February 2019 - NANOG - lists.nanog.org

Issue with Geolocation in Virginia US
by Raja Sekhar Gullapalli 04 Jan '24

04 Jan '24

Team, We are having issues in our Virginia US office & it shows geolocation in all browsers as Canada instead of US region when we access news.google.com in our PC. Our public ip is 129.46.232.65. This issue is being observed for more than 2 month. Can you help to whom we can contact to resolve the issue. Regards, Raja

8 13

Spectrum technical contact
by Josh Luthman 23 Jan '20

23 Jan '20

We have had a DOS attack for over 12 hours. I simply want them to null route or black hole an address. The traffic is filling one of our circus with them. The farthest I got was them telling me they can't do route changes because we're not public safety. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373

9 19

Cellular backup connections
by Dovid Bender 24 Jun '19

24 Jun '19

Hi All, I finally got around to setting up a cellular backup device in our new POP. I am currently testing with T-Mobile where the cell signal strength is at 80%. The connection is 4G. When SSH'ing in remotely the connection seems rather slow. Ping times seem to be all over the place (for instance now I am seeing: rtt min/avg/max/mdev = 174.142/336.792/555.574/99.599 ms) . Is that just cellular or is that more related to the provider and the location where I am? I could in theory test with VZ and ATT as well. With Verizon they charge $500.00 just to get a public IP and I want to avoid that if possible. Thanks and sorry in advance if this is off topic.

15 19

Re: [proj-bgp] adding graphs for actually unreachable RPKI INVALID prefixes to RPKI Monitor?
by Montgomery, Douglas (Fed) 16 May '19

16 May '19

Our effort to get our new monitor transitioned to a public facing system ran into a wall for ~35 days. Unfortunately during that time, the visa of a visiting researcher leading that effort expired. We have almost recovered from all of that. Unfortunately, we have a bit of a bureaucracy to deploying public facing systems. So I would guess it will take ~end of March to get it on-line. Thanks DougM -- Doug Montgomery, Manager Internet & Scalable Systems Research @ NIST Date: Thu, 14 Feb 2019 21:39:00 +0000 From: nusenu <nusenu-lists(a)riseup.net> To: "Sriram, Kotikalapudi (Fed)" <kotikalapudi.sriram(a)nist.gov> Cc: rpki-monitor <rpki-monitor(a)nist.gov>, "nanog(a)nanog.org" <nanog(a)nanog.org>, "Montgomery, Douglas (Fed)" <dougm(a)nist.gov> Subject: Re: [proj-bgp] adding graphs for actually unreachable RPKI INVALID prefixes to RPKI Monitor? Message-ID: <2b8f9b07-27a7-08ba-ac51-afd39b30f769(a)riseup.net> Content-Type: text/plain; charset="utf-8" Sriram, Kotikalapudi (Fed) (2018-09-18):> I also found your analysis very interesting and useful. Thanks for that. > >> What do you think about adding graphs that show the amount of actually >> unreachable prefixes and IP space? (prefix where no alternative valid/unknown announcement exists) > > I am also part of the NIST BGP team. > Doug has already responded with information that we will soon have a new version of the NIST Monitor > which will provide the kind of graphs that you requested. Can you share an estimate for when you plan to publish the new version of the NIST Monitor? thanks, nusenu

2 2

Disney+ CDN
by Aaron Graves 28 Apr '19

28 Apr '19

Anyone know what Disney is planning on doing for streaming content distribution once they leave Netflix? Would be nice if they'd provide an on-prem cache server. AG

14 18

JunOS Fusion Provider Edge
by Mehmet Akcin 12 Apr '19

12 Apr '19

Hey there Any ISP using Juniper Fusion Provider Edge? https://www.juniper.net/documentation/en_US/junos/information-products/path… I am trying to chat with an engineer besides Juniper engineers to understand how buggy (or not) this is to go on production for a medium size ISP. Any feedback good/bad appreciated. -- Mehmet +1-424-298-1903

10 10

FYI - Major upgrade this weekend to www.arin.net and ARIN Online
by John Curran 22 Mar '19

22 Mar '19

NANOGers - This weekend there will be a major upgrade to www.arin.net<http://www.arin.net> website and the ARIN Online system. If you routinely use these systems, you might want to read what follows for an overview of the upcoming change – https://teamarin.net/…/02/27/getting-ready-for-the-big-rev…/<https://teamarin.net/%E2%80%A6/02/27/getting-ready-for-the-big-rev%E2%80%A6/> FYI, /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] How Community Input Shaped Our New ARIN.NET<http://ARIN.NET> Date: 27 February 2019 at 11:50:22 AM EST To: <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> On 2 March, we will be deploying a new and improved www.arin.net<http://www.arin.net>. This project is the product of collaboration with our community; user input was a driving factor at every stage. We encourage you to read our new blog post about the process and some of the changes you will see when we go live: https://teamarin.net/2019/02/27/getting-ready-for-the-big-reveal/ Regards, Communications and Member Services American Registry for Internet Numbers (ARIN) _______________________________________________ ARIN-Announce You are receiving this message because you are subscribed to the ARIN Announce Mailing List (ARIN-announce(a)arin.net) Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-announce Please contact info(a)arin.net if you experience any issues.

