- mice-discuss - lists.micemn.net

Re: BGP sessions down...

by Frank Bulk

Thanks -- looks like it's down just to Akamai and MICE MRS #2. Since they all share the same physical path, not clear to me how this can be, but I'll start digging. Frank -----Original Message----- From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Richard Laager Sent: Thursday, August 04, 2016 5:01 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] BGP sessions down... On 08/04/2016 04:58 PM, Frank Bulk wrote: > Problem at MICE? Physical link is up. All of my MICE sessions (including both route servers) are up, and I can still ping across the exchange. -- Richard

Aug. 4, 2016

Re: BGP sessions down...

by Richard Laager

On 08/04/2016 04:58 PM, Frank Bulk wrote: > Problem at MICE? Physical link is up. All of my MICE sessions (including both route servers) are up, and I can still ping across the exchange. -- Richard

Aug. 4, 2016

BGP sessions down...

by Frank Bulk

Problem at MICE? Physical link is up. Frank -----Original Message----- From: nagios(a)nagios.mtcnet.net [mailto:nagios@nagios.mtcnet.net] Sent: Thursday, August 04, 2016 4:53 PM To: Frank Bulk <fbulk(a)mypremieronline.com> Subject: PROBLEM: CRITICAL alert for Premiers Spencer-facing Brocade MLXe-4 router/BGP ***** Nagios ***** This is a PROBLEM notice that Premiers Spencer-facing Brocade MLXe-4 router/BGP is CRITICAL Date/Time: Thu Aug 4 16:52:57 CDT 2016 Additional Info: CRITICAL: critical 2, warning 6 Host 192.168.0.85 with interface to BGP peer AS53679-MRS-2.micemn.net [206.108.255.2/AS 53679]: the BGP peer state is in state connect Host 192.168.0.85 with interface to BGP peer AS29040.micemn.net [206.108.255.84/AS 20940]: the BGP peer state is in state connect Host 192.168.0.85 with interface to BGP peer AS53679-MRS-2.micemn.net [206.108.255.2/AS 53679]: the elapsed time the remote peer has been in the Established state or how long since this peer was last in the Established state changed from 39 days, 19 hours, 41 minutes, 12 seconds to 0 seconds Host 192.168.0.85 with interface to BGP peer AS29040.micemn.net [206.108.255.84/AS 20940]: the elapsed time the remote peer has been in the Established state or how long since this peer was last in the Established state changed from 23 days, 4 hours, 33 minutes, 7 seconds to 0 seconds Host 192.168.0.85 with interface to BGP peer AS53679-MRS-2.micemn.net [206.108.255.2/AS 53679]: the number of received route prefixes changed from 1763 to 0 Host 192.168.0.85 with interface to BGP peer AS53679-MRS-2.micemn.net [206.108.255.2/AS 53679]: 0 learned prefixes is less than the specified minimum of 1 Host 192.168.0.85 with interface to BGP peer AS29040.micemn.net [206.108.255.84/AS 20940]: the number of received route prefixes changed from 10 to 0 Host 192.168.0.85 with interface to BGP peer AS29040.micemn.net [206.108.255.84/AS 20940]: 0 learned prefixes is less than the specified minimum of 1 Host 192.168.0.85 with interface to BGP peer AS53679-MRS-2.micemn.net [206.108.255.2/AS 53679]: the number of installed route prefixes changed from 1763 to 0 Host 192.168.0.85 with interface to BGP peer AS29040.micemn.net [206.108.255.84/AS 20940]: the number of installed route prefixes changed from 10 to 0 BGP state of premier.spnc-mlx.fbnt.netins.net [173.215.60.1/AS 18883]: established; prefixes (received/installed): 1/1 BGP state of AS53679-MRS-1.micemn.net [206.108.255.1/AS 53679]: established; prefixes (received/installed): 1769/1769 BGP state of AS53679-MRS-2.micemn.net [206.108.255.2/AS 53679]: connect; prefixes (received/installed): 0/0 BGP state of AS6939.micemn.net [206.108.255.52/AS 6939]: established; prefixes (received/installed): 92186/91624 BGP state of AS29040.micemn.net [206.108.255.84/AS 20940]: connect; prefixes (received/installed): 0/0

