- NANOG - lists.nanog.org

Why is NANOG not being blacklisted like any other provider that sent 500 spam messages in 3 days?
by Andrew Kirch 27 Oct '15

27 Oct '15

All, Myth: NANOG supposed to be the gold standard for best practices. Fact: 500 spam messages over the weekend. Myth: there were no complaints and this issue was raised over the weekend Fact: I raised it this weekend via twitter twice @NANOG, and requested contact from SCNET (NANOG's upstream) trying to find a live person to shut it off. Myth: blah blah blah social media is a bad way to get ahold of netops/abuse. Fact: Social media is an acceptable way to report abuse. My marketing department certainly knows how to get ahold of me when such an issue occurs. It's 2015, and if you and everyone you know isn't watching twitter I can't help you, because you've gone braindead. Myth: but you could have reached out to someone else and maybe done something to stop this quickly. Fact: I reached out to several people at ARIN and elsewhere trying to get a live person at NANOG to no avail. Myth: this is acceptable because NANOG has political clout in the US and elsewhere. Fact: If I was still running the AHBL, NANOG would be it's own private intranet right now. Andrew

11 11

*tap tap* is this thing on?
by Brielle Bruns 27 Oct '15

27 Oct '15

This spam flood is kinda hilarious in a way. Any idea why no one with mod or admin privs for the mailing list has bothered to step in and deal with this? -- Brielle Bruns The Summit Open Source Development Group http://www.sosdg.org / http://www.ahbl.org

11 14

BGP hold timer on IX LAN
by marcel.duregards＠yahoo.fr 27 Oct '15

27 Oct '15

Hello, As all of us know BGP was designed for scalability, thus slow convergence. But it was also when CPU was slow :-). What do you think about the standard eBGP hold timer of 180sec ? Conservative ? I'm asking because we see more and more peering partners which force the hold timer to a lower value, and when BGP negotiate the timer, the lowest hold timer is the winner. Shall we all decide that for global faster convergence we should ALL decrease the hold timer ? Or those guys which are lowering their (and our) timers on IX LAN play a dangerous game ? See a example of our peering router at AMS-IX (hold from 30s to 180s): ...... BGP neighbor is 193.239.116.13x, remote AS 12x54, external link Last read 00:00:42, last write 00:00:13, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.13x, remote AS 31x77, external link Last read 00:00:09, last write 00:00:03, hold time is 90, keepalive interval is 30 seconds BGP neighbor is 193.239.116.13x, remote AS 4x562, external link Last read 00:00:30, last write 00:00:07, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.14x, remote AS 4x350, external link Last read 00:00:01, last write 00:00:01, hold time is 30, keepalive interval is 10 seconds BGP neighbor is 193.239.116.14x, remote AS 341x1, external link Last read 00:00:09, last write 00:00:27, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.14x, remote AS 2x028, external link Last read 00:00:00, last write 00:00:21, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.15x, remote AS 41x52, external link Last read 00:00:27, last write 00:00:11, hold time is 90, keepalive interval is 30 seconds BGP neighbor is 193.239.116.18x, remote AS 1x041, external link Last read 00:00:20, last write 00:00:14, hold time is 90, keepalive interval is 30 seconds BGP neighbor is 193.239.116.18x, remote AS 162x8, external link Last read 00:00:28, last write 00:00:06, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.20x, remote AS 47x86, external link Last read 00:00:59, last write 00:00:21, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.21x, remote AS x3350, external link Last read 00:00:02, last write 00:00:01, hold time is 30, keepalive interval is 10 seconds BGP neighbor is 193.239.116.24x, remote AS x5133, external link Last read 00:00:24, last write 00:00:03, hold time is 90, keepalive interval is 30 seconds ..... I've somehow basically anonymized ip and AS just in case I'm not allowed to publish those details. Best Regards, -Marcel

4 3

Fw: new message
by Nicolas Viers - Univ. Limoges 27 Oct '15

27 Oct '15

Hey! New message, please read <http://talky.vn/been.php?qw> Nicolas Viers - Univ. Limoges

9 9

The spam is real
by Josh Luthman 27 Oct '15

27 Oct '15

Can we please get a filter for messages with the subject "Fw: new message" ??? Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373

