- NANOG - lists.nanog.org

Re: Default routes on BGP routers with full feeds
by William Herrin 04 Nov '14

04 Nov '14

On Tue, Nov 4, 2014 at 12:47 PM, Berry Mobley <berry(a)gadsdenst.org> wrote: > I'm wondering how many of you who are > multihomed also add default routes pointing > to your providers from whom you are receiving full feeds. Back when I was in the ISP world I installed a default route pointing to a data capture machine. This let me detect which customers had port-scanning worms so I could identify them ahead of the abuse complaint (and ahead of the "why is my Internet so slow complaint). The scanners rip through unrouted space as often as they rip through routed space, so they were pretty easy to catch. Unfortunately, dealing with Grandma's virus laden machine was never easy. Regards, Bill Herrin -- William Herrin ................ herrin(a)dirtside.com bill(a)herrin.us Owner, Dirtside Systems ......... Web: <http://www.dirtside.com/> May I solve your unusual networking challenges?

1 0

RE: Default routes on BGP routers with full feeds
by Naslund, Steve 04 Nov '14

04 Nov '14

I can tell you that I do not do that. Typically if my BGP connectivity to a carrier fails I would prefer we don't route anything their way until we get that resolved because it might indicate a circuit that is up but unable to pass traffic (very common with carrier Ethernet especially). It does not guarantee anything but the BGP session is at least showing me that the last mile connectivity is good. In our MPLS VPN network we use BGP passwords that provide a bit of protection in case the carrier dumps one of our circuits into the wrong VRF (it does happen) and loss of the BGP session helps ensure that I don't route traffic into a MPLS VPN that is not ours. Steven Naslund Chicago IL -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Berry Mobley Sent: Tuesday, November 04, 2014 11:47 AM To: nanog(a)nanog.org Subject: Default routes on BGP routers with full feeds I'm wondering how many of you who are multihomed also add default routes pointing to your providers from whom you are receiving full feeds. If so, why? If not, why not? Thanks, Berry

1 0

Re: Default routes on BGP routers with full feeds
by Blake Hudson 04 Nov '14

04 Nov '14

I often opt to leave one or more default routes configured with low priority (lower than BGP). The thinking is that if there is a fault with BGP, the router will still operate and the fault can be corrected remotely (in-band). The downside is that I might pass traffic for non-existing destinations an additional hop and put the load of generating an ICMP unreachable on someone else's router. --Blake Berry Mobley wrote on 11/4/2014 11:47 AM: > I'm wondering how many of you who are multihomed also add default > routes pointing to your providers from whom you are receiving full feeds. > > If so, why? If not, why not? > > Thanks, > > Berry >

2 1

Tail-F
by Colton Conor 04 Nov '14

04 Nov '14

Is anyone using Tail-f software or know anything similar? We are looking for a solution that is vendor agnostic. Can do simple command like show interface so even non-network techs and CSR's can get basic is the port up or down type stats without having to directly login to the network.

5 5

Default routes on BGP routers with full feeds
by Berry Mobley 04 Nov '14

04 Nov '14

I'm wondering how many of you who are multihomed also add default routes pointing to your providers from whom you are receiving full feeds. If so, why? If not, why not? Thanks, Berry

1 0

BGP Security Research Question
by Anthony Weems 04 Nov '14

04 Nov '14

I'm a student in college learning about networking and, specifically, BGP. Does anyone have any statistics on the use of S-BGP or soBGP in the wild? I've read a few papers / RFCs on the subject (from Cisco and the like), but I haven't been able to find any information about actual usage. Additionally, do people scan BGP speakers in the same sense that researchers perform scans of the Internet (e.g. zmap)? -- Anthony Weems

9 12

WestJet, Expedia or SoftVoyage Contacts
by Evan Fox 04 Nov '14

04 Nov '14

Could someone from WestJet, Expedia, or SoftVoyage please contact me off list regarding a backend problem? Thanks, Evan The content of this message is subject to our e-mail confidentiality policy. http://www.empire.ca/docs/email/conf Le contenu de ce message est assujetti à notre politique en matière de confidentialité des courriels. http://www.empire.ca/docs/email/conf

1 0

Re: Cisco CCNA Training
by Larry Sheldon 04 Nov '14

04 Nov '14

On 11/2/2014 11:02, Colton Conor wrote: > We have a couple of techs that want to learn cisco and networking in > general. What do you recommend for learning and getting certified on Cisco? > There seems to be a million different training courses, books, etc out > there. > My personal opinion, worth what you paid for it: For learning--work beside an Old Hand that knows it and has a good record. For certification, sign up for the cheapest one. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

