- NANOG - lists.nanog.org

Spoofer Report for NANOG for Sep 2021
by CAIDA Spoofer Project 08 Oct '21

08 Oct '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Sep 2021: ASN Name Fixed-By 8038 6CONNECT 2021-09-08 208188 PUGET-SOUND-NETWORKS 2021-09-28 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Sep 2021: ASN Name First-Spoofed Last-Spoofed 6939 HURRICANE 2016-02-22 2021-09-15 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2021-09-29 20412 CLARITY-TELECOM 2016-09-30 2021-09-30 6181 FUSE-NET 2016-10-10 2021-09-30 11427 TWC-11427-TEXAS 2016-10-21 2021-09-28 22898 ATLINK 2016-12-16 2021-09-25 701 UUNET 2017-06-14 2021-09-13 63296 AWBROADBAND 2017-09-01 2021-09-24 23089 HOTWIRE-COMMUNICATIONS 2017-09-30 2021-09-24 546 PARSONS-PGS-1 2017-11-20 2021-09-24 12222 AKAMAI 2018-02-14 2021-09-23 393564 SPOKANE 2018-06-05 2021-09-28 33452 RW 2018-09-19 2021-09-28 8047 GCI 2019-04-11 2021-09-17 62904 EONIX-COMMUNICATIONS-ASBLOCK-6 2019-07-14 2021-09-28 5078 ONENET-AS-1 2020-04-06 2021-09-23 11650 PLDI 2020-05-25 2021-09-10 398836 NP-NETWORKS 2021-03-12 2021-09-17 56207 Converge 2021-03-26 2021-09-14 13876 FIBER-64 2021-05-20 2021-09-11 399318 2021-08-29 2021-09-30 268206 Community Net Internet e Infor 2021-08-30 2021-09-28 18450 WEBNX 2021-09-01 2021-09-16 399804 2021-09-04 2021-09-04 63457 EMPIRE-CONNECT 2021-09-08 2021-09-29 398355 DATAIDEAS-LLC 2021-09-10 2021-09-10 211562 2021-09-23 2021-09-23 264872 Brothers Lan House Ltda Me 2021-09-28 2021-09-28 33258 CSONLINE-AS-1 2021-09-28 2021-09-28 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Global issues @ Telia - doing a "FB/hold my beer" move?
by Vincentz Petzholtz 08 Oct '21

08 Oct '21

Hi everyone, Looks like the season for outages is on. Does anyone has more details regarding the issues at Telia? I didn't found any public available information. They say it's over but this is clearly not the case. Best regards, Vincentz

5 5

IRR for IX peers
by Randy Bush 07 Oct '21

07 Oct '21

so i have an AS (3130) which peers at the SIX (RSs and some direct). in the hope that leak detectors such as artemis would stop false positives when they see my prefixes announced customer cones of SIX peers, i want to add the SIX peers to my aut-num: policy. export: to AS-SEATTLEIX-RS-CLIENTS announce AS-RG-SEA seems clear and obvious. but import: from AS-SEATTLEIX-RS-CLIENTS accept AS-SEATTLEIX-RS-CLIENTS would seem to allow bill's bait and sushi to announce microsoft to me. and i am not sure that expansive `from` clause is actually allowed. what are others in this space doing? [ and let's not descend into the rat-hole of dissing the IRR. i have heard of this RPKI thing and might try it some day. ] randy --- randy(a)psg.com `gpg --locate-external-keys --auto-key-locate wkd randy(a)psg.com` signatures are back, thanks to dmarc header butchery

6 14

Another Perspective - Kentik's View on the Facebook Outage
by Mark Tinka 07 Oct '21

07 Oct '21

https://www.kentik.com/blog/facebooks-historic-outage-explained/?mkt_tok=OD… Mark.

