- Test - lists.nanog.org

Honeypot type services from cloud flare or other security groups?
by Brielle 11 Mar '20

11 Mar '20

Hi all, Sorry for formatting errors, on my iPad while I have this thought in my mind. Does anyone know if any of the security groups or CDNs like Cloudflare have honeypots out there that can be used for analysis of unusual attacks? As in, change the DNS temp for a host and let the honey pot take the brunt of it and hopefully get useful data (even for the benefit of the security company). Got a situation where I’ve got an abnormally high amount of legit looking GET requests to a HTTPS git server, but are too high amount to actually be legit end users or people cloning the repos. The sources are worldwide, distributed, but with the bulk coming from China, Russia, Brazil, and Egypt. I have some theories and observations that I’d be open to sharing, but preferably not on an open mailing list until I’ve had a change to have them reviewed by someone with more experience and background. Thx! Sent from my iPad

2 2

Re: Anyone from EDGECASTCDN / Verizon Media on the list?
by Dmitry Sherman 11 Mar '20

11 Mar '20

Hello Chriztoffer thanks for following up! Yes, thanks, we resolved the issue. Best regards, Dmitry Sherman Interhost Networks [X] On 11 Mar 2020, at 18:54, Chriztoffer Hansen <chriztoffer.hansen(a)de-cix.net> wrote: Hello Dmitry Sherman, Did your attempt at getting in touch with EDGECASTCDN / Verizon Media succeed? Best regards, Chriztoffer -- Chriztoffer Hansen Network Service Engineer ------------------------------ DE-CIX Management GmbH Lindleystr. 12, 60314 Frankfurt (Germany) phone: +49 69 1730902 11 fax: +49 69 4056 2716 e-mail: support(a)de-cix.net web: www.de-cix.net ------------------------------ DE-CIX Management GmbH Executive Directors: Harald A. Summa and Sebastian Seifert Trade registry: District court (Amtsgericht) Cologne, HRB 51135 Registered office: Lichtstr. 43i, 50825 Cologne | -----Ursprüngliche Nachricht----- | Von: NANOG <nanog-bounces(a)nanog.org> Im Auftrag von Dmitry Sherman | Gesendet: lørdag den 7. marts 2020 13:31 | An: NANOG list <nanog(a)nanog.org> | Betreff: Anyone from EDGECASTCDN / Verizon Media on the list? | | Hello, | Anyone from EDGECASTCDN / Verizon Media on the list? | We are facing network reachability issues from EDGECASTCDN to our | network. Please contact off-list if possible. | | Thanks. | | -- | Dmitry Sherman | Interhost Networks Ltd |

1 0

Any Singtel AU APAC observed
by Van Dyk, Donovan 11 Mar '20

11 Mar '20

Hi all, Over the past two weeks we have been noticed a lot of transit issues with packet loss for all our carriers connections into singtel APAC going to Australia specifically. Anyone aware of any congestion issues going on? If anyone has a Singtel contact to forward that would be awesome aswell. Thanks -- Donovan Van Dyk Platform Operations Engineer, Senior Fort Lauderdale, FL USA [signature_465954491] The information contained in this electronic mail transmission and its attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient (or an individual responsible for delivery of the message to such person), you are strictly prohibited from copying, disseminating or distributing this communication. If you have received this communication in error, please notify the sender immediately and destroy all electronic, paper or other versions.

1 0

Spectrum Network Engineer (Legacy TWC/RR) ?
by Gabriel Kuri 11 Mar '20

11 Mar '20

Any Spectrum/Legacy TWC engineers on the list that could contact me off list in regards to a network issue in the Los Angeles area that first tier support is clueless about and unwilling to escalate? To quickly summarize, it appears port 5060 (SIP traffic) is blocked at very specific nodes within the Los Angeles area. Yes, SIP ALG is turned off in the router and cable modem, Techs have been out multiple times to put in different cable modems to no avail. Swapping the same location over to a fiber or DSL connection with an alternate provider makes the issue go away. It feels like there is a piece of equipment beyond the cable modem that is either mangling or blocking SIP traffic. The issue is not everywhere in the Los Angeles area on Spectrum/TWC, only a few sites from what we've seen. I can provide specifics if someone would kindly contact me off list. We'd like to get this resolved and first tier support says they have no way to escalate. Thanks ...

1 0

akamai yesterday - what in the world was that
by Aaron Gould 11 Mar '20

11 Mar '20

My gosh, what in the word was that coming out of my local Akamai aanp servers yesterday !? starting at about 12:00 noon central time lasting several hours ? -Aaron

73 180

Chairman Pai Proposes Mandating STIR/SHAKEN To Combat Robocalls
by Sean Donelan 10 Mar '20

10 Mar '20

https://www.fcc.gov/document/chairman-pai-proposes-mandating-stirshaken-com… Federal Communications Commission Chairman Ajit Pai today proposed a major step forward to further the FCC’s efforts to protect consumers against spoofed robocalls: new rules requiring implementation of caller ID authentication using socalled “STIR/SHAKEN” technological standards. STIR/SHAKEN enables phone companies to verify the accuracy of caller ID information that is transmitted with a call. Industry-wide implementation would reduce the effectiveness of illegal spoofing, allow law enforcement to identify bad actors more easily, and help phone companies identify calls with illegally spoofed caller ID information before those calls reach their subscribers. The FCC will vote on these new rules during its Open Meeting on March 31.

