July 2014 - NANOG - lists.nanog.org

Re: Owning a name
by Larry Sheldon 31 Jul '14

31 Jul '14

I keep thinking (in this "you can not own a name" thing) about the early occupants of North America who to a man, I believe, argued that fences were just wrong, because you can't own the land. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

On a future of open settlement free peering
by Daniel Golding 30 Jul '14

30 Jul '14

I hesitate to respond to Mr. Bennett. But since he has asserted my opinion on this matter... There is no reasonable reading of the early FCC Open Internet proposed rulemaking that would lead to a ban on paid peering. It takes a number of logical leaps and a great deal of inference to even get close to that: the text of the proposed rule-making is crystal clear. I can turn any transit link into a "paid peering" link in about 25 seconds (and only that long because my IOS and JUNOS are rusty) The law professor whose contribution you cite either misrepresented or failed to understand the paper he (in turn) cited regarding MPEG-DASH and congested networks. His inference was that maybe networks really aren't congested and that the problem is the underlying video transmission protocol. The idea is absurd - we've all seen the Backdoor Santa graphs. Whether MPEG-DASH gracefully degrades under significant congestion is another matter entirely, and is orthogonal to this discussion. You seem to paint everyone who disagrees with you as being some sort of cabal. Yet, my agreement with Patrick Gilmore on this issue is far more the result of the extremism of the opposite position. The guiding principle of the internet engineering community has always been to avoid breaking the Internet because it has the effect of hurting everyone - a tragedy of the commons. And yet, some broadband providers are playing a long game of intentional congestion to attempt to reverse the existing content-broadband power paradigm. No one deserves settlement free interconnection and I don't believe it should be universally mandated. However, the ability for carriers and content providers to avoid onerous regulation has long depended on acting responsibly, as is the case in any industry. Causing prolonged pain to your own customers, as some monopolistic broadband providers are doing, is inviting regulation. This is where I do part company with some folks in this community - I think regulation is bad and will hurt us. People say "well it can't get worse" - oh yes, it can. But, Mr. Bennett, your paymasters are driving us to a more comprehensive regulatory regime, whether we like it or not. Mr. Bennett - the reason that everyone believes you are a lobbyist rather than a sincere activist is that a sincere activist (who just happened to be getting paid by the broadband providers) would realize that he is going down a path of greater regulation. If you were sincere, you would find that to be abhorrent. AEI once stood for competition and lower regulatory burdens. Now, you take money to support monopoly providers who are destroying established industry self-regulatory regimes. Shameful. Daniel Golding (speaking for myself, not my employer)

1 0

FW: Public Notice: FCC asks for comments on network security
by Livingood, Jason 30 Jul '14

