- Test - lists.nanog.org

Copyright Enforcement DoS/DDoS Attacks
by Brandon Galbraith 09 Sep '10

09 Sep '10

http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-… <http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-…>Has anyone dealt with this in the wild? I wasn't aware DoS/DDoS attacks were suddenly legal. -- Brandon Galbraith Voice: 630.492.0464

6 6

DS3 mux recommendation
by Jay Nakamura 09 Sep '10

09 Sep '10

I haven't researched stand alone DS3 mux in a long time and was wondering if anyone can recommend a DS3 Mux. I have used Adtran before. (Long ago) The products back then worked fine on line level but management interface was awful and if you threw too much SNMP at it and the management interface locked up. Are there anything better out there these days? TIA, -Jay

7 7

Anyone seeing problems with PCCW?
by Jared Geiger 09 Sep '10

09 Sep '10

I'm seeing routes die on PCCW's network both in Amsterdam and Washington DC with destinations to Asia (Hong Kong is mainly what I've tested). However the routes are fine from Los Angeles. Does anyone know of any fiber cuts or issues that would be causing this?

1 0

re: Cogent issues
by Nick Olsen 09 Sep '10

09 Sep '10

No Cogent issues here in Florida. Nick Olsen Network Operations (877) 804-3001 x106 ---------------------------------------- From: "Charles Mills" <w3yni1(a)gmail.com> Sent: Wednesday, September 08, 2010 10:35 PM To: "NANOG list" <nanog(a)nanog.org> Subject: Cogent issues Anyone notice any issues with Cogent? Internet Health Report showing some high latency to Verizon and a couple of other carriers.

1 0

Re: Copyright Enforcement DoS/DDoS Attacks
by khatfield＠socllc.net 09 Sep '10

09 Sep '10

No matter how they spin it, it isn't legal. Likely he won't be touched in India but in the U.S. he and the industry paying him would be facing a judge. The guy is a moron. Wanna be elitist. ------Original Message------ From: Michael Painter To: nanog(a)nanog.org Subject: Re: Copyright Enforcement DoS/DDoS Attacks Sent: Sep 9, 2010 12:13 AM Brandon Galbraith wrote: > http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-… > > <http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-…>Has > anyone dealt with this in the wild? I wasn't aware DoS/DDoS attacks were > suddenly legal. It's gotta' be tough reading that when you're in the slammer, eh? http://www.theregister.co.uk/2010/05/25/second_scientology_ddoser_jailed/

1 0

Speakeasy Contact
by Paul Norton 08 Sep '10

08 Sep '10

Someone from Speakeasy please contact me off-list. This is for business T-1 service. I've been seeing major packet loss on one of your peering nodes for a week now and am experiencing degraded service due to this. Support has been unable to resolve and has been unresponsive for the past 24 hours. Also, Account Manager has been non-responsive for 6 days now. -- Paul Norton Systems Administrator Neoverve -www.neoverve.com Neoverve Blog -http://blog.neoverve.com/

2 1

RE: NANOG Digest, Vol 32, Issue 25
by Scott Weeks 08 Sep '10

08 Sep '10

--- M.Hotze(a)hotze.com wrote: From: Martin Hotze <M.Hotze(a)hotze.com> I have a private website; I don't want the site to be listed or content found via a search engine. I want to be able to give the URL out to friends etc. but I don't want all of the world hotlink or whatever[...] -------------------------------------------------- Don't put links on the main page. Put up example.com with only <html> </html> or nothing even. Then your friends have to know to go to example.com/mypage.html but the web crawlers never know about mypage.html because there's no link on the top page. scott

1 0

RE: NOC Automation / Best Practices
by Martin Hotze 08 Sep '10

08 Sep '10

> -----Original Message----- > Date: Wed, 08 Sep 2010 08:54:20 -0700 > From: Charles N Wyble <charles(a)knownelement.com> > Subject: NOC Automation / Best Practices > To: nanog(a)nanog.org > > NOGGERS, > > (...) > The way I see it, an ounce of prevention is worth a pound of cure. > Along > those lines, I'm putting in some mitigation techniques are as follows > (hopefully this will reduce the number of incidents and therefore calls > to the abuse desk). I would appreciate any feedback folks can give me. > > A) Force any outbound mail through my SMTP server with AV/spam > filtering. > B) Force HTTP traffic through a SQUID proxy with SNORT/ClamAV running > (several other WISPs are doing this with fairly substantial bandwidth > savings. However I realize that many sites aren't cache friendly. > Anyone > know of a good way to check for that? Look at HTTP headers?). Do the > bandwidth savings/security checking outweigh the increased support > calls > due to "broken" web sites? > C) Force DNS to go through my server. I hope to reduce DNS hijacking > attacks this way. > > Thanks! For either A, B or C you won't get my business, let alone a combination of all 3. *wah!* There is too much FORCE here. :-) #m

