December 2015 - NANOG - lists.nanog.org

Looking for VPS providers with BGP session
by Philippe Bonvin 22 Dec '15

22 Dec '15

Hello, I'm looking for providers around the world who are able to provide VPS with a BGP session but it seems to be rather difficult to find. I have already found a few with WHT/bgp.he.net/google but a little help would be appreciated. Does anyone have contact or know people who can offer such services ? If yes, please contact me off list. Our budget is quite low: around 50$/month/node +/- 50$ depending the transit providers for a server with 1-2 CPU cores, 20 Go SSD or SAS and 1-2 Go RAM. I'll be happy to share my provider list we use with anyone who needs it. Thanks for your help, Philippe [EDSI-Tech Sarl]<http://www.edsi-tech.com> Philippe Bonvin, Directeur EDSI-Tech S?rl<http://www.edsi-tech.com> EPFL Innovation Park, Batiment C, 1015 Lausanne, Suisse | T?l?phone: +41 (0) 21 566 14 15 Savoie Technolac, 17 Avenue du Lac L?man, 73375 Le Bourget-du-Lac, France | T?l?phone: +33 (0)4 86 15 44 78

7 6

Re: Nat
by Scott Weeks 21 Dec '15

21 Dec '15

--- jared(a)puck.nether.net wrote: From: Jared Mauch <jared(a)puck.nether.net> I'd love to hear from people on what they perceive and the real barriers they have seen with regards to IPv6 in your environment. ------------------------------------------------------- In the enterprise; managers that don't (and don't want to) understand and say things like "present a business plan and we might consider it. In the mean time I need everyone to focus on <insert short-term need here>." The things a netgeek has to put up with when (s)he doesn't want to move. scott

1 0

RE: Nat
by Scott Weeks 21 Dec '15

21 Dec '15

--- chuckchurch(a)gmail.com wrote: From: "Chuck Church" <chuckchurch(a)gmail.com> but I'm just having a hard time believing Joe Sixpack will be applying business networking principals such as micro-segmenting to a home network with 3 to 7 devices on it. If anything, these complexities we keep ---------------------------------------- Won't the devices themselves begin to do that based on minimal or no input from Joe? scott

5 5

[CVE-2015-7755] Backdoor in Juniper/ScreenOS
by Stephane Bortzmeyer 21 Dec '15

21 Dec '15

http://forums.juniper.net/t5/Security-Incident-Response/Important-Announcem… https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1… Should we blame Juniper for letting a git repository open to "unauthorized code" or should we congratulate them for their frankness (few corporations would have admitted the problem)?

7 9

reliably detecting the presence of a bridge?
by Dave Taht 19 Dec '15

19 Dec '15

I am curious if there is some sort of igmp or other form of message that would reliably detect if a switch had a bridge on it. How could deviceA detect deviceC was a bridge in this case? deviceA -> ethernet switch -> deviceB ethernet switch -> deviceC with bridged wifi and ethernet question came up in the context of: http://lists.alioth.debian.org/pipermail/babel-users/2015-December/002231.h… -- Dave Täht Let's go make home routers and wifi faster! With better software! https://www.gofundme.com/savewifi

12 16

CDN
by Ahmed Munaf 19 Dec '15

19 Dec '15

Dear All, Does anyone know if AWS amazon “cloudfront”, cloud flare, Microsoft … etc, hosting their servers on other party providers? just like what GGC and Akamai do by hosting their servers on other ISP’s datacenter! Regards,

6 8

Re: Nat
by Lee Howard 18 Dec '15

18 Dec '15

On 12/16/15, 8:53 PM, "NANOG on behalf of Berry Mobley" <nanog-bounces(a)nanog.org on behalf of berry(a)gadsdenst.org> wrote: >At 08:22 PM 12/16/2015, Randy Bush wrote: >> > We need to put some pain onto everyone that is IPv4 only. >> >>this is the oppress the workers so they will revolt theory. load of >>crap. >> >>make ipv6 easier to deploy, especially in enterprise. repeat the >>previous sentence 42 times. > >This. I'm in an enterprise with some stubborn vendors, and none of >them are even talking about ipv6. It won't help me to move (and it >won't help you to get well if you're here) if my users can't get to >their stuff. Can you dual-stack while you wait for them? Can we help you push on those vendors? Lee > >Berry > >