Aug. 4, 2016

Re: Please welcome Yahoo to MICE!

by Jason Hanke

Send me the optics and I'll get them installed: Neutral Path Communications Attn: Jay Hanke 3 Civic Center Plaza, STE 204 Mankato, MN 56001 On Wed, Aug 3, 2016 at 4:00 PM, Russell Lohr <lohr(a)yahoo-inc.com> wrote: > Jason, > > Zayo will be placing the Xconnect orders on Yahoo's behalf. > > Russell Lohr > Tech Yahoo| Network Eng > 404-422-5932 cell > 701 First Avenue Sunnyvale CA 94089 > lohr(a)yahoo-inc.com > > > ________________________________ > From: Jason Hanke <jayhanke(a)neutralpath.net> > To: Russell Lohr <lohr(a)yahoo-inc.com> > Cc: MICE Discuss <MICE-DISCUSS(a)lists.iphouse.net>; Mehmet Akcin > <akcin(a)yahoo-inc.com>; Josh Lepold <josh.lepold(a)zayo.com> > Sent: Wednesday, August 3, 2016 1:52 PM > > Subject: Re: Please welcome Yahoo to MICE! > > Is Yahoo placing the orders for the cross connects in Minneapolis or > is Zayo doing that on behalf of Yahoo? > > On Wed, Aug 3, 2016 at 3:49 PM, Russell Lohr <lohr(a)yahoo-inc.com> wrote: >> Jay, >> >> Sir, in regards to the optics, that you require, where do I need to have >> these optics sent, please advise address and c/o person and we will drop >> ship the optics. Please let me know. >> >> Russell Lohr >> Tech Yahoo| Network Eng >> 404-422-5932 cell >> 701 First Avenue Sunnyvale CA 94089 >> lohr(a)yahoo-inc.com >> >> >> ________________________________ >> From: Jason Hanke <jayhanke(a)neutralpath.net> >> To: Russell Lohr <lohr(a)yahoo-inc.com> >> Cc: MICE Discuss <MICE-DISCUSS(a)lists.iphouse.net>; Mehmet Akcin >> <akcin(a)yahoo-inc.com>; Josh Lepold <josh.lepold(a)zayo.com> >> Sent: Tuesday, August 2, 2016 12:41 PM >> Subject: Re: Please welcome Yahoo to MICE! >> >> Juniper part EX-SFP-10GE-LR or compatible >> >> We strongly recommend an optic with DOM. >> >> Thanks! >> >> On Tue, Aug 2, 2016 at 2:37 PM, Russell Lohr <lohr(a)yahoo-inc.com> wrote: >>> Jason, >>> >>> Hello sir, I have been asked to come back to you and ask what the model# >>> or >>> SKU that you use, I was asked to get this from you so that we know what >>> to >>> provide back to you. Please let me know. >>> >>> Russell Lohr >>> Tech Yahoo| Network Eng >>> 404-422-5932 cell >>> 701 First Avenue Sunnyvale CA 94089 >>> lohr(a)yahoo-inc.com >>> >>> >>> ________________________________ >>> From: Jason Hanke <jayhanke(a)neutralpath.net> >>> To: MICE Discuss <MICE-DISCUSS(a)lists.iphouse.net>; Mehmet Akcin >>> <akcin(a)yahoo-inc.com>; Josh Lepold <josh.lepold(a)zayo.com>; Russell Lohr >>> <lohr(a)yahoo-inc.com> >>> Sent: Tuesday, August 2, 2016 7:51 AM >>> Subject: Please welcome Yahoo to MICE! >>> >>> Yahoo will be connecting to two 10G ports with NO LAG Config. >>> >>> Name: Yahoo >>> ASN: 10310 >>> Contact: peering(a)yahoo-inc.com >>> >>> Port: xe-0/2/0 (main switch) >>> IPv4: 206.108.255.58/24 >>> IPv6: 2001:504:27:0:0:2846::1/64 >>> >>> Port: xe-2/0/5 (main switch) >>> IPv4: 206.108.255.59/24 >>> IPv6: 2001:504:27:0:0:2846::2/64 >>> >>> Yahoo- >>> >>> This email will serve as your LOA/CFA. Please provide a Juniper >>> compatible SFP+ optic for each of your connections to be installed in >>> the MICE Ethernet switch. >>> >>> Route Server and web server configuration please! >>> >>> Welcome aboard! >>> >>> -- >>> Jay Hanke >>> CTO >>> Neutral Path Communications >>> 3 Civic Center Plaza, Suite 204 >>> Mankato, MN 56001 >>> (507) 327-2398 mobile >>> jayhanke(a)neutralpath.net >>> www.neutralpath.net > >> >>> >>> >> >> >> >> -- >> Jay Hanke >> CTO >> Neutral Path Communications >> 3 Civic Center Plaza, Suite 204 >> Mankato, MN 56001 >> (507) 327-2398 mobile >> jayhanke(a)neutralpath.net >> www.neutralpath.net >> >> > > > > -- > Jay Hanke > CTO > Neutral Path Communications > 3 Civic Center Plaza, Suite 204 > Mankato, MN 56001 > (507) 327-2398 mobile > jayhanke(a)neutralpath.net > www.neutralpath.net > > -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 3, 2016

