- NANOG - lists.nanog.org

fuzzy subnet aggregation
by Joe Maimon 29 Oct '19

29 Oct '19

Does anyone have or seen any such tool? I have a script that seems to work, but its terribly slow. Currently I can produce aggregated subnets that can be mising up to a specified number of individual addresses. Which can be fed back in for multiple passes. Doing RTBH on individual /32 does not scale well, if you are eyeing collaboration with external lists. I have found likely sources that could produce another 100k prefixes easily. Joe

8 13

SP 800-189 (Draft), Resilient Interdomain Traffic Exchange
by Montgomery, Douglas C. (Fed) 28 Oct '19

28 Oct '19

https://csrc.nist.gov/publications/detail/sp/800-189/draft / This document provides technical guidance and recommendations for technologies that improve the security and robustness of interdomain traffic exchange. Technologies recommended in this document for securing the interdomain routing control traffic include Resource Public Key Infrastructure (RPKI), BGP origin validation (BGP-OV), and prefix filtering. Additionally, technologies recommended for mitigating DoS and DDoS attacks include prevention of IP address spoofing using source address validation with access control lists (ACLs) and unicast Reverse Path Forwarding (uRPF). Other technologies such as remotely triggered black hole (RTBH) filtering, flow specification (Flowspec), and response rate limiting (RRL) are also recommended as part of the overall security mechanisms. dougm -- Doug Montgomery, Manager Internet & Scalable Systems Research @ NIST

2 2

Unable to email anyone from my primary domain name; thanks Google Mail and G Suite.
by Constantine A. Murenin 28 Oct '19