30 Jul '14

FYI. The U.S. Public Safety and Homeland Security Bureau released a Public Notice on Friday (copied below), seeking comment on the “implementation and effectiveness of the CSRIC III recommendations”. Comments are due by September 26. Some folks here may wish to send the FCC comments on this, especially areas pertaining to preventing IP address spoofing. - Jason DA 14-1066 Released: July 25, 2014 FCC’S PUBLIC SAFETY AND HOMELAND SECURITY BUREAU REQUESTS COMMENT ON IMPLEMENTATION OF CSRIC III CYBERSECURITY BEST PRACTICES In March 2012, the FCC’s third Communications Security, Reliability and Interoperability Council (CSRIC III)1 unanimously adopted voluntary recommendations for Internet service providers (ISPs) to combat three major cybersecurity threats: (1) botnet attacks; (2) domain name fraud; and (3) Internet route hijacking.2 Among other stakeholders, leading ISPs participated in the development of these recommendations and publicly committed to implementing them.3 The recommendations included voluntary measures in three areas: an Anti-Bot Code of Conduct to mitigate the proliferation of distributed denial of service (DDoS) attacks,4 steps to better secure the Domain Name System (DNS) through incremental implementation of DNSSEC, and steps to strengthen the security of the Internet’s inter-domain routing infrastructure.5 CSRIC III also recommended that the FCC encourage ISPs to implement source-address filtering topreventattackersfromspoofingIPaddressestolaunchDDoSattacks. Specifically,CSRIC recommended that the FCC encourage implementation of the following best current practices (BCPs) to mitigate this risk:6 1. 1) BCP 38/RFC 2827 – Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing;7 and 2. 2) BCP 84/RFC 3704 – Ingress Filtering for Multi-homed Networks.8 All CSRIC best practices are available on the Commission’s website in a searchable database.9 Since CSRIC III adopted these important recommendations, stakeholders have not yet provided the FCC’s Public Safety and Homeland Security Bureau (Bureau) information regarding their implementation that is sufficient for a meaningful understanding of either their effectiveness or lessons learned from implementation. Meanwhile, the vulnerabilities these recommendations were intended to address continue to be exploited.10 For example, recent DDoS attacks of unprecedented scale11 add to the urgency of ISPs’ implementation of CSRIC recommendations or of alternative approaches that ISPs believe are superior to the CSRIC recommendations. Request for Comment By this Public Notice, the Bureau seeks comment from ISPs, the Internet community, consumer organizations, and the broader public on the implementation and effectiveness of the CSRIC III recommendations and/or alternatives that stakeholders have developed since the time of the CSRIC’s original work to address these challenges. The purpose of this Public Notice is to promote a robust, stakeholder-driven discourse drawing on broad perspectives from throughout the cyber ecosystem to provide the communications sector and the Commission new information, insights and situational awareness regarding innovative solutions to these [page1image21240] [page1image21408] Federal Communications Commission 445 12th St., S.W. Washington, D.C. 20554 [page1image22856] News Media Information 202 / 418-0500 Internet: http://www.fcc.gov TTY: 1-888-835-5322 particular cyber risks. To the extent that companies or stakeholders may prefer that their submissions remain confidential, we intend to protect the confidentiality of submissions according to the requests and consistent with FCC rules, as described below. This inquiry is part of the Commission’s effort to develop effective and proactive private sector-driven cyber risk management;12 in particular, it complements and supports ongoing work in CSRIC IV to create measurable, accountable cyber assurances across a wide variety of IP-based communications technologies and services.13 The Bureau seeks public comment on the implementation status and effectiveness of these voluntary recommendations, or alternatives, by ISPs and other members of the Internet community. We are particularly interested in comment on the following questions as they relate to the four broad areas of CSRIC’s previous best practices and recommendations cited above: 1. What progress have stakeholders made in implementing the recommendations? 2. What barriers have stakeholders encountered in implementing the recommendations? 3. What significant success stories or breakthroughs have been achieved in implementing the recommendations? 4. What are stakeholders’ views and/or plans for full implementation of the recommendations? 