Re: Please welcome Yahoo to MICE!

by Jason Hanke

Is Yahoo placing the orders for the cross connects in Minneapolis or is Zayo doing that on behalf of Yahoo? On Wed, Aug 3, 2016 at 3:49 PM, Russell Lohr <lohr(a)yahoo-inc.com> wrote: > Jay, > > Sir, in regards to the optics, that you require, where do I need to have > these optics sent, please advise address and c/o person and we will drop > ship the optics. Please let me know. > > Russell Lohr > Tech Yahoo| Network Eng > 404-422-5932 cell > 701 First Avenue Sunnyvale CA 94089 > lohr(a)yahoo-inc.com > > > ________________________________ > From: Jason Hanke <jayhanke(a)neutralpath.net> > To: Russell Lohr <lohr(a)yahoo-inc.com> > Cc: MICE Discuss <MICE-DISCUSS(a)lists.iphouse.net>; Mehmet Akcin > <akcin(a)yahoo-inc.com>; Josh Lepold <josh.lepold(a)zayo.com> > Sent: Tuesday, August 2, 2016 12:41 PM > Subject: Re: Please welcome Yahoo to MICE! > > Juniper part EX-SFP-10GE-LR or compatible > > We strongly recommend an optic with DOM. > > Thanks! > > On Tue, Aug 2, 2016 at 2:37 PM, Russell Lohr <lohr(a)yahoo-inc.com> wrote: >> Jason, >> >> Hello sir, I have been asked to come back to you and ask what the model# >> or >> SKU that you use, I was asked to get this from you so that we know what to >> provide back to you. Please let me know. >> >> Russell Lohr >> Tech Yahoo| Network Eng >> 404-422-5932 cell >> 701 First Avenue Sunnyvale CA 94089 >> lohr(a)yahoo-inc.com >> >> >> ________________________________ >> From: Jason Hanke <jayhanke(a)neutralpath.net> >> To: MICE Discuss <MICE-DISCUSS(a)lists.iphouse.net>; Mehmet Akcin >> <akcin(a)yahoo-inc.com>; Josh Lepold <josh.lepold(a)zayo.com>; Russell Lohr >> <lohr(a)yahoo-inc.com> >> Sent: Tuesday, August 2, 2016 7:51 AM >> Subject: Please welcome Yahoo to MICE! >> >> Yahoo will be connecting to two 10G ports with NO LAG Config. >> >> Name: Yahoo >> ASN: 10310 >> Contact: peering(a)yahoo-inc.com >> >> Port: xe-0/2/0 (main switch) >> IPv4: 206.108.255.58/24 >> IPv6: 2001:504:27:0:0:2846::1/64 >> >> Port: xe-2/0/5 (main switch) >> IPv4: 206.108.255.59/24 >> IPv6: 2001:504:27:0:0:2846::2/64 >> >> Yahoo- >> >> This email will serve as your LOA/CFA. Please provide a Juniper >> compatible SFP+ optic for each of your connections to be installed in >> the MICE Ethernet switch. >> >> Route Server and web server configuration please! >> >> Welcome aboard! >> >> -- >> Jay Hanke >> CTO >> Neutral Path Communications >> 3 Civic Center Plaza, Suite 204 >> Mankato, MN 56001 >> (507) 327-2398 mobile >> jayhanke(a)neutralpath.net >> www.neutralpath.net > >> >> > > > > -- > Jay Hanke > CTO > Neutral Path Communications > 3 Civic Center Plaza, Suite 204 > Mankato, MN 56001 > (507) 327-2398 mobile > jayhanke(a)neutralpath.net > www.neutralpath.net > > -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 3, 2016

