August 2016 - mice-discuss - lists.micemn.net

NP Remote Switch upgrade to 2x10G LAG

by Jason Hanke

Neutral Path is upgrading the back haul to 2x10G from a single 10G today. The new port allocation on the main switch is xe-0/2/1. Thanks! -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 3, 2016

Re: Please welcome Yahoo to MICE!

by Jason Hanke

Juniper part EX-SFP-10GE-LR or compatible We strongly recommend an optic with DOM. Thanks! On Tue, Aug 2, 2016 at 2:37 PM, Russell Lohr <lohr(a)yahoo-inc.com> wrote: > Jason, > > Hello sir, I have been asked to come back to you and ask what the model# or > SKU that you use, I was asked to get this from you so that we know what to > provide back to you. Please let me know. > > Russell Lohr > Tech Yahoo| Network Eng > 404-422-5932 cell > 701 First Avenue Sunnyvale CA 94089 > lohr(a)yahoo-inc.com > > > ________________________________ > From: Jason Hanke <jayhanke(a)neutralpath.net> > To: MICE Discuss <MICE-DISCUSS(a)lists.iphouse.net>; Mehmet Akcin > <akcin(a)yahoo-inc.com>; Josh Lepold <josh.lepold(a)zayo.com>; Russell Lohr > <lohr(a)yahoo-inc.com> > Sent: Tuesday, August 2, 2016 7:51 AM > Subject: Please welcome Yahoo to MICE! > > Yahoo will be connecting to two 10G ports with NO LAG Config. > > Name: Yahoo > ASN: 10310 > Contact: peering(a)yahoo-inc.com > > Port: xe-0/2/0 (main switch) > IPv4: 206.108.255.58/24 > IPv6: 2001:504:27:0:0:2846::1/64 > > Port: xe-2/0/5 (main switch) > IPv4: 206.108.255.59/24 > IPv6: 2001:504:27:0:0:2846::2/64 > > Yahoo- > > This email will serve as your LOA/CFA. Please provide a Juniper > compatible SFP+ optic for each of your connections to be installed in > the MICE Ethernet switch. > > Route Server and web server configuration please! > > Welcome aboard! > > -- > Jay Hanke > CTO > Neutral Path Communications > 3 Civic Center Plaza, Suite 204 > Mankato, MN 56001 > (507) 327-2398 mobile > jayhanke(a)neutralpath.net > www.neutralpath.net > > -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 2, 2016

Please welcome Yahoo to MICE!

by Jason Hanke

Yahoo will be connecting to two 10G ports with NO LAG Config. Name: Yahoo ASN: 10310 Contact: peering(a)yahoo-inc.com Port: xe-0/2/0 (main switch) IPv4: 206.108.255.58/24 IPv6: 2001:504:27:0:0:2846::1/64 Port: xe-2/0/5 (main switch) IPv4: 206.108.255.59/24 IPv6: 2001:504:27:0:0:2846::2/64 Yahoo- This email will serve as your LOA/CFA. Please provide a Juniper compatible SFP+ optic for each of your connections to be installed in the MICE Ethernet switch. Route Server and web server configuration please! Welcome aboard! -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 2, 2016

Re: DDoS Identification / Mitigation

by Colin Baker

On 01.08.2016 11:58, Ben Wiechman wrote: > > Does anyone have any experience with FastNetMon? > (https://github.com/pavel-odintsov/fastnetmon [5]) It seemed to > potentially be a useful roll your own type of solution. > I like it. Works really well with sflow, and netmap (requires intel NIC + port mirror) is even better. I found netflow generated more false positives in limited testing - that could just be timeout setting-related, but I know the author is not a big netflow fan. FNM doesn't have a lot knobs to turn on its own - it can email alerts based on very generic thresholds, which has some value, but a bit of customization in ExaBGP and/or flowspec is required to do the cool stuff. IMO its not a complete solution, but can be a very useful part of an overall plan, if you want to go the roll-your-own route. -- Colin Baker SupraNet Communications, Inc. (608) 572-7634 colinb(a)supranet.net This message is subject to the SupraNet Email Confidentiality Policy which is located at http://supranet.net/confidentiality

Aug. 1, 2016

Re: LTD Broadband 2nd port

by Doug McIntyre

On Sat, Jul 30, 2016 at 04:23:24PM -0500, Jason Hanke wrote: > LTD Broadband is adding a second MICE connection on the main switch. > Their connection on the NP Remote switch will remain. > > Port: xe-2/0/4 > IPv4: 206.108.255.42/24 > IPv6: 2001:504:27:0:6:045A::2/64 > ASN: 394330 > Contact: corey.hauer(a)ltdbroadband.com > > They will need route server config for this port as well. These ports > will NOT be in a LAG group. I've got that all set in the route servers now. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Aug. 1, 2016

