- Test - lists.nanog.org

Re: DDoS attack
by Christopher Morrow 09 Dec '19

09 Dec '19

On Mon, Dec 9, 2019 at 3:42 PM Michael Sherlock <michael.sherlock(a)hrins.net> wrote: > > Cristopher, > > Ip addresses that are not currently in use, and IP addresses that is currently used for CGNAT for end users > I'm 100% sure that those words mean something to you.. but not operating your network they don't mean anything to me. > > Regards, > > Michael Sherlock > Mobile: +44 75070 92392 > > Sent from my iPhone > > On Dec 9, 2019, at 8:36 PM, "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> wrote: > > > > Begin forwarded message: > > From: Christopher Morrow <morrowc.lists(a)gmail.com> > Subject: Re: DDoS attack > Date: December 9, 2019 at 11:11:31 PM GMT+3 > To: "ahmed.dalaali(a)hrins.net" <ahmed.dalaali(a)hrins.net> > Cc: nanog list <nanog(a)nanog.org> > > I'd note that: "what prefixes?" isn't answered here... like: "what is > the thing on your network which is being attacked?" > > On Mon, Dec 9, 2019 at 3:08 PM ahmed.dalaali(a)hrins.net > <ahmed.dalaali(a)hrins.net> wrote: > > > Dear All, > > My network is being flooded with UDP packets, Denial of Service attack, soucing from Cloud flare and Google IP Addresses, with 200-300 mbps minimum traffic, the destination in my network are IP prefixes that is currnetly not used but still getting traffic with high volume. > The traffic is being generated with high intervals between 10-30 Minutes for each time, maxing to 800 mbps > When reached out cloudflare support, they mentioned that there services are running on Nat so they can’t pin out which server is attacking based on ip address alone, as a single IP has more than 5000 server behind it, providing 1 source IP and UDP source port, didn’t help either > Any suggestions? > > Regards, > Ahmed Dala Ali > >

1 0

packet loss on AT&T in the L.A. area
by Francois Lecavalier 09 Dec '19

09 Dec '19

Anybody else is experiencing packet loss since last Tuesday across the AT&T network in the L.A. area? I'm seeing it coming from both Zayo and HE 8. ae2.cs1.lga5.us.zip.zayo.com 0.0% 153 17.8 19.7 17.6 48.4 4.6 9. ae18.ter1.lga5.us.zip.zayo.com 0.0% 153 17.8 17.7 17.5 18.3 0.0 10. 192.205.36.105 10.5% 153 22.3 21.3 19.3 25.0 1.0 11. cr1.n54ny.ip.att.net 1.3% 153 76.5 75.5 73.1 80.7 1.6 12. cgcil22crs.ip.att.net 5.9% 153 75.1 76.1 72.6 80.7 2.0 13. cgcil21crs.ip.att.net 3.9% 153 76.9 76.4 72.0 83.9 2.3 14. dvmco22crs.ip.att.net 3.9% 153 73.9 76.4 72.4 81.1 2.3 15. slkut21crs.ip.att.net 5.9% 153 74.2 76.8 72.9 84.7 2.3 16. la2ca21crs.ip.att.net 4.6% 153 76.7 76.7 72.6 82.6 2.1 17. gar20.la2ca.ip.att.net 8.5% 153 73.6 73.3 72.1 75.7 0.5 4. 12.87.252.89 0.0% 338 1.9 1.8 1.6 3.6 0.2 5. cr1.la2ca.ip.att.net 0.0% 338 2.7 3.5 1.5 6.7 1.0 cr84.la2ca.ip.att.net 6. ggr2.la2ca.ip.att.net 0.0% 338 4.8 3.5 1.6 5.6 1.0 ggr2.la2ca.ip.att.net 7. ae7.mpr1.lax12.us.zip.zayo.com 5.6% 338 73.1 74.2 72.0 133.8 4.4 8. ae13.cs1.lax112.us.eth.zayo.com 8.6% 338 83.7 89.1 72.9 116.7 7.9 This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately. Ce courrier ?lectronique est confidentiel et prot?g?. L'exp?diteur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) d?sign?(s) est interdite. Si vous recevez ce courrier ?lectronique par erreur, veuillez m'en aviser imm?diatement, par retour de courrier ?lectronique ou par un autre moyen.

1 0

Elephant in the room - Akamai
by Kaiser, Erich 09 Dec '19

09 Dec '19

Lets talk Akamai They have shifted 90% of their traffic off IXs and onto our full route DIA, anyone else seeing this issue or have insight as to what is going on over there? We have been asking for help on resolution for weeks and all we get is we are working on it and now we get no response. We were even sent an LOA and when the DC went to go put in the x-connect their patch panel was full. How do they not know if they have ports open or not? I have even reached out to an engineer who is on this list and he does not even respond. The last two nights the traffic levels to them has skyrocketed as well. Any insight? Erich Kaiser The Fusion Network

