- Test - lists.nanog.org

attribution
by Randy Bush 17 Apr '20

17 Apr '20

Apr 12 17:57:42 r0.iad rpd[1752]: Prefix Send failed ! 103.148.41.0/24 bgp_rt_trace_too_big_message:1209 path attribute too big. Cannot build update. so some idiot is barfing out a ridiculous as_path. dear lazynet, is there an easy way to get attribution for this stupidity? i.e. the as_path. e.g. a nice query to ris or rv given the prefix, 103.148.41.0/24, and the uct time, Apr 12 17:57:42. randy

8 8

Re: UDP/123 policers & status
by Hal Murray 17 Apr '20

17 Apr '20

Steven Sommars said: > The secure time transfer of NTS was designed to avoid amplification attacks. I work on NTP software (ntpsec). I have a couple of low cost cloud servers in the pool where I can test things and collect data. I see bursts of 10K to several million packets "from" the same IP Address at 1K to 10K packets per second. Ballpark of 100 events per day, depending on the size cutoff. I saw one that lasted for most of a day at 1K packeets/sec. All the packets I've seen have been vanilla NTP requests - no attempt at amplification. I'm only checking a very small fraction of the garbage. I haven't seen any pattern in the target IP Address. Reverse DNS names that look like servers are rare. I see legitimate NTP requests from some of the targets. Would data be useful? If so, who, what, ... (poke me off list) I don't see any good solution that a NTP server can implement. If I block them all, the victim can't get time. If I let some fraction through, that just reduces the size of the DDoS. I don't see a fraction that lets enough through so the victim is likely to get a response to a legitimate request without also getting a big chunk of garbage. I'm currently using a fraction of 0. If the victim is using several servers, one server getting knocked out shouldn't be a big deal. (The pool mode of ntpd should drop that system and use DNS to get another.) If NTS is used, it would be possible to include the clients IP Address in the cookie and only respond to requests with cookies that were issued to the client. That has privacy/tracking complications. ---------- I don't want to start a flame war, but why isn't BCP 38 widely deployed? Can somebody give me a pointer to a talk at NANOG or such? What fraction of the world does implement BCP 38? I'd also be interested in general background info on DDoS. Who is DDoS-ing whom and/or why? Is this gamers trying to get an advantage on a competitor? Bad guys making a test run to see if the server can be used for a real run? Is DDoS software widely available on the dark web? ... -- These are my opinions. I hate spam.

6 29

BIRD / BGP-ORR experiences?
by Deepak Jain 16 Apr '20

16 Apr '20

Thinking about setting up BGP-ORR on some BIRD VMs (https://bird.network.cz) for lab purposes, I'm sure its more than sufficient. Does anyone use these in production? Any thoughts, experiences, caveats? Do we even like BGP ORR? Thanks in advance, Deepak

6 21

RE: Route aggregation w/o AS-Sets
by Jakob Heitz (jheitz) 15 Apr '20

15 Apr '20

Suppose you had a set of customers than all announced to you a set of routes and all those routes complete an aggregate and you announce only the aggregate to those customers and you include an AS_SET with it then those customers will drop your aggregate, thinking there is an AS-loop and those customers will not be able to reach each other. An AS_SET does not prevent routing loops and can prevent correct routing. But you must include the ATOMIC_AGGREGATE attribute, so that someone else does not disaggregate your aggregate that does not have the AS_SET. Regards, Jakob. -----Original Message----- Date: Tue, 14 Apr 2020 02:32:37 -0700 From: Matthew Petach <mpetach(a)netflight.com> I generally would use the atomic-aggregate knob to generate aggregate routes for blocks I controlled, when the downstream ASN information was not necessary to propagate outside my network (usually cases where I had multiple internal ASNs, but all connectivity funneled though a single upstream pathway.) If you have discrete downstream ASNs with potentially different external pathways, you shouldn't be generating aggregate routes that cover them; that's just bad routing 101. Thus, my rules for aggregation always came down to: 1) is there more than one external/upstream pathway for the ASN and prefix? If so, don't aggregate. 2) is redundant, reliable connectivity between all the external gateway routers that would be announcing the aggregate? If not, don't generate a covering aggregate. 3) If there's only a single upstream pathway through you for the ASN and prefix, and that won't be changing any time soon (eg, you have a collection of downstream datacenter with their own ASNs and prefixes, but they all route through a common backbone), then use the atomic-aggregate option to suppress the more specific AS_PATH information, and simply announce the space as a single aggregate coming from your backbone ASN. That way, there's no confusion with RPKI and AS_SETS; all you're ever announcing are simple AS_PATHs for a given prefix. Best of luck! Matt

