- NANOG - lists.nanog.org

what if...?
by Eduardo A. Suárez 23 Dec '11

23 Dec '11

Hi, what if evil guys hack my mom ISP DNS servers and use RPZ to redirect traffic from mom_bank.com to evil.com? How can she detect this? Eduardo.- -- Eduardo A. Suarez Facultad de Ciencias Astronómicas y Geofísicas - UNLP FCAG: (0221)-4236593 int. 172/Cel: (0221)-15-4557542/Casa: (0221)-4526589 ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

12 11

Help with quagga BGP config for ipv6 route-server
by David Waitzman 22 Dec '11

22 Dec '11

I am trying to set up BGP peering with a route-server, concurrently dual-stack. BGP 4 over an IPv4 connection works fine. A separate BGP 6 over IPv6 fails: with an "[Error] No common capability". I am using quagga 0.99.20 on ubuntu 10.04.03. I don't know what the route-server is. I have tried to tell both quagga to not be strict about capabilities or not negotiate them at all. My quagga config includes: router bgp XX no bgp enforce-first-as no bgp default ipv4-unicast !! tried with and without this bgp router-id XX network XY/24 route-map SetAttr neighbor XX4 remote-as XX neighbor XX4 activate neighbor XX4 next-hop-self neighbor XX4 send-community address-family ipv6 network XY6/48 route-map SetAttr neighbor XX6 remote-as XX neighbor XX6 activate neighbor XX6 next-hop-self neighbor XX6 send-community neighbor XX6 soft-reconfiguration inbound The code, I think, that's triggering the error is: /* Check there is no common capability send Unsupported Capability error. */ if (*capability && ! CHECK_FLAG (peer->flags, PEER_FLAG_OVERRIDE_CAPABILITY)) { if (! peer->afc_nego[AFI_IP][SAFI_UNICAST] && ! peer->afc_nego[AFI_IP][SAFI_MULTICAST] && ! peer->afc_nego[AFI_IP][SAFI_MPLS_VPN] && ! peer->afc_nego[AFI_IP6][SAFI_UNICAST] && ! peer->afc_nego[AFI_IP6][SAFI_MULTICAST]) From tcpdump, my side's open message includes: Open Message (1), length: 57 Version 4, my AS XX, Holdtime 180s, ID XX4 !! XX4 is my V4 address Optional parameters, length: 28 Option Capabilities Advertisement (2), length: 6 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) 0x0000: 0001 0001 Option Capabilities Advertisement (2), length: 2 Route Refresh (Cisco) (128), length: 0 Option Capabilities Advertisement (2), length: 2 Route Refresh (2), length: 0 Option Capabilities Advertisement (2), length: 6 32-Bit AS Number (65), length: 4 no decoder for Capability 65 0x0000: 0000 e0c5 Option Capabilities Advertisement (2), length: 2 Unknown (66), length: 0 no decoder for Capability 66 The route-server's response is: Open Message (1), length: 45 Version 4, my AS XX, Holdtime 240s, ID XY4 !! XY4 is his V4 address Optional parameters, length: 16 Option Capabilities Advertisement (2), length: 14 Multiprotocol Extensions (1), length: 4 AFI IPv6 (2), SAFI Unicast (1) 0x0000: 0002 0001 To which I respond: Notification Message (3), length: 27, OPEN Message Error (2), subcode Capability Message Error (7) When I add "dont-capability-negotiate" to the config, I send: Open Message (1), length: 29 Version 4, my AS 57541, Holdtime 180s, ID XX4 Optional parameters, length: 0 I get back: Open Message (1), length: 45 Version 4, my AS XX, Holdtime 240s, ID XY4 Optional parameters, length: 16 Option Capabilities Advertisement (2), length: 14 Multiprotocol Extensions (1), length: 4 AFI IPv6 (2), SAFI Unicast (1) 0x0000: 0002 0001 I respond: Notification Message (3), length: 27, OPEN Message Error (2), subcode Capability Message Error (7) I'm a developer and former rfc writer, not a network operator. thanks nanog, -- David Waitzman BBN Technologies

1 1

RE: bgp update destroying transit on redback routers ?
by Jeff Tantsura 22 Dec '11

22 Dec '11

Hi, Let me take it over from now on, I'm the IP Routing/MPLS Product Manager at Ericsson responsible for all routing protocols. There's nothing wrong in checking ASN in AGGREGATOR, we don't really want see ASN 0 anywhere, that's how draft-wkumari-idr-as0 (draft-ietf-idr-as0-00) came into the worlds. To my knowledge - the only vendor which allows changing ASN in AGGREGATOR is Juniper, see "no-aggregator-id", in the past I've tried to talk to Yakov about it, without any results though. So for those who have it configured - please rethink whether you really need it. As for SEOS - understanding that this badly affects our customers and not having draft-ietf-idr-error-handling fully implemented yet, we will temporarily disable this check in our code. Patch will be made available. Please contact me for any further clarifications. Regards, Jeff P.S. Warren has recently included AGGREGATOR in the draft, please see 2. Behavior This document specifies that a BGP speaker MUST NOT originate or propagate a route with an AS number of zero. If a BGP speaker receives a route which has an AS number of zero in the AS_PATH (or AS4_PATH) attribute, it SHOULD be logged and treated as a WITHDRAW. This same behavior applies to routes containing zero as the Aggregator or AS4 Aggregator.

