- Test - lists.nanog.org

DDoS mitigation for ISPs
by Mike 29 Oct '15

29 Oct '15

Hello, Is there any DDoS mitigation service provider that can scrub traffic for an ISP network? I have an ASN and BGP and my own netblocks, and I have a 1gbps pipe. I was thinking the scenario would be during attack, we could bring up a tunnel and run bgp over it and advertise some portion of our ip space thru it. I realise getting it setup while attack is taking place would be a little hard and that we likely could expect at least some down time. What we have seen so far has been reflection attacks (dns and ssdp) and we have been able to do rate limiting on these and other protocols to sane values. This has worked well, although the primary risk is once the traffic flow exceeds the link capacity such limiting won't have any net effect. But if we could farm this out during times of trouble to a mitigation services provider, they could advertise our block(s) and rate limit and scrub for us and send us the result, it would be a far better than what we have now (which is effectively nothing). I asked cloudflare this and they stated they are focused on web traffic. My upstream can't help me, doesn't support RTBH and won't install filters anyways unless it's impacting THEIR network. Just wondering if anyone has any other ideas (short of ditching my provider, which I also can't do due at this time due to lack of competitive choice). Mike-

4 5

Re: All in favor or.....
by Larry Sheldon 29 Oct '15

29 Oct '15

On 10/28/2015 19:15, Matthew Petach wrote: > I work 8 hours a day... > > ...and then I work another 8. A long time ago, in a place far, far away, the PTB determined that we should change from a three-team, three-8-hour shifts, 5 days a week ("days", "evenings", and "nights" (aka "graves" or "graveyard") for 7 x 24 coverage, to a four-team, 12 1/2 hour day 3 day week (and you know, I have forgotten how we covered the 7th day!). For the 2nd-level managers like me, the reaction was "Wow! I will only have to work 12-18 hours three days a week! -- sed quis custodiet ipsos custodes? (Juvenal)

1 0

speedtest vs geo-coding IP info
by lorell＠hathcock.org 28 Oct '15

28 Oct '15

Legions of NANOG: Here's an interesting problem. My customers are running speedtests from Ookla's speedtest.net site. The default site is in Kansas and not in Texas where we receive our internet connection. Questions: 1. How do I go about viewing the geo-coded data that accompanies my IP addresses? This is obviously a database that is kept for geo-coding purposes. The whois info for the block in question traces back to a superblock formerly owned by PSINet, Inc and has a Washington, DC address. I conclude that the geo-coding used by speedtest.net is not from the whois database. 2. If I pestered my carrier to SWIP the IP address block to me (as they should have?) would that help me solve my problem? 3. Is there anything else I need to be thinking of that would help me have better control of my geo-coding info? Are there third-party self sign up/volunteer database which house geo-coding info? Thanks in advance! Sincerely, Lorell Hathcock Chief Technology Officer SolStar Network, LLC Communications FIBER - VOIP - SECURITY - TV FTTH - Commercial - Residential Burglar - Access Control 956-478-5955 (cell) - 956-316-4090 (main) <mailto:lorell@SolStarNetwork.com> lorell(a)SolStarNetwork.com <http://www.solstarnetwork.com/> www.SolStarNetwork.com TX License #B19998

4 4

Uptick in spam
by anthony kasza 28 Oct '15

28 Oct '15

Has there been a recent uptick in crap sent to the list or is it just me? Is there anything that we can do to filter these messages with junk links? -AK

24 34

Anyone here from Orbitz?
by Andy Ringsmuth 28 Oct '15

28 Oct '15

Any chance someone on the list from Orbitz? Car rentals are suddenly impossible to book. It seems there’s a session timeout set to essentially zero. Selecting a vehicle returns this URL: http://www.orbitz.com/shop/home?errorId=3207 And an error of “We’ve noticed you’ve been away from this page for a while and your session has timed out. Please try again.” ---- Andy Ringsmuth andy(a)newslink.com News Link – Manager Travel, Technology & Facilities 2201 Winthrop Rd., Lincoln, NE 68502-4158 (402) 475-6397 (402) 304-0083 cellular

