- NANOG - lists.nanog.org

Anyone here from Orbitz?
by Andy Ringsmuth 28 Oct '15

28 Oct '15

Any chance someone on the list from Orbitz? Car rentals are suddenly impossible to book. It seems there’s a session timeout set to essentially zero. Selecting a vehicle returns this URL: http://www.orbitz.com/shop/home?errorId=3207 And an error of “We’ve noticed you’ve been away from this page for a while and your session has timed out. Please try again.” ---- Andy Ringsmuth andy(a)newslink.com News Link – Manager Travel, Technology & Facilities 2201 Winthrop Rd., Lincoln, NE 68502-4158 (402) 475-6397 (402) 304-0083 cellular

1 0

spam smackdown?
by Scott Weeks 28 Oct '15

28 Oct '15

It looks like someone's trying to make a point. --------------------------------- New message, please read <http://xxxxxxxxx> ----------------------------------- scott

10 9

Re: *tap tap* is this thing on?
by Dovid Bender 28 Oct '15

28 Oct '15

The reason they are the big boys is because they don't fund such operations. They see money before what you call obligations. Right or wrong they will sell a product if they think they can make it work. Making it work is all subjective. You say it means handling abuse complaints while they say it means the client being connected and able to ping the world. ------Original Message------ From: Rich Kulawiec Sender: NANOG To: nanog(a)nanog.org Subject: Re: *tap tap* is this thing on? Sent: Oct 27, 2015 06:30 On Mon, Oct 26, 2015 at 02:48:59PM -0600, Brielle Bruns wrote: > I get it that it is hard for large providers to be proactive about > things going on due to the sheer size of their networks, but come > on. That excuse only works for so long. 1. It's not hard. It's far easier for large providers than small ones, although many of them flat-out lie and claim the opposite. 2. Whatever happened to "never build what you can't control?" If you can't stop your operation from emitting abuse, you should shut it down. Immediately. That's what professionals do. 3. Large providers pretend to be "leaders", but are among the worst in terms of actually leading by example. Just try getting a response from them via postmaster@ or abuse@. Of course these large operations should individually answer *every* message to those addresses promptly, 24x7, and initiate immediate investigation/remediation on *every* complaint. That's baseline operational competence 101, and given their enormous financial and personnel resources, it would require only a tiny amount of resources. But they don't -- and everyone else pays the price for it. ---rsk Regards, Dovid

1 0

IPligence?
by Dennis Burgess 28 Oct '15

28 Oct '15

Anyone have a contact for Ipligence, looks like a company out of Spain that does geoip database work. They have some issues with their database, and can't find a way to get in contact with them. They don't answer their support e-mails. Thanks, [DennisBurgessSignature] www.linktechs.net<http://www.linktechs.net/> - 314-735-0270 x103 - dmburgess(a)linktechs.net<mailto:dmburgess@linktechs.net>

2 1

Global Crossing contact
by Jim McBurnett 28 Oct '15

28 Oct '15

Hi folks, Sorry to add to the noise level, but need to reach someone at level2/3 at Global crossing for a pathing issue. Please contact me offlist so we can figure out where some traffic is being lost. Thanks, Jim [cid:image321144.PNG@13411130.448fc74e]<http://TGASolutions.com><http://tgasolutions.com> Jim McBurnett | Senior Network Engineer TGA Solutions 13891 Asheville Highway | Inman, SC 29349 Tel (864) 473-1200 | Support 864-708-0616 Website<http://www.tgasolutions.com/> | Email<mailto:jim@tgasolutions.com> <https://twitter.com/tgasolutions> [cid:image48ea14.GIF@cce627af.4c881bf4] <https://twitter.com/tgasolutions> [cid:image0cd093.GIF@9be97be4.4185bb9a] <https://www.facebook.com/pages/TGA-Solutions/171403666251238> <https://www.facebook.com/pages/TGA-Solutions/171403666251238> [cid:image334971.GIF@85a3af4d.489311ca] <https://www.linkedin.com/company/247020?trk=tyah/in/rexweston/> [cid:image6b6966.GIF@ef589bf0.4db7e941] <https://twitter.com/tgasolutions> <https://www.linkedin.com/company/247020?trk=tyah/in/rexweston/> [cid:image2cf82a.PNG@a3058521.419c8c19]<http://tgasolutions.com>

