- NANOG - lists.nanog.org

MPLS/MEF Switches and NIDs
by Colton Conor 09 Jun '21

09 Jun '21

For MPLS and MEF switches, I know Juniper, Cisco, and Nokia are commonly talked about on this list. However, I was wondering if anyone has evaluated other brands? We are not interested in looking at chinese based vendors, so ZTE and Huawei are not an option. Anyone else worth looking into? We have used Juniper's ACX line primarily, but there is a big gap in their product line. The ACX2200 has only two 10G ports. The next jump up from there is the ACX710 with 24 10G ports. They have nothing in between that has 4-12 10G ports. Not to mention, Juniper is very proud price wise. We are looking for cost efficient 10G NIDs with at least 4 10G ports on them and aggregation boxes with at least 12 10G ports on them with 25g/100G uplinks. Ciena seems to have multiple options available with Segment Routing, MPLS, and streaming telemetry support. I am probably most interested in what Ciena has to offer. Has anyone deployed the 3000 or 5000 product line of Ciena? How does it compare to Juniper? The Ciena 3924 is sub $1000 for example, and has 4 10G ports on it. Adva has quite a few options as well, but I don't think their routing stack is as strong as Ciena's. Tejas was an unknown player to me, but they seem to have a couple of options that fit the bill. Price wise, I have heard the run circles around everyone. RAD has some options, but their pricing looks much higher than Ciena. Accedian looked interesting, but it seems they don't make aggregation switches, only NIDs. ECI Telecom / Ribbon seems to have some options, but I have not talked to them. What does Nokia and Cisco have in this space, and price wise is it going to compare to these less known vendors?

13 33

hulu IP issue
by Daniel Sterling 09 Jun '21

09 Jun '21

I changed my hulu passwd and got this email from hulu (see below). It notes what IP I used to change the passwd, but it's an internal IP! Probably not as intended :) email: You've Changed Your Password Hi Daniel, As requested, your password has been changed. From now on, you'll use this new password to log in to Hulu. The password was changed from the IP address 10.35.33.117.

1 0

Re: A survey on BGP MRAI timer values in practice
by Jakob Heitz (jheitz) 09 Jun '21

