- NANOG - lists.nanog.org

Re: Overview on Defending DDoS attack
by Dobbins, Roland 07 Nov '12

07 Nov '12

On Nov 7, 2012, at 5:56 PM, Mohamed Al-fateh wrote: > Could you please share them with us or direct us to other good resources for that <https://www.box.com/s/4h2l6f4m8is6jnwk28cg> ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> Luck is the residue of opportunity and design. -- John Milton

1 0

Re: Indonesian ISP Moratel announces Google's prefixes
by Anurag Bhatia 07 Nov '12

07 Nov '12

OK one quick question here - Moratel leaked route and thus for a portion of internet route to Google was via Moratel but was a path. What caused 100% outage I.e all four authoritative DNS servers and open resolver service too ? Can we just guess that due to ultra high traffic path between Moratel and Google was checked ? Or there's a chance that some customer of Moratel announced prefix using Google's ASN at first place. Hard to believe why they would have set bgp session in first place with wrong asn but was curious to know if that is also a possibility? Thanks (Sent from my mobile device) Anurag Bhatia http://anuragbhatia.com On Nov 7, 2012 12:22 PM, "Patrick W. Gilmore" <patrick(a)ianai.net> wrote: > On Nov 07, 2012, at 01:29 , Anurag Bhatia <me(a)anuragbhatia.com> wrote: > > > Apologize for calling it an prefix hijack. I misunderstood in start. > Clearly it was case of prefix leaking. > > No worries. I should have read more closely. > > -- > TTFN, > patrick > >

2 1

Re: Indonesian ISP Moratel announces Google's prefixes
by Hank Nussbacher 07 Nov '12

07 Nov '12

At 21:21 06/11/2012 -0800, Jian Gu wrote: If Google announces 8.8.8.0/24 to you and you in turn start announcing to the Internet 8.8.8.0/24 as originating from you, then a certain section of the Internet will believe your announcement over Google's. This has happened many times before due to improper filters, but this is the first time I have seen the victim being blamed. Interesting concept. -Hank >I don't know what Google and Moratel's peering agreement, but "leak"? >educate me, Google is announcing /24 for all of their 4 NS prefix and >8.8.8.0/24 for their public DNS server, how did Moratel leak those routes >to Internet? > >On Tue, Nov 6, 2012 at 9:13 PM, Patrick W. Gilmore <patrick(a)ianai.net>wrote: > > > On Nov 07, 2012, at 00:07 , Jian Gu <guxiaojian(a)gmail.com> wrote: > > > > > Where did you get the idea that a Moratel customer announced a > > google-owned > > > prefix to Moratel and Moratel did not have the proper filters in place? > > > according to the blog, all google's 4 authoritative DNS server networks > > and > > > 8.8.8.0/24 were wrongly routed to Moratel, what's the possiblity for a > > > Moratel customers announce all those prefixes? > > > > Ah, right, they just leaked Google's prefix. I thought a customer > > originated the prefix. > > > > Original question still stands. Which attribute do you expect Google to > > set to stop this? > > > > Hint: Don't say No-Advertise, unless you want peers to only talk to the > > adjacent AS, not their customers or their customers' customers, etc. > > > > Looking forward to your answer. > > > > -- > > TTFN, > > patrick > > > > > > > On Tue, Nov 6, 2012 at 9:02 PM, Patrick W. Gilmore <patrick(a)ianai.net > > >wrote: > > > > > >> On Nov 06, 2012, at 23:48 , Jian Gu <guxiaojian(a)gmail.com> wrote: > > >> > > >>> What do you mean hijack? Google is peering with Moratel, if Google does > > >> not > > >>> want Moratel to advertise its routes to Moratel's peers/upstreams, then > > >>> Google should've set the correct BGP attributes in the first place. > > >> > > >> That doesn't make the slightest bit of sense. > > >> > > >> If a Moratel customer announced a Google-owned prefix to Moratel, and > > >> Moratel did not have the proper filters in place, there is nothing > > Google > > >> could do to stop the hijack from happening. > > >> > > >> Exactly what attribute do you think would stop this? > > >> > > >> -- > > >> TTFN, > > >> patrick > > >> > > >> > > >>> On Tue, Nov 6, 2012 at 3:35 AM, Anurag Bhatia <me(a)anuragbhatia.com> > > >> wrote: > > >>> > > >>>> Another case of route hijack - > > >>>> > > >> > > http://blog.cloudflare.com/why-google-went-offline-today-and-a-bit-about > > >>>> > > >>>> > > >>>> > > >>>> I am curious if big networks have any pre-defined filters for big > > >> content > > >>>> providers like Google to avoid these? I am sure internet community > > >> would be > > >>>> working in direction to somehow prevent these issues. Curious to know > > >>>> developments so far. > > >>>> > > >>>> > > >>>> > > >>>> > > >>>> Thanks. > > >>>> > > >>>> > > >>>> -- > > >>>> > > >>>> Anurag Bhatia > > >>>> anuragbhatia.com > > >>>> > > >>>> Linkedin <http://in.linkedin.com/in/anuragbhatia21> | > > >>>> Twitter<https://twitter.com/anurag_bhatia>| > > >>>> Google+ <https://plus.google.com/118280168625121532854> > > >>>> > > >>> > > >> > > >> > > >> > > > > > >

