- NANOG - lists.nanog.org

Your Input Needed: Can ROA Replace LOA? – Short Survey (7 mins)
by Christopher Hawker 16 Nov '23

16 Nov '23

Hello everyone, Aftab Siddiqui is currently exploring the possibility of using Route Object Authorisations (ROAs) as a potential replacement to LOAs. Separate to this (and unknowing of Aftab's research), I had started a discussion on the RPKI Community guild on Discord (https://discord.gg/9jYcqpbdRE) discussing the usage of ROAs instead of LOAs. An LOA, or "Letter of Authority" / "Letter of Authorization," is a formal document granting permission for third parties to take specific actions regarding network resources or services. In the service provider industry, its primary use is for advertising address resources (IPv4/v6 and ASN). When an organization intends to announce its IP prefixes through its own or a transit provider's ASN to the global internet, it typically needs to provide an LOA to their transit provider, confirming their custodianship or ownership of the resources. RPKI ROA, stands for "Resource Public Key Infrastructure Route Origin Authorization," is part of a security framework designed to validate the authenticity of internet routing information. It involves a digitally signed object that specifies which Autonomous Systems (ASes) are permitted to announce specific IP address prefixes. Could you please take a moment to fill out our brief survey? Your feedback will play a crucial role in our understanding of this topic. Survey Link: https://www.surveymonkey.com/r/JCHLWBB Thanks, Christopher Hawker

7 7

NANOG 90 Registration is OPEN! + Call for Presentations + More
by Nanog News 16 Nov '23

16 Nov '23

*NANOG 90 Registration is OPEN!* *Don't Miss Out on Discounted Early Registration* NANOG 90 will take place 12-14 Feb 2024, in Charlotte, NC. Register to attend in-person or virtually now! *REGISTER NOW * <https://nanog.org/events/nanog-90/registration/registrant> *Call for Presentations: NANOG 90 * *Don't Wait - Submit Your Presentation Now * *The NANOG Program Committee (PC) is accepting proposals for in-person or live remote presentations at all sessions of NANOG 90! Requested Topics: * • Network Automation - practical uses, how to get started • Future of Networking - forecast for changes in technology, design, applications • Research & Education - what research is happening now in network operations • + More *MORE INFO * <https://www.nanog.org/program/call-presentations/> *Annual ACM/IRTF Event Connects Importance of Network Research to Network Operations* ANRW Discusses Emerging Results in Applied Networking Research *Why it's worth your time:* The recent Applied Networking Research Workshop (ANRW) organized by the Association for Computing Machinery (ACM) + Internet Research Task Force (IRTF) showed that measurements can inform how Internet protocols are being used and more. Internet Research Task Force Chair + Associate Professor in the School of Computing Science at the University of Glasgow, Colin Perkins, writes about an upcoming annual event our community should attend. *READ MORE <https://nanog.org/stories/articles/acmirtf-event-connects-importance-of-net…>* *Sponsorships Available! Hackathon, Peering Forum + More * *Invest in the Strength of the Community We Have Built* NANOG is, and always has been, dedicated to the people who make up our community. Our in-person conferences draw up to 1,500 individuals in multiple facets of network engineering, operations, and architecture, who gather with us in major cities across North America. We are still in need of a sponsor for Hackathon and the Peering Forum. *Contact Shawn Winstead swinstead(a)nanog.org <swinstead(a)nanog.org> for more details.*

1 0

MCC (Microsoft Connected Cache for ISP)
by Aaron Gould 16 Nov '23

16 Nov '23

Is MCC for ISP comparable to other well-known CDN's, like Facebook FNA, Netflix OCA, etc? Anyone have any experience with MCC in an ISP environment, and do you see much bandwidth savings with it? https://learn.microsoft.com/en-us/windows/deployment/do/mcc-isp -- -Aaron

