- NANOG - lists.nanog.org

Join us for NANOG 94 in Denver
by De' Harvey 24 Apr '25

24 Apr '25

Hello NANOG Friends, I want to personally let you know that our next conference is right around the corner! We’ll be gathering in Denver June 9-11 at the Sheraton Denver Downtown and we really hope to see you there. We are putting together a great event focused on connection, learning, and collaboration and Denver is the place for all of it. A few quick notes to keep in mind as you make your plans: - Save $100 by registering before May 11. After that, prices go up. - If you need a hotel room, be sure to do it early. Our room block closes May 15. - Can’t make it in person? No worries, virtual registration will open May 12 so you can still be part of the experience online. - We will share the full agenda on May 19, stay tuned! Here’s the registration link: https://www.nanog.org/events/nanog-94/registration/ In person Registration Start Date End Date Member NonMember Student Standard Mar 24 May 11 $925 $950 $100 Late May 12 June 7 $1025 $1050 $100 Onsite June 8 June 11 $1,225 $1,250 $100 Whether in person or online, I can't wait for you to join us. Warmly, De’ Director of Meetings, NANOG

1 0

NANOG Members: We Want to Hear from YOU! + More!
by Nanog News 24 Apr '25

24 Apr '25

*** NANOG Members: We Want to Hear from YOU!* ------------------------------------------------------------ *Please Take Our Emailed Survey* The NANOG Elections Committee sent members an email with a survey link on Monday, asking for feedback regarding voter turnout. Please check your inbox or peek in that SPAM folder in case it was caught by a filter. *** Reminder! Call for Presentations Deadline Approaching* ------------------------------------------------------------ *Submit Your Talk Proposal by Monday, Apr. 28* Got something to share? You still have time to present at NANOG. Connect directly with your peers and contribute to the conversations driving our industry forward. *LEARN MORE * </>(https://nanog.org/program/call-presentations/) *** Register Now for N94 and Save on Fees!* ------------------------------------------------------------ *Join Us for NANOG 94 in Denver (June 9-11)* Only two weeks remain to take advantage of the current registration rate — register today and save $100. *REGISTER NOW* (https://nanog.org/events/nanog-94/register/) *** Video of the Week* ------------------------------------------------------------ *Streaming with Open Caching on the ISP Edge w/ Jeff Budney —Verizon* With over 2,000 views and counting, don’t miss Budney’s deep dive into streaming industry trends, Verizon’s approach to handling traffic, and how Open Caching is transforming video performance. From buffering to start failures, see the real-world results of a nationwide deployment in this insightful talk. *WATCH NOW* (https://www.youtube.com/watch?v=7OAa0s-FDeY) *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

[NANOG] The NANOG 94 CFP is open through 28-April-2025
by NANOG Program 21 Apr '25

