- mat-wg - mailman.ripe.net

[MAT-WG]: Attributing inbound traffic from an IX
by Steve Nash 25 Feb '13

25 Feb '13

[This email has also gone to the EIX-WG ] Bad traffic is coming into my IX Peering interface. How do I find out where that bad traffic is coming from? How do I get it to stop? Customers of Internet Exchanges get a good deal on peering. Life is easy. Until something goes wrong. DDoS traffic starts coming into the IX interface.. I work for Arbor Networks and I have seen such questions many times. cFlow, Netflow, IPFIX can show that there is anomalous traffic arriving, but not where it is coming from (last hop). I have a suggestion and I would like to know if it is already in use, or considered of any use.. The answers are in Layer-2, of course. The MAC addresses identify which of the routers of my Peers actually transmitted a packet to my router. Problems: 1/ I could try to tap off the interface and get a packet trace, but I have to capture and identify a sample of the offending traffic, 2/ My peering router generates Netflow/IPFIX, but only populates Layer-3 data. Even if it did populate field 56 - Src MAC.. 3/ In either case I need to get into the ARP cache to figure out which IP address the MAC address belongs to.. Suggestion: Ask all IX customers to Embed the ASN into a Locally Administered MAC address on each peering interface. First byte for Local flag, second byte for interface number, others for four-byte ASN 02:00:00:00:01:00 for ASN 256 02:00:00:00:04:F9 for ASN 1273 (first interface) 02:01:00:00:04:F9 for ASN 1273 (second interface) Now, if all peers have their router interfaces configured with these Local MAC Addresses, then a customer can capture the traffic and very quickly extract the identity of each Peer that is sending packets. And peers can change their router hardware and still transmit from the same MAC address. Also, if I can get a peering Router to populate the Src MAC field of IPFIX and Netflow then I can start monitoring it all with flow reporting tools. Such MAC level encoding of ASN could be part of the peering agreement between organisations, or part of the requirement to connect to an IX RouteReflector. Even as a voluntary recommendation it could cut down the workload of identifying where traffic is coming from. I would appreciate your comments. I'll be in Dublin too, if a discussion is worthwhile. Regards Steve Nash

1 0

Call for Papers: RIPE 66, 13-17 May 2013 in Dublin, Ireland
by Benno Overeinder 22 Feb '13

22 Feb '13

Call for Papers: RIPE 66 A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 66 will take place on 13-17 May 2013 in Dublin, Ireland. https://ripe66.ripe.net/ The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the Plenary, BoF and Tutorial sessions at RIPE 66. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity in operations - Commercial transactions of IPv4 addresses - Data center technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange Submissions Attendees of the RIPE meetings are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. Presenters who are proposing a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. In addition to presentations selected in advance for the Plenary, the RIPE PC also offers several time slots for “lightning talks” which are selected immediately before or during the conference. The following requirements apply: - Proposals for Plenary talks, BoFs, Panels and Tutorials must be submitted for full consideration no later than 24 February 2013, using the meeting submission system at: https://meetings.ripe.net/pc/ Proposals submitted after this date will be considered on a space-available basis. - Presenters should indicate how much time they will require (30 minutes for talks is a common maximum duration, although some talks can be longer). - Proposals for talks will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For BoFs and panels, proposals must contain a clear description as well as names of invited panelists/presenters. - Due to potential technical issues, it is expected that most if not all presenters/panelists will be physically present at the RIPE meeting. - Lightning talks should be submitted using the meeting submission system. They must be short (10 minutes maximum) and often involve more timely topics. They can be submitted at any time. The allocation of lightning talk slots will be announced one day prior to the relevant session. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat
by Mirjam Kuehne 19 Feb '13

19 Feb '13

[apologies for duplicates] Dear colleagues, We implemented a new widget in RIPEstat that allows you to find abuse contact information registered in the RIPE Database. Please find more information on RIPE Labs: https://labs.ripe.net/Members/cteusche/finding-anti-abuse-contact-informati… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Phase 1 of RIPE Atlas Anchors pilot - report on RIPE Labs
by Vesna Manojlovic 15 Feb '13

15 Feb '13

Dear community, [apologies for the duplicates] we just published an article on RIPE Labs with the status & features available for the hosts of RIPE Atlas Anchor boxes after the Phase 1: https://labs.ripe.net/Members/becha/ripe-atlas-anchors-pilot-update-on-phas… Share and enjoy :) Vesna

1 0

New on RIPE Labs: Country Specific Graphs in RIPEstat
by Mirjam Kuehne 06 Feb '13

06 Feb '13

[apologies for duplicates] Dear colleagues, We developed additional functionality in RIPEstat that shows various datasets by country. A new widget called Country Routing Statistics is now available, along with the ability to compare the situation in different countries side by side. Please find more details on RIPE Labs: https://labs.ripe.net/Members/cteusche/country-specific-graphs-in-ripestat Kind regards, Mirjam Kuehne RIPE NCC

1 0

New RIPE Atlas features released in January, and other news
by Vesna Manojlovic 01 Feb '13

01 Feb '13

Dear colleagues, today's RIPE Labs article describes new release of RIPE Atlas, as well as other community news: https://labs.ripe.net/Members/becha/ripe-atlas-january-2013-achievements Looking forward to hear from you, regards, Vesna -- Vesna Manojlovic BECHA(a)ripe.net Senior Community Builder @Ms_Measurements for Measurements Tools RIPE NCC http://ripe.net

