Re: Barefoot "Tofino": 6.4 Tbps whitebox switch silicon?

2016-06-15 Thread Pavel Odintsov
ds-Fastest-Most-Programmable-Networks.pdf > > > Based on their investors, could have interesting results for much lower > cost 100GbE whitebox switches. -- Sincerely yours, Pavel Odintsov

Re: Detecting Attacks

2016-06-12 Thread Pavel Odintsov
Hello! You could try my open source project: https://github.com/pavel-odintsov/fastnetmon It's pretty popular and used by a very big number of really big networks. We have option for capturing "pcap" dump for each attack for detailed investigation. On Sat, Jun 11, 2016 at 8:2

Re: Major IX bandwidth sharing

2016-04-22 Thread Pavel Odintsov
> They fight with DDoS, so it means every month 95% traffic will be full 100G. >> >> On 21.04.16 22:40, Pavel Odintsov wrote: >>> If they could offer 95th percentile usage no more than commit they >>> should pay only for it. But actually it depends on certain c

Re: Major IX bandwidth sharing

2016-04-21 Thread Pavel Odintsov
th, not for 10-20G ;) > > On 21.04.16 20:25, Pavel Odintsov wrote: > > Hello! > > > > If you want cheaper price just ask any TIER-1 provider for link with > commit > > 10ge and burst up to 100GE. It will be definitely cheaper and simpler > than > > your

Re: Major IX bandwidth sharing

2016-04-21 Thread Pavel Odintsov
; Please contact me off list for more details. > > > > Thank you. > > -- > > Piotr Iwanejko > > > > > -- > Regards, > Paras > > President > ProTraf Solutions, LLC > Enterprise DDoS Mitigation > -- Sincerely yours, Pavel Odintsov

Re: Stop IPv6 Google traffic

2016-04-10 Thread Pavel Odintsov
at can you advice for that? >>> >>> >>> Umm.. fix the reasons why they're seeing timeouts? :) >>> >>> Have you determined why the timeouts are happening? >>> >> > -- Sincerely yours, Pavel Odintsov

Re: sFlow vs netFlow/IPFIX

2016-03-01 Thread Pavel Odintsov
Tinka wrote: > > > On 1/Mar/16 16:33, Pavel Odintsov wrote: > >> As opposed to older Cisco switches. > > Well, every vendor has older switches. > >> Btw, 100GE is pretty new and >> actually I have experience only with Extreme Black Diamond 8. > > Does

Re: sFlow vs netFlow/IPFIX

2016-03-01 Thread Pavel Odintsov
As opposed to older Cisco switches. Btw, 100GE is pretty new and actually I have experience only with Extreme Black Diamond 8. On Tue, Mar 1, 2016 at 5:24 PM, Mark Tinka wrote: > > > On 1/Mar/16 09:44, Pavel Odintsov wrote: >> But unfortunately they (Cisco Nexus) are pretty expen

Re: sFlow vs netFlow/IPFIX

2016-02-29 Thread Pavel Odintsov
from "network brands" with Not Invented Here syndrome to enough smart agnostic hardware vendors. On Mon, Feb 29, 2016 at 1:15 PM, Nikolay Shopik wrote: > Cisco Nexus switches support sflow, since they are broadcom based. > > On 29/02/16 10:26, Pavel Odintsov wrote: >> Cisco d

Re: sFlow vs netFlow/IPFIX

2016-02-29 Thread Pavel Odintsov
Thanks! Very interesting. Will dig into details :) On Mon, Feb 29, 2016 at 3:55 PM, Edward Dore wrote: > >> On 29 Feb 2016, at 12:37, Pavel Odintsov wrote: >> >> Hello! >> >> Nice information. Very interesting architecture. They are using L3 on >> IX?

