- NANOG - lists.nanog.org

Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Ronald F. Guilmette 05 Nov '14

05 Nov '14

I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

2 1

hawaiian telcom
by Chris McDonald 05 Nov '14

05 Nov '14

if there is a commercial contact from hawaiian telcom lurking here, can you please ping me offlist? thanks, chris

1 0

Re: Default routes on BGP routers with full feeds
by William Herrin 05 Nov '14

05 Nov '14

On Tue, Nov 4, 2014 at 12:47 PM, Berry Mobley <berry(a)gadsdenst.org> wrote: > I'm wondering how many of you who are multihomed > also add default routes pointing to your providers > from whom you are receiving full feeds. > > If so, why? If not, why not? Back when I worked for the DNC we ran into a problem with the TCAM size. Given the DNC's focus on the U.S., network reliability to the /8's operated out of the APNIC and RIPE regions was much less important to us. So, we filtered BGP announcements from within those /8's and relied on covering routes to get our packets there instead. I used covering /8's instead of a default, but a default would have been as effective. Regards, Bill Herrin -- William Herrin ................ herrin(a)dirtside.com bill(a)herrin.us Owner, Dirtside Systems ......... Web: <http://www.dirtside.com/> May I solve your unusual networking challenges?

1 0

Issues with SNMP monitoring over a GRE tunnel.
by Brian Christopher Raaen 05 Nov '14

05 Nov '14

I have two different customers where I am unable to monitor their networks due to GRE MTU issues. This is monitoring cable modems so I can't change the MTU of the end device. The problem I am having is that the modems are producing frames that appear to be larger than some kind of MTU limit in the system (we do not control the customer routers in either case). One that I am looking at is dropping anything larger than 1472, and I have let to tune down on the other one. In one case the customer endpoint is a Cisco ASR1K router and the other is a ASR9K. because these are UDP packets I can't use a mss to clamp things down. Also I have been unable to replicate the issue in my lab, so I can't send them a list of commands to help fix the issue on their end. -- Brian Christopher Raaen Network Architect Zcorum

3 2

RE: Default routes on BGP routers with full feeds
by Mike Walter 05 Nov '14

05 Nov '14

I have 5 providers and we get the default from all of them and full routing tables. I have seen cases where if there is no default route, the traffic didn't know where to go, even with full routes from all my providers. -Mike -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Berry Mobley Sent: Tuesday, November 04, 2014 12:47 PM To: nanog(a)nanog.org Subject: Default routes on BGP routers with full feeds I'm wondering how many of you who are multihomed also add default routes pointing to your providers from whom you are receiving full feeds. If so, why? If not, why not? Thanks, Berry

7 7

BGP process torture
by Brandon Martin 05 Nov '14

05 Nov '14

I'm attempting to help somebody re-produce a possible glitch that relies on heavily loading the BGP process on their router. Anybody know a good/pre-canned way to synthesize, preferably with some knobs to control behavior, a couple of full-table edge-like session in terms of number of routes as well as amount of churn? -- Brandon Martin

4 4

Re: Default routes on BGP routers with full feeds
by Mark Tinka 05 Nov '14

05 Nov '14

On Tuesday, November 04, 2014 07:47:21 PM Berry Mobley wrote: > I'm wondering how many of you who are multihomed also add > default routes pointing to your providers from whom you > are receiving full feeds. > > If so, why? If not, why not? We filter out default routes from our upstreams, but many of our customers request it so we send them both full + default routes. We have not yet been in a position where a default route to an upstream would have come in handy, as we do a lot of peering (close to 70% of our Internet traffic) and have a reasonable number of upstreams. Mark.

1 0

Seeking clueful Comcast contact re static IP address info
by John LeCoque 05 Nov '14

05 Nov '14

Hello all, Sorry to take such a basic issue all the way to NANOG, but my team has nearly 16 hours into this issue via phone / e-mail with no results. We just need the IP address information for our recently installed DOCSIS service at a location in Tallahassee, FL. Unfortunately we have had no luck with support (after many attempts), and our sales rep has made it very clear that he does not care. Is there anyone from Comcast here who could contact me off-list to help us get this resolved? I am very grateful for any assistance. Thank you, John

1 1

Re: Cisco CCNA Training
by Scott Weeks 04 Nov '14

04 Nov '14

For vendor agnostic netgeek training there is always the NANOG Education Series: https://www.nanog.org/meetings/education/home scott

1 0

Re: Default routes on BGP routers with full feeds
by Owen DeLong 04 Nov '14

04 Nov '14

Usually, when this is done, it is an adjunct to providing connectivity fast while the table is loading on a connection reset. Owen > On Nov 4, 2014, at 9:47 AM, Berry Mobley <berry(a)gadsdenst.org> wrote: > > I'm wondering how many of you who are multihomed also add default routes pointing to your providers from whom you are receiving full feeds. > > If so, why? If not, why not? > > Thanks, > > Berry

1 0