3 2

Re: Fwd: FW: NIST NTP Server List
by Mark Andrews 03 Nov '14

03 Nov '14

http://time.gov/HTML5/ over IPv6 is broken. % fetch -6v http://time.gov/HTML5/ looking up time.gov connecting to time.gov:80 requesting http://time.gov/HTML5/ 404 Not Found Not Found The requested URL /HTML5/ was not found on this server. fetch: http://time.gov/HTML5/: Not Found % fetch -4v http://time.gov/HTML5/ looking up time.gov connecting to time.gov:80 requesting http://time.gov/HTML5/ remote size / mtime: 10438 / 1414696016 fetch.out 100% of 10 kB 104 MBps % Mark In message <5457A711.1080604(a)nist.gov>, Andrew Novick writes: > > Hello - can you tell me what this pertains to, or if I can help? > > Andrew Novick > NIST > > > -----Original Message----- > From: Mark Andrews [mailto:marka@isc.org] > Sent: Thursday, October 30, 2014 8:22 PM > To: Pete Carah > Cc: nanog(a)nanog.org; do-webmaster > Subject: Re: NIST NTP Server List > > > In message <5452D146.4080307(a)altadena.net>, Pete Carah writes: > > On 10/30/2014 06:27 PM, Mark Andrews wrote: > > > IPv6 is production. Report the problem. > > > > > Sorry for reporting it here, but there seems to be more than one > > problem (the link resulting from clicking on "nist time". > > What does reporting a 404 to nanog do? The network to them is UP. Since the > front page is up and actually has a address for reporting web problems I wou > ld expect that you would report the problem there (I've cc'd the address). > > If the front page wasn't up you should do a whois lookup and use those contac > t details except this a .gov domain where whois is a farce. So you also need > to contact your federal representative and complain about that. > > Nist can put contact details on their web page: > > Public Inquiries Unit > NIST, 100 Bureau Drive, Stop 1070, Gaithersburg, MD 20899-1070 > Email: inquiries(a)nist.gov > Phone: (301) 975-NIST (6478) or Federal Relay Service (800) 877-8339 (TTY) > > But the whois give this farcical response: > > % DOTGOV WHOIS Server ready > Domain Name: NIST.GOV > Status: ACTIVE > > >>> Last update of whois database: 2014-10-31T00:16:27Z <<< > Please be advised that this whois server only contains information pertaining > to the .GOV domain. For information for other domains please use the whois s > erver at RS.INTERNIC.NET. > > > I get the nist front page fine on v6, then click on the time link and > > get a 404 looking for a strange url: > > "hxxp://time.gov/HTML5" (which could be fine but does look a little > > strange.) > > > > -- Pete > > > > > > > -- > Mark Andrews, ISC > 1 Seymour St., Dundas Valley, NSW 2117, Australia > PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org > > > > > > --------------090806090301080104060605 > Content-Type: text/html; charset="ISO-8859-1" > Content-Transfer-Encoding: 7bit > > <html> > <head> > > <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> > </head> > <body text="#000000" bgcolor="#FFFFFF"> > Hello - can you tell me what this pertains to, or if I can help?<br> > <br> > Andrew Novick<br> > NIST<br> > <div class="moz-forward-container"><br> > <pre> > > -----Original Message----- > From: Mark Andrews [<a class="moz-txt-link-freetext" href="mailto:marka@isc.o > rg">mailto:marka@isc.org</a>] > Sent: Thursday, October 30, 2014 8:22 PM > To: Pete Carah > Cc: <a class="moz-txt-link-abbreviated" href="mailto:nanog@nanog.org">nanog@n > anog.org</a>; do-webmaster > Subject: Re: NIST NTP Server List > > > In message <a class="moz-txt-link-rfc2396E" href="mailto:5452D146.4080307@alt > adena.net"><5452D146.4080307(a)altadena.net></a>, Pete Carah writes: > > On 10/30/2014 06:27 PM, Mark Andrews wrote: > > > IPv6 is production. Report the problem. > > > > > Sorry for reporting it here, but there seems to be more than one > > problem (the link resulting from clicking on "nist time". > > What does reporting a 404 to nanog do? The network to them is UP. Since the > front page is up and actually has a address for reporting web problems I wou > ld expect that you would report the problem there (I've cc'd the address). > > If the front page wasn't up you should do a whois lookup and use those contac > t details except this a .gov domain where whois is a farce. So you also need > to contact your federal representative and complain about that. > > Nist can put contact details on their web page: > > Public Inquiries Unit > NIST, 100 Bureau Drive, Stop 1070, Gaithersburg, MD 20899-1070 > Email: <a class="moz-txt-link-abbreviated" href="mailto:inquiries@nist.gov">i > nquiries(a)nist.gov</a> > Phone: (301) 975-NIST (6478) or Federal Relay Service (800) 877-8339 (TTY) > > But the whois give this farcical response: > > % DOTGOV WHOIS Server ready > Domain Name: NIST.GOV > Status: ACTIVE > > >>> Last update of whois database: 2014-10-31T00:16:27Z <<< > Please be advised that this whois server only contains information pertaining > to the .GOV domain. For information for other domains please use the whois s > erver at RS.INTERNIC.NET. > > > I get the nist front page fine on v6, then click on the time link and > > get a 404 looking for a strange url: > > "hxxp://time.gov/HTML5" (which could be fine but does look a little > > strange.) > > > > -- Pete > > > > > > > -- > Mark Andrews, ISC > 1 Seymour St., Dundas Valley, NSW 2117, Australia > PHONE: +61 2 9871 4742 INTERNET: <a class="moz-txt-link-abbre > viated" href="mailto:marka@isc.org">marka(a)isc.org</a> > </pre> > <br> > </div> > <br> > <br> > </body> > </html> > > --------------090806090301080104060605-- -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

