- NANOG - lists.nanog.org

FCC Report on 2019 Nationwide Emergency Alert Test
by Sean Donelan 12 May '20

12 May '20

FCC published its 2019 nationwide EAS test report. The issues haven't changed, and some improved. "With respect to the single largest complication reported from the 2019 nationwide EAS test results – namely, issues with monitoring source failures – FEMA notes that it is actively taking measures to improve PEP performance going forward. In particular, FEMA has begun working with SECCs in several states to conduct state-level tests on a monthly basis and station-level tests on a weekly basis through the PEP stations. FEMA emphasizes that continued testing of the PEP stations will improve EAS performance over time, as this testing will help ensure the PEP stations are relaying messages properly through the EAS and allow stakeholders to make ongoing improvements and adjustments as needed." FCC's Public Safety and Homeland Security Bureau issues a report on the August 7, 2019 nationwide Emergency Alert System test https://www.fcc.gov/document/fcc-report-2019-nationwide-emergency-alert-test

1 0

An appeal for more bandwidth to the Internet Archive
by Jared Brown 12 May '20

12 May '20

Hello all! Last week the Internet Archive upgraded their bandwidth 30% from 47 Gbps to 62 Gbps. It was all gobbled up immediately. There's a lovely solid green graph showing how usage grows vertically as each interface comes online until it too is 100% saturated. Looking at the graph legend you can see that their usage for the past 24 hours averages 49.76G on their 50G of transport. To see the pretty pictures follow the below link: https://blog.archive.org/2020/05/11/thank-you-for-helping-us-increase-our-b… Relevant parts from the blog post: "A year ago, usage was 30Gbits/sec. At the beginning of this year, we were at 40Gbits/sec, and we were handling it. ... Then Covid-19 hit and demand rocketed to 50Gbits/sec and overran our network infrastructure’s ability to handle it. So much so, our network statistics probes had difficulty collecting data (hence the white spots in the graphs). We bought a second router with new line cards, and got it installed and running (and none of this is easy during a pandemic), and increased our capacity from 47Gbits/sec peak to 62Gbits/sec peak. And we are handling it better, but it is still consumed." It is obvious that the Internet Archive needs more bandwidth to power the Wayback machine and to fulfill its mission of being the Internet library and the historic archive of our times. The Internet Archive is present at Digital Realty SFO (200 Paul) and a member of the San Francisco Metropolitan Internet Exchange (SFMIX). I appeal to all list members present or capable of getting to these facilities to peer with and/or donate bandwidth to the Internet Archive. I appeal to all vendors and others with equipment that they can donate to the Internet Archive to contact them so that they can scale their services and sustain their growth. The Internet Archive is currently running 10G equipment. If you can help them gain 100G connectivity, 100G routing, 100G switching and/or 100G DWDM capabilities, please reach out to them. They have the infrastructure and dark fiber to transition to 100G, but lack the equipment. You can find the Internet Archive's contact information below or you can contact Jonah at the Archive Org directly either by email or via the contact information available on his Twitter profile @jonahedwards. You can also donate at https://archive.org/donate/ The Internet Archive is a 501(c)(3) non-profit. Donations are tax-deductible. Contact information: https://archive.org/about/contact.php Volunteering: https://archive.org/about/volunteerpositions.php Disclaimer: I am not affiliated with the Internet Archive. Nobody asked me to write this post. If something angers you about this post, be angry at me. I merely think that the Internet Archive is a good thing and deserves our support. Jared

7 7

Alternative for Google Safe Browsing for Network Administrators?
by David Hubbard 12 May '20

12 May '20

Just received notice that Google is eliminating the Safe Browsing for Network Administrators service…. in favor of a new paid alternative; imagine that. Are there recommended similar services out there that will send netblock owners alerts related to suspected compromised websites, malware distribution, C&C, etc. activity? Thanks

2 1

looking for operator validation for regexes that extract ASNs
by Matthew Luckie 11 May '20