1 0

Reminder to Submit Presentations for NANOG 90
by NANOG Program 16 Nov '23

16 Nov '23

NANOG Community, The NANOG Program Committee (PC) would like to remind you that we are accepting proposals for in-person or live remote presentations at all sessions of NANOG 90, taking place in Charlotte, NC on 12-14 Feb 2024. Below is a summary of key details and dates from the Call For Presentations on the NANOG website, which can be found at https://www.nanog.org/program/call-presentations/. Requested Topics: Based on feedback from our survey results, we have seen numerous requests for the following topics: - Network Automation - practical uses, how to get started - Future of Networking - forecast for changes in technology, design, applications - Research & Education - what research is happening now in network operations - Security - various protocols of, developments in, problems/solutions - Optical Networking - technology, practice, deployment options - Tutorials - all levels, IPv6, BGP, Segment Routing, DNS, MPLS, VXLAN We are looking to schedule 1,600 minutes of content between General Session and Breakout Rooms for NANOG 90, and have only confirmed 75 minutes at this time - so don’t wait! Presentation abstracts and draft slides should be submitted no later than Thursday, 28 Dec 2023 to be considered for NANOG 90. Presentations may cover current technologies, soon-to-be deployed technologies, and industry innovation. Vendors are welcome to submit talks which cover relevant technologies and capabilities, but presentations should not be promotional, or discuss proprietary solutions. The primary speaker, moderator, or author should submit a presentation proposal and abstract via the Program Committee Tool at: https://www.nanog.org/meetings/submit-presentation/ - Sign in with your Profile Account - Select the type of talk you propose to present, and complete the form Timeline for submission and proposal review: - Submitter enters abstract (and draft slides if possible) in the Program Committee Tool prior to the deadline for slide submission. - PC performs initial review and assigns a “shepherd” to help develop the submission — typically within 2 weeks. - Submitter develops draft slides of talk if not already submitted with the initial proposal. Please submit initial draft slides early — the PC does not evaluate submissions until draft slides are available for review. NANOG Staff is available to assist with slide templates upon request from the submitter. - Panel and Track submissions should provide a topic list and intended/confirmed participants in the abstract. - PC reviews the slides and continues to work with Submitter as needed to develop the topic. - FINAL SUBMISSION DEADLINE Draft presentation slides should be submitted prior to the published deadline for slides (28 Dec 2023). - PC evaluates submissions to determine presentations for the agenda (posted on 22 Jan 2024). - Submitters notified. - Agenda assembled and posted. - Final presentation slides must be submitted prior to the published deadline for slides (05 Feb 2024 for in person + live remote presentations). If you think you have an interesting topic but want feedback or suggestions for developing an idea into a presentation, please email the PC ( nanogpc(a)nanog.org) and a representative will respond to you in a timely manner. Otherwise, submit your talk, tutorial, track, or panel proposal to the Program Committee Tool at your earliest convenience. We look forward to reviewing your submission! NANOG 90 Calendar of Events Date Event/Deadline Thurs, 16 November 2023 CFP Reminder Announcement Thurs, 28 December 2023 DRAFT Presentation Slides Due Mon, 15 January 2024 Topics List Published Mon, 22 January 2024 Meeting Agenda Published Mon, 05 February 2024 Final Slides DUE Sun, 11 February 2024 On-Site Lightning Talk Submissions Open Final slides for accepted presentations must be submitted by Monday, 05 February 2024. Materials received after that date may be updated on the website after the completion of the conference. We look forward to seeing you in February! Sincerely, Stevan Plote Program Committee Chair Sent on behalf of the NANOG PC

1 0

Wifi Carrier Off-load (T-Mobile ? )
by Faisal Imtiaz 16 Nov '23

16 Nov '23

Hello, Is there any one here on Nanog list that has experience or information on how to setup T-Mobile Wifi Carrier Off-load ? (Passpoint), for enterprise use ? (I am familiar with and working with Google Orion, I am needing to do the same for T-Mobile) Will greatly appreciate any or all info. Thanks. Faisal Imtiaz Snappy Internet & Telecom

2 1

DDOS scrubbing
by john doe 15 Nov '23

15 Nov '23

Hi! I could not find any recent thread on the list about ddos scrubbing devices. We are looking into some kind of hybrid service with onprem hardware and scrubbing centers. At the moment we are evaluating NSFocus and Riorey, do the list have any experience from them? Johan

1 0

Zayo woes
by JASON BOTHE 14 Nov '23

14 Nov '23

Does anyone know what’s happening at Zayo? Tickets are taking weeks and months to get resolved, much less get a tech assigned to them. The folks answering the noc phone are mere order takers and are only reading from a script, manager on duty/escalation lines go to voicemail. If anyone can help get to a human in the transport group, that would be great. I’ve given up all hope at this point. Appreciated. Jason

