- NANOG - lists.nanog.org

Mikrotik RPKI Testing
by Mike Hammett 18 Jun '20

18 Jun '20

I noticed that Mikrotik has added RPKI into their very much beta v7 branch. I would like to ask those of you that know RPKI well to check it out and offer Mikrotik feedback on what they've done right\wrong\broken. Thanks. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

9 12

Hurricane Electric has reached 0 RPKI INVALIDs in our routing table
by Mike Leber 18 Jun '20

18 Jun '20

I'm pleased to announce Hurricane Electric has completed our RPKI INVALID filtering project and we now have 0 RPKI INVALIDs in our routing table. Hurricane Electric has 29021 BGP sessions with 22109 prefix filters with 7191 networks directly and 8239 networks including Internet exchanges. We filter all BGP sessions using prefix filters based on IRR and RPKI. These prefix filters are updated automatically both through a system of daily updates and real time updates to prevent RPKI INVALID routes from being carried in our routing table.

11 18

Re: [c-nsp] Devil's Advocate - Segment Routing, Why?
by Mark Tinka 18 Jun '20

18 Jun '20

On 18/Jun/20 02:32, Phil Bedard wrote: > I look at the basic SR via IGP extensions like VPLS vs. EVPN. If we had a way to go back in history I'm not sure anyone would have said VPLS was a good idea vs. EVPN. > > There were reasons back in the day why something like SR wasn't done. The thought of global MPLS labels scared people and source routing was also evil. So LDP was created to distribute labels hop by hop, while still relying 100% on the IGP to do so. It kind of defies common sense when you look at it now, but there were supposedly good reasons for it back then. > > SR-MPLS on an existing device supporting MPLS forwarding is a control-plane change, meaning almost any device could support SR-MPLS. > > SR is meant to be data plane agnostic, the SID is just an identifier. Most support MPLS, some support IPv6. Fair enough. There's still a whole IGP mess to sort out though, not to mention many years of field experience to bake in. Mark.

1 0

Client-side information gathering tool
by Matt Harris 18 Jun '20

18 Jun '20

Hey folks, I was hoping maybe someone could point me in a useful direction here. I'm looking into software tools (ideally, they'd support Windows, Mac, and Linux, though Windows is perhaps the only critical one) that can be sent over to random users with varying (mostly very little) knowledge of how the internet works to gather a bunch of data that they can then provide to us to help identify connectivity issues between the client and a chosen endpoint. IPv4 and IPv6 support are requirements. I've got a lot of clients with VPN connections of varying sorts running on internet connections of often very low quality, and sometimes even in places where reasonable quality doesn't seem to even exist. Right now, when these users complain, this often means my support folks get to walk them through downloading winmtr and running that as well as other command line tools to gather a bunch of other information about their computer, its connection to their LAN, their LAN configuration as best as we can tell, and their connection to the greater internet. This is somewhat cumbersome of a process though. If we could send them something they could click on and then copy/paste out of or otherwise direct the data to us, that would save a fair bit of time and also be a lot less patience-grating on the part of our clients. Any links to potentially useful tools (commercial or free are both fine) would be appreciated. The main goal is getting lots of relevant information to us without having to walk an end-user through lots of steps to do so. The more relevant data, the better. Thanks, Matt Matt Harris|Infrastructure Lead Engineer 816-256-5446|Direct Looking for something? Helpdesk Portal|Email Support|Billing Portal We build and deliver end-to-end IT solutions.

2 1

Yahoo Email NOC
by Fawcett, Nick 17 Jun '20

17 Jun '20

Could someone from Yahoo email NOC contact me offline. We have been getting complains from our users trying to send to yahoo.com addresses. Email is getting deliverd, but randomly going into the Yahoo users spam folder. Thanks. ~Nick -- Checked by SOPHOS http://www.sophos.com

2 1

Mystery CDN
by Clinton Work 17 Jun '20

17 Jun '20

I'm struggling to determine which CDN owns the servers in CenturyLink prefix 8.240.0.0/12. During the Call of Duty Season 4 update on June 11th from 06:00 UTC until 08:30 UTC, we had 240 Gbps of traffic steaming into our network from CenturyLink prefix 8.240.0.0/12. We originally thought it was Akamai, but they swear up and down that the servers don't belong to them. Here are some of the HTTP/HTTPS servers in 8.240.0.0/12: 8.253.151.248 8.251.135.126 8.240.167.126 8.240.228.126 8.240.168.126 8.240.126.254 8.240.191.254 -- Clinton Work Airdrie, AB

5 4

IPv4 routes spiking from 10PM EST until 8AM EST
by Drew Weaver 17 Jun '20

17 Jun '20

Has anyone noticed over the last week or so that the IPv4 routes appear to be spiking up temporarily every night from about 10PM EST until about 8AM EST? Is that just someone trying to test flipping over other network's TCAMs? Just wondering.

1 0

Re: RPKI race
by Baldur Norddahl 17 Jun '20

17 Jun '20

On Wed, Jun 17, 2020 at 10:07 AM Niels den Otter <niels.denotter(a)surfnet.nl> wrote: > Hello Baldur, > > If you want to validate routes in a VRF you need to configure; > > set routing-options validation notification-rib <rib> > > Have you done so? > > > That was missing from the config. After adding it and running the command "request validation policy" I got the prefixes validated. Thanks for the help. Baldur

3 2

Cogent sales reps who actually respond
by noc＠as37662.com noc＠as37662.com 17 Jun '20

17 Jun '20

Hi fellow network operators, Do any orgs here have experience with a good Cogent rep? The rep we got via Cogent's website is unresponsive to even basic questions. It feels like we are dealing with a bot and copy-pasted replies. Thanks Ruldu

66 146

BGP FLowspec to Yang/Yaml ACL
by Douglas Fischer 17 Jun '20

17 Jun '20

We were looking for some way to implement BGP Flowspec Filtering(just the permit/deny basic) using L3 switches in an automated way. Searching a bit we found https://github.com/ios-xr/bgpfs2acl Is almost what we are looking for! But is focused on Cisco devices. We even considered fork it to our specific vendor. But before reinventing the wheel, I decide to ask to colleagues if anybody knows some tool that converts BGP Flowspec ACLs into YAML or even to YANG. If that exists, with Ansible/Netconf/RestConf(or some similar tool), it would be easy to delegate to Switchs doing the basic filtering that only More expensive Routers can do by now. P.S.: This Idea does not include(on the first moment) more complex features of Flowspec like Redirect ou Rate-Limt. Any suggestions or ideas? -- Douglas Fernando Fischer Engº de Controle e Automação

3 3