March 2021 - NANOG - lists.nanog.org

How to Fix IP GEO for google/youtube tv
by tim＠nwohiobb.com 11 Mar '21

11 Mar '21

Can anybody tell me how to fix my IP block for google websites and youtube/tv because I am getting customers saying they are out of the country and I tried to apply for the google isp portal and I have not gotten anything back on this. Thanks Tim

8 13

Australian Dark Fibre Providers - Sydney
by Rod Beck 11 Mar '21

11 Mar '21

Anyone besides Superloop? Regards, Roderick. Roderick Beck Global Network Capacity Procurement United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> https://unitedcablecompany.com/video/ New York City & Budapest rod.beck(a)unitedcablecompany.com Budapest: 36-70-605-5144 NJ: 908-452-8183 [1467221477350_image005.png]

3 2

Cable Landing Station Address
by Rod Beck 10 Mar '21

10 Mar '21

Vung Tau cable landing station - 3 cables include AAE1. I want the street address which many not even exist given PTT paranoia. Roderick Beck Global Network Capacity Procurement United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> https://unitedcablecompany.com/video/ New York City & Budapest rod.beck(a)unitedcablecompany.com Budapest: 36-70-605-5144 NJ: 908-452-8183 [1467221477350_image005.png]

4 8

Network / Infrastructure security testing services
by Nathanael Cariaga 10 Mar '21

10 Mar '21

Apologies for this shameless plug, but wanted to ask if any folks on this list who does network/infrastructure security testing? Please to reach back to me off the list. Thank you for your time.

5 5

Contact data for outlook.com
by Dan Walters 10 Mar '21

10 Mar '21

Good afternoon, So I'm looking for a contact at Microsoft in particular someone on the outlook spam protection/prevention team to assist us with a IP block. I have allready signed up for SNDS and there is no data given . Please feel free to contact me off the list. Best Regards, Daniel Walters

5 5

Re: an IP hijacking attempt
by Brian Turnbow 09 Mar '21

09 Mar '21

If they had a route record that was close, I Would give them the benefit of doubt. They do not however as the only records start with 217. And our IPs are 45. So It Is very strange. Would you send a LOA without a route record? Brian Turnbow ________________________________ Da: Mel Beckman <mel(a)beckman.org> Inviato: martedì 9 marzo 2021 19:17 A: Brian Turnbow Cc: North American Network Operators' Group Oggetto: Re: an IP hijacking attempt It could just be a typo on the LOA. It seems unlikely any ISP would approve a forged LOA that could readily be debunked by contacting the IP space owner. The whole point of LOA’s is to facilitate this verification. -mel via cell > On Mar 9, 2021, at 10:01 AM, Brian Turnbow via NANOG <nanog(a)nanog.org> wrote: > > Hello everyone, > > We received a strange request that I wanted to share. > An email was sent to us asking to confirm a LOA from a diligent ISP. > The Loa was a request to open bgp for an AS , that is not ours, to announce a /23 prefix that is ours. > So basically this entity sent to their upstream a request to announce a prefix from one our allocated ranges. > We have the allocation correctly registered and ROAs in place , but it is worrisome that someone would attempt this. > Obviously we have informed the ISP that the LOA is not valid and are trying to contact the originating party. > Aside from RIRs for the offending AS and our IPs, Is there anywhere to report this type of activity? > We have dealt with hijacking technically speaking in the past but this is the first time, to my knowledge, of someone forging a LOA with our IPs. > > Thanks in advance for any advice > > Brian > > P.S. a big thanks to Chris for checking the boxes before activating the filter if you are on the list! > > > >

3 2

Ip space Dilemma
by Justin Wilson (Lists) 09 Mar '21

09 Mar '21

Folks, We have an IP block I have asked about help on a few times on here. This is a block we received from ARIN in June of 2020. We have several state networks here in Indiana dropping this traffic at their firewalls. I have been working with them since we discovered this issue in September. I am not getting anywhere with them and was finally told we were not a priority. I am at the point I need to give the space back because it is unusable to the ISP customers. Does anyone have any creative ideas on how to fix this? Justin Wilson j2sw(a)mtin.net — https://j2sw.com - All things jsw (AS209109) https://blog.j2sw.com - Podcast and Blog

6 5

AWS Using Class E IPv4 Address on internal Routing
by Douglas Fischer 09 Mar '21

09 Mar '21

Has anybody seen that also? P.S.: I'm completely in favor of a complementary RFC assing FUTURE USE exclusively to "Between Routers" Link Networks... -- Douglas Fernando Fischer Engº de Controle e Automação

5 6

Is there an established method for reporting/getting removed a company with 100% false peeringdb entries?
by Eric Kuhnke 09 Mar '21

09 Mar '21

First, take a look at this: https://www.peeringdb.com/asn/18894 Now look at these (or use your own BGP table analysis tools): https://bgp.he.net/AS18894 https://stat.ripe.net/18894 The claimed prefixes announced, traffic levels and POPs appear to have no correlation with reality in global v4/v6 BGP tables. It is also noteworthy that I have inquired with a number of persons I know who are active in network engineering in NYC, and nobody has ever encountered this company.

6 5

Spoofer Report for NANOG for Feb 2021
by CAIDA Spoofer Project 08 Mar '21

08 Mar '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Feb 2021: ASN Name Fixed-By 62904 EONIX-COMMUNICATIONS-ASBLOCK-6 2021-02-27 18450 WEBNX 2021-02-28 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Feb 2021: ASN Name First-Spoofed Last-Spoofed 46562 PERFORMIVE 2016-04-26 2021-02-27 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2021-02-23 7459 GRANDECOM-AS1 2016-09-26 2021-02-12 20412 CLARITY-TELECOM 2016-09-30 2021-02-27 6181 FUSE-NET 2016-10-10 2021-02-25 14971 PINETEL 2016-10-21 2021-02-14 11427 TWC-11427-TEXAS 2016-10-21 2021-02-25 12083 WOW-INTERNET 2016-11-09 2021-02-17 30036 MEDIACOM-ENTERPRISE-BUSINESS 2016-11-16 2021-02-14 22898 ATLINK 2016-12-16 2021-02-25 20473 AS-CHOOPA 2017-01-08 2021-02-17 63296 AWBROADBAND 2017-09-01 2021-02-24 27589 MOJOHOST 2017-09-20 2021-02-27 62240 Clouvider 2017-10-20 2021-02-27 546 PARSONS-PGS-1 2017-11-20 2021-02-26 12222 AKAMAI 2018-02-14 2021-02-16 393564 SPOKANE 2018-06-05 2021-02-23 33452 RW 2018-09-19 2021-02-23 20448 VPNTRANET-LLC 2018-09-20 2021-02-22 8047 GCI 2019-04-11 2021-02-12 53356 FREE RANGE CLOUD 2020-05-19 2021-02-12 6391 URBAN-15 2020-05-29 2021-02-16 7040 NETMINDERS 2020-08-31 2021-02-27 32181 ASN-GIGENET 2020-09-02 2021-02-27 11814 DISTRIBUTEL-AS11814 2020-11-22 2021-02-27 208188 PUGET-SOUND-NETWORKS 2020-12-04 2021-02-27 53703 KWIKOM 2021-01-17 2021-02-19 40220 MARIA 2021-02-08 2021-02-08 54527 ASTUTEHOSTING 2021-02-21 2021-02-21 64089 DNSFILTER 2021-02-28 2021-02-28 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0