- NANOG - lists.nanog.org

Re: Incoming SSDP UDP 1900 filtering
by Patrick McEvilly 11 Apr '19

11 Apr '19

I'm working with Level3 on a similar problem. They filter both UDP and TCP port 1900 on our peer to them. This is blocking all connections that randomly use ephemeral tcp port 1900. They are refusing to remove the tcp port 1900 filter without dispensation from the DDoS security gods. I understand blocking UDP 1900, what is the purpose of Level3 filtering tcp port 1900? On 3/25/19, 12:44 PM, "NANOG on behalf of Saku Ytti" <nanog-bounces(a)nanog.org on behalf of saku(a)ytti.fi> wrote: Hey Tom, > If your edge ingress ACLs are not 100% in sync all the time, you will inevitably have Really Weird Stuff happen that will end up taking forever to diagnose. You may at some cases have hard to troubleshoot issues, which is true for everything, even when perfectly configured, because software is not perfect. However choosing to do iACL is still something many networks choose to do, because the upside is worth the complexity to them. > Packet filtering is more computationally taxing than just routing is. Your edge equipment is likely going to be built for maximum routing efficiency. Trying to bite off too much filtering there increases your risk of legit traffic being tossed on the floor. Depends on implementation, on some implementations it is zero-cost on some it is not. On most implementations it's very cheap, particularly compared to say uRPF. It seems your position is 'i don't know how ACL works on my platforms and i don't trust myself to write ACL, so i should not do them', which is perfectly valid position under those constrains, but other networks have other constrains under which it is no longer valid proposal to omit doing iACL. I would encourage networks to continue deploying iACL and consider it BCP. iACL removes attack surface and protects you from host of known and unknown SIRT issues. -- ++ytti

4 4

Multi-tenant Internet Access
by Steve Danello 11 Apr '19

11 Apr '19

Hello all; forwarding a question from a couple folks I know that are having issues with Comcast internet access at a seasonal resort on the East Coast. Does anyone know how multi tenant access works? It appears that something has been put in place that prevents cable modems from syncing and actually going ‘online’. The technicians have mentioned MDTA’s and Q2Q’s which are probably in the path; but can someone provide a brief explanation of how it works? There are somewhere on the order of 500+ tenants at the facility in question; they used to be able to get internet service over the same cabling where they were provided about 60+ standard def channels. Any guidance appreciated. Best; Steve

1 0

Netgate TNSR software router using DPDK/VPP/FRR
by nanog-isp＠mail.com 11 Apr '19

11 Apr '19

Hello NANOG, Has anybody kicked the tires of Netgate's TNSR software router that uses DPDK/VPP/FRR and would like to share their experience? Jared

1 0

Facebook (account)
by Nathan Anderson 10 Apr '19

10 Apr '19

Fellow NetOps, I realize this is an unorthodox / off-topic request, but I've been trying to help a friend out and don't know how to advise her next. If there is someone from FB here who has connections to someone in account security and is willing to contact me off-list, I'd really appreciate it. A friend had her FB account of many years hijacked and then held for ransom by a random dude. When she asked FB to intercede, she appeared to have her account back for a short time (< 24 hrs) before FB themselves blocked the account, and that's where we are now. It's been over 2 weeks and she has been going round and round with "CS" and getting nowhere...whoever these robots are keep repeating requests for her to send in ID, which she does, and then they repeat the request again and it just goes in a circle. I have a feeling that I know what's going on behind-the-scenes, but we can't seem to get a living, breathing human over there who isn't just reading a script to actually listen to her. Seriously, what is the average person supposed to do under these circumstances? If this was just the story of a lone FB account I'm not sure I would bother and I'd just tell her to get a new one. But she runs a business (popular local coffee shop) with a FB page that this account of hers was apparently the only admin for. Thanks in advance for any leads, -- Nathan Anderson First Step Internet, LLC nathana(a)fsr.com

5 5

residential/smb internet access in 2019 - help?
by david raistrick 10 Apr '19

10 Apr '19

folks, I've been away from nanog for a long time - and away from the ISP world for longer. Looking at a house in a new area, at&t copper splice box out front, bellsouth fiber markers as well (yes, that's usually just passing by. but it's there). Owners since '82 said the telephone company was AT&T - but the New AT&T apparently no longer offers phone or internet service there. This is located in a semi-rural area between Ocala and Gainesville Florida (Micanopy, specifically). I knew the state of residential service was in sorry shape - but from what I'm reading, it seems to be worse than I'd though possible. Anyone have any suggestions for service options? I'm cool with dark fiber, if it comes down to that (and can be price sanely and terminated somewhere useful), but it seems like there -should- still be CLEC/DLECs or just plain resellers in business who still have access to resources that are in the ground. My business operates from home - so obviously quality service is a priority, and I'm willing to pay for it within reason. Business plans are certainly an option as well. I've confirmed with all of the known players via their front channels - att, windstream, centurylink, frontier, cox/comcast/spectre. Via backchannels I've confirmed that cox has fiber in the ground 1.4 miles away - straight shot down a dirt road (same one with the BS fiber markers). I have a lead on a couple of tower shots - but there's a big (for florida) ridge between us, and I might have to build 3-400ft to hit anything (speculatively). Anyone have local area or other knowledge that might be helpful? I'd hate to miss out on this house - it's a lot of things we love - but cell or sat only for internet access just isn't going to fly. thanks guys. ...david