1 0

failover via comcast tunnel?
by bzs＠theworld.com 18 Dec '15

18 Dec '15

I'm looking at some sort of 50-100mbps failover link in case my primary is down. My options seem limited particularly since I'm cheap. I see Comcast has unlimited data business links in this range but I'm not sure I'd want to deal with the management issue of BGP or swapping ip blocks etc with them in an emergency. I just tried calling their business sales line and after the initial "Thank you for calling Comcast Business Services etc" it dropped me...three times. Yeah, that builds confidence. So I'm thinking something more like using their service as a raw bandwidth pipe and tunneling to an actual route provider? Crazy? Anyone done anything like this? Are there tools for that? Other, similar suggestions? Feel free contact me off-list. -- -Barry Shein Software Tool & Die | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo*

2 2

Weekly Routing Table Report
by Routing Analysis Role Account 18 Dec '15

18 Dec '15

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, PaNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 19 Dec, 2015 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 575038 Prefixes after maximum aggregation (per Origin AS): 212671 Deaggregation factor: 2.70 Unique aggregates announced (without unneeded subnets): 279789 Total ASes present in the Internet Routing Table: 52332 Prefixes per ASN: 10.99 Origin-only ASes present in the Internet Routing Table: 36643 Origin ASes announcing only one prefix: 15899 Transit ASes present in the Internet Routing Table: 6389 Transit-only ASes present in the Internet Routing Table: 168 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 37 Max AS path prepend of ASN ( 40285) 34 Prefixes from unregistered ASNs in the Routing Table: 1022 Unregistered ASNs in the Routing Table: 366 Number of 32-bit ASNs allocated by the RIRs: 12134 Number of 32-bit ASNs visible in the Routing Table: 9300 Prefixes from 32-bit ASNs in the Routing Table: 35469 Number of bogon 32-bit ASNs visible in the Routing Table: 16 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 410 Number of addresses announced to Internet: 2802619584 Equivalent to 167 /8s, 12 /16s and 148 /24s Percentage of available address space announced: 75.7 Percentage of allocated address space announced: 75.7 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 97.8 Total number of prefixes smaller than registry allocations: 189105 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 145893 Total APNIC prefixes after maximum aggregation: 39962 APNIC Deaggregation factor: 3.65 Prefixes being announced from the APNIC address blocks: 154461 Unique aggregates announced from the APNIC address blocks: 61426 APNIC Region origin ASes present in the Internet Routing Table: 5124 APNIC Prefixes per ASN: 30.14 APNIC Region origin ASes announcing only one prefix: 1200 APNIC Region transit ASes present in the Internet Routing Table: 892 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 34 Number of APNIC region 32-bit ASNs visible in the Routing Table: 1759 Number of APNIC addresses announced to Internet: 756146560 Equivalent to 45 /8s, 17 /16s and 225 /24s Percentage of available APNIC address space announced: 88.4 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 131072-135580 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 181146 Total ARIN prefixes after maximum aggregation: 89006 ARIN Deaggregation factor: 2.04 Prefixes being announced from the ARIN address blocks: 184534 Unique aggregates announced from the ARIN address blocks: 86477 ARIN Region origin ASes present in the Internet Routing Table: 16478 ARIN Prefixes per ASN: 11.20 ARIN Region origin ASes announcing only one prefix: 5936 ARIN Region transit ASes present in the Internet Routing Table: 1723 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 37 Number of ARIN region 32-bit ASNs visible in the Routing Table: 895 Number of ARIN addresses announced to Internet: 1102004160 Equivalent to 65 /8s, 175 /16s and 63 /24s Percentage of available ARIN address space announced: 58.