- NANOG - lists.nanog.org

Connecting rural providers: ethernet to large city or nearby transit
by Jean-Francois Mezei 13 Apr '16

13 Apr '16

Generic question. Say you have a municipal provider in small town where the municipality won the subsidy over the incumbent to deploy broadband. The easiest is for the town's ISP to buy transit from the incumbent. But incumbent will not be interested in offering competitive pricing. As a sanity check, would a rural ISP come out ahead getting an ethernet link to large city where cheaper transit is available as well as peering to offload a lot of traffic, or would buying transit at higher price locally end up being better ? Is the difference between the two small, or orders of magnitudes cheaper to go one way or the other ? context: in order to provide affordable backhaul to towns, the CRTC *might consider regulation. The Chairman used a key word today "market failure" indicating they are ready to listen to arguments on this.

3 2

Stop IPv6 Google traffic
by Max Tulyev 13 Apr '16

13 Apr '16

Hi All, I need to stop IPv6 web traffic going from our customers to Google without touching all other IPv6 and without blackhole IPv6 Google network (this case my customers are complaining on long timeouts). What can you advice for that?

25 37

Re: Why the US Government has so many data centers
by Scott Weeks 12 Apr '16

12 Apr '16

--- sean(a)donelan.com wrote: From: Sean Donelan <sean(a)donelan.com> https://fcw.com/articles/2016/04/11/lyngaas-halvorsen-update.aspx --------------------------------------------- Wow, this is big news in that article for the companies that deal with selling network devices and computers to the DoD: (Defense Department CIO is Terry Halvorsen) "Halvorsen also briefed reporters on updates to the department's cybersecurity scorecard and its certification process. He said he expects to announce revisions in the coming weeks to DOD's accreditation and certification process for commercial IT products and services. "I think we have reached a point where we no longer can do specific hardware or software accreditation," he said, meaning a piecemeal approach won't keep up with continual updates to, say, cloud offerings. "Our process wouldn't sustain that," he said of certifying cloud offerings that are always being updated. "We need to look at how we do certification and accreditation by process and at some point maybe even by vendor."" scott

1 0

Why the US Government has so many data centers
by Sean Donelan 12 Apr '16

12 Apr '16

If you've wondered why the U.S. Government has so many data centers, ok I know no one has ever asked. The U.S. Government has an odd defintion of what is a data center, which ends up with a lot of things no rational person would call a data center. If you call every room with even one server a "data center," you'll end up with tens of thousands of rooms now data centers. With this defintiion, I probably have two data centers in my home. Its important because Inspectors General auditors will go around and count things, because that's what they do, and write reports about insane numbers of data centers. https://datacenters.cio.gov/optimization/ "For the purposes of this memorandum, rooms with at least one server, providing services (whether in a production, test, stage, development, or any other environment), are considered data centers. However, rooms containing only routing equipment, switches, security devices (such as firewalls), or other telecommunications components shall not be considered data centers."

18 38

Re: Telco Systems
by Raymond Macharia 12 Apr '16

12 Apr '16

Hi, We have used them on our metro for some years now and they have performed well. They do support Mpls. Pricing is very good for what you get. I am currently using the 7124 and I know of another provide who are running exclusively on the telco devices. We have also managed to get them talking to our Cisco aggregation with no issues so far. Raymond Macharia Internet Solutions Kenya On 12 Apr 2016 16:09, "Colton Conor" <colton.conor(a)gmail.com> wrote: Does anyone use Telco Systems Carrier Ethernet & MPLS Aggregation Switches? I have heard good things about them. Overall, the saying is they price 10G ethernet switches at 1G ethernet pricing. It looks like they support MPLS. http://www.telco.com/index.php?page=product-category&category=ethernet-mpls…

1 0

Any ATT.net mail admins here?
by Jeremy Parr 12 Apr '16

12 Apr '16

I have two spam filters that relay outbound mail for a few dozen companies, and as such generate a fair amount of traffic. We are fairly strict with the spam filtering on outbound mail, but somehow end up blacklisted by ATT/Prodigy/Bellsouth a few times a year.