15 29

Strange IPSEC traffic
by Shawn L 14 Nov '23

14 Nov '23

Is anyone else seeing a lot of 'strange' IPSEC traffic? We started seeing logs of IPSEC with invalid spi on Friday. We're seeing it on pretty much all of our PE routers, none of which are setup to do anything VPN related. Most are just routing local customer traffic. decaps: rec'd IPSEC packet has invalid spi for destaddr=X.X.X.X, prot=50, spi=0x9D2D0000(2636972032), srcaddr=211.112.195.167, input interface=TenGigabitEthernet0/0/11 decaps: rec'd IPSEC packet has invalid spi for destaddr=Y.Y.Y.Y, prot=50, spi=0x14690000(342425600), srcaddr=74.116.56.244, input interface=TenGigabitEthernet0/0/5 The destination address is always one of our customer's ip addresses. The source seems to be all over the place, mostly Russia, Korea, China or south east asia. It's not really impacting anything at the moment, just rather annoying. Thanks Shawn

8 7

Celebration: RADB appears to now filter RPKI-invalid IRR route/route6 objects
by Job Snijders 14 Nov '23

14 Nov '23

Dear NANOG, It appears the WHOIS service at whois.radb.net is now filtering out RPKI-invalid IRR route/route6 objects for common expansion queries! This really is exciting and excellent news. I'll elaborate a bit on what this exactly means. Example ROA & IRR object ======================== Take for example the 194.32.71.0/24 test prefix: https://irrexplorer.nlnog.net/prefix/194.32.71.0/24 For experimental purposes, NTT (ages ago) created a cryptographically verifiable RPKI ROA to indicate that any BGP announcements for 194.32.71.0/24 or-longer are RPKI-invalid: https://console.rpki-client.org/rpki.ripe.net/repository/DEFAULT/01/ee8b98-… RPKI ROA: +--------------------------------+ | Prefix: 194.32.71.0/24 | | Origin: AS 0 | | Trust Anchor: RIPE NCC | +--------------------------------+ Additionally, an IRR route object was created in the RIPE NCC managed 'RIPE' IRR database: https://apps.db.ripe.net/db-web-ui/query?bflag=false&dflag=false&rflag=true… IRR Route Object: +--------------------------------+ | route: 194.32.71.0/24 | | origin: AS15562 | | pingable: 194.32.71.1 | | ... | | source: RIPE | +--------------------------------+ Obviously, the above IRR route object is in conflict with the sole RPKI ROA for 194.32.71.0/24, which designated AS 0 exclusively. Following the reasoning that IRR route objects describe possible BGP states, and in BGP the combo 194.32.71.0/24AS15562 would be rejected; it makes sense to go a step further and filter out IRR objects which are RPKI-invalid too. This concept of filtering out RPKI-invalid IRR objects was described in https://www.ripe.net/publications/docs/ripe-731 and also implemented in IRRd v4. RPKI-Invalids no longer visible via whois.radb.net ================================================== Since recently, whois.radb.net indeed applies such filtering and no longer displays the RPKI-conflicting IRR object for 194.32.71.0/24: $ whois -h whois.radb.net 194.32.71.0/24 % No entries found for the selected source(s). The above 'No entries found' output means that the IRRd instance filtered out the RPKI-invalid IRR objects! This is great :-) In doing so, RADB actively helps safeguard the interests of resource holders: it no longer is possible for adversaries to create IRR route objects which are in conflict with RPKI ROAs via the RADB service, and RADB also filters out RPKI-invalid IRR route/route6 objects received via the NRTM mirror streams; additionally, this filter mechanism helps clean up historical route objects that have become irrelevant due to transfers. The RPKI-based filtering mechanism cleans up the past and helps protect going forward. Of course RADB isn't the only IRR operator who apply RPKI-based filtering, NTT is another one, as is TC, etc; but this week's RADB migration it certainly moves the needle in a significant way: now all the world's largest IRR mirrors apply RPKI-based filtering! :-) Thanks ====== I'd like to express appreciation to the NTT crew (past and present) for helping launch the IRRd v4 initiative: Dorian Kim, Shawn Morris, Michael Wheeler, Dan Lowe, Troy Boudreau, Camilo Cardona; to Sasha Romijn from Reliably Coded for leading the development of IRRd v4; and to the Merit crew who diligently worked to migrate RADB away from legacy IRRd - I believe we collectively benefit from their efforts. The IRRd cross-organizational open-source project is here: http://irrd.net/ お疲れ様です! Kind regards, Job

1 0

Am I the only one who thinks this is disconcerting?
by Owen DeLong 13 Nov '23

13 Nov '23

https://dnsviz.net/d/10.159.192.in-addr.arpa/dnssec/ Seems to report a bunch of errors in the DS records for 192.in-addr.arpa held in the in-addr.arpa zone. I figured I’d wait a few days and try again the first few times I encountered this, but it’s persisted for more than two weeks now. Owen

8 12