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-395164 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 138479 Total RIPE prefixes after maximum aggregation: 68745 RIPE Deaggregation factor: 2.01 Prefixes being announced from the RIPE address blocks: 146403 Unique aggregates announced from the RIPE address blocks: 90629 RIPE Region origin ASes present in the Internet Routing Table: 18038 RIPE Prefixes per ASN: 8.12 RIPE Region origin ASes announcing only one prefix: 7978 RIPE Region transit ASes present in the Internet Routing Table: 2990 Average RIPE Region AS path length visible: 4.8 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 4316 Number of RIPE addresses announced to Internet: 702141824 Equivalent to 41 /8s, 217 /16s and 213 /24s Percentage of available RIPE address space announced: 102.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-204287 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 60498 Total LACNIC prefixes after maximum aggregation: 11803 LACNIC Deaggregation factor: 5.13 Prefixes being announced from the LACNIC address blocks: 73413 Unique aggregates announced from the LACNIC address blocks: 34606 LACNIC Region origin ASes present in the Internet Routing Table: 2461 LACNIC Prefixes per ASN: 29.83 LACNIC Region origin ASes announcing only one prefix: 594 LACNIC Region transit ASes present in the Internet Routing Table: 537 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 23 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2153 Number of LACNIC addresses announced to Internet: 170625024 Equivalent to 10 /8s, 43 /16s and 136 /24s Percentage of available LACNIC address space announced: 101.7 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-265628 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 13470 Total AfriNIC prefixes after maximum aggregation: 3113 AfriNIC Deaggregation factor: 4.33 Prefixes being announced from the AfriNIC address blocks: 15817 Unique aggregates announced from the AfriNIC address blocks: 6300 AfriNIC Region origin ASes present in the Internet Routing Table: 736 AfriNIC Prefixes per ASN: 21.49 AfriNIC Region origin ASes announcing only one prefix: 191 AfriNIC Region transit ASes present in the Internet Routing Table: 168 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 19 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 177 Number of AfriNIC addresses announced to Internet: 71324160 Equivalent to 4 /8s, 64 /16s and 82 /24s Percentage of available AfriNIC address space announced: 70.9 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5599 4192 76 China Education and Research 7545 3059 346 157 TPG Telecom Limited 4766 3016 11136 999 Korea Telecom 17974 2758 914 96 PT Telekomunikasi Indonesia 9829 2201 1413 372 National Internet Backbone 4755 2067 431 232 TATA Communications formerly 9808 1687 8639 18 Guangdong Mobile Communicatio 4808 1590 2275 504 CNCGROUP IP network China169 9583 1507 163 80 Sify Limited 38197 1412 88 186 Sun Network (Hong Kong) Limit Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3270 2964 145 Cox Communications Inc. 3356 2600 10693 537 Level 3 Communications, Inc. 6389 2508 3687 42 BellSouth.net Inc. 18566 2212 394 277 MegaPath Corporation 20115 1897 1902 403 Charter Communications 6983 1698 849 238 EarthLink, Inc. 30036 1666 332 334 Mediacom Communications Corp 4323 1577 1021 393 tw telecom holdings, inc. 209 1463 4338 1227 Qwest Communications Company, 701 1373 11441 646 MCI Communications Services, Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 2473 129 7 SaudiNet, Saudi Telecom Compa 20940 2261 892 1617 Akamai International B.V. 34984 1910 318 426 TELLCOM ILETISIM HIZMETLERI A 8551 1437 376 44 Bezeq International-Ltd 8402 1082 544 15 OJSC "Vimpelcom" 13188 1075 97 79 TOV "Bank-Inform" 12479 1062 965 80 France Telecom Espana SA 31148 1042 47 41 Freenet Ltd. 9198 950 349 25 JSC Kazakhtelecom 6830 898 2712 468 Liberty Global Operations B.V Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3419 543 113 Telmex Colombia S.A. 8151 2122 3364 491 Uninet S.A. de C.V. 7303 1581 942 241 Telecom Argentina S.A. 6503 1388 453 58 Axtel, S.A.B. de C.V. 28573 1213 2174 131 NET Serviços de Comunicação S 11830 1094 366 25 Instituto Costarricense de El 6147 1039 376 34 Telefonica del Peru S.A.A. 7738 994 1882 41 Telemar Norte Leste S.A. 3816 974 459 185 COLOMBIA TELECOMUNICACIONES S 26615 948 2325 34 Tim Celular S.A. