September 2011 - NANOG - lists.nanog.org

Blocking private AS
by Thomas Magill 27 Nov '13

27 Nov '13

I am thinking about implementing a filter to block all traffic with private AS numbers in the path. I see quite a few in my table though so I am concerned I might block some legitimate traffic. In some cases, these are just prefixes with the private appended to the end but a few have the private as a transit. Is this a good idea or would I likely be blocking too much legitimate traffic? The filter I am using currently shows the following: BGP table version is 5462394, local router ID is 209.112.253.4 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path * i58.68.109.0/24 x.x.x.x 0 100 0 6130 9498 10201 65534 i *> y.y.y.y 0 6130 9498 10201 65534 i * i68.115.224.0/24 x.x.x.x 0 100 0 6130 19151 20115 65011 i *> y.y.y.y 0 6130 19151 20115 65011 i * 85.112.22.0/24 y.y.y.y 0 6130 6939 23148 64532 64532 64532 64532 64532 64532 64532 64532 64532 i *> 93.189.194.0/24 y.y.y.y 0 6130 3549 39386 39386 39386 25233 65000 47146 i * i x.x.x.x 0 100 0 6130 3549 39386 39386 39386 25233 65000 47146 i *> 96.60.243.0/24 y.y.y.y 0 6130 2828 4181 65528 i * i x.x.x.x 0 100 0 6130 2828 4181 65528 i * i96.61.232.0/24 x.x.x.x 0 100 0 6130 2828 4181 65527 i *> y.y.y.y 0 6130 2828 4181 65527 i * i96.61.233.0/24 x.x.x.x 0 100 0 6130 2828 4181 65527 i *> y.y.y.y 0 6130 2828 4181 65527 i * i96.61.234.0/24 x.x.x.x 0 100 0 6130 2828 4181 65527 i *> y.y.y.y 0 6130 2828 4181 65527 i *> 148.207.2.0/24 y.y.y.y 0 6130 2828 3257 16531 13579 65090 i * i x.x.x.x 0 100 0 6130 2828 3257 16531 13579 65090 i *> 148.207.40.0/24 y.y.y.y 0 6130 2828 3257 16531 13579 65090 i * i x.x.x.x 0 100 0 6130 2828 3257 16531 13579 65090 i *> 148.207.97.0/24 y.y.y.y 0 6130 2828 3257 16531 13579 65090 i * i x.x.x.x 0 100 0 6130 2828 3257 16531 13579 65090 i * 170.34.100.0/24 y.y.y.y 0 6130 19151 20115 65011 ? * 170.34.104.0/24 y.y.y.y 0 6130 19151 20115 65011 ? * 170.34.113.0/24 y.y.y.y 0 6130 19151 20115 65011 ? * i174.35.1.0/24 x.x.x.x 0 100 0 6130 16467 64565 i * i174.47.199.0/24 x.x.x.x 0 100 0 6130 2828 4323 15065 65123 i *> y.y.y.y 0 6130 2828 4323 15065 65123 i * i192.109.61.0 x.x.x.x 0 100 0 6130 19151 20115 65011 i *> y.y.y.y 0 6130 19151 20115 65011 i *> 196.216.249.0 y.y.y.y 0 6130 2828 3257 8513 8513 8513 36881 65000 36896 37062 i * i x.x.x.x 0 100 0 6130 2828 3257 8513 8513 8513 36881 65000 36896 37062 i Network Next Hop Metric LocPrf Weight Path *> 209.172.69.128/30 y.y.y.y 0 6130 16467 64565 i * i x.x.x.x 0 100 0 6130 16467 64565 i *> 213.146.161.0 y.y.y.y 0 6130 2828 174 64679 48493 i * i x.x.x.x 0 100 0 6130 2828 174 64679 48493 i Thomas Magill Network Engineer Office: (858) 909-3777 Cell: (858) 869-9685 mailto:tmagill@providecommerce.com <mailto:tmagill@providecommerce.com> provide-commerce 4840 Eastgate Mall San Diego, CA 92121 ProFlowers <http://www.proflowers.com/> | redENVELOPE <http://www.redenvelope.com/> | Cherry Moon Farms <http://www.cherrymoonfarms.com/> | Shari's Berries <http://www.berries.com/>