27 45

Spoofer Report for NANOG for Nov 2019
by CAIDA Spoofer Project 08 Dec '19

08 Dec '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Nov 2019: ASN Name Fixed-By 8047 GCI 2019-11-20 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Nov 2019: ASN Name First-Spoofed Last-Spoofed 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-11-29 6128 CABLE-NET-1 2016-09-03 2019-11-28 7459 GRANDECOM-AS1 2016-09-26 2019-11-06 20412 CLARITY-TELECOM 2016-09-30 2019-11-29 6181 FUSE-NET 2016-10-10 2019-11-30 25787 ROWE-NETWORKS 2016-10-21 2019-11-11 174 COGENT-174 2016-10-21 2019-11-26 32440 LONI 2016-11-03 2019-11-29 12083 WOW-INTERNET 2016-11-09 2019-11-30 18451 LESNET 2017-02-22 2019-11-05 701 UUNET 2017-06-14 2019-11-23 63296 AMARILLO-WIRELESS 2017-09-01 2019-11-26 546 PARSONS-PGS-1 2017-11-20 2019-11-25 11827 WSU 2018-05-07 2019-11-29 393564 SPOKANE 2018-06-05 2019-11-19 225 VIRGINIA 2018-06-18 2019-11-20 33452 RW 2018-09-19 2019-11-27 20448 VPNTRANET-LLC 2018-09-20 2019-11-11 63275 RADIOWIRE 2019-02-07 2019-11-05 8047 GCI 2019-04-11 2019-11-26 10745 ARIN-ASH-CHA 2019-04-29 2019-11-15 20381 CABLELABS-LV 2019-05-01 2019-11-01 46300 HSC-WAP 2019-10-30 2019-11-28 53424 PUREPAGES 2019-11-05 2019-11-05 2886 EC-813-2886 2019-11-05 2019-11-29 26827 EPBTELECOM 2019-11-07 2019-11-07 54646 HARDYNET 2019-11-10 2019-11-10 11293 UCOP-ASN 2019-11-23 2019-11-23 53641 TOMALESBAYLAN 2019-11-29 2019-11-29 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Puerto Rico IX (operational)
by Mehmet Akcin 08 Dec '19

08 Dec '19

Hey there, Puerto Rico IX , famously known as PRIX , is now operational. You can visit www.puertoricoix.net to see sites you can connect to PRIX, members and join Ix mailing list. There are no fees to join the IX. We hope to keep this, this way until there is enough interest to form a non profit org. I would like to thank once again Aeronet, Arista and Cloudsmash for their donations of equipment , time and energy! Now, we are looking for those who want to deploy 1-2RU caching boxes anything from DNS to Content. We are working on more stats/looking glass, etc soon! Mehmet -- Mehmet +1-424-298-1903

3 6

network billing software
by Mehmet Akcin 08 Dec '19

08 Dec '19

hi there, as a small isp network billing is done right is quite important. I do not want to reinvent the wheel though. I have been using librenms and I do think I need a tool that can be more automated and more turn-key. I have looked into cacti, and also Ubersmith. I wanted to check in here and ask what people are using to see if I can find something more commonly known. I would like as much as automation possible (auto email of the bill, etc.) and if it can integrate with quickbooks even better. 95th percentile billing is a must. let me know what your recommendations are. mehmet

1 0

virginia beach
by Mehmet Akcin 07 Dec '19

07 Dec '19

hey there, we've put together a blog post about Virginia beach developments and how it can reshape some of the ways we have been designing our networks. https://www.infrapedia.com/post/virginia-beach-a-new-hub-is-born I would love to hear some feedback about this, feel free to contact me offlist. Mehmet

5 12

Arista Switch Suggestion
by Mike Hammett 07 Dec '19

07 Dec '19

I asked over at https://puck.nether.net/mailman/listinfo/arista-nsp a couple weeks ago, but didn't get an answer, so I have moved to a larger group. I understand that some Arista switches will expose each VLAN in SNMP so I can monitor traffic on a VLAN independently of over VLANs on that same physical interface. Some of them don't. Which ones do? I prefer a solid used switch. 10G ports are fine. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

3 6

Anyone have contacts at Bharti Airtel?
by Bottiger 07 Dec '19

07 Dec '19

Does anyone have any contacts at Bharti Airtel? I either get no response or full inbox for emails in their WHOIS at AS9498 and AS24560.

4 3

Questions about satellite phones + satellite Internet
by Yosem Companys 06 Dec '19

06 Dec '19

Hey All, I'm new to the world of satellite phones + satellite Internet. I can't find an informative guide that will help me figure out the best options. Anyone know where I could find such information? Based on my exhaustive search, it seems the best generally speaking are Iridium and ViaSat, respectively. (For Iridium, that assumes one has line of sight.) But would it be best to do both or get Iridium Go only and use one's cell phone via a satellite link or have a dedicated satellite phone? More important, how can one assess whether one's geographic location is ideally suited for one service vis-a-vis the other? For perspective, I live on the Silicon Valley Coastside (i.e., Half Moon Bay). Comcast and AT&T rely on PG&E's transmission cables for Internet access. As such, whenever a power shutdown occurs, many of us on the Coastside are left without cable or Internet access. I shudder to think what would happen during the Big One. Even when there are no power shutoffs, however, Comcast appears to throttle our community on a regular basis. As such, I'm thinking about getting a combo of satellite phone and/or satellite Internet both to improve my Internet service and to maintain communication during an anthropogenic or natural disaster. Any suggestions? Thanks, Yosem

2 1