09 Jun '21

In Cisco, MRAI is "advertisement-interval". MRAI helps to reduce route update multiplication in highly redundant networks. OTOH, it can increase the time it takes to re-advertise a complete internet table in some router implementations. Update multiplication due to redundant network connections causes some receivers of the multiple updates to become slow peers. Here's an experiment: Do something to cause a BGP route refresh, like the equivalent of "clear bgp soft out". It will not change any routes. It just resends everything that was already sent. See how long it takes with MRAI=0. Then set MRAI to about half of that value and do the refresh again. If it takes substantially longer to complete the refresh, stick with MRAI=0. If there is no significant difference, use MRAI of 1 or 2 seconds. Regards, Jakob. -----Original Message----- Date: Wed, 9 Jun 2021 08:53:19 +0300 From: Saku Ytti <saku(a)ytti.fi> On Wed, 9 Jun 2021 at 01:18, Adam Thompson <athompson(a)merlin.mb.ca> wrote: If your work results in actionable recommendations such as "don't use BGP > out-delay timers to mitigate XYZ in circumstance LMNO, do ABC instead", > that's fantastic. Please keep us advised, and do post aggregated survey > results here once you close the survey. > What is actionable? What is the goal? The question as OP presented contains some assumptions a) better convergence is needed b) MRAI is important part of the solution space Neither are provable. We already know how to make DFZ convergence really fast (or at least orders of magnitude faster than it is), that information exists, but that isn't deployed because customers are not asking for it, so providers are not aware that there is room for improvements. Things don't optimise to be as good as they can be, things optimise to be as bad as the market allows them to be. And the market accepts the DFZ convergence. If you do decide to optimise for DFZ convergence, without commercial pressure, you will risk lower availability, because you'll be using configuration less tested by other customers and everyone knows how terrible quality every NOS is. Everyone finds novel bugs, in the same damn protocols we've ran +20 years. It's like running Windows and Linux and regularly finding out listing files in a directory breaks your service, year after year after year. For those who are interested in better convergence - change your interface down reporting to 0 (there may be delay before interface down is reported to system, so that optical protection works without causing outage) - use 'add-path' or at least 'best-external' in iBGP, so that you always have backup eBGP route immediately available once best is invalidated (normally you have lot of delay to find next best, once you lose your best eBGP) - tie your route validity to IGP, so you can invalidate your BGP the moment IGP disappears - ensure IGP converges fast (another topic) - set MRAI to 0 - use PIC edge - ensure your BGP NLRI can be as large as MTU allows - ensure your convergence isn't bottle necked by slow peer in group - ensure you are not dropping received TCP packets on punt path - ensure your fast external fallover works (eBGP down, on int down) this is quite easy to break - then ensure everyone else in the DFZ does the same thing But from a business POV, don't do any of this, you will have more bugs and lower availability and your customers will be less happy. > I *am *specifically interested in the answer to "Have you ever had to > adjust BGP out-delay with any of your peers, and why?" It would be great > if we could derive that answer from the survey results, but anecdotal > replies here would also be helpful. All you larger(-than-me) network > operators out there: when would I need to use out-delay? Why? What does > it accomplish? > > Good luck in reformulating your survey to get better engagement, > -Adam > > *Adam Thompson* > Consultant, Infrastructure Services > [image: 1593169877849] > 100 - 135 Innovation Drive > Winnipeg, MB, R3T 6A8 > (204) 977-6824 or 1-800-430-6404 (MB only) > athompson(a)merlin.mb.ca > www.merlin.mb.ca > > ------------------------------ > *From:* NANOG <nanog-bounces+athompson=merlin.mb.ca(a)nanog.org> on behalf > of Saku Ytti <saku(a)ytti.fi> > *Sent:* June 8, 2021 01:06 > *To:* shahrooz(a)cs.umass.edu <shahrooz(a)cs.umass.edu> > *Cc:* nanog list <nanog(a)nanog.org>; Arun Venkataramani <arun(a)cs.umass.edu> > *Subject:* Re: A survey on BGP MRAI timer values in practice > > On Mon, 7 Jun 2021 at 19:32, <shahrooz(a)cs.umass.edu> wrote: > > > We often read that the Internet (i.e. BGP) has a long convergence delay. > > But why is it so slow? And can we (researchers) do anything about it? > > Create business incentives to improve it. This is a non-technical > problem, we've long had technical tools to make it fast, there just > isn't incentive to make it fast. Customers are not asking operators > for better convergence speeds. > > > Please help us out to find out by answering our short anonymous survey > > (<10 minutes). > > Can you tell me what have you done so far? What are the default MRAI > values for each AFI/SAFI for IOS, IOS-XR, Junos, SROS, VRP and EOS? > Then people responding don't have to check what their NOS does, they > can refer to your table and tell the default value, since this is what > >99% will be using. > > Now your survey has built-in selection bias, people who answer it are > people who know what it is and who are concerned about it and have > changed it, this is not a representative group and you will start your > work with very bad data. > > > > -- > ++ytti > -- ++ytti

1 0

BCP38 on public-facing Ubuntu servers
by Stephen Satchell 09 Jun '21

09 Jun '21

Not every uplink service implements BCP38. When putting up servers connected more-or-less directly to the Internet through these uplinks, it would be nice if the servers themselves were able to implement ingress and egress filtering according to BCP38. (Sorry about the typo in the subject lines of my previous message -- not everyone can get a BGP feed.) (Or, when using Ubuntu server edition to implement edge routers.) My earlier query was asking if anyone has encoded the blackhole routes in YAML for inserting in netplan(5). My prior message contains the routes to be blackholed. That takes care of egress routing. (I think I can write a Python program to take my list and convert it to the YAML that netplan(5) wants to see. That way, the routes are inserted when the public interface is up, and removed when the public interface is down.) Ingress routing appears to be one-line addition. IPTABLES can be told to weed out packets with unroutable source addresses. My experiments will add something like this line to the firewall: # iptables -A INPUT -m addrtype -i enp1s0 --src-type BLACKHOLE -j DROP THIS HAS NOT BEEN VERIFIED. I'm building a web server that will integrate this idea, and try it out.

