- mice-discuss - lists.micemn.net

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Brian Riggleman

We also lost google related sites from 6:50 PM until 7:18 PM. I also was unable to explain this. Brian Riggleman Network Administrator Jaguar Communications 507-214-0258 briggleman(a)jagcom.net On Thu, Jun 20, 2019 at 12:33 PM Jeff Wilde <jeff.wilde(a)parkregion.com> wrote: > No lost icmp to google and others allegedly but I'm not finding anything. > > Jeff Wilde > IT Manager > Park Region Telephone Company > P: 218-826-8330 > E: jeff.wilde(a)parkregion.com > > -----Original Message----- > From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Mike > Horwath > Sent: Thursday, June 20, 2019 12:32 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET > Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic > > On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: > > On a separate note, did anyone experience very intermittent Internet > > issues last night for about 30 minutes or so? > > You mean for Hulu and Netflix going down? :) > > -- > Mike Horwath, reachable via drechsau(a)Geeks.ORG >

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Jeff Wilde

No lost icmp to google and others allegedly but I'm not finding anything. Jeff Wilde IT Manager Park Region Telephone Company P: 218-826-8330 E: jeff.wilde(a)parkregion.com -----Original Message----- From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Mike Horwath Sent: Thursday, June 20, 2019 12:32 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: > On a separate note, did anyone experience very intermittent Internet > issues last night for about 30 minutes or so? You mean for Hulu and Netflix going down? :) -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Mike Horwath

On Thu, Jun 20, 2019 at 05:30:40PM +0000, Jeff Wilde wrote: > On a separate note, did anyone experience very intermittent Internet > issues last night for about 30 minutes or so? You mean for Hulu and Netflix going down? :) -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Mike Horwath

On Thu, Jun 20, 2019 at 11:48:13AM -0500, Andrew Hoyos wrote: > SIX, as an example, has a blackhole IP address, and the route > servers matching a blackhole community to set next hop to this to > sink the traffic on the switch fabric. Perhaps something we should > look into for MICE. A good idea - perahps use a specific community advertisement with correct next-hop into the ether. Then folks can subscribe as needed. You can even automate a few things as well from known blacklists, then another system to accept new networks to be reviewed then blackholed for <period of time>. -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Jeff Wilde

On a separate note, did anyone experience very intermittent Internet issues last night for about 30 minutes or so? Jeff Wilde IT Manager Park Region Telephone Company P: 218-826-8330 E: jeff.wilde(a)parkregion.com<mailto:jeff.wilde@parkregion.com> From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Andrew Hoyos Sent: Thursday, June 20, 2019 11:48 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] ADV: [MICE-DISCUSS] Blackholing DoS traffic On Jun 20, 2019, at 11:39 AM, Doug McIntyre <merlyn(a)IPHOUSE.NET<mailto:merlyn@IPHOUSE.NET>> wrote: On Thu, Jun 20, 2019 at 04:33:12PM +0000, Frank Bulk wrote: https://www.seattleix.net/blackholing Does MICE have an blackholng functionality equivalent to SIX? I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. You can adjust the routing with communities, ie. in the MICE communities aera of http://micemn.net/technical.html you could block-hole the AS that is sending you that traffic. unfortunately, that just has the effect of traffic going elsewhere - not a blackhole effect. the communities in place would just cause the route not to be advertised to said peer, and the traffic would just ingress your network via a different path. In the case of a DDOS, it’s likely you have multiple ASN’s targeting you. https://www.seattleix.net/blackholing SIX, as an example, has a blackhole IP address, and the route servers matching a blackhole community to set next hop to this to sink the traffic on the switch fabric. Perhaps something we should look into for MICE. — Andrew Hoyos hoyosa(a)gmail.com<mailto:hoyosa@gmail.com> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Andrew Hoyos

On Jun 20, 2019, at 11:39 AM, Doug McIntyre <merlyn(a)IPHOUSE.NET> wrote: > On Thu, Jun 20, 2019 at 04:33:12PM +0000, Frank Bulk wrote: >> https://www.seattleix.net/blackholing >> >> Does MICE have an blackholng functionality equivalent to SIX? >> >> I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. > > > You can adjust the routing with communities, ie. in the MICE communities aera of > http://micemn.net/technical.html > > you could block-hole the AS that is sending you that traffic. unfortunately, that just has the effect of traffic going elsewhere - not a blackhole effect. the communities in place would just cause the route not to be advertised to said peer, and the traffic would just ingress your network via a different path. In the case of a DDOS, it’s likely you have multiple ASN’s targeting you. https://www.seattleix.net/blackholing <https://www.seattleix.net/blackholing> SIX, as an example, has a blackhole IP address, and the route servers matching a blackhole community to set next hop to this to sink the traffic on the switch fabric. Perhaps something we should look into for MICE. — Andrew Hoyos hoyosa(a)gmail.com

June 20, 2019

Re: ADV: [MICE-DISCUSS] Blackholing DoS traffic

by Doug McIntyre

On Thu, Jun 20, 2019 at 04:33:12PM +0000, Frank Bulk wrote: >https://www.seattleix.net/blackholing > >Does MICE have an blackholng functionality equivalent to SIX? > >I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. You can adjust the routing with communities, ie. in the MICE communities aera of http://micemn.net/technical.html you could block-hole the AS that is sending you that traffic. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

June 20, 2019

Blackholing DoS traffic

by Frank Bulk

https://www.seattleix.net/blackholing Does MICE have an blackholng functionality equivalent to SIX? I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. Regards, Frank