2 1

Telco Systems
by Colton Conor 12 Apr '16

12 Apr '16

Does anyone use Telco Systems Carrier Ethernet & MPLS Aggregation Switches? I have heard good things about them. Overall, the saying is they price 10G ethernet switches at 1G ethernet pricing. It looks like they support MPLS. http://www.telco.com/index.php?page=product-category&category=ethernet-mpls…

2 1

Problem with CoA on Cisco ASR 1000
by Mohsen Dehghani 12 Apr '16

12 Apr '16

Hello Team, I have a problem in updating PPPoE session policy-map via RADIUS CoA packet. When the RADIUS sends CoA to the BRAS, the policy of PPPoE session would not update. My software is asr1000rp2-adventerprisek9.03.13.00.S.154-3.S-ext.bin and The result of "debug aaa coa" is as follows: *Apr 11 04:55:42.152: COA: 80.191.122.6 request queued *Apr 11 04:55:42.152: RADIUS: authenticator 2C D3 08 A2 34 72 FB F2 - 5C 3C A4 F9 81 09 4D 77 *Apr 11 04:55:42.152: RADIUS: Vendor, Cisco [26] 11 *Apr 11 04:55:42.152: RADIUS: Sub_Policy_In [37] 5 "256" *Apr 11 04:55:42.152: RADIUS: Vendor, Cisco [26] 11 *Apr 11 04:55:42.152: RADIUS: Sub_Policy_Out [38] 5 "256" *Apr 11 04:55:42.152: RADIUS: Acct-Session-Id [44] 10 "001195E5" *Apr 11 04:55:42.152: COA: Message Authenticator missing or failed decode *Apr 11 04:55:42.152: ++++++ CoA Attribute List ++++++ *Apr 11 04:55:42.152: 7F78B212D7A8 0 00000081 sub-policy-In(420) 3 256 *Apr 11 04:55:42.152: 7F78B211FCA0 0 00000081 sub-policy-Out(422) 3 256 *Apr 11 04:55:42.152: 7F78B211FCE0 0 00000001 session-id(408) 4 1152485(1195E5) *Apr 11 04:55:42.152: *Apr 11 04:55:42.153: ++++++ Received CoA response Attribute List ++++++ *Apr 11 04:55:42.153: 7F78C82755D0 0 00000081 ssg-command-code(490) 2 10 00 *Apr 11 04:55:42.153: 7F78C8275610 0 00000001 session-id(408) 4 1152485(1195E5) *Apr 11 04:55:42.153: 7F78C8275650 0 00000081 ssg-account-info(488) 22 $IVirtual-Access2.5184 Any Help would be really appreciated.

1 0

Re: how to deal with port scan and brute force attack from AS 8075 ?
by Todd Crane 11 Apr '16