Re: DDoS Identification / Mitigation

by Ben Wiechman

Kentik looked rather useful. We've been browsing in this space quite a bit for the last year. We've consistently struggled with the size of the attacks we are seeing, routinely hitting our upstreams at 2-4x our total uplink size. Has anyone set up any automated triggers with tools like Kentik? Does anyone have any experience with FastNetMon? ( https://github.com/pavel-odintsov/fastnetmon) It seemed to potentially be a useful roll your own type of solution. Ben Wiechman Network Engineer IV | Arvig Direct: 320.256.0184 Cell: 320.247.3224 Office: 320.256.7471 ben.wiechman(a)arvig.com On Mon, Aug 1, 2016 at 8:48 AM, Andrew Hoyos <hoyosa(a)gmail.com> wrote: > We’ve had great luck with Kentik (https://www.kentik.com/) as a general > netflow tool to at least identity DDoS sources/targets (not to mention a > very well rounded tool for analyzing flow data coupled with BGP info/sankey > diagrams, as well). > > From a mitigation perspective, hopefully your upstream providers support > D/RTBH at a minimum. If they don’t, vote with your wallet and go somewhere > that does. > > Set up your IBGP mesh with a blackhole community and local null routing, > with respective policies and communities on your transit edges matching > their blackhole communities. In theory, you should be able to add a null > route anywhere in your ibgp mesh, and have network wide black holing that > also triggers upstream blackholing as well. Ideally, you’d have some sort > of standalone trigger router with OOB access that you can use to originate > those routes into BGP. > > Bonus points for automating that process, or giving tech actionable alert > to copy/paste into a router. > > -- > Andrew Hoyos > hoyosa(a)gmail.com > > > > > On Jul 30, 2016, at 4:35 PM, Dave Williams <Dave(a)revnetdata.com> wrote: > > > > Hi all – I know this isn’t a MICE specific question, but I can’t think > of a better group of people to ask! I was wondering if anyone could share > their strategy for DDoS detection and mitigation? We randomly have > troubles with it and as you can imagine it’s quite the pain! > > Thanks in advance! > > d > > > > Dave Williams > > Founder / Visionary > > Revelation Network Management, Inc. > > O: 763.367.6161 > > C: 763.670.5558 > > > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > >

Aug. 1, 2016

Re: DDoS Identification / Mitigation

by Andrew Hoyos

We’ve had great luck with Kentik (https://www.kentik.com/) as a general netflow tool to at least identity DDoS sources/targets (not to mention a very well rounded tool for analyzing flow data coupled with BGP info/sankey diagrams, as well). From a mitigation perspective, hopefully your upstream providers support D/RTBH at a minimum. If they don’t, vote with your wallet and go somewhere that does. Set up your IBGP mesh with a blackhole community and local null routing, with respective policies and communities on your transit edges matching their blackhole communities. In theory, you should be able to add a null route anywhere in your ibgp mesh, and have network wide black holing that also triggers upstream blackholing as well. Ideally, you’d have some sort of standalone trigger router with OOB access that you can use to originate those routes into BGP. Bonus points for automating that process, or giving tech actionable alert to copy/paste into a router. -- Andrew Hoyos hoyosa(a)gmail.com > On Jul 30, 2016, at 4:35 PM, Dave Williams <Dave(a)revnetdata.com> wrote: > > Hi all – I know this isn’t a MICE specific question, but I can’t think of a better group of people to ask! I was wondering if anyone could share their strategy for DDoS detection and mitigation? We randomly have troubles with it and as you can imagine it’s quite the pain! > Thanks in advance! > d > > Dave Williams > Founder / Visionary > Revelation Network Management, Inc. > O: 763.367.6161 > C: 763.670.5558 > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

Aug. 1, 2016

Re: DDoS Identification / Mitigation

by Dave Williams

Steve - that looks like a great thing to start with! Thanks! Sent from my T-Mobile 4G LTE Device -------- Original message -------- From: Steve Howard <showard(a)PAULBUNYAN.NET> Date: 7/30/16 10:18 PM (GMT-06:00) To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] DDoS Identification / Mitigation This isn't exactly a detection/mitigation solution, but we use the CYMRU UTRS service to help us reduce our share of the problem: http://www.team-cymru.org/UTRS/ https://www.cymru.com/jtk/misc/utrs.html I encourage everyone to check it out. It's free, and as more organizations participate it becomes more effective. On Jul 30, 2016, at 15:35, Dave Williams <dave(a)REVNETDATA.COM<mailto:dave@revnetdata.com>> wrote: Hi all – I know this isn’t a MICE specific question, but I can’t think of a better group of people to ask! I was wondering if anyone could share their strategy for DDoS detection and mitigation? We randomly have troubles with it and as you can imagine it’s quite the pain! Thanks in advance! d Dave Williams Founder / Visionary Revelation Network Management, Inc. O: 763.367.6161 C: 763.670.5558 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Aug. 1, 2016