Skip to Content.
Sympa Menu

netsec-sig - Re: [Security-WG] What tools do people use to trigger Zenedge/Oracle Dyn's scrubbing service?

Subject: Internet2 Network Security SIG

List archive

Re: [Security-WG] What tools do people use to trigger Zenedge/Oracle Dyn's scrubbing service?


Chronological Thread 
  • From: "Sullivan, Jason W - (jsullivan)" <>
  • To: "" <>
  • Subject: Re: [Security-WG] What tools do people use to trigger Zenedge/Oracle Dyn's scrubbing service?
  • Date: Tue, 20 Nov 2018 19:04:04 +0000
  • Accept-language: en-US
  • Authentication-results: spf=none (sender IP is ) ;
  • Ironport-phdr: 9a23:wvjVFxx6PRvycLjXCy+O+j09IxM/srCxBDY+r6Qd0uoVL/ad9pjvdHbS+e9qxAeQG9mDu7Qc06L/iOPJYSQ4+5GPsXQPItRndiQuroEopTEmG9OPEkbhLfTnPGQQFcVGU0J5rTngaRAGUMnxaEfPrXKs8DUcBgvwNRZvJuTyB4Xek9m72/q99pHPYAhEniaxba9vJxiqsAvdsdUbj5F/Iagr0BvJpXVIe+VSxWx2IF+Yggjx6MSt8pN96ipco/0u+dJOXqX8ZKQ4UKdXDC86PGAv5c3krgfMQA2S7XYBSGoWkx5IAw/Y7BHmW5r6ryX3uvZh1CScIMb7S60/Vza/4KdxUBLmiDkJOSMl8G/ZicJwgqBUoBO9qBNw2IPUb52ZOeBic6/BYd8XR2xMVdtRWSxbBYO8apMCA+QcM+ZFq4n9o1oOrQWkCgmqHO/k1ztGiWXt3a091eQqDAHJ1xE5E9kTtHjUrs71NLoWUeCxzanI0y/Mb/VT1Tvz9YPFdRIhoeqRXbJ0dcrRyFcvGBnDjliLt4PlOima1uUJs2SB9eVgT+Ovim8gqwF3uDej3NkjhZTUho8MzF3P6Ct3wIEwJdKiSU57Z8apEJRRtyGGN4t2X9gtT3t0tyY9z70KoZ27czYMyJQ7xh7faOaLfJSP4hLmUuuaPDR2hGp9db+wmxq+61WsxvH+W8Wu0VtHqjBJn93Nu3wVyhDf9MuKRuFg8kql2DuDzR3f5+NFLEwui6bXNpAszqY+lpUNsknPAir7lUDrg6KSa0ko5+2l6+r5bbjiqJKRMpR7hwDkPaksn8GwG+c1PRYSUGWd5O+yzqfs/VfjT7VPlvA2krfWsJTdJckDvqC0Hwhb3pos5hqmETqoyckUkWAALF1eZh2LlY/pO0zSIP/jCve/nlKsnypxy/DeJL3hBYnNIWbfn7f9fLZ97EhcxBA0zdBC+5JUDrYBIPXwWkPrqNPYCRo5PxS1w+bhFtp9ypsTVG2TDqODLa/erV2F6vguLuSIfoMYvDfwJ+Ag5/H0jH85nVEdfbOu3ZsScH24HO9mI1idYXrog9cBD30FvgwlQeP0jV2NSz9TZ3KoU60m/DE7CYOnDYDFRo+3mrCOwjq0HoBOamBcFl+MCWvod5mDW/oUcyKdPNNukiEeVbigV48g1QiitQH1y7d8KurU+zYYtY741NRr/eHTlBcy9SBqAMSH1WGCUX10kn0SSzAowa9/vB819lDWm7N1iOFCFMBCouxGegY8KZPGyeFmUZb/Vh+LNoOSRV27WNS6EHQuQfowxcMDeUBwB4/kgxzeiXmEGbgQwvawGZgw87zV2Ty5Bc9mzHCO6+FkxxkkWdZLMWy4j6g+vUCHBZXUl0GYia+sXakZ1S/Jsm6ZzHiJukgeXQJtB/aWFUsDb1fb+IyqrnjJSKWjXOx9aFlI1NKCJ61Wa9bgkVRBQrL5Nc/DZ36qxD/iHg6Gk7WLaoeiO34Q2inQEgAlq0gS5j7HUGp2HSK9uyTbBT1qG0joZhbu6vR6rHKlR0kcwgSDbkkn3qC06BkTjLqRR+5Alr8=
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

https://github.com/pavel-odintsov/fastnetmon was a decent tool, although we ditched it for virtual Arbor SP (peekflow) -was 8k for perpetual licensing, 20k fps.


On 11/20/18 12:01 PM, James Deaton wrote:
I know that several of the state networks are using Kentik to trigger it. I think some of them are on this list but if they don't speak up, I'd be happy to connect you with some folks. I know one of them left RapidBGP because of the lack of controls and issues they ran into and use Kentik to do the triggering now.


-- 
James


On Nov 20, 2018, at 12:41 PM, Daniel F. Magorian wrote:

Hello Security WG folks!

We are having issues with ZenEdge/Oracle Dyn's RapidBGP triggering of their scrubbing, and while they're figuring that out, I thought I would ask people what tools they use to trigger scrubbing of subsets of your prefixes.

Yes, I know several folks have Arbox Peakflow boxes for on-prem scrubbing, and use these to signal Zenedge's as well.

So does anyone have a netflow-based tool that seems to work well?

Thanks, Dan
-----Original Message-----
From: Magorian, Daniel F.
Sent: Wednesday, October 3, 2018 10:34 AM
To:
Subject: RE: [Security-WG] What are folks' experience using Zenedge's scrubbing service....

We have the RapidBGP alerting service, and the main issue is false positives from stuff like big user downloads and high volume of inbound traffic to our Forcepoint/Websense http proxies. They're supposed to trigger on multiple criteria not just volume, but when we complain to their tech support, they respond a few days later saying they'll adjust something or other, all very non-transparent. They have also promised more useful stuff in the portal; right now it doesn't even know about the alerts they've sent you email about, basically broken. Still a work in progress...

Dan

-----Original Message-----
From: On Behalf Of Steven Wallace
Sent: Wednesday, October 3, 2018 10:25 AM
To:
Subject: [Security-WG] What are folks' experience using Zenedge's scrubbing service....

Greeting all,

Grateful if folks could share their experience using Zenedge’s scrubbing service. Specifically, how does engaging, and removing, the scrubbing service affect access to the hosts being scrubbed.

Is there a hit? Do users notice?

Thanks,

Steve

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature


Archive powered by MHonArc 2.6.19.

Top of Page