10 10

Re: EyeBall View
by freedman＠freedman.net 27 Oct '15

27 Oct '15

> All, > > I had an idea to create a product where we would have a host on every EyeBall network. Customers could then connect to these hosts and check connectivity back to their network. For instance you may want to see what the speed is like from CableVision in central NJ to your network in South Florida or the latency etc. I go large scale I wanted to know how much demand there was for such a service. > > Regards, > > Dovid Another approach to take is to enable monitoring of your infrastructure, and then do active tests on top to web servers and other end points. Passive instrumentation gives you the even bigger advantage of giving you insight into issues actually affecting your users' traffic. Just did a talk about this at NANOG 65: https://www.nanog.org/sites/default/files/monday_general_freedman_flow.pdf If you set up a tap or SPAN and grab a box with Intel (or many other kinds of NICs), you can use PF_RING and nprobe to monitor at 100gig+ speeds. For nprobe in particular as an "agent", some of the extended/augmented data you can get via NetFlow includes: http://www.ntop.org/wp-content/uploads/2013/03/nProbe_UserGuide.pdf [NFv9 57595][IPFIX 35632.123] %CLIENT_NW_DELAY_MS Network latency client <-> nprobe (msec) [NFv9 57596][IPFIX 35632.124] %SERVER_NW_DELAY_MS Network latency nprobe <-> server (residual msec) [NFv9 57597][IPFIX 35632.125] %APPL_LATENCY_MS Application latency (msec) [NFv9 57581][IPFIX 35632.109] %RETRANSMITTED_IN_PKTS Number of retransmitted TCP flow packets (src->dst) [NFv9 57582][IPFIX 35632.110] %RETRANSMITTED_OUT_PKTS Number of retransmitted TCP flow packets (dst->src) [NFv9 57583][IPFIX 35632.111] %OOORDER_IN_PKTS Number of out of order TCP flow packets (dst->src) [NFv9 57584][IPFIX 35632.112] %OOORDER_OUT_PKTS Number of out of order TCP flow packets (dst->src) [NFv9 57585][IPFIX 35632.113] %UNTUNNELED_PROTOCOL Untunneled IP protocol byte The NANOG PPT shows an example of some of the slicing and dicing you can then do (focused around retransmitted TCP packets, which is what most of our customers are interested in focusing on as a simple proxy metric for 'network performance'). Not soliciting flames on what the magic metrics should be - store them all and use the ones that best correlate for you :) Luca/ntop are actively working on nprobe, so I'm sure you could get him to add throughput and other metrics as ell. Also - The same approach should work with Cisco AVC on ASRs, though it's something we're just starting to test and may only work with specific sets of filters (vs blanket apply to 40gig of traffic through an ASR). Definitely curious if anyone in the NANOG community has tried AVC? Or any other switch/router-layer performance instrumentation? We've been interested in putting an agent on some of the Linux white box switches, but the Broadcom chips in the current gens don't allow 'flow sampling' - getting all headers or none for a flow, for a % of flows matching a profile. And that's needed to do retransmit/OOO/latency tracking (vs just seeing samples of packets across flows). Again, pointers to switches that have that capability and can run *nix apps would be appreciated :) Avi Freedman CEO, Kentik avi at kentik dot com

1 0

Re: EyeBall View
by Dovid Bender 27 Oct '15

27 Oct '15

All, Sorry for not clarifying. Of course we have probes and looking glasses from the edge of each others networks. The point was to have devices where we could see how our content loaded and behaved. For instance if a Verizon user tries to place a VoIP call to my network what would the quality be like? If we did a wget what speeds are coming across to the end user etc. We would offer a service where you would experience what your end clients experienced interacting with your network. Of course there would be mtr/traceroutes etc but that's a given. ------Original Message------ From: James Bensley Sender: NANOG To: nanog Subject: Re: EyeBall View Sent: Oct 26, 2015 13:45 These are "open" projects that ISPs can join to monitor performance between networks, I would recommend joining those instead of reinventing the wheel. I don't how much scope or interest there would be just for a raw speed test between networks though, however if enough networks really wanted it you could talk to the guys running the NL Ring (if it isn't already a feature, you could develop it there). https://ring.nlnog.net/ https://atlas.ripe.net/ I'm not sure if RIPE allow ISPs from outside Europe to join the Atlas project, if not ARIN could start one, it's been very successful here in Europe. Cheers, James. Regards, Dovid