Re: Please welcome Yahoo to MICE!

by Doug McIntyre

On Tue, Aug 02, 2016 at 09:51:28AM -0500, Jason Hanke wrote: > Yahoo will be connecting to two 10G ports with NO LAG Config. > > Name: Yahoo > ASN: 10310 > Contact: peering(a)yahoo-inc.com > > Port: xe-0/2/0 (main switch) > IPv4: 206.108.255.58/24 > IPv6: 2001:504:27:0:0:2846::1/64 > > Port: xe-2/0/5 (main switch) > IPv4: 206.108.255.59/24 > IPv6: 2001:504:27:0:0:2846::2/64 > > Route Server and web server configuration please! Sure, all set on the switch ports, and in the Route Servers. Welcome aboard! -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Aug. 3, 2016

Re: NP Remote Switch upgrade to 2x10G LAG

by Doug McIntyre

On Wed, Aug 03, 2016 at 09:29:38AM -0500, Richard Laager wrote: > On 08/03/2016 09:24 AM, Jason Hanke wrote: > > Neutral Path is upgrading the back haul to 2x10G from a single 10G today. > > > > The new port allocation on the main switch is xe-0/2/1. > > Will this be ae9 on the main switch? Yes, it'll be ae9. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Aug. 3, 2016

Re: NP Remote Switch upgrade to 2x10G LAG

by Jason Hanke

unit 0 { family inet { address 206.108.255.241/24; } family inet6 { address 2001:504:27:0:0:d1af::241/64; } } On Wed, Aug 3, 2016 at 9:29 AM, Richard Laager <rlaager(a)wiktel.com> wrote: > On 08/03/2016 09:24 AM, Jason Hanke wrote: >> Neutral Path is upgrading the back haul to 2x10G from a single 10G today. >> >> The new port allocation on the main switch is xe-0/2/1. > > Will this be ae9 on the main switch? > > Does the Neutral Path switch have MICE IPv4 and IPv6 addresses (e.g. for > Cacti)? Those are still listed with TBD as the last octet. > > -- > Richard -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 3, 2016

Re: NP Remote Switch upgrade to 2x10G LAG

by Richard Laager

On 08/03/2016 09:24 AM, Jason Hanke wrote: > Neutral Path is upgrading the back haul to 2x10G from a single 10G today. > > The new port allocation on the main switch is xe-0/2/1. Will this be ae9 on the main switch? Does the Neutral Path switch have MICE IPv4 and IPv6 addresses (e.g. for Cacti)? Those are still listed with TBD as the last octet. -- Richard

Aug. 3, 2016

NP Remote Switch upgrade to 2x10G LAG

by Jason Hanke

Neutral Path is upgrading the back haul to 2x10G from a single 10G today. The new port allocation on the main switch is xe-0/2/1. Thanks! -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 3, 2016

Re: Please welcome Yahoo to MICE!