Re: sFlow vs netFlow/IPFIX

2016-02-29 Thread Pavel Odintsov
Hello! Nice information. Very interesting architecture. They are using L3 on IX? How big Juniper Lan in comparison with Extreme lan? On Mon, Feb 29, 2016 at 3:16 PM, Edward Dore wrote: > >> On 29 Feb 2016, at 09:59, Pavel Odintsov wrote: >> >> For example, at huge I

Re: sFlow vs netFlow/IPFIX

2016-02-29 Thread Pavel Odintsov
ion as Arbor's vision in public speeches / presentations? Thanks! On Mon, Feb 29, 2016 at 12:42 PM, Roland Dobbins wrote: > On 29 Feb 2016, at 15:53, Pavel Odintsov wrote: > >> It's not about default. It's about minimal possible. > > > To my knowl

Re: sFlow vs netFlow/IPFIX

2016-02-29 Thread Pavel Odintsov
vision. On Mon, Feb 29, 2016 at 11:38 AM, Roland Dobbins wrote: > On 29 Feb 2016, at 15:12, Pavel Odintsov wrote: > >> Looks like you haven't so much field experience with sflow. I could >> help and offer some real field experience below. > > > I've already re

Re: sFlow vs netFlow/IPFIX

2016-02-29 Thread Pavel Odintsov
xplicit vendors. Because netflow is very-very-very vendor specific. I have my own netflow collector implementation for netflow v5, netflow v9 and IPFIX (just check my repository https://github.com/pavel-odintsov/fastnetmon/blob/master/src/netflow_plugin/netflow_collector.cpp). I spent so much nigh

Re: sFlow vs netFlow/IPFIX

2016-02-28 Thread Pavel Odintsov
this attack in seconds. Is it make sense? On Mon, Feb 29, 2016 at 10:32 AM, Roland Dobbins wrote: > On 29 Feb 2016, at 14:26, Pavel Odintsov wrote: > >> From my own experience sflow should be selected if you are interested in >> internal packet payload (for dpi / ddos dete

Re: sFlow vs netFlow/IPFIX

2016-02-28 Thread Pavel Odintsov
Hello, folks! I've huge experience for battle sflow vs netflow because in my free DDoS detection toolkit fastnetmon we support both capture methods. You could look at this comparison table: https://github.com/pavel-odintsov/fastnetmon/blob/master/docs/CAPTURE_BACKENDS.md >From my own ex

Re: Softlayer / Blocking Cuba IP's ?

2016-02-21 Thread Pavel Odintsov
>>> policies that try to (maybe rightfully) cover their bottoms in the light of >>> the >>> law. For instance, I can't hide the fact that I have access to Gmail; but at >>> the same time there are many Google properties and services than I can't. >>> There >>> are many companies, global companies, that I can't access, and others are >>> open >>> to us which are, paradoxically, completely based on the US and under US law >>> (won't name them publicly to avoid potential damage). >> >>> Any way, I'm going back to lurk mode. However, feel free to ask anything, >>> on- of >>> offlist. And I thank you all for this wonderful resource. >>> Carlos. >> >> >> > -- Sincerely yours, Pavel Odintsov

Re: algorithm used by (RIPE region) ISPs to generate automatic BGP prefix filters

2016-02-04 Thread Pavel Odintsov
> understand this correctly. > > > There are basically two abstractions: > > 1. as-set. Can contain other as-sets or as numbers. > 2. prefixes are registered to an as-number. > > Remember that there are multiple IRR servers, and they mirror each other. > > Use http://irrexplorer.nlnog.net/ to play around a bit :-). > > > Best regards, Henrik > > Henrik Thostrup Jensen > Software Developer, NORDUnet > > -- Sincerely yours, Pavel Odintsov