28 Oct '19

Dear NANOG@, I'm not sure where else to post this, and this is not really new, either, but I think I have a new take here. I use my own personal domain name for various UNIX stuff, including sending log-related things to myself out of cron, which end up in my own Gmail.com account, either directly, or through forwarding (w/o SRS). (I do not use G Suite for my own domain name, for obvious reasons; just the consumer-based gmail.com email address from the old times of invitation-based registrations.) Over the years, I sometimes had certain messages rejected by Gmail, but it was a very low rate of rejection (less than 5% for any mail I cared about), and wasn't a major problem (usually only some automated messages would be rejected). A couple of months ago, I setup some new scripts that would send me new nightly emails. It's all plain text, but had a few dozen of domain names present (it's logs). Absolutely no links, just plenty of domains which I don't control. So, Gmail has been presenting most of these messages with their red warning label that the email contains malicious links, even though all of these emails contained zero links, zero URLs to any of these unknown domain names, zero URL schemes, zero "http://", zero "https://" etc. You get the idea. Since about a few weeks ago, I am now seeing at least a 95% rejection rate for my domain name, for ALL email, including the forwards. Including emails which I send to myself from within Google, and which get forwarded back to Gmail by my UNIX machine (which is not known to break Gmail's DKIM, either, although it's also difficult to test, because when it does get through, it's automatically marked as a duplicate by Gmail, so, you don't get DKIM status from Gmail by looking at the headers, since you only get to examine the original copy that was sent, not the forwarded duplicate that was subsequently accepted). I.e., emails with a passing DMARC still get rejected. The funny thing is, Google doesn't actually blacklist my primary IPv6 address in my own /48 from which all of my messages originate; even though the rDNS resolves to a subdomain on the very same domain name which they've blacklisted "due to the very low reputation". They've blacklisted just the main domain name that I use for my own non-Gmail-hosted mail. Sending the same messages into my Gmail.com from a different domain name in MAIL FROM, which is served from the same zone file DNS-wise (e.g., an SPF pass), through sendmail's `-f` option, or with Mutt, makes the messages go through (even with rDNS being "low reputation"); sending it from my primary domain name in MAIL FROM results in the following: >>> DATA <<< 550-5.7.1 [2001:470:xxxx:: 19] Our system has detected that this message is <<< 550-5.7.1 likely suspicious due to the very low reputation of the sending <<< 550-5.7.1 domain. To best protect our users from spam, the message has been <<< 550-5.7.1 blocked. Please visit <<< 550 5.7.1 https://support.google.com/mail/answer/188131 for more information. 135si403977wma.43 - gsmtp 554 5.0.0 Service unavailable The support article suggests using Postmaster Tools; great, never heard of it, sounds cool; let's verify our domain, and try it out, hopefully, there's a solution right there. However, after verifying my domain name through DNS for Postmaster Tools, it is revealed that Postmaster Tools cannot tell me anything at all, with all tabs and screens being 100% blank, allegedly because I'm not actually a mass email sender (I don't send hundreds of emails a day or whatnot), and they're too afraid that I'll figure out why my mail doesn't actually go through, instead of signing up for G Suite. Right now, I've had a business need to reply to a work-related email from some other business. This is what I got after sending my reply from my primary domain name through mutt — a nice double rejection by both the G Suite and Gmail in a single bounce generated by my server: ----- Transcript of session follows ----- ... while talking to aspmx.l.google.com.: >>> DATA <<< 550-5.7.1 [2001:470:xxxx:: 19] Our system has detected that this message is <<< 550-5.7.1 likely suspicious due to the very low reputation of the sending <<< 550-5.7.1 domain. To best protect our users from spam, the message has been <<< 550-5.7.1 blocked. Please visit <<< 550 5.7.1 https://support.google.com/mail/answer/188131 for more information. z11si12494671wrw.137 - gsmtp 554 5.0.0 Service unavailable ... while talking to gmail-smtp-in.l.google.com.: >>> DATA <<< 550-5.7.1 [2001:470:xxxx:: 19] Our system has detected that this message is <<< 550-5.7.1 likely suspicious due to the very low reputation of the sending <<< 550-5.7.1 domain. To best protect our users from spam, the message has been <<< 550-5.7.1 blocked. Please visit <<< 550 5.7.1 https://support.google.com/mail/answer/188131 for more information. 135si403977wma.43 - gsmtp 554 5.0.0 Service unavailable Changing MAIL FROM into a non-primary domain name (served out of an identical zone file, basically) gets the message accepted, without DKIM, without the 4-minute delay that many "suspicious" messages have had for months now, from the very same IPv6 address with the rDNS pointing to the domain name with "the very low reputation", and it shows up in both my own Gmail as well as, presumably, in the G Suite account of the business partner I was replying to. (Note that this trick where the rDNS domain gets ignored works only for new emails with a passing SPF; I presume the rDNS still prevails in bringing the "low reputation of the sending domain" for forwards, as they don't seem to succeed any longer now.) There are a number of possible tl;dr: takeaways here: * don't spread the monoculture — don't use G Suite for your organisation; * don't send crontab output to your Gmail from your primary domain name; * don't use Gmail. What is my own takeaway here? * Without being an anti-Google zealot, from a purely practical perspective, since my Gmail account no longer contains the mail I care most about, as it gets rejected on the SMTP layer, I'll have fewer reasons to use it. * I'll now have no other choice but to modify my setup to stop forwarding to Gmail, because my business contacts don't need to see all these bounces that are now taking place. * Since so many businesses are G Suite useds, I'm still looking for a solution to get rid of the "the very low reputation of the sending domain" from a domain name I've been using since 2007, and which I'm 100% convinced was blacklisted by Google entirely for me sending crontab with system logs (zero HTML, zero URLs) to my own Gmail. I have SPF and DMARC all setup and passing since years ago, which doesn't stop this issue from occurring. Merely switching the name of the domain in From and MAIL FROM to any other domain I own (which points to the very same MX) appears to be my workaround for now. Some possible suggestions for Google, if I may: * Maybe don't convert schemeless domain names which are non-URLs into "malicious" URLs? (They already do seem to block them from being presented as links in the UI in such an instance, but there's little reason for trying to convert these domain names into links in the first place.) * Maybe don't consider harmless plain text emails with a bunch of domain names to contain malicious links when they don't? * Maybe don't assume everyone with a domain name runs a G Suite? (Their whole troubleshooting guide is built around it.) * Maybe don't assume everyone with a domain name sends hundreds of emails from their domain name per day? (They seem to limit Postmaster Tools based on such a criterion.) * Maybe don't blacklist a domain name for sending harmless logs to a Gmail account that lists said domain name as an alternative From address? Cheers, Constantine.