by Jason Hanke

Juniper part EX-SFP-10GE-LR or compatible We strongly recommend an optic with DOM. Thanks! On Tue, Aug 2, 2016 at 2:37 PM, Russell Lohr <lohr(a)yahoo-inc.com> wrote: > Jason, > > Hello sir, I have been asked to come back to you and ask what the model# or > SKU that you use, I was asked to get this from you so that we know what to > provide back to you. Please let me know. > > Russell Lohr > Tech Yahoo| Network Eng > 404-422-5932 cell > 701 First Avenue Sunnyvale CA 94089 > lohr(a)yahoo-inc.com > > > ________________________________ > From: Jason Hanke <jayhanke(a)neutralpath.net> > To: MICE Discuss <MICE-DISCUSS(a)lists.iphouse.net>; Mehmet Akcin > <akcin(a)yahoo-inc.com>; Josh Lepold <josh.lepold(a)zayo.com>; Russell Lohr > <lohr(a)yahoo-inc.com> > Sent: Tuesday, August 2, 2016 7:51 AM > Subject: Please welcome Yahoo to MICE! > > Yahoo will be connecting to two 10G ports with NO LAG Config. > > Name: Yahoo > ASN: 10310 > Contact: peering(a)yahoo-inc.com > > Port: xe-0/2/0 (main switch) > IPv4: 206.108.255.58/24 > IPv6: 2001:504:27:0:0:2846::1/64 > > Port: xe-2/0/5 (main switch) > IPv4: 206.108.255.59/24 > IPv6: 2001:504:27:0:0:2846::2/64 > > Yahoo- > > This email will serve as your LOA/CFA. Please provide a Juniper > compatible SFP+ optic for each of your connections to be installed in > the MICE Ethernet switch. > > Route Server and web server configuration please! > > Welcome aboard! > > -- > Jay Hanke > CTO > Neutral Path Communications > 3 Civic Center Plaza, Suite 204 > Mankato, MN 56001 > (507) 327-2398 mobile > jayhanke(a)neutralpath.net > www.neutralpath.net > > -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 2, 2016

Please welcome Yahoo to MICE!

by Jason Hanke

Yahoo will be connecting to two 10G ports with NO LAG Config. Name: Yahoo ASN: 10310 Contact: peering(a)yahoo-inc.com Port: xe-0/2/0 (main switch) IPv4: 206.108.255.58/24 IPv6: 2001:504:27:0:0:2846::1/64 Port: xe-2/0/5 (main switch) IPv4: 206.108.255.59/24 IPv6: 2001:504:27:0:0:2846::2/64 Yahoo- This email will serve as your LOA/CFA. Please provide a Juniper compatible SFP+ optic for each of your connections to be installed in the MICE Ethernet switch. Route Server and web server configuration please! Welcome aboard! -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Aug. 2, 2016

Re: DDoS Identification / Mitigation

by Colin Baker

On 01.08.2016 11:58, Ben Wiechman wrote: > > Does anyone have any experience with FastNetMon? > (https://github.com/pavel-odintsov/fastnetmon [5]) It seemed to > potentially be a useful roll your own type of solution. > I like it. Works really well with sflow, and netmap (requires intel NIC + port mirror) is even better. I found netflow generated more false positives in limited testing - that could just be timeout setting-related, but I know the author is not a big netflow fan. FNM doesn't have a lot knobs to turn on its own - it can email alerts based on very generic thresholds, which has some value, but a bit of customization in ExaBGP and/or flowspec is required to do the cool stuff. IMO its not a complete solution, but can be a very useful part of an overall plan, if you want to go the roll-your-own route. -- Colin Baker SupraNet Communications, Inc. (608) 572-7634 colinb(a)supranet.net This message is subject to the SupraNet Email Confidentiality Policy which is located at http://supranet.net/confidentiality