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1184 1470 14 TE-AS 24863 1135 405 37 Link Egypt (Link.NET) 37611 583 39 40 Afrihost-Brevis Computer Serv 36903 552 278 110 Office National des Postes et 36992 434 1233 33 ETISALAT MISR 37492 325 192 74 Orange Tunisie 29571 264 21 11 Cote d'Ivoire Telecom 24835 245 146 12 Vodafone Data 3741 221 837 183 Internet Solutions 15706 171 32 6 Sudatel (Sudan Telecom Co. Lt Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5599 4192 76 China Education and Research 10620 3419 543 113 Telmex Colombia S.A. 22773 3270 2964 145 Cox Communications Inc. 7545 3059 346 157 TPG Telecom Limited 4766 3016 11136 999 Korea Telecom 17974 2758 914 96 PT Telekomunikasi Indonesia 3356 2600 10693 537 Level 3 Communications, Inc. 6389 2508 3687 42 BellSouth.net Inc. 39891 2473 129 7 SaudiNet, Saudi Telecom Compa 20940 2261 892 1617 Akamai International B.V. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 10620 3419 3306 Telmex Colombia S.A. 22773 3270 3125 Cox Communications Inc. 7545 3059 2902 TPG Telecom Limited 17974 2758 2662 PT Telekomunikasi Indonesia 6389 2508 2466 BellSouth.net Inc. 39891 2473 2466 SaudiNet, Saudi Telecom Compa 3356 2600 2063 Level 3 Communications, Inc. 4766 3016 2017 Korea Telecom 18566 2212 1935 MegaPath Corporation 4755 2067 1835 TATA Communications formerly Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 30662 UNALLOCATED 8.2.129.0/24 3356 Level 3 Communicatio 53506 UNALLOCATED 8.17.102.0/23 3356 Level 3 Communicatio 46467 UNALLOCATED 8.19.192.0/24 46887 Lightower Fiber Netw 18985 UNALLOCATED 8.21.68.0/22 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.122.0/24 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.124.0/24 3356 Level 3 Communicatio 27205 UNALLOCATED 8.38.16.0/21 3356 Level 3 Communicatio 15347 UNALLOCATED 8.224.147.0/24 12064 Cox Communications I 33628 UNALLOCATED 12.0.239.0/24 1239 Sprint 32805 UNALLOCATED 12.1.225.0/24 7018 AT&T Services, Inc. Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.226.112.0/20 62788 >>UNKNOWN<< 23.249.144.0/20 40430 colo4jax, LLC 23.249.144.0/21 40430 colo4jax, LLC 23.249.152.0/21 40430 colo4jax, LLC 27.100.7.0/24 56096 >>UNKNOWN<< 31.170.96.0/23 23456 32bit Transition AS 37.46.8.0/23 13768 Peer 1 Network (USA) Inc. 37.46.10.0/23 36351 SoftLayer Technologies Inc. 37.46.14.0/24 36351 SoftLayer Technologies Inc. 37.46.15.0/24 36351 SoftLayer Technologies Inc. Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:100 /12:265 /13:506 /14:1016 /15:1773 /16:12988 /17:7408 /18:12610 /19:25580 /20:37740 /21:39987 /22:63460 /23:54945 /24:315024 /25:546 /26:578 /27:384 /28:17 /29:16 /30:9 /31:0 /32:21 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 22773 2458 3270 Cox Communications Inc. 39891 2432 2473 SaudiNet, Saudi Telecom Compa 18566 2114 2212 MegaPath Corporation 6389 1553 2508 BellSouth.net Inc. 30036 1483 1666 Mediacom Communications Corp 6983 1345 1698 EarthLink, Inc. 10620 1289 3419 Telmex Colombia S.A. 34984 1205 1910 TELLCOM ILETISIM HIZMETLERI A 11492 1132 1222 CABLE ONE, INC. 31148 961 1042 Freenet Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1643 2:653 4:100 5:2068 6:26 8:1412 12:1801 13:30 14:1588 15:23 16:2 17:57 18:19 20:48 22:1 23:1320 24:1730 27:2132 31:1703 32:54 33:2 34:4 35:5 36:192 37:2211 38:1137 39:22 40:76 41:3005 42:368 43:1623 44:36 45:1567 46:2353 47:64 49:1069 50:825 51:3 52:35 54:96 55:8 56:8 57:44 58:1430 59:840 60:519 61:1760 62:1461 63:1909 64:4436 65:2186 66:4071 67:2136 68:1090 69:3270 70:1043 71:461 72:1976 74:2557 75:358 76:416 77:1378 78:1280 79:820 80:1324 81:1361 82:848 83:669 84:779 85:1532 86:456 87:1048 88:548 89:1930 90:153 91:5964 92:861 93:2307 94:2238 95:2242 96:472 97:353 98:957 99:45 100:79 101:872 103:9167 104:2171 105:88 106:361 107:1108 108:638 109:2369 110:1239 111:1542 112:878 113:1188 114:916 115:1534 116:1515 117:1351 118:2009 119:1491 120:513 121:1163 122:2254 123:1872 124:1570 125:1739 128:674 129:353 130:422 131:1281 132:592 133:169 134:452 135:121 136:348 137:310 138:1586 139:197 140:249 141:465 142:637 143:737 144:578 145:150 146:827 147:609 148:1306 149:450 150:622 151:809 152:570 153:269 154:477 155:904 156:443 157:404 158:347 159:1065 160:421 161:690 162:2213 163:501 164:712 165:1100 166:315 167:913 168:1339 169:560 170:1484 171:267 172:373 173:1572 174:716 175:766 176:1497 177:3961 178:2277 179:1049 180:2051 181:1629 182:1911 183:649 184:763 185:5177 186:3051 187:1879 188:2125 189:1710 190:7543 191:1262 192:8738 193:5734 194:4308 195:3730 196:2250 197:1113 198:5503 199:5518 200:6707 201:3489 202:9869 203:9299 204:4557 205:2730 206:2966 207:3018 208:4017 209:3973 210:3766 211:2018 212:2616 213:2199 214:831 215:73 216:5721 217:1871 218:741 219:543 220:1640 221:798 222:641 223:874 End of report

