at the Intercontinental Rialto - Complimentary registration for Breakpoint and Ruxcon conferences - Invitation to all Breakpoint and Ruxcon parties - Unlock 'Presented on world's smallest continent' achievement * All speaker benefits apply to a single speaker per submission. .[x]. Contact .[x]. If you have any questions or inqueries, contact us at: * Email: bpx(a)ruxconbreakpoint.com * Twitter: @ruxconbpx

1 0

Re: Tier1 blackholing policy?
by Jared Mauch 30 Apr '13

30 Apr '13

On Apr 30, 2013, at 2:50 PM, bmanning(a)vacation.karoshi.com wrote: > Phone? You mean like Jitsi or Skype? > Fax? > > I'd like to see some numbers to back your assertion of "Typical" restoration > times of days. my vendors deliver software fixes for "BGP" doesn't work in weeks, so I think that the following timeline and process I'm going to outline exceeds their BGP problems. 0 hour - Issue Reported 0-24 hours - triage; send to customer/internal customer to mitigate/remediate 25-48 hours - Customer responds, host taken down if hacked, etc.. 48-96 hours+ - If no response, IP null0'ed per AUP as network security risk 48-96 hours is also where the customer freaks out and quickly fixes their problem to come in compliance with AUP. This is a natural process. Null0 or ACLs don't stay up for days or weeks on end. That doesn't mean this catches 100% of all cases, but many ISPs get a daily report of phishing sites and malware hosted on their network each morning. You can get one too! http://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork You can get a daily ATLAS report from Arbor as well: http://atlas.arbor.net/ (Although I can't get anyone to fix a problem with it, so anyone there can email me if you have the power to fix it). There are other aggregators of data as well, such as SIE. If you don't know the health of your network, take a look. Many folks will email you these reports automatically, or provide you a direct feed (some in realtime, such as SIE). - Jared

1 0