October 2022 - mice-discuss - lists.micemn.net

Proposal: MICE Static MAC address Only

by Jay Hanke

I propose we change the MICE required port security settings to be hard filtered for a single static mac address per port. Over the years, we've had several incidents where floods have occurred prior to port being error-disabled during a looping event. -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

Oct. 31, 2022

Re: MICE RR #2 having issues..

by Jeremy Lumby

Looks like we had unicast flooding on the core Arista. I cleared the forwarding table, and levels look like they are going back to normal. -----Original Message----- From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Doug McIntyre Sent: Friday, October 28, 2022 11:43 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: [MICE-DISCUSS] MICE RR #2 having issues.. Around 11:30PM CDT tonight, 10/28/2022, the 2nd route-reflector at 206.108.255.2/2001:504:27:0:0:d1af::2 starting having huge packet loss (ie. 85%). The DRAC on this system stopped working a while ago, so I can't get in remotely to see what is up with it. If anybody is around Cologix this weekend that can power cycle the machine, it probably will set it right again. I'm guessing other people are seeing this as well, so putting out a note that this is known.

Oct. 29, 2022

MICE RR #2 having issues..

by Doug McIntyre

Around 11:30PM CDT tonight, 10/28/2022, the 2nd route-reflector at 206.108.255.2/2001:504:27:0:0:d1af::2 starting having huge packet loss (ie. 85%). The DRAC on this system stopped working a while ago, so I can't get in remotely to see what is up with it. If anybody is around Cologix this weekend that can power cycle the machine, it probably will set it right again. I'm guessing other people are seeing this as well, so putting out a note that this is known.

Oct. 29, 2022

Re: [OT] Calix GigaCenter Vulnerability

by Ryan Malek

*_Issue Summary_* Calix has identified a vulnerability on GigaCenters to a SOCKS proxy attack. *_Impact on Services_* The SOCKS proxy attack uses malicious service-blocking rules applied via HTTP API calls using the admin or support user credentials. This configuration causes the GigaCenter to download a SOCKS proxy server and execute a malicious script. It has been observed that the proxy listens on port 8111 and initiates or forwards huge amounts of data or DNS flows, causing CPU and memory exhaustion, resulting in WAN service impacts, and causes the 5G radio to crash. The port that is opened and set as the listening port by the malicious script is a variable, so it is possible that a different port could be used. The affected units do not recover from the 5G crash until a reboot is performed. *_Impacted Systems_* This issue impacts all GigaCenters(844E, 844G, 854G) systems. *_Recommended Action(s)_* * Run a workflow to disable remote access and update the admin and support credentials on all GigaCenters. As a best practice, different passwords should be used for the admin and support users. * On the upstream core router or edge routers, add an ACL to block inbound access to the port used by the SOCKS proxy. * Reboot affected GigaCenters with service impacts. Calix is currently working to identify how to best address GigaCenters which are already affected. Please stay tuned to this community post for more updates. Ryan Malek - Router12 Networks LLC Internet, Phone, and Hosted Services Ph. 641.420.7180 On 10/26/2022 7:06 PM, Brady Kittel wrote: > Richard, this link requires a login. > > On Wed, Oct 26, 2022, 6:28 PM Richard Laager <rlaager(a)wiktel.com> wrote: > > If you run Calix GigaCenters, they are being actively exploited. > > Some details here: > https://community.calix.com/s/feed/0D54u00009074nuCAA > > -- > Richard > > > ------------------------------------------------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > > > ------------------------------------------------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> >

Oct. 27, 2022

Re: [OT] Calix GigaCenter Vulnerability

by Brady Kittel

Richard, this link requires a login. On Wed, Oct 26, 2022, 6:28 PM Richard Laager <rlaager(a)wiktel.com> wrote: > If you run Calix GigaCenters, they are being actively exploited. > > Some details here: https://community.calix.com/s/feed/0D54u00009074nuCAA > > -- > Richard > > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

Oct. 27, 2022

[OT] Calix GigaCenter Vulnerability

by Richard Laager

If you run Calix GigaCenters, they are being actively exploited. Some details here: https://community.calix.com/s/feed/0D54u00009074nuCAA -- Richard

Oct. 26, 2022

Please welcome Code42 Software to MICE!

by Jeremy Lumby

Name: Code42 Software Switch: MICE Core Port: E4/19 ASN: 396410 IPv4: This is an ASN change, all other info remains the same IPv6: Peering Contact: iops(a)code42.com Route Servers: Yes BFD: No Welcome Aboard Again! Jeremy Lumby Minnesota VoIP 9217 17th Ave S #216 Bloomington, MN 55425 Main: 612-355-7740 Direct: 612-392-6814 Fax: 952-873-7425 jlumby(a)mnvoip.com

Oct. 21, 2022

Re: New MSP IX announced in EdgeConnex

by Chris Wopat

Marketing seems about right. Per the PR they're also joining us down here in Madison in an EdgeConnex facility (FGC) that probably won't get many real users, since the locals are on MadIX already in the closest to what we have to a carrier hotel (222). Perhaps just a 'deal' for space/power for NinjaIX to generate publicity to attract more people to these facilities.

Oct. 20, 2022

Re: New MSP IX announced in EdgeConnex

by Jeremy Lumby

If this was another situation I would say it was competition, however I think this is mostly an EdgeConnex marketing stunt. If MICE ever gets some real competition I think we need to ask what MICE can be doing to fill the void that the competition is trying to fill. For example Andrew mentioned connectivity outside of Cologix. Unless something has changed very recently that I am not aware of there is almost no one in EdgeConnex Minneapolis that is willing and able to peer on an IX. -----Original Message----- From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Dean Bahls Sent: Thursday, October 20, 2022 10:46 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] New MSP IX announced in EdgeConnex I might be ignorant, but this seems like MICE competition to me....so not good for us. What am I missing? Dean -----Original Message----- From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Jay Hanke Sent: Thursday, October 20, 2022 8:41 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: [MICE-DISCUSS] New MSP IX announced in EdgeConnex https://newswire.telecomramblings.com/2022/10/edgeconnex-expands-its-intern… -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

Oct. 20, 2022

Re: New MSP IX announced in EdgeConnex

by Jay Hanke

> That seems like a low traffic volume at around 1.5Gbps per participant. According to my rough guess calculations, MICE is around 20Gbps per participant using marketing traffic values. Perhaps EdgeConneX doesn't know about using "marketing" values to report traffic loads. :-) The CDN mix at an IX really skews the per participant traffic numbers. Just a small number of members at MICE generate 80% of the inbound traffic.

Oct. 20, 2022