14 18

IPv4 and Auctions
by Matt Hoppes 28 Oct '19

28 Oct '19

A thought crossed my mind the other day as I was having a discussion with someone. Every entity is suppose to justify their need for IPv4 address space from ARIN. This was always (in recent history) the case. No entity is suppose to be given more IPv4 space until they have nearly exhausted their previous space. How is it, then, that we daily for the last 2-3 years have places like Hilco that have sometimes 15-20 large IPv4 blocks up for auction? Supposedly we are completely out of IPv4 space, yet every day large blocks are being sold for money, yet they were never returned because they weren’t needed. Another thought: being that IPv4 address space is essentially leased to you from ARIN, can you even legally auction your space to someone else? I know it’s happening, but it would almost be like me auctioning my apartment to another random person.

14 20

California network infrastructure report (FCC)
by Sean Donelan 28 Oct '19

28 Oct '19

According to reporting to the FCC: https://www.fcc.gov/document/ca-power-shutoff-communications-status-report-… Cell sites out of service: overall 2.4% (630 out of 25,893) Marin County: 49.6% out of service (105 out of 270) Lake County: 19.3% out of service (11 out of 57) Calaveras County: 18.6% out of service (8 out of 43) Sonoma County: 17.1% out of service (73 out of 427) Santa Cruz County: 16.4% out of service (35 out of 213) Cable and Wireline systems (combined) 393,735 subscribers out of service. Only Outside Plant and Hub locations. Likely does not include loss of Customer Premise Equipment (CPE) power. Broadcast 4 FM radio stations out of service, 2 FM stations with programming sent to another station.

2 1

U.S. Senate: READI Act 2019 re-introducted
by Sean Donelan 28 Oct '19

28 Oct '19

U.S. Senators Brian Schatz (D-Hawaii) and John Thune (R-S.D.) reintroduced the Reliable Emergency Alert Distribution Improvement (READI) Act today (October 24, 2019). The READI Act would: [...] Explore establishing a system to offer emergency alerts to audio and video online streaming services, such as Netflix and Spotify; [...] The READI Act is support by NCTA – The Internet and Television Association, the National Association of Broadcasters (NAB), the Internet Association, CTIA – The Wireless Association, and the Wireless Infrastructure Association. Due to its bi-partisan co-sponsors and industry support, this bill is likely to pass. As I've stated before, I think network emergency alerts should be built into the underlying smart assistant layer (i.e. apple siri, amazon echo/fire, roku, google/nest home, etc.) instead of each content provider or internet provider.

4 11

Re: Couple of questions about "baremetal/ONIE" networking equipment sellers
by Nick ten Cate 27 Oct '19