Re: DDoS Mitigation

2015-11-05 Thread Pavel Odintsov
o:pa...@protrafsolutions.com>> wrote: >> >> Hey, >> >> Just blocking port 19 won't cut it, as we often see Chargen attacks that run >> on nonstandard ports as well >> >> Thanks, >> Paras >> >> On 11/4/2015 12:33 PM, Mario Eirea wrote: >> Hello everyone, >> >> Looking to find out how the pricing model works for DDoS mitigation and what >> to expect as far as ballpark pricing from my ISP. Some background, we are >> getting hit with a chargen attack that comes and goes and is saturating our >> 500mb connection. Tried hitting up the ISP for UDP block on 19 but they want >> us to go through our rep, in the process making this go on longer that is >> necessary. Any feedback would be appreciated. >> >> Thanks, >> >> -ME >> >> -- Sincerely yours, Pavel Odintsov

Re: DDoS mitigation for ISPs

2015-10-29 Thread Pavel Odintsov
l, xmpp/jabber > PGP fingerprint (B178313E): > CF18 15FA 9FE4 0CD1 2319 1D77 9AB1 0FFD B178 313E > > (also on textsecure & redphone) > -- Sincerely yours, Pavel Odintsov

Looking for upstream provider with BGP Flow Spec support / RFC 5575

2015-10-04 Thread Pavel Odintsov
eally well. But we are experiencing so much attacks on channel overflow and want to lock part of traffic on upstream's side. Thanks! -- Sincerely yours, Pavel Odintsov

Re: Any Tool to replace Peakflow CP

2015-09-06 Thread Pavel Odintsov
gt; # > >> Thanks. >> >> Aluísio da Silva >> Coordenação de Planejamento e Engenharia >> CTBC >> (34) 3256-2471 >> (34) 9976-0471 >> www.ctbc.com.br -- Sincerely yours, Pavel Odintsov

Re: Experience on Wanguard for 'anti' DDOS solutions

2015-08-10 Thread Pavel Odintsov
bing) will come later. > Best Regards,-Marcel Duregards > > > -- Sincerely yours, Pavel Odintsov

Re: Yet Another BGP (Border Gateway Protocol) Python Implementation

2015-08-07 Thread Pavel Odintsov
Nice! On Friday, August 7, 2015, Alistair Mackenzie wrote: > "As our priority, we will do MPLS VPN, IPv6, *Flowspec* firstly. In the > future, we will consider multicast and EVPN. > Thanks." > > On 7 August 2015 at 10:05, Pavel Odintsov > wrote: > >> Hi! &g

Re: Yet Another BGP (Border Gateway Protocol) Python Implementation

2015-08-07 Thread Pavel Odintsov
gt; > ipv6 in 2015? you don't have to use either. > > Definitely. In any case, one advantage of open sourcing stuff is that > you can always answer such comments with a simple > > "Patches welcome!" > > which tends to silence critics :-) > > > Bjørn > -- Sincerely yours, Pavel Odintsov

Re: Working with Spamhaus

2015-07-28 Thread Pavel Odintsov
ne has any advice on how to deal with these people. Please let me >> know here or off list. > > > Based on years of experience, the very best way is "don't". Don't profit > from spam, and as a result don't deal with Spamhaus at all. > > > -- > sed quis custodiet ipsos custodes? (Juvenal) -- Sincerely yours, Pavel Odintsov

Re: DDOS Simulation

2015-07-28 Thread Pavel Odintsov
;>>> On Mon, Jul 27, 2015 at 8:32 AM, Dovid Bender wrote: >>>> >>>> Hi All, >>>> >>>> We are looking into a few different DDOS solutions for a client. We need a >>>> LEGITIMATE company that can simulate some DDOS attacks (the generic + >>>> specific to the clients business). Anyone have any recommendations? >>>> >>>> Regards, >>>> >>>> Dovid >> > -- Sincerely yours, Pavel Odintsov

Re: DDOS Simulation

2015-07-28 Thread Pavel Odintsov
Hello! My machines have 16GB of memory but traffic generator uses about ~1GB of memory for 10GE link. On Tue, Jul 28, 2015 at 12:36 AM, alvin nanog wrote: > > hi pavel > > On 07/28/15 at 12:02am, Pavel Odintsov wrote: >> It's poor man's traffic generator :) >