11 May '20

Hi NANOG To support Internet topology analysis efforts, we have been working on an algorithm to detect AS numbers inside hostnames (PTR records) for router interfaces, and automatically build regular expressions (regexes) to extract them. Specifically, we are looking at operators who embed the ASN of their neighbor in the hostname when they provide the IP address to the neighbor for interconnection. For example, suppose we had the following three hostnames in the gtt.net domain suffix, which we believed to be assigned to routers operated by ASes 1215, 1273, and 10835 as1215.xe-7-0-6.ar2.sjc1.us.as4436.gtt.net as1273.hkg11.ip4.gtt.net as10835.cr3-sea2.ip4.gtt.net We might infer the regex ^as(\d+)\..+\.gtt\.net$ extracts these ASNs and reflects GTT practice to name these IP addresses they assigned to neighbors with the ASN that operates the router. We're at the stage where we are asking for broader feedback from operators. The webpage at https://www.caida.org/~mjl/rnc/asn/ shows the inferences our algorithm made for 219 domains. If you operate one of the domains in that list, we would appreciate it if you could comment (private is probably better but public is fine with me) on whether the regex our algorithm inferred represents your naming intent. In the first instance, we are most interested in feedback for the suffix / date combinations for suffixes that are colored green or orange, i.e. appear to be reasonable. Each suffix / date combination links to a page that contains the naming convention and corresponding inferences. The colored part of each hostname is the ASN extracted by the regex. The green hostnames appear to be correct, at least as far as the algorithm determined. Some suffixes have errors due to either stale hostnames or incorrect training data, and those hostnames are colored red. We'd appreciate particular feedback for the red hostnames -- was the hostname stale, or the training data incorrect? Thanks, Matthew

2 2

finishline.com
by Bryan Holloway 11 May '20

11 May '20

If anyone from finishline.com is lurking, could you please reach out to me off-line? Our AS seems to be blocked to your web-site as a whole, which appears to be hosted by Akamai. However, the curious thing is that we see this behavior from other IPs not part of our AS, so it's difficult to tell if it's just us, Akamai, or something more systemic. E-mails to various contacts are going unanswered. Thank you!

1 0

NORAD no-fail mission - Cheyenne Mountain complex re-activated
by Sean Donelan 10 May '20

10 May '20

In 2008, NORAD changed its Cheyenne Mount Complex to a backup command center. NORAD's day-to-day early warning mission was moved to Peterson Air Force Base. The Cheyeene Mount Complex was kept ready as a 'warm backup' and skeleton maintenance and training crews. In late February 2020, NORAD split its operation staff into two watch centers and re-activated the Cheyenne Mountain Complex. Crews do not physically interact with the other watch crews to minimize an infection impacting both command centers. When off-duty, they stay in separate quarters in distant areas on Peterson AFB. https://www.stripes.com/news/air-force/to-protect-no-fail-mission-norad-mil… Of course, not everyone has a mountain lair on standby. I've also heard some electric grid operators made similar staffing changes. The ISO operation staff is split into seperate crews, which physically isolate on and off-duty during their 7 or 14-day watches.

1 0

Throughput issues on Wave G/CondoInternet (Redmond, WA)
by Neel Chauhan 10 May '20

10 May '20

Hi NANOG mailing list, I have Wave G "Gigabit" service in Redmond, WA, and download speeds have been slow. Wave G is Wave Broadband's MDU-focused Gigabit offering, and was formerly CondoInternet, although I joined only this year on a Wave G-branded service. To Seattle, I cap at about 600-750 Mbps download while I get 900 Mbps uploads. To servers far away, it does gown to 10-30 Mbps while I can upload at 200-500 Mbps. The downloads speeds are far lower than what's normal from TCP (I **do** know higher latency == slower downloads). The issue appears to be the window size being smaller on downloads on the routers on Wave G's side and that limits download throughput. This is a Wireshark screenshot of a download test: https://i.imgur.com/2gXbNSZ.png The green line is the window size, and the blue line is the outstanding bytes. In comparison, this is a Wireshark screenshot of an upload test: https://i.imgur.com/WOGvpWx.png The download test shows a small window size and spikes in the outstanding bytes and this gets reset very often after the first increase instead of gradually using the pipe's full capacity and then resetting, showing the window size can't get higher. The upload test shows a larger window size and a sawtooth shape of the outstanding bytes which is what should normally happen. This happens on both FreeBSD 13-CURRENT and Windows 10, both hardwired and Wi-Fi. My work Windows 10 PC via RDP and personal FreeBSD VPS servers have no issues whatsoever to the same exact servers, both being in the Seattle metro. "Tech Support" hasn't been helpful since they insist on a tech visit which I believe isn't needed ("Wave G" isn't Wave's DOCSIS offering, no HFC issues here), or blame the issue on something outside their network (these issues **don't** exist outside Wave G). Ziply/Frontier and CenturyLink aren't available here, and why would I go to Comcast's overpriced, asymmetrical, capped garbage? If someone works for Wave Broadband, or more specifically on the Wave G service, please shoot me an private email so we can get this resolved (and I can share my service details and pcap file if necessary in the said private email). -Neel Chauhan === https://www.neelc.org/

