| 00:02.01 | aeryndunham | picked the most boring textbook, she thinks |
| 00:14.27 | *** join/#utah fungus (~fungus@delta.myfungus.net) |
| 02:50.24 | *** join/#utah blunaxela (~alex@c-67-162-147-93.hsd1.co.comcast.net) |
| 03:23.55 | *** join/#utah blunaxela (~alex@c-67-162-147-93.hsd1.co.comcast.net) |
| 06:19.00 | *** join/#utah basepi (~basepi@basepi.net) |
| 14:40.58 | eightyeight | 25/32: Linear A- https://twitter.com/AaronToponce/status/799622060641165312 |
| 15:19.43 | *** join/#utah BitBandit (~BitBandit@50-198-187-221-static.hfc.comcastbusiness.net) |
| 15:26.52 | *** join/#utah nage (~nathan.ge@unaffiliated/nage) |
| 15:30.16 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 16:44.27 | TodPunk | The 32 bytes of Christmas |
| 16:48.44 | eightyeight | 7 more to go |
| 16:52.43 | *** join/#utah manithree (~blr@li4-76.members.linode.com) |
| 17:04.48 | TodPunk | ok then |
| 17:04.53 | TodPunk | The 32 bytes of Thanksgiving |
| 17:06.24 | spangborn | Your daily dose of puppies. http://i.imgur.com/lsvEnxS.gif |
| 17:11.21 | *** join/#utah SunSparc (~jonathan@45.56.57.85) |
| 17:23.07 | *** join/#utah aeryndunham (~aeryndunh@151.124.47.51) |
| 17:27.48 | manithree | Hmm https://lesspass.com/#/ |
| 17:29.33 | aeryndunham | so I'm trying to compile a report for my boss shoreside with basically a breakdown of what uses all our bandwidth, and I am trying to understand how over the last week the intenret cafe has used 178GB of 'ping' |
| 17:30.31 | unum | wow |
| 17:30.43 | unum | what do you use to gather the data |
| 17:30.52 | spangborn | Malware maybe? |
| 17:31.10 | aeryndunham | I'm just on the firewall dashboard |
| 17:31.27 | unum | or a DDOS |
| 17:31.31 | aeryndunham | the next highest thing is Facebook at 46GB which makes sense |
| 17:31.55 | aeryndunham | I mean we are taking 5000 people over 7 days |
| 17:31.57 | unum | actually probably both |
| 17:32.05 | aeryndunham | but 178GB of 'ping' is mystifying |
| 17:32.07 | unum | there is malware on it being used for a ddos attack against something else |
| 17:33.13 | aeryndunham | I do see a lot of realllllly junky old laptops owned by people with no business owning laptops |
| 17:33.15 | aeryndunham | wouldn't surprise me |
| 17:34.27 | unum | you should probably block ping at the firewall |
| 17:34.47 | unum | I'm suprised you allow anything other than tcp on ports 80 and 443 |
| 17:35.27 | aeryndunham | I mean we ping all time for testing and stuff |
| 17:35.33 | aeryndunham | I don't think we are blocking ports, how could I test that |
| 17:35.52 | unum | nmap |
| 17:36.11 | unum | but then you need something to scan on the other side |
| 17:36.28 | unum | hping is also useful for this sort of thing |
| 17:37.07 | aeryndunham | hmm |
| 17:37.22 | unum | you should be able to create restricted subnets, and then block them from doing anything but tcp/ip on standard ports |
| 17:37.22 | aeryndunham | I mean I am looking at the traffic report for 'ping' to see what is being pinged to, I think |
| 17:37.36 | unum | what's it showing? |
| 17:37.50 | aeryndunham | I've got IP addresses, that's all |
| 17:38.15 | unum | you can run host IPADDRESS to find out the domain |
| 17:38.29 | unum | and see if any of the correlate to publized ddos attacks |
| 17:38.45 | unum | wait that's not right |
| 17:42.06 | unum | well DNS has to be configure right for that to work, but there are websites you can use to find out who owns an ip |
| 17:42.29 | aeryndunham | looks to be 3 IPs mainly |
| 17:45.47 | unum | http://itools.com/tool/arin-whois-domain-search |
| 17:45.51 | unum | will tell you who owns them |
| 17:47.21 | aeryndunham | thanks for the help |
| 17:47.43 | aeryndunham | I did think all that 'ping' was weird but didn't think of possibility of DDos or anything |
| 17:47.59 | spangborn | This is the kind of thing I end up doing on a regular basis for production support |
| 17:48.04 | spangborn | Hey look, this traffic looks abnormal |
| 17:48.18 | spangborn | notices someone trying to bruteforce accounts from a list |