Re: DDOS Simulation

2015-07-27 Thread Pavel Odintsov
Hello! It's poor man's traffic generator :) My test lab is i7 2600 with 2 port Intel X520 10GE and Intel Xeon E5 2604 witj 2 port Intel X520 10GE. On Mon, Jul 27, 2015 at 11:59 PM, wrote: > On Mon, 27 Jul 2015 23:32:56 +0300, Pavel Odintsov said: > >> I would like to

Re: DDOS Simulation

2015-07-27 Thread Pavel Odintsov
comply with the various govermental issues > >both inhouse and cloud based solutions solve some problems > >another 32+ point comparison for inhouse vs cloud based solutions >- http://ddos-mitigator.net/InHouse-vs-Cloud > > thanx > alvin > - http://ddos-mitigator.net > - http://ddos-simulator.net > -- Sincerely yours, Pavel Odintsov

Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours

2015-07-21 Thread Pavel Odintsov
attacks. But pps/bps thresholds still useful in this case too. On Tue, Jul 21, 2015 at 5:48 PM, Rafael Possamai wrote: > Pavel, what kind of resources does the analysis of a 100G circuit require? > Or is it just counting packets? > > On Tue, Jul 21, 2015 at 8:11 AM, Pavel Odintsov > w

Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours

2015-07-21 Thread Pavel Odintsov
;was today at 09:00 EST. >> > >> >> > >>I'm assuming this is just another DDoS like all others, but I would be >> > >>interested to hear if I am not the only one seeing this. >> > >> >> > >>On list or off-list is fine. >> > >> >> > >>Thanks, >> > >>-Drew >> > >> >> > >> >> > >> > -- >> > Best Regards >> > Curtis Maurand >> > Principal >> > Xyonet Web Hosting >> > mailto:cmaur...@xyonet.com >> > http://www.xyonet.com >> >> -- >> Jared Mauch | pgp key available via finger from ja...@puck.nether.net >> clue++; | http://puck.nether.net/~jared/ My statements are only >> mine. >> -- Sincerely yours, Pavel Odintsov

Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours

2015-07-21 Thread Pavel Odintsov
n't find it.) >> > >> > (Hint 2: Mortal users have never heard of WHOIS or similar services) >> > >> > And what are the chances that after 3-4 days of unreachable, the user will >> > simply conclude you've gone out of business and you've lost a >> > customer/reader >> > to a competitor? > > -- > Jared Mauch | pgp key available via finger from ja...@puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements are only mine. -- Sincerely yours, Pavel Odintsov

Re: 'gray' market IPv4

2015-07-14 Thread Pavel Odintsov
k for at least small buyers of space if they're > sophisticated enough to address the RIR issues. If you do decide to take > the simple broker approach (not all are simple and not all approaches are > suitable to simple brokers), use an RFP. And Yelp. :-) > > Best, > > -M< > -- Sincerely yours, Pavel Odintsov

Re: Inexpensive software bgp router that supports route tags?

2015-07-01 Thread Pavel Odintsov
Mikrotik hardware > routers > > have an API, but I can't tell if the API supports adding BGP networks, > so I > > need to investigate that further. I can go hardware if I have to, with > > some ssh/expect scripts, but thought there may be other options that are > > easier. > > > > Thanks, > > > > David > > > -- Sincerely yours, Pavel Odintsov

Re: Fkiws with destination port 0 and TCP SYN flag set

2015-06-17 Thread Pavel Odintsov
, length 0 hping3 --flood --syn host.com On Wed, Jun 17, 2015 at 12:50 PM, Maqbool Hashim wrote: > Hmm, no flags set in your output though? > > ____ > From: Pavel Odintsov > Sent: 17 June 2015 10:44 > To: Maqbool Hashim > Cc: Marcin Ciesla

