- Test - lists.nanog.org

Re: Ransom DDoS attack - need help!
by Joe Morgan 10 Dec '15

10 Dec '15

Just an update for those following. We have custom in house software that watches the traffic flows from our edge routers and automatically blackholes any ip getting targeted. The blackhole gets sent upstream which is what we did to maintain the network for our customers during the first attack. We did not suffer any network outage because of the attacks other than our public facing website which honestly is not critical. Since we submitted this thread originally we have gotten two responses from "Armada Collective". One basically a reminder telling us we had 24 hours left to pay. The next came tonight as they were supposed to be hitting us. The second response said they were supposed to be hitting us but decided to give us two more days to get the cash into bitcoin. As of right now we have not replied to them and have no plans to do so. We never had plans to respond or pay them, although telling them whats on my mind sounds appealing. We have contacted the FBI and are working with them providing info. As for protecting our network from future attacks we put all public facing web sites behind Cloudflare and changed the ips from what they were. We left the old ips nulled at our edge and with our providers. We plan to null any ip they decide to hit and and wait it out. As of right now all they have done is take our website offline briefly so not much of a problems as it has not caused our customers issues. Thanks for all the help and info that has been provided and we plan to update this thread as things unfold. I know there are others that have had similar demands (several have reached out off list.) so hopefully the info is useful. -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615

3 2

Re: Ransom DDoS attack - need help!
by Anne Mitchell 10 Dec '15

10 Dec '15

Last year when this happened to several large providers, it was a cluster all around the same time, and it turned out that it was the same org hitting all of them. This quickly came to light as we (ISIPP) started coordinating with the targets, because the attacker was using the same gmail address for communicating with each target. We had a preservation demand served on Google (so they wouldn't delete the gmail account when the complaints started happening), and the Feds were quickly involved. In fact, the Basecamp group that I mentioned came out of that effort. It seems that several of you here are now experiencing a similar ransom DDoS, all that the same time, so I would be very curious to know if this is similar - are the demands all coming from the same individual/email address? I'd very much like to know. Can each of you who is on the receiving end of this please send me the email address associated with the demands? (I'm on digest here, so even if you post it here, *please* also cc: me). Anne Anne P. Mitchell, Attorney at Law CEO/President, Institute for Social Internet Public Policy Member, Cal. Bar Cyberspace Law Committee Member, Colorado Cyber Committee Member, Asilomar Microcomputer Workshop Committee Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law) Ret. Professor of Law, Lincoln Law School of San Jose Ret. Chair, Asilomar Microcomputer Workshop

1 0

KP, North Korea disappears
by Randy Bush 10 Dec '15

10 Dec '15

https://stat.ripe.net/KP#tabId=routing KP's one asn and four prefixes go off net about 10:35

1 0

CAIDA BGP Hackathon 6,7 Feb 2016 -- Call for Participation
by Alberto Dainotti 09 Dec '15

09 Dec '15

What: CAIDA BGP Hackathon, Call for Participation (CFP) When: Feb 6-7, 2016 Where: the San Diego Supercomputer Center (SDSC) on the University of California at San Diego (UCSD) campus. Who: Parties interested in hacking on live BGP data. Inquiries: bgp-hackathon-info(a)caida.org Important Deadline: Dec 22, 2015 for travel grant requests Apply to attend: http://www.caida.org/workshops/bgp-hackathon/1602/ CAIDA, in cooperation with CSU, USC, UFMG, FORTH, Route Views, RIPE NCC, will host a BGP Hackathon on the 6-7th of February 2016 at UC San Diego (La Jolla, CA, USA). The theme of the hackathon is “live BGP measurements and monitoring”. We will provide participating teams with access to data sources and a toolbox: live streaming of BGP data, the new BGPMon interface, BGP processing tools and APIs such as the opensource BGPStream software framework, the PEERING testbed, RIPE RIS, visualization tools, and data-plane active measurement platforms such as CAIDA Ark and RIPE Atlas. Participating teams will work on "challenges" that extend, integrate and demonstrate the utility of these platforms/data for understanding or solving practical problems (e.g., detecting BGP prefix hijacking, evaluating anycast performance, effectively visualizing phenomena). The hackathon will be held in San Diego the weekend immediately preceding the NANOG conference and the AIMS academic Internet measurement workshop. The hackathon aims to: - bring together these different communities, e.g., to discuss problems operators face that academics may want to research; - advertise tools (e.g., PEERING peering.usc.edu, BGPStream bgpstream.caida.org) to the communities and get people familiar with using them, and encourage further use in the future; - get people working together on interesting/important problems, hopefully spurring further collaboration on these problems; - provide extra incentive for students to attend NANOG. ### FORMAT Each team of 2-4 people will work on a "challenge". The organization committee will propose a set of challenges to bootstrap feedback and refinement based on community input: participants can propose totally new challenges, modifications to existing ones, and express their preferences. The set of potential challenges is described in the event website at https://github.com/CAIDA/bgp-hackathon/wiki/List-of-Challenges and will continuously evolve in the days preceding the hackathon. On Saturday morning, participants will very briefly introduce their interests and ideas and teams will be officially formed. On Saturday and Sunday, participants will work together in teams to hack and develop their ideas, culminating in very short presentations to the jury on Sunday evening and a party to announce the winning teams and celebrate everyone's participation. During the event, domain-experts will provide support to the teams. Participants are free to work on drafted challenges and on their own ideas in the days preceding the hackathon. A mailing list and documentation will provide support on the platforms/tools/data used in the hackathon. However, for the teams to compete in the hackathon for prizes, they will have to demonstrate that substantial work was done during the two-day event. ### PARTICIPATION AND TRAVEL GRANTS Application to participate in the hackathon is open from December 8, 2016. Application does not guarantee participation. There is no application fee, and no participation fee. We will accept applications until one week before the hackathon, or until capacity is reached. However, the deadline to apply for a travel grant (through the hackathon application form) is 22 December 2015. Travel grants reimburse flights and hotel expenses. Food and drinks will be provided throughout the two-day event. http://www.caida.org/workshops/bgp-hackathon/1602/