| 17:49.08 | aeryndunham | well me trying to run a report for my boss has turned into something way more educational :p |
| 17:49.20 | spangborn | Haha, it's fun right? |
| 17:49.32 | aeryndunham | yup |
| 17:49.33 | spangborn | I like trying to figure out if something was malicious, or why it was happening |
| 17:49.50 | spangborn | (I work in security, so it's something I enjoy) |
| 17:50.50 | aeryndunham | So these IPs would theoretically be the people being attacked or doing the attacking? |
| 17:52.06 | spangborn | They're external IPs |
| 17:52.33 | spangborn | Right? |
| 17:52.48 | spangborn | I'd guess they're probably the targets, in that case |
| 17:53.01 | aeryndunham | yeah |
| 17:53.31 | aeryndunham | two belong RIPE Network Communications, and the 3rd is a lawfirm in Providence RI |
| 17:53.47 | Migs | it got leg and skyscraper but NOT my hot tub??? https://i.gyazo.com/882c031d4b2e7a8b50ebcb877d2ce916.png |
| 17:54.19 | spangborn | lol Migs |
| 17:56.30 | aeryndunham | So you'd guess that some poor souls have malware on their devices that are constantly pinging these external IPs as some sort of DDOS attack, and that's why we have ginormous traffic to ping. Is that right? |
| 17:58.11 | spangborn | Yeah, that's what it seems like |
| 17:58.35 | spangborn | Probably difficult to track down what internal machine it is though, if it's a passenger device? |
| 17:58.43 | aeryndunham | well that's kind neat |
| 17:58.51 | spangborn | Although I suppose you could block it and then wait for them to complain |
| 17:58.54 | aeryndunham | It's unlikely to be our internet cafe machines |
| 17:59.02 | aeryndunham | you can't really download anything to them |
| 17:59.38 | aeryndunham | And the way to prevent this would be to block outgoing pings? But then we wouldn't be able to ping stuff to test speeds? |
| 17:59.41 | aeryndunham | sorries for the dumb |
| 18:01.35 | spangborn | Well, you could probably block segments of the network from using it |
| 18:01.52 | spangborn | While allowing your own machines to ping |
| 18:03.32 | aeryndunham | It looks kinda rampant though, lots of different source and destination IPs |
| 18:03.38 | aeryndunham | which is weird? |
| 18:05.13 | romanovic | yeah, there must be some way to configure the firewall to drop ping traffic rather than routing any of it off the ship |
| 18:05.43 | romanovic | that is, assuming you have an on-board firewall and it's not all going to some other off-ship location? |
| 18:06.17 | aeryndunham | It's an onboard firewall |
| 18:06.22 | aeryndunham | hates the firewall |
| 18:06.38 | spangborn | Because it's a pain to configure? ;p |
| 18:06.39 | aeryndunham | it's apparently a really good firewall but there's stupid huge issues with it |
| 18:06.44 | unum | you could probably even block it at the wireless access points though I suspect you have several of those |
| 18:06.54 | unum | and would have to configure each one seperatly |
| 18:06.57 | aeryndunham | hah yeah like 400+ access points |
| 18:06.58 | spangborn | Haha I'm sure it's more than several |
| 18:07.15 | unum | then there probably is a global config tool.... |
| 18:07.16 | spangborn | I'd guess wifi doesn't penetrate walls in a ship very well |
| 18:07.41 | aeryndunham | it does not |
| 18:08.08 | aeryndunham | None of the offending IPs are online right now so I don't think I can figure out who they are |
| 18:08.25 | unum | aeryndunham: if you're not familiar with botnets you may want to do some reading :) |
| 18:08.38 | aeryndunham | is not familiar |
| 18:09.07 | aeryndunham | well initial google is horrifying :p |
| 18:09.12 | unum | I used to have a book by the honeypot people what had a irc chat log of some botnet operators, it was really interesting |
| 18:09.14 | romanovic | wow, 178GB of pings in a week works out to > 5,500 pings/second |
| 18:09.23 | unum | wow |
| 18:09.25 | aeryndunham | jesus |
| 18:09.28 | unum | I was wondering about that |
| 18:09.31 | aeryndunham | that isn't possible, is it? |
