Internet2 Network Security SIG

["Magorian, Daniel F." <>]

Hello Security WG folks!

We are having issues with ZenEdge/Oracle Dyn's RapidBGP triggering of their 
scrubbing, and while they're figuring that out, I thought I would ask people 
what tools they use to trigger scrubbing of subsets of your prefixes.  

Yes, I know several folks have Arbox Peakflow boxes for on-prem scrubbing, 
and use these to signal Zenedge's as well.  

So does anyone have a netflow-based tool that seems to work well?

Thanks,  Dan

-----Original Message-----
From: Magorian, Daniel F. 
Sent: Wednesday, October 3, 2018 10:34 AM
To: 

Subject: RE: [Security-WG] What are folks' experience using Zenedge's 
scrubbing service....

We have the RapidBGP alerting service, and the main issue is false positives 
from stuff like big user downloads and high volume of inbound traffic to our 
Forcepoint/Websense http proxies.  They're supposed to trigger on multiple 
criteria not just volume, but when we complain to their tech support, they 
respond a few days later saying they'll adjust something or other, all very 
non-transparent.  They have also promised more useful stuff in the portal; 
right now it doesn't even know about the alerts they've sent you email about, 
basically broken.  Still a work in progress...  

Dan

-----Original Message-----
From: 

 
<>
 On Behalf Of Steven Wallace
Sent: Wednesday, October 3, 2018 10:25 AM
To: 

Subject: [Security-WG] What are folks' experience using Zenedge's scrubbing 
service....

Greeting all,

Grateful if folks could share their experience using Zenedge’s scrubbing 
service. Specifically, how does engaging, and removing, the scrubbing service 
affect access to the hosts being scrubbed.

Is there a hit? Do users notice?

Thanks,

Steve

Attachment: smime.p7s
Description: S/MIME cryptographic signature