21 Apr '25

NANOG Community at large, The NANOG Program Committee (PC) would like to remind you that we are accepting proposals through Monday, 28 April 2025, for in-person or live remote presentations at all sessions of NANOG 94, taking place in Denver, CO on 09-11 June 2025. Sometimes, we deal with our own projects so regularly that they no longer seem cool or interesting to us - but they are to other people! Sometimes you want to present, but don’t know what other people want to learn about. During every NANOG Conference we ask everyone to answer the surveys and tell us what they want to hear about at a future conference. Some of the most recent answers are below. If you have a presentation on any of these general or specific topic areas, your community would love to hear from you! Hardware - More hardware talks - Would like to see a talk on different ASIC chip families, like a showdown of different generations. (capabilities, pros/cons) - Softer skills - Professional and career development, especially Kam Agahian and Matt Ringel - Risk-based financial decision making - Conversation on transitioning from a purely operations role to operations and management - Computing and internet history - Keynote or special speaker that isn't even IT related, someone that is a bit famous - AI - Using AI Platforms - More network automation, to attract software developers that also work in networks. Discuss databases, APIs, Linux systems administration as vendor network operating systems are based on Linux. - Details on how to define and build AI agents - More inclusion of Network Automation platforms and open-source. - Network automation with programming languages, databases, APIs, Linux, Docker/Kubernetes, and more. - Continue w AI, automation and interplanetary networking, please. - A presentation on how to use any one of the [automation] tools - Routing - Residential Broadband - Integrating IPv6 - MP-BGP EVPN/ISIS MPLS Segment Routing (ISP focused) - Performance - Open source/freely available tools are out there that don't suck for moving data quickly and efficiently (editor’s note: there was grumbling about globus being expensive) - More information about how to measure and improve network performance from hosts. Submit your presentation proposal and abstract via the Program Committee Tool at: https://www.nanog.org/meetings/submit-presentation/ - Sign in with your Profile Account - Select the type of talk you propose to present, and complete the form Timeline for submission and proposal review: NANOG 94 Calendar of Events Date Event/Deadline *Apr 28, 2025* *DRAFT Presentation Slides Due* May 19, 2025 Meeting Agenda Published Jun 2, 2025 FINAL Slides Due If you have any questions, please email the PC (nanogpc(a)nanog.org) and a representative will respond to you in a timely manner. Otherwise, submit your talk, tutorial, track, or panel proposal to the Program Committee Tool at your earliest convenience. We look forward to reviewing your submission! Sincerely, Adair Thaxton Program Committee Chair Sent on behalf of the NANOG PC

1 0

CGNAT growing pains
by Jon Lewis 17 Apr '25

17 Apr '25

We started rolling out CGNAT about 6 months ago. It was smooth sailing for the first few months, but we eventually did run into a number of issues. Our customer base is primarily FTTH with "dynamic" IP assignment via DHCP. Since connections are always-on, customer ONTs/routers get an IP assigned, and then when the lease is renewed, they request a new lease for the existing IP, and, in general, that request is granted. This gives customers the mistaken impression they have a static IP. So, my impression, from working with some customers who've needed to be moved from CGNAT back to public IP is that customers who are doing port-forwarding don't even bother with dynamic DNS. They just know they can connect to their IP as they've never seen it change. We do offer/sell static IP, but pre-CGNAT, it was strictly for business customers. i.e. A residential customer could only get static IP service by converting their account to a business account. That may change in the near future. One issue we didn't foresee has been IP Geo issues. i.e. We all knew that streaming services like Netflix use IP Geo to determine what content should be made available, but that's, AFAIK, limited by country or region. What we didn't anticipate is services like Hulu Live TV doing IP Geo down to the city level to determine which local channels are a subscriber's local channels. We're using Juniper MX gear and SPC3 cards for our CGNAT routers, each one having a single large external pool. Since we serve most of FL, one external pool can't IP Geo correctly for customers as far apart as Miami and Jacksonville hitting the same CGNAT router. We don't currently have an acceptable solution to this other than moving impacted customers off CGNAT. One of the great unknowns (at least for us) with CGNAT was what our PBA settings should be. i.e. How large each port-block should be, and how many port-blocks to allow per customer. We started with 256x4. It seemed to work. We eventually noticed that we were logging port-block exceeded errors. This is one aspect where Juniper's CGNAT support is lacking. There's a counter for these errors, and it's available via SNMP, but there's no way to attribute the errors to subscriber IPs. We're polling the mib and graphing it, so we know it's a continuing issue and can see when it's incrementing faster/slower, but Junos provides no means for determining if "PBEs" are all being caused by a single customer, a handful of customers, etc. We have a JTAC case open on this. As a quick & hopeful fix, we both increased the port-block size and block limit. That helped, but didn't stop the errors. It also cut our CGNAT ratio by more than half (64:1 -> 28:1), if we stay at this ratio, we'll need much larger external pools than originally anticipated. Tuning these settings is kind of painful as JTAC strongly recommends bouncing the CGNAT service anytime CGNAT related config changes are made. This means briefly breaking Internet access for all CGNAT'd customers. For the PBEs, JTAC's suggestions so far have been to shorten some of the timeouts in the config and to keep doing what we're doing, which is a cron job that essentially does a "show services nat source port-block", parses the output looking for subscriber IPs that have used up the ports in several of their port-blocks, then does a "show services sessions source-prefix ..." and logs all of this. This at least gives us snapshots of "who's a heavy user right now" and lets us look at how they were using all their ports. i.e. was it bittorent, are they compromised and scanning the internet for more systems to compromise, is it legit looking traffic - just lots of it, etc.? The latest CGNAT issue is a customer with a Palo Alto Networks firewall connected to our network and several of their employees are our FTTH customers. On their PANW firewall, they're doing IP Geo based filtering, limiting access to internal servers to "US IPs". Since we only CGNAT traffic to the external Internet, their on-net employees hit the firewall from their 100.64/10 IPs and get blocked. I suggested they whitelist 100.64/10, saying we block traffic from 100.64/10 from entering our network via peering and transit, so they can be assured anything from 100.64/10 came from inside our network / our customers. They say the firewall won't let them whitelist 100.64.0.0/10, giving an error that it's invalid IP space. I know we're not the first to implement CGNAT, so I'm curious if others have run into these sorts of issues, or others we haven't run into yet, and if so, how you solved them. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Blue Stream Fiber, Sr. Neteng | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

