- eix-wg - mailman.ripe.net

RIPE EIX-WG: Attributing inbound traffic
by Steve Nash 25 Feb '13

25 Feb '13

Bad traffic is coming into my IX Peering interface. How do I find out where that bad traffic is coming from? How do I get it to stop? Customers of Internet Exchanges get a good deal on peering. Life is easy. Until something goes wrong. DDoS traffic starts coming into the IX interface.. I work for Arbor Networks and I have seen such questions many times. cFlow, Netflow, IPFIX can show that there is anomalous traffic arriving, but not where it is coming from (last hop). I have a suggestion and I would like to know if it is already in use, or considered of any use.. The answers are in Layer-2, of course. The MAC addresses identify which of the routers of my Peers actually transmitted a packet to my router. Problems: 1/ I could try to tap off the interface and get a packet trace, but I have to capture and identify a sample of the offending traffic, 2/ My peering router generates Netflow/IPFIX, but only populates Layer-3 data. Even if it did populate field 56 - Src MAC.. 3/ In either case I need to get into the ARP cache to figure out which IP address the MAC address belongs to.. Suggestion: Ask all IX customers to Embed the ASN into a Locally Administered MAC address on each peering interface. First byte for Local flag, second byte for interface number, others for four-byte ASN 02:00:00:00:01:00 for ASN 256 02:00:00:00:04:F9 for ASN 1273 (first interface) 02:01:00:00:04:F9 for ASN 1273 (second interface) Now, if all peers have their router interfaces configured with these Local MAC Addresses, then a customer can capture the traffic and very quickly extract the identity of each Peer that is sending packets. And peers can change their router hardware and still transmit from the same MAC address. Also, if I can get a peering Router to populate the Src MAC field of IPFIX and Netflow then I can start monitoring it all with flow reporting tools. Such MAC level encoding of ASN could be part of the peering agreement between organisations, or part of the requirement to connect to an IX RouteReflector. Even as a voluntary recommendation it could cut down the workload of identifying where traffic is coming from. I would appreciate your comments. I know that I am coming from the monitoring angle and have had few dealing with the business of an IX, so you may have tried and rejected such things. I'll be in Dublin too, if a discussion is worthwhile. Regards Steve Nash

2 1

IPv6 Link Local Addressing on IXPs?
by Michael Behringer (mbehring) 23 Nov '12

23 Nov '12

EIX WG, Eric and myself have put together an internet draft on the usage of IPv6 link local addressing on infrastructure links. The goal is to document what works and what doesn't when you only have IP6 link local addresses on such links. We were pointed to the fact that this question is also arising for IXPs, and have now tried to capture the high level view for IXPs. We'd appreciate feedback on our draft, specifically section 2.4 http://tools.ietf.org/html/draft-ietf-opsec-lla-only-02 Please let us know how we can improve the draft, specifically this section. Any feedback is welcome. If you are "okay" with the current draft, a quick note would also help us. Thanks! Eric and Michael

3 2

New on RIPE Labs: IXP Traffic Levels During Stratos Skydive
by Mirjam Kuehne 19 Oct '12

19 Oct '12

Dear colleagues, In this new post on RIPE Labs we take a look at IXP traffic levels during Felix Baumgartner's 39-kilometre jump to Earth: https://labs.ripe.net/Members/fergalc/ixp-traffic-during-stratos-skydive Kind regards, Mirjam Kuehne RIPE NCC

1 0

Call for presentation: ENOG 4, Moscow 23-24 October
by Maxim Tuliuk 03 Oct '12

03 Oct '12

Guys, Twice per year RIPE NCC organises an ENOG meeting in one of former Soviet Union countries. The next one will be 23-24 October in Moscow: http://www.enog.org/meetings/enog-4/ We have a panel about IPX and if you would like to make a presentation please apply either via the web-site or send it to me (I'm a member of Program Committee). I apologise for informing just 3 weeks in advance and if this October is too late for you. The next meeting will be in the next May-June and we'll be glad to hear new presenters. Best wishes, Maxim Tuliuk

1 1

Re: [eix-wg] [ripe.net #1060311] [ws] EIX-WG Agenda RIPE65 - Final Version
by Fearghas McKay 25 Sep '12