17 33

GTT Contact
by Nikolas Geyer 09 Mar '20

09 Mar '20

Hello. Can someone on list from GTT contact me? You are advertising prefixes that do not belong to you and have no authority to do so. Have spent weeks with INOC including a “tier 2” escalation with no resolution. Thanks, Nik.

2 1

Hi-Rise Building Fiber Suggestions
by Norman Jester 09 Mar '20

09 Mar '20

I’m in the process of choosing hardware for a 30 story building. If anyone has experience with this I’d appreciate any tips. There are two fiber pairs running up the building riser. I need to put a POE switch on each floor using this fiber. The idea is to cut the fiber at each floor and insert a switch and daisy chain the switches together using one pair, and using the other pair as the failover side of the ring going back to the source so if one device fails it doesn’t take the whole string down. The problem here is how many switches can be strung together and I would not try more than 3 to 5. This is not something I typically do (stacking switches). I have fears of STP and/or RSTP issue stacking past Ethernet switch to switch limits (if they still exist??) Is there a device with a similar protocol as the old 3com (now HP IDF) stacking capability via fiber? I’d like to use something inexpensive as its to power ubiquiti wifi on each floor. Ideally if you know something I don’t about ubiquiti switches that can do this I’d appreciate knowing. Norman

24 44

Spoofer Report for NANOG for Feb 2020
by CAIDA Spoofer Project 08 Mar '20

08 Mar '20

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Feb 2020: ASN Name Fixed-By 2152 CSUNET-NW 2020-02-11 19624 SERVERROOM 2020-02-19 2886 CL-260-2886 2020-02-26 701 UUNET 2020-02-29 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Feb 2020: ASN Name First-Spoofed Last-Spoofed 19230 NANOG 2016-06-13 2020-02-12 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2020-02-29 6128 CABLE-NET-1 2016-09-03 2020-02-29 27364 ACS-INTERNET 2016-09-27 2020-02-24 20412 CLARITY-TELECOM 2016-09-30 2020-02-25 6181 FUSE-NET 2016-10-10 2020-02-29 11427 SCRR-11427 2016-10-21 2020-02-09 174 COGENT-174 2016-10-21 2020-02-29 32440 LONI 2016-11-03 2020-02-29 12083 WOW-INTERNET 2016-11-09 2020-02-29 39939 RISE-CO-AS39939 2016-11-11 2020-02-24 2828 XO-AS15 2016-11-21 2020-02-20 9009 M247 2017-01-10 2020-02-22 18451 LESNET 2017-02-22 2020-02-19 63296 AMARILLO-WIRELESS 2017-09-01 2020-02-25 546 PARSONS-PGS-1 2017-11-20 2020-02-26 12222 AKAMAI 2018-02-14 2020-02-07 11827 WSU 2018-05-07 2020-02-15 393564 SPOKANE 2018-06-05 2020-02-25 20448 VPNTRANET-LLC 2018-09-20 2020-02-18 63275 RADIOWIRE 2019-02-07 2020-02-08 8047 GCI 2019-04-11 2020-02-26 46573 AS-GLobalf 2019-05-16 2020-02-16 46300 HSC-WAP 2019-10-30 2020-02-27 2886 CL-260-2886 2019-11-05 2020-02-28 12231 CONWAYCORP 2020-01-10 2020-02-25 239 UTORONTO 2020-01-28 2020-02-26 21949 BEANFIELD 2020-02-04 2020-02-04 395823 DOOF 2020-02-06 2020-02-06 46208 PFNL-ASN 2020-02-13 2020-02-13 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Re: a bit off-topic: ManTra'20 CFP
by Amir Herzberg 08 Mar '20

08 Mar '20

The first ACM SIGCOMM Workshop on Traffic Manipulation (ManTra’20) will be co-located with the ACM SIGCOMM conference and will be held at Columbia University, New York City, USA, Aug. 10-14, 2020 . I think it may be of interest to some of the NANOG community, to participate and/or submit; you may see some familiar (academic, mostly) names in the PC. There is not much time until the submission deadline of April 10. URL: https://conferences.sigcomm.org/sigcomm/2020/workshop-mantra.html Cheers, Amir Herzberg Comcast professor of Security Innovations, University of Connecticut Homepage: https://sites.google.com/site/amirherzberg/home Foundations of Cyber-Security (part I: applied crypto, part II: network-security): https://www.researchgate.net/project/Foundations-of-Cyber-Security

1 0