August 2016 - NANOG - lists.nanog.org

Level3 (3356) to outlook.office365.com via v6?
by David Hubbard 02 Aug '16

02 Aug '16

Curious if anyone else is having issues reaching outlook.office365.com via ipv6 over Level 3? Our customers have begun reporting failures checking email, and in the ones who have had this issue, are using the mail server name outlook.office365.com and are on v6. Traceroute6 shows the traffic dying shortly into Level 3 land at 2001:1900:4:1::3d1 which is likely a Tampa-area router. Thanks, David

2 1

CenturyLink Executive
by Dennis Burgess 02 Aug '16

02 Aug '16

I have been working on a circuit outage since Monday morning, my tickets are closed, can't get ahold of anyone, no phone calls, problem not resolved, anyone from CenturyLink Executive Team could give me a call or e-mail to see if we can get these issues solved. [DennisBurgessSignature] www.linktechs.net<http://www.linktechs.net/> - 314-735-0270 x103 - dmburgess(a)linktechs.net<mailto:dmburgess@linktechs.net>

1 0

Nexus 9k, packet loss through switch on vlan without SVI
by Jeremy 02 Aug '16

02 Aug '16

Running into some weird issues with a Cisco Nexus9k. We have a Cisco 3750X pair stacked, port channel (2x 1G) to a two different blades on a Nexus9k. Isolating the links of the port channel , on one link we can consistently get 800mbps (using iperf), or the other link we consistently get ~34mbps. we have seen this across multiple 3750X stacks. The vlan we were on is just layer2 through the n9k, there are no IP addresses. We were able to (apparently) resolve this issue by creating an SVI on the n9k, with an empty config. Now, even isolating links we can get ~800mbps across the n9k, through the various 3750X stacks. I am confused why creating the SVI would have an impact on this, and why it wouldn't be consistent across both links. If the lack of SVI were at fault, I would be less surprised if it just flat out didn't work, but this partial working state feels very odd. Anyone else seen this? Thoughts? Could traffic be hitting the CPU while going across modules? This feels like quirky n9k internals... Thanks! Jeremy PS: no CRC errors found on interfaces, all looked clean

2 1

ExtremeWare
by Mike Hammett 02 Aug '16

02 Aug '16

Can those that ran switches with ExtremeWare on them remember that far back? I've got a Summit 400t-48 and I can't seem figure out how to get DDM information from the SFP. Did they have that ability? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

4 3

Operations task management software?
by David Hubbard 02 Aug '16

02 Aug '16

Hi all, curious if anyone has recommendations on software that helps manage routine duties assigned to operations staff? For example, let’s say we have a P&P that says someone from the netops group must check that Rancid is successfully backing up all router configs bi-weekly. Ideally, it would send an email reminder to this pre-defined group of people saying hey, it’s Monday, someone needs to check this and come acknowledge the task as having been completed. If that doesn’t occur, pre-defined manager X is notified on Tuesday. If manager X doesn’t get someone to complete the task, director Y is notified, so on and so forth. Then, perhaps periodically it emails manager X anyway and says hey, it’s been three months, you need to audit netops to ensure they’re actually doing the Rancid audit and not just checking that it was done. This could be applied to the staff who check on backup failures, backup internet circuit status, out of band interfaces, etc. A data center I looked at recently had QR code stickers on all of their infrastructure stuff and there were staff assigned to check and log certain displayed values each day. The software would at least ensure they actually visited the equipment by requiring they scan the relevant QR code when in front of it. So I figure something that does what I’m looking for properly already exists. Thanks, David

6 7

EVERYTHING about Booters (and CloudFlare)
by Jair Santanna 01 Aug '16

01 Aug '16

Hi folks, A friend forward me your topic about Booters and CloudFlare. Then I decided to join the NANOG list. The *answer* for the first question about CloudFlare and Booters is at: https://www.youtube.com/watch?v=wW5vJyI_HcU (minute 45:55) given by the _CloudFlare CEO_ in the blackhat2013. I investigate Booters since 2013 and I know many (if not all) the possible aspects about this DDoS-as-a-Service phenomenon. A summary of my entire research (or large part of that) can be watched at https://tnc16.geant.org/web/media/archive/3A (from minute 22:53). On top of that, I developed an algorithm to find Booters and publicly share such list (http://booterblacklist.com/) My main goal with this initiative is to convince people to blacklist and keep on track the users that access Booters (that potentially perform attacks) If you have any question about any aspect of the entire phenomenon don't hesitate to contact me. By the way, I want to help deploy the booters blacklist worldwide and help prosecutors to shutdown this bastards. I have many evidences! Cheers, Jair Santanna jairsantanna.com

37 87

Re: Cloudflare, dirty networks and politricks
by John 01 Aug '16

01 Aug '16

On 2016-08-01 13:20, Baldur Norddahl wrote: > On 2016-07-31 05:46, Randy Bush wrote: >>> This is silly. Anyone is of course allowed to deny service to parties >>> involved in obvious criminal activity. >> so block cloudflare from your network and go back to work already. >> >> randy .... > I do believe that most of us on this list have cause to do that civil > lawsuit, especially if it was done as a class action. But I just own a > small company that is not even based in the US, so I am not going to > be the hero that funds it. Instead I will do what I can to warn > everyone off this company. > > Regards, > > Baldur I think even you will win in court Russian government since a while implemented country-wide blocklist. It is transparent and available online, and there is a lot of cloudflare ip's (http://reestr.rublacklist.net/api/ips) First i thought, again Putin's regime crack on freedom, but after viewing specific cloudflare subnet as example ( http://reestr.rublacklist.net/search/1?q=104.16.) i can say, major part of websites are online gambling, and many of them have court decisions. There is also some ISIL propaganda, questionable nudes of underage (they pretend to be art), drug dealers forums (all in russian language) and etc. As far as i know russians send first abuse letter, and if such content is not removed in reasonable terms - they block resource on "russian firewall". And i believe ignorance hurts cloudflare business in Russia, but do they care? I may understand much more proper position of google, for example if they receive court order from Russia - they block this particular content in Russia only. But they wont back on their position on free speech. And they are able to clearly draw a line between free speech and criminals. Ok, let's say on booters no court decision and it is gray area. But providing connectivity for terrorists propaganda or very questionable content - beyond my understanding. Sure i leave chance that they didn't received notification from officials, but at least now they are aware about this.

1 0