- NANOG - lists.nanog.org

Don't Miss Out! Register Now For NANOG 89! + More
by Nanog News 14 Sep '23

14 Sep '23

*Don't Miss Out! Register Now For NANOG 89! * *Our Next Meeting Will Take Place 16 - 18 Oct. in San Diego* *REGISTER NOW * <https://nanog.org/events/nanog-89/> *Candidate Statements of Support Open* *Key Dates 2023* *13 September - Statements of Support* for Board of Director Candidates open* 17 October - Voting for Board of Director Candidates begins 25 October - Voting for Board of Director Candidates ends ***View 2023 Candidate Board Candidateshere. <https://www.nanog.org/members/elections/2023-board-candidates/> *LEARN MORE * <https://www.nanog.org/members/elections/2023-candidate-statement-of-support…> *Espresso Bar Sponsorship Available!* Contact Shawn at swinstead(a)nanog.org for more info. *Video of the Week * How To Survive NANOG As An Introvert Do large crowds tend to overwhelm or exhaust you? In this talk, Google Fiber Louie Lee moderates a discussion with community members who self-identify as introverts. Lee opens up the conversation for strategies to deal with a large conference - i.e., how to properly conserve energy + orchestrate social engagements to better manage fatigue, stress, and overwhelm. *WATCH NOW * <https://www.youtube.com/watch?v=9dgCIak3wFs>

1 0

Traffic being directed at random infrastructure with pornhub.com host header (?)
by Drew Weaver 13 Sep '23

13 Sep '23

Has anyone else recently seen a spike of port 80 traffic being sent at seemingly random IP addresses that include the Pornhub host header? 0: 000C3170 A440000F 35F95000 08004500 ..1p$@..5yP...E<mailto:..1p$@..5yP...E>. 16: 004D0997 4000F006 F8D59DF5 7C90CFB6 .M..@.p.xU.u|.O6<mailto:.M..@.p.xU.u|.O6> 32: 9E010050 00500000 67D50000 000B5002 ...P.P..gU....P. 48: FFFF6559 00004745 54202F20 48545450 ..eY..GET / HTTP 64: 2F312E31 0D0A486F 73743A20 706F726E /1.1..Host: porn 80: 6875622E 636F6D0D 0A0D0A00 hub.com..... Just thought it was quirky and was wondering if anyone else had seen it. This particular payload was directed at a Cisco router. Offlist is fine if needed. -Drew

3 2

Spam from ARIN to POC addresses
by packetcat 13 Sep '23

13 Sep '23

At 14:01 and 14.46 EST I received two identical emails from meetings(a)arin-events.net with the subject “Join us for ARIN 52 in October”. One was sent to the NOC POC address and one to the abuse POC address for my ASN. As far as I am aware, I never signed up for whatever that mailing list is and if I did I wouldn’t subscribe to it on those addresses. Furthermore, I am not seeing an unsubscribe button on either email. That makes both messages spam. Considering I’ve never received messages like those from ARIN on those addresses, I’ll give ARIN the benefit of the doubt and say someone accidentally imported the wrong list of emails into their MSP. I hope this is not the start of a new pattern of behaviour because that would not be…good to put it mildly. -- packetcat https://bastetrix.com

4 4

Guest Column: Kentik's Doug Madory, Last Call for Upcoming ISOC Course + More
by Nanog News 13 Sep '23

13 Sep '23

*Guest Column: Kentik's Doug Madory* *BGP Incidents: From Traffic-Disrupting BGP Leaks to Crypto-Stealing BGP Hijacks* BGP routing incidents can be problematic for a range of reasons. In some cases, they simply disrupt the flow of legitimate internet traffic while in others, they can result in the misdirection of communications, posing a security risk from interception or manipulation. *READ MORE <https://www.google.com/url?q=https://nanog.us20.list-manage.com/track/click…>Last Call for Upcoming ISOC Course: 11 Sept. * *Fundamentals of Designing and Deploying Computer Networks* This course will discuss the fundamentals of networking, Ethernet, and WIFI technologies. It will additionally teach the planning, design, and deployment of simple LANs and cover how to connect a LAN to the Internet. *LEARN MORE <https://www.google.com/url?q=https://nanog.us20.list-manage.com/track/click…>* *Reminder: Board Nominations are Open! * *Your Choice, Your Vote* *Elections: 2023* The NANOG Board of Directors is an active and engaged part of NANOG. The Board is responsible for and works closely with committees to promote, support, and improve NANOG. *VIEW MORE <https://www.google.com/url?q=https://nanog.us20.list-manage.com/track/click…>* *What's Trending on the Mailing List? * *Find a Solution Via our Community Forum Online Discussion Boards * ****Remember you must log in or create an account to access the Community Forum.* Lossy cogent p2p experiences? Replies: 62 JunOS/FRR/Nokia et al BGP critical issue Replies: 13 Re: Destination Preference Attribute for BGP Replies: 20 v6 route mess frm AS266970 Replies: 5 *VIEW MORE <https://community.nanog.org/latest>* *Video of the Week * *The Future is Now: Delivering the Next Generation Brilliant Network* Brilliant networks delivering next-generation connected experiences are here. Comcast Chief Network Officer Elad Nafshi will share how 10G network technologies are evolving related experiences in real-time, even as they continue to get more innovative, faster, reliable, and secure for future generations. *WATCH NOW * <https://www.youtube.com/watch?v=jNluliEMKvY&t=313s>