5. How effective are the recommendations at mitigating cyber risk when they have been implemented? Given the experiences gained in the past two years, are there alternatives to full implementation that could be more effective than full implementation at mitigating cyber risk risks posed by botnets, DNS vulnerabilities, routing infrastructure vulnerabilities, and source address spoofing? On what basis do stakeholders believe that these alternatives are more effective than the CSRIC III recommendations? Do stakeholders undertake qualitative or quantitative evaluations of the effectiveness of these various approaches, or both? Comment Submission Interested parties are invited to comment by September 26, 2014. Please submit comments or meeting requests by email directly to the Associate Bureau Chief for Cybersecurity and Communications Reliability, Jeffery Goldthorp, at jeffery.goldthorp(a)fcc.gov, with a copy to the Deputy Chief of the Bureau’s Cybersecurity and Communications Reliability Division, Lauren Kravetz, at lauren.kravetz(a)fcc.gov. Requests for confidential treatment of information submitted should follow the procedures set forth in section 0.459 of the Commission’s rules, under which all submissions with an appropriate request for confidential treatment will be treated as presumptively confidential pending a ruling on the request. Additionally, upon request and on a case-by-case basis, the Bureau may accommodate classified comment submissions or discussions. Alternatively, those who desire to submit comments in hard copy only should submit an original and one copy of each set of comments. Hard copy comments can be sent by hand or messenger delivery, by commercial overnight courier, or by first-class or overnight U.S. Postal Service mail. All such submissions should be addressed to the Commission’s Secretary, Office of the Secretary, Federal Communications Commission and reference DA 14-1066. *  All hand-delivered or messenger-delivered paper submissions for the Commission’s Secretary must be delivered to FCC Headquarters at 445 12th St., SW, Room TW-A325, Washington, DC 20554. Delivery hours are 8:00 a.m. to 7:00 p.m. All hand deliveries must be held together with rubber bands or fasteners. Any envelopes and boxes must be disposed of before entering the building. *  Commercial overnight mail (other than U.S. Postal Service Express Mail and Priority Mail) must be sent to 9300 East Hampton Drive, Capitol Heights, MD 20743. 2  U.S. Postal Service first-class, Express, and Priority mail must be addressed to 445 12th Street, SW, Washington DC 20554. To request materials in accessible formats for people with disabilities (braille, large print, electronic files, audio format), send an e-mail to fcc504(a)fcc.gov or call the Consumer & Governmental Affairs Bureau at 202-418-0530 (voice), 202-418-0432 (tty). For further information, contact Jeffery Goldthorp, at jeffery.goldthorp(a)fcc.gov or (202) 418- 1096 or Lauren Kravetz, at lauren.kravetz(a)fcc.gov or (202) 418-7944. – FCC – 1 CSRIC is a federal advisory committee composed of leaders from the private sector, academia, engineering, consumer/community/non-profit organizations, and government partners from tribal, state, local and federal agencies. See FCC Encyclopedia, Communications Security, Reliability and Interoperability Council III, http://www.fcc.gov/encyclopedia/communications-security-reliability-and-int…. 2 See CSRIC III FINAL REPORTS, WORKING GROUPS 5, 6, 7, available at http://www.fcc.gov/encyclopedia/communications-security-reliability-and-int…. 3 See AT&T Public Policy Blog: Cybersecurity and the FCC’s CSRIC Recommendations (March 22, 2012), available at http://www.attpublicpolicy.com/cybersecurity/cybersecurity-and-the-fccs-csr…; CenturyLink Public Policy Blog: CenturyLink Takes Cybersecurity Seriously (April 2, 2012), available at http://community.centurylink.com/regulatoryblog/2012/04/centurylink-takes-c…; and Comcast Voices: Comcast Applauds Work of the FCC’s CSRIC on Online Security and Safety (March 22, 2012), available at http://corporate.comcast.com/comcast-voices/comcast-applauds-work-of-the-fc… safety. 4 In a distributed denial-of-service (DDoS) attack, an attacker uses multiple computers to prevent legitimate users from accessing information or services by sending large amounts of data to a website or spam to particular e-mail addresses. See Security Tip (ST04-015), Understanding Denial-of-Service Attacks, US-CERT, (Feb. 06, 2013), http://www.us-cert.gov/ncas/tips/ST04-015. Source-address spoofing may lead to “attacks where the unreachability of the source can be exploited” by attackers who transmit packets that appear to come from a victim’s IP address. See CSRIC III WORKING GROUP 4 FINAL REPORT at 18 (March 2013), available at http://transition.fcc.gov/bureaus/pshs/advisory/csric3/CSRIC_III_WG4_Report… (CSRIC III WG4 REPORT). 