Aug. 1, 2016

Re: LTD Broadband 2nd port

by Doug McIntyre

On Sat, Jul 30, 2016 at 04:23:24PM -0500, Jason Hanke wrote: > LTD Broadband is adding a second MICE connection on the main switch. > Their connection on the NP Remote switch will remain. > > Port: xe-2/0/4 > IPv4: 206.108.255.42/24 > IPv6: 2001:504:27:0:6:045A::2/64 > ASN: 394330 > Contact: corey.hauer(a)ltdbroadband.com > > They will need route server config for this port as well. These ports > will NOT be in a LAG group. I've got that all set in the route servers now. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Aug. 1, 2016

Re: DDoS Identification / Mitigation

by Ben Wiechman

Kentik looked rather useful. We've been browsing in this space quite a bit for the last year. We've consistently struggled with the size of the attacks we are seeing, routinely hitting our upstreams at 2-4x our total uplink size. Has anyone set up any automated triggers with tools like Kentik? Does anyone have any experience with FastNetMon? ( https://github.com/pavel-odintsov/fastnetmon) It seemed to potentially be a useful roll your own type of solution. Ben Wiechman Network Engineer IV | Arvig Direct: 320.256.0184 Cell: 320.247.3224 Office: 320.256.7471 ben.wiechman(a)arvig.com On Mon, Aug 1, 2016 at 8:48 AM, Andrew Hoyos <hoyosa(a)gmail.com> wrote: > We’ve had great luck with Kentik (https://www.kentik.com/) as a general > netflow tool to at least identity DDoS sources/targets (not to mention a > very well rounded tool for analyzing flow data coupled with BGP info/sankey > diagrams, as well). > > From a mitigation perspective, hopefully your upstream providers support > D/RTBH at a minimum. If they don’t, vote with your wallet and go somewhere > that does. > > Set up your IBGP mesh with a blackhole community and local null routing, > with respective policies and communities on your transit edges matching > their blackhole communities. In theory, you should be able to add a null > route anywhere in your ibgp mesh, and have network wide black holing that > also triggers upstream blackholing as well. Ideally, you’d have some sort > of standalone trigger router with OOB access that you can use to originate > those routes into BGP. > > Bonus points for automating that process, or giving tech actionable alert > to copy/paste into a router. > > -- > Andrew Hoyos > hoyosa(a)gmail.com > > > > > On Jul 30, 2016, at 4:35 PM, Dave Williams <Dave(a)revnetdata.com> wrote: > > > > Hi all – I know this isn’t a MICE specific question, but I can’t think > of a better group of people to ask! I was wondering if anyone could share > their strategy for DDoS detection and mitigation? We randomly have > troubles with it and as you can imagine it’s quite the pain! > > Thanks in advance! > > d > > > > Dave Williams > > Founder / Visionary > > Revelation Network Management, Inc. > > O: 763.367.6161 > > C: 763.670.5558 > > > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > >

Aug. 1, 2016

Re: DDoS Identification / Mitigation

by Andrew Hoyos

We’ve had great luck with Kentik (https://www.kentik.com/) as a general netflow tool to at least identity DDoS sources/targets (not to mention a very well rounded tool for analyzing flow data coupled with BGP info/sankey diagrams, as well). From a mitigation perspective, hopefully your upstream providers support D/RTBH at a minimum. If they don’t, vote with your wallet and go somewhere that does. Set up your IBGP mesh with a blackhole community and local null routing, with respective policies and communities on your transit edges matching their blackhole communities. In theory, you should be able to add a null route anywhere in your ibgp mesh, and have network wide black holing that also triggers upstream blackholing as well. Ideally, you’d have some sort of standalone trigger router with OOB access that you can use to originate those routes into BGP. Bonus points for automating that process, or giving tech actionable alert to copy/paste into a router. -- Andrew Hoyos hoyosa(a)gmail.com > On Jul 30, 2016, at 4:35 PM, Dave Williams <Dave(a)revnetdata.com> wrote: > > Hi all – I know this isn’t a MICE specific question, but I can’t think of a better group of people to ask! I was wondering if anyone could share their strategy for DDoS detection and mitigation? We randomly have troubles with it and as you can imagine it’s quite the pain! > Thanks in advance! > d > > Dave Williams > Founder / Visionary > Revelation Network Management, Inc. > O: 763.367.6161 > C: 763.670.5558 > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