10 16

[NANOG] Join the NANOG Discord Channel! + More
by Nanog News 17 Apr '25

17 Apr '25

*** Keep the Conversations Going on the NANOG Discord Channel!* ------------------------------------------------------------ *Have you Joined the NANOG Discord yet?* Keep the conversations going between the in-person meetups, where you will find groups of channels related to the conferences, NANOG committees, technology, and official + unofficial affinity groups. *SEE MORE* <https://discord.nanog.org.> (http:// https://discord.nanog.org.) *** Reminder! Call for Presentations Deadline Approaching* ------------------------------------------------------------ *Submit Your Talk Proposal by Monday, Apr. 28* *Got something to share? *You still have time to present at NANOG. Connect directly with your peers and contribute to the conversations driving our industry forward. *LEARN MORE* <https://nanog.org/program/call-presentations/> ( https://nanog.org/program/call-presentations/) *** Find a Mentor or Receive Mentorship* ------------------------------------------------------------ *Join the NANOG Mentorship Program* Open the door to guiding or becoming the next generation of tech leaders. *MORE INFO * <https://nanog.org/outreach/nanog-mentorship-program/>( https://nanog.org/outreach/nanog-mentorship-program/) *** Video of the Week* ------------------------------------------------------------ *Keynote: "Networking for AI" with Sharada Yeluri* In one of our most viewed videos from N93, Yeluri explores what AI networking truly entails—from the critical role of networks in training AI clusters to how AI models are partitioned and how GPU traffic patterns emerge. *WATCH NOW* <https://www.youtube.com/watch?si=wWmlg-Ob8pQNn2jS&v=Rd1tzO8U8to&feature=you…> *** Happy Easter from all of us at NANOG!* ------------------------------------------------------------ Wishing peace, renewal, and connection —whether you're spending time with loved ones, recharging, or diving into a passion project. Here's to brighter days and stronger networks ahead. *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

[NANOG] ISPs in Spain are blocking CDN IP ranges to tackle soccer piracy
by Raúl Martínez 16 Apr '25

16 Apr '25

Hello, Nanog, This is an ongoing issue that might affect your spanish users if you use services like Cloudflare, Vercel, BunnyCDN or GitHub pages. A couple of weeks ago, the most important ISPs in Spain started intercepting or nullrouting IP addresses from this CDN providers. The reason is that a couple of local court orders allowed LA LIGA (sports association responsible for administering the two professional football leagues in Spain) to provide ISPs with a list of IP addresses that host soccer piracy sites to be taken down in a short period of time, even when the football match is taken place. The issue is that most of this piracy sites use Cloudflare and others to protect themselves, so ISPs are nullrouting or intercepting IP ranges that serve thousands of websites, including all Cloudflare Free customers (but not limited to). For example, they blocked one IP address that served ChatGPT. These blockages are applied when the soccer matches are played and they are turned off hours later. Cloudflare has already taken legal action against this, but the issue is still ongoing. You can find more information about this issue on TorrentFreak (LaLiga Blocks Cloudflare Again, New Pirate IPTV Providers & Anything in The Way), BandaanchaEU (bandaancha bloqueos del fútbol). *Regards,* *Raúl Martínez*