14 19

Root zone operational announcement: introducing ZONEMD for the root zone
by Wessels, Duane 12 Sep '23

12 Sep '23

I am pleased to announce that Message Digests for DNS Zones, also known as ZONEMD, will be added to the root zone later this year. This feature, specified in RFC 8976, adds cryptographic data protections to the zone as a whole, allowing the recipient to verify the authenticity of the zone’s contents. ZONEMD will be added to the root zone using a phased approach. On September 13, 2023, a ZONEMD record will make its first appearance in the root zone. At this time the Hash Algorithm field will be set to a private use algorithm number, making the ZONEMD record deliberately unverifiable. On December 6, 2023, the ZONEMD record will be published with the SHA-384 Hash Algorithm, thereby making it verifiable. We expect no operational impacts for end users. ZONEMD does not affect root zone queries and responses. The root server operators have agreed to not alter their zone ingestion processes for at least a year after ZONEMD is first introduced. Anyone that downloads the root zone file from www.internic.net or rs.internic.net should be aware that it will include the new ZONEMD resource record in its native presentation format starting on September 6th. Please feel free to follow up with any questions or concerns. References and further reading: [1] RFC 8976: “Message Digest for DNS Zones”, https://www.rfc-editor.org/rfc/rfc8976 [2] Root Server Operators Statement on adding ZONEMD to the root zone, https://root-servers.org/media/news/2022-08-Statement_on_ZONEMD.pdf [3] RZERC003: “Adding Zone Data Protections to the Root Zone”, https://www.icann.org/uploads/ckeditor/rzerc-003-en.pdf [4] Verisign Blog: “Adding ZONEMD Protections to the Root Zone”, https://blog.verisign.com/security/root-zone-zonemd/ [5] APNIC Ping Podcast episode “Adding ZONEMD protections to the root zone”, https://blubrry.com/ping_podcast/108940688/adding-zonemd-protections-to-the… DW

1 1

EDU zone operational announcement: DNSSEC algorithm rollover
by Wessels, Duane 12 Sep '23

12 Sep '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Verisign is pleased to announce that an algorithm 13 (ECDSA) DS record has been published for the EDU zone, and the algorithm 8 record has been removed. Over the next few days, the algorithm 8 DNSKEY records will be removed from the EDU zone, followed by the removal of algorithm 8 signatures. We continue to expect no operational impacts for end users, but please feel free to reach out to us with concerns or any observations of anomalous behavior related to this algorithm rollover. DW -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBCAAGBQJlAIwcAAoJEGyZpGmowJiNEj4H/R07bC4outa2znVIh7BIsolu mamlG2+NlOBmdAOTzk8vdmoUMy11RHeG0W+6o6oQS9gALUgj4shxPF5z+Je0R6Us Y54HDnE4mi1KAGKOtg/AE5RYCZeA/rhLk/qxRnLiUBtlmuRwMpjkJ5k+viCEFVX+ IyZPWEJyDSC8bFx4LThYt7AP093r74vjKHa2wMffa+3VHZgrEpHReL6Na149+u3L Idb1In9cCs6nYFp/DuMopdVHy3EqK6psPSCt7jCG27qAtM4+ormsCPYYo4KI7RUo lF7X2SdDmVUfoL4lzrLUzl7MFBxJxNYCt/yPvN/VBLw2Yby2AhPHVQt7lpjIQXo= =/uAl -----END PGP SIGNATURE-----

