September 2021 - NANOG - lists.nanog.org

IPv6 woes - RFC
by Grant Taylor 01 Oct '21

01 Oct '21

Hi, Does anyone have any recommendation for a viable IPv6 tunnel broker / provider in the U.S.A. /other/ /than/ Hurricane Electric? I reluctantly just disabled IPv6 on my home network, provided by Hurricane Electric, because multiple services my wife uses are objecting to H.E.'s IPv6 address space as so called VPN or proxy provider. Netflix, HBO Max, Pandora, and other services that I can't remember at the moment have all objected to H.E. Disabling IPv6 feels *SO* *WRONG*! But fighting things; hacking DNS, null routing prefixes, firewalling, etc., seems even more wrong. Is there a contemporary option for home users like myself who's ISP doesn't offer native IPv6? Please consider this to be a Request for Comments and suggestions. Thank you and have a nice day / weekend / holiday. -- Grant. . . . unix || die

55 256

Cisco WAE
by Mark Davis 30 Sep '21

30 Sep '21

Is anyone on the list familiar with configuring WAE to exclude specific devices from collection? Thanks -- Mark William Davis mdavis(a)gmail.com

2 2

Register Now for NANOG 83 + VIDEO | Ep.2 w/ Geoff Huston
by Nanog News 29 Sep '21

29 Sep '21

*NANOG Partners with ICANN + Internet Society* *Collaboration of Resources will Better Serve Communities* In addition to our long-standing relationship with the American Registry for Internet Numbers (ARIN), NANOG would like to also announce a new partnership with the Internet Corporation for Assigned Names and Numbers (ICANN) and the Internet Society. These partnerships will help realize common objectives, promote collaboration, and strengthen the outreach efforts of all the organizations involved. *READ MORE <https://www.nanog.org/stories/nanog-signs-a-memorandum-of-understanding-wit…>* *How will You Attend NANOG 83?* *Register Now In-Person or Virtually* Get excited for hybrid NANOG 83! Expect incredible programming, interactive expos, networking events from the comfort of your home and/or in person. The event will take place Nov. 1 - 3 in Minneapolis, MN, and all programming + networking events will stream live for real-time engagement. *REGISTER NOW <https://www.nanog.org/events/nanog-83/>* *INTERNET INNOVATORS - NEW EPISODE * *WATCH EP. 2 w/ Internet Pioneer Geoff Huston* Leave it to Internet Hall of Fame Global Connector + chief scientist for APNIC, Geoff Huston to make the hairy + scary parts of the Internet almost sound charming. Maybe it's his sparkling wit, pleasant demeanor, (or maybe even) the Australian accent that makes all pills a little easier to swallow. Ep.2 of our new web series, "Internet Innovators" Huston explains why we need to continue to address the elephants in the room. Huston also talks about the importance of developing public speaking skills + "how to make an impact on a room full of geeks." We also get to hear more about Huston's childhood in Australia and what made him the man he is today. Overall, Huston will leave you wanting to ask better questions and think more critically of the digital world around you. *WATCH EP. 2 NOW * <https://www.nanog.org/news-stories/nanog-tv/internet-innovators/geoff-husto…>

1 0

RE: uPRF strict more
by Jean St-Laurent 29 Sep '21

29 Sep '21

I understand better why some prefer acl vs uRpf. For sure, forwarding 400 Gbps of 80B frames is a sign that something bad is happening. 😉 Jean -----Original Message----- From: brad dreisbach <bradd(a)ntt.net> Sent: September 29, 2021 4:18 PM To: Jean St-Laurent <jean(a)ddostest.me> Cc: 'brad dreisbach' <bradd(a)us.ntt.net>; 'Phil Bedard' <bedard.phil(a)gmail.com>; 'North American Network Operators' Group' <nanog(a)nanog.org> Subject: Re: uPRF strict more On Wed, Sep 29, 2021 at 04:07:19PM -0400, Jean St-Laurent wrote: >Thanks a lot for sharing. > >So 100 Gbps at line rate with 80B frames is about ~150 Mpps. > >100 Gbps at line rate with 208B frames is about ~60 Mpps. > >It's a significant penalty. and keep in kind the 4x100 card is 1 port per NPU. they make an 8x100 where the NPU's are shared. it gets even worse. not to single out cisco, this is just how urpf works. juniper had similar penalties, i just cant find the numbers. -b > >Jean > >-----Original Message----- >From: brad dreisbach <bradd(a)us.ntt.net> >Sent: September 29, 2021 3:33 PM >To: Jean St-Laurent <jean(a)ddostest.me> >Cc: 'brad dreisbach' <bradd(a)us.ntt.net>; 'Phil Bedard' ><bedard.phil(a)gmail.com>; 'North American Network Operators' Group' ><nanog(a)nanog.org> >Subject: Re: uPRF strict more > >On Wed, Sep 29, 2021 at 02:54:43PM -0400, Jean St-Laurent wrote: >>Hi Brad, >> >>I'd be interested to hear more about this pps penalty. Do we talk about 5% penalty or something closer to 50%? >> >>Let me know if you still have some numbers close to you related to PPS with uRPF loose. > >iirc, strict vs loose doesnt matter, its still an extra lookup which effects the performance. i was able to find some numbers to give an example. > >the 4x100G tomahawk card was able to pass min frame size(which iirc on >ixia is >80B) at line rate with no features enabled. turn on uRPF and it is only able to pass 208B frames at line rate. > >similar results were seen with several generations of cisco and juniper line cards(if i tested nokia i cant recall, we had stopped doing urpf when they were introduced into the network). > >-b >

