- Test - lists.nanog.org

strategies to mitigate DNS amplification attacks in ISP network
by Martin T 02 Dec '15

02 Dec '15

Hi, as around 40% of ASNs allow at least partial IPv4 address spoofing in their network(http://spoofer.csail.mit.edu/summary.php) and there are around 30 million open-resolvers(http://openresolverproject.org/) in the Internet, then DNS amplification traffic is daily occasion for ISPs. This in probably mainly because RPF checks and DNS RRL(https://kb.isc.org/article/AA-01000/0/A-Quick-Introduction-to-Response-… are not ubiquitously implemented, recursive requests without any ACLs in DNS servers are often allowed, it requires little effort from attackers point of view and is effective attack method. Unfortunately, there seems to be very limited number of countermeasures for ISPs. Few which I can think of: 1) higher capacity backbone links - I'm not sure if this can be considered a mitigation method, but at least it can help to affect smaller amount of customers if traffic volumes are not very high 2) rate-limit incoming DNS traffic flows on peering and uplink ports - here I mean something similar to iptables "recent" module(http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HO… which allows certain number of certain type of packets in a configured time-slot per IP. However, such functionality is probably not common on edge or backbone routers. Tracking the packet state does definitely not work because state table should be synchronized between all the routers in the network and again, this requires Internet-routers to have stateful firewall functionality. In addition, one also needs to allow new DNS connections from Internet to its network. If one simply polices incoming DNS traffic on uplink and peering ports(for example if baseline DNS traffic is 5Mbps, then policer is set to 50Mbps), then legitimate customers DNS traffic is also affected in case of actual attack occurs and policer starts to drop DNS traffic, i.e. policer has no way to distinguish between the legitimate and non-legitimate incoming DNS traffic. Am I wrong in some points? What are the common practices to mitigate DNS amplification attacks in ISP network? thanks, Martin

7 7

Re: OT: BdNOG announces website blocks
by Scott Weeks 01 Dec '15

01 Dec '15

--- nanog(a)nanog.org wrote: From: ABDUL AWAL via NANOG <nanog(a)nanog.org> http://bdnews24.com/bangladesh/2015/11/29/proxy-servers-to-access-facebook-… --------------------------------- Hahaha, gov't official - meet reality. "State Minister for Posts and Telecommunications Tarana Halim says proxy servers being used..." ""I think Facebook can't be closed unless the internet is shut down. We don't want to do that. We won't shut down the internet," said Tarana Halim." "We are only catching only those that need to be caught, not everyone." "I ask you (journalists) to find out whether it's possible or not. I hope you will find the answer. Closing down Facebook 100 percent is not possible in any country in the world" Or any other app a gov't wants to keep from its citizenry so their communications with others can be controlled. "Those who are using them are using a bandwidth with a specific capacity. They won't be able to do that much longer. Because this bandwidth's capacity is low." "The second bandwidth's speed is far lower than normal. Saboteurs can't communicate and organise attacks fast enough using that bandwidth. It's very easy to track (anyone's internet activity) if the speed is low."" wtf does that even mean? scott

3 2

RFC 6335 DNS SRV registrations
by Jay R. Ashworth 01 Dec '15

01 Dec '15

If you've done one, please ping me off-list? Got a few clarifications that the RFC doesn't go deep enough in the right places for. Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

1 0

OT: BdNOG announces website blocks
by Scott Weeks 01 Dec '15

01 Dec '15

--------------------------------------------- Md. abdullah Al naser mail.naserbd at yahoo.com Wed Nov 18 12:56:15 BDT 2015 The service of Facebook, Viber and Whatsapp are blocked from now till further notice. It has been ordered by Begum Tarana Halim, State Minister, Post and Telecommunications. ---------------------------------------------- I just saw this on BdNOG and thought it might be interesting to others here and where some of the internet is headed... Wow, all of these govt's just can't seem to deal with not being able to completely control *everything* about the populace. So, in Bangladesh, no communicating with your social peers, no free calls, text or picture sharing and no mobile messaging. The new State Minister for Post and Telecommunications in Bangladesh wants her money. It'd be interesting to hear how they're attempting to make it happen. scott

6 5

Bluehost.com
by JoeSox 30 Nov '15

30 Nov '15

Anyone have the scope on the outage for Bluehost? https://twitter.com/search?q=%23bluehostdown&src=tyah Cannot even move my DNS until its restored. :( I suggest moving the status page to outside your network as well. https://www.bluehost.com/hosting/serverstatus -- Later, Joe

13 21

[NANOG-announce] NANOG 66 - San Diego - Call for Presentations is Open!
by Tony Tauber 30 Nov '15