7 9

Spoofer Report for NANOG for May 2021
by CAIDA Spoofer Project 08 Jun '21

08 Jun '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during May 2021: ASN Name Fixed-By 5078 ONENET-AS-1 2021-05-19 55016 IMPER-AS-1 2021-05-25 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during May 2021: ASN Name First-Spoofed Last-Spoofed 3356 LEVEL3 2016-03-06 2021-05-05 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2021-05-25 20412 CLARITY-TELECOM 2016-09-30 2021-05-31 6181 FUSE-NET 2016-10-10 2021-05-29 11427 TWC-11427-TEXAS 2016-10-21 2021-05-28 174 COGENT-174 2016-10-21 2021-05-11 30036 MEDIACOM-ENTERPRISE-BUSINESS 2016-11-16 2021-05-25 22898 ATLINK 2016-12-16 2021-05-28 63296 AWBROADBAND 2017-09-01 2021-05-27 546 PARSONS-PGS-1 2017-11-20 2021-05-20 393564 SPOKANE 2018-06-05 2021-05-18 33452 RW 2018-09-19 2021-05-26 20448 VPNTRANET-LLC 2018-09-20 2021-05-28 5078 ONENET-AS-1 2020-04-06 2021-05-24 6391 URBAN-15 2020-05-29 2021-05-20 208188 PUGET-SOUND-NETWORKS 2020-12-04 2021-05-30 62684 XLBROADBAND 2021-05-19 2021-05-19 13876 FIBER-64 2021-05-20 2021-05-27 26397 OPTIPUTER 2021-05-24 2021-05-24 3754 NYSERNET3 2021-05-24 2021-05-24 3756 NYSERNET3 2021-05-24 2021-05-26 20150 ANYNODE 2021-05-29 2021-05-29 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Fastly CDN down globally?
by Tony McCrory 08 Jun '21

08 Jun '21

Affected for example:- theguardian.co.uk nytimes.com fastly.com All return 503 Service Unavailable from Varnish Cache Tony

2 1

Fastly CDN Down?
by Jason Cooper 08 Jun '21

08 Jun '21

I just got an email from my CI alert that says registry.terraform.io is experiencing HTTP 503. And not just terraform, repo.maven.apache.org/maven2 also seems down. Even with their own website: fastly.com Is there anyone at Fastly? -- Jason