11 Apr '16

I must have missed that… my bad. > On Mar 31, 2016, at 2:01 AM, Dan Hollis <goemon(a)sasami.anime.net> wrote: > > It's right there in his email: > > "We have sent email to abuse(a)microsoft.com, but no answer." > > -Dan > > On Thu, 31 Mar 2016, Todd Crane wrote: > >> Oh and, >> >> I’m assuming you contacted Microsoft’s abuse? If not, it’s not cool, not to mention unprofessional, to publicly call them out on such a public forum without giving them an opportunity to correct it first. >> >>> On Mar 31, 2016, at 1:15 AM, Todd Crane <todd.crane(a)n5tech.com> wrote: >>> >>> Marcel >>> >>> Depending on what is on those machines, I would just recommend using fail2ban. The default is that if an ip address fails ssh auth 3 times in 5 minutes, their ip gets blocked via iptables for 5 minutes. This is enough to thwart most scripted attacks, especially those from a certain government in Asia. This is configurable to various applications, timing schemes, and blocking/jailing mechanisms. >>> >>> -Todd >>>> On Mar 31, 2016, at 1:02 AM, marcel.duregards--- via NANOG <nanog(a)nanog.org> wrote: >>>> >>>> Dear Nanog'er, >>>> >>>> We are facing a lot of port scan and brute force attack on port 22 (but >>>> not limited to) from Microsoft AS 8075 range toward our own infra, or >>>> toward our customers. >>>> We have sent email to abuse(a)microsoft.com, but no answer. >>>> >>>> source ip are: >>>> NetRange: 40.74.0.0 - 40.125.127.255 >>>> CIDR: 40.74.0.0/15, 40.112.0.0/13, 40.124.0.0/16, >>>> 40.76.0.0/14, 40.80.0.0/12, 40.125.0.0/17, 40.96.0.0/12, 40.120.0.0/14 >>>> NetName: MSFT >>>> >>>> >>>> >>>> We consider port scan and brute force on ssh port as an attack, and even >>>> as a pre-DDOS phase (could be use to install botnet, detect unpatched >>>> host, and so one). >>>> >>>> It's one thing to propose services and make money over an infra, it's an >>>> other thing to take care that you clients do not use this infra to make >>>> illegal stuffs. >>>> >>>> >>>> How do you deal with such massive amount of 'illegal' traffic ? >>>> >>>> Thank, >>>> Best Regards >>>> Marcel >>>> >>>> >>>> >>>> >>>> >>>> He are some examples (we have more than 3000 such packets per day just >>>> from them, probably Azure), and source ip is always differents of course: >>>> >>>> >>>> Flow Filtering Expression >>>> src AS 8075 and dst port 22 and packets=1 >>>> Limit Flows >>>> 40000 >>>> Sorting >>>> By Date >>>> >>>> Date_first_seen Duration Proto _IP_Addr:Port >>>> Dst_IP_Addr:Port Flags Packets >>>> 2016-02-29 14:55:20.108 0.000 6 104.45.210.69:1160 -> >>>> x.x.231:22 ...... 1 >>>> 2016-02-29 14:55:20.611 0.000 6 104.45.210.69:1161 -> >>>> x.x.231:22 ...... 1 >>>> 2016-02-29 14:56:41.004 0.000 6 40.76.55.204:1090 -> >>>> x.x..14:22 ...... 1 >>>> 2016-02-29 14:56:41.324 0.000 6 40.76.55.204:1091 -> >>>> x.x..14:22 ...... 1 >>>> 2016-02-29 15:00:05.670 0.000 6 40.76.55.204:1088 -> >>>> x.x.125:22 ...... 1 >>>> 2016-02-29 15:00:06.003 0.000 6 40.76.55.204:1089 -> >>>> x.x.125:22 ...... 1 >>>> 2016-02-29 15:01:17.358 0.000 6 40.76.70.58:1168 -> >>>> x.x..80:22 ...... 1 >>>> 2016-02-29 15:01:17.676 0.000 6 40.76.70.58:1169 -> >>>> x.x..80:22 ...... 1 >>>> 2016-02-29 15:02:42.637 0.000 6 40.76.55.204:1176 -> >>>> x.x.193:22 ...... 1 >>>> 2016-02-29 15:02:42.878 0.000 6 40.76.55.204:1177 -> >>>> x.x.193:22 ...... 1 >>>> 2016-02-29 15:02:48.067 0.000 6 104.45.210.69:1160 -> >>>> x.x.173:22 ...... 1 >>>> 2016-02-29 15:02:48.394 0.000 6 104.45.210.69:1161 -> >>>> x.x.173:22 ...... 1 >>>> 2016-02-29 15:03:18.854 0.000 6 40.121.53.153:1041 -> >>>> x.x..88:22 ...... 1 >>>> 2016-02-29 15:03:19.172 0.000 6 40.121.53.153:1042 -> >>>> x.x..88:22 ...... 1 >>>> 2016-02-29 15:06:36.248 0.000 6 40.76.55.204:1056 -> >>>> x.x..45:22 ...... 1 >>>> 2016-02-29 15:07:31.882 0.000 6 40.76.80.17:44895 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 15:07:32.245 0.000 6 40.76.80.17:44896 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 15:09:08.433 0.000 6 40.76.70.58:1168 -> >>>> x.x..31:22 ...... 1 >>>> 2016-02-29 15:09:08.744 0.000 6 40.76.70.58:1169 -> >>>> x.x..31:22 ...... 1 >>>> 2016-02-29 15:11:45.668 0.000 6 40.76.80.17:47993 -> >>>> x.x.157:22 ...... 1 >>>> 2016-02-29 15:11:45.987 0.000 6 40.76.80.17:47994 -> >>>> x.x.157:22 ...... 1 >>>> 2016-02-29 15:12:09.543 0.000 6 40.76.70.58:1168 -> >>>> x.x..24:22 ...... 1 >>>> 2016-02-29 15:12:09.925 0.000 6 40.76.70.58:1169 -> >>>> x.x..24:22 ...... 1 >>>> 2016-02-29 15:17:05.920 0.000 6 40.76.70.58:1168 -> >>>> x.x.243:22 ...... 1 >>>> 2016-02-29 15:17:06.241 0.000 6 40.76.70.58:1169 -> >>>> x.x.243:22 ...... 