30 Nov '15

Greetings NANOG Folks, The last two NANOG meetings (San Francisco and Montreal) set records for attendance and we hope and expect the trend of strong attendance numbers to continue for the NANOG 66 meeting February 8-10, 2016 in San Diego, CA which will be hosted by IIX, Inc. The detailed NANOG66 Call For Presentations <http://nanog.org/meetings/nanog66/callforpresentations> has more info but below is some information that might be useful for quick digestion. Cheers, Tony Tauber Chair, NANOG Program Committee === Timeline for submission and proposal review 1. Submitter enters Abstract (and draft slides if possible) in Program Committee Site <https://pc.nanog.org/>. 1. Any time following Call for Presentations and before deadline for Abstracts 2. PC performs initial review and assigns a “Shepherd” to help develop the submission. 1. Within about 2-3 weeks 3. Submitter develops draft slides (minimally showing proposed outline and level of detail). 1. Please submit initial draft slides before published deadline for slides 2. Panels and Track submissions should provide topic list and intended/confirmed participants 4. PC reviews slides and iteratively works with Submitter to help develop topic. 5. PC accepts or declines submission 6. Agenda assembled and posted 7. Submitters notified If you think you have an interesting topic but want some feedback or assistance working it into a presentation, please email the Program Committee <nanogpc(a)nanog.org>, and a representative on the Program Committee will give you the feedback needed to work it into a presentation. Otherwise, don't delay in submitting your talk, keynote, track, or panel proposal to the <http://pc.nanog.org/>Program Committee Site <https://pc.nanog.org/>. We look forward to reviewing your submission. Key Dates For NANOG 66 Event/Deadline Date Registration for NANOG 66 Opens Monday, 10/26/2015 CFP Opens for NANOG 66 Monday, 10/26/2015 CFP Deadline #1: Presentation Abstracts Due Monday, 11/30/2015 CFP Topic List and NANOG Highlights Page Posted Friday, 12/18/2015 CFP Deadline #2: Presentation Slides Due Monday, 1/4/2016 Meeting Agenda Published Monday, 1/11/2016 Speaker FINAL presentations to Program Committee Site <https://pc.nanog.org/> Wednesday, 2/3/2016 On-site Registration Sunday, 2/7/2016 Lightning Talk Submissions Open (Abstracts Only) Sunday, 2/7/2016 Further Presentation Guidelines can be found under "Present at a NANOG" <https://www.nanog.org/meetings/presentation> and some general advice is available in Tips on Giving a Talk <https://www.nanog.org/meetings/presentation/tips>. _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 1

Opinions on Arista 7280?
by David Hubbard 30 Nov '15

30 Nov '15

Curious if anyone's used the 7280 and wants to share their experience? I'm looking at it primarily for three reasons, MLAG (i.e. multi-chassis LACP), large ARP/MAC table (256k entries) and large IPv6 neighbor table (256k entries). For the table sizes we would like out of one pair of switches, we'd be into the Cisco 7000 series, but that's dramatically more expensive and we don't need much of anything else that it offers. Looked at Brocade too, but they don't have devices that can do the multi chassis LACP, has the huge table sizes and has a reasonable number of 10gig ports. It was possible to construct a workable solution using VDX's for switching and CER's for routing, but that's more complex than Arista's option if it's a usable option. Thanks, David

7 6

route converge time
by Baldur Norddahl 29 Nov '15

29 Nov '15

Hi I got a network with two routers and two IP transit providers, each with the full BGP table. Router A is connected to provider A and router B to provider B. We use MPLS with a L3VPN with a VRF called "internet". Everything happens inside that VRF. Now if I interrupt one of the IP transit circuits, the routers will take several minutes to remove the now bad routes and move everything to the remaining transit provider. This is very noticeable to the customers. I am looking into ways to improve that. I added a default static route 0.0.0.0 to provider A on router A and did the same to provider B on router B. This is supposed to be a trick that allows the network to move packets before everything is fully converged. Traffic might not leave the most optimal link, but it will be delivered. Say I take down the provider A link on router A. As I understand it, the hardware will notice this right away and stop using the routes to provider A. Router A might know about the default route on router B and send the traffic to router B. However this is not much help, because on router B there is no link that is down, so the hardware is unaware until the BGP process is done updating the hardware tables. Which apparently can take several minutes. My routers also have multipath support, but I am unsure if that is going to be of any help. Anyone got any tricks or pointers to what can be done to optimize the downtime in case of a IP transit link failure? Or the related case of one my routers going down or the link between them going down (the traffic would go a non-direct way instead if the direct link is down). Thanks, Baldur

9 12

Re: Binge On! - And So This is Net Neutrality?
by nanog-isp＠mail.com 28 Nov '15

28 Nov '15

So, which porn sites are zero rated? Uh, asking for a friend. (Would love to be a fly on the wall when those and other uncomfortable requests to join come in.) Jared

2 1

EoMPLS vlan rewrite between brands; possibly new bug in Cisco IOS 15
by Jonas Bjork 28 Nov '15

28 Nov '15

Hi, I am using a couple of AToM/EoMPLS tunnels in order to carry customer voice and data traffic across our IP/MPLS core, and it is currently working just fine. The first side consists of a Cisco 7600 router (rsp) and the other one is an HP A5500-HI routing switch with full LER/E-LSR capability. At the HP site, the tunnels are facing the access ports towards our premium end-customers; and on the Cisco PE I terminate the tunnels on one of the 2x10GE portchannel backbone links. There is vlan X on the HP side and vlan Y on the Cisco side - vlan rewrite is working perfectly - as long as I use IOS 12. After upgrading the Cisco router software to IOS 15 the tunnels won't come up. sh mpls l2 vc Y d says: ... Last error: Imposition VLAN rewrite capability mismatch with peer ... I use almost exactly the same Cisco configuration before and after the upgrade (only minor changes and nothing related to this) and I havn't touched the HP. Apparently they don't talk the same L2PW language. I wonder though, why now? We use service instances on the HP switchport as endpoint, we initiate the targetted LDP session in addition to the pseudowire handshake from a sub interface MPLS crossconnect. There is no MTU mismatch; not here - not anywhere. Anyone heard of this issue or experienced it? Best regards, Jonas Björk SNE, Europe/Sweden (hope you guys will help me anyway:)

4 7