1 0

Is RouteViews dead? Is there any alternatives?
by Kurt Kraut 08 Dec '15

08 Dec '15

Hi, For the past couple of months I've been attempting to add new Autonomous Systems to the RouteViews project and got no response. Talking to other AS in my area, I wasn't able to find no new BGP operator that got a response from them since July. Is RouteViews dead? If the answer is yes, it is sad. It is the most used resource about the internet routing for multiple perspectives. Is there any other similar project that I could colaborate providing the point of view of my routers have of the internet? Best regards, Kurt Kraut

5 4

Re: Is RouteViews dead? Is there any alternatives?
by Ashwin Jacob Mathew 08 Dec '15

08 Dec '15

PCH maintains routing archives here: https://www.pch.net/resources/Raw_Routing_Data/ In aggregate, our AS3856 collects routes from 1307 distinct ASNs spread across 82 IXPs. > *From:* Kurt Kraut via NANOG <nanog(a)nanog.org <mailto:nanog@nanog.org>> > *Date:* December 8, 2015 at 08:24:31 PST > *To:* NANOG list <nanog(a)nanog.org <mailto:nanog@nanog.org>> > *Subject:* *Is RouteViews dead? Is there any alternatives?* > *Reply-To:* Kurt Kraut <listas(a)kurtkraut.net > <mailto:listas@kurtkraut.net>> > > Hi, > > > For the past couple of months I've been attempting to add new Autonomous > Systems to the RouteViews project and got no response. Talking to other AS > in my area, I wasn't able to find no new BGP operator that got a response > from them since July. > > Is RouteViews dead? If the answer is yes, it is sad. It is the most used > resource about the internet routing for multiple perspectives. > > Is there any other similar project that I could colaborate providing the > point of view of my routers have of the internet? > > > Best regards, > > > Kurt Kraut

1 0

IGF Mandate Renewl
by Steve Mikulasik 08 Dec '15

08 Dec '15

The UN's Internet Governance Forum is up for renewal at the end of 2015, without UN approval they will be shutdown. I am relatively new here and haven't seen much discussion about IGF and UN (attempted) involvement in the internet. How do people feel about the IGF and should it be renewed by the UN? I can't really figure out what gap they fill other than being big conference. https://en.wikipedia.org/wiki/Internet_Governance_Forum#2015_mandate_renewal

6 7

IPv6 Cogent vs Hurricane Electric
by Max Tulyev 08 Dec '15

08 Dec '15

Hi All, we got an issue today that announces from Cogent don't reach Hurricane Electric. HE support said that's a feature, not a bug. So we have splitted Internet again? I have to change at least one of my uplinks because of it, which one is better to drop, HE or Cogent?

21 37

Re: Modem as a service?
by Bacon Zombie 08 Dec '15

08 Dec '15

Have you looked into scheduled scans with WarVOX? On Dec 6, 2015 7:39 PM, "James Laszko" <jamesl(a)mythostech.com> wrote: We are looking to automate testing of OOB modem connections when our NMS detects a site connection failure. Rather than have a live body call a modem number (or even a fax) to see if it answers (to determine if there is a potential site power issue), we'd like to be able to utilize some "Modem as a service" to automate this. I've exhausted my Google skills trying to see if anything like this exists. Anyone have any experience? Thank you, James Laszko Mythos Technology Inc jamesl(a)mythostech.com<mailto:jamesl@mythostech.com>

12 14

Survey on Middlebox modeling and troubleshooting
by Zhang, Ying 07 Dec '15

07 Dec '15

Dear All, We are researchers in HP Labs and Duke university. We are currently working on a project related to Middlebox modeling and troubleshooting. We are currently conducting a survey and gathering feedback from operators. Can you help us by providing some answers? Please feel free to email us if you have any additional suggestions. https://www.surveymonkey.com/r/5SFP6G8 Thanks! -Ying

1 0