1 >>>> 2016-02-29 15:19:21.364 0.000 6 40.83.121.211:62936 -> >>>> x.x..81:22 ...... 1 >>>> 2016-02-29 15:19:21.704 0.000 6 40.83.121.211:62937 -> >>>> x.x..81:22 ...... 1 >>>> 2016-02-29 15:19:45.891 0.000 6 40.76.70.58:1168 -> >>>> x.x..39:22 ...... 1 >>>> 2016-02-29 15:19:46.273 0.000 6 40.76.70.58:1169 -> >>>> x.x..39:22 ...... 1 >>>> 2016-02-29 15:21:52.030 0.000 6 40.76.70.58:1168 -> >>>> x.x.120:22 ...... 1 >>>> 2016-02-29 15:21:52.349 0.000 6 40.76.70.58:1169 -> >>>> x.x.120:22 ...... 1 >>>> 2016-02-29 15:24:07.614 0.000 6 40.76.55.204:1048 -> >>>> x.x.237:22 ...... 1 >>>> 2016-02-29 15:24:07.933 0.000 6 40.76.55.204:1128 -> >>>> x.x.237:22 ...... 1 >>>> 2016-02-29 15:27:31.289 0.000 6 40.121.53.153:1041 -> >>>> x.x.133:22 ...... 1 >>>> 2016-02-29 15:27:31.544 0.000 6 40.121.53.153:1042 -> >>>> x.x.133:22 ...... 1 >>>> 2016-02-29 15:27:59.120 0.000 6 40.76.70.58:1168 -> >>>> x.x.9.3:22 ...... 1 >>>> 2016-02-29 15:27:59.440 0.000 6 40.76.70.58:1169 -> >>>> x.x.9.3:22 ...... 1 >>>> 2016-02-29 15:29:30.933 0.000 6 40.76.70.58:1168 -> >>>> x.x.211:22 ...... 1 >>>> 2016-02-29 15:29:31.031 0.000 6 40.76.70.58:1169 -> >>>> x.x.211:22 ...... 1 >>>> 2016-02-29 15:29:33.729 0.000 6 40.76.55.204:1142 -> >>>> x.x.166:22 ...... 1 >>>> 2016-02-29 15:29:34.032 0.000 6 40.76.55.204:1143 -> >>>> x.x.166:22 ...... 1 >>>> 2016-02-29 15:31:41.947 0.000 6 40.76.70.58:1168 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 15:31:42.266 0.000 6 40.76.70.58:1169 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 15:32:10.044 0.000 6 40.121.53.153:1041 -> >>>> x.x..71:22 ...... 1 >>>> 2016-02-29 15:32:10.348 0.000 6 40.121.53.153:1042 -> >>>> x.x..71:22 ...... 1 >>>> 2016-02-29 15:32:10.442 0.000 6 104.45.210.69:1161 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 15:32:10.475 0.000 6 104.45.210.69:1160 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 15:32:29.165 0.000 6 40.121.143.132:1040 -> >>>> x.x..62:22 ...... 1 >>>> 2016-02-29 15:32:29.466 0.000 6 40.121.143.132:1041 -> >>>> x.x..62:22 ...... 1 >>>> 2016-02-29 15:37:07.616 0.000 6 40.76.80.17:56902 -> >>>> x.x..51:22 ...... 1 >>>> 2016-02-29 15:37:07.925 0.000 6 40.76.80.17:56903 -> >>>> x.x..51:22 ...... 1 >>>> 2016-02-29 15:40:04.546 0.000 6 40.121.53.153:1041 -> >>>> x.x.186:22 ...... 1 >>>> 2016-02-29 15:40:04.866 0.000 6 40.121.53.153:1042 -> >>>> x.x.186:22 ...... 1 >>>> 2016-02-29 15:40:28.870 0.000 6 40.76.70.58:1168 -> >>>> x.x.171:22 ...... 1 >>>> 2016-02-29 15:40:29.125 0.000 6 40.76.70.58:1169 -> >>>> x.x.171:22 ...... 1 >>>> 2016-02-29 15:41:57.034 0.000 6 40.76.55.204:1128 -> >>>> x.x.181:22 ...... 1 >>>> 2016-02-29 15:41:57.354 0.000 6 40.76.55.204:1176 -> >>>> x.x.181:22 ...... 1 >>>> >>>> >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.163:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.176:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.206:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.158:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.185:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.251:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.255:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.141:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.136:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.235:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.242:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.240:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.100:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.244:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.217:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x..72:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.221:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.5.4:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.150:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.145:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.119:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..52:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.127:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..22:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..77:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..85:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..35:22 ...... 1 >>>> >>>> >>>> >>>> >>> >>

5 6

Would someone who works for Brighthouse please contact me offlist to resolve a connectivity issue?
by Andrew Kirch 09 Apr '16

09 Apr '16

I can't access http://jimtest.delong.com via your Cable Modem network. Thanks! Andrew

1 0