11 17

[NANOG] NANOG Mail List Alias ending 18-April-2025
by Valerie Wittkop 15 Apr '25

15 Apr '25

NANOG Community, It has been a month and a half since we completed maintenance on our instance of Mailman, and started using nanog(a)lists.nanog.org. This message is to notify you we will be ending the use of the nanog(a)nanog.org alias on Friday, 18 April before noon eastern. Once the alias is turned off, messages addressed to nanog(a)nanog.org will NOT be delivered to the NANOG mail list. If you send a message to nanog(a)nanog.org you will get an auto-response informing you the message was not delivered to the mail list. Additionally, we will also be removing the subject prefix [NANOG] from messages going forward. For those wanting to filter list messages, we suggest using the List-ID: headers. We strongly encourage you to update your address books at this time so messages will be sent to nanog(a)lists.nanog.org. Thank you, NANOG Staff *Valerie Wittkop* Program Directorvwittkop(a)nanog.org | +1 734-730-0225 <+17347300225> (mobile) | www.nanog.org NANOG | 305 E. Eisenhower Pkwy, Suite 100 | Ann Arbor, MI 48108, USA ASN 19230

1 0

[NANOG] Re: ISPs in Spain are blocking CDN IP ranges to tackle soccer piracy
by Hank Nussbacher 15 Apr '25

15 Apr '25

On 15/04/2025 8:47, Hank Nussbacher wrote: Italy: https://arstechnica.com/gadgets/2025/03/italian-court-orders-google-to-bloc… Extract: Just last year, Italian ISPs briefly blocked the entire Google Drive domain because someone, somewhere used it to share copyrighted material. This is often called DNS poisoning or spoofing in the context of online attacks, and the outcome is the same if it's being done under legal authority: a DNS record is altered to prevent someone typing a domain name from being routed to the correct IP address. Spain: https://torrentfreak.com/french-court-orders-cloudflare-to-dynamically-bloc… Extract: Interestingly, the blockades may not stop at the 14 domain names mentioned in the original complaint. The ‘dynamic’ order allows SECP to request additional blockades from Cloudflare, if future pirate sites are flagged by French media regulator, ARCOM. Refusal to comply could see Cloudflare incur a €5,000 daily fine per site. “[Cloudflare is ordered to implement] all measures likely to prevent, until the date of the last race in the MotoGP season 2025, currently set for November 16, 2025, access to the sites identified above, as well as to sites not yet identified at the date of the present decision,” the order reads. -Hank >> Hello, Nanog, >> >> This is an ongoing issue that might affect your spanish users if you use >> services like Cloudflare, Vercel, BunnyCDN or GitHub pages. >> >> A couple of weeks ago, the most important ISPs in Spain started >> intercepting or nullrouting IP addresses from this CDN providers. >> >> The reason is that a couple of local court orders allowed LA LIGA (sports >> association responsible for administering the two professional football >> leagues in Spain) to provide ISPs with a list of IP addresses that host >> soccer piracy sites to be taken down in a short period of time, even when >> the football match is taken place. >> >> The issue is that most of this piracy sites use Cloudflare and others to >> protect themselves, so ISPs are nullrouting or intercepting IP ranges that >> serve thousands of websites, including all Cloudflare Free customers (but >> not limited to). For example, they blocked one IP address that served >> ChatGPT. >> >> These blockages are applied when the soccer matches are played and they are >> turned off hours later. >> >> Cloudflare has already taken legal action against this, but the issue is >> still ongoing. >> >> You can find more information about this issue on TorrentFreak (LaLiga >> Blocks Cloudflare Again, New Pirate IPTV Providers & Anything in The Way), >> BandaanchaEU (bandaancha bloqueos del fútbol). >> >> *Regards,* >> *Raúl Martínez* >> _______________________________________________ >> NANOG mailing list >> https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/PCJ6SCD… > >

