3 ms·

Maybe Hurricane needs to police it's own network first. My web server constantly receives malicious probes and invalid requests from Hurricane owned IPs. How

Maybe Hurricane needs to police it's own network first. My web server constantly receives malicious probes and invalid requests from Hurricane owned IPs. How does a malicious actor get direct access to a Tier 1 address? The only way I can see is by being inside their facilities.

remram 3y ago
Hurricane Electric operates tunnelbroker.net, a free SIT tunnel to provide IPv6 connectivity. All those clients (like me) will be using a HE-owned IPv6 address. They also offer dedicated servers and colocation services: http://he.net/colocation.html http://he.net/colocation.html They are not only a transit provider, in fact they wouldn't need to own IPs at all if they were.
- NoZebra120vClip 3y ago
  > They are not only a transit provider, in fact they wouldn't need to own IPs at all if they were. Inconvenient fact: Layer 3 routers use IP addresses for each of their network interfaces. This is actually how they provide transit.
  - 0x0000000 3y ago
    RFC 6598? Interfaces needing an address does not mean the business needs to own IP address space.
    - NoZebra120vClip 3y ago
      I am not sure what you're trying to tell me with an RFC pertaining only to CGNAT. We're talking about transit providers running core and backbone routers here. Such routers aren't running NAT of any kind, and they aren't customer-facing appliances. The transit provider needs to own some IP space to assign addresses to router interfaces. This is how internetwork routing works. It goes from one network to another, and the router must be a member of the source and destination network in order to participate in each hop. A transit provider doesn't need many IP addresses in total; if all they're running is core routers then they need sparse allocations: a point-to-point link only needs a /30 or /31 to function correctly. They'll still need to own a variety of netblocks, though, because if they offer transit and backbone services then these will be geographically disparate, and they will necessarily transit a large amount of logical address space.
      - remram 3y ago
        Parent was saying that those addresses don't need to be globally routable, so you can pick from private IP addresses ranges for your point-to-point addresses. They might have put the wrong RFC number there. Maybe they meant RFC 6890?
dumpsterdiver 3y ago
Oh wow, I didn't realize which "hurricane" we were talking about until you said that. Years ago I wrote a script that automatically updated firewall rules to block apparently malicious IP blocks (based upon observable behavior as well as IP reputation), and Hurricane was consistently near the top of the offender list. I recall finding it interesting at the time how the various Hurricane servers showing up in our logs reminded of an actual hurricane.

remram 3y ago

Hurricane Electric operates tunnelbroker.net, a free SIT tunnel to provide IPv6 connectivity. All those clients (like me) will be using a HE-owned IPv6 address. They also offer dedicated servers and colocation services: http://he.net/colocation.html http://he.net/colocation.html They are not only a transit provider, in fact they wouldn't need to own IPs at all if they were.

NoZebra120vClip 3y ago
> They are not only a transit provider, in fact they wouldn't need to own IPs at all if they were. Inconvenient fact: Layer 3 routers use IP addresses for each of their network interfaces. This is actually how they provide transit.
- 0x0000000 3y ago
  RFC 6598? Interfaces needing an address does not mean the business needs to own IP address space.
  - NoZebra120vClip 3y ago
    I am not sure what you're trying to tell me with an RFC pertaining only to CGNAT. We're talking about transit providers running core and backbone routers here. Such routers aren't running NAT of any kind, and they aren't customer-facing appliances. The transit provider needs to own some IP space to assign addresses to router interfaces. This is how internetwork routing works. It goes from one network to another, and the router must be a member of the source and destination network in order to participate in each hop. A transit provider doesn't need many IP addresses in total; if all they're running is core routers then they need sparse allocations: a point-to-point link only needs a /30 or /31 to function correctly. They'll still need to own a variety of netblocks, though, because if they offer transit and backbone services then these will be geographically disparate, and they will necessarily transit a large amount of logical address space.
    - remram 3y ago
      Parent was saying that those addresses don't need to be globally routable, so you can pick from private IP addresses ranges for your point-to-point addresses. They might have put the wrong RFC number there. Maybe they meant RFC 6890?

dumpsterdiver 3y ago

Oh wow, I didn't realize which "hurricane" we were talking about until you said that. Years ago I wrote a script that automatically updated firewall rules to block apparently malicious IP blocks (based upon observable behavior as well as IP reputation), and Hurricane was consistently near the top of the offender list. I recall finding it interesting at the time how the various Hurricane servers showing up in our logs reminded of an actual hurricane.