June 2019 - mice-discuss - lists.micemn.net

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Jeff Wilde

On a separate note, did anyone experience very intermittent Internet issues last night for about 30 minutes or so? Jeff Wilde IT Manager Park Region Telephone Company P: 218-826-8330 E: jeff.wilde(a)parkregion.com<mailto:jeff.wilde@parkregion.com> From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Andrew Hoyos Sent: Thursday, June 20, 2019 11:48 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic On Jun 20, 2019, at 11:39 AM, Doug McIntyre <merlyn(a)IPHOUSE.NET<mailto:merlyn@IPHOUSE.NET>> wrote: On Thu, Jun 20, 2019 at 04:33:12PM +0000, Frank Bulk wrote: https://www.seattleix.net/blackholing Does MICE have an blackholng functionality equivalent to SIX? I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. You can adjust the routing with communities, ie. in the MICE communities aera of http://micemn.net/technical.html you could block-hole the AS that is sending you that traffic. unfortunately, that just has the effect of traffic going elsewhere - not a blackhole effect. the communities in place would just cause the route not to be advertised to said peer, and the traffic would just ingress your network via a different path. In the case of a DDOS, it’s likely you have multiple ASN’s targeting you. https://www.seattleix.net/blackholing SIX, as an example, has a blackhole IP address, and the route servers matching a blackhole community to set next hop to this to sink the traffic on the switch fabric. Perhaps something we should look into for MICE. — Andrew Hoyos hoyosa(a)gmail.com<mailto:hoyosa@gmail.com> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Andrew Hoyos

On Jun 20, 2019, at 11:39 AM, Doug McIntyre <merlyn(a)IPHOUSE.NET> wrote: > On Thu, Jun 20, 2019 at 04:33:12PM +0000, Frank Bulk wrote: >> https://www.seattleix.net/blackholing >> >> Does MICE have an blackholng functionality equivalent to SIX? >> >> I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. > > > You can adjust the routing with communities, ie. in the MICE communities aera of > http://micemn.net/technical.html > > you could block-hole the AS that is sending you that traffic. unfortunately, that just has the effect of traffic going elsewhere - not a blackhole effect. the communities in place would just cause the route not to be advertised to said peer, and the traffic would just ingress your network via a different path. In the case of a DDOS, it’s likely you have multiple ASN’s targeting you. https://www.seattleix.net/blackholing <https://www.seattleix.net/blackholing> SIX, as an example, has a blackhole IP address, and the route servers matching a blackhole community to set next hop to this to sink the traffic on the switch fabric. Perhaps something we should look into for MICE. — Andrew Hoyos hoyosa(a)gmail.com

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Doug McIntyre

On Thu, Jun 20, 2019 at 04:33:12PM +0000, Frank Bulk wrote: >https://www.seattleix.net/blackholing > >Does MICE have an blackholng functionality equivalent to SIX? > >I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. You can adjust the routing with communities, ie. in the MICE communities aera of http://micemn.net/technical.html you could block-hole the AS that is sending you that traffic. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

June 20, 2019

Blackholing DoS traffic

by Frank Bulk

https://www.seattleix.net/blackholing Does MICE have an blackholng functionality equivalent to SIX? I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. Regards, Frank

June 20, 2019

Re: Bi-lateral peering with Yahoo!

