Re: Tata Scenic routing in LAX area?

2018-11-15 Thread John Weekes
Marcus, From route-views output, it looks like AS9498/airtel is probably leaking your route between two of its upstreams (AS6453/Tata and AS4637/Telstra) overseas, funneling some of your traffic through their router. route-views>sh ip bgp 23.92.178.22 | i 9498   3356 6453 9498 4637 29791  

Re: Amazon network engineering contact? re: DDoS traffic

2018-11-08 Thread John Weekes
On Behalf Of John Weekes Sent: Thursday, November 08, 2018 14:44 To: nanog@nanog.org Subject: Amazon network engineering contact? re: DDoS traffic We've been seeing significant attack activity from Amazon over the last two months, involving apparently compromised instances that commonly send 1-10G

Amazon network engineering contact? re: DDoS traffic

2018-11-08 Thread John Weekes
We've been seeing significant attack activity from Amazon over the last two months, involving apparently compromised instances that commonly send 1-10G of traffic per source and together generate Nx10G of total traffic. Even when our overall upstream capacity exceeds an attack's overall size,

Re: Spitballing IoT Security

2016-10-30 Thread John Weekes
On 10/29/2016 9:43 PM, Eric S. Raymond wrote: I in turn have to call BS on this. If it were really that easy, we'd be inundated by Mirais -- we'd have several attacks a*day*. Some of us are seeing many significant attacks a day. That's because botnets are frequently used to hit game servers

Re: Death of the Internet, Film at 11

2016-10-25 Thread John Weekes
On 10/24/2016 9:37 PM, b...@theworld.com wrote: As I've suggested before how much would you attribute this to a lack of English skills by recipients? I do not think that is a significant factor. Here are some points along those lines: - ab...@cnc-noc.net times out. It's not a matter of

Re: Death of the Internet, Film at 11

2016-10-23 Thread John Weekes
On 10/23/2016 4:19 PM, Ronald F. Guilmette wrote: ... I've recorded about 2.4 million IP addresses involved in the last two months (a number that is higher than the number of actual devices, since most seem to have dynamic IP addresses). The ISPs behind those IP addresses have received

Re: Death of the Internet, Film at 11

2016-10-22 Thread John Weekes
Ok, so this mailing list is a list of network operators. Swell. Every network operator who can do so, please raise your hand if you have *recently* scanned you own network and if you can -honestly- attest that you have taken all necessary steps to insure that none of the numerous specific

Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours

2015-07-20 Thread John Weekes
Ca, Folks, it may be time to take the next step and admit that UDP is too broken to support https://tools.ietf.org/html/draft-byrne-opsec-udp-advisory-00 Your comments have been requested My comment would be that UDP is still widely used for game server traffic. This is unlikely to change

Re: Cogent / Internap issue ??

2014-05-27 Thread John Weekes
On 5/27/2014 11:24 AM, Matthew Huff wrote: We are having troubles reaching services on the other side of cogent/internap peering. Anyone else seeing issues? We haven't seen Cogent-related issues at SEF today and that IP address is currently pingable through the Cogent looking glass. From

Re: Filter NTP traffic by packet size?

2014-02-20 Thread John Weekes
On 2/20/2014 12:41 PM, Edward Roels wrote: Curious if anyone else thinks filtering out NTP packets above a certain packet size is a good or terrible idea. From my brief testing it seems 90 bytes for IPv4 and 110 bytes for IPv6 are typical for a client to successfully synchronize to an NTP