| 18:09.38 | aeryndunham | unless like... everyone onboard is affected? |
| 18:09.48 | aeryndunham | Or it's something else entirely |
| 18:10.15 | spangborn | romanovic: Well, unless the ping payload is bigger, right? |
| 18:10.41 | romanovic | yeah, that's just assuming the default 56 byte size |
| 18:11.07 | spangborn | I'd assume if you're attempting to use pings to DOS, you'd probably use a larger payload |
| 18:11.07 | unum | https://en.wikipedia.org/wiki/Ping_of_death |
| 18:11.19 | unum | up to 65K! |
| 18:11.28 | aeryndunham | well this is just turning into a spectacularly educational afternoon |
| 18:13.07 | romanovic | 100% 65K pings would be 2.9M pings |
| 18:13.24 | romanovic | or 4/second... so in theory it could be just one or a handful of people? |
| 18:13.38 | aeryndunham | the previous week was 36.4G of pings |
| 18:14.55 | unum | I'd make sure they aren't company computers |
| 18:15.02 | unum | they have been hacked somehow |
| 18:15.15 | aeryndunham | I don't think I can see company computers here |
| 18:15.19 | aeryndunham | I am only seeing Internet Cafe traffic |
| 18:15.43 | aeryndunham | Well, I guess it could be my internet cafe computers, I'll have to check the IPs more closely |
| 18:16.03 | aeryndunham | Dang, just the pasr 24 hours shows 42GB of pinf |
| 18:16.35 | unum | I meant to say may have |
| 18:16.40 | spangborn | That's quite a bit of traffic for a very thin pipe |
| 18:16.46 | aeryndunham | yep |
| 18:16.53 | aeryndunham | internet does seem horribly slow today |
| 18:17.04 | aeryndunham | I'm getting lots of complaints, our ship-wide bandwidth is maxed (but that's normal) |
| 18:17.16 | aeryndunham | but if we do have people pinging insane amounts, that wouldn't help |
| 18:17.32 | unum | if you can block ping at the firewall I'd try turning it on just for 15 minutes or so and see what happens |
| 18:17.41 | aeryndunham | I can't |
| 18:17.45 | aeryndunham | I only have read only access |
| 18:17.49 | unum | ah |
| 18:18.14 | aeryndunham | scrolling through the past 24 hours, none of the IPs seem to be mine |
| 18:18.19 | aeryndunham | it's gotta be people's devices |
| 18:19.00 | aeryndunham | Some of it shows more traffic received than sent? Which for ping makes no sense? |
| 18:19.29 | unum | not if it's what we thought it was |
| 18:20.24 | unum | I'm assuming all the devices are on NAT |
| 18:20.33 | aeryndunham | NAT? |
| 18:20.46 | unum | Network Address Translation |
| 18:20.58 | unum | there are real ip addresses and ip address for local network |
| 18:21.15 | aeryndunham | Ah yeah |
| 18:21.23 | aeryndunham | I am seeing local IP addresses |
| 18:21.33 | aeryndunham | whole ship has only one public facing IP, I think |
| 18:21.43 | unum | ya that's what I would expect |
| 18:21.54 | unum | so from my computer i can ping the public ip |
| 18:22.02 | aeryndunham | yeah |
| 18:22.05 | unum | but I can't iniative any thing with any other ip |
| 18:22.10 | aeryndunham | exactly |
| 18:22.48 | unum | I can think of any reason you would be geting more ping data back than is being sent out |
| 18:22.55 | unum | s/can/can't |
| 18:22.55 | unum | man |
| 18:22.59 | unum | stupid fingers |
| 18:25.58 | aeryndunham | the firewall dashboard has tons of info but I don't really understand much of it |
| 18:26.40 | aeryndunham | I'm not reallllly supposed to even know the login that I know :p |
| 18:28.33 | aeryndunham | Technically my only business in the firewall is when crew members come to me with "m'am, all my mb are gone" I can try to see what ate it |
| 18:29.04 | aeryndunham | I am technically supposed to submit a request to the sysadmin for this, but he decided I can just do it myself |
| 18:33.10 | aeryndunham | is just help desk, basically :( |
| 18:33.47 | RyanE | a lazy sysadmin is a good sysadmin. :) |
| 18:34.41 | aeryndunham | the sysadmin is also my boyfriend; I've managed to obtain the login info for pretty much evertthing at this point :p |
| 18:35.03 | RyanE | the plot thickens. :) |
| 18:35.13 | aeryndunham | haha |