1 0

Identifying submarine links via traceroute
by PAUL R BARFORD 29 Sep '21

29 Sep '21

Hello, I am a researcher at the University of Wisconsin. My colleagues at Northwestern University and I are studying submarine cable infrastructure. Our interest is in identifying submarine links in traceroute measurements. Specifically, for a given end-to-end traceroute measurement, we would like to be able to identify when two hops are separated by a submarine cable. Our initial focus has been on inter-hop latency, which can expose long links. The challenge is that terrestrial long-haul links may have the same or longer link latencies as short submarine links. So, we're interested in whether there may be other features (e.g., persistent congestion, naming conventions in router interfaces, peering details, etc.) or techniques that would indicate submarine links. Any thoughts or insights you might have would be greatly appreciated - off-list responses are welcome. Thank you. Regards, PB Paul Barford University of Wisconsin - Madison

4 4

Admin for .tk (not a spam/abuse complaint!)
by Tim Harman 29 Sep '21

29 Sep '21

Hi, If anyone has contact details for the operators of the .tk TLD, could you contact me off-list please? We are unable to contact the authoritive NS for this TLD - it seems our range is on a blacklist or they have some odd route back to us that isn't working. Thus our customers can't resolve any .tk names. I've tried mailing a few @dot.tk (from a host that has no trouble resolving the domain!) but have heard nothing back. Specifically after a contact for whoever maintains ;; ADDITIONAL SECTION: a.ns.tk. 172800 IN A 194.0.38.1 b.ns.tk. 172800 IN A 194.0.39.1 c.ns.tk. 172800 IN A 194.0.40.1 d.ns.tk. 172800 IN A 194.0.41.1 {11:58}~ ➭ dig @194.0.41.1 test.tk ; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> @194.0.41.1 test.tk ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached Many Thanks, Tim

2 1

100GbE beyond 40km
by Randy Carpenter 28 Sep '21

28 Sep '21

How is everyone accomplishing 100GbE at farther than 40km distances? Juniper is saying it can't be done with anything they offer, except for a single CFP-based line card that is EOL. There are QSFP "ZR" modules from third parties, but I am hesitant to try those without there being an equivalent official part. The application is an ISP upgrading from Nx10G, where one of their fiber paths is ~35km and the other is ~60km. thanks, -Randy

18 21

Robocall Mitigation Database Call Blocking Deadline Is Today
by Sean Donelan 28 Sep '21

28 Sep '21

According to the FCC, 4,798 companies had filed in the Robocall Mitigation Database with many hundreds of carriers, including all of the largest phone carriers, certifying to implementation of STIR/SHAKEN standards on their IP networks. Beginning today, if a voice service provider’s certification and other required information does not appear in the FCC’s Robocall Mitigation Database, intermediate providers and voice service providers will be prohibited from directly accepting that provider’s traffic. Note the word "directly." Guess what's going to happen? https://www.fcc.gov/document/fcc-robocall-mitigation-database-call-blocking…

1 0

What happens when you don't validate/scrub data on input from whois
by Eric Kuhnke 28 Sep '21

28 Sep '21

https://research.securitum.com/fail2ban-remote-code-execution/ What happens if you put the following in your whois entry: drop table prefixes; Or anything similar... https://xkcd.com/327/

1 0

VoIP Provider DDoSes
by Mike Hammett 28 Sep '21

28 Sep '21

As many may know, a particular VoIP supplier is suffering a DDoS. https://twitter.com/voipms Are your garden variety DDoS mitigation platforms or services equipped to handle DDoSes of VoIP services? What nuances does one have to be cognizant of? A WAF doesn't mean much to SIP, IAX2, RTP, etc. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

10 15