1 0

spam smackdown?
by Scott Weeks 28 Oct '15

28 Oct '15

It looks like someone's trying to make a point. --------------------------------- New message, please read <http://xxxxxxxxx> ----------------------------------- scott

10 9

Re: *tap tap* is this thing on?
by Dovid Bender 28 Oct '15

28 Oct '15

The reason they are the big boys is because they don't fund such operations. They see money before what you call obligations. Right or wrong they will sell a product if they think they can make it work. Making it work is all subjective. You say it means handling abuse complaints while they say it means the client being connected and able to ping the world. ------Original Message------ From: Rich Kulawiec Sender: NANOG To: nanog(a)nanog.org Subject: Re: *tap tap* is this thing on? Sent: Oct 27, 2015 06:30 On Mon, Oct 26, 2015 at 02:48:59PM -0600, Brielle Bruns wrote: > I get it that it is hard for large providers to be proactive about > things going on due to the sheer size of their networks, but come > on. That excuse only works for so long. 1. It's not hard. It's far easier for large providers than small ones, although many of them flat-out lie and claim the opposite. 2. Whatever happened to "never build what you can't control?" If you can't stop your operation from emitting abuse, you should shut it down. Immediately. That's what professionals do. 3. Large providers pretend to be "leaders", but are among the worst in terms of actually leading by example. Just try getting a response from them via postmaster@ or abuse@. Of course these large operations should individually answer *every* message to those addresses promptly, 24x7, and initiate immediate investigation/remediation on *every* complaint. That's baseline operational competence 101, and given their enormous financial and personnel resources, it would require only a tiny amount of resources. But they don't -- and everyone else pays the price for it. ---rsk Regards, Dovid

1 0

IPligence?
by Dennis Burgess 28 Oct '15

28 Oct '15

Anyone have a contact for Ipligence, looks like a company out of Spain that does geoip database work. They have some issues with their database, and can't find a way to get in contact with them. They don't answer their support e-mails. Thanks, [DennisBurgessSignature] www.linktechs.net<http://www.linktechs.net/> - 314-735-0270 x103 - dmburgess(a)linktechs.net<mailto:dmburgess@linktechs.net>

2 1

Global Crossing contact
by Jim McBurnett 28 Oct '15

28 Oct '15

Hi folks, Sorry to add to the noise level, but need to reach someone at level2/3 at Global crossing for a pathing issue. Please contact me offlist so we can figure out where some traffic is being lost. Thanks, Jim [cid:image321144.PNG@13411130.448fc74e]<http://TGASolutions.com><http://tgasolutions.com> Jim McBurnett | Senior Network Engineer TGA Solutions 13891 Asheville Highway | Inman, SC 29349 Tel (864) 473-1200 | Support 864-708-0616 Website<http://www.tgasolutions.com/> | Email<mailto:jim@tgasolutions.com> <https://twitter.com/tgasolutions> [cid:image48ea14.GIF@cce627af.4c881bf4] <https://twitter.com/tgasolutions> [cid:image0cd093.GIF@9be97be4.4185bb9a] <https://www.facebook.com/pages/TGA-Solutions/171403666251238> <https://www.facebook.com/pages/TGA-Solutions/171403666251238> [cid:image334971.GIF@85a3af4d.489311ca] <https://www.linkedin.com/company/247020?trk=tyah/in/rexweston/> [cid:image6b6966.GIF@ef589bf0.4db7e941] <https://twitter.com/tgasolutions> <https://www.linkedin.com/company/247020?trk=tyah/in/rexweston/> [cid:image2cf82a.PNG@a3058521.419c8c19]<http://tgasolutions.com>

