February 2018 - NANOG - lists.nanog.org

Dark Fiber Providers - Domestic
by Rod Beck 06 Feb '18

06 Feb '18

Who regulates and licenses dark fiber providers? Or does no one? Roderick Beck Director of Global Sales United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-30-859-5144 [1467221477350_image005.png]

3 2

Embratel / Claro AS4230
by Faisal Imtiaz 06 Feb '18

06 Feb '18

Hello All, Looking for a Technical Contact / IP NOC Engineer for EmbraTel/Claro AS4230 ? We are seeing some of the routes we are announcing not showing up in there route tables. (170.80.188.0/24 and 170.80.190.0/24 and 170.80.191.0/24) Off list contact will be great. Thanks Faisal Imtiaz Snappy Internet & Telecom http://www.snappytelecom.net Tel: 305 663 5518 x 232 Help-desk: (305)663-5518 Option 2 or Email: Support(a)Snappytelecom.net

1 0

Re: improving signal to noise ratio from centralized network syslogs
by Scott Weeks 06 Feb '18

06 Feb '18

--- tarko(a)lanparty.ee wrote: > This is done with the 'logging facility' > command on the devices: > > After defining your syslog server's IP > address and the level of messaging you want > (I set it to debug because I want to see > everything): > > on the routers: logging facility local0 > on the switches: logging facility local1 Alternative, and more universal, way to do it is to use multiple IPs for syslog server. Then configure correct syslog server IP on the device. syslog-ng and others can all do filtering to different destinations based on the IP where message was received. ------------------------------------------------ The nice thing about the simple way is you see everything that's happening on the network, except what you 'egrep -v' out, which you already know about. Then you find things you weren't expecting. You don't go looking for stuff. You just watch the network events scroll by in real time ans see what shows up. I have no knowledge of syslog-ng. Does it do the real time scrolling like I mention? scott

4 4

40G reforming
by Baldur Norddahl 06 Feb '18

06 Feb '18

Hello Is it possible to reform a 40G signal as individual 10G links? The idea is to use a 40G QSFP multimode MTP module such as https://www.fs.com/products/44058.html. Then connect it using a MTP breakout cable such as https://www.fs.com/products/68049.html to get four dual fiber connectors. These are then connected to four 10G SFP+ multimode modules such as https://www.fs.com/products/11589.html. The reformer could be https://www.fs.com/products/43721.html. And finally the reformed signal can be transported using anything including DWDM modules such as https://www.fs.com/products/44058.html. Just using fs.com as a reference to the kind of equipment I am talking about. Many other vendors offer simelar products. The motivation for doing this is to get access to the many options that are available for 10G optics but not possible with 40G. Regards, Baldur

7 10

Re: improving signal to noise ratio from centralized network syslogs
by Scott Weeks 05 Feb '18

05 Feb '18

--- jmaimon(a)jmaimon.com wrote: Centralized logging is a good thing. However, what happens is that every repetitive, annoying but not (usually) important thing fills up the log with reams of what you are not looking for. --------------------------------------- Apologies, I'm late to the party. But I just want to add one thing for the archives. It's along with what Rich Kulawiec said, "it forces you to look at your own data, which is really helpful. You'll be surprised at what you find if you've never done it before." This is accurate. It's fun to see what your network is putting out. This is all from memory (I've done it so many times it's in there permanently... :-) as I don't have a unix server or a router in front of me to use, so don't hold me to exact details... And it's mainly for the newbies. Have all the routers send to one syslog file, switches to another and other devices to a third on a *nix box: For example, send the router messages to /var/log/router.log and the switch messages to /var/log/switch.log This is done with the 'logging facility' command on the devices: After defining your syslog server's IP address and the level of messaging you want (I set it to debug because I want to see everything): on the routers: logging facility local0 on the switches: logging facility local1 on the logging server in: /etc/rsyslog.conf local0.* /var/log/router.log local1.* /var/log/switch.log Use logrotate to manage the log files as they can get quite large. Then, you can watch your network in real time like so (below is all one line): tail -f /var/log/router.log /var/log/switch.log | egrep -vi 'term1|term2|termN' 'egrep -v' takes out all the lines you don't want to see while the syslog messages scroll across the screen. Say there is a battery condition on router1 and a duplex mismatch on a switch I don't want to see: tail -f /var/log/router.log /var/log/switch.log | egrep -vi 'router1.*battery|switch1.*duplex.*mismatch' For me, N can get to 40-50 sometimes, so I put it into a shell script like so: vi log.sh --------------------------- #! /bin/sh tail -f /var/log/router.log /var/log/switch.log | egrep -v 'term1|term2|termN' --------------------------- then, run it like so: ./log.sh It's all netgeek fun-n-games from there on. :) scott

