June 2019 - mice-discuss - lists.micemn.net

Re: Please Welcome FDL Communications Corp to MICE!

by AnthonyAnderberg＠nuvera.net

Added FDL to the route servers, switch config, and graph system. Welcome! [signature_21095059] From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Jay Hanke <jayhanke(a)SOUTHFRONT.IO> Reply-To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Date: Friday, June 21, 2019 at 2:29 PM To: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] Please Welcome FDL Communications Corp to MICE! Name: FDL Communications Corp Port: Ethernet5/27 (Main Switch) 10GE ASN: 396939 IPv4: 206.108.255.144/24<http://206.108.255.144/24> IPv6: 2001:504:27:0:6:0e8b::1/64 Peering Contact: peering(a)aaniin.net<mailto:peering@aaniin.net> Route Servers- YES BFD: NO Welcome Aboard! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io<mailto:jayhanke@southfront.io> Phone 612-204-0000 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

June 22, 2019

Please Welcome FDL Communications Corp to MICE!

by Jay Hanke

Name: FDL Communications Corp Port: Ethernet5/27 (Main Switch) 10GE ASN: 396939 IPv4: 206.108.255.144/24 IPv6: 2001:504:27:0:6:0e8b::1/64 Peering Contact: peering(a)aaniin.net Route Servers- YES BFD: NO Welcome Aboard! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

June 21, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Darin Steffl

Yes we saw issues from 6:50 to about 7:20 as well. None of our BGP sessions dropped to cogent, HE, or MICE but our customers noticed it and I did see a drop in traffic during that time.. It's stumped me and I'm glad I'm not the only one since I thought it was internal to our network but it appears not. On Thu, Jun 20, 2019, 12:30 PM Jeff Wilde <jeff.wilde(a)parkregion.com> wrote: > On a separate note, did anyone experience very intermittent Internet > issues last night for about 30 minutes or so? > > > > Jeff Wilde > > IT Manager > > *Park Region Telephone Company* > > P: 218-826-8330 > > E: jeff.wilde(a)parkregion.com > > > > *From:* MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> * On Behalf Of *Andrew > Hoyos > *Sent:* Thursday, June 20, 2019 11:48 AM > *To:* MICE-DISCUSS(a)LISTS.IPHOUSE.NET > *Subject:* Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic > > > > On Jun 20, 2019, at 11:39 AM, Doug McIntyre <merlyn(a)IPHOUSE.NET> wrote: > > On Thu, Jun 20, 2019 at 04:33:12PM +0000, Frank Bulk wrote: > > https://www.seattleix.net/blackholing > > Does MICE have an blackholng functionality equivalent to SIX? > > I was visiting with a DDoS mitigation vendor this morning and was curious > if there was a way we could automatically mitigate DoS attack traffic > coming from a MICE peer. > > > > You can adjust the routing with communities, ie. in the MICE communities > aera of > http://micemn.net/technical.html > > you could block-hole the AS that is sending you that traffic. > > > > unfortunately, that just has the effect of traffic going elsewhere - not a > blackhole effect. the communities in place would just cause the route not > to be advertised to said peer, and the traffic would just ingress your > network via a different path. In the case of a DDOS, it’s likely you have > multiple ASN’s targeting you. > > > > https://www.seattleix.net/blackholing > > > > SIX, as an example, has a blackhole IP address, and the route servers > matching a blackhole community to set next hop to this to sink the traffic > on the switch fabric. > > Perhaps something we should look into for MICE. > > > > > > — > > Andrew Hoyos > > hoyosa(a)gmail.com > > > > > > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Dave Williams

We had issues reported last night... it was 'fixed' by the time I looked at things Sent from my T-Mobile 4G LTE Device -------- Original message -------- From: Mike Horwath <drechsau(a)GEEKS.ORG> Date: 6/20/19 12:32 PM (GMT-06:00) To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: > On a separate note, did anyone experience very intermittent Internet > issues last night for about 30 minutes or so? You mean for Hulu and Netflix going down? :) -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Jay Hanke