6 8

BGP noob needs monitoring advice
by Dave Pooser 21 Dec '11

21 Dec '11

Earlier this year I got a /24 of PA space, set up our shiny new router, got BGP working with both my upstreams, and heaved a sigh of relief: "I'll never have to think about THAT again!" (Okay, quit laughing; I SAID I was a noob!) Now, I discover that one of my upstreams quit announcing our route in November (fortunately the provider who assigned us the /24, so we're still covered in their /18) and the other upstream apparently started filtering our announcements last week. I'm working with both of them to get that fixed, but it's made it clear to me that I need to be monitoring this. My question for the group is, how? I can and do monitor my own router, and I can see that I'm receiving full routes from both ISPs. I am capable of manually accessing route servers and looking glass servers to check if they're receiving routes to me, but I'd like something more automated. Free is nice, $$ is not a problem, $$$$ might become a problem. Thanks in advance for any suggestions. -- Dave Pooser Manager of Information Services Alford Media http://www.alfordmedia.com

9 10

Level3 AWS network issues?
by Rob Smith 21 Dec '11

21 Dec '11

Is anyone else seeing issues connecting to the different Amazon AWS products from the east coast via Level3? I'm very high latency once I hit Amazon's network on Level3 for the last day and a half: me@computer:~/$ tracepath s3.amazonaws.com 1: computer.local 0.136ms pmtu 1500 1: XXXXXXXX 6.495ms 1: XXXXXXXX 2.091ms 2: 10.68.96.1 8.933ms 3: gig-2-18-nycmnyr-rtr02.nyc.rr.com 12.440ms 4: tenge-0-4-0-6-nyquny91-rtr001.nyc.rr.com 12.296ms 5: bun6-nyquny91-rtr002.nyc.rr.com 13.894ms 6: ae-3-0.cr0.nyc20.tbone.rr.com 16.869ms 7: 107.14.17.169 10.200ms 8: xe-9-3-0.edge2.Newark1.Level3.net 12.215ms 9: ae-32-52.ebr2.Newark1.Level3.net 12.380ms 10: ae-4-4.ebr2.Washington1.Level3.net 20.277ms 11: ae-92-92.csw4.Washington1.Level3.net 15.482ms 12: ae-2-70.edge3.Washington1.Level3.net 15.972ms asymm 13 *13: AMAZON.COM.edge3.Washington1.Level3.net 277.609ms asymm 16 * *14: 72.21.220.129 311.718ms asymm 17 * *15: 72.21.222.139 325.718ms * *16: 72.21.218.201 279.354ms asymm 17 * *17: 72.21.218.207 276.793ms asymm 15 * I've heard from a few other folks that they're experiencing this as well, but only if they're traversing the Level3 network. I've tried contacting Amazon and tried going through my own provider but haven't been able to get anywhere. Can anyone forward this to the appropriate Amazon/Level3 contacts or provide contact information for someone that I can relay this information to?

1 0

Any tools to help network security
by Deric Kwok 21 Dec '11

21 Dec '11

Hi We discover there are so many (source) ip not belonging to our network to go to outside. We can block it but don't know how to locate the source. Any tools can be easily found out. Thank you

4 3

BGPmon regex
by Christopher J. Pilkington 21 Dec '11

21 Dec '11

I'm trying to edit my prefixes' AS path regex in BGPmon, and when I add a '\s' in the Regular expression field, upon save, the '\' is stripped. Is this expected behavior? The workaround is to insert a '\\s' instead, but one needs to remember to do this on every edit, and I tend to forget which results in panicking the others on our team with false positives. -cjp

3 2

routeviews.org domain registration
by Stephen Strowes 21 Dec '11

21 Dec '11

routeviews.org domain registration has lapsed? I pinged John Kemp at uoregon.edu, but unsure if he is the correct contact for this. Domain ID:D48496876-LROR Domain Name:ROUTEVIEWS.ORG Created On:14-Dec-2000 23:05:47 UTC Last Updated On:20-Dec-2011 08:53:07 UTC Expiration Date:14-Dec-2012 23:05:47 UTC Sponsoring Registrar:Network Solutions LLC (R63-LROR) Status:CLIENT TRANSFER PROHIBITED Status:AUTORENEWPERIOD Registrant ID:DOMAIN-RESALE Registrant Name:Pending Renewal or Deletion Registrant Street1:P.O. Box 430 Registrant Street2: Registrant Street3: Registrant City:Herndon Registrant State/Province:VA Registrant Postal Code:20172 Registrant Country:US Registrant Phone:+1.5707088786 Registrant Phone Ext.: Registrant FAX: Registrant FAX Ext.: Registrant Email:pendingrenewalordeletion@networksolutions.com

3 2

Google's Schmidt on Iran supposedly hijacking GOOG'd .dk traffic
by Gadi Evron 21 Dec '11

21 Dec '11

Video at: http://edition.cnn.com/video/#/video/bestoftv/2011/12/13/erin-schmidt-on-ir… Gadi. -- Gadi Evron, ge(a)linuxbox.org. Blog: http://gevron.livejournal.com/

1 0

Happy xmas folks
by andrew.wallace 21 Dec '11

21 Dec '11

I just want to say happy xmas to everyone at NANOG. I'm about to sign off for the holidays. Andrew

3 3