- NANOG - lists.nanog.org

Consistent routing policy?
by Ben Logan 17 Sep '19

17 Sep '19

Hello, In reviewing our BGP routing policies last week, I realized that we are advertising our address space upstream in slightly different ways to our two upstream providers. For example, we might advertise a /21 to one provider and break that into two /22s when advertising it to the other. (The reason this was done was to help with traffic engineering--we'd prepend one of the /22s to help balance the traffic. Prepending the entire /21 might have been too much.) I'm just wondering if that's acceptable practice, or if we should advertise consistent prefixes between providers? Thanks, Ben -- <https://img.beta.newoldstamp.com/r/13887/p> Ben Logan Senior Network Engineer | Working Lead Wilkes Communications | RiverStreet Networks Address: 1400 River St Wilkesboro, NC 28697 Email: benlogan(a)myriverstreet.net Phone: 336-973-9075 Mobile: 336-452-8072 wilkes.net <https://www.wilkes.net> myriverstreet.net <https://www.myriverstreet.net> <https://img.beta.newoldstamp.com/r/13833/facebook> <https://img.beta.newoldstamp.com/r/13833/twitter> <https://img.beta.newoldstamp.com/r/13887/youtube> <https://img.beta.newoldstamp.com/r/13833/linkedin> <https://img.beta.newoldstamp.com/r/13833/instagram> This email transmission contains information which may be confidential and/or privileged. The information is intended to be for the use of the individual or entity named on this transmission. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this email information is prohibited. If you have received this email in error, please notify the sender to arrange for retrieval of the original documents. Thank you.

8 13

Security alert aggregator?
by David Hubbard 16 Sep '19

16 Sep '19

Curious if anyone knows of a security alert aggregation service? For example, go and plug in all the various vendors hardware and software packages your enterprise uses, and then the service subscribes to all the random RSS feeds, CVE lists, vendor mailing lists, etc. to feed you the data instead of needing staff to write something custom, and then have checks to ensure the custom thing is still pulling from the right location, etc. Thanks

3 2

Geolocation\VPN Assistance
by Mike Hammett 16 Sep '19

16 Sep '19

I'm building a page that has links and contact information for various IP geolocation services as well as contacts and links at companies that people often have issues with. There used to be a wiki page on CluePon that had some information, but that's been gone a few years. My intent is to direct people there whenever Netflix, Hulu, whatever says that they can't get content due to a country restriction... or a VPN restriction (if they're not using a VPN), etc. Then we don't have to rehash everything every time. BTW: This comes up a lot more often in different circles, more focused on eyeball ISPs. http://thebrotherswisp.com/index.php/geo-and-vpn/ Please provide OFFLIST constructive feedback and additions. Please note the, "This page is very incomplete and poorly organized. With time, hopefully, that gets corrected." ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

2 2

Comcast route server not reflecting their reality
by Will Orton 11 Sep '19

11 Sep '19

I'm seeing odditiies when trying to traffic-engineering my way around an AS 3356-to-7922 performance issue. I buy transit from 3356 and announce my /19 to 3356. I set traffic engineering community 65000:7922 to supress announcement of it from 3356 to 7922. When I do that, at route-server.newyork.ny.ibone.comcast.net I see the AS-path for my /19 change from: 3356 <me> to: 2914 <me> which makes sense as I also have transit from 2914. So that's great, 7922 should be routing to me via 2914 or, any path not via 3356. But then if I go to a customer location on 7922's network, and traceroute to my /19, it still goes via 7922 3356 <me> ! Is 7922's looking glass no longer reflecting actual route selection in their network? Does Comcast do traffic engineering that is not otherwise reflected at their looking glass? If I deaggregate my /19 and announce a /24 from it to 2914, I can draw the inbound traffic to me away from the 7922 3356 path. Which is not a real nice long-term solution... -Will

4 5

Bahamas: Hurricane Dorian recovery status
by Sean Donelan 11 Sep '19

11 Sep '19

Telecommunications and mobile services have been restored in about 90% of the Grand Bahama island area, however network capacity is still limited. Only about 10% of mobile and telecommunication service has been restored on the Abaco island. Over 60% of the housing and buildings on Abaco was destroyed. Four critical communications points have been established on Abaco for relief efforts. BTC and Aliv, the two major mobile providers in the Bahamas, have entered into a free roaming agreement for the next 30 days allowing customers to connect to either working cell towers without roaming charges. The Emergency Telecommunications Cluster partnered CISCO TacOps, Ericsson Response, NetHope, TSF and Vodafone Foundation are providing connectivity for humanitarian responders in four sites: - The Marsh Harbour port and international airport (set up by Ericsson Response, CISCO TacOps and WFP); - Maxwell Supermarket, used as the military EOC (set up by TSF); - A healthcare facility (set up by Vodafone Foundation). Equipment has been provided by the ETS partners on the ground as well as by Eutelsat and Hispasat ‒ and services by Inmarsat ‒ as part of the Crisis Connectivity Charter.