5 4

yahoo crawlers hammering us
by Ken Chase 08 Sep '10

08 Sep '10

So i guess im new at internets as my colleagues told me because I havent gone around to 30-40 systems I control (minus customer self-managed gear) and installed a restrictive robots.txt everywhere to make the web less useful to everyone. Does that really mean that a big outfit like yahoo should be expected to download stuff at high speed off my customers servers? For varying values of 'high speed', ~500K/s (4Mbps+) for a 3 gig file is kinda... a bit harsh. Especially for an exe a user left exposed in a webdir, thats possibly (C) software and shouldnt have been there (now removed by customer, some kinda OS boot cd/toolset thingy). This makes it look like Yahoo is actually trafficking in pirated software, but that's kinda too funny to expect to be true, unless some yahoo tech decided to use that IP/server @yahoo for his nefarious activity, but there are better sites than my customer's box to get his 'juarez'. At any rate: >From Address To Address Proto Bytes CPS ============================================================================================================================================================================================== 67.196.xx.xx..80 67.195.112.151..44507 tcp 14872000 523000 $ host 67.195.112.151 8.8.8.8 151.112.195.67.in-addr.arpa domain name pointer b3091122.crawl.yahoo.net. CIDR: 67.195.0.0/16 NetName: A-YAHOO-US8 so that's yahoo, or really well spoofed. Is this expected/my own fault or what? A number of years ago, there were 1000s of videos on a customer site (training for elderly care, extremely exciting stuff for someone into -1-day movies to post on torrent sites). Customer called me to say his bw was gone, and I checked and found 12 yahoo crawlers hitting the site at 300K/s each (~30Mbps +) downloading all the videos. This was all the more injurious as it was only 2004 and bandwidth was more than $1/mbps back then. I did the really crass thing and nullrouted the whole /20 or whatever they were on per ARIN. It was the new-at-the-time video.yahoo.com search engine coming to index the whole site. I suppose they cant be too slow about it, or they'll never index a whole webfull of videos this century, but still, 12x 300K/s in 2004? (At the time Rasmus though it was kinda funny. I do too, now.) /kc -- Ken Chase - ken(a)heavycomputing.ca - +1 416 897 6284 - Toronto CANADA Heavy Computing - Clued bandwidth, colocation and managed linux VPS @151 Front St. W.

7 9

NOC Automation / Best Practices
by Charles N Wyble 08 Sep '10

08 Sep '10

NOGGERS, The recent thread on ISP port blocking practice mentioned a way to identify infected machines through a highly automated manner. This got me thinking about other ways to automate aspects of network/system operations when it comes to tier-1 end user support (is it plugged in/is your wireless working etc) and tier-2/3 NOC support (abuse desk/incident response/routing issues etc) . I'm putting in a very high degree of monitoring/healing in place to reduce the amount of end user support calls that come in, and only bother a human when it's a real issue. I'm in the process of launching a small regional wireless ISP / ad delivery network in Los Angeles CA. I have a small staff (I'm the only full time engineer, I have a couple NOC techs and 1 help desk tech who will provide escalation for any serious issues). My initial thoughts/questions on the matter: 1) Are people integrating their PBX with their OSS/CRM systems? So when a call comes in the tech has all the relevant information? (perhaps even things like traceroute/port scan/AV/security health status based on their phone number or customer number?). This way if I take a user offline because they are spewing spam/virii the tech can refer them to our IT support partner organization to clean up their PC. :) 2) What sort of automated alerting/reporting/circuit turn down/RADIUS lock out is done in regards to alerting customers or even taking them offline when they have a security issue? 3) What are folks doing in terms of frontline offloading? Do you have your PBX set to play a different recording when you have an outage so the NOC techs phones don't go crazy and leave them free to deal with the issue? 4) Your comments here. :) The way I see it, an ounce of prevention is worth a pound of cure. Along those lines, I'm putting in some mitigation techniques are as follows (hopefully this will reduce the number of incidents and therefore calls to the abuse desk). I would appreciate any feedback folks can give me. A) Force any outbound mail through my SMTP server with AV/spam filtering. B) Force HTTP traffic through a SQUID proxy with SNORT/ClamAV running (several other WISPs are doing this with fairly substantial bandwidth savings. However I realize that many sites aren't cache friendly. Anyone know of a good way to check for that? Look at HTTP headers?). Do the bandwidth savings/security checking outweigh the increased support calls due to "broken" web sites? C) Force DNS to go through my server. I hope to reduce DNS hijacking attacks this way. Thanks!

2 1