- NANOG - lists.nanog.org

Question about great firewall of China
by Jean-Francois Mezei 23 Mar '18

23 Mar '18

Asking in a sanity check context. As you may have heard, Bell Canada has gathered a group called Fairplay Canada to force all ISPs in Canada to block web sites Fairplay has decided infringe on copyright. (ironically, Fairplay is copyright by Apple, and used without permission :-) Canada has hundreds of separate ISPs, each using a combination of one or more transit providers (and there are many that have POPs in Canada). (so the following question makes it relevant to the NA in NAnog). 1- Does anyone have "big picture" details on how China implements its website blocks? Is this implemented in major trunks that enter China from the outside world? Is there a governmenmt onwed transit provider to whom any/all ISPs must connect (and thus that provider can implemnent the blocks), or are the blocks performed closer to the edges with ISPs in charge of implementing them ? I assume they are some blocked ports, and fake authoritative DNS zone files to redirect sites like bbc.co.uk to something else? Would DPI, on a national scale work to look at HTTP and HTTPS transactions to kill TCP sessione to IPs where the HTTP transaction has a banned work (such as "Host: www.bbc.co.uk" 2- Bell Canada used to use DPI on 1gbps Ellacoya on its wireline Internet to detect and slow bittorrent flows down to dialup speeds. When it started to upgrade its core network to support FTTH in 2010, the upgrade of the BRAS routers to 10GBPS ports would have required Bell buy a totally new fleet of DPI boxes and keep buying whenever there were capacity upgrades. The math favoured increasing capacity instead of limiting use via DPI throttling, especially since traffic growth was with youtube and netflix , not bittorrent. fast forward 7-8 years to today: Is the deployment of dedicated DPI, capable of wire speed control of individual flows be economically feasable for wireline internet services? (DOCSIS and FTTH speeds). When Rogers and Comcast wanted to slow Netflix, underprovisioning links from the Netflix appliances/CDN is much cheaper than deploying DPI. Just curious if there is still an apetite for DPI for wireline ISPs that deploy at modern DOCSIS/FTTH speeds. Does the rapid move from HTTP to HTTPS render DPI for wire speed live control useless? ( I realise that blind collection of netflow data to be batch processed into billing systems to implement zero rating schemes is possible with normal routers and may not require dedicated DPI. 3- In the case of the USA with ISPs slated to become AOL-like information providers, is there an expectation of widespread deployment of DPI equipment to "manage" the provision of information, or is the expectation that the ISPs will focus more on using netflow to impact the billing system and usage limits? 4- Or is DPI being deployed anyways to protect the networks from DDOS attacks, so adding website blocking would be possible?

4 3

Re: How are you configuring BFD timers?
by Scott Weeks 22 Mar '18

22 Mar '18

--- saku(a)ytti.fi wrote: From: Saku Ytti <saku(a)ytti.fi> ...but I have far more BFD caused problems than BFD solved problems, spanning multiple vendors. (CAT7600, ASR9k, MX). ---------------------------------------- Yes, that's for sure. Also, it's hard to scale when you're tweaking knobs on each session trying to get the time down w/o causing failure unnecessarily. scott

2 1

Juniper MX - Routed pseudowire using LDP - VPWS or VPLS
by Ben Bartsch 22 Mar '18

22 Mar '18

When we had Cisco ASR 920/903 and ASR9k, I could attach a layer 2 pseudowire endpoint on that device to a layer 3 BDI/BVI. I'm trying to do the same thing on a Juniper MX 480/960 and it does not appear to be supported (for LDP at least - MP-BGP might be supported). We could do either VPWS or VPLS on the PE device handoff to the CE (layer 2 only). JTAC has somewhat confirmed this is not supported for LDP, but they only do break/fix, not new config. We do not have professional services (we are broke). Any Juniper routerheads out there that have seen this done using LDP without having to hairpin on the MX? Thanks, y'all. -ben

3 6

Brocade unsupported transceiver?
by Mike Hammett 22 Mar '18

22 Mar '18

Anyone know if there is a command in Brocade NOS (4.x) to force the use of an unsupported transceiver? If so, what is it? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