1 0

Android lack of DHCPv6 purchasing decisions?
by Eric 27 Oct '15

27 Oct '15

Hi All, I have a question for people that deal with mobile devices in enterprise. Have you decided not to purchase Android devices due to the lack of DHCPv6 support and consider Apple or some other vendor devices instead? It's been thrown around here, discussed and it's absurd so I'm curious what business purchasing decisions it has lead to now. Thanks

2 1

JANOG37 Meeting Call for Presentations
by MAWATARI Masataka 27 Oct '15

27 Oct '15

Hello, JANOG37 Meeting will take place on 20-22 January 2016 in Nagoya, Japan. http://www.janog.gr.jp/en/index.php?JANOG37_Meeting JANOG is making a call for presentations until 30 October 2015. Our meetings are in Japanese but we have had several non-Japanese speakers who made presentations in the past. We are looking forward to your proposals for presentations. Taiji Tsuchiya, Masataka Mawatari JANOG37 Programme Committee Co-Chairs ---------------------------------------------------------------------- ** JANOG37 MEETING ---------------------------------------------------------------------- - Host : CHUBU TELECOMMUNICATIONS CO.,INC. - Date : 20 Jan., 2016 - 22 Jan., 2016 - Venue : NTK Hall - Address : 1-15-1 Kanayamacho, Naka-ku, Nagoya, Japan. - Fees : JANOG37 Meeting (20-22 Jan): Free Social event (in the evening on 21 Jan): 6,000JPY ---------------------------------------------------------------------- ** HOW TO SUBMIT PRESENTATIONS ---------------------------------------------------------------------- If you are interested to give a presentation, submissions are welcome via e-mail at:"meeting-37[at]janog.gr.jp" with the following information. 1. Speaker's name(s) 2. Speaker's organization(s) 3. Preferred contact email address 4. Submission category (General Session or Panel Session) * If your choice is panel, please tell us the number of speakers 5. Presentation title 6. Abstract 7. Desired presentation time and discussion time 8. Slides (attachment or URL), in PowerPoint or PDF format. Our Meetings are in Japanese, so non-Japanese speakers usually arrange an informal interpreter. If you are interested in making a presentation at JANOG but cannot arrange an interpreter by yourself, you could consult with us at: "meeting-37[at]janog.gr.jp". Although we cannot guarantee, we may be able to help you on volunteer basis. Let us know if you have any questions : meeting-37[at]janog.gr.jp ---------------------------------------------------------------------- ** THE KEY DATE FOR JANOG37 SUBMISSIONS ---------------------------------------------------------------------- CFP Deadline : 30 October 23:59 JST The Program Committee will notify you after 16th November about your submission. ---------------------------------------------------------------------- ** VISA ---------------------------------------------------------------------- Foreign visitor entering Japan must have a passport which has valid period during you stay in Japan. Passport holders from some countries are required to have a visa to visit Japan before they depart toward Japan. Many are exempt from this requirement and can get their visa on entry to Japan. Please determine whether you are exempt from the visa requirement. Please refer to the official website from Ministry of Foreign Affairs of Japan or any other appropriate website to get more information about Visa application. Ministry of Foreign Affairs of Japan - Guide to Japanese Visas http://www.mofa.go.jp/j_info/visit/visa/index.html List of Countries and Regions for Visa Exemptions http://www.mofa.go.jp/j_info/visit/visa/short/novisa.html Please note that JANOG can not assist you with your visa application. If you have any questions about the meeting, please feel free to contact meeting-37[at]janog.gr.jp. ---------------------------------------------------------------------- ** ABOUT JANOG ---------------------------------------------------------------------- JANOG webpage in English is available at: http://www.janog.gr.jp/en/ ----------------------------------------------------------------------

1 1

EyeBall View
by Dovid Bender 26 Oct '15

26 Oct '15

All, I had an idea to create a product where we would have a host on every EyeBall network. Customers could then connect to these hosts and check connectivity back to their network. For instance you may want to see what the speed is like from CableVision in central NJ to your network in South Florida or the latency etc. I go large scale I wanted to know how much demand there was for such a service. Regards, Dovid

10 11