1 0

New on RIPE Labs: Access RIPE Atlas via LIR Portal
by Mirjam Kuehne 22 Jan '13

22 Jan '13

[apologies for duplicates] Dear colleagues, You can now access RIPE Atlas via the LIR Portal. Please find more information on RIPE Labs: https://labs.ripe.net/Members/becha/ripe-atlas-via-lir-portal Kind Regards, Mirjam Kuehne RIPE NCC

1 0

RIPE Atlas in 2012: achievements and acknowledgments
by Vesna Manojlovic 16 Jan '13

16 Jan '13

Dear colleagues, thanks to the involvement of RIPE Atlas community, we have reached many milestones this year, and enabled RIPE NCC membership, and Internet community to use RIPE Atlas in order to measure speed and performance of their networks, and to look at the "health of the Internet" in this eventful year. We are grateful to the members, hosts, sponsors and all users. Please see the story of the RIPE Atlas achievements in this RIPE Labs article: https://labs.ripe.net/Members/becha/ripe-atlas-2012-a-year-in-review Regards, Vesna -- Vesna Manojlovic BECHA(a)ripe.net Senior Community Builder @Ms_Measurements for Measurements Tools RIPE NCC http://ripe.net

1 0

New on RIPE Labs: RIPEstat 2012 Year in Review
by Suzanne Taylor Muzzin 07 Jan '13

07 Jan '13

Dear colleagues, Please find on RIPE Labs a review of all the developments that took place with RIPEstat during 2012: https://labs.ripe.net/Members/suzanne_taylor_muzzin/ripestat-2012-year-in-r… This includes new widgets developed, the new user interface, the new text service, better data integration, improved functionality and more. In addition, we give a sneak peak of the developments we'll be working on during 2013. Kind regards, Suzanne Taylor Muzzin RIPE NCC

1 0

Deadline Extension: TRAC 2013 4th International Workshop on Traffic Analysis and Classification
by Sandrine VATON 29 Dec '12

29 Dec '12

******************************************************************************* CALLFORPAPERS ******************************************************************************* TRAC2013 4th International Workshop on TRaffic Analysis and Classification IEEE sponsored July 1-5, 2013, Cagliari, Italy http://netgroup.iet.unipi.it/trac2013 co-located with IWCMC 2013 (http://iwcmc.org/2013/) CALLFORPAPERS Brief description ----------------- The evolution of the Internet in the last few years has been characterized by dramatic changes to the way users behave, interact and utilize the network. The rapid introduction of new categories of applications such as network games and peer-to-peer, the increasing presence of malicious traffic, and the widespread use of encryption techniques, make the measurement, analysis and classification of Internet traffic a challenging task. The research community and many network operators are responding to these changes by designing and deploying traffic measurement and classification architectures of increasing complexity. Such activities are pivotal for researchers, developers, service managers and providers, as well as for end users involved in the evolution of the networks. Traffic classification and analysis mechanisms belong to the wide set of tools that helps the allocation, control and management of resources in IP networks. Following the development and the evolution of Internet applications, new efficient classification techniques are highly desirable to support advanced capabilities as regards network monitoring, network resource management, anomaly detection, and network auditing. This workshop is intended to serve as a forum for scientists and engineers in academia and industry to exchange and discuss their experiences and research results about all aspects of traffic classification and analysis. Topics of interest ------------------ The workshop is soliciting high quality papers discussing original and innovative experimental activities, unpublished and not currently submitted for publication elsewhere, on topics, including but not limited to, the following: # Traffic classification algorithms and techniques # Detection, analysis, and classification of network anomalies # Distributed algorithms for anomaly detection # Platforms for on-line, real-time traffic classification # Comparisons among traffic classification techniques # Privacy-preserving classification techniques # Identification and classification of encrypted traffic # Classification algorithms for anomaly detection # Impact of sampling on network traffic classification # Applications of traffic classification # Data-reduction techniques for traffic traces # Anonymization tools and their effects on traffic classification # Traffic measurements, analysis and modeling # Packet classification at ultra-high link rates (terabits) # Fast table look-up # Internet measurements and accounting support in switches/routers # Advanced algorithms for deep packet inspection at high speed # High speed packet processing Important Dates --------------- Papers submission deadline: December 15, 2012 Notification of decision: March 15, 2013 Camera-ready deadline: April 1, 2013 Instructions for Authors ------------------------ Perspective authors are invited to submit using the EDAS system a full paper of not more than six (6) IEEE style pages including results, figures and references. Papers will be reviewed with the standard reviewing procedure. Accepted papers will be published on IEEE Digital Library. TRAC2013 co-Chairs -------------------------------------- Christian Callegari, University of Pisa, Italy (christian.callegari(a)iet.unipi.it <mailto:christian.callegari@iet.unipi.it>) Sandrine Vaton, Telecom Bretagne, France (Sandrine.Vaton(a)telecom-bretagne.eu <mailto:Sandrine.Vaton@telecom-bretagne.eu>) -- Dr Sandrine VATON Maître de Conférences (HDR) Institut Mines-Télécom, Télécom Bretagne Brest, France Téléphone: +33 2 29 00 10 29 http://perso.telecom-bretagne.eu/sandrinevaton

1 0