4 4

Re: Indonesian ISP Moratel announces Google's prefixes
by Hank Nussbacher 07 Nov '12

07 Nov '12

At 20:48 06/11/2012 -0800, Jian Gu wrote: Ahhh...blame the victim. Google - shame on you. -Hank >What do you mean hijack? Google is peering with Moratel, if Google does not >want Moratel to advertise its routes to Moratel's peers/upstreams, then >Google should've set the correct BGP attributes in the first place. > >On Tue, Nov 6, 2012 at 3:35 AM, Anurag Bhatia <me(a)anuragbhatia.com> wrote: > > > Another case of route hijack - > > http://blog.cloudflare.com/why-google-went-offline-today-and-a-bit-about > > > > > > > > I am curious if big networks have any pre-defined filters for big content > > providers like Google to avoid these? I am sure internet community would be > > working in direction to somehow prevent these issues. Curious to know > > developments so far. > > > > > > > > > > Thanks. > > > > > > -- > > > > Anurag Bhatia > > anuragbhatia.com > > > > Linkedin <http://in.linkedin.com/in/anuragbhatia21> | > > Twitter<https://twitter.com/anurag_bhatia>| > > Google+ <https://plus.google.com/118280168625121532854> > >

1 0

p2p addresses for point-to-point connections with customers
by Tassos Chatzithomaoglou 07 Nov '12

07 Nov '12

I've been trying hard to come up with a solution regarding this, but i haven't decided yet which one is the best. >From the perspective of an ISP, how do you characterize the p2p addresses given for a point-to-point connection to a) customers with their own ASN b) customers without an ASN? These are ip addresses configured on your router's border interface and on the customer's peer router interface (old WAN-style), so they actually are both infrastructure and customer addresses. So... Do you consider them infrastructure addresses or customer addresses? Do you put them in your IGP or in BGP? Do you filter them on your border routers (via iACLs) and if yes, how? -- Tassos

5 8

Unable to reach www.t-online.de over IPv6 since late September
by Frank Bulk 07 Nov '12

07 Nov '12

For 42 days we have not been able to reach www.t-online.de over IPv6. C:\>tracert -6 www.t-online.de Tracing route to www.t-online.de [2003:2:2:40:62:153:159:92] over a maximum of 30 hops: 1 4 ms 3 ms 2 ms router-core.mtcnet.net [2607:fe28:11:1000::2] 2 3 ms 3 ms 2 ms sxct.sxcy.mtcnet.net [2607:fe28:11:1002::197] <snip> 8 24 ms 23 ms 22 ms sl-crs2-chi-te1-2-0-1.v6.sprintlink.net [2600:4::6] 9 31 ms 30 ms 30 ms sl-crs2-akr-bu-2.v6.sprintlink.net [2600:0:2:1239:144:232:20:186] 10 41 ms 41 ms 39 ms sl-crs2-rly-bu-2.v6.sprintlink.net [2600:0:2:1239:144:232:4:187] 11 40 ms 40 ms 39 ms sl-crs2-dc-po0-9-0-0.v6.sprintlink.net [2600:0:2:1239:144:232:25:128] 12 42 ms 42 ms 41 ms sl-st31-ash-po0-2-0-0.v6.sprintlink.net [2600:0:2:1239:144:232:25:15] 13 * * * Request timed out. 14 * * * Request timed out. 15 * * * Request timed out. DT (Deutsche Telekom) is not learning our routes (AS53347) or the routes of our upstream provider (AS5056). DT's looking glass (https://f-lga1.f.de.net.dtag.de/index.php?pageid=lg) confirms that: sh ipv6 bgp 2607:fe28::/32 % Network not in table sh ipv6 bgp 2001:05f8::/32 % Network not in table Our prefix goes over our upstream provider's transit link with Sprint, so on September 26 our upstream provider opened up a ticket with Sprint. From what our upstream provider tells us, Sprint is advertising our routes to DT but DT has an IPv6 prefix that is blocking all of Sprint's customer prefixes. It's almost been a month since the last substantive update from DT (via our upstream provider, via Sprint). If anybody is able to help and shake something loose at DT, that would be appreciated. For the right people, I can provide both Sprint and DT's ticket numbers. Thanks, Frank

1 0

UK Scientists Claim to Develop 2000 Times Faster Broadband via Fibre Optic
by Eugen Leitl 06 Nov '12

