- Test - lists.nanog.org

Fwd: Sunday night social?
by Matthew Petach 12 Jun '16

12 Jun '16

> I just finished registering for NANOG 67, and answered Yes to "Will you be attending the sunday evening social" and booked my flight accordingly...but now i can't seem to find any details on what time it starts on the website. Does anyone know what time it starts? > > Thanks! > > Matt > >

6 8

phish platform ?
by Julien T 12 Jun '16

12 Jun '16

Hello, I'm reviewing the process how to manage phish report at a customer and am looking for tools ideally opensource. Recently, OVH released https://github.com/ovh/cerberus-ux and maybe AbuseHelper can do http://abusehelper.be/ I also checked APWG but didn't find reference to such a tool. Quick constraints: multiple types of input+garbage, metrics, API, SIEM integration Any advices of a public tool? or mostly in-house dev? Thanks a lot. Cheers, Jul

1 0

Netflix VPN detection - actual engineer needed
by Matthew Kaufman 12 Jun '16

12 Jun '16

Every device in my house is blocked from Netflix this evening due to their new "VPN blocker". My house is on my own IP space, and the outside of the NAT that the family devices are on is 198.202.199.254, announced by AS 11994. A simple ping from Netflix HQ in Los Gatos to my house should show that I'm no farther away than Santa Cruz, CA as microwaves fly. Unfortunately, when one calls Netflix support to talk about this, the only response is to say "call your ISP and have them turn off the VPN software they've added to your account". And they absolutely refuse to escalate. Even if you tell them that you are essentially your own ISP. So... where's the Netflix network engineer on the list who all of us can send these issues to directly? Matthew Kaufman

31 70

Detecting Attacks
by subashini hariharan 12 Jun '16

12 Jun '16

Hello, I am Subashini, a graduate student. I am interested in doing my project in Network Security. I have a doubt related to it. The aim is to detect DoS/DDoS attacks using the application. I am going to use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log Analytics). My doubt is regarding how do we generate logs for detecting this attack? As I am new to this process, I am not sure about it. Also, if it is possible to do any other attacks similar to this, you can please give a hint about it. Could anyone please help with this, it would be a great help!! -- Thank You. With Regards, H.Subashini

5 4

Detecting Attacks
by subashini hariharan 12 Jun '16

12 Jun '16

Hello, I am Subashini, a graduate student. I am interested in doing my project in Network Security. I have a doubt related to it. The aim is to detect DoS/DDoS attacks using the application. I am going to use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log Analytics). My doubt is regarding how do we generate logs for detecting this attack? As I am new to this process, I am not sure about it. Also, if it is possible to do any other attacks similar to this, you can please give a hint about it. Could anyone please help with this, it would be a great help!! -- Thank You. With Regards, H.Subashini

2 1

intra-AS messaging for route leak prevention
by Sriram, Kotikalapudi (Fed) 12 Jun '16

12 Jun '16

I am a co-author on a route-leak detection/mitigation/prevention draft in the IDR WG in the IETF: https://tools.ietf.org/html/draft-ietf-idr-route-leak-detection-mitigation-… Based on private conversations with a few major ISPs, the following common practice for intra-AS messaging (using Community tagging in iBGP) for prevention of route leaks is described in Section 3.2 of the draft: <begin quote> “Routes are tagged on ingress to an AS with communities for origin, including the type of eBGP peer it was learned from (customer, transit-provider or peer), geographic location, etc. The community attributes are carried across the AS with the routes. Routes that the AS originates directly are tagged with similar origin communities when they are redistributed into BGP from static, IGP, etc. These communities are used along with additional logic in route policies to determine which routes are to be announced to which eBGP peers and which are to be dropped. Route policy is applied to eBGP sessions based on what set of routes they should receive (transit, full routes, internal-only, default-only, etc.). In this process, the ISP's AS also ensures that routes learned from a transit-provider or a lateral peer (i.e. non-transit) at an ingress router are not leaked at an egress router to another transit-provider or peer. Additionally, in many cases, ISP network operators' outbound policies require explicit matches for expected communities before passing routes. This helps ensure that that if an update has made it into the routing table (i.e. RIB) but has missed its ingress community tagging (due to a missing/misapplied ingress policy), it will not be inadvertently leaked.” <end quote> Question: Are there other means of conveying this information in common use today (i.e. for prevention of route leaks)? Also, the following publicly available references can be possibly cited in support of the above: https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf http://showipbgp.com/bgp-tools/bgp-community-list/91-level3-as3356.html Pointers to any other relevant references would be very welcome as well. Thank you. Sriram

