44net

44net@mailman.ampr.org

3194 discussions

inbound traffic
by Brian Kantor 19 May '17

19 May '17

I built a new inbound ports display https://gw.ampr.org/router/ports.svg which shows a significant amount of traffic that SANS and others identify as being aimed at vulnerable ports on various pieces of equipment. I don't want to just block them, as they have legitimate uses, but if you're running your own firewall, you might want to block them yourself if you don't have any need for the legitimate use. - Brian

2 3

Connection Problem
by vk2tv 19 May '17

19 May '17

I'm trying to access one of Brian's help documents but the connection attempt to http://n1uro.ampr.org/linuxconf/amprnat.txt times out. Is there an issue somewhere that might impact on my attempts? Ray vk2tv

3 10

What happened to the missing inbound encap traffic
by Brian Kantor 19 May '17

19 May '17

As you can see from the graph https://gw.ampr.org/router/encapinpkt.svg, there was a precipitous decline in inbound encap traffic about 19:00 UTC on May 16th. I've been wondering what happened to all that traffic. Well, it turns out that the amount of traffic coming in before that cutoff was anomalously high. There was a host called chocolate-nebula.mit.edu (18.96.0.110) which was sending over 95% of the inbound traffic to amprgw, and had been for several days, before the graph started. I jumped to the conclusion that that amount of traffic was normal, when in fact it was not. So what has really happened was that inbound traffic has returned to normal after 16 May at 19:10. chocolate-nebula.mit.edu is registered on the portal as amprnet-gateway1.amolbhave.com, the gateway for subnet 44.44.7.224/28, belonging to KC1EDX. I don't yet know why it was sending all that traffic, nor why it suddenly stopped. So most of the mystery is solved. Maybe KC1EDX will pop up here and explain what was going on. - Brian

1 0

Gateway in EC2?
by Mark Scrano 18 May '17

18 May '17

Hey, I'm wondering of anyone has successfully got a gateway running in Amazon's EC2 service? I was thinking of using a raspberry pi with a tinc VPN to the EC2 instance to tie into my RF connection regardless of my IP address. I hit a wall when it came to getting ampr-ripd running. If anyone has such a configuration working I would love to pick your brain about your setup. Regards, Mark Scrano K2EXE -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

1 0

Re: [44net] Traffic not routing to my gateway
by Rob Janssen 18 May '17

18 May '17

> Guys, I think I may be missing something here. I've seen a couple > references to RIP being required. I didn't see that mentioned in any of > the on-line docs. Perhaps I've missed it, and if so, I apologize. I'll go > look at the Wiki to see if it is there. > Is this required or optional? It is optional, but I think it will be very unpractical or even impossible to get the IPIP tunneling working on your SRX. Note that it is NOT sufficient to setup a single IPIP tunnel to the amprgw and route all net-44 traffic over that. You need to setup a tunnel to each of the (about 430) gateway systems and route the defined subnets (about 615) over those tunnels. And the IP addresses of some of the endpoints are changing all the time because users are on a dynamic internet IP. To keep that config uptodate in your router, you either need to do AMPR-RIP, or you need to setup elaborate scripting to reconfigure the router whenever required. (regularly downloading the encap.txt file and generating config for it) In practice, you need a Linux box to do the routing, or a MikroTik router that has scripting powerful enough to do the above on its own. With your SRX you will need a separate machine that does the updating. Rob

2 1

amprgw inbound traffic protocol analysis
by Brian Kantor 18 May '17

18 May '17

I got curious about what all the inbound traffic we're experiencing (and mostly rejecting) was all about. Here's a very elementary breakdown of a one minute sample of what I saw on the inbound Ethernet: 22434704 packets read from savefile 344 non-IP packets discarded proto 1 (ICMP) count 87478 proto 2 count 14 proto 4 (IPIP) count 26162 proto 6 (TCP) count 20467723 proto 17 (UDP) count 1829610 proto 41 count 330 proto 47 (GRE) count 23041 proto 103 count 2 I'll do some additional analysis when I have time. - Brian