Aug. 1, 2016

Re: DDoS Identification / Mitigation

by Dave Williams

Steve - that looks like a great thing to start with! Thanks! Sent from my T-Mobile 4G LTE Device -------- Original message -------- From: Steve Howard <showard(a)PAULBUNYAN.NET> Date: 7/30/16 10:18 PM (GMT-06:00) To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] DDoS Identification / Mitigation This isn't exactly a detection/mitigation solution, but we use the CYMRU UTRS service to help us reduce our share of the problem: http://www.team-cymru.org/UTRS/ https://www.cymru.com/jtk/misc/utrs.html I encourage everyone to check it out. It's free, and as more organizations participate it becomes more effective. On Jul 30, 2016, at 15:35, Dave Williams <dave(a)REVNETDATA.COM<mailto:dave@revnetdata.com>> wrote: Hi all – I know this isn’t a MICE specific question, but I can’t think of a better group of people to ask! I was wondering if anyone could share their strategy for DDoS detection and mitigation? We randomly have troubles with it and as you can imagine it’s quite the pain! Thanks in advance! d Dave Williams Founder / Visionary Revelation Network Management, Inc. O: 763.367.6161 C: 763.670.5558 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Aug. 1, 2016

Re: DDoS Identification / Mitigation

by Mike Horwath

On Sat, Jul 30, 2016 at 11:05:48PM -0500, Brady Kittel wrote: > I worked at a shop for a while that used Arbor networks solution > with good success. From what I recall it requires the upstream > carrier to support it so you'd have to see if yours do. I replied offlist to the OP. There are so many ways to operate denial of service attacks. Some of them are bandwidth eating (ICMP, SYN, UDP flooding), some of them attack the assets (HTTP slow accept, high fake query/request, etc). Each of these needs a slightly different approach. Arbor Networks works quite well if both ends have it - very true and also very, very expensive. F5 has stuff built in to protect assets but also can be very expensive. Fortigate firewalls have some decent stuff in them for relegating throughput and dropping bad traffic at the edge but will require some tuning. IPS/IDS is quite good as well. But once the traffic is at your edge, and the attack is to burn your bandwidth, you've already lost. But if application attacks are going on then FGT can help. CloudFlare moves the endpoint into their network and have come a long way since I first learned of them. Think of it as a reverse proxy for HTTP-type termination and your global DNS server. There are so many things that can help mitigate depending on the type of attack - that needs to be determined :) -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

July 31, 2016

Re: DDoS Identification / Mitigation

by Brady Kittel

I worked at a shop for a while that used Arbor networks solution with good success. From what I recall it requires the upstream carrier to support it so you'd have to see if yours do. On Jul 30, 2016 4:35 PM, "Dave Williams" <dave(a)revnetdata.com> wrote: > Hi all – I know this isn’t a MICE specific question, but I can’t think of > a better group of people to ask! I was wondering if anyone could share > their strategy for DDoS detection and mitigation? We randomly have > troubles with it and as you can imagine it’s quite the pain! > > Thanks in advance! > > d > > > > Dave Williams > > Founder / Visionary > > Revelation Network Management, Inc. > > O: 763.367.6161 > > C: 763.670.5558 > > > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

July 31, 2016

Re: DDoS Identification / Mitigation

by Steve Howard

This isn't exactly a detection/mitigation solution, but we use the CYMRU UTRS service to help us reduce our share of the problem: http://www.team-cymru.org/UTRS/ https://www.cymru.com/jtk/misc/utrs.html I encourage everyone to check it out. It's free, and as more organizations participate it becomes more effective. > On Jul 30, 2016, at 15:35, Dave Williams <dave(a)REVNETDATA.COM> wrote: > > Hi all – I know this isn’t a MICE specific question, but I can’t think of a better group of people to ask! I was wondering if anyone could share their strategy for DDoS detection and mitigation? We randomly have troubles with it and as you can imagine it’s quite the pain! > Thanks in advance! > d > > Dave Williams > Founder / Visionary > Revelation Network Management, Inc. > O: 763.367.6161 > C: 763.670.5558 > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