27 Oct '19

Hi Mike/Drew, We also have lots of experience with FS.com switches; however.. One thing we noticed really quick is that its better to order 1 and to find the actual supplier and order with them directly. FS.com is a reseller; and they will switch (no pun intended) supplier almost yearly. Real technical support is nonexistent (even though they claim it is great) and I have yet to have a single bug fixed; packet dumps and steps to reproduce included. I have removed all of our *N*5850-48S6Q due to bugs in software lockups. Their current *S*5850-48S6Q is developed by Centec Neworks ( http://www.centecnetworks.com/en/SolutionList.asp?ID=91 ) and is the E580-48X6Q (compare the changelog and manual; you will see its a "replace all" job). These switches do actually support LDP/MPLS/VPLS if you buy the license and run them in their 'ipran' profile. Feel free to contact me off list if you have any questions. Kind regards, Nick ten Cate >> Date: Fri, 25 Oct 2019 09:25:24 -0700 >> From: Mike <mike-nanog(a)tiedyenetworks.com> >> To: nanog(a)nanog.org >> Subject: Re: Couple of questions about "baremetal/ONIE" networking >> equipment sellers >> Message-ID: <1f380ffc-ae44-3346-5db3-bf38d290a326(a)tiedyenetworks.com> >> Content-Type: text/plain; charset="windows-1252" >> >> On 10/25/19 9:13 AM, Drew Weaver wrote: >> > >> > Hello, >> > >> > >> > >> > 1. I was reading about Cumulus and came across a note about >> > bm-switch.com, does anyone have any experience purchasing switches >> > from bm-switch.com? What was your experience like? >> > 2. Same question about hardware from FS.com any problems there? >> > >> > Thanks! >> > >> > -Drew >> > >> >> I have some experience with FS.com - I have the S5850-48S6Q >> (https://www.fs.com/products/29123.html) and it does the job. Advanced >> features like MPLS and such are not available, but for the money I'm >> quite happy. >> >>

2 1

New Alaskan Network
by Rod Beck 25 Oct '19

25 Oct '19

Unusual in that it will traverse Canada to reach the lower 48. https://www.theverge.com/2019/5/1/18525866/alaska-fiber-optic-network-cable… [https://cdn.vox-cdn.com/thumbor/0w80DQVzjT8MXT05t-SSNgXP7uA=/0x78:1100x654/…]<https://www.theverge.com/2019/5/1/18525866/alaska-fiber-optic-network-cable…> Alaska will connect to the rest of the US via a 100-terabit fiber optic network - The Verge<https://www.theverge.com/2019/5/1/18525866/alaska-fiber-optic-network-cable…> MTA Fiber Holdings announced today that it would build the "first and only all-terrestrial" fiber optic network running from Alaska and into the Lower 48. The line will begin in North Pole, Alaska ... www.theverge.com Roderick Beck VP of Business Development United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-70-605-5144 [1467221477350_image005.png]

3 3

Fiber Builds
by Rod Beck 25 Oct '19

25 Oct '19

https://www.lightwaveonline.com/network-design/high-speed-networks/article/… [https://img.lightwaveonline.com/files/base/ebm/lw/image/2019/07/LWcenturyli…]<https://www.lightwaveonline.com/network-design/high-speed-networks/article/…> CenturyLink adding 4.7 million fiber miles to U.S., European fiber-optic networks | Lightwave - lightwaveonline.com<https://www.lightwaveonline.com/network-design/high-speed-networks/article/…> CenturyLink, Inc. (NYSE: CTL) says it has completed the first of a two-phase build out that will see its fiber-optic networks in the U.S. and Europe grow by 4.7 million fiber miles. www.lightwaveonline.com Roderick Beck VP of Business Development United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-70-605-5144 [1467221477350_image005.png]

1 0

Facebook the Wholesale Fiber Provider
by Rod Beck 25 Oct '19

25 Oct '19

https://engineering.fb.com/connectivity/fiber-optic-cable/ [https://engineering.fb.com/wp-content/uploads/2019/02/fiberbuild.jpg]<https://engineering.fb.com/connectivity/fiber-optic-cable/> Building network infrastructure with fiber-optic cable - Facebook Engineering<https://engineering.fb.com/connectivity/fiber-optic-cable/> As we bring more data centers online, we will continue to partner and invest in core backbone network infrastructure. We take a pragmatic approach to investing in network infrastructure and utilize whatever method is most efficient for the task at hand. engineering.fb.com Roderick Beck VP of Business Development United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-70-605-5144 [1467221477350_image005.png]

1 0