Re: Fkiws with destination port 0 and TCP SYN flag set

2015-06-17 Thread Pavel Odintsov
t, >> but it's interesting that there are a whole set of Ack Reset packets >> from the destination hosts with a source port of 0 also. > > So the destination host is sending ACK+RST with the *source* port > set to zero, or the *destination* port? > >> Does this not indicate that it probably isn't a reporting artifact? > > I would just tcpdump on one of the source machines to find out. > > ~Marcin -- Sincerely yours, Pavel Odintsov

Re: FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation

2015-06-12 Thread Pavel Odintsov
Thu, Jun 4, 2015 at 12:55 PM, Pavel Odintsov > wrote: > >> Brilliant idea! But in Docker we could offer only sflow and sflow. Port >> mirror capture need support from the kernel side. Will try shortly! >> >> On Thursday, June 4, 2015, Roberto Bertó > >

Re: FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation

2015-06-05 Thread Pavel Odintsov
Jun 4, 2015 at 9:26 PM, Rafael Possamai wrote: > You could look into LXD for that type of deployment. > > On Thu, Jun 4, 2015 at 12:55 PM, Pavel Odintsov > wrote: >> >> Brilliant idea! But in Docker we could offer only sflow and sflow. Port >> mirror capture need sup

Re: FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation

2015-06-04 Thread Pavel Odintsov
> It's a security tool. So ppl using it want to publicly hide the fact they > > use it in case you screw up and it contains leaks ;) > > > > ---- Oorspronkelijk bericht > > Van: Pavel Odintsov > > > Datum: > > Aan: Jim Popovitch > > &

Re: FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation

2015-06-04 Thread Pavel Odintsov
(yes, including me) and new-ness > in this thread.Should I be impressed with the freshness or > concerned about astroturfing? :-) > > Bah Humbug! > > -Jim P. > -- Sincerely yours, Pavel Odintsov

Re: FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation

2015-06-03 Thread Pavel Odintsov
Hello! Thank you! Please share your experience after tests! On Wed, Jun 3, 2015 at 5:50 PM, Budiwijaya wrote: > Yep, definitely i'll give this a trial run. > We are developing nullroute application internally. > I'll try to run this in our lab. > > On Wed, Jun 3, 2015 a

Re: FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation

2015-06-02 Thread Pavel Odintsov
Thank you for interest! Feel free to ask me about anything! Feature requests very appreciate! On Wed, Jun 3, 2015 at 9:31 AM, Johan Kooijman wrote: > Interesting project, Pavel. I'll most certainly give this a trial run. > > On Tue, Jun 2, 2015 at 10:16 PM, Pavel Odintsov > w

FastNetMon 1.1.2 - open source solution for DoS/DDoS mitigation

2015-06-02 Thread Pavel Odintsov
icmp_flood, udp_flood, ip_fragmentation_flood - Add support for Netmap for Linux (we have prepared special driver for ixgbe users: https://github.com/pavel-odintsov/ixgbe-linux-netmap) and FreeBSD. - Add support for PF_RING ZC (very fast but need license from ntop folks) - Add ability to collect netflow v9/

Re: Low Cost 10G Router

2015-05-20 Thread Pavel Odintsov
master/src/scripts/exabgp_queue_writer.py But full BGP route table is enough big and need external processing. But yes, with some Python code is possible to implement route server with ExaBGP. On Wed, May 20, 2015 at 5:25 PM, Aled Morris wrote: > On 20 May 2015 at 15:00, Pavel Odintsov wrote: &

Re: Low Cost 10G Router

2015-05-20 Thread Pavel Odintsov
ay 20, 2015 at 4:57 PM, Nick Hilliard wrote: > On 20/05/2015 14:56, Pavel Odintsov wrote: >> Yes, right! But ExaBGP could receive full BGP table, drop some rules >> and reflect they to Quagga which could load FIB on the Cumulus. > > or you could not bother with exabgp and do your

