- Test - lists.nanog.org

Reflection DDoS last week (was: syn flood attacks from NL-based netblocks)
by Töma Gavrichenkov 28 Aug '19

28 Aug '19

Peace, Here's to confirm that the pattern reported before in NANOG was indeed a reflection DDoS attack. On Sunday, it also hit our customer, here's the report: https://www.prnewswire.com/news-releases/root-cause-analysis-and-incident-r… tl;dr: basically that was a rather massive reflected SYN/ACK carpet bombing against several datacenter prefixes (no particular target was identified). -- Töma On Sat, Aug 17, 2019, 1:06 AM Jim Shankland <nanog(a)shankland.org> wrote: > Greetings, > > I'm seeing slow-motion (a few per second, per IP/port pair) syn flood > attacks ostensibly originating from 3 NL-based IP blocks: 88.208.0.0/18 > , 5.11.80.0/21, and 78.140.128.0/18 ("ostensibly" because ... syn flood, > and BCP 38 not yet fully adopted). > > Why is this syn flood different from all other syn floods? Well ... > > 1. Rate seems too slow to do any actual damage (is anybody really > bothered by a few bad SYN packets per second per service, at this > point?); but > > 2. IPs/port combinations with actual open services are being targeted > (I'm seeing ports 22, 443, and 53, just at a glance, to specific IPs > with those services running), implying somebody checked for open > services first; > > 3. I'm seeing this in at least 2 locations, to addresses in different, > completely unrelated ASes, implying it may be pretty widespread. > > Is anybody else seeing the same thing? Any thoughts on what's going on? > Or should I just be ignoring this and getting on with the weekend? > > Jim >

4 6

Looking for a Google contact (peering frustrations)
by Jon Sands 28 Aug '19

28 Aug '19

AS397031 here, located in Telehouse (7 Teleport). We picked up a port on NYIIX specifically to peer with google and cloudflare. We were doing around 6gbps inbound from google over the NYIIX for some time then without warning google withdrew routes from us, I'm guessing because too much bandwidth over an IIX and they prefer a private interconnect at that point. So we requested to peer with them via a PNI and were denied, saying they can't do that either as they're not located in any Telehouse buildings. So I'm left with no Google peering A 10gb wave from where we are to the nearest google peering point is basically the same cost as 10gbps from HE, so trying to figure out my best options here. Open to suggestions! Ideally we would love to peer with google again over NYIIX if possible. -- Jon Sands MFI Labs https://fohdeesha.com/

2 3

Facebook launches alerts for local first responders
by Sean Donelan 27 Aug '19

27 Aug '19

Facebook announced its new Local Alerts feature. Potential uses include storm warnings and advisories for extreme temperatures, evacuations, road closures, active shooter situations, bomb threats, missing person reports, water main breaks and more. The aim is to keep its users “safe and in-the-know.” https://www.washingtonpost.com/weather/2019/08/27/facebook-launching-local-… The Facebook Local Alerts appears to be a closed, walled-garden system, requiring local emergency managers to setup and maintain Facebook accounts. Emergency managers have used multiple social media platforms for several years, but its always a bit hit&miss reaching the public using different platforms. Smart assistants like Alexia, Google Assistant, Apple Siri or streaming services like Netflix and Hulu don't don't proactively provide local emergency alerts like Cable, TV and radio broadcasters. If you need to ask Alexa if there is a tornado warning, you probably already know there is a tornado.