by Frank Bulk

Thanks, Jay. I saw service return Monday evening. Frank From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Jay Hanke Sent: Monday, June 17, 2019 5:25 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Bi-lateral peering with Yahoo! I opened ticket # PTKT1583794 with Yahoo/Oath regarding the LoS. Jay On Fri, Jun 14, 2019 at 6:01 PM Jay Hanke <jayhanke(a)southfront.io<mailto:jayhanke@southfront.io>> wrote: Looks like 1 of 2 Oath links are down. On Fri, Jun 14, 2019 at 5:47 PM Andrew Hoyos <hoyosa(a)gmail.com<mailto:hoyosa@gmail.com>> wrote: Same here: Jun 14 20:12:13 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: NOTIFICATION sent to 2001:504:27::2846:0:1 (External AS 10310): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 2001:504:27::2846:0:1 (External AS 10310), socket buffer sndcc: 38 rcvcc: 0 TCP state: 4, snd_una: 715538896 snd_nxt: 715538934 snd_wnd: 16384 rcv_nxt: 937051995 rcv_adv: 937068379, hold timer 90s, hold timer remain 0s, last sent 26s, TCP port (local 60544, remote 179) Jun 14 20:12:30 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: NOTIFICATION sent to 206.108.255.58 (External AS 10310): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 206.108.255.58 (External AS 10310), socket buffer sndcc: 57 rcvcc: 0 TCP state: 4, snd_una: 3794713179 snd_nxt: 3794713236 snd_wnd: 16384 rcv_nxt: 58606928 rcv_adv: 58623312, hold timer 90s, hold timer remain 0s, last sent 22s, TCP port (local 179, remote 65426) — Andrew Hoyos hoyosa(a)gmail.com<mailto:hoyosa@gmail.com> > On Jun 14, 2019, at 5:44 PM, Frank Bulk <fbulk(a)MYPREMIERONLINE.COM<mailto:fbulk@MYPREMIERONLINE.COM>> wrote: > > I assume some others are seeing the same, that peering with one of Yahoo!'s IPs has been down since just before 3:45 pm? > > Host premier.sxct-north.fbnt.netins.net<https://urldefense.proofpoint.com/v2/url?u=http-3A__premier.sxct-2Dnorth.fb…> [207.32.15.28] with interface to BGP peer AS10310-1.micemn.net<https://urldefense.proofpoint.com/v2/url?u=http-3A__AS10310-2D1.micemn.net&…> [206.108.255.58/AS<https://urldefense.proofpoint.com/v2/url?u=http-3A__206.108.255.58_AS&d=DwM…> 10310 (Oath Holdings Inc., US)]: the BGP peer state is in state connect > > Frank -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io<mailto:jayhanke@southfront.io> Phone 612-204-0000 -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io<mailto:jayhanke@southfront.io> Phone 612-204-0000 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.iphouse.net_cgi-2…>

June 19, 2019

Re: Bi-lateral peering with Yahoo!

by Jay Hanke

I opened ticket # PTKT1583794 with Yahoo/Oath regarding the LoS. Jay On Fri, Jun 14, 2019 at 6:01 PM Jay Hanke <jayhanke(a)southfront.io> wrote: > Looks like 1 of 2 Oath links are down. > > On Fri, Jun 14, 2019 at 5:47 PM Andrew Hoyos <hoyosa(a)gmail.com> wrote: > >> Same here: >> >> Jun 14 20:12:13 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: >> NOTIFICATION sent to 2001:504:27::2846:0:1 (External AS 10310): code 4 >> (Hold Timer Expired Error), Reason: holdtime expired for >> 2001:504:27::2846:0:1 (External AS 10310), socket buffer sndcc: 38 rcvcc: 0 >> TCP state: 4, snd_una: 715538896 snd_nxt: 715538934 snd_wnd: 16384 rcv_nxt: >> 937051995 rcv_adv: 937068379, hold timer 90s, hold timer remain 0s, last >> sent 26s, TCP port (local 60544, remote 179) >> >> Jun 14 20:12:30 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: >> NOTIFICATION sent to 206.108.255.58 (External AS 10310): code 4 (Hold Timer >> Expired Error), Reason: holdtime expired for 206.108.255.58 (External AS >> 10310), socket buffer sndcc: 57 rcvcc: 0 TCP state: 4, snd_una: 3794713179 >> snd_nxt: 3794713236 snd_wnd: 16384 rcv_nxt: 58606928 rcv_adv: 58623312, >> hold timer 90s, hold timer remain 0s, last sent 22s, TCP port (local 179, >> remote 65426) >> >> — >> Andrew Hoyos >> hoyosa(a)gmail.com >> >> >> >> > On Jun 14, 2019, at 5:44 PM, Frank Bulk <fbulk(a)MYPREMIERONLINE.COM> >> wrote: >> > >> > I assume some others are seeing the same, that peering with one of >> Yahoo!'s IPs has been down since just before 3:45 pm? >> > >> > Host premier.sxct-north.fbnt.netins.net [207.32.15.28] with interface >> to BGP peer AS10310-1.micemn.net [206.108.255.58/AS 10310 (Oath Holdings >> Inc., US)]: the BGP peer state is in state connect >> > >> > Frank >> > > > -- > Jay Hanke, President > South Front Networks > jayhanke(a)southfront.io > Phone 612-204-0000 > -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

June 17, 2019

Re: Google ASN Migration/Port Move

by Doug McIntyre

On Thu, Jun 13, 2019 at 11:53:21AM -0500, Jay Hanke wrote: >Google is converting their existing MICE connection to their backbone >AS (15169). > >Immediately following the migration, Google will disconnect their >existing 100G port (Ethernet3/2/1). > >The new addressing will be: >ASN: 15169 >IPv4: 206.108.255.141/24 >IPv6: 2001:504:27:0:0:3b41::1/64 I've added AS 15169 to the route servers to prep this and ready them up. >The new 100G port will be Ethernet3/13/1. > >Google has requested the port be set up as a new single channel LAG group. I've setup Port-Channel 29 for this LAG group, and have the Arista core switch config'd up on Port Eth3/13/1. They should be all set to bring up this link as needed. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