1 0

Prize Picks - gelocation/vpn/fraud system
by Justin Krejci 11 Sep '23

11 Sep '23

Yes, unfortunate geolocation/vpn troubles strike again. If any from PrizePicks.com are on here I would appreciate if you would reach out to me regarding a mutual customer not able to use your services. If anyone else on NANOG has a contact there, I would appreciate some help getting in contact to resolve an issue that the regular support channel is unable to do. Thanks! Justin Krejci

1 0

Captive portal for suspended accounts
by Steve Saner 11 Sep '23

11 Sep '23

We are a combination fiber and fixed wireless ISP with around 20k subscribers. Management is wanting to develop something along the lines of a captive portal for suspended accounts such that those customers are forced to a portal that allows them to make payment and get reactivated. This is a common thing for a cafe wifi hotspot or something, but has anyone here attempted to do it at this kind of scale who would be willing to share their experiences? If someone has successfully done this, I would love to pick your brain a bit to understand how you accomplished it. Thanks much. -- *Steve Saner* | Senior Network Engineer ideatek INTERNET FREEDOM™ FOR ALL 316-640-8715 ext. 4005 | 111 Old Mill St., Buhler KS,67522 | <http://ideatek.com/>ideatek.com This email transmission and any documents, files or previous email messages attached to it may contain confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you are not or believe you may not be the intended recipient, please advise the sender immediately by return email or by calling 620.543.5026. Then, please take all steps necessary to permanently delete the email and all attachments from your computer system. No trees were affected by this transmission – though a few billion photons were mildly inconvenienced.

6 6

Lossy cogent p2p experiences?
by David Hubbard 11 Sep '23

11 Sep '23

Hi all, curious if anyone who has used Cogent as a point to point provider has gone through packet loss issues with them and were able to successfully resolve? I’ve got a non-rate-limited 10gig circuit between two geographic locations that have about 52ms of latency. Mine is set up to support both jumbo frames and vlan tagging. I do know Cogent packetizes these circuits, so they’re not like waves, and that the expected single session TCP performance may be limited to a few gbit/sec, but I should otherwise be able to fully utilize the circuit given enough flows. Circuit went live earlier this year, had zero issues with it. Testing with common tools like iperf would allow several gbit/sec of TCP traffic using single flows, even without an optimized TCP stack. Using parallel flows or UDP we could easily get close to wire speed. Starting about ten weeks ago we had a significant slowdown, to even complete failure, of bursty data replication tasks between equipment that was using this circuit. Rounds of testing demonstrate that new flows often experience significant initial packet loss of several thousand packets, and will then have ongoing lesser packet loss every five to ten seconds after that. There are times we can’t do better than 50 Mbit/sec, but it’s rare to achieve gigabit most of the time unless we do a bunch of streams with a lot of tuning. UDP we also see the loss, but can still push many gigabits through with one sender, or wire speed with several nodes. For equipment which doesn’t use a tunable TCP stack, such as storage arrays or vmware, the retransmits completely ruin performance or may result in ongoing failure we can’t overcome. Cogent support has been about as bad as you can get. Everything is great, clean your fiber, iperf isn’t a good test, install a physical loop oh wait we don’t want that so go pull it back off, new updates come at three to seven day intervals, etc. If the performance had never been good to begin with I’d have just attributed this to their circuits, but since it worked until late June, I know something has changed. I’m hoping someone else has run into this and maybe knows of some hints I could give them to investigate. To me it sounds like there’s a rate limiter / policer defined somewhere in the circuit, or an overloaded interface/device we’re forced to traverse, but they assure me this is not the case and claim to have destroyed and rebuilt the logical circuit. Thanks!

10 25

Re: Lossy cogent p2p experiences?
by Mike Hammett 10 Sep '23

10 Sep '23

I wouldn't call 50 megabit/s an elephant flow ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com ----- Original Message ----- From: "Mark Tinka" <mark(a)tinka.africa> To: "Mike Hammett" <nanog(a)ics-il.net>, "Saku Ytti" <saku(a)ytti.fi> Cc: nanog(a)nanog.org Sent: Friday, September 1, 2023 8:56:03 AM Subject: Re: Lossy cogent p2p experiences? On 9/1/23 15:44, Mike Hammett wrote: and I would say the OP wasn't even about elephant flows, just about a network that can't deliver anything acceptable. Unless Cogent are not trying to accept (and by extension, may not be able to guarantee) large Ethernet flows because they can't balance them across their various core links, end-to-end... Pure conjecture... Mark.

13 54