2 1

Explore the NANOG 82 Virtual Expo 👉 Doors open TODAY
by Nanog News 07 Jun '21

07 Jun '21

NANOG 82 EXPO: Interact + Network Virtually *The latest technology, all in one space* The NANOG 82 Expo <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> is right around the corner! Network and interact with reps from top tech companies from your living room, learn about the latest technologies, have fun at the scavenger hunt + win raffle prizes. *Digital doors open June 7 and will remain open until June 25.* Engage in this one-of-a-kind experience by visiting booths virtually, have the opportunity to connect with incredible professionals and of course, get your swag on! *Sponsored by <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…>Opengear <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…>* *Scavenger Hunt Rules:* Please visit each NANOG 82 Virtual Expo booth to search for answers to our daily Scavenger Hunt, beginning on June 14 and ending on June 16. Submit your answers by 11pm EST/8pm PST for a chance to win a $100 VISA Gift Card. 1 winner per day. Winners will be notified by email. *Scroll on to learn more about each of our exhibitors.* Visit Expo <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Amazon*Interconnect with the Amazon global network.* Amazon operates a global network covering more than 80 cities and over 200 Points of Presence (POPs). Learn more: peering.aws <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Charter Communications*America's fastest-growing TV, Internet and Voice provider.* At Charter Communications, we connect our customers to innovation. From Spectrum Internet Gig and our path to 10G, to the Spectrum TV App and Spectrum Mobile, our blazing fast and secure broadband network powers the future. Learn more: spectrum.com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Juniper Networks*Engineering Simplicity* Juniper Networks brings simplicity to networking with products, solutions and services that connect the world. Through engineering innovation, we harness the power of networking in the cloud to solve the toughest challenges. Learn more: juniper.net <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Kentik*Kentik is the network observability company. Our platform is a must-have for the network front line, whether digital business, corporate IT, or service provider. * Kentik® is the network intelligence platform for the connected world, trusted by leading digital enterprises and service providers. With Kentik, businesses eliminate the visibility and intelligence gaps associated with running dynamic and complex networks, and achieve greater network performance, reliability and security. The Kentik Network Intelligence Platform ingests diverse data streams from the internet, edge, cloud, data center and hybrid infrastructures and provides real-time visualizations and AIOps-powered insights and automation. Learn more: kentik.com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Microsoft *Learn. Connect. Explore.* Empowering Others: Our mission is to empower every person and every organization on the planet to achieve more. Learn more: microsoft.com/en-us <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> [image: netscout_expo.png] Netscout*Visibility Without Borders* NETSCOUT SYSTEMS, INC. (NASDAQ: NTCT) helps assure digital business services against disruptions in availability, performance, and security. Our market and technology leadership stems from combining our patented smart data technology with smart analytics. We provide real-time, pervasive visibility and insights customers need to accelerate and secure their digital transformation. Our approach transforms the way organizations plan, deliver, integrate, test, and deploy services and applications. Our nGenius™ service assurance solutions provide real-time, contextual analysis of service, network, and application performance. Learn more: netscout.com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> *Swag + Prizes * $200 Amazon Gift Card Giveaway! Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Nokia*The NetOps era is here – switch to data center networking your way.* Our next-generation data center switching solution is driven by SR-Linux, a uniquely open, extensible and consumable Network Operating System (NOS), together with our new Fabric Services Platform which provides the declarative, intent-based toolkit needed to successfully automate data center network operations. Just out: Packet Pushers Heavy Networking podcast: Nokia SR Linux – A Hyperscaler NOS Designed For Everyone. Learn more: nokia.com/networks/dc-fabric <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> [image: packetfabric.png] PacketFabric*Defy the network norm* PacketFabric delivers on-demand, private and secure optical connectivity between hundreds of colocation DCs, cloud service providers, Internet Exchange and SaaS providers in minutes, across a 50+Tbps global network.. Build an agile backbone at scale on month-to-month terms. Expand your network reach and performance. Connect and move data between multiple cloud providers at speeds up to 100G with no hardware or physical ports. Do it via self-service portal or REST API. Learn more packetfabric.com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> *Swag + Prizes* Apple Series 6 Watch Giveaway! Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Precision Optical*Custom Solutions. Reliable Networks.* Precision Optical Transceivers is a system engineering company focused on optical transceivers and related active/passive optical components. For over a decade, we have helped build networks around the globe by providing high quality, custom-engineered optical solutions. Learn more: precisionot.com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Swag + Prizes: - Raffle: Apple Watch Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> [image: solid-optics-expo.png] Solid Optics *Global Supplier and Manufacturer of Optical Networking Equipment & Solutions. * Solid Optics is a global supplier of compatible optical transceivers, multiplexers, OADMs and measuring tools, including our innovative EDFAMUX: a MUX + EDFA + DCM in 1RU for 10G up to 200km and for QSFP28 PAM4 DWDM 100G up to 120km. We assist and advise our customers on complex tailored networking solutions and provide a full range of optical networking products including custom built multiplexers and enclosures. Learn more: *solid-optics* <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> .com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> *Swag + Prizes:* 1st Prize: Sony WH-1000XM4 Wireless Headphones <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> 2nd Prize: Sonos One (Gen 2) - Voice Controlled Smart Speaker <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> 3rd Prize: $50 Amazon E-Gift Card Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Team Cymru*The Power of Pure Signal™* Since 2005, Team Cymru’s mission has been to save and improve human lives by working with public and private sector teams to discover, track and take down threat actors and criminals around the globe. The company delivers comprehensive visibility into global cyber threat activity and is a key source of intelligence data for many cyber security and threat intelligence vendors. Enterprise security teams rely on its Pure Signal™ platform for access to global network traffic and 50+ other types of data. With this visibility, they not only accelerate incident response, but they can get ahead of their most critical, recurring threats – monitoring malicious infrastructures in the wild and even blocking attacks before they’re launched. Learn more: team-cymru.com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> [image: windstream-wholesale-expo.png] Windstream Wholesale*Empowering digital transformation for wholesale customers* Empowering digital transformation for wholesale customers - including content and media providers, cloud and data center operators, international carriers, resale partners, cable operators, wireless and traditional network service providers and more. Learn more: windstreamenterprise.com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> XKL*#LightyourNetwork * XKL continues to deliver and expand its family of optical transport solutions for private/public cloud solutions, data center networks, internet exchanges, campus/metro networks, broadband ISP, and long-haul networks. Our clientele is global, and we recognize the need to adapt to various market, regulatory, and licensing conditions and to meet the broader telecommunication audience needs. Our team members work closely with our customers to help identify customer pain points, create compelling customer solutions, and develop use cases. Our goal will be to deliver an XKL optical networking solution that achieves network independence, greater reliability, enhanced transmission speed, and better value. Learn more: xkl.com <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Visit Expo Booth <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> Where to Watch 🖥️Next Monday, June 14, the NANOG 82 Virtual conference will start! Where to Watch: Just navigate over to nanog.org/virtual-82 <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> on 6/14 + click "Watch Webcast" in the left-hand nav. Don't forget to register in advance + set up your NANOG account. Complementary Conference Registration <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> is available to anyone who needs it! View Agenda <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> NANOG 82 Events: Save the Date *Game Time*: Put your NANOG + network engineering knowledge to the test with a round of Kahoot trivia during the last 15 minutes of the 1:30-2:00 PM EDT break. Check the abstract in the agenda for login information for each day's game. *Hackathon:* The NANOG 82 virtual Hackathon will take place this Saturday + Sunday, June 12 and 13. Participants can work individually, or self-organize into teams to work on their software passion projects. REGISTER NOW. <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…> *🙋Engage with the NANOG community:* NANOG 82 will include a number of networking opportunities, polls, and live Q&As, so you can network and share your ideas with the greater NANOG community from the comfort of your home. Register for NANOG 82 <https://nanog.us20.list-manage.com/track/click?u=4d708401d0e69d9dc73d1c204&…>

