- Test - lists.nanog.org

Should the Facebook's, Google , Amazon's of this world operate a BGP looking glass ?
by Peter Ehiwe 29 Mar '13

29 Mar '13

Hi All Should major social networking sites like Facebook,Google and Amazon operate an IP looking glass ? i think they should , here is a short justification write-up i did , using a real life troubleshooting scenario. http://www.slideshare.net/peterehiwe/why-major-content-providers-need-an-ip… -- Warm Regards Peter

1 0

Google public DNS flapping/non-functional
by Blair Trosper 28 Mar '13

28 Mar '13

Could someone from Google contact me off list to discuss the public resolvers? I'm getting NXDOMAIN and then a proper response literally one second later. And from there it's just 20 GOTO 10...the resolver seems to be having a psychotic episode, or...at the very least...an identity crisis. Other public resolver services have no issue with this, but the problem seems to be affected by anything I throw at either 8.8.8.8 or 8.8.4.4 to resolve. (The IPv6 public resolvers are doing the same thing, I should point out.) I understand that those ingress addresses are any/multicast, so perhaps the problem I'm having is confined to a single datacenter in my region...and thus may not be affecting people outside of that DC. Thanks, Blair

2 1

Verizon Wireless security contact needed
by nick hatch 28 Mar '13

28 Mar '13

Hi all, I just discovered a somewhat-exigent issue which affects confidentiality for Verizon Wireless customers. (PSTN / Voice) I'm failing at trying to find a Verizon Wireless security contact through normal means. If someone can provide a contact off-list it would be much appreciated. Thanks, -Nick

2 1

Line cut in Mediterranean?
by James Smith 28 Mar '13

28 Mar '13

Getting reports from a third party vendor that there's been a line cut in the Mediterranean that is affecting some Internet traffic. Anyone have any details?

10 11

Re: Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by freedman＠freedman.net 27 Mar '13

27 Mar '13

An important question... I recall a peering panel at an ISPCON in 1996 when the current Peering Badguys, BBN, were represented by John, who listened to a ton of bitching for an hour about the unfairness of it all and said (paraphrasing)... "I understand you all have your opinions and desires but I just want to point out one thing. It is now 1996, 2 years after the widespread adoption of the web, and in every city in the US there are at least two ISPs happily providing unlimited {dialup} access for under $20/mo. What do you think we'd have if it were run or regulated by the government?" Luckily, many bureaucrats and politicians in our government do understand that. And so far The Community has been able to put pressure on international bodies and other governments don't have the clout. Hopefully that remains the case for some time. Avi > In general, governments have avoided regulating various aspects of > the Internet, in part because of lack of understanding and in part > because the community keeps telling them that trying to regulate > won't work because of its decentralized nature. As the Internet > becomes increasingly important to each country's economy and its > citizens, the status quo is not likely to continue. > > The real question is, when governments do decide to try and help > "improve the Internet", who will they be listening to, and will > the operator community have spoken with a clear enough voice in > these matters on what actually would make for an improvement? > > FYI, > /John

1 0

Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by Jay Ashworth 27 Mar '13

27 Mar '13

http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet Yes: 120 gigabits/second, primarily of DNS amplification traffic. Still think it's optional to implement BCP38 pervasively? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

9 9

Re: Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by Scott Weeks 27 Mar '13