June 17, 2019

Re: Bi-lateral peering with Yahoo!

by Jay Hanke

Looks like 1 of 2 Oath links are down. On Fri, Jun 14, 2019 at 5:47 PM Andrew Hoyos <hoyosa(a)gmail.com> wrote: > Same here: > > Jun 14 20:12:13 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: > NOTIFICATION sent to 2001:504:27::2846:0:1 (External AS 10310): code 4 > (Hold Timer Expired Error), Reason: holdtime expired for > 2001:504:27::2846:0:1 (External AS 10310), socket buffer sndcc: 38 rcvcc: 0 > TCP state: 4, snd_una: 715538896 snd_nxt: 715538934 snd_wnd: 16384 rcv_nxt: > 937051995 rcv_adv: 937068379, hold timer 90s, hold timer remain 0s, last > sent 26s, TCP port (local 60544, remote 179) > > Jun 14 20:12:30 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: > NOTIFICATION sent to 206.108.255.58 (External AS 10310): code 4 (Hold Timer > Expired Error), Reason: holdtime expired for 206.108.255.58 (External AS > 10310), socket buffer sndcc: 57 rcvcc: 0 TCP state: 4, snd_una: 3794713179 > snd_nxt: 3794713236 snd_wnd: 16384 rcv_nxt: 58606928 rcv_adv: 58623312, > hold timer 90s, hold timer remain 0s, last sent 22s, TCP port (local 179, > remote 65426) > > — > Andrew Hoyos > hoyosa(a)gmail.com > > > > > On Jun 14, 2019, at 5:44 PM, Frank Bulk <fbulk(a)MYPREMIERONLINE.COM> > wrote: > > > > I assume some others are seeing the same, that peering with one of > Yahoo!'s IPs has been down since just before 3:45 pm? > > > > Host premier.sxct-north.fbnt.netins.net [207.32.15.28] with interface > to BGP peer AS10310-1.micemn.net [206.108.255.58/AS 10310 (Oath Holdings > Inc., US)]: the BGP peer state is in state connect > > > > Frank > -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

June 14, 2019

Re: Bi-lateral peering with Yahoo!

by Andrew Hoyos

Same here: Jun 14 20:12:13 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: NOTIFICATION sent to 2001:504:27::2846:0:1 (External AS 10310): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 2001:504:27::2846:0:1 (External AS 10310), socket buffer sndcc: 38 rcvcc: 0 TCP state: 4, snd_una: 715538896 snd_nxt: 715538934 snd_wnd: 16384 rcv_nxt: 937051995 rcv_adv: 937068379, hold timer 90s, hold timer remain 0s, last sent 26s, TCP port (local 60544, remote 179) Jun 14 20:12:30 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: NOTIFICATION sent to 206.108.255.58 (External AS 10310): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 206.108.255.58 (External AS 10310), socket buffer sndcc: 57 rcvcc: 0 TCP state: 4, snd_una: 3794713179 snd_nxt: 3794713236 snd_wnd: 16384 rcv_nxt: 58606928 rcv_adv: 58623312, hold timer 90s, hold timer remain 0s, last sent 22s, TCP port (local 179, remote 65426) — Andrew Hoyos hoyosa(a)gmail.com > On Jun 14, 2019, at 5:44 PM, Frank Bulk <fbulk(a)MYPREMIERONLINE.COM> wrote: > > I assume some others are seeing the same, that peering with one of Yahoo!'s IPs has been down since just before 3:45 pm? > > Host premier.sxct-north.fbnt.netins.net [207.32.15.28] with interface to BGP peer AS10310-1.micemn.net [206.108.255.58/AS 10310 (Oath Holdings Inc., US)]: the BGP peer state is in state connect > > Frank

June 14, 2019

Bi-lateral peering with Yahoo!

by Frank Bulk

I assume some others are seeing the same, that peering with one of Yahoo!'s IPs has been down since just before 3:45 pm? Host premier.sxct-north.fbnt.netins.net [207.32.15.28] with interface to BGP peer AS10310-1.micemn.net [206.108.255.58/AS 10310 (Oath Holdings Inc., US)]: the BGP peer state is in state connect Frank

June 14, 2019