3 2

Network topology
by Colin Alston 15 Nov '13

15 Nov '13

Hi all I'm considering trying to come up with some means to automatically detect a networks topology and draw pretty pictures. This is somewhat boring though if a network isn't well arranged with VLANs and q-tag trunk routers and so on (It will just look like a big cloud of junk connected off an assumed switch). Is there any kind of cunning trick to detect standard layer2 switches along a path without stuff like STP?

9 12

Inventory and workflow management systems
by vijay gill 26 May '13

26 May '13

What software solution do people use for inventory management for things like riser/conduit drawdown, fiber inventory, physical topology store, CLR/DLR, x-connect, contracts, port inventory, etc. Any experiences in integrating workflow into those packages for work orders, modeling, drawdown levels, etc. /vijay

10 13

Route Optimization Software / Appliance
by Babak Pasdar 01 Feb '12

01 Feb '12

Hello Group, I was wondering if anyone could share their experience with any route optimization approaches, methodologies or platforms, either open source or commercial (Internap FCP), that can actively adjust BGP parameters based on latency and number of layer 3 hops to a network rather than AS hops. We have upstreams all over the country and we would like to automate optimization to take the best egress path. Thank you for your feedback in advance. Best Regards, Babak -- Babak Pasdar President & CEO | Certified Ethical Hacker Bat Blue Corporation | Integrity . Privacy . Availability . Performance (p) 212.461.3322 x3005 | (f) 212.584.9999 | (w) www.BatBlue.com Bat Blue is proud to be the Official WiFi Provider for ESPN's X Games Bat Blue's AS: 25885 | BGP Policy | Peering Policy Receive Bat Blue's Daily Security Intelligence Report Bat Blue's Legal Notice

8 9

Facebook insecure by design
by William Allen Simpson 26 Oct '11

26 Oct '11

In accord with the recent thread, "facebook spying on us?" We should also worry about other spying on us. Without some sort of rudimentary security, all that personally identifiable information is exposed on our ISP networks, over WiFi, etc. Facebook claims to be able to run over TLS connections. Not so much (see attached picture). This wasn't an "app", this is the simple default content of a page accessed after a Google search. https://www.facebook.com/ceelogreen

21 29

IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 24 Oct '11

24 Oct '11

The IPv6 version of www.qwest.com has been down for 10 days. Wget shows a 301 to www.centurylink.com, but that also fails. Emails to the nocs at both companies have gone unanswered. Unless HE is deployed in a web browser, this behavior leads to a bad end-user experience. If anyone can prod either of these two companies that would be much appreciated. Frank nagios:/home/fbulk# wget -6 www.qwest.com --2011-08-18 00:32:40-- http://www.qwest.com/ Resolving www.qwest.com... 2001:428:b21:1::20 Connecting to www.qwest.com|2001:428:b21:1::20|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: http://www.centurylink.com/ [following] --2011-08-18 00:32:40-- http://www.centurylink.com/ Resolving www.centurylink.com... 2001:428:b21:1::22 Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:02-- (try: 2) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:25-- (try: 3) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:49-- (try: 4) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. Etc...

