Nikolay Pleshakov

12/06/2026

MPLS VPN Troubleshooting - Глубокое погружение в поиск и устранение неисправностей или почему «Интернет иногда тормозит, но пинги ходят» или почему ваша сеть MPLS L3VPN внезапно превращается в «черную дыру»? 🌐⛓

Коллеги, признавайтесь: как часто вы сталкиваетесь с кейсами, где на первый взгляд всё «зеленое», а трафик всё равно пропадает?

Игорь Тумкин, эксперт Cisco с многолетним опытом в TAC, разобрал основные «генераторы кейсов», которые годами мучают инженеров сервис-провайдеров.

Подготовила выжимку самого «мяса» из его доклада. Сохраняйте себе чек-лист по траблшутингу:
📏 Коварные 1530 байт (Проблема MTU) Добавление 1–4 MPLS-меток и L2-заголовков может раздуть клиентский пакет до нестандартных размеров. Симптомы — «медленный интернет» и работа мелких запросов при гибели тяжелых файлов.
Решение: увеличивайте MTU на интерфейсах (минимум на 8–30 байт) или используйте ip tcp adjust-mss как временную меру.

🚀 Broken LSP: когда IP жив, а MPLS мертв Если Label Switched Path разорван, пакеты будут дропаться, даже если в таблице маршрутизации всё чисто.
Лайфхак: используйте Traceroute с выключенным ttl propagation. Это позволит найти «битый» линк за один проход.

🔄 LDP-синхронизация: спасаем сеть от «черных дыр» Бывает, что IGP уже поднялся и перехватил трафик, а LDP-сессия еще не успела обменяться метками. Трафик улетает в никуда.
Совет: включайте mpls ldp sync. Это заставит IGP выставлять Max Metric (65535), пока метки не будут готовы к работе.

🛡 Загадочный OSPF Down Bit Если вы строите Multi-homed CE, ваши маршруты могут внезапно исчезать из-за механизма защиты от петель.
Что делать: если вы используете VRF на устройствах, не являющихся PE, не забудьте про команду capability vrf-lite, чтобы игнорировать этот бит.

⚠ Железо тоже имеет значение (Catalyst 6500/7600) Не забывайте про аппаратный QoS! Без команды Trust на этих платформах ваши управляющие пакеты LDP/IGP могут просто не дожить до процессора при высокой нагрузке на линк.

------------------------------------------------------------------------------—
🎥 Таймкоды для быстрого погружения:
07:25 — Как инкапсуляция убивает MTU.
17:00 — Траблшутинг LSP через Traceroute без копирования TTL.
27:03 — Почему падают LDP-сессии (CPU, Input Q, QoS).
1:06:30 — Когда нужен capability vrf-lite.

Смотрим https://www.youtube.com/watch?v=a9CdWIt5bDc

Более подробно про раскрытие топологии MPLS сети нам рассказал ранее Георгий Гешев, с его работой можно ознакомиться по ссылке: https://vk.com/s/v1/doc/O4Y2wD4l5v0u6Ri0XQFvKjqZSqZbIHa0fhiln15hiRusHrbwL5g

А с какими самыми странными проблемами в MPLS сетях сталкивался ты или как часто? Пиши в комментариях! 👇

#явростелекоме

28/05/2026

На Кипре поймали украинца с €200 тысячами в носках

Вот, только вчера мы говорили о том, что Кипр снискал себе славу самого "обнального" острова в Европе и уже сегодня очередная новость на эту тему.

Недавно, при въезде из Ирландии, в аэропорту Пафоса на Кипре, задержали гражданина Украины с €199,950, которые были рассованы по 13 носкам. И, естественно, они не были задекларированы 🤡

При этом, двумя неделями ранее, на КПП Агиос Дометиос была задержана семейная пара с наличными на сумму более €208 тысяч. Они распихали 💰 деньги по 50-ти конвертам и спрятали в своей машине.

И вот где в Европе вы встретите что-то подобное?

К слову, все, таким образом изъятые наличные, происхождение которых не подтверждено документально, изымаются к доход государства.