06 Nov '12

http://www.ispreview.co.uk/index.php/2012/11/uk-scientists-claim-to-develop… UK Scientists Claim to Develop 2000 Times Faster Broadband via Fibre Optic Posted Tuesday, November 6th, 2012 (11:08 am) by Mark Jackson (Score 746) A team of scientists working out of Bangor University in Wales has developed a commercially affordable method of using Optical Orthogonal Frequency Division Multiplexing (OOFDM) over fibre optic lines, which could deliver broadband ISP speeds that are 2,000 times faster than current services. But the three-year project (OCEAN) is not the first to make use of OOFDM, which typically splits a laser down to multiple different optical frequencies. The data can then be broken up and sent in parallel streams via the different frequencies. Last year a team of Sydney University scientists found an energy-efficient way of using a single laser to transfer data down a 50km long single-mode fibre optic cable at speeds of up to 26Tbps (Terabits per second). The key difference with OCEAN is that this work is capable of “significantly saving the network installation and maintenance cost for both [ISPs] and equipment vendors” by using low-cost off-the-shelf components and end-to-end real-time OOFDM transceivers via currently installed fibre networks (FTTH etc.). It also provides a “Green” solution due to the “significant reduction in electrical power consumption“. The work is also more targeted towards home and business connections, as opposed to undersea cables, most of which tend to offer broadband speeds of less than 100Mbps; currently only a few UK FTTH ISPs offer up to 1Gbps and most suffer from very limited coverage. Professor Jianming Tang explained: “Compared to today’s commercially available broadband connections, the technology is expected to provide end-users with both downloading and uploading speeds up to 2,000 times faster than current speeds and with a guaranteed quality of services at a price that subscribers are currently paying for their current 20Mb/s services, regardless of subscribers’ home location. Obviously, this will revolutionise communication technology.” However there’s still the little matter of capacity supply costs and Traffic Management measures to consider, although the university’s efforts bode well for the future and could help a new generation of truly fibre optic ISPs to improve their service without incurring excessive additional costs. On the other hand most of today’s connections are still being delivered over older and slower copper based broadband lines. This is gradually beginning to change and the situation could look very different in another ten or twenty years’ time. According to Bangor University, OCEAN is a partnership project (funded by the European Union (3m Euros+)) that includes several major global telecoms firms; Fujitsu Semiconductors Europe, Finisar Israel, Fraunhofer Heinrich Hertz Institute and VPIsystems GmbH.

1 0

NSA and the exchanges
by andy lam 06 Nov '12

06 Nov '12

Anyone knows if there's a way to find out how involved NSA monitors 151 front street at Toronto? NSA allegedly monitors data centres in the US, but does it have the same influence at a building sitting in its neighbor's soil? There's something on the web like www.ixmaps.ca that tries to piece it together. but not sure how helpful the information on there really is? feedback welcome.

8 8

Looking for recommendation on 10G Ethernet switch
by Eric Germann 06 Nov '12

06 Nov '12

Colleagues, I'm looking for a recommendation on a smallish 10G Ethernet switch for a small virtualization/SAN implementation (4-5 hosts, 2 SAN boxes) over iSCSI with some legacy boxes on GigE. Preferably - 8-16 10G ports - several GigE ports for legacy GigE hosts or cross connect to a legacy GigE switch - preferably not a large chassis based solution with blades The hosts aren't going to be driving full line rate, nor the SAN boxes providing full line rate, but their offered loads will definitely exceed 1Gbps. Assessing whether it is better to go 10G now vs. multi-pathing with quad GigE cards. Trying to find the best solution for > 1G on a trunk and < $50K per box. Any recommendations appreciated. Thanks EKG

10 10

IPv6 Netowrk Device Numbering BP
by Crist J. Clark 06 Nov '12

06 Nov '12

We're working out our dual stacked IPv4-IPv6 network. One issue that recently has arisen is how to number the management interfaces on the network devices themselves. I have always been kind of partial to the idea of taking advantage IPv6 features and letting hosts set their own addresses with EUI-64 interface numbers. For the management interface on a network device, it's more like a "normal" host. I'd just as well tell the device its prefix, and let it build the address itself. For IPv6, my opinion is that I'm not even going to try to remember 128-bit addresses. It's not something reasonable to expect humans to do. I'm going to depend on some name-to-number service (DNS or a hosts file), and as far as a computer goes, 2001:db8::80:abff:fe45:6789 is just as easy to remember as, 2001:db8::12:34. The other approach is to assign addresses. To me, that's more of a hold over from IPv4 thinking, but there are legitimate reasons I can think of. It's nice to have the IPv6 address tied to the configuration rather than the hardware. If you need to drop in a replacement device, you copy the configuration and no addresses change. But OTOH, others might consider it a feature that the IP follows the device rather than the role. And the real reason I think people want to do it is that they want to be able to memorize IP addresses of "important" hosts like these. Another option would be to do both. Assign a fixed address and also let it chose EUI-64. However, I see that leading to confusion. Not sure what good it would do. Is there anything like a standard, best practice for this (yet)? What are other people doing and their reasons? Anyone have operational experience with what works and what does not (and the "what does not" is probably really of more interest)? -- Crist J. Clark

23 41