- NANOG - lists.nanog.org

DSL Operators Mailing List?
by Mike Hammett 08 May '18

08 May '18

Is there a good mailing list for DSL operators? A cursory search really only came up with DSL Reports, which is far from what I'm looking for. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

5 8

Spoofer Report for NANOG for Apr 2018
by CAIDA Spoofer Project 08 May '18

08 May '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Apr 2018: ASN Name First-Fixed 11796 AIRSTREAMCOMM-NET 2018-04-12 7922 COMCAST-7922 2018-04-15 7018 ATT-INTERNET4 2018-04-30 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Apr 2018: ASN Name First-Spoofed Last-Spoofed 577 BACOM 2016-03-09 2018-04-29 4323 TWTC 2016-04-22 2018-04-17 1280 ISC-AS-1280 2016-05-27 2018-04-18 7029 WINDSTREAM 2016-06-21 2018-04-24 2828 XO-AS15 2016-07-27 2018-04-20 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2018-04-29 6128 CABLE-NET-1 2016-09-03 2018-04-26 19165 WEBPASS 2016-09-19 2018-04-19 11232 MIDCO-NET 2016-09-22 2018-04-18 20412 CLARITY-TELECOM 2016-09-30 2018-04-30 20001 ROADRUNNER-WEST 2016-10-08 2018-04-19 6181 FUSE-NET 2016-10-10 2018-04-30 15305 SYRINGANETWORKS 2016-10-21 2018-04-25 25787 ROWE-NETWORKS 2016-10-21 2018-04-27 174 COGENT-174 2016-10-21 2018-04-27 271 BCNET-AS 2016-10-24 2018-04-30 32440 LONI 2016-11-03 2018-04-28 33182 DimeNOC 2016-11-08 2018-04-25 12083 WOW-INTERNET 2016-11-09 2018-04-29 5056 AUREON-5056 2016-11-10 2018-04-30 39939 RISE-CO-AS39939 2016-11-11 2018-04-15 11404 AS-VOBIZ 2016-11-11 2018-04-09 1403 EBOX 2016-11-12 2018-04-30 20105 URICHMOND 2016-11-15 2018-04-24 3549 LVLT-3549 2016-11-16 2018-04-30 54858 AS-SBI 2016-12-25 2018-04-27 2152 CSUNET-NW 2017-02-02 2018-04-21 21832 KELLINCOM-1 2017-02-03 2018-04-25 62593 SILOWIRELESS 2017-06-09 2018-04-28 6461 ZAYO-6461 2017-06-21 2018-04-30 26793 ICS-LLC 2017-08-16 2018-04-24 63296 AMARILLO-WIRELESS 2017-09-01 2018-04-25 7233 YAHOO-US 2017-09-07 2018-04-26 33523 ROWANUNIVERSITY 2017-10-29 2018-04-25 1680 NV-ASN 2017-11-14 2018-04-17 11796 AIRSTREAMCOMM-NET 2017-11-30 2018-04-02 12222 AKAMAI 2018-02-14 2018-04-25 55236 CBC 2018-03-03 2018-04-21 3257 GTT-BACKBONE 2018-03-06 2018-04-27 29384 Qatar-Foundation 2018-03-08 2018-04-29 23148 TERRENAP 2018-03-15 2018-04-25 226 LOS-NETTOS-AS 2018-03-26 2018-04-26 54417 STIMULUS-TECHNOLOGIES 2018-03-29 2018-04-24 8100 ASN-QUADRANET-GLOBAL 2018-04-06 2018-04-29 15176 AS-INOC 2018-04-09 2018-04-12 20009 WADSNET 2018-04-13 2018-04-29 4201 ORST-AS 2018-04-19 2018-04-26 11827 WSU-AS 2018-04-19 2018-04-26 31863 DACEN-2 2018-04-26 2018-04-26 11427 SCRR-11427 2018-04-28 2018-04-28 14615 ROCK-HILL-TELEPHONE 2018-04-30 2018-04-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Re: Catalyst 4500 listening on TCP 6154 on all interfaces
by Jay Farrell 07 May '18

07 May '18

I saw that list, but understood the numbers there to be IDS signature numbers, rather than port numbers. Am I misreading something? On Mon, May 7, 2018 at 12:24 PM, Curtis, Bruce <bruce.curtis(a)ndsu.edu> wrote: > Some Cisco devices use 6154 for ypxfrd. > > > 6154 ypxfrd Portmap Request (Info, Atomic*) > > Triggers when a request is made to the portmapper for the YP transfer > daemon (ypxfrd) port. > > https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/ > configuration/guide/fsecur_c/scfids.html > > https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/ > configuration/guide/asa_84_cli_config/protect_tools.html > >

2 1

would someone from AS7363 contact me off list please <eom>
by Walt 07 May '18

07 May '18

1 0

Hulu Contact
by David Brain 07 May '18

07 May '18

Is there a good Hulu contact for situations where IP addresses are being incorrectly flagged as anonymous proxy? I see 'ipadmin@hulu' but suspect that's not exactly what I need. Thanks, David. -- David Brain - MCNC - 919.248.1998