25 Sep '12

Marita Yes the two Ks were an error. Thanks for the quick turn around. f Sent from a random mobile device with reusable electrons! On 25 Sep 2012, at 11:19, "Marita Phelan" <webmaster(a)ripe.net> wrote: > On Tue Sep 25 11:06:40 2012, fearghas(a)gmail.com wrote: >> Hello >> >> Here is the final agenda for the EIX meeting on 09:00 - 12:30 >> Wednesday 26 September 2012 at RIPE65. >> >> The meeting will be webcast and archived. > > > Hi Fearghas, > > I've updated the meeting agenda. I take it that 2x K was a typo in the > list of talks, so I changed one of them to J. If that is incorrect, > please let me know. > > Cheers, > > /marita > > >> >> A. Meeting Admin >> >> Scribes >> Agenda bashing >> Approval of previous minutes >> >> B. Overview of the local peering scene lead by NL-IX >> >> C. The sense of distributed Internet exchanges – NL-IX >> >> D. Analysis of Query SRC and Anycast locations – Kurtis Lindqvist >> >> E. IXP Traffic During Major Sport Events - Mirjam Kuehne` >> >> F. AMS-IX IPv6 Day Before & After - Maxim Tuliuk >> >> G. AMS-IX collaborative model - Cara Mascini >> >> Coffee Break >> >> H. IXP Wish List Status Update >> >> I. Euro-IX Update - Bijal Sanghani >> >> K. Bird Update - Ondrej Filip >> >> K. Quagga Update >> >> L. Content caching/CDN sharing for small ISPs at IXPs - Toshinori Ishii >> >> M. Remote Peering - Zaid Ali` >> >> N. Lesotho Internet Exchange Point - Puseletso Putsoane >> >> O. IXP 30 sec updates >> >> CIXP >> >> P. AOCB > > > -- > Cheers, > > /marita > > -- > > Marita Phelan > RIPE NCC Content Webmaster >

1 0

EIX-WG Agenda RIPE65 - Final Version
by Fearghas Mckay 25 Sep '12

25 Sep '12

Hello Here is the final agenda for the EIX meeting on 09:00 - 12:30 Wednesday 26 September 2012 at RIPE65. The meeting will be webcast and archived. A. Meeting Admin Scribes Agenda bashing Approval of previous minutes B. Overview of the local peering scene lead by NL-IX C. The sense of distributed Internet exchanges – NL-IX D. Analysis of Query SRC and Anycast locations – Kurtis Lindqvist E. IXP Traffic During Major Sport Events - Mirjam Kuehne` F. AMS-IX IPv6 Day Before & After - Maxim Tuliuk G. AMS-IX collaborative model - Cara Mascini Coffee Break H. IXP Wish List Status Update I. Euro-IX Update - Bijal Sanghani K. Bird Update - Ondrej Filip K. Quagga Update L. Content caching/CDN sharing for small ISPs at IXPs - Toshinori Ishii M. Remote Peering - Zaid Ali` N. Lesotho Internet Exchange Point - Puseletso Putsoane O. IXP 30 sec updates CIXP P. AOCB

2 1

Draft Agenda - EIX-WG RIPE65
by Fearghas McKay 13 Sep '12

13 Sep '12

Greetings Here is our draft agenda for RIPE65, Okura Hotel, Amsterdam, Wednesday 26th 2012, 9am - 12:30 We still have some slots available for presentations that cover operational issues for and around IXPs. Please send a short summary to <eix-wg-chairs(a)ripe.net> Thanks Fearghas & Andy A Meeting Admin Scribes Agenda Bashing Approval of previous minutes B Overview of the local Peering Scene lead by NL-IX C NL-IX - The sense of distributed Internet exchanges D Kurtis Lindqvist - Analysis of Query SRC and Anycast locations (25 Mins) E RIPE Atlas IXP Update F IXP Wish List - Status Update G Euro-IX Update H IXP 30 sec updates I AOCB

2 2

New on RIPE Labs: Internet Traffic During the Olympics 2012
by Mirjam Kuehne 04 Sep '12

04 Sep '12

Dear all, Following on from the reporting we did during the Euro 2012 together with Euro-IX and a number of participating IXPs, we also took a look at the traffic at Internet Exchanges during the Olympics. The article is available on RIPE Labs: https://labs.ripe.net/Members/fergalc/internet-traffic-during-olympics-2012 If you have any questions or comments, please feel free to leave a comment under the article or contact me directly. Kind Regards, Mirjam Kuehne RIPE NCC

1 0

New on RIPE Labs: Internet Traffic During Euro 2012 - Final Conclusions
by Mirjam Kuehne 13 Jul '12

13 Jul '12

Dear colleagues, This is the last in a series of articles in which we looked at traffic statistics at Internet Exchange Points during the European Championship 2012. This time we looked at IXP traffic during the semi-finals and the final. In addition we also look back over the entire 5 weeks of matches and draw some conclusions. https://labs.ripe.net/Members/fergalc/internet-traffic-during-euro-2012-fin… Kind regards, Mirjam Kuehne RIPE NCC

2 1

New on RIPE Labs: Internet Traffic During Euro 2012 - Group Stages
by Mirjam Kuehne 27 Jun '12

27 Jun '12

Dear colleagues, In the third article of this series we're looking at some interesting traffic graphs seen at IXPs at the end of the group stages of the European Football Championship. https://labs.ripe.net/Members/fergalc/internet-traffic-during-euro-2012-gro… Kind regards, Mirjam Kuehne RIPE NCC

1 1