Re: Low Cost 10G Router

2015-05-20 Thread Pavel Odintsov
Yes, right! But ExaBGP could receive full BGP table, drop some rules and reflect they to Quagga which could load FIB on the Cumulus. On Wed, May 20, 2015 at 4:53 PM, Nick Hilliard wrote: > On 20/05/2015 14:46, Pavel Odintsov wrote: >> We could cut full BGP and select only important pref

Re: Low Cost 10G Router

2015-05-20 Thread Pavel Odintsov
a full table on them, they won't accept it. > > Nick > > -- Sincerely yours, Pavel Odintsov

Re: Low Cost 10G Router

2015-05-20 Thread Pavel Odintsov
hat has at least >> four 10G ports, and can handle full BGP routes? All that I know of are the >> Juniper MX80, and the Brocade CER line. What does Cisco and others have >> that compete with these two? Any other vendors besides Juniper, Brocade, >> and Cisco to look at? >> -- Sincerely yours, Pavel Odintsov

Re: Low Cost 10G Router

2015-05-20 Thread Pavel Odintsov
u again." - Direct Marketing Ass'n position on e-mail >> spam(CNN) >> With 24 million small businesses in the US alone, that's way too many >> apples. >> > > > > -- > Ray Patrick Soucy > Network Engineer > University of Maine System > > T: 207-561-3526 > F: 207-561-3531 > > MaineREN, Maine's Research and Education Network > www.maineren.net -- Sincerely yours, Pavel Odintsov

Re: Low Cost 10G Router

2015-05-19 Thread Pavel Odintsov
about good future. They can't be used now but they have really awesome outlook. On Tue, May 19, 2015 at 11:46 PM, wrote: > On 2015-05-19 14:23, Pavel Odintsov wrote: >> >> Hello! >> >> Somebody definitely should build full feature router with >> DPDK/netm

Re: Low Cost 10G Router

2015-05-19 Thread Pavel Odintsov
#x27;s are hideously pricey, >>>> and for a router, you're probably better off with something like a >>>> Supermicro X10SRn fsvo "n" with a Xeon E5-1650v3. Board is typically >>>> around $300, 1650 is around $550, so total cost I'm guessing closer to >>>> $1500-$2000 that route. >>>> >>>> The edge you get there is the higher clock on the CPU. Only six cores >>>> and only 15M cache, but 3.5GHz. The E5-2643v3 is three times the cost >>>> for very similar performance specs. Costwise, E5 single socket is the >>>> way to go unless you *need* more. >>>> >>>> ... JG >> -- Sincerely yours, Pavel Odintsov

Re: Low Cost 10G Router

2015-05-19 Thread Pavel Odintsov
> SFP+ ports. >> >> http://routerboard.com/CCR1036-8G-2SplusEM > > Run away from Mikrotik, especially if you want to run BGP. > > -- > Eduardo Schoedler -- Sincerely yours, Pavel Odintsov

Re: Low Cost 10G Router

2015-05-19 Thread Pavel Odintsov
mance specs. Costwise, E5 single socket is the > >way to go unless you *need* more. > > > >... JG > >-- > >Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net > >"We call it the 'one bite at the apple' rule. Give me one chance [and] > then I > >won't contact you again." - Direct Marketing Ass'n position on e-mail > spam(CNN) > >With 24 million small businesses in the US alone, that's way too many > apples. > > -- > Ken Chase - Toronto Canada -- Sincerely yours, Pavel Odintsov

Re: Route Optimization Products

2015-05-15 Thread Pavel Odintsov
>> Midwest Internet Exchange >> http://www.midwest-ix.com >> >> -- Sincerely yours, Pavel Odintsov