2 2

Fastly.com security team
by Josh Luthman 15 Apr '20

15 Apr '20

Can someone from Fastly reach out to me? I believe you're blocking some of our IPs. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373

2 1

Route aggregation w/o AS-Sets
by Lars Prehn 15 Apr '20

15 Apr '20

Hi everyone, how exactly do you aggregate routes? When do you add the AS_SET attribute, when do you omit it? How does the latter interplay with RPKI? Best regards, Lars

6 7

Netflix Open Connect
by John Alcock 14 Apr '20

14 Apr '20

I figure Netflix is busy just like every other company during the pandemic. I sent a request several weeks ago for Netflix OCA. I have not heard anything. Anyone from Netflix contact me off list? I am in charge of AS395437 John

2 1

Re: Constant Abuse Reports / Borderline Spamming from RiskIQ
by Tom Beecher 14 Apr '20

14 Apr '20

Jonathan- First time posts to the list are , pardon the phrase, quarantined out of the gate. Once it's obvious that it's not spam or a problem individual, that gets released and future messages go straight out. This is still a manual process done by one person in the NANOG organization, so it's not always that fast. You likely just got caught up in that, and didn't do anything incorrectly. On Tue, Apr 14, 2020 at 4:25 AM Jonathan M <jonathan-m(a)riskiq.net> wrote: > My bad - This was not for Rich but for Kushal who initiated the thread > taking the survey about us being "spammers". I'm contacting the > administrator at Nanog.org now to figure out what I did wrong to properly > post to the thread as I haven't used the mailing list before. Have a good > day. Jonathan > > On Mon, Apr 13, 2020 at 9:55 PM Jonathan M <jonathan-m(a)riskiq.net> wrote: > >> This may not have been approved yet by the moderator but was sent to the >> list about 30 minutes ago....I'm sorry, but I'm just learning how to use >> this list and I am concerned that my post was not properly sent--thus, >> replying to the thread here....thx >> >> Re: https://twitter.com/RiskIQ_IRT/status/1249721818602070016?s=20 >> >> Hi, Rich, >> >> I hope you are well. If you ever encounter an incident that you think >> could have been handled better on our end, we aspire to continuously >> improve, and don't claim to be perfect. >> >> Rather than blocking our abuse notification to the abuse POC, it would be >> better to let us know you have concerns so that we can improve our >> communications. Blocking us on Twitter and shutting off communication is no >> better than if we were to just send your customer's domain to a blacklist >> without notifying you of a compromise so that it can possibly be patched. >> Let's keep the overall goal in mind -- it's to make the internet safer by >> flagging possible violations of your acceptable use policy that may lead to >> compromised personal data or sensitive credentials of innocent visitors >> online. >> >> Before anything is posted to Twitter, I personally review the history of >> the event to see if we have exhausted all reasonable steps to mitigate >> harmful cyber activity or operations on network infrastructure short of >> always picking up the phone or using the fax. While we have attempted to do >> that in the past for each event, there is just too much harmful cyber >> activity going on for us to be relying on phone calls to try and reach the >> abuse team to ask that our ticket be prioritised after an unreasonable >> period of time has elapsed. We have thousands of escalations that we need >> to handle and most of the time though not across the board, when we call to >> reach the abuse teams, we are unsuccessful in reducing the time to >> remediation. >> >> The goal is not to shame anyone per se. It's to create more transparency >> regarding a