#процессинг #адсенс #темщик #темка

17/05/2026

The following tools were used in BGP Vulnerability testing conducted by Cisco's Critical Infrastructure Assurance Group (CIAG) during Spring and Summer 2003:

* bgpcrack - libpcap-based RFC 2385 password cracker;
* ttt - blind sequence number guessing, RFC 2385 message generation and general purpose TCP tool;
* tcphijack - simple proof of concept too for injecting spoofed UPDATEs.

See presentations at NANOG 28 and Black Hat USA 2003 (by Sean Convery and Matthew Franz) for more information.

16/05/2026

tcphijack.c is a tool that allows to hijack a TCP connection and inject arbitrary data in the TCP conversation, this tool was written as a proof of concept to measure router response to a spoofed update message using BGP

To use it, the machine where tcphijack runs on must be able to see the TCP conversation that it wants to hijack. A quick example is the best way to illustrate how to use tcphijack:

* Telnet to machine X from machine Y. Log in.
* On machine A (attacker), run tcphijack like this:

$ sudo ./tcphijack -d 500 -c -s -p telnet \
-P payload.txt

The different switches have the following meaning:

-d 500 is a 500 msecs. delay before sending our payload, once we have sync'ed with the conversation and have all the data we need to hijack it (sequence and acknoledge numbers, port numbers, etc.)
-c for specifying the client's IP address (or hostname)
-s for specifying the server's IP address (or hostname)
-p is the port number to use. Symbolic port names are valid too (/etc/services is queried.)
-P is for specifying the payload (a file with the payload, actually)

There's a -t option that can be used to specify a "trigger" file. The trigger file causes injection to be delayed until a TCP segment arrives with a payload that is identical to what's in the trigger file.

* In the telnet session, press the space key. This will cause the telnet client (machine Y) to send ' ' (0x20) to the server (machine X), which will then reply with the echo of the space. At this point tcphijack knows all the details it needs to know about the state of the TCP conversation to be able to hijack the TCP session and inject our payload.

* Finally tcphijack sends our payload. If the payload file (payload.txt) has a command, it will be executed as if it was typed by the user using the telnet session from machine Y.

* Please note that a severe ACK storms happens after we have hijacked the TCP conversation because the server acknowledges a TCP segment that the real client never sent, so both server and client keep sending ACKs to each other, until after several minutes someone gives up and resets the TCP connection.

* As always, tcpdump is your friend - it'll show you exactly what's happening on the wire.

Eloy Paris
Cisco Systems Critical Infrastructure Assuarance Group (CIAG)
Download link: https://www.cisco.com/public/support/ciag-bgp-tools-1.00.tar.gz

16/05/2026

TCP Hijack (tcphijack.c) is a tool that allows to hijack a TCP
connection and inject arbitrary data in the TCP conversation. This tool was written as a proof of concept to measure router response to a spoofed update message using BGP.

http://youtube.com/post/UgwQ0PBpFKvr4z4s1yt4AaABCQ?si=dSh3MaN3F7CVs5A1 feat YouTube

TCP Hijack (tcphijack.c) is a tool that allows to hijack a TCP connection and inject arbitrary data in the TCP conversation. This tool was written as a proof...

14/05/2026

This year, law enforcement agencies' attention has increasingly shifted from nominees, mules, and ordinary "executors" to the management level of gray processing—the team leads of payment platforms. This isn't a coincidence or a result of "local excesses," but a natural development.

Processing platforms serving casinos, shops, and other high-risk traffic aren't websites or "technical solutions." They're essentially alternative banking infrastructure. Through it, funds are accepted, redistributed, and withdrawn, their origins are disguised, and banks' anti-fraud systems and financial control requirements are circumvented. None of this operates automatically—it's configured, maintained, and managed by specific individuals.

And the key figure here is the team lead. This isn't an IT specialist "getting the deadlines." This is the person who leads the team, assigns roles, understands the payment flow architecture, knows which banks and gateways are used, where the bottlenecks are, and how the stability of the entire system is ensured. They are the ones who see the full cycle of money movement—from entry to exit.