Re: macomnet weird dns record

2015-04-14 Thread Pavel Odintsov
;> Subject: Re: macomnet weird dns record >>>>> >>>>> Because looks strange especially if the traffic is 100% bad Best practice >>>>> says avoid such info in records as does not aid debug since mix of dec and >>>>> hex >>>>> >>>>> Colin >>>>> >>>>>> On 14 Apr 2015, at 14:09, Nikolay Shopik wrote: >>>>>> >>>>>> How its weird? All these chars allowed in DNS records. >>>>>> >>>>>> On 14/04/15 15:36, Colin Johnston wrote: >>>>>>> never saw hex in host dns records before. >>>>>>> host-242.strgz.87.118.199.240.0xfff0.macomnet.net >>>>>>> >>>>>>> range is blocked non the less since bad traffic from Russia network >>>>> ranges. >>>>>>> >>>>>>> Colin >>>>>>> >>>>> >>> >> >> >> >> -- >> Sincerely yours, Pavel Odintsov > -- Sincerely yours, Pavel Odintsov

Re: macomnet weird dns record

2015-04-14 Thread Pavel Odintsov
ird? All these chars allowed in DNS records. >>>> >>>> On 14/04/15 15:36, Colin Johnston wrote: >>>>> never saw hex in host dns records before. >>>>> host-242.strgz.87.118.199.240.0xfff0.macomnet.net >>>>> >>>>> range is blocked non the less since bad traffic from Russia network >>> ranges. >>>>> >>>>> Colin >>>>> >>> > -- Sincerely yours, Pavel Odintsov

Re: macomnet weird dns record

2015-04-14 Thread Pavel Odintsov
ever saw hex in host dns records before. >>>> host-242.strgz.87.118.199.240.0xfff0.macomnet.net >>>> >>>> range is blocked non the less since bad traffic from Russia network >> ranges. >>>> >>>> Colin >>>> >> -- Sincerely yours, Pavel Odintsov

Re: PoC for shortlisted DDoS Vendors

2015-04-02 Thread Pavel Odintsov
y humble opinion > is becoming more aggressive day after day? > > Mohamed Kamal > Core Network Sr. Engineer > > On 4/2/2015 5:03 PM, Pavel Odintsov wrote: > > Hello! > > What about open source alternatives? Main part of commercial ddos > filters are simple high

Re: PoC for shortlisted DDoS Vendors

2015-04-02 Thread Pavel Odintsov
fore and can help provide the appropriate tools, advices, or the > testing documents for efficient PoC. > > Thanks. > > -- > Mohamed Kamal > Core Network Sr. Engineer -- Sincerely yours, Pavel Odintsov

Re: DDOS, IDS, RTBH, and Rate limiting

2015-01-28 Thread Pavel Odintsov
testing! On Wed, Dec 3, 2014 at 7:57 AM, Roland Dobbins wrote: > > On 2 Dec 2014, at 17:18, Pavel Odintsov wrote: > >> In near future I will add netflow v5 support. > > > Good job - you should really go for NetFlow v9 when you can, as it supports > IPv6 and MPLS labe

Re: scaling linux-based router hardware recommendations

2015-01-27 Thread Pavel Odintsov
ly does. > > > On 1/27/2015 午後 04:33, Pavel Odintsov wrote: >> >> Hello! >> >> Looks like somebody want to build Linux soft router!) Nice idea for >> routing 10-30 GBps. I route about 5+ Gbps in Xeon E5-2620v2 with 4 >> 10GE cards Intel 82599 and De

Re: scaling linux-based router hardware recommendations

2015-01-26 Thread Pavel Odintsov
ut there that could meet these goals. I'm unsure if faster CPUs, or > more CPUs is really the problem, or networking cards, or just plain old > fashioned tuning. > > Any ideas or suggestions would be welcome! > micah > -- Sincerely yours, Pavel Odintsov