June 20, 2019

Re: Bi-lateral peering with Yahoo!

by Frank Bulk

Thanks, Jay. I saw service return Monday evening. Frank From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Jay Hanke Sent: Monday, June 17, 2019 5:25 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Bi-lateral peering with Yahoo! I opened ticket # PTKT1583794 with Yahoo/Oath regarding the LoS. Jay On Fri, Jun 14, 2019 at 6:01 PM Jay Hanke <jayhanke(a)southfront.io<mailto:jayhanke@southfront.io>> wrote: Looks like 1 of 2 Oath links are down. On Fri, Jun 14, 2019 at 5:47 PM Andrew Hoyos <hoyosa(a)gmail.com<mailto:hoyosa@gmail.com>> wrote: Same here: Jun 14 20:12:13 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: NOTIFICATION sent to 2001:504:27::2846:0:1 (External AS 10310): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 2001:504:27::2846:0:1 (External AS 10310), socket buffer sndcc: 38 rcvcc: 0 TCP state: 4, snd_una: 715538896 snd_nxt: 715538934 snd_wnd: 16384 rcv_nxt: 937051995 rcv_adv: 937068379, hold timer 90s, hold timer remain 0s, last sent 26s, TCP port (local 60544, remote 179) Jun 14 20:12:30 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: NOTIFICATION sent to 206.108.255.58 (External AS 10310): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 206.108.255.58 (External AS 10310), socket buffer sndcc: 57 rcvcc: 0 TCP state: 4, snd_una: 3794713179 snd_nxt: 3794713236 snd_wnd: 16384 rcv_nxt: 58606928 rcv_adv: 58623312, hold timer 90s, hold timer remain 0s, last sent 22s, TCP port (local 179, remote 65426) — Andrew Hoyos hoyosa(a)gmail.com<mailto:hoyosa@gmail.com> > On Jun 14, 2019, at 5:44 PM, Frank Bulk <fbulk(a)MYPREMIERONLINE.COM<mailto:fbulk@MYPREMIERONLINE.COM>> wrote: > > I assume some others are seeing the same, that peering with one of Yahoo!'s IPs has been down since just before 3:45 pm? > > Host premier.sxct-north.fbnt.netins.net<https://urldefense.proofpoint.com/v2/url?u=http-3A__premier.sxct-2Dnorth.fb…> [207.32.15.28] with interface to BGP peer AS10310-1.micemn.net<https://urldefense.proofpoint.com/v2/url?u=http-3A__AS10310-2D1.micemn.net&…> [206.108.255.58/AS<https://urldefense.proofpoint.com/v2/url?u=http-3A__206.108.255.58_AS&d=DwM…> 10310 (Oath Holdings Inc., US)]: the BGP peer state is in state connect > > Frank -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io<mailto:jayhanke@southfront.io> Phone 612-204-0000 -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io<mailto:jayhanke@southfront.io> Phone 612-204-0000 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.iphouse.net_cgi-2…>

June 19, 2019

Re: Bi-lateral peering with Yahoo!

by Jay Hanke

I opened ticket # PTKT1583794 with Yahoo/Oath regarding the LoS. Jay On Fri, Jun 14, 2019 at 6:01 PM Jay Hanke <jayhanke(a)southfront.io> wrote: > Looks like 1 of 2 Oath links are down. > > On Fri, Jun 14, 2019 at 5:47 PM Andrew Hoyos <hoyosa(a)gmail.com> wrote: > >> Same here: >> >> Jun 14 20:12:13 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: >> NOTIFICATION sent to 2001:504:27::2846:0:1 (External AS 10310): code 4 >> (Hold Timer Expired Error), Reason: holdtime expired for >> 2001:504:27::2846:0:1 (External AS 10310), socket buffer sndcc: 38 rcvcc: 0 >> TCP state: 4, snd_una: 715538896 snd_nxt: 715538934 snd_wnd: 16384 rcv_nxt: >> 937051995 rcv_adv: 937068379, hold timer 90s, hold timer remain 0s, last >> sent 26s, TCP port (local 60544, remote 179) >> >> Jun 14 20:12:30 er1.511.msp rpd[1832]: bgp_hold_timeout:4677: >> NOTIFICATION sent to 206.108.255.58 (External AS 10310): code 4 (Hold Timer >> Expired Error), Reason: holdtime expired for 206.108.255.58 (External AS >> 10310), socket buffer sndcc: 57 rcvcc: 0 TCP state: 4, snd_una: 3794713179 >> snd_nxt: 3794713236 snd_wnd: 16384 rcv_nxt: 58606928 rcv_adv: 58623312, >> hold timer 90s, hold timer remain 0s, last sent 22s, TCP port (local 179, >> remote 65426) >> >> — >> Andrew Hoyos >> hoyosa(a)gmail.com >> >> >> >> > On Jun 14, 2019, at 5:44 PM, Frank Bulk <fbulk(a)MYPREMIERONLINE.COM> >> wrote: >> > >> > I assume some others are seeing the same, that peering with one of >> Yahoo!'s IPs has been down since just before 3:45 pm? >> > >> > Host premier.sxct-north.fbnt.netins.net [207.32.15.28] with interface >> to BGP peer AS10310-1.micemn.net [206.108.255.58/AS 10310 (Oath Holdings >> Inc., US)]: the BGP peer state is in state connect >> > >> > Frank >> > > > -- > Jay Hanke, President > South Front Networks > jayhanke(a)southfront.io > Phone 612-204-0000 > -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

June 17, 2019