I was in a hotel in waterloo ia on centruylink and had a similar problem about the same time to fb and google. On Thu, Jun 20, 2019, 1:00 PM Brian Riggleman <briggleman(a)jagcom.net> wrote: > We also lost google related sites from 6:50 PM until 7:18 PM. I also was > unable to explain this. > > > Brian Riggleman > > Network Administrator > > Jaguar Communications > > 507-214-0258 briggleman(a)jagcom.net > > > On Thu, Jun 20, 2019 at 12:33 PM Jeff Wilde <jeff.wilde(a)parkregion.com> > wrote: > >> No lost icmp to google and others allegedly but I'm not finding anything. >> >> Jeff Wilde >> IT Manager >> Park Region Telephone Company >> P: 218-826-8330 >> E: jeff.wilde(a)parkregion.com >> >> -----Original Message----- >> From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Mike >> Horwath >> Sent: Thursday, June 20, 2019 12:32 PM >> To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET >> Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic >> >> On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: >> > On a separate note, did anyone experience very intermittent Internet >> > issues last night for about 30 minutes or so? >> >> You mean for Hulu and Netflix going down? :) >> >> -- >> Mike Horwath, reachable via drechsau(a)Geeks.ORG >> > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Andrew Hoyos

On Jun 20, 2019, at 12:31 PM, Mike Horwath <drechsau(a)GEEKS.ORG> wrote: > > On Thu, Jun 20, 2019 at 11:48:13AM -0500, Andrew Hoyos wrote: >> SIX, as an example, has a blackhole IP address, and the route >> servers matching a blackhole community to set next hop to this to >> sink the traffic on the switch fabric. Perhaps something we should >> look into for MICE. > > A good idea - perahps use a specific community advertisement with > correct next-hop into the ether. > Yes, exactly. Rough logic = route server accepts /32’s from you tagged with 65535:666 route server sets next hop no matching prefixes to 206.108.255.0 206.108.255.0 is a blackhole/null destination on switching fabric, or at least translates to dst-mac-addr that is layer2 acl’d to drop. I’d think a prerequisite for this, however, is getting to a point on the route-servers where we are validating/strict filtering prefixes that folks are sending (via IRR), otherwise, we run the risk of people essentially being able to blackhole others. > You can even automate a few things as well from known blacklists, then > another system to accept new networks to be reviewed then blackholed > for <period of time>. Sure, essentially what many folks do already internally for RTBH, and signaling to upstream. We utilize Kentik to flip back community tagged routes via BGP to for us for dst ip’s under attack matching certain parameters. We blackhole these on our core routers via the same logic above (match community, set next hop to a IP w/ a discard/null route). In turn, you can community match these and send upstream if your upstreams support a RTBH community as well. — Andrew Hoyos hoyosa(a)gmail.com

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Brian Riggleman

We also lost google related sites from 6:50 PM until 7:18 PM. I also was unable to explain this. Brian Riggleman Network Administrator Jaguar Communications 507-214-0258 briggleman(a)jagcom.net On Thu, Jun 20, 2019 at 12:33 PM Jeff Wilde <jeff.wilde(a)parkregion.com> wrote: > No lost icmp to google and others allegedly but I'm not finding anything. > > Jeff Wilde > IT Manager > Park Region Telephone Company > P: 218-826-8330 > E: jeff.wilde(a)parkregion.com > > -----Original Message----- > From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Mike > Horwath > Sent: Thursday, June 20, 2019 12:32 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET > Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic > > On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: > > On a separate note, did anyone experience very intermittent Internet > > issues last night for about 30 minutes or so? > > You mean for Hulu and Netflix going down? :) > > -- > Mike Horwath, reachable via drechsau(a)Geeks.ORG >

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Jeff Wilde

No lost icmp to google and others allegedly but I'm not finding anything. Jeff Wilde IT Manager Park Region Telephone Company P: 218-826-8330 E: jeff.wilde(a)parkregion.com -----Original Message----- From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Mike Horwath Sent: Thursday, June 20, 2019 12:32 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: > On a separate note, did anyone experience very intermittent Internet > issues last night for about 30 minutes or so? You mean for Hulu and Netflix going down? :) -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Mike Horwath

On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: > On a separate note, did anyone experience very intermittent Internet > issues last night for about 30 minutes or so? You mean for Hulu and Netflix going down? :) -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Mike Horwath

On Thu, Jun 20, 2019 at 11:48:13AM -0500, Andrew Hoyos wrote: > SIX, as an example, has a blackhole IP address, and the route > servers matching a blackhole community to set next hop to this to > sink the traffic on the switch fabric. Perhaps something we should > look into for MICE. A good idea - perahps use a specific community advertisement with correct next-hop into the ether. Then folks can subscribe as needed. You can even automate a few things as well from known blacklists, then another system to accept new networks to be reviewed then blackholed for <period of time>. -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

June 20, 2019