1 0

NANOG 83 Sneak Peak + Safety Concerns
by Nanog News 06 Oct '21

06 Oct '21

Sneak Peak of NANOG 83Register Now for Incredible Programming, Network Opportunities + More *The anticipation is killing us!* We are only three short weeks away from our next meeting and we cannot wait to see you! NANOG 83 will take place online + in person in Minneapolis, MN, from Nov. 1 - 3. *Topics to be featured:* - Famous Internet Outages Panel - Security - IPv6 - Automation - Networking Sessions - Newcomers on Monday - Women in Tech on Tuesday - Community Meeting - Board Candidate Session *Be sure not to miss* the NANOG Board of Directors candidate session on Monday, 11/1. NANOG 83 Keynotes, given by Bert Hubert on Tuesday, 11/2, and John Brzozowski on Wednesday, 11/3. We’ll also hold the NANOG Community Meeting on Wednesday, 11/3 (all are welcome!), and the NANOG Members Meeting on Tuesday, 11/02. If this is your first NANOG conference, we encourage you to attend the Newcomers Networking Session on Monday. *Also, don't miss our hybrid expo.* Daily games + prizes, and numerous opportunities to connect with our community in real-time (online + in-person). *REGISTER NOW <https://www.nanog.org/events/nanog-83/>* *NANOG 83 Safety + Travel Concerns* Addressing the COVID Elephant We understand the changing course of the pandemic may concern the NANOG community about traveling to NANOG 83 this fall. Your health and safety are very important to us and we are continuing to monitor the latest federal, state, and local government guidelines and restrictions. Check out our Meeting Guidelines to learn more about the precautions we are taking. *MEETING GUIDELINES <https://www.nanog.org/events/nanog-83/safety-travel/>* *Register Now for Hackathon* Fun Way to Network + Explore Passion *NANOG 83 Hackathon Details* Fri. Oct. 22 - intro/tutorial/team formation Sat. + Sun. Oct. 30, 31 - hacking *Enjoy in-Person + virtual: *NANOG Hackathons are hands-on, and educational at their core — directly supporting the most critical aspects of our mission. All levels are welcome to participate, and as always, registration is free. So, what is it actually like to participate? Q + A with a NANOG Hackathon <https://www.nanog.org/stories/so-what-is-it-actually-like-to-participate-in…> alumni. <https://www.nanog.org/stories/so-what-is-it-actually-like-to-participate-in…> *REGISTER NOW * <https://www.nanog.org/events/n83-hackathon/>

1 0

Cloudflare contact
by David Brain 06 Oct '21

06 Oct '21

Hi, Is there a contact/procedure with Cloudflare to address the issue of users getting CAPCHAs when accessing sites behind CloudFlare. We are seeing this impacting some of our user base, and it has been persisting for a number of days. Thanks, David. -- David Brain - MCNC - 919.248.1998

1 0

massive facebook outage presently
by Eric Kuhnke 06 Oct '21

06 Oct '21

https://downdetector.com/status/facebook/ Normally not worth mentioning random $service having an outage here, but this will undoubtedly generate a large volume of customer service calls. Appears to be failure in DNS resolution.

60 104

HBO Max Contact
by Kevin McCormick 05 Oct '21

05 Oct '21

Hello Everyone, We've been having trouble with HBO Max and blocked subnets. I tried HBO: CTIAEngineers(a)hbo.com<mailto:CTIAEngineers@hbo.com> listed on TheBrothersWISP website and support(a)hbo.com<mailto:support@hbo.com>. https://thebrotherswisp.com/index.php/geo-and-vpn/ We have never received a reply. Does anyone have another contact for them or do you know which IP Geolocation and VPN service they use? Thank you, [cid:image001.png@01D6B9D9.BDCE3D20]<https://www.mdtc.net/> Kevin McCormick McDonough Telephone Cooperative 210 N Coal St. Colchester, IL 62326 Phone: 309.776.6258 Email: kmccormick(a)mdtc.net<mailto:kmccormick@mdtc.net> Web: mdtc.net<https://www.mdtc.net/> | mtccomm.net<https://www.mtccomm.net/> Fax: 309.776.3299 24 Hour Repair: 309.776.3214 Driving Directions<https://goo.gl/maps/zrsGKHLQLSqu6VHA6> | Follow us on Facebook<https://www.facebook.com/followmdtc> CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. You may not read, retransmit, or in any way use or allow the following material to be used in any way unless you are the addressee. Any unauthorized review, copying, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Thank you.

4 4

Re: facebook outage
by Bill Woodcock 04 Oct '21

04 Oct '21

Ok, I lied, I’m still awake. I got my first successful Facebook main page load at 23:13 UTC, for an overall duration of 8:33, or 513 minutes. Multiplied by three billion users, that’s 1.54 trillion person-minutes. That’s a tera-lapse! Have we had one of those before? -Bill

1 0

The Outage
by Andy Ringsmuth 04 Oct '21

04 Oct '21

I suppose it could just be me. Or it could be more than just me. Anyone else noticing that at the same time as the giant FB outage, both the outages and outages-discussion lists are suddenly slow as molasses in January too? Checking some headers on messages that do make it through to outages, I’m seeing delays up to an hour and a half. I sent one messages to outages-discussion at 11:41 CDT (75 minutes ago) and haven’t seen it show up yet. ---- Andy Ringsmuth 5609 Harding Drive Lincoln, NE 68521-5831 (402) 304-0083 andy(a)andyring.com “Better even die free, than to live slaves.” - Frederick Douglas, 1863

3 3