27 Mar '13

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> According to the New York Times it was 300 gbps and Cyberbunker was the bad guy. http://www.nytimes.com/2013/03/27/technology/internet/online-dispute-become… ----------------------------------------- Got a link that we don't have to allow cookies and have to create an account to read? ------------------------------------------------------------ I found it using startpage.com's proxy and pasted it below for others that don't want to create accounts and all: A squabble between a group fighting spam and a Dutch company that hosts Web sites said to be sending spam has escalated into one of the largest computer attacks on the Internet, causing widespread congestion and jamming crucial infrastructure around the world, John Markoff and Nicole Perlroth write on Wednesday in The New York Times. Millions of ordinary Internet users have experienced delays in services like Netflix or could not reach a particular Web site for a short time. However, for the Internet engineers who run the global network, the problem is more worrisome. The attacks are becoming increasingly powerful, and computer security experts worry that if they continue to escalate, people may not be able to reach basic Internet services, like e-mail and online banking. The dispute started when the spam-fighting group, called Spamhaus, added the Dutch company Cyberbunker to its blacklist, which is used by e-mail providers to weed out spam. Cyberbunker, named for its headquarters, a five-story former NATO bunker, offers hosting services to any Web site “except child porn and anything related to terrorism,” according to its Web site. A spokesman for Spamhaus, which is based in Europe, said the attacks began on March 19, but had not stopped the group from distributing its blacklist. Patrick Gilmore, chief architect at Akamai Networks, a digital content provider, said Spamhaus’s role was to generate a list of Internet spammers. Of Cyberbunker, he added: “These guys are just mad. To be frank, they got caught. They think they should be allowed to spam.” Mr. Gilmore said that the attacks, which are generated by swarms of computers called botnets, concentrate data streams that are larger than the Internet connections of entire countries. He likened the technique, which uses a long-known flaw in the Internet’s basic plumbing, to using a machine gun to spray an entire crowd when the intent is to kill one person. The so-called distributed denial of service, or DDoS, attacks have reached previously unknown magnitudes, growing to a data stream of 300 billion bits per second. Questioned about the attacks, Sven Olaf Kamphuis, an Internet activist who said he was a spokesman for the attackers, said in an online message that, “We are aware that this is one of the largest DDoS attacks the world had publicly seen.” Mr. Kamphuis said Cyberbunker was retaliating against Spamhaus for “abusing their influence.” scott

3 2

Re: Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by Scott Weeks 27 Mar '13

27 Mar '13

"...Sven Olaf Kamphuis, an Internet activist who said he was a spokesman for the attackers..." I wonder is he'll ever post here again as he has in the past. It probably would not go well for him if he did... scott

1 0

Re: Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by Scott Weeks 27 Mar '13

27 Mar '13

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> According to the New York Times it was 300 gbps and Cyberbunker was the bad guy. http://www.nytimes.com/2013/03/27/technology/internet/online-dispute-become… ----------------------------------------- Got a link that we don't have to allow cookies and have to create an account to read? scott

4 3

Enforcing Source Integrity: BCP38 and Open Resolver Problems
by Eric M. Carroll 27 Mar '13

27 Mar '13

The root cause of high scale directed amplification attacks is the failure to assure the integrity of the source IP address. This failure leads to a large set of directed amplification attack vectors. BCP38 was written in 2000, coming up on its 13th anniversary. This root cause, and various methodologies & technologies to resolve it, have been an ongoing discussion since back to the 90s. The failure to enforce this BCP or the related technological mechanisms to force implementation is the root cause of why the Internet cannot always trust source addresses and why these attack vectors persist. Until the ISP community gets serious about forcing the integrity of source addresses throughout its topology, various flavours of attack whose root cause is the spoofed source addresses will continue. Yes, it is not easy to do because it is a transitive trust issue, linked to topology and address management policy. Yes it would be easier if there was a magic bullet to validate source addresses built into the architecture. But there is not, the architecture is what it is. If every step of the chain enforced the integrity of source addresses, this risk would be resolved. There are multiple different steps that could be taken, including law enforcement, statute, contractual, policy, process and technological mechanisms. Every ISP and content providers' business model is threatened by this vulnerability. Every attack drives up operational expenses for everyone. Opportunity costs of missed sales and impacted business are everywhere. It is a pure tragedy of the commons - for lack of enforcement, the whole system is threatened in scale. This problem cannot be allowed to rest at the edges simply by pointing at the current amplification vector. Yesterday it was something different. Tomorrow it will different again. The constant is the rising scale of the Internet and resulting increase in scale of the attack and its corresponding economic impact. The root cause is not today's Google issue. The ISP community has the power to enforce this through policy and technological means. Whether it has the will and ability to self-organize and enforce is a different issue (and also, a long standing one). The discussion needs to be not just about the edge issue of the day. It needs to be about what forum, and what means can be used to enforce this integrity. Post-9/11 the ISP community has significantly more hammers in its arsenal now that it did in May 2000. Perhaps NANOG is not the right forum to discuss, but if not, what is? This is truly an operational threat to the whole community. Leadership needs to come from the largest providers, not just from the smallest. Today the threat is rogue data centres hosting spammers trying to game the system, tolerated by their up stream providers. Does this really need to be a hostile state or quasi-state actor deliberately threatening the infrastructure before serious coordinated action is taken? We really do know better. Eric Carroll

1 0