[low urgency] some issues from room network

[ajs@…]

Hi,

I'm currently associated with ietf-hotel:

	inet6 fe80::62f8:1dff:feb3:bf46%en0 prefixlen 64 scopeid 0x4 
	inet6 2001:67c:370:136:62f8:1dff:feb3:bf46 prefixlen 64 autoconf 
	inet6 2001:67c:370:136:3d36:aadf:75f0:5a24 prefixlen 64 autoconf temporary 
	inet 31.133.145.145 netmask 0xfffff800 broadcast 31.133.151.255

Certain v4-only sites seem not to work.  For instance:

derby:~ ajs$ traceroute m3aawg.org
traceroute to m3aawg.org (67.192.153.71), 64 hops max, 52 byte packets
 1  dhcp-92c8 (31.133.146.200)  186.732 ms  1.046 ms  0.831 ms
 2  * * *
 3  * * *
 4  * * *

[&c.]

derby:~ ajs$ traceroute citusdata.com
traceroute: Warning: citusdata.com has multiple addresses; using 104.25.233.15
traceroute to citusdata.com (104.25.233.15), 64 hops max, 52 byte packets
 1  dhcp-92c8 (31.133.146.200)  1.158 ms  1.053 ms  0.883 ms
 2  * * *
 3  * * *
 4  * * *
 5  *

[&c. -- the other address doesn't work any better]

I bet it's transient, but I thought it worth filing for your records.
No response needed.

A

-- 
Andrew Sullivan
ajs@anvilwalrusden.com

[ajs@…]

Hi,

It looks like this is actually everything v4 only, or at least
everything I try that is v4 only.  So there may be a bigger problem.

On Wed, Apr 06, 2016 at 12:14:19AM -0000, IETF Meeting/NOC wrote:
> #995: [low urgency] some issues from room network
> ----------------------+----------------------
>  Reporter:  ajs@…     |      Owner:  llynch@…
>      Type:  request   |     Status:  new
>  Priority:  tbd       |  Milestone:  ietf-95
> Component:  incoming  |
> ----------------------+----------------------
>  {{{
>  Hi,
> 
>  I'm currently associated with ietf-hotel:
> 
>          inet6 fe80::62f8:1dff:feb3:bf46%en0 prefixlen 64 scopeid 0x4
>          inet6 2001:67c:370:136:62f8:1dff:feb3:bf46 prefixlen 64 autoconf
>          inet6 2001:67c:370:136:3d36:aadf:75f0:5a24 prefixlen 64 autoconf
>  temporary
>          inet 31.133.145.145 netmask 0xfffff800 broadcast 31.133.151.255
> 
>  Certain v4-only sites seem not to work.  For instance:
> 
>  derby:~ ajs$ traceroute m3aawg.org
>  traceroute to m3aawg.org (67.192.153.71), 64 hops max, 52 byte packets
>   1  dhcp-92c8 (31.133.146.200)  186.732 ms  1.046 ms  0.831 ms
>   2  * * *
>   3  * * *
>   4  * * *
> 
>  [&c.]
> 
>  derby:~ ajs$ traceroute citusdata.com
>  traceroute: Warning: citusdata.com has multiple addresses; using
>  104.25.233.15
>  traceroute to citusdata.com (104.25.233.15), 64 hops max, 52 byte packets
>   1  dhcp-92c8 (31.133.146.200)  1.158 ms  1.053 ms  0.883 ms
>   2  * * *
>   3  * * *
>   4  * * *
>   5  *
> 
>  [&c. -- the other address doesn't work any better]
> 
>  I bet it's transient, but I thought it worth filing for your records.
>  No response needed.
> 
>  A
> 
>  --
>  Andrew Sullivan
>  ajs@anvilwalrusden.com
>  }}}
> 
> --
> Ticket URL: <https://tickets.meeting.ietf.org/ticket/995>
> IETF Meeting/NOC <https://tickets.meeting.ietf.org>
> IETF Meeting - NOC pages

-- 
Andrew Sullivan
ajs@anvilwalrusden.com

[Clemens Schrimpe]

Andrew,

we are investigating this further. It appears you have been victim to an ARP spoofing "attack" - whether with malicious intent or not we do not know yet. We are tracking this and will keep you informed.

FYI: We do have certain protections in place throughout our own net, yet you experienced this on the hotel's network where we have no real means against this, I am afraid.

Clemens

[Clemens Schrimpe]

Unfortunately all involved IP / Mac Addresses are no longer visible, I'm afraid.

Please let us know, if the problem re-appears for you. I'll also look again at around the same time notight.

Thanks for your help!

[Rick Alfvin]

Milestone renamed