5 7

Analysing traffic in context of rejecting RPKI invalids using pmacct
by Job Snijders 14 Mar '19

14 Mar '19

Dear all, Whether to deploy RPKI Origin Validation with an "invalid == reject" policy really is a business decision. One has to weigh the pros and cons: what are the direct and indirect costs of accepting misconfigurations or hijacks for my company? what is the cost of deploying RPKI? What is the cost of honoring misconfigured RPKI ROAs? There are a few thousand misconfigured ROAs, what does this mean for me? To answer these questions, Paolo Lucente and myself worked to extend pmacct traffic analysis engine (http://pmacct.net/) in such a way that it can do perform the RFC 6811 Origin Validation procedure and present the outcome as a property in the flow aggregation process. Pmacct has the ability to ingest BGP feeds and correlate the BGP data to the sflow/netflow/ipfix data. This allows for fantastic business intelligence, you can see exactly how much traffic is flowing from what customers to what endpoints for what reason! Pmacct implemented Origin Validation in a cute way: it separates out RPKI invalid BGP announcements into two categories: a) "invalid with no overlapping or alternative route" (aka will be blackholed if 'invalid == reject') b) "invalid but an overlapping unknown/valid announcement also exists" (end-to-end connectivity can still work). Because pmacct separates out the various types kinds of (invalid) BGP announcements, operators don't have to do deploy *anything* in their network to get a good grasp on how their connectivity to the rest of the Internet would look like after deploying a "invalid == reject" policy. No changes to your network configurations are required to make use of this feature, you don't need to tag routes with communities or do other tricks. All the analysis happens inside pmacct. Of course we tested this first in the NTT global backbone AS 2914! At the moment of writing, we're seeing less than a handful of gigabits per second being send towards BGP announcements that are RPKI Invalid and for which no alternative route exists. In context of NTT's backbone that amount of traffic is just statistical noise. This is a very encouraging sign, it may help us move towards the goal of deploying RPKI Origin Validation in AS 2914. Nusenu wrote a great blog post on where these RPKI ROA misconfigurations are located, i recommend reading their posts to develop a better understanding of the problem space: https://medium.com/@nusenu/where-are-rpki-unreachable-networks-located-65c7… Even if you don't intend to deploy RPKI Origin Validation (or are single-homed), pmacct's RPKI capabilities can be useful in forensic investigations. It'll be easier to analyse how much and what kind of traffic for what period of time was sent to a possible hijack. This will help you when writing RFOs! If you want to testdrive this feature, fetch pmacct version 1.7.3-rc1 from https://github.com/pmacct/pmacct/releases/tag/1.7.3-rc1 Documentation on how to configure the feature: https://github.com/pmacct/pmacct/blob/master/QUICKSTART#L1783-#L1833 https://github.com/pmacct/pmacct/blob/master/CONFIG-KEYS#L2626-#L2647 Let us know what you think! Or if you'd like to chat telemetry with Paolo or me about analysing the effects of BGP hijacks and RPKI, we'll both be at the San Francisco NANOG meeting next week! Kind regards, Job ps. Dear Kentik & Deepfield, please copy+paste this feature! We'll happily share development notes with you, you can even look at pmacct's source code for inspiration. :-)

4 4

ICMPv6 "too-big" packets ignored (filtered ?) by Cloudflare farms
by Jean-Daniel Pauget 13 Mar '19

13 Mar '19

hello, I confess using IPv6 behind a 6in4 tunnel because the "Business-Class" service of the concerned operator doesn't handle IPv6 yet. as such, I realised that, as far as I can figure, ICMPv6 packet "too-big" (rfc 4443) seem to be ignored or filtered at ~60% of ClouFlare's http farms as a result, random sites such as http://nanog.org/ or https://www.ansible.com/ are badly reachable whenever small mtu are involved ... support@cloudflare answered me that because I'm not the owner of concerned site, and because of security reasons, they wouldn't investigate further. are there security concerns with ICMP-too-big ? regards, -- Jean-Daniel Pauget http://rezopole.net/ Rezopole/LyonIX +33 (0)4 27 46 00 50

19 38

Arista Layer3
by Romeo Czumbil 09 Mar '19

09 Mar '19

So I've been using Arista as layer2 for quite some time, and I'm pretty happy with them. Kicking the idea around to turn on some Layer3 features but I've been hearing some negative feedback. The people that I did hear negative feedback don't use Arista themselves. (they just heard....) So do we have any Arista L3 people out here that can share some negatives or positives? Use case: Just some MPLS IPv4/IPv6 routing, l2vpn OSPF/BGP Maybe 20k routes (no full internet routes) 7050 Series 7280 Series -Romeo

20 33