| 18:36.18 | aeryndunham | He knows that I want to move in some sort of IT direction in my future so he lets me do more than my job really entails |
| 18:43.44 | programmerq | aeryndunham⸠I know when I'm on an unreliable network, I will just let ping run and see what's going on. |
| 18:52.52 | aeryndunham | I run a ping a lot too |
| 18:53.01 | aeryndunham | but not 178GB worth ;) |
| 18:54.07 | romanovic | I wonder if your monitoring tool is classifying some other ambiguous traffic as ping? |
| 19:01.20 | aeryndunham | It possibly could |
| 19:01.51 | aeryndunham | i did just pop downstairs and ask Chris, he said that many people noted the quantity of ping traffic (we were troubleshooting a weird QoS problem last week) and he thinks it's ddos as well |
| 19:03.15 | manithree | TIL water bottle slide valves freeze really hard, really quickly |
| 19:25.14 | spangborn | I wonder if certain types of speed tests use ping for that |
| 19:25.27 | spangborn | like speedtest.net or something |
| 19:25.33 | spangborn | Even still, that's a ton of data |
| 19:27.07 | aeryndunham | yeah |
| 19:27.59 | aeryndunham | It's definitely a burden on our limited bandwidth, that's for sure |
| 19:31.37 | aeryndunham | On some ships you need to be connected to your Internet plan to run a ping, on others you can ping while not signed in |
| 19:32.00 | aeryndunham | I just checked a ship where I know you need to be signed in, their pings over the past 24 hours is only 24MB |
| 19:32.30 | spangborn | Ah, based on the hotspot intercept |
| 19:32.40 | aeryndunham | hmm? |
| 19:32.54 | spangborn | maybe it's a device that's connected to the wifi, but not signed in, and keeps trying to see if it can connect? |
| 19:32.55 | unum | http://www.cracked.com/photoplasty_2312_21-movies-that-need-to-exist-right-now/ |
| 19:33.06 | spangborn | *connect to an outside service |
| 19:33.07 | unum | I'd watch definetly watch 19 and 11 |
| 19:33.32 | spangborn | aeryndunham: Well the hotspots that make you sign in could have two different configs, as you said. |
| 19:34.59 | spangborn | So on your ship, you can ping out without being authenticated, but you can't make HTTP requests because they get intercepted by the hotspot and redirected to the login page |
| 19:35.25 | aeryndunham | Yes |
| 19:35.27 | spangborn | So maybe the device is trying to do that, and then checks for an active connection by pinging, and is confused about being connected or not |
| 19:35.33 | spangborn | So it keeps trying |
| 19:36.03 | RyanE | but as someone pointed out upthread, if they're 'regular' pings, it's like 5000/sec. |
| 19:36.10 | RyanE | which is a lot of pings. |
| 19:36.11 | RyanE | :) |
| 19:36.19 | spangborn | Could be faulty software design though, too |
| 19:36.33 | aeryndunham | I'm checking another ship where I remember being able to ping offline |
| 19:36.49 | spangborn | My work laptop, for instance, tries to connect to an always-on VPN on *any* network it joins |
| 19:36.52 | aeryndunham | takes eons to log into another ship though |
| 19:37.05 | spangborn | Haha, satellite latency FTL |
| 19:37.53 | spangborn | Regardless, if it's negatively affecting network performance, I'd just have someone block it and then when the owner of the device complains, you address it there |
| 19:38.32 | aeryndunham | I think our first step will be to block ping while not signed in |
| 19:40.02 | aeryndunham | of course I have no power over these choices |
| 19:40.26 | RyanE | you have no power over your boyfriend? |
| 19:40.29 | RyanE | :) |
| 19:40.40 | Migs | is he hot? |
| 19:40.44 | aeryndunham | he probably can't do it |
| 19:40.51 | RyanE | Migs: heh |
| 19:40.52 | spangborn | lol Migs |
| 19:40.53 | aeryndunham | It'd need to be shoreside |
| 19:40.58 | spangborn | Is he single? |
| 19:41.00 | spangborn | I kid, I kid |
| 19:41.01 | aeryndunham | I mean I think so? hah |
| 19:41.06 | Migs | would I hit it? |
| 19:41.13 | RyanE | that's what she said |
| 19:41.21 | spangborn | TIL objectifying men is okay |
| 19:41.42 | aeryndunham | I've been putting up with for 3 years so I guess he's ok? |