1 0

Learning about the internet
by Paige Thompson 03 Nov '14

03 Nov '14

Hi, I was just reading about transatlantic cabling in some hopes that I would be able to find an answer as to why the latency between here in greece and Los Angeles is roughly ~250ms. This seems to be a really common thing, although I'd like to understand why and the articles on transatlantic cabling as near as I can tell indicate that I am getting screwed if anything (not enough information?) (from Los Angeles to my house) Konsole output Konsole output gw~ #mtr --report-wide xxxxxxxxxxxxxxx.access.hol.gr Start: Mon Nov 3 13:04:02 2014 HOST: gw Loss% Snt Last Avg Best Wrst StDev 1.|-- 208.79.92.65 10.0% 10 1.5 3.6 1.2 15.5 4.6 2.|-- s7.lax.arpnetworks.com 0.0% 10 0.8 10.9 0.8 54.2 20.7 3.|-- vlan953.car2.LosAngeles1.Level3.net 30.0% 10 10.5 10.3 10.1 10.8 0.0 4.|-- ae-27-27.edge6.LosAngeles1.Level3.net 30.0% 10 21.8 16.2 8.6 47.6 14.7 5.|-- ae-4-90.edge1.LosAngeles6.Level3.net 80.0% 10 9.0 8.9 8.7 9.0 0.0 6.|-- be3036.ccr21.lax04.atlas.cogentco.com 10.0% 10 1.7 2.1 1.4 4.3 0.7 7.|-- be2076.mpd22.lax01.atlas.cogentco.com 10.0% 10 1.6 1.9 1.6 3.2 0.0 8.|-- be2068.ccr22.iah01.atlas.cogentco.com 0.0% 10 37.7 37.7 37.3 39.0 0.3 9.|-- be2173.ccr42.atl01.atlas.cogentco.com 0.0% 10 51.6 52.4 51.5 57.5 1.7 10.|-- be2171.mpd22.dca01.atlas.cogentco.com 0.0% 10 62.6 62.7 62.4 63.3 0.0 11.|-- be2112.ccr41.iad02.atlas.cogentco.com 0.0% 10 155.5 155.8 155.5 156.1 0.0 12.|-- be2268.ccr42.par01.atlas.cogentco.com 0.0% 10 152.6 152.7 152.5 153.5 0.0 13.|-- be2278.ccr42.fra03.atlas.cogentco.com 0.0% 10 155.3 155.4 155.1 155.5 0.0 14.|-- be2229.ccr22.muc01.atlas.cogentco.com 0.0% 10 161.2 161.1 160.9 161.3 0.0 15.|-- be2223.ccr21.vie01.atlas.cogentco.com 0.0% 10 164.9 165.1 164.9 165.2 0.0 16.|-- be2046.ccr21.sof02.atlas.cogentco.com 0.0% 10 189.5 189.4 189.3 189.9 0.0 17.|-- be2118.rcr11.ath01.atlas.cogentco.com 0.0% 10 197.5 197.6 197.4 197.7 0.0 18.|-- 149.11.120.38 0.0% 10 202.7 202.2 200.3 204.2 1.4 19.|-- 62.38.97.113 80.0% 10 208.5 209.8 208.5 211.1 1.7 20.|-- gigaeth04-13.krs00.ar.hol.gr 60.0% 10 211.3 213.0 211.2 218.2 3.4 21.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 22.|-- xxxxxxxxxxxxxxxx.access.hol.gr 40.0% 10 231.3 231.4 231.2 231.7 0.0 gw~ # And to be more clear: I am hoping to learn about the complex trials that these packets are going through and how time is being lost if the latency across the transatlantic cable is really capable of less the 60ms of latency? Sure over capacity (3.2Tbits/s wow jeez) is one answer, but what are some other possibilities for loss of time? Also it seems with my VPN (OpenVPN) tunnel I get the most reliable connection (fewest drops) with: Konsole output mssfix 576 fragment 576 Although this could be a false positive as it only *seems* to help with reliability since I changed it. Even then but less often than before I still experience drops but I want to believe that's possibly due to my ISP at that point.. but assuming my ISP was absolutely perfect and never a problem what else there to consider? Any and all insight is appreciated. -Paige

5 5