1 0

ISP marking ipsec traffic based on certificate, how is this possible?
by Mark Zimmer 18 Dec '15

18 Dec '15

Hello list, I have a site-to-site ipsec vpn with strongswan. It was working well for 5-6 months then a day ago I have noticed something strange, that from Site-A to Site-B (tunnel mode) only the upload bandwidth is capped down to 20-30kbit/s inside the VPN. I have tried various apps like ftp, scp on different ports it was the same result. I also ran speedtest/wget on both endpoints just to make sure that not the entire connection of those networks are capped. Since outside parties cannot see anything from what's going on inside the tunnel, first I was thinking that they started limiting the traffic based on port (4500 udp) or based on protocol (ESP), that is easy to do. In older versions of strongswan it's not possible to change the charon nat port (probably wouldn't work anyway since most of the traffic should be ESP (protocol 50)). I have restarted the strongswan daemon on both endpoints multiple times it did not change the situation (the bandwidth limiting was still present). So my last idea was to make new vpn certificates. For my biggest surprise with the new certificates the capping was gone and the bandwidth went back to normal. I hope I don't have to put the old certs back from backup just to make a point. One of the ISPs must started tagging the ipsec traffic based on the certificate and then do traffic shaping (QoS) on it to throttle down the bandwidth. How is this even possible? I was thinking that an ipsec connection is encrypted and random from the beginning. How can they define a pattern to their whatever device to be able to mark this specific traffic? Is there a part at the beginning of the connection sequence which is always the same with using the same certificate? Do I have to worry about here that my vpn keys got compromised? Anybody ever experienced this? Thanks!

3 2