14 21

RPKI Route Origin Validation - Africa
by Ben Maddison 09 Apr '19

09 Apr '19

Hello all. In November 2018 during the ZAPF (South African Peering Forum) meeting in Cape Town, 3 major African ISP's announced that they would enable RPKI-based ROV (Route Origin Validation), including dropping Invalid routes as part of efforts to improve Internet routing security, on the 1st April, 2019. On the 1st of April, Workonline Communications (AS37271) enabled ROV and began dropping Invalid routes. This applies to all eBGP sessions, both IPv4 and IPv6. On the 5th of April, SEACOM (AS37100) enabled ROV and began dropping Invalid routes. This applies to eBGP sessions with public peers, private peers and transit providers, both for IPv4 and IPv6. eBGP sessions toward downstream customers will follow in 3 months time. Implementation at the third ISP has yet to be completed. We are sure they will communicate with the community when they are ready to do so. Please note that for the legal reasons previously discussed in various fora, neither Workonline nor SEACOM are utilising the ARIN TAL. As a result, any routes covered only by a ROA issued under the ARIN TAL will fall back to a status of Not Found. Unfortunately, this means that ARIN members will not see any improved routing security for their prefixes on our networks until this is resolved. We will each re-evaluate this decision if and when ARIN's policy changes. We are hopeful that this will happen sooner rather than later. If you interconnect with either of us and believe that you are experiencing any routing issues potentially related to this new policy, please feel free to reach out to either: - noc(a)workonline.africa - peering(a)seacom.mu Workonline Communications and SEACOM hope that this move encourages the rest of the ISP community around the world to ramp up their deployment of RPKI ROV and begin dropping Invalid routes. We appreciate the work that AT&T and others have carried out in the same vein. In the mean time, we are happy to answer any questions you may have about our deployments. Thanks, Mark Tinka (SEACOM) & Ben Maddison (Workonline Communications).

1 0

IIJ demonstrating emergency information for broadband and smart TVs
by Sean Donelan 09 Apr '19

09 Apr '19

Internet Initiative Japan (IIJ) and T-NET Japan are demonstrating a hybrid integration of emergency alerts for broadcasting and broadband smart TVs at this week's National Association of Broadcasters convention. A consortium of Korean broadcasters and manufacturers is also demonstrating UHD. In addition to the gorgeous video, the Korean UHD consortium has a very nice emergency alert demostration. Korea and Japan seem to be the leaders. The U.S. smart assistant companies (Amazon and Google) have very large booths on the NAB show floor, but their products don't have emergency alerts.

1 0

Amazon AS16509 peering... how long to wait?
by John Von Essen 08 Apr '19

08 Apr '19

I applied for peering, received an email, setup the BGP session, waited about a month. Then 3 weeks ago my BGP session with Amazom came up, but with zero routes. I assume I am in some kind of test/waiting period, but after three weeks, I thought I would be getting routes by now. Emails to the peeringdb POC have not returned anything. Anyone here from AS16509, can this be bumped? We are AS17185, and peering is on DE-CIX NYC. Thanks John