1 0

IP Route Hijacking Bad Actor: AS57129/RU-SERVERSGET-KRSK, RU/Optibit LLC
by Paul Ferguson 27 Aug '19

27 Aug '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Howdy, I'm soliciting any background information, anecdotes, shared experiences, previous evidence, etc. of bad behavior and/or IP route hijacking for this 'hijack factory', as I've heard it called privately. They are actively -- and illegitimately -- announcing prefixes which are (legitimately) allocated to other organizations, a couple of them are very large & well-known U.S. healthcare providers. I'd also be interesting in hearing suggestion on the course of action one of these organizations might take to make this stop.... Thanks in advance, - - ferg - -- Paul Ferguson Seattle, WA USA -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAl1i4CEACgkQKJasdVTchbJVHAEA0s7Ej73VPQth2Rho4xwTnv8e qQFJ6SB+qulM1HFHoUgA/RXAL1BFJC3wq9GsXYJ4sqLSrje/gPm1JzVMeEJMTGlQ =r3mY -----END PGP SIGNATURE-----

2 1

SLA language about monitoring route leaks and inter-connection issues
by Sean Donelan 26 Aug '19

26 Aug '19

Do any major ISPs have SLA language about monitoring inter-provider agreements for route hijacking, route leaks, address spoofing, and so on? I'm looking for something more proactive than waiting for a customer to notice a problem and open a trouble ticket.

3 3

DNS cache hold of SERVFAIL responses
by Stephen Satchell 26 Aug '19

26 Aug '19

This is for any Google admin on this list: When you receive a SERVFAIL from a name server listed as authoritative for a given domain, how long is that negative look-up cached? When you receive a SERVFAIL from the root servers, how long is that negative lookup cached? Does Google follow RFC 2308? Is there a common cache for all resolvers, or do each resolver in your DNS server corps maintain a local cache? When a SOA (when you see one) says 14400 for the minimum TTL (or negative cache TTL) does Google honor that hold time?

1 0

report domains found in malware distrabution
by james jones 25 Aug '19

25 Aug '19

just quick question: is the abuse emails still best way to report domains that are being used in malware scripts? or is there a more central place to report such things? -James

3 2

Asset management recommendations
by Mehmet Akcin 24 Aug '19

24 Aug '19

Hey there I am looking for a tool recommendation for network and server asset management which can scale in multiple sites and integrate with other platforms like nagios, librenms. Being able to do patch management is plus. Mostly linux and juniper shop Any recommendations? -- Mehmet +1-424-298-1903

6 6

Re: Tiered operations support
by Clayton Zekelman 23 Aug '19

23 Aug '19

Find a new job. At 02:40 PM 23/08/2019, harbor235 wrote: >Hi noggers, > >First some background; > >I have inherited a real-time services delivery >infrastructure that while technically functional >is absent of a wworking tiered operational >support structure. In addition, the >infrastructure was not implemented with >technology best practices and has some remaining >single points of failure. T3/engineering handles >engineering, operational support, testing, and >development. T1 and T2 perform some tasks but >not what is expected of a traditional support >structure, As we are attempting to scale our >program our limitations are obvious. > >We are trying to scale the program and need to >remedy all single points of failure and >implement technical and management best >practices. While we try to remedy all of the >above, our customer expects routine capability enhancements. > >Question(s) >1) how to pivot to a tiered operational support >structure and set expectations for each tier >level. How do I do that without having my entire staff leave? >Â Â Â Â Â Â Current staff is not a professional >organization and are used to a purely reactive state. > >2) ITIL process are great and we have started to >implement what makes sense but I need a >operational support stucture/model to support and manage this effort. > >3) How do you manage your engineering and >operational projects? Currently I am using Excel >for all projects short and long term and also >use a seperate spreadsheet for my short term >project sprints? Basic project tracking with no mature processes involve. > >How are you pulling this all together? > >I would like to hire key positions that can >bring essential capabilities to my project but I am limited hiring new staff. > >thoughts, suggestions > >Mike

4 3

Re: Tiered operations support
by Scott Weeks 23 Aug '19

23 Aug '19

--- harbor235(a)gmail.com wrote: How do I do that without having my entire staff leave? Current staff is not a professional organization and are used to a purely reactive state. ----------------------------------------------------- Maybe you want some of them to leave, if they're "not a professional organization". Get some fresh folks from professional minded organizations and see if the others quit being reactionary only and step up their game. scott

1 0