5 See News Release: FCC Advisory Committee Adopts Recommendations to Minimize Three Major Cyber Threats, Including an Anti-Bot Code of Conduct, IP Route Hijacking Industry Framework and Secure DNS Best Practices, (March 22, 2012), available at http://www.fcc.gov/document/csric-adopts-recs-minimize-three-major-cyber-th…. 6 CSRIC III WG4 REPORT at 20. 7 See P. FERGUSON & D. SENIE, BEST CURRENT PRACTICE 38, NETWORK INGRESS FILTERING: DEFEATING DENIAL OF SERVICE ATTACKS WHICH EMPLOY IP SOURCE ADDRESS SPOOFING (2000), available at http://tools.ietf.org/html/bcp38. 8 See F. BAKER AND P. SAVOLA, BEST CURRENT PRACTICE 84, INGRESS FILTERING FOR MULTIHOMED NETWORKS, (2004), available at http://tools.ietf.org/html/bcp84. 9 See CSRIC Best Practices, FCC Public Safety and Homeland Security Bureau, https://www.fcc.gov/nors/outage/bestpractice/BestPractice.cfm. 10 See Jim Cowie, The New Threat: Targeted Internet Traffic Misdirection, RENESYS BLOG, Nov. 19, 2013, available at http://www.renesys.com/2013/11/mitm-internet-hijacking/. According to an Internet security firm that investigated the attack, victims included financial institutions, governments, and network service providers in the United States, South Korea, Germany, and several other countries. Id. See also Nicole Perlroth, In Cyberattacks on Banks, Evidence of a New Weapon, THE NEW YORK TIMES, Oct. 5, 2012, available at http://bits.blogs.nytimes.com/2012/10/05/in-cyberattacks-on-banks-evidence-…. See also Mathew 3 J. Schwartz, Bank DDoS Attacks Resume: Wells Fargo Confirms Disruptions, INFORMATION WEEK, March 27, 2013, available at http://www.informationweek.com/attacks/bank-ddos-attacks-resume-wells-fargo… disruptions/d/d-id/1109271?. 11 In a Reflective DNS Amplification DDoS attack, an attacker sends multiple requests to multiple open DNS resolvers pretending that they are coming from a victim’s IP address. The open DNS resolvers then reply to the victim’s IP address with larger packets thus amplifying the attack size. See David Piscitello, Anatomy of a DNS DDoS Amplification Attack, WATCHGUARD TECHNOLOGIES, INC., http://www.watchguard.com/infocenter/editorial/41649.asp. See also John Leyden, Biggest DDoS Attack in History Hammers Spamhaus, THE REGISTER (March 27, 2013), http://www.theregister.co.uk/2013/03/27/spamhaus_ddos_megaflood/; John Markoff and Nicole Perlroth, Firm Is Accused of Sending Spam, and Fight Jams Internet, N.Y. TIMES, (March 26, 2013), See also Mathew J. Schwartz, DDoS Attack Hits 400 Gbit/s, Breaks Record, INFORMATION WEEK (Feb. 11, 2014), available at http://www.informationweek.com/security/attacks-and-breaches/ddos-attack-hi… id/1113787. 12 See remarks of FCC Chairman Tom Wheeler to the American Enterprise Institute, June 12, 2014 available at http://www.fcc.gov/document/chairman-wheeler-american-enterprise-institute-…. Chairman Wheeler stated that “the pace of innovation on the Internet is much, much faster than the pace of a notice-and-comment rulemaking” and challenged communications providers to create a “new paradigm” of proactive, measurable, accountable, business-driven cyber risk management. He cited the “important foundational work” in cybersecurity from CSRIC III that is the subject of this Public Notice and announced that “in the coming weeks, we will be seeking information to measure the implementation and impact of these industry-defined best practices.” 13 See Remarks of Public Safety and Homeland Security Bureau Chief, Rear Admiral (Ret.) David Simpson to CSRIC IV Public Meeting, June 18, 2014, available at http://www.fcc.gov/events/communications-security- reliability-and-interoperability-council-iv-meeting-1. Admiral Simpson’s remarks reiterated Chairman Wheeler’s call for a “‘new paradigm’ of proactive, measurable, accountable, business-driven risk management for communications security and reliability” and further described the “new paradigm” as “a substitute for traditional regulation that is more dynamic than complying with rules and more effective than blindly trusting the market. Under this new approach, businesses would step up and take responsibility for determining how to manage their risk in a more transparent and measurable way that promotes market accountability for cyber risk reduction. The traditional regulatory approach was that the FCC would propose a rule, and, after taking in your comments, tell you what you have to do – and, then, we would measure whether or not you are doing what we told you to do. The ‘new paradigm’ approach is different, and it is more challenging, because if it is going to succeed, it will rely primarily on your action. This is the case both in developing best practices and risk management processes in the first place, and then in following through with meaningful, measurable, demonstrable implementation.”