5 6

Re: Were A record domain names ever limited to 23 characters?
by steve pirk [egrep] 11 Oct '11

11 Oct '11

Found a decent starting reference. It was a Network solutions limit... I *knew* it! LOL http://www.123-domain-register.com/longdomainnames.htm The domain in question was inspectorgadgetthemovie.com 27 characters long including the .tld. I was off by one, the limit was 22 characters for the A record name and 4 characters for .com, .net, .org, .gov and .edu. >From the 123-domain-register web page: > The word is out... and the experts have been taking advantage of a change > in Domain Name regulations that allows up to 67 characters in domain names. > > How this will impact you: > > - > > Long domain names filled with keywords can get you ranked higher on the > search engines. (yes, the search engines will rank them) > > - > > For those who could not get a DOT.COM domain name, or were limited by > the 22 character limit, those days are over...for awhile anyway. > > - > > This revolution is driven by entrepreneurs who can act quickly. If you > do not act soon, all the good domains will be gone, and you will have to pay > premiums you do not want to in order get the domain name you want. > > Since 1993, Network Solutions has registered more than 3.4 million domain > names -- all limited to 26 characters. Now that their exclusive government > contract is ending, competitors have tossed this artificial limit and are > allowing longer names. > Cool, I was not dreaming... ;-] --steve On Fri, Sep 30, 2011 at 15:00, <bmanning(a)vacation.karoshi.com> wrote: > On Fri, Sep 30, 2011 at 02:54:38PM -0700, steve pirk [egrep] wrote: > > I seem to recollect back the 1999 or 2000 times that I was unable to > > register a domain name that was 24 characters long. Shortly after that, I > > heard that the character limit had been increased to like 128 characters, > > and we were able to register the name. > > > > Can anyone offer some input, or is this a memory of a bad dream? > > ;-] > > > > -- Steve Pirk > > Yensid > > the foundational DNS spec sez: > > > http://www.ietf.org/rfc/rfc1035.txt > > 2.3.1 > [elided] > There are also some restrictions on the length. Labels must be 63 > characters or less. > > /bill > -- steve pirk refiamerica.org "father... the sleeper has awakened..." paul atreides - dune kexp.org member august '09

8 12

Announcement of University of Washington routing study
by Ethan Katz-Bassett 10 Oct '11

10 Oct '11

Hi NANOG, >From August 24 to October 4, the University of Washington and Georgia Tech will conduct an Internet routing study using AS-PATH poisoning. The study will *only* affect the Georgia Tech experimental prefix 184.164.224.0/19(and its sub-prefixes). The prefix serves *no active users/services* so the study should not affect any production prefixes or users. We plan to insert AS numbers into our announcements to route around some networks. We will always start AS-PATHs with our own ASN 47065. We will limit ourselves to at most 10 announcement changes per hour (and generally will change the announcement for a given sub-prefix at most every 90 minutes). This experiment is almost identical to one that Georgia Tech conducted in June and July without problems or complaints (http://mailman.nanog.org/pipermail/nanog/2011-June/037527.html) so we do not anticipate any issues. Others have done similar studies in the past (e.g., Randy Bush et al.: http://www.psg.com/~olaf/measurements/as3130/visibility.pdf<http://www.google.com/url?sa=D&q=http://www.psg.com/~olaf/measurements/as31…>). If, for any reason, you want us not to include your ASN in announcements for our prefix, please opt-out at any time before August 24 at: http://www.surveymonkey.com/s/9P2TD7T . A few ASes opted out of the previous Georgia Tech study, and we will continue to honor those opt-outs. Please feel free to contact me directly with any questions. Cheers, Ethan Katz-Bassett http://www.cs.washington.edu/homes/ethan/ University of Washington

2 3

Were A record domain names ever limited to 23 characters?
by steve pirk [egrep] 07 Oct '11

07 Oct '11

I seem to recollect back the 1999 or 2000 times that I was unable to register a domain name that was 24 characters long. Shortly after that, I heard that the character limit had been increased to like 128 characters, and we were able to register the name. Can anyone offer some input, or is this a memory of a bad dream? ;-] -- Steve Pirk Yensid

3 3

events
by harbor235 06 Oct '11

06 Oct '11

What is everyone using to collect, alert, and analyze syslog data? I am looking for something that can generate reports as well as support multiple vendors. We have done some home grown stuff in the past but would be interested in something that incorprates all the best features. Soalrwinds, splunk, fwanalog, and others come to mind, any other good ones out there? Mike

18 21