2 1

Re: [44net] AMPRNet outage?
by Rob Janssen 18 May '17

18 May '17

> I suspected at some point that there is a network using 44 addresses > internally, had some leaks on them and that the garbage (DNS replies, > ICM rejects, IP fragments and such stuff) were the replies from hosts on > the internet receiving that traffic and sending replies back via the > ampr-gw. I think that is not a legitimate use but an attack group that spoofs sender addresses when sending their attacks and they use net-44 addresses as well. To have that go down, more ISPs should implement BCP38 (source address filtering). Unfortunately, there is little incentive for ISPs to do that, because it benefits only others and not themselves. Rob

4 5

Re: [44net] AMPRNet outage?
by Rob Janssen 18 May '17

18 May '17

> This is rather disturbing. Many of the gateways in the gateway > statistics are showing ZERO encap packets coming from them. One of > the busiest normally is the gateway for Germany, 141.75.245.225, which > has not sent ANY encap packets to amprgw since the current stats began Is that still the case? I receive plenty of traffic from that gateway, so when you don't there could be someone who inserted a protocol 4 filter along the way. I can still ping 44.0.0.1 via the tunnel... traceroute to 169.228.66.251 (169.228.66.251), 30 hops max, 60 byte packets 1 xs4all-router (213.222.29.193) 0.262 ms 0.304 ms 0.276 ms 2 0.ae10.xr4.1d12.xs4all.net (194.109.5.57) 0.322 ms 0.ae11.xr4.1d12.xs4all.net (194.109.5.77) 0.341 ms 0.276 ms 3 asd2-rou-1043.NL.eurorings.net (134.222.93.144) 0.320 ms 0.355 ms asd2-rou-1044.NL.eurorings.net (134.222.97.17) 0.370 ms 4 asd2-rou-1022.NL.eurorings.net (134.222.48.222) 0.615 ms 0.544 ms 0.500 ms 5 chg-s1-rou-1041.US.eurorings.net (134.222.48.90) 95.532 ms 95.539 ms 95.543 ms 6 eq-exchange.tr01-chcgil01.transitrail.NET (206.223.119.116) 95.616 ms 95.675 ms 95.644 ms 7 ae-1.80.rtsw.chic.net.internet2.edu (64.57.20.150) 95.879 ms 95.901 ms 95.890 ms 8 et-3-1-0.4072.rtsw.kans.net.internet2.edu (64.57.20.89) 106.891 ms 106.906 ms 106.909 ms 9 ae-0.80.rtsw.salt.net.internet2.edu (64.57.20.146) 126.801 ms 126.922 ms 126.846 ms 10 ae-2.80.rtsw.losa.net.internet2.edu (64.57.20.144) 139.339 ms 139.437 ms 139.436 ms 11 64.57.20.83 (64.57.20.83) 139.681 ms 139.675 ms 140.043 ms 12 dc-tus-agg3--lax-agg6-100ge.cenic.net (137.164.11.7) 140.662 ms 140.780 ms 140.919 ms 13 dc-sdg-agg4--tus-agg3-100ge.cenic.net (137.164.11.9) 142.328 ms 142.342 ms 142.395 ms 14 dc-ucsd-1--sdg-agg4.cenic.net (137.164.23.54) 141.823 ms 141.889 ms 141.998 ms 15 nodem-core--mx0-30ge.ucsd.edu (132.239.254.163) 142.100 ms 142.099 ms 142.086 ms 16 ebu3b-6509-nodem-core-interconnect-vl910-bcast-255-131.ucsd.edu (132.239.255.131) 142.068 ms 142.094 ms 142.162 ms Rob

6 13

Re: [44net] AMPR stats ...
by Rob Janssen 17 May '17

17 May '17

> it is strange that my one camera consume half of the bandwith of all the 44 net bandwith Oh but that is only the traffic from tunneled hosts talking to the internet via amprgw! We output about twice that amount (700kB/s) continuoously on our gateway for only network 44.137.0.0/16. And that is after the Brandmeister hosts have been disconnected for internet addresses due to the DDoS. Before that, it was several MB/s, up to about 8 MB/s last february. Rob

1 0

Re: [44net] AMPRNet outage?
by Rob Janssen 17 May '17

17 May '17

> Perhaps it's time to revisit UDPIP. Does Linux support the use > of UDP port 94 for encapsulation? It appears it has been introduced in kernel 3.18 which is quite recent and will mean there are some issues for many users. (requirement to install a backported kernel and "ip" program that supports the newly introduced "ip fou" subcommand. It is not supported on the systems we are currently running. (Debian Wheezy and Jessie) It also is not supported on MikroTik routers. Rob

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net