1 0

amazon.com multiple SPF records
by Brad Barnett 07 Jun '21

07 Jun '21

If anyone at Amazon is paying attention, you have duplicate spf1 records for amazon.com: # dig -t TXT amazon.com | grep spf amazon.com. 281 IN TXT "spf2.0/pra include:spf1.amazon.com include:spf2.amazon.com include:amazonses.com -all" amazon.com. 281 IN TXT "v=spf1 include: amazon.com include:spf1.amazon.com include:spf2.amazon.com include:amazonses.com -all" amazon.com. 281 IN TXT "v=spf1 include:spf1.amazon.com include:spf2.amazon.com include:amazonses.com -all" It's causing mail deliverability issues, so users cannot reset their password, or even get OTP codes reliably. (I don't know where else to post, as whois/arin contacts aren't responding, and I can't even imagine trying to go through other methods of support...)

8 8

OSI layer 1 and revisiting labelmakers in the year 2021
by Eric Kuhnke 07 Jun '21

07 Jun '21

I am still using a Dymo 4200 [1] which is generally okay. I am wondering if anyone or their field tech team has recently changed to a better label maker in terms of feature set, battery life/charging or label consumable cost. Surely there must be something better out there. Strong preference for QWERTY keyboards, no ABCDE type. [1]: https://www.dymo.com/en_CA/rhino-industrial-4200-qwy.html

3 2