3 2

Upgrade Path Options from 6500 SUP720-3BXL for Edge Routing
by Corey Touchet 30 Jul '14

30 Jul '14

I’m curious what other providers have gone with when moving away from SUP720-3BXL 6500 platforms. I’m platform agnostic and just as comfortable with Juniper as with Cisco. It’s a conversation were having since the 3BXL’s are running into limits with the large number of prefixes, long eBGP convergence times, and 10G port density. Basically were looking to carry multiple full routing tables from several 4+ carriers plus internet exchange traffic so the ability to handle 1-2M IPV4 and 500K+ IPv6 and decent 10G port density and/or 40G options as well. Also should have decent CPU capabilities so it can crunch routes in a reasonable amount of time. Right now my thinking are MX480 or ASR9k platforms. Opinions on those are equally welcome as alternatives, but I’d love to hear from those with personal experiences today vs sales people trying to tell me it would route the world :) Thanks, Corey T

7 8

BGP communities question
by Philip 30 Jul '14

30 Jul '14

Hello Nanog, I'm fairly new to running my employers multihomed BGP network with our own ASN. Things have been relatively smooth and stable for the past few months. We have 2 upstream ISP's giving us full routes. We have a single link to each provider, but I run two BGP sessions over that single link so I can have router redundancy. My routers are run in an active-passive configuration. With ISP-A, they have configured our 2 BGP sessions such that the secondary session (our passive router), although the BGP session is up, no traffic is directed there unless the primary router's BGP session goes away. This prevents asymmetric routing problems with my active/passive config. ISP-A attributes this config to the fact that we have 2 sessions, but on the same router, with a config on their router that looks like this: #show <http://r04.lsanca03.us.bb#show> running-config interface tenGigE 0/1/0/7 interface TenGigE0/1/0/7 description: 10GbE service-policy input cust1-in service-policy output cust1-out ipv4 address xxx.xxx.xxx.xxx 255.255.255.252 ipv4 address xxx.xxx.xxx.yyy 255.255.255.252 secondary ipv4 verify unicast source reachable-via any allow-self-ping ISP-B says they aren't able to do this active/passive config without us getting 2 physical links (kind of opposite what ISP-A is saying) They recommend that we use local pref and communities to direct traffic to our primary BGP session and only using the secondary session if the primary fails. Does that recommendation make sense? Will setting the local pref via ISP-B community strings accomplish this active/passive traffic split that I'm looking for? Looking through the documentation on this providers site about which community string needs to be set, it seems like I just need to make the primary router BGP session community string higher than the default, and the passive router BGP session community string lower than the default and that will get me the desired behavior. Is that the proper way of achieving the traffic flows for active / passive config from provider to my gear? Thank you, Philip

2 1

Re: Netflix To Cogent To World
by Brandon Butterworth 30 Jul '14

30 Jul '14

> From: Mark Tinka <mark.tinka(a)seacom.mu> > Commercial trends have been moving farther and farther away > from, "How much bandwidth do you want to buy?" to, "How many > Tv channels, voice minutes and cloud recording can I get?", > particularly in much more developed markets Internet should be utility, many providing it don't wnat to be a utility and so try doing other services usually best left to specialists > As a transit provider industry, we need to get our act > together and play nice, before we all get run over by the > content owners Yes, I like to remind those engaging in peering wars and charging for access users to be careful when creating reasons for others to become their competition As a broadcaster we send our content direct to users over the air, there is opportunity in not making us do so for internet too (though it already happens, here in the UK Sky TV are a large ISP) brandon