1 0

[NANOG] Small Capacity UPS
by Mike Hammett 14 Apr '25

14 Apr '25

I'm trying to find something that keeps my customer's network gear online for a meaningful amount of time. The challenge is that an ONT, firewall, switch, AP, and some IP phones doesn't add up to be very much load. Most normal UPSes get terribly inefficient at lower load ratings. Add up all of the network devices a customer may have and we rarely break 50 watts of load. Normal, small UPSes are lucky to break 50% efficiency at those loads whereas they may be 95% efficient at say 100 or 200 watts. Get a bigger unit with a bigger battery and now you're even less efficient. Get a big enough unit to have extendable batteries and now you're spending thousands of dollars for such a small request. I've gone asking, but haven't really gotten anywhere. The best technical solution was from some electronics parts nerds that was basically to build my own small rectifier and battery system. Great. I can achieve high efficiencies with small loads, letting me have say 4 or 8 hours of battery. However, I've got a science project, not something I can deploy at a customer. I'm hoping one of you has the magic bullet in what product a service provider should use in this scenario. Oh, and of course, being able to centrally manage them from my own iron would be great too. :-) ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

30 84

[NANOG] Re: ISPs in Spain are blocking CDN IP ranges to tackle soccer piracy
by Mark Andrews 14 Apr '25

14 Apr '25

Theoretically IPv6 should provide enough addresses that a CDN doesn’t need to share an address between customers . Give each machine a /64 or longer and assign the customer a unique addresses within that prefix. Use the ability of modern kernels to bind to a range of addresses/interface and check the name to address mapping before returning content in addition to checking that it is configured for the name. You can share resources without sharing addresses. -- Mark Andrews > On 15 Apr 2025, at 03:00, Bryan Holloway via NANOG <nanog(a)lists.nanog.org> wrote: > > While we're at it, who needs L3. A flat L2 should suffice. > > >> On 4/14/25 18:00, Constantine A. Murenin via NANOG wrote: >> Here's an idea, why don't we centralise the entire internet behind a >> single network to "solve" the issue of connectivity and availability? >> Oh, wait! Nevermind! /s >> C. >>> On Mon, 14 Apr 2025 at 10:20, Raúl Martínez via NANOG >>> <nanog(a)lists.nanog.org> wrote: >>> Hello, Nanog, >>> This is an ongoing issue that might affect your spanish users if you use >>> services like Cloudflare, Vercel, BunnyCDN or GitHub pages. >>> A couple of weeks ago, the most important ISPs in Spain started >>> intercepting or nullrouting IP addresses from this CDN providers. >>> The reason is that a couple of local court orders allowed LA LIGA (sports >>> association responsible for administering the two professional football >>> leagues in Spain) to provide ISPs with a list of IP addresses that host >>> soccer piracy sites to be taken down in a short period of time, even when >>> the football match is taken place. >>> The issue is that most of this piracy sites use Cloudflare and others to >>> protect themselves, so ISPs are nullrouting or intercepting IP ranges that >>> serve thousands of websites, including all Cloudflare Free customers (but >>> not limited to). For example, they blocked one IP address that served >>> ChatGPT. >>> These blockages are applied when the soccer matches are played and they are >>> turned off hours later. >>> Cloudflare has already taken legal action against this, but the issue is >>> still ongoing. >>> You can find more information about this issue on TorrentFreak (LaLiga >>> Blocks Cloudflare Again, New Pirate IPTV Providers & Anything in The Way), >>> BandaanchaEU (bandaancha bloqueos del fútbol). >>> *Regards,* >>> *Raúl Martínez* >>> _______________________________________________ >>> NANOG mailing list >>> https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/PCJ6SCD… >> _______________________________________________ >> NANOG mailing list >> https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/TPJCY6R… > > _______________________________________________ > NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/CQITXJS…

2 1