| 19:41.44 | RyanE | "no means no!" |
| 19:41.47 | aeryndunham | putting up with him |
| 19:41.52 | spangborn | Haha. |
| 19:42.07 | spangborn | You must be a patient woman |
| 19:43.15 | aeryndunham | haha he's nice |
| 19:45.15 | aeryndunham | But he's in a weird place where he doesn't have a lot of authority to do much |
| 19:45.35 | spangborn | Sounds like a man in a relationship to me ;p |
| 19:46.13 | aeryndunham | lol |
| 19:51.35 | romanovic | aeryndunham: you could always report in terms of money. Ship satellite uplink $cost per day / % of daily traffic currently wasted on pings = $amount they are flushing down the toilet |
| 19:52.05 | aeryndunham | romanovic: Yeah, it's definitely an issue we need to look at, ping is currently our top bandwidth user, which is ridiculou |
| 19:53.17 | romanovic | if that is $500 / day, and people who have access take 20 days to do anything about it, that's $10,000 down the drain |
| 19:53.51 | romanovic | $10,000 towards sponsoring someone's botnet traffic |
| 19:53.58 | aeryndunham | yeah :/ |
| 19:55.10 | romanovic | doesn't know how much large satellite uplinks cost but knows it is obscenely expensive |
| 19:55.45 | aeryndunham | Yeah I don't know either but it's definitely not cheap |
| 19:55.52 | aeryndunham | I mean we charge passengers an obscene amount to use it |
| 19:56.10 | unum | but probably cheaper than giving you enough room that you can stretch while laying down :) |
| 19:56.35 | romanovic | I once had 128kb/s satellite internet for about a year, it was $150/month |
| 19:56.43 | aeryndunham | yikes |
| 19:56.50 | romanovic | that's only 2x modem speeds |
| 19:57.13 | romanovic | s/modem/dial-up modem/ |
| 20:00.31 | levi | Mmm, surprise lunch with a company VP at an Indian restaurant. |
| 20:01.59 | spangborn | Hopefully that's a good lunch |
| 20:02.03 | spangborn | Not a bad lunch |
| 20:12.22 | *** join/#utah aeryndunham (~aeryndunh@151.124.47.51) |
| 20:12.51 | aeryndunham | went and got her flu shot AND was brave enough to ask about her strange wrist deformity and isn't dying, yay! |
| 20:21.49 | spangborn | Yay herd immunity |
| 20:22.28 | aeryndunham | yup |
| 20:23.36 | aeryndunham | And I guess "unless it's bothering you, don't worry about it, it'll probably go away" it about as good an answer you can get re: a weird wrist bump |
| 20:28.04 | Migs | someone built an arcade machine and put it in our break room. Has a bunch of NES, SNES, and MAME ROMs on it. |
| 20:28.21 | aeryndunham | wow |
| 20:28.22 | aeryndunham | that's pretty awesome |
| 20:30.08 | Migs | I don't think he's going to leave it here forever, but it's pretty cool |
| 20:40.05 | aeryndunham | Mmm. Peppermint tea. Yum. |
| 20:43.54 | *** join/#utah aarobc (~aarobc@216.51.32.182) |
| 20:44.54 | *** join/#utah goozbach (~goozbach@fedora/goozbach) |
| 20:44.54 | *** mode/#utah [+v goozbach] by ChanServ |
| 20:47.00 | levi | I've been working on the software end of an emulator arcade machine, but I haven't been moving terribly fast on it lately. |
| 21:15.52 | TodPunk | aeryndunham: What should happen is your comp lab computers should have static reservations in the DHCP server for a known subset of the subnet, or an entirely separate subnet. Passenger devices should not be allowed ICMP ping traffic (there's no reason to have this on a cruise, they're not going to need to do network research or something) |
| 21:16.07 | TodPunk | Then your comps can still ping stuff, but your passengers can't |
| 21:59.43 | levi | Mmmmm, Tom Waits. |
| 22:01.24 | unum | I'm surprised they are allowed anything other than tcp over ports 80 and 443 |
| 23:04.51 | *** join/#utah aeryndunham (~aeryndunh@151.124.47.51) |
| 23:09.37 | *** join/#utah nage (~nathan.ge@unaffiliated/nage) |
| 23:13.15 | aeryndunham | dangit I want to take notes tonight and I forgot a pen :( |
| 23:54.10 | levi | What are you wanting to take notes about? |
| 23:56.30 | romanovic | ~give aeryndunham a pen |
| 23:56.30 | infobot | ACTION gives a pen to aeryndunham |