July 31, 2016

DDoS Identification / Mitigation

by Dave Williams

Hi all - I know this isn't a MICE specific question, but I can't think of a better group of people to ask! I was wondering if anyone could share their strategy for DDoS detection and mitigation? We randomly have troubles with it and as you can imagine it's quite the pain! Thanks in advance! d Dave Williams Founder / Visionary Revelation Network Management, Inc. O: 763.367.6161 C: 763.670.5558

July 30, 2016

LTD Broadband 2nd port

by Jason Hanke

LTD Broadband is adding a second MICE connection on the main switch. Their connection on the NP Remote switch will remain. Port: xe-2/0/4 IPv4: 206.108.255.42/24 IPv6: 2001:504:27:0:6:045A::2/64 ASN: 394330 Contact: corey.hauer(a)ltdbroadband.com They will need route server config for this port as well. These ports will NOT be in a LAG group. Welcome Aboard (again)! -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

July 30, 2016

Re: State of MN DNS Issues

by Frank Bulk

Doesn't seem happy: http://dnsviz.net/d/state.mn.us/dnssec/ Frank -----Original Message----- From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Richard Laager Sent: Tuesday, July 19, 2016 6:53 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] State of MN DNS Issues On 07/19/2016 03:42 AM, Richard Laager wrote: > FYI: state.mn.us DNS has broken DNSSEC and broken IPv6. I called > yesterday, and they were aware of the DNSSEC issue. The state says it's good, and it looks good from my perspective again. -- Richard

July 20, 2016

Re: State of MN DNS Issues

by Richard Laager

On 07/19/2016 03:42 AM, Richard Laager wrote: > FYI: state.mn.us DNS has broken DNSSEC and broken IPv6. I called > yesterday, and they were aware of the DNSSEC issue. The state says it's good, and it looks good from my perspective again. -- Richard

July 19, 2016

Fwd: [JPTECHS] Fwd: [MICE-DISCUSS] State of MN DNS Issues

by David Farmer

I forwarded this off to the guys at the state, here is a response. Thanks ---------- Forwarded message ---------- From: Reilly, Russ (MNIT) <russ.reilly(a)state.mn.us> Date: Tue, Jul 19, 2016 at 9:19 AM Subject: Re: Fwd: [MICE-DISCUSS] State of MN DNS Issues Thanks, we are aware of some complaints and working the issue. Something possibly related to how IPv6 was enable on the Infoblox and the various addresses. Comcast was broke Saturday and we got that fixed so it seems there are just oddities in various resolvers we are working through this with Infoblox. *Russ Reilly* | Network Support, network Support Manager MN.IT Services, State of Minnesota 651-201-1022 (w) *| * russ.reilly(a)state.mn.us *[image: Title: MN.IT Services logo - Description: MN.IT Services logo]* <http://www.mn.gov/oet> Information Technology for Minnesota Government *|* mn.gov/mnit <http://www.mn.gov/oet> Begin forwarded message: *From:* Doug McIntyre <merlyn(a)IPHOUSE.NET <merlyn(a)iphouse.net>> *Date:* July 19, 2016 at 08:51:27 CDT *To:* MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)lists.iphouse.net> *Subject:* *Re: [MICE-DISCUSS] State of MN DNS Issues* *Reply-To:* MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)lists.iphouse.net>> On Tue, Jul 19, 2016 at 03:42:13AM -0500, Richard Laager wrote: FYI: state.mn.us DNS has broken DNSSEC and broken IPv6. I called yesterday, and they were aware of the DNSSEC issue. I had to push out the early beta BIND 9.11 out to production so I could use the new Negative Trust anchor option for them on my frontline resolvers. rndc nta state.mn.us [view] I think only BIND based resolvers thought it was an error though. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades -- =============================================== David Farmer Email:farmer@umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 ===============================================

July 19, 2016