5 4

Akamai caches hammering Sophos XG firewalls
by Jeremy Parr 05 Feb '18

05 Feb '18

Somewhat OT, but before I was a jack of all trades enterprise sysadmin, I was a jack of all trades ISP sysadmin. I'm seeing an issue at a few sites where I have Sophos XG firewalls deployed where the XG gets hammered on it's WAN interface by Akamai hosts with TCP re-transmissions. Anyone at Akamai who may have some background on this issue please reach out to me. The hosts currently in question are 24.244.145.137 and 24.244.145.139, but I suspect that is only due to these being closest to me, colocated at my ISP AS15146.

2 1

Re: improving signal to noise ratio from centralized network syslogs
by Scott Weeks 05 Feb '18

05 Feb '18

--- shane(a)short.id.au wrote: In addition to that, you can use some fancy awk colour coding, so you can make it highlight certain lines based on content.. I use this for my e-mail logs, but I’m sure it could be adapted: tail -n 1000 -f /var/log/mail-submission.log | grep smtp.*relay | awk ' /sent/ {print "\033[32m" $0 "\033[39m"} /bounced/ {print "\033[31m" $0 "\033[39m"} /deferred/ {print "\033[33m" $0 "\033[39m"} ---------------------------------------------------- The main thing for me is to find things that your network is doing that you weren't aware of. Not normal things you want to see that a monitoring system will alert you about. scott

1 0

RADB - aut-num policy question
by Ryan, Spencer 04 Feb '18

04 Feb '18

Hello all, I'm a bit out of my element on this one and hoping someone can help. I'm putting together an aut-num entry for RADB and have a question about our Comcast peerings. We peer with AS7922 in several sites, but if you look at the actual pathing via bgp.he.net or just the routes themselves you can see that the first AS in the path after ours is either 7015 or 33668 depending on region for the paths that prefer comcast's network. For the import/export policy can I just reference 7922 or do I also need to include the others? Thanks in advance! Spencer Ryan | Senior Systems Administrator | sryan(a)arbor.net<mailto:sryan@arbor.net> Arbor Networks | The security division of NETSCOUT +1.734.794.5033 (d) | +1.734.846.2053 (m) www.arbornetworks.com<http://www.arbornetworks.com/>

1 0

Merit radb https interface, TLS1.0 only?
by Eric Kuhnke 03 Feb '18

03 Feb '18

Is the radb login page supposed to be TLS1.0 only? This is with the latest version of Firefox. Screenshot: https://imgur.com/nnlFmLZ I also noticed that the registration page is plain http/non TLS. for reference: https://www.google.com/search?client=ubuntu&channel=fs&q=tls+1.0+deprecated…

3 2

listserv hosed? [Was: Fwd: nanog.org mailing list memberships reminder]
by Paul Ferguson 02 Feb '18

02 Feb '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 oh noes. the listserv deded. Started getting a series of these just now from the past. :-) And yes, the headers reveal that they are indeed coming from the NANOG listserv/MailMan. Can someone please fix that? kthxbai. :-) - - ferg - -------- Forwarded Message -------- Subject: nanog.org mailing list memberships reminder Date: Fri, 01 Sep 2017 05:00:40 +0000 From: mailman-owner(a)nanog.org To: fergdawgster(a)mykolab.com This is a reminder, sent out once a month, about your nanog.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. [...] - -- Paul Ferguson ICEBRG.io, Seattle USA -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlpz4g8ACgkQKJasdVTchbIYkwD/YKFV2FP6R+Ow0o2HuiWfAD/H +7s2kWMowu0L3rpu1ssA/j+NTaDvydw99/BHG3ZAfj8XYItxDU8zYC976kS81AvF =Rexp -----END PGP SIGNATURE-----

7 8