1 0

DNSSEC broken for login.microsoftonline.com
by Bruce Curtis 28 Oct '15

28 Oct '15

FYI our DNS requests to resolve login.microsoftonline.com are failing because of a DNSSEC error. http://dnssec-debugger.verisignlabs.com/login.microsoftonline.com http://dnsviz.net/d/login.microsoftonline.com/dnssec/ ns1 domain]$ drill -DT login.microsoftonline.com Warning: No trusted keys were given. Will not be able to verify authenticity! ;; Domain: . ;; Signature ok but no chain to a trusted key or ds record [S] . 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b} . 172800 IN DNSKEY 256 3 8 ;{id = 62530 (zsk), size = 1024b} Checking if signing key is trusted: New key: . 172800 IN DNSKEY 256 3 8 AwEAAbgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNMioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaRF2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXl ;{id = 62530 (zsk), size = 1024b} [S] com. 86400 IN DS 30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766 ;; Domain: com. ;; Signature ok but no chain to a trusted key or ds record [S] com. 86400 IN DNSKEY 256 3 8 ;{id = 51797 (zsk), size = 1024b} com. 86400 IN DNSKEY 257 3 8 ;{id = 30909 (ksk), size = 2048b} [S] Existence denied: microsoftonline.com. DS ;; No ds record for delegation ;; Domain: microsoftonline.com. ;; No DNSKEY record found for microsoftonline.com. ;; No DS for login.microsoftonline.com.;; No ds record for delegation ;; Domain: login.microsoftonline.com. ;; No DNSKEY record found for login.microsoftonline.com. [U] No data found for: login.microsoftonline.com. type A ;;[S] self sig OK; [B] bogus; [T] trusted [ns1 domain]$ [ns1 domain]$ drill -DT medicare.gov Warning: No trusted keys were given. Will not be able to verify authenticity! ;; Domain: . ;; Signature ok but no chain to a trusted key or ds record [S] . 172800 IN DNSKEY 256 3 8 ;{id = 62530 (zsk), size = 1024b} . 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b} Checking if signing key is trusted: New key: . 172800 IN DNSKEY 256 3 8 AwEAAbgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNMioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaRF2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXl ;{id = 62530 (zsk), size = 1024b} [S] gov. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe gov. 86400 IN DS 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ;; Domain: gov. ;; Signature ok but no chain to a trusted key or ds record [S] gov. 86400 IN DNSKEY 256 3 8 ;{id = 13175 (zsk), size = 1024b} gov. 86400 IN DNSKEY 257 3 8 ;{id = 7698 (ksk), size = 2048b} Checking if signing key is trusted: New key: gov. 86400 IN DNSKEY 256 3 8 AQPCY4NZARQ0HDzGismy6sZdJ17o2+yzmZSkw6d9PeeJ8NCnw9atj4PGHO50LX1Hy0n4YimUcDEXHu+sI4MBaeTkHY3ilsC2kpWGGOFW2fkXn6XNvvPVRjwk04hDsEFphOXPPdoXWjXtQiTVYkFpgUbxJYo24/JxM5JuC4v0+qDmLQ== ;{id = 13175 (zsk), size = 1024b} [S] medicare.gov. 3600 IN DS 16500 7 1 ea88786ecaa04e66322e4405b1c1a55e31485281 medicare.gov. 3600 IN DS 16500 7 2 43a0e12df89bb342c15229495cd2bc18dddce0d9fb315aeb5b06b0d849b9a3ee ;; Domain: medicare.gov. ;; Signature ok but no chain to a trusted key or ds record [S] medicare.gov. 7200 IN DNSKEY 256 3 7 ;{id = 58988 (zsk), size = 1024b} medicare.gov. 7200 IN DNSKEY 256 3 7 ;{id = 41714 (zsk), size = 1024b} medicare.gov. 7200 IN DNSKEY 257 3 7 ;{id = 16500 (ksk), size = 2048b} [S] medicare.gov. 20 IN A 23.213.71.152 ;;[S] self sig OK; [B] bogus; [T] trusted --- Bruce Curtis bruce.curtis(a)ndsu.edu Certified NetAnalyst II 701-231-8527 North Dakota State University

3 7