1 0

How are you configuring BFD timers?
by Jason Lixfeld 07 May '18

07 May '18

Hey, For those running BFD on your land-based point-to-point links, I’m interested in hearing about what factors you consider when deciding how to configure your timers and multiplier. On paper, BFD between two devices over a local or metro dark fibre or wave seems pretty trivial: Assuming your gear can a) support echo mode b) hardware offloads echo processing c) automatically treats echos as vital and puts them into the appropriate high priority queue, then setting the timers down to their lowest possible values (3ms on some of the gear that I’ve seen) and some low multiplier seems more than reasonable. But? From another angle, your link isn’t dark fibre or a wave but, for example, ethernet over some sort of IP based L2 Transport, and is still a low (sub 1ms) one-way latency local or metro link. How do you set your timers, and what do you base that on? From yet another angle, what if your link is a long-haul wave, or for that matter a wave of any distance that imposes a one-way latency that is higher than the minimum tx and rx timers that are supported by your gear? We’ll assume an unprotected wave, because I’m sure if it’s protected, you have no choice but to consider the one-way latency of the longest of the two segments. I made some assumptions above about support for echo mode and hardware offload, but what if (some of) your gear doesn’t support some or all of that stuff? How do you factor your configuration decisions? Thanks!

17 31

Anyone on from Comcast?
by Janet Sullivan 07 May '18

07 May '18

I've spent my morning in customer support hell. Sorry for the noise, but if someone with clue could help a gig residential customer getting 3 Mbit/s, I'd love you.

1 0

Route Reflector Client Design Question
by Erik Sundberg 07 May '18

07 May '18

I have a RR Client design question...... CORE1-------------------2x10G-----------------------CORE2 | | | | | 10G Ring | | | | | PE1----------PE2----------PE3----------PE4----------PE5 -Core1 & Core2 are RR Reflectors with full IPV4 Tables (ASR9K) -MPLS LDP Enabled -IGP is ISIS -Each PE peers only with Core1 and Core2 as RR Clients with iBGP -PE's are only receiving a default route from the Core Routers due to TCAM size of 20K (ASR920's\ME3800's) -The ring does not have that much traffic on it <500m, so I do not want to use additional 10G ports on the Core's and is why I have it in a 10G U ring. -Primary link to the cores is via the PE1 --- CORE1 Like......... For this discussion the link between PE5 to CORE2 is set up as a backup link. The scenario is I have traffic between PE2 and PE3. Since the PE's are only receiving a default route from the Cores. Traffic is label switch from PE2 - PE1 - Core1 does a IP lookup at Ingress then label switches back to PE1-PE2-PE3. This ends up being 5 hops and doubling the traffic on the link to the Cores. My questions is how do I get traffic to go directly between the PE's without going to the Core Routers? 1. Can I enable iBGP between the PE's in a full mesh to allow traffic between the PE's without going to the core's. Or does this break the Route Reflector model? 2. Create a route policy on the Core's advertising routes learned from the PE's back to all the PE's on the ring. 3. Is this one of the down sides to U Rings? 4. Leave it alone and move on to bigger and better things.... Thanks Erik ________________________________ CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must destroy the original transmission and its attachments without reading or saving in any manner. Thank you.

9 12

NSR / NSF
by Hari . 05 May '18

05 May '18

Checking on best practice being followed with regards to enabling NSF or NSR or both on ASR 9k. Which option can be beneficial and considered to be a standard approach. Thanks!

2 1

RE: Route Reflector Client Design Question
by Jakob Heitz (jheitz) 04 May '18

04 May '18

You could optimize the packet hop count by making smaller but more rings. For example, make one ring with CORE1, CORE2, PE1, PE2, PE3. And another ring with CORE1, CORE2, PE4, PE5. If you configure "route-reflector-client" on the CORE, and mesh the clients, then you can additionally configure "bgp client-to-client reflection disable". However, if the CORE is just sending a default route, then you probably have default-originate and no RR clients on the CORE. Then you don't need to disable reflection, because it's not reflecting anyway. (reflection refers to the reflection of routes, not reflection of packets). You could send limited important or heavily used prefixes between the PEs using route policy without blowing up the TCAM. Regards, Jakob. -----Original Message----- From: Erik Sundberg <ESundberg(a)nitelusa.com> I have a RR Client design question...... CORE1-------------------2x10G-----------------------CORE2 | | | | | 10G Ring | | | | | PE1----------PE2----------PE3----------PE4----------PE5 -Core1 & Core2 are RR Reflectors with full IPV4 Tables (ASR9K) -MPLS LDP Enabled -IGP is ISIS -Each PE peers only with Core1 and Core2 as RR Clients with iBGP -PE's are only receiving a default route from the Core Routers due to TCAM size of 20K (ASR920's\ME3800's) -The ring does not have that much traffic on it <500m, so I do not want to use additional 10G ports on the Core's and is why I have it in a 10G U ring. -Primary link to the cores is via the PE1 --- CORE1 Like......... For this discussion the link between PE5 to CORE2 is set up as a backup link. The scenario is I have traffic between PE2 and PE3. Since the PE's are only receiving a default route from the Cores. Traffic is label switch from PE2 - PE1 - Core1 does a IP lookup at Ingress then label switches back to PE1-PE2-PE3. This ends up being 5 hops and doubling the traffic on the link to the Cores. My questions is how do I get traffic to go directly between the PE's without going to the Core Routers? 1. Can I enable iBGP between the PE's in a full mesh to allow traffic between the PE's without going to the core's. Or does this break the Route Reflector model? 2. Create a route policy on the Core's advertising routes learned from the PE's back to all the PE's on the ring. 3. Is this one of the down sides to U Rings? 4. Leave it alone and move on to bigger and better things....

1 0