February 2013 - mat-wg - mailman.ripe.net

[MAT-WG]: Attributing inbound traffic from an IX
by Steve Nash 25 Feb '13

25 Feb '13

[This email has also gone to the EIX-WG ] Bad traffic is coming into my IX Peering interface. How do I find out where that bad traffic is coming from? How do I get it to stop? Customers of Internet Exchanges get a good deal on peering. Life is easy. Until something goes wrong. DDoS traffic starts coming into the IX interface.. I work for Arbor Networks and I have seen such questions many times. cFlow, Netflow, IPFIX can show that there is anomalous traffic arriving, but not where it is coming from (last hop). I have a suggestion and I would like to know if it is already in use, or considered of any use.. The answers are in Layer-2, of course. The MAC addresses identify which of the routers of my Peers actually transmitted a packet to my router. Problems: 1/ I could try to tap off the interface and get a packet trace, but I have to capture and identify a sample of the offending traffic, 2/ My peering router generates Netflow/IPFIX, but only populates Layer-3 data. Even if it did populate field 56 - Src MAC.. 3/ In either case I need to get into the ARP cache to figure out which IP address the MAC address belongs to.. Suggestion: Ask all IX customers to Embed the ASN into a Locally Administered MAC address on each peering interface. First byte for Local flag, second byte for interface number, others for four-byte ASN 02:00:00:00:01:00 for ASN 256 02:00:00:00:04:F9 for ASN 1273 (first interface) 02:01:00:00:04:F9 for ASN 1273 (second interface) Now, if all peers have their router interfaces configured with these Local MAC Addresses, then a customer can capture the traffic and very quickly extract the identity of each Peer that is sending packets. And peers can change their router hardware and still transmit from the same MAC address. Also, if I can get a peering Router to populate the Src MAC field of IPFIX and Netflow then I can start monitoring it all with flow reporting tools. Such MAC level encoding of ASN could be part of the peering agreement between organisations, or part of the requirement to connect to an IX RouteReflector. Even as a voluntary recommendation it could cut down the workload of identifying where traffic is coming from. I would appreciate your comments. I'll be in Dublin too, if a discussion is worthwhile. Regards Steve Nash

1 0

Call for Papers: RIPE 66, 13-17 May 2013 in Dublin, Ireland
by Benno Overeinder 22 Feb '13

22 Feb '13

Call for Papers: RIPE 66 A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 66 will take place on 13-17 May 2013 in Dublin, Ireland. https://ripe66.ripe.net/ The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the Plenary, BoF and Tutorial sessions at RIPE 66. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity in operations - Commercial transactions of IPv4 addresses - Data center technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange Submissions Attendees of the RIPE meetings are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. Presenters who are proposing a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. In addition to presentations selected in advance for the Plenary, the RIPE PC also offers several time slots for “lightning talks” which are selected immediately before or during the conference. The following requirements apply: - Proposals for Plenary talks, BoFs, Panels and Tutorials must be submitted for full consideration no later than 24 February 2013, using the meeting submission system at: https://meetings.ripe.net/pc/ Proposals submitted after this date will be considered on a space-available basis. - Presenters should indicate how much time they will require (30 minutes for talks is a common maximum duration, although some talks can be longer). - Proposals for talks will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For BoFs and panels, proposals must contain a clear description as well as names of invited panelists/presenters. - Due to potential technical issues, it is expected that most if not all presenters/panelists will be physically present at the RIPE meeting. - Lightning talks should be submitted using the meeting submission system. They must be short (10 minutes maximum) and often involve more timely topics. They can be submitted at any time. The allocation of lightning talk slots will be announced one day prior to the relevant session. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat
by Mirjam Kuehne 19 Feb '13

19 Feb '13

[apologies for duplicates] Dear colleagues, We implemented a new widget in RIPEstat that allows you to find abuse contact information registered in the RIPE Database. Please find more information on RIPE Labs: https://labs.ripe.net/Members/cteusche/finding-anti-abuse-contact-informati… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Phase 1 of RIPE Atlas Anchors pilot - report on RIPE Labs
by Vesna Manojlovic 15 Feb '13

15 Feb '13

Dear community, [apologies for the duplicates] we just published an article on RIPE Labs with the status & features available for the hosts of RIPE Atlas Anchor boxes after the Phase 1: https://labs.ripe.net/Members/becha/ripe-atlas-anchors-pilot-update-on-phas… Share and enjoy :) Vesna

1 0

New on RIPE Labs: Country Specific Graphs in RIPEstat
by Mirjam Kuehne 06 Feb '13

06 Feb '13

[apologies for duplicates] Dear colleagues, We developed additional functionality in RIPEstat that shows various datasets by country. A new widget called Country Routing Statistics is now available, along with the ability to compare the situation in different countries side by side. Please find more details on RIPE Labs: https://labs.ripe.net/Members/cteusche/country-specific-graphs-in-ripestat Kind regards, Mirjam Kuehne RIPE NCC

1 0

New RIPE Atlas features released in January, and other news
by Vesna Manojlovic 01 Feb '13

01 Feb '13

Dear colleagues, today's RIPE Labs article describes new release of RIPE Atlas, as well as other community news: https://labs.ripe.net/Members/becha/ripe-atlas-january-2013-achievements Looking forward to hear from you, regards, Vesna -- Vesna Manojlovic BECHA(a)ripe.net Senior Community Builder @Ms_Measurements for Measurements Tools RIPE NCC http://ripe.net

1 0