1 0

Re: alternative to voip gateways
by Clayton Zekelman 10 May '20

10 May '20

When we do DSL, we service everything out of ADSL2+ combo cards on Zhone MXK gear. -Integrated metallic testing on the combo cards helps reduce truck rolls -Having dialtone on the pair helps with identifying pairs in the field using ANAC -Having dialtone on a pair provides sealing current -Having dialtone on a pair stops other techs from "stealing" the pair for something else, because they think it isn't in use -Derived voice (VoIP on CPE) makes the voice more subject to line impairments, etc. At peak we had around 6000 leased CLEC copper pairs from the local ILEC. Just notes from personal experience. At 12:54 PM 10/05/2020, Baldur Norddahl wrote: >On Sun, May 10, 2020 at 4:16 PM Mike Hammett ><<mailto:nanog@ics-il.net>nanog(a)ics-il.net> wrote: >If POTS last mile is available, why complicate it with VoIP? > > >Because it is cheaper and easier? It is a lot of >equipment there simply does not need to be >there. If you have DSL you have CPE equipment >and that CPE equipment can have FXP out for very >little extra. You also save having filters to separateÂ DSL and voice. > >In any case, even the ILEC here is dropping >analog and delivering phone services via VoIP >and FXP out on the CPE. I believe because the >technicianÂ only needs to go to the DSLAM to >connect you. If you are also getting analog >voice, he needs to go to the CO too because >voice and DSLAM are no longer cohosted. > >Regards, > >Baldur -- Clayton Zekelman Managed Network Systems Inc. (MNSi) 3363 Tecumseh Rd. E Windsor, Ontario N8W 1H4 tel. 519-985-8410 fax. 519-985-8409

1 0

anyone on from hotmail.com, msn.com, live.com smtp?
by Joseph Jenkins 10 May '20

10 May '20

We are getting this messages when sending emails from our domain. We've submitted tickets, but haven't received a response yet. Anyone have any insights? 550 5.7.1 Unfortunately, messages from [1.1.1.1] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3140). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. [ AM5EUR03FT014.eop-EUR03.prod.protection.outlook.com] It's our own address and everything on the Microsoft site says we are clean with no issues.

3 3

Re: anyone on from hotmail.com, msn.com, live.com smtp?
by Terrence Koeman 09 May '20

09 May '20

Hi Joseph, I've had the same issue that started a year ago. Eventually they removed the subnet, but it was blocked again a week later. It seems to me they import a third party block list containing my subnet, which re-blocks it shortly after removal, and they won't whitelist. They wouldn't tell me the source (nor the reason). I've repeated the remove/block cycle a few times and then just gave up and renumbered my mail servers. They don't seem to care. At all. Your mileage may vary though. If you do get to a solution I'd appreciate hearing about it :) Good luck! -- Regards, Terrence Koeman, PhD/MTh/BPsy Darkness Reigns (Holding) B.V. Please quote relevant replies. Spelling errors courtesy of my 'smart'phone. ________________________________ From: Joseph Jenkins <joe(a)breathe-underwater.com> Sent: Saturday, 9 May 2020 04:36 To: NANOG Subject: anyone on from hotmail.com, msn.com, live.com smtp? > We are getting this messages when sending emails from our domain. We've > submitted tickets, but haven't received a response yet. Anyone have any > insights? > > 550 5.7.1 Unfortunately, messages from [1.1.1.1] weren't sent. Please > contact your Internet service provider since part of their network is on > our block list (S3140). You can also refer your provider to > http://mail.live.com/mail/troubleshooting.aspx#errors. [ > AM5EUR03FT014.eop-EUR03.prod.protection.outlook.com] > > It's our own address and everything on the Microsoft site says we are clean > with no issues.

1 0