From a criminal law perspective, such structures are increasingly being classified as illegal banking activity. This applies not only to the classic "cashier," but to any sustainable mechanism that effectively performs banking functions—receiving, transferring, and distributing funds—outside of a licensed system. The formal argument "I'm not a bank and haven't touched the money" has long been ineffective here.

Additionally, the illegal circulation of payment instruments almost always arises—when third-party cards, electronic payment instruments, payment interfaces, and accounts not intended for such activities are used. Modern practice interprets this element much more broadly than before: it no longer only includes counterfeit cards, but also the very organization of illegal payment instrument circulation.

14/05/2026

Bu yıl, kolluk kuvvetlerinin dikkati giderek daha çok, vekillerden, aracı kişilerden ve sıradan "yürütücülerden" gri işlemenin yönetim düzeyine, yani ödeme platformlarının ekip liderlerine kaydı. Bu bir tesadüf veya "yerel aşırılıkların" sonucu değil, doğal bir gelişme.

Kumarhanelere, mağazalara ve diğer yüksek riskli trafiğe hizmet veren işlem platformları web siteleri veya "teknik çözümler" değildir. Bunlar esasen alternatif bankacılık altyapısıdır. Bu platformlar aracılığıyla fonlar kabul edilir, yeniden dağıtılır ve çekilir, kökenleri gizlenir ve bankaların dolandırıcılık önleme sistemleri ve finansal kontrol gereksinimleri atlatılır. Bunların hiçbiri otomatik olarak çalışmaz; belirli kişiler tarafından yapılandırılır, bakımı yapılır ve yönetilir.

Ve buradaki kilit figür ekip lideridir. Bu, "son teslim tarihlerini alan" bir BT uzmanı değildir. Bu, ekibi yöneten, rolleri atayan, ödeme akışı mimarisini anlayan, hangi bankaların ve ağ geçitlerinin kullanıldığını, darboğazların nerede olduğunu ve tüm sistemin istikrarının nasıl sağlandığını bilen kişidir. Para hareketinin tüm döngüsünü –girişten çıkışa kadar– görenler onlardır.

Ceza hukuku açısından bakıldığında, bu tür yapılar giderek yasadışı bankacılık faaliyeti olarak sınıflandırılmaktadır. Bu, sadece klasik "kasiyer" için değil, lisanslı bir sistem dışında fon alma, transfer etme ve dağıtma gibi bankacılık işlevlerini etkili bir şekilde yerine getiren her türlü sürdürülebilir mekanizma için de geçerlidir. "Ben banka değilim ve paraya dokunmadım" şeklindeki biçimsel argüman burada uzun zamandır etkisiz kalmıştır.

Ayrıca, ödeme araçlarının yasadışı dolaşımı neredeyse her zaman ortaya çıkar –üçüncü taraf kartlar, elektronik ödeme araçları, ödeme arayüzleri ve bu tür faaliyetler için tasarlanmamış hesaplar kullanıldığında. Modern uygulama bu unsuru eskisinden çok daha geniş yorumlamaktadır: artık sadece sahte kartları değil, aynı zamanda yasadışı ödeme aracı dolaşımının organizasyonunu da içermektedir.

#темщик #темка

14/05/2026

In this video I am showcasing a specific method within my program that allows me as the user to choose from about 20 different captive portals that I can serve via the ssid, effectively acting as a evil twin.

This will allow the user to have a look alike captive portal that once’s users interact with, the program will capture given credentials and return said credentials back to the user outputting through the terminal.

I will be adding a file for indefinite logging of all credentials captured so that way the user will have a persistent way of storing and saving captured credentials

13/05/2026

Secure the Backbone: Advanced MPLS Security & Offensive Audit Training program

Are your L3 VPNs truly bulletproof? In an era where BGP and MPLS isolation is the bedrock of service provider trust, staying ahead of sophisticated threats is no longer optional. Why Choose This Program? Move beyond theory. Our elite training transforms network engineers into security architects by bridging the gap between architectural resilience and offensive testing.

Who should attend?

- ISP Network Architects & Security Engineers.
- Enterprise Lead Integrators.
- Security Auditors specializing in Telecommunications.

Equip your team with the skills to prove that your network’s security is "Paramount". Enroll Now for the Next Session

12/05/2026

What do you think is right option?