8 7

Spoofer Report for NANOG for Mar 2019
by CAIDA Spoofer Project 08 Apr '19

08 Apr '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Mar 2019: ASN Name Fixed-By 2828 XO-AS15 2019-03-06 33523 ROWANUNIVERSITY 2019-03-25 5050 PSC-EXT 2019-03-26 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Mar 2019: ASN Name First-Spoofed Last-Spoofed 577 BACOM 2016-03-09 2019-03-22 7029 WINDSTREAM 2016-06-21 2019-03-29 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-03-26 6128 CABLE-NET-1 2016-09-03 2019-03-30 18530 ISOMEDIA-1 2016-09-27 2019-03-26 20412 CLARITY-TELECOM 2016-09-30 2019-03-29 6181 FUSE-NET 2016-10-10 2019-03-29 25787 ROWE-NETWORKS 2016-10-21 2019-03-28 174 COGENT-174 2016-10-21 2019-03-22 11537 ABILENE 2016-10-24 2019-03-04 31857 PRIORITY-TERABIT 2016-10-25 2019-03-29 30341 SCTA-ASN 2016-10-31 2019-03-25 32440 LONI 2016-11-03 2019-03-26 12083 WOW-INTERNET 2016-11-09 2019-03-31 1403 EBOX 2016-11-12 2019-03-08 13427 SOFTCOM-INTERNET-COMMUNICATION 2016-11-14 2019-03-26 3549 LVLT-3549 2016-11-16 2019-03-07 21832 KELLINCOM-1 2017-02-03 2019-03-31 18451 LESNET 2017-02-22 2019-03-07 53597 HOYOS-CONSULTING-LLC 2017-03-24 2019-03-09 23314 ORLANDOTELCO 2017-04-14 2019-03-09 19624 SERVERROOM 2017-06-02 2019-03-25 701 UUNET 2017-06-14 2019-03-09 6461 ZAYO-6461 2017-06-21 2019-03-06 63296 AMARILLO-WIRELESS 2017-09-01 2019-03-27 7233 YAHOO-US 2017-09-07 2019-03-05 33523 ROWANUNIVERSITY 2017-10-29 2019-03-25 546 PARSONS-PGS-1 2017-11-20 2019-03-25 12222 AKAMAI 2018-02-14 2019-03-26 8100 ASN-QUADRANET-GLOBAL 2018-04-06 2019-03-07 4201 ORST 2018-04-19 2019-03-27 12028 MMINTERNET 2018-06-14 2019-03-26 225 VIRGINIA 2018-06-18 2019-03-26 40911 L2NC 2018-08-31 2019-03-29 33452 RW 2018-09-19 2019-03-26 20448 VPNTRANET-LLC 2018-09-20 2019-03-26 11215 LOGIXCOMM 2018-09-20 2019-03-11 11996 LOBOIS 2018-09-24 2019-03-26 13825 TROYCABLE-NET 2018-11-21 2019-03-26 32329 MONKEYBRAINS 2018-11-28 2019-03-22 4943 NOL 2019-03-04 2019-03-12 20278 NEXEON 2019-03-05 2019-03-05 395565 MIEMX 2019-03-08 2019-03-08 19531 NODESDIRECT 2019-03-14 2019-03-28 44685 ShatelNet 2019-03-23 2019-03-23 11297 LIPSCOMB 2019-03-29 2019-03-29 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

RE: NANOG Digest, Vol 135, Issue 8 [EXTERNAL MAIL]
by DurgaPrasad - DatasoftComnet 08 Apr '19

08 Apr '19

Same problem in India connecting at Extreme IX peering in Mumbai. The session is up since months. Receiving no prefixes yet - followed up many times. We are having ASN 133593 Regards DP -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of nanog-request(a)nanog.org Sent: 08 April 2019 17:30 To: nanog(a)nanog.org Subject: NANOG Digest, Vol 135, Issue 8 [EXTERNAL MAIL] Send NANOG mailing list submissions to nanog(a)nanog.org To subscribe or unsubscribe via the World Wide Web, visit https://mailman.nanog.org/mailman/listinfo/nanog or, via email, send a message with subject or body 'help' to nanog-request(a)nanog.org You can reach the person managing the list at nanog-owner(a)nanog.org When replying, please edit your Subject line so it is more specific than "Re: Contents of NANOG digest..." Today's Topics: 1. Amazon AS16509 peering... how long to wait? (John Von Essen) 2. Re: Amazon AS16509 peering... how long to wait? (Mehmet Akcin) 3. Re: Amazon AS16509 peering... how long to wait? (Ross Tajvar) 4. Re: Amazon AS16509 peering... how long to wait? (Siyuan Miao) 5. Re: Amazon AS16509 peering... how long to wait? (Kieran Murphy) 6. Re: Amazon AS16509 peering... how long to wait? (Bill Blackford) ---------------------------------------------------------------------- Message: 1 Date: Sun, 7 Apr 2019 17:41:22 -0400 From: John Von Essen <john(a)essenz.com> To: nanog(a)nanog.org Subject: Amazon AS16509 peering... how long to wait? Message-ID: <346afcfa-a2b3-883d-67b6-470ce1e2c96c(a)essenz.com> Content-Type: text/plain; charset=utf-8; format=flowed I applied for peering, received an email, setup the BGP session, waited about a month. Then 3 weeks ago my BGP session with Amazom came up, but with zero routes. I assume I am in some kind of test/waiting period, but after three weeks, I thought I would be getting routes by now. Emails to the peeringdb POC have not returned anything. Anyone here from AS16509, can this be bumped? We are AS17185, and peering is on DE-CIX NYC. Thanks John ------------------------------ Message: 2 Date: Sun, 7 Apr 2019 16:13:42 -0600 From: Mehmet Akcin <mehmet(a)akcin.net> To: John Von Essen <john(a)essenz.com> Cc: nanog(a)nanog.org Subject: Re: Amazon AS16509 peering... how long to wait? Message-ID: <CA+LTh5XJFsKOaRXe3ByxtEsaK8KwWaXSbOV2rwZVbm8o0xrX2Q(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I will connect you to right people offlist I am surprised its taking that long On Sun, Apr 7, 2019 at 16:41 John Von Essen <john(a)essenz.com> wrote: > I applied for peering, received an email, setup the BGP session, waited > about a month. Then 3 weeks ago my BGP session with Amazom came up, but > with zero routes. I assume I am in some kind of test/waiting period, but > after three weeks, I thought I would be getting routes by now. Emails to > the peeringdb POC have not returned anything. Anyone here from AS16509, > can this be bumped? We are AS17185, and peering is on DE-CIX NYC. > > > Thanks > > John > > -- Mehmet +1-424-298-1903

1 0