1 0

rr.level3.net on autopilot?
by Jon Lewis 10 Sep '19

10 Sep '19

I was doing some IRR clean-up and after a few successful updates, I'm no longer able to alter or delete our objects in rr.level3.com. Emails to rpsl(a)level3.com result in no action and no response. I've tried reaching out to the Level3 (Centurylink) NOC via email and phone, and can't seem to find anyone who knows what rr.level3.com is, much less knows who to talk to about troubleshooting. Anyone know who (if anyone) keeps the wheels spinning on the Level3 IRR? ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

4 5

Google DNS Oddity
by Chip Marshall 09 Sep '19

09 Sep '19

Hello, I'm seeing an oddity when doing DNS lookups for www.google.com from our London datacenter, and I'm curious if other people are seeing the same behavior. It appears that when we ask for www.google.com. we sometimes get an answer that only contains records for www-anycast.google.com., which our resolver ignores as they don't match the query. As seen with dig: ``` # dig @ns1.google.com. www.google.com. aaaa ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @ns1.google.com. www.google.com. aaaa ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42641 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;www.google.com. IN AAAA ;; ANSWER SECTION: www-anycast.google.com. 300 IN AAAA 2001:4860:4802:34::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:38::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:36::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:32::75 ;; Query time: 7 msec ;; SERVER: 216.239.32.10#53(216.239.32.10) ;; WHEN: Fri Sep 06 19:05:32 UTC 2019 ;; MSG SIZE rcvd: 167 ``` So far I've observed this with A and AAAA queries. It's my understanding that without a CNAME record in the answer, the resolver is doing the right thing by ignoring the answer, as there's no linkage between www and www-anycast. Is this broken, or is this just some weird DNS trick I've not come across before? -- Chip Marshall <chip(a)2bithacker.net>

6 9

Spoofer Report for NANOG for Aug 2019
by CAIDA Spoofer Project 08 Sep '19

08 Sep '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Aug 2019: ASN Name Fixed-By 4 ISI 2019-08-06 6939 HURRICANE 2019-08-10 7922 COMCAST-7922 2019-08-16 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Aug 2019: ASN Name First-Spoofed Last-Spoofed 7029 WINDSTREAM 2016-06-21 2019-08-23 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-08-28 6128 CABLE-NET-1 2016-09-03 2019-08-28 27364 ACS-INTERNET 2016-09-27 2019-08-30 20412 CLARITY-TELECOM 2016-09-30 2019-08-28 6181 FUSE-NET 2016-10-10 2019-08-31 25787 ROWE-NETWORKS 2016-10-21 2019-08-25 32440 LONI 2016-11-03 2019-08-29 12083 WOW-INTERNET 2016-11-09 2019-08-26 39939 RISE-CO-AS39939 2016-11-11 2019-08-27 13427 SOFTCOM-INTERNET-COMMUNICATION 2016-11-14 2019-08-28 9009 M247 2017-01-10 2019-08-26 21832 KELLINCOM-1 2017-02-03 2019-08-21 19624 SERVERROOM 2017-06-02 2019-08-27 63296 AMARILLO-WIRELESS 2017-09-01 2019-08-29 546 PARSONS-PGS-1 2017-11-20 2019-08-23 54540 INCERO 2018-01-15 2019-08-26 12222 AKAMAI 2018-02-14 2019-08-30 4201 ORST 2018-04-19 2019-08-28 11827 WSU 2018-05-07 2019-08-26 393564 SPOKANE 2018-06-05 2019-08-27 225 VIRGINIA 2018-06-18 2019-08-28 33452 RW 2018-09-19 2019-08-29 20448 VPNTRANET-LLC 2018-09-20 2019-08-26 393437 KLAYER 2018-12-21 2019-08-13 63275 RADIOWIRE 2019-02-07 2019-08-14 8047 GCI 2019-04-11 2019-08-30 10745 ARIN-ASH-CHA 2019-04-29 2019-08-29 6058 NORTHWESTEL-INC 2019-05-06 2019-08-07 6536 CITYNET 2019-05-15 2019-08-20 138576 2019-05-21 2019-08-10 33387 DATASHACK 2019-06-06 2019-08-16 16787 CHARTER-16787 2019-06-17 2019-08-26 210 WEST-NET-WEST 2019-08-04 2019-08-04 13760 SOUTHERN-LIGHT 2019-08-13 2019-08-13 32 STANFORD 2019-08-21 2019-08-29 54600 PEGTECHINC 2019-08-28 2019-08-28 26658 HENGTONG-IDC-LLC 2019-08-30 2019-08-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

IPAM recommendations
by Mehmet Akcin 08 Sep '19

08 Sep '19

Looking for IPAM recommendations, preferably open source, API is a plus (almost must, almost..). 40-50K IPs to be managed. thanks in advance.

17 23

Re: Art and Tech is madness
by Scott Weeks 07 Sep '19

07 Sep '19

--- cboyd(a)gizmopartners.com wrote: From: Chris Boyd <cboyd(a)gizmopartners.com> There’s also this gem from 2005 or 2007 days. I’ve heard Cisco staff was involved in its creation. http://www.mattzrelak.com/mp3/t1down.htm ------------------------------ At work... ====================================== This site is blocked due to a security threat. www.mattzrelak.com This site is blocked due to a security threat that was discovered by the Cisco Umbrella security researchers. Report an incorrect block ===================================== scott

2 1