1 0

DNSSEC broken for login.microsoftonline.com
by Bruce Curtis 28 Oct '15

28 Oct '15

FYI our DNS requests to resolve login.microsoftonline.com are failing because of a DNSSEC error. http://dnssec-debugger.verisignlabs.com/login.microsoftonline.com http://dnsviz.net/d/login.microsoftonline.com/dnssec/ ns1 domain]$ drill -DT login.microsoftonline.com Warning: No trusted keys were given. Will not be able to verify authenticity! ;; Domain: . ;; Signature ok but no chain to a trusted key or ds record [S] . 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b} . 172800 IN DNSKEY 256 3 8 ;{id = 62530 (zsk), size = 1024b} Checking if signing key is trusted: New key: . 172800 IN DNSKEY 256 3 8 AwEAAbgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNMioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaRF2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXl ;{id = 62530 (zsk), size = 1024b} [S] com. 86400 IN DS 30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766 ;; Domain: com. ;; Signature ok but no chain to a trusted key or ds record [S] com. 86400 IN DNSKEY 256 3 8 ;{id = 51797 (zsk), size = 1024b} com. 86400 IN DNSKEY 257 3 8 ;{id = 30909 (ksk), size = 2048b} [S] Existence denied: microsoftonline.com. DS ;; No ds record for delegation ;; Domain: microsoftonline.com. ;; No DNSKEY record found for microsoftonline.com. ;; No DS for login.microsoftonline.com.;; No ds record for delegation ;; Domain: login.microsoftonline.com. ;; No DNSKEY record found for login.microsoftonline.com. [U] No data found for: login.microsoftonline.com. type A ;;[S] self sig OK; [B] bogus; [T] trusted [ns1 domain]$ [ns1 domain]$ drill -DT medicare.gov Warning: No trusted keys were given. Will not be able to verify authenticity! ;; Domain: . ;; Signature ok but no chain to a trusted key or ds record [S] . 172800 IN DNSKEY 256 3 8 ;{id = 62530 (zsk), size = 1024b} . 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b} Checking if signing key is trusted: New key: . 172800 IN DNSKEY 256 3 8 AwEAAbgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNMioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaRF2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXl ;{id = 62530 (zsk), size = 1024b} [S] gov. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe gov. 86400 IN DS 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ;; Domain: gov. ;; Signature ok but no chain to a trusted key or ds record [S] gov. 86400 IN DNSKEY 256 3 8 ;{id = 13175 (zsk), size = 1024b} gov. 86400 IN DNSKEY 257 3 8 ;{id = 7698 (ksk), size = 2048b} Checking if signing key is trusted: New key: gov. 86400 IN DNSKEY 256 3 8 AQPCY4NZARQ0HDzGismy6sZdJ17o2+yzmZSkw6d9PeeJ8NCnw9atj4PGHO50LX1Hy0n4YimUcDEXHu+sI4MBaeTkHY3ilsC2kpWGGOFW2fkXn6XNvvPVRjwk04hDsEFphOXPPdoXWjXtQiTVYkFpgUbxJYo24/JxM5JuC4v0+qDmLQ== ;{id = 13175 (zsk), size = 1024b} [S] medicare.gov. 3600 IN DS 16500 7 1 ea88786ecaa04e66322e4405b1c1a55e31485281 medicare.gov. 3600 IN DS 16500 7 2 43a0e12df89bb342c15229495cd2bc18dddce0d9fb315aeb5b06b0d849b9a3ee ;; Domain: medicare.gov. ;; Signature ok but no chain to a trusted key or ds record [S] medicare.gov. 7200 IN DNSKEY 256 3 7 ;{id = 58988 (zsk), size = 1024b} medicare.gov. 7200 IN DNSKEY 256 3 7 ;{id = 41714 (zsk), size = 1024b} medicare.gov. 7200 IN DNSKEY 257 3 7 ;{id = 16500 (ksk), size = 2048b} [S] medicare.gov. 20 IN A 23.213.71.152 ;;[S] self sig OK; [B] bogus; [T] trusted --- Bruce Curtis bruce.curtis(a)ndsu.edu Certified NetAnalyst II 701-231-8527 North Dakota State University

3 7

algeria
by Randy Bush 27 Oct '15

27 Oct '15

any gossip of a cable issue to algier? randy

2 2

Is anyone tracking the "Fw: New Message" joe-job spammer?
by Jay Ashworth 27 Oct '15

27 Oct '15

Cause if so I got about 100 examples from last night I can send you if you think they'll help. :-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

4 3

[Discussion] MTU mismatch and impact of data-plane traffic
by Mohamed Kamal 27 Oct '15

27 Oct '15

Suppose you have the below network topology, where PE is connected to P1, P1 is connected to P2 and P2 is connected to GW, all through 1G links. [PE]-1500------------1500-[P1]-1600------------1600-[P2]-1500------------1600-[GW] The numbers represent the MTU values configured in the following order; PE's egress interface to P1, P1 ingress interface, P1 egress interface, P2 ingress, P2 egress and eventually GW ingress. Q1: What do you think would be the impact in terms of data-plane traffic (HTTP/s browsing, Video streaming etc), traversing this network, in the direction from the Internet and going to the PE router? My answer is: If there is a client running Win7 on a machine trying to access a web server out there, the TCP MSS would be adjusted to around 1260-1460 bytes depending on the Operating System's MTU value. Hypothetically, the first packet from the web server destined to the client would be 1460-bytes and will reach the ingress interface of the GW. The GW would receive it in the input_buffer of the ingress interface, strip off the Ethernet header, and move it to the output buffer of the egress interface whose MTU is 1600. Since the largest MSS is 1460, and there is always a one-to-one mapping between segments received from the TCP module and the packets constructed in the IP module, I believe that the largest IP packet would be 1480. GW would cram the Ethernet frame with the 1480-bytes of IP payload data and send it to the P2, which would in the other end, pass it on its way. Q2: However, what about larger MSS sizes? example; above 1500? and larges chunks of payload from a connectionless protocols that don't exchange MSS? UDP for example? or Google's QUIC (which is HTTP over UDP)? -- Mohamed Kamal

2 1

Fiber in\near Hoopeston, IL
by Mike Hammett 27 Oct '15

27 Oct '15

Can we talk about something not SPAM for a minute? Looking for fiber in or near Hoopeston, IL that's not the incumbent. Frontier is the ILEC and it looks like New Wave is the MSO, but New Wave doesn't appear to go to Chicago. I know of networks near 57 and 65 and also McLeod's route to the south. Any other ideas for networks in that area? I'm assuming there aren't any others, but figured I'd ping here before going with the incumbent. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

1 0