3 7

Re: How are you configuring BFD timers?
by Scott Weeks 21 Mar '18

21 Mar '18

:: For those running BFD on your land-based point-to-point links, :: I’m interested in hearing about what factors you consider when :: deciding how to configure your timers and multiplier. It has been a while since I used BFD, but I remember trying to get it as close to what I wanted and then fine tuning it over time. For example, sometimes it would take down the session when I didn't want it to and I had to turn the knobs a bit. So another thing to consider is your initial design choice is likely to change over time. scott --- jason+nanog(a)lixfeld.ca wrote: From: Jason Lixfeld <jason+nanog(a)lixfeld.ca> For those running BFD on your land-based point-to-point links, I’m interested in hearing about what factors you consider when deciding how to configure your timers and multiplier. On paper, BFD between two devices over a local or metro dark fibre or wave seems pretty trivial: Assuming your gear can a) support echo mode b) hardware offloads echo processing c) automatically treats echos as vital and puts them into the appropriate high priority queue, then setting the timers down to their lowest possible values (3ms on some of the gear that I’ve seen) and some low multiplier seems more than reasonable. But? From another angle, your link isn’t dark fibre or a wave but, for example, ethernet over some sort of IP based L2 Transport, and is still a low (sub 1ms) one-way latency local or metro link. How do you set your timers, and what do you base that on? From yet another angle, what if your link is a long-haul wave, or for that matter a wave of any distance that imposes a one-way latency that is higher than the minimum tx and rx timers that are supported by your gear? We’ll assume an unprotected wave, because I’m sure if it’s protected, you have no choice but to consider the one-way latency of the longest of the two segments. I made some assumptions above about support for echo mode and hardware offload, but what if (some of) your gear doesn’t support some or all of that stuff? How do you factor your configuration decisions? Thanks!

1 0

COX BGP contact
by Deepak Jain 21 Mar '18

21 Mar '18

I know there should be a more reasonable way to do this. If someone has responsibility for COX BGP (AS 22773) would love to hear from you. Multiple days of getting the run around in various NOCs has lead to nowhere. Thanks in advance, Deepak

1 0

hijacking of 128.255.192.0/22
by Jay Ford 21 Mar '18

21 Mar '18

Something apparently in Brazil is hijacking 128.255.192.0/22, part of 128.255.0.0/16 which is held by the University of Iowa. AS 263971 is announcing 128.255.192.0/22 which Hurricane Electric is accepting & propagating. None of that has any authorization. I can't find any decent contact information for the originating entity, so I have reported it to abuse(a)he.net, but it'd be fabulous if some HE folks listening here could whack the hijacking faster than the abuse channels will get to it. Also useful would be some functional contact for AS263971. Any help will be appreciated. ________________________________________________________________________ Jay Ford, Network Engineering Group, Information Technology Services University of Iowa, Iowa City, IA 52242 email: jay-ford(a)uiowa.edu, phone: 319-335-5555

8 8

problems sending to prodigy.net hosted email
by Trey Nolen 21 Mar '18

21 Mar '18

We are having issues with domains hosted on prodigy.net email servers including att.net, bellsouth.net, and scbglobal.net. We are being rejected for bad reverse DNS, but DNS is setup correctly. The error we are receiving is: Remote host said: 550 5.7.1 Connections not accepted from servers without a valid sender domain.flph829 Fix reverse DNS for 74.252.14.252 I leave it up to the reader to test the validity of 74.252.14.252, but every test we've done looks good. The MX records for these domains indicate this (identical on the three domains mentioned above): ;; ANSWER SECTION: att.net. 175 IN MX 5 al-ip4-mx-vip1.prodigy.net. att.net. 175 IN MX 5 ff-ip4-mx-vip2.prodigy.net. att.net. 175 IN MX 5 ff-ip4-mx-vip1.prodigy.net. att.net. 175 IN MX 5 al-ip4-mx-vip2.prodigy.net. Everything we can find on the postmaster pages, forums, etc. point to emailing abuse_rbl(a)abuse-att.net. We have done this and received their autoresponder. We've waited the requisite 48 hours and emailed again for an escalation only to receive another autoresponder with another ticket number attached (even though we emailed with a ticket number in the message). This has now been ongoing since at least March 4, when we received our first complaint and we have yet to hear anything from AT&T. We don't currently have any direct contacts for Prodigy.net. I will say that the 75.252.14.0/24 netblock is owned by AT&T and I'm wondering if that might be causing the issue. For instance, they are trying to do a local lookup of the PTR record instead of contacting the delegated servers. I'm hoping someone here has a point of contact which I might reach out to in order to correct this issue. Any help would be appreciated. Trey Nolen

7 10

Looking for someone from Intuit to contact me.
by Anthony Leto 21 Mar '18

21 Mar '18

I have a few users on my cloud that are not able to reach intuit.com<http://intuit.com> or quickbooks.intuit.com<http://quickbooks.intuit.com>. In addition my users are not able to eFile taxes from their terminal server with Quickbooks on it. We have checked and our firewalls are not blocking. From the trace route and other testing it looks like my IP ranges are being blocked. Thanks, Anthony Leto Founder Flying Man Studio, LLC.

1 0

Telx Internet Exchange Atlanta
by Joe Carroll 21 Mar '18

21 Mar '18

Is there anyone on the list from TelX with visibility into the Atlanta TIE ?

1 0