Re: DDOS solution recommendation

2015-01-11 Thread Pavel Odintsov
tive action such as > contacting the user and addressing the problem, limiting the user’s ability > to send dDOS traffic, etc. > > However, this would require lots of cooperation and if such a clearing house > were to evolve, it would probably have to start as a coalition of residential > ISPs. > > Owen > > -- Sincerely yours, Pavel Odintsov

Re: DDOS solution recommendation

2015-01-11 Thread Pavel Odintsov
;> eliminated spoofed source. >> >> Push on your providers. Stop paying for transit from networks that do not >> filter ingress, put it in your RFPs, and reward those who do with contracts. >> Make it economically advantageous to fix the problem, and people will. > > +1 > mh >> > -- Sincerely yours, Pavel Odintsov

Re: DDOS solution recommendation

2015-01-09 Thread Pavel Odintsov
to know if someone is using the cloud based >> solutions/scrubbing centers like Imperva, Prolexic, etc and what are the >> advantages/disadvantages of using a cloud base vs an on-premise solution. >> It would be great if you can share your experience on this matter. >> >> Thank you -- Sincerely yours, Pavel Odintsov

Re: North Korean internet goes dark (yes, they had one)

2014-12-23 Thread Pavel Odintsov
59903 >> >> (Yes, I know, they're saying it's a DDoS, not a routing hack...) > > > I was hoping that everyone just put 175.45.176.0/22 in their bogon list. > > > -- > Joe Hamelin, W7COM, Tulalip, WA, 360-474-7474 -- Sincerely yours, Pavel Odintsov

Re: Estonian IPv6 deployment report

2014-12-22 Thread Pavel Odintsov
t; Some others hammer our BNGs with NA request every 0.1 seconds etc. > > > As statistics go, there are 3+ active IPv6 subscribers (almost 15% of > our customer base, based on our public numbers), 81% of them have have at > least one IPv6 enabled device in the LAN, 70% have more than one. Most IPv6 > traffic is generated by Google+Youtube, Facebook and Akamai. Not bad for a > country with 1.3M people. > > Next up: mobile network :) > > -- > tarko -- Sincerely yours, Pavel Odintsov

Re: jack in the box ssl cert

2014-12-21 Thread Pavel Odintsov
Wow! Nice burgers! On Sun, Dec 21, 2014 at 1:15 PM, Javier J wrote: > can someone let them know they are having a bad day? > > https://www.jackinthebox.com/ -- Sincerely yours, Pavel Odintsov

Re: Comcast residential DNS contact

2014-12-03 Thread Pavel Odintsov
these >> queries in an attempt to optimise DNS query volumes and RTT. > > At the ISP I consult to, I filter all ANY queries, because they have > been used for DNS amplification attacks. > -- Sincerely yours, Pavel Odintsov

Re: DDOS, IDS, RTBH, and Rate limiting

2014-12-02 Thread Pavel Odintsov
u upgrade those to 8.x > firmware, you'll lose sflow on the 10gb ports. Once you upgrade, they send > a corrupted sflow packet, and at *far* less then the rate that you > configure. Even if you adjust your parser to compensate for the corrupt > packet, they're still dropping the

Re: DDOS, IDS, RTBH, and Rate limiting

2014-12-02 Thread Pavel Odintsov
ts. Once you upgrade, they send > a corrupted sflow packet, and at *far* less then the rate that you > configure. Even if you adjust your parser to compensate for the corrupt > packet, they're still dropping the large majority of samples, making sflow > pretty much useless. > > It's been several months since we reported this, and we're still waiting on > a fix. -- Sincerely yours, Pavel Odintsov

DDOS, IDS, RTBH, and Rate limiting

2014-11-20 Thread Pavel Odintsov
nt) FastNetMon can handle 2-3 million of packets per second and ~20Gbps on standard i7 2600 Linux box with Intel 82599 NIC. If you need any help or suggestions you can email me directly or ask via GitHub. Thank you! -- Sincerely yours, Pavel Odintsov