8 20

Re: Detecting Attacks
by alvin nanog 11 Jun '16

11 Jun '16

hi su.. On 06/10/16 at 10:39pm, subashini hariharan wrote: > I am Subashini, a graduate student. I am interested in doing my project in > Network Security. I have a doubt related to it. duh... too broad of a subject ... you'd need to be more specific about which of the hundred's of sub categories ... > The aim is to detect DoS/DDoS attacks using the application. good ... sorta specific but not ... > I am going to > use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log > Analytics). hummm, why that app and not the couple dozen other ways people are using to detect incoming and/or outgoing DDoS attacks if the "professor" says "use ELK" ... you have no ther choice ... if not, there's much better options to detect DDoS attacks ... ( tcpdump -nnvv ) ... if you cannot explain each line, you've got a DDoS problem > My doubt is regarding how do we generate logs for detecting this attack? As > I am new to this process, I am not sure about it. what's the doubt ?? if there is a doubt ... conduct and experiment and see if it confirms your expected result or explain why its different and do more experiments until "its all explained" and no more doubts > Also, if it is possible to do any other attacks similar to this, you can > please give a hint about it. several dozens other types of attacks similar to DDoS, which takes over a server or network offline including no-technical-skill required attacks > Could anyone please help with this, it would be a great help!! google/yahoo/bing is your assistant ready to give you ALL the answer's you need and ant ----------- side notes ... a) if you log all incoming packets ( attacks ), you have increased the effectiveness of ddos attacks since you have now gave them the power to fill up your disk, use your cpu, use your memory, use your time to review the logs, etc, etc all of that is bad bad stuff to have the DDoS attackers do to you b) for logs, etc, there are dozens of other apps that try to detect attacks ( splunk, snort, hundred other apps, including eyeballs ) why are some methodologies better than others ? c) detecting DDoS attacks is nice but, what's the point ?? you're still under attack ... and haven't resolved the issue kinda like cooking dinner but not eating it ... you're still starving d) every computer connected to the internet is under constant 24x7x365 attacks ... a good "ddos detector" will tell you how much traffic is legitimate and how much bandwidth is wasted by the attacks and which server and which ports they are attacking, etc etc script kiddies are already attacking your network ( the one you're using bnow ) .. it's a free and harmless DDoS attacks and you should be able to see what they are doing to you "now" if you cannot "see what" they are attacking, you've got a major problem e) if you want to generate some specific DDoS attacks .. use ping, nping, hping, nmap, etc to start .... that should keep you busy for the next year or few years do NOT ever send packets outside to computers you do not own, or some ominous looking folks might come looking for you f) if you want to detect DDoS attacks .... post process tcpdump's output magic pixie dust alvin # # DDoS-Simulator.net # DDoS-Mitigator.net #

1 0

RE: Netflix banning HE tunnels
by Scott Weeks 11 Jun '16

11 Jun '16

--- chuckchurch(a)gmail.com wrote: From: "Chuck Church" <chuckchurch(a)gmail.com> The true jerks who used HE to bypass geo-lockout probably changed to something else the next day. But we suffer still. The FCC or some other federal entity probably needs to step in. ------------------------------------------ Yeah, because the US federal government does such a great job fixing problems like this... scott

3 2

Akamai GeoIP
by Josh Reynolds 10 Jun '16

10 Jun '16

Can somebody from Akamai contact me offlist about a GeoIP location change for a block please? Thank you.

2 1

Maybe Telia issues?
by Jeff McAdams 10 Jun '16

10 Jun '16

Not quite sure whether this should go to outages, or here. I'm not confident that there actually *is* an outage of any sort...having a tough time characterizing it. I have an IPSec tunnel between 64.6.220.219 (upstreams Sprint, AT&T, and LeveL3/legacy TWTelecom) and 64.199.98.162 (upstream Windstream). Egress from 64.6.220.219 was going through Sprint until I turned that session down. traceroute to 64.199.98.162 (64.199.98.162), 30 hops max, 60 byte packets 1 1a-1-vlan11.int.appriss.com (10.10.35.1) 0.995 ms 0.965 ms 0.947 ms 2 lsces03-e-1-13.office.appriss.com (10.9.3.45) 0.283 ms 0.344 ms 0.421 ms 3 lscorpfw01a-ge2-0-0-0.int.appriss.com (64.6.219.41) 0.275 ms 0.299 ms 0.272 ms 4 clinetedge01-ge-0-3-0-0.appriss.net (64.6.221.157) 0.731 ms 0.762 ms 0.752 ms 5 sl-gw10-nsh-0-1-0-0-si204.sprintlink.net (144.228.97.29) 45.753 ms 45.782 ms 45.772 ms 6 144.232.11.73 (144.232.11.73) 44.496 ms 44.321 ms 44.296 ms 7 144.232.5.212 (144.232.5.212) 46.955 ms 45.695 ms 46.958 ms 8 144.232.2.225 (144.232.2.225) 42.132 ms 144.232.15.111 (144.232.15.111) 41.922 ms 144.232.10.218 (144.232.10.218) 41.928 ms 9 atl-bb1-link.telia.net (62.115.49.157) 42.872 ms 42.863 ms 42.955 ms 10 * * * 11 * * * traceroute from the 64.199.98.162 side back towards 64.6.220.219: Type escape sequence to abort. Tracing the route to 64.6.220.219 1 64.199.98.161 0 msec 10 msec 0 msec 2 205.147.221.153 0 msec 10 msec 0 msec 3 40.128.249.156 10 msec 0 msec 0 msec 4 40.136.117.74 0 msec 0 msec 10 msec 5 40.128.10.138 10 msec 20 msec 40.128.248.62 10 msec 6 40.128.10.150 10 msec 40.128.10.146 10 msec 40.128.10.150 10 msec 7 80.239.194.41 20 msec 10 msec 10 msec 8 213.248.87.254 10 msec 10 msec 30 msec 9 12.122.133.34 20 msec 20 msec 20 msec 10 12.122.152.137 20 msec 20 msec 20 msec 11 12.122.152.209 50 msec 20 msec 20 msec 12 12.118.107.122 40 msec 40 msec 40 msec 13 170.75.217.4 50 msec 40 msec 50 msec 14 * * * 15 * * * (the 170.75.217.4 is my edge facing AT&T) When I shut down my BGP session to Sprint, my traffic shifted to AT&T and the tunnel came up. Anyone else seeing any issues around this area (I know, pretty vague), seemingly specifically related to interconnections between Sprint, Telia, and Windstream? I know Telia experienced some issues yesterday that were apparently resolved, maybe some lingering issues resulting from that? Shot in the dark, here. -- Jeff

1 0