3 2

Re: Richard Bennett, NANOG posting, and Integrity
by Larry Sheldon 30 Jul '14

30 Jul '14

Remembering the things (which had to do with network operations) that I go banned for. One wonders why I felt bad about it, NANOG = NANAE us a slur on NANAE. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

On a future of open settlement free peering
by William Herrin 30 Jul '14

30 Jul '14

Howdy folks, It seems to me that we're moving in a direction where either ratioless, high-capacity settlement-free peering will be a industry requirement exercised voluntarily, or where some heavy-handed government regulation will compel some kind of interconnection that the holdouts find even less desirable. I can only hope the holdouts will "see the light" before the weight of government crashes down on them -- regulation has no winners, only losers and bigger losers. And sometimes the worst thing that can happen is you get what you ask for with no opportunity to later change your mind. I'm curious what lies beyond that horizon. If we stipulate for the sake of the discussion that open peering is the way it going to be, a critical part of network neutrality, what exactly will that mean? Will it be permissible for one network to ask the other to pay a one-time port cost for the initial interconnect, assuming its representative of the actual cost of a one-time equipment addition? To what degree is redundancy a requirement? If a network refuses to peer in more than one chancy location, does that mean their peering policy isn't really open? Will a network be compliant if the open peering connections are only available in its own data center? Or will they need to be available in neutral data centers? Would a refusal to connect to neutral peering fabrics constitute a refusal to connect to smaller networks? Or is it reasonable to state that anybody who can't come up with 10 gig ports and cross-connects isn't of threshold size? Can a peering policy be open if it's regionally restricted? If my peering points for the mid-Atlantic states only announce routes tied to my mid-Atlantic customers and only propagate your routes to those mid-Atlantic customers, is that acceptable behavior? Or have I mis-served my customers if I don't pull all of them to the location you find it convenient to peer? Food for thought, Bill Herrin -- William Herrin ................ herrin(a)dirtside.com bill(a)herrin.us Owner, Dirtside Systems ......... Web: <http://www.dirtside.com/> Can I solve your unusual networking challenges?

2 4

Re: Upgrade Path Options from 6500 SUP720-3BXL for Edge Routing
by vristevs＠ramapo.edu 30 Jul '14

30 Jul '14

The 6880 has a single fixed Sup 2T. I believe you meant the 6807. That's what we are looking at to replace our 6500s. There currently are no high density 10G cards out for the 6807 but our account rep tells us a 32 port 1/10G SFP+ line card is coming out in December. If it weren't for this new line card, we would probably lean toward a different solution.

1 0

Many players make up application performance (was Re: Richard Bennett, NANOG posting, and Integrity)
by McElearney, Kevin 29 Jul '14

29 Jul '14

On 7/28/14, 5:35 PM, "Jim Richardson" <weaselkeeper(a)gmail.com> wrote: >I pay for (x) bits/sec up/down. From/to any eyecandysource. If said >eyecandy origination can't handle the traffic, then I see a slowdown, >that's life. But if <$IP_PROVIDER> throttles it specifically, rather >than throttling me to (x),I consider that fraud. > >I didn't pay for (x) bits/sec from some whitelist of sources only. Along with paying <$IP_PROVIDER> for (x) bits/sec up/down, you are also paying (or the product of advertising) eyecandysource to deliver a service (w/ a level of quality). <$IP_PROVIDER> plays a big role in delivering your *overall* Internet experience, but eyecandysource plays an even bigger role delivering your *specific* eyecandy experience. If eyecandystore has internal challenges, business negotiation/policy objectives, or uses poor adaptive routing path decisions, this has a direct and material impact to your *specific* eyecandy experience (and some have found fixable by hiding your source IP with a VPN). While ISPs do play a big role in this, people tend to miss eyecandystore decisions (and business drivers) as a potential factors in isolated application performance issues.

6 8