problem that we all need to work together on. It's similar to >> where nation state actors use public attribution as part of mitigation to >> improve the Internet from cyber attacks. We did not block you on Twitter, >> and after every tweet, we follow-up to the appropriate abuse point of >> contact to raise visibility of the matter, as well as to the PR team, and >> applicable computer emergency response teams as well as attorney generals >> or other applicable authorities. >> >> We all need to work together. Please do not hesitate to contact me and I >> will make sure we are meeting our end of aspiring to be a good partner, and >> look forward to working with you as the need arises. Stay safe and healthy >> in these challenging times, and we wish you the best. >> >> I'm happy to discuss offline as well. We can set up a time to discuss and >> improve the mitigation workflow on both sides. >> >> Best regards, >> Jonathan Matkowsky >> VP, Digital Risk >> RiskIQ, Inc. >> >> >> On Mon, Apr 13, 2020 at 9:41 PM Tom Beecher <beecher(a)beecher.cc> wrote: >> >>> I would agree that Twitter is not a primary place for abuse reporting. >>> >>> If they are reporting things via your correct abuse channel and you are >>> indeed handling them within 48 business hours, then I would also agree this >>> much extra spray and pray is excessive. However RiskIQ is known to be >>> pretty responsible, so if they are doing this they likely feel like they >>> are NOT getting appropriate responses from you and are resorting to >>> scorched earth. Have you attempted to reach out to them and make sure they >>> have the proper direct channel for abuse reporting? >>> >>> On Mon, Apr 13, 2020 at 1:45 PM Kushal R. <kushal.r(a)h4g.co> wrote: >>> >>>> All abuse reports that we receive are dealt within 48 business hours. >>>> As far as that tweet is concerned, it’s pending for 16 days because they >>>> have been blocked from sending us any emails due to the sheer amount of >>>> emails they started sending and then our live support chats. >>>> >>>> We send our abuse reports to, but we don’t spam them to every publicly >>>> available email address for an organisation, it isn’t difficult to lookup >>>> the Abuse POC for an IP or network and just because you do not get a >>>> response in 24 hours does not mean you forward the same report to 10 other >>>> email addresses. Similarly twitter isn’t a place to report abuse either. >>>> >>>> >>>> On Apr 13, 2020 at 9:37 PM, <Rich Kulawiec <rsk(a)gsp.org>> wrote: >>>> >>>> >>>> On Mon, Apr 13, 2020 at 07:55:37PM +0530, Kushal R. wrote: > We understand these reports and deal with them as per our policies and timelines but this constant spamming by them from various channels is not appreciated. Quoting from: https://twitter.com/RiskIQ_IRT/status/1249696689985740800 which is dated 9:15 AM 4/13/2020: 5 #phishing URLs on admin12.find-textbook[.]com were reported to @Host4Geeks (Walnut, CA) from as far back as 16 days ago, and they are all STILL active 16 days is unacceptable. If you can't do better than that -- MUCH better -- then shut down your entire operation today as it's unworthy of being any part of the Internet community. ---rsk >>>> >>>> >>>> > ******************************************************************* > This message was sent from RiskIQ, and is intended only for the designated > recipient(s). It may contain confidential or proprietary information and > may be subject to confidentiality protections. If you are not a designated > recipient, you may not review, copy or distribute this message. If you > receive this in error, please notify the sender by reply e-mail and delete > this message. Thank you. > > *******************************************************************

1 0

Re: Constant Abuse Reports / Borderline Spamming from RiskIQ
by Kushal R. 14 Apr '20

14 Apr '20

I’ll reaching out to you off list. > > On Apr 14, 2020 at 1:55 PM, <Jonathan M (mailto:jonathan-m@riskiq.net)> wrote: > > > > > My bad - This was not for Rich but for Kushal who initiated the thread taking the survey about us being "spammers". I'm contacting the administrator at Nanog.org now to figure out what I did wrong to properly post to the thread as I haven't used the mailing list before. Have a good day. Jonathan > > > > On Mon, Apr 13, 2020 at 9:55 PM Jonathan M <jonathan-m(a)riskiq.net (mailto:jonathan-m@riskiq.net)> wrote: > > > > > > > This may not have been approved yet by the moderator but was sent to the list about 30 minutes ago....I'm sorry, but I'm just learning how to use this list and I am concerned that my post was not properly sent--thus, replying to the thread here....thx > > > > > > Re: https://twitter.com/RiskIQ_IRT/status/1249721818602070016?s=20 > > > > > > Hi, Rich, > > > > > > > > I hope you are well. If you ever encounter an incident that you think could have been handled better on our end, we aspire to continuously improve, and don't claim to be perfect. > > > > > > > > Rather than blocking our abuse notification to the abuse POC, it would be better to let us know you have concerns so that we can improve our communications. Blocking us on Twitter and shutting off communication is no better than if we were to just send your customer's domain to a blacklist without notifying you of a compromise so that it can possibly be patched. Let's keep the overall goal in mind -- it's to make the internet safer by flagging possible violations of your acceptable use policy that may lead to compromised personal data or sensitive credentials of innocent visitors online. > > > > > > > > Before anything is posted to Twitter, I personally review the history of the event to see if we have exhausted all reasonable steps to mitigate harmful cyber activity or operations on network infrastructure short of always picking up the phone or using the fax. While we have attempted to do that in the past for each event, there is just too much harmful cyber activity going on for us to be relying on phone calls to try and reach the abuse team to ask that our ticket be prioritised after an unreasonable period of time has elapsed. We have thousands of escalations that we need to handle and most of the time though not across the board, when we call to reach the abuse teams, we are unsuccessful in reducing the time to remediation. > > > > > > > > The goal is not to shame anyone per se. It's to create more transparency regarding a problem that we all need to work together on. It's similar to where nation state actors use public attribution as part of mitigation to improve the Internet from cyber attacks. We did not block you on Twitter, and after every tweet, we follow-up to the appropriate abuse point of contact to raise visibility of the matter, as well as to the PR team, and applicable computer emergency response teams as well as attorney generals or other applicable authorities. > > > > > > > > We all need to work together. Please do not hesitate to contact me and I will make sure we are meeting our end of aspiring to be a good partner, and look forward to working with you as the need arises. Stay safe and healthy in these challenging times, and we wish you the best. > > > > > > > > I'm happy to discuss offline as well. We can set up a time to discuss and improve the mitigation workflow on both sides. > > > > > > > > Best regards, > > > > Jonathan Matkowsky > > > > VP, Digital Risk > > > > RiskIQ, Inc. > > > > > > > > > > > > > > > > On Mon, Apr 13, 2020 at 9:41 PM Tom Beecher <beecher(a)beecher.cc> wrote: > > > > > > > > I would agree that Twitter is not a primary place for abuse reporting. > > > > > > > > > If they are reporting things via your correct abuse channel and you are indeed handling them within 48 business hours, then I would also agree this much extra spray and pray is excessive. However RiskIQ is known to be pretty responsible, so if they are doing this they likely feel like they are NOT getting appropriate responses from you and are resorting to scorched earth. Have you attempted to reach out to them and make sure they have the proper direct channel for abuse reporting? > > > > > > > > > > > > > > > On Mon, Apr 13, 2020 at 1:45 PM Kushal R. <kushal.r(a)h4g.co (mailto:kushal.r@h4g.co)> wrote: > > > > > > > > > > > > > > > > > > > > > > > All abuse reports that we receive are dealt within 48 business hours. As far as that tweet is concerned, it’s pending for 16 days because they have been blocked from sending us any emails due to the sheer amount of emails they started sending and then our live support chats. > > > > > > > > > > > > > > > > We send our abuse reports to, but we don’t spam them to every publicly available email address for an organisation, it isn’t difficult to lookup the Abuse POC for an IP or network and just because you do not get a response in 24 hours does not mean you forward the same report to 10 other email addresses. Similarly twitter isn’t a place to report abuse either. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On Apr 13, 2020 at 9:37 PM, <Rich Kulawiec (mailto:rsk@gsp.org)> wrote: > > > > > > > > > > > > > > > > > > > > On Mon, Apr 13, 2020 at 07:55:37PM +0530, Kushal R. wrote: > We understand these reports and deal with them as per our policies and timelines but this constant spamming by them from various channels is not appreciated. Quoting from: https://twitter.com/RiskIQ_IRT/status/1249696689985740800 which is dated 9:15 AM 4/13/2020: 5 #phishing URLs on admin12.find-textbook[.]com were reported to @Host4Geeks (Walnut, CA) from as far back as 16 days ago, and they are all STILL active 16 days is unacceptable. If you can't do better than that -- MUCH better -- then shut down your entire operation today as it's unworthy of being any part of the Internet community. ---rsk > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ******************************************************************* > This message was sent from RiskIQ, and is intended only for the designated recipient(s). It may contain confidential or proprietary information and may be subject to confidentiality protections. If you are not a designated recipient, you may not review, copy or distribute this message. If you receive this in error, please notify the sender by reply e-mail and delete this message. Thank you. > > > > ******************************************************************* >

1 0

Any Zayo peeps on the list?
by Mike Lyon 14 Apr '20

14 Apr '20

Howdy! Any Zayo peeps on the list? Seeing some packet loss on your network and your NCC seems to be clueless. Please shoot me an email offlist. Thank You, Mike

3 2