- NANOG - lists.nanog.org

Re: *tap tap* is this thing on?
by Dovid Bender 28 Oct '15

28 Oct '15

The reason they are the big boys is because they don't fund such operations. They see money before what you call obligations. Right or wrong they will sell a product if they think they can make it work. Making it work is all subjective. You say it means handling abuse complaints while they say it means the client being connected and able to ping the world. ------Original Message------ From: Rich Kulawiec Sender: NANOG To: nanog(a)nanog.org Subject: Re: *tap tap* is this thing on? Sent: Oct 27, 2015 06:30 On Mon, Oct 26, 2015 at 02:48:59PM -0600, Brielle Bruns wrote: > I get it that it is hard for large providers to be proactive about > things going on due to the sheer size of their networks, but come > on. That excuse only works for so long. 1. It's not hard. It's far easier for large providers than small ones, although many of them flat-out lie and claim the opposite. 2. Whatever happened to "never build what you can't control?" If you can't stop your operation from emitting abuse, you should shut it down. Immediately. That's what professionals do. 3. Large providers pretend to be "leaders", but are among the worst in terms of actually leading by example. Just try getting a response from them via postmaster@ or abuse@. Of course these large operations should individually answer *every* message to those addresses promptly, 24x7, and initiate immediate investigation/remediation on *every* complaint. That's baseline operational competence 101, and given their enormous financial and personnel resources, it would require only a tiny amount of resources. But they don't -- and everyone else pays the price for it. ---rsk Regards, Dovid

1 0

IPligence?
by Dennis Burgess 28 Oct '15

28 Oct '15

Anyone have a contact for Ipligence, looks like a company out of Spain that does geoip database work. They have some issues with their database, and can't find a way to get in contact with them. They don't answer their support e-mails. Thanks, [DennisBurgessSignature] www.linktechs.net<http://www.linktechs.net/> - 314-735-0270 x103 - dmburgess(a)linktechs.net<mailto:dmburgess@linktechs.net>

2 1

Global Crossing contact
by Jim McBurnett 28 Oct '15

28 Oct '15

Hi folks, Sorry to add to the noise level, but need to reach someone at level2/3 at Global crossing for a pathing issue. Please contact me offlist so we can figure out where some traffic is being lost. Thanks, Jim [cid:image321144.PNG@13411130.448fc74e]<http://TGASolutions.com><http://tgasolutions.com> Jim McBurnett | Senior Network Engineer TGA Solutions 13891 Asheville Highway | Inman, SC 29349 Tel (864) 473-1200 | Support 864-708-0616 Website<http://www.tgasolutions.com/> | Email<mailto:jim@tgasolutions.com> <https://twitter.com/tgasolutions> [cid:image48ea14.GIF@cce627af.4c881bf4] <https://twitter.com/tgasolutions> [cid:image0cd093.GIF@9be97be4.4185bb9a] <https://www.facebook.com/pages/TGA-Solutions/171403666251238> <https://www.facebook.com/pages/TGA-Solutions/171403666251238> [cid:image334971.GIF@85a3af4d.489311ca] <https://www.linkedin.com/company/247020?trk=tyah/in/rexweston/> [cid:image6b6966.GIF@ef589bf0.4db7e941] <https://twitter.com/tgasolutions> <https://www.linkedin.com/company/247020?trk=tyah/in/rexweston/> [cid:image2cf82a.PNG@a3058521.419c8c19]<http://tgasolutions.com>

1 0

DNSSEC broken for login.microsoftonline.com
by Bruce Curtis 28 Oct '15

28 Oct '15

FYI our DNS requests to resolve login.microsoftonline.com are failing because of a DNSSEC error. http://dnssec-debugger.verisignlabs.com/login.microsoftonline.com http://dnsviz.net/d/login.microsoftonline.com/dnssec/ ns1 domain]$ drill -DT login.microsoftonline.com Warning: No trusted keys were given. Will not be able to verify authenticity! ;; Domain: . ;; Signature ok but no chain to a trusted key or ds record [S] . 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b} . 172800 IN DNSKEY 256 3 8 ;{id = 62530 (zsk), size = 1024b} Checking if signing key is trusted: New key: . 172800 IN DNSKEY 256 3 8 AwEAAbgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNMioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaRF2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXl ;{id = 62530 (zsk), size = 1024b} [S] com. 86400 IN DS 30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766 ;; Domain: com. ;; Signature ok but no chain to a trusted key or ds record [S] com. 86400 IN DNSKEY 256 3 8 ;{id = 51797 (zsk), size = 1024b} com. 86400 IN DNSKEY 257 3 8 ;{id = 30909 (ksk), size = 2048b} [S] Existence denied: microsoftonline.com. DS ;; No ds record for delegation ;; Domain: microsoftonline.com. ;; No DNSKEY record found for microsoftonline.com. ;; No DS for login.microsoftonline.com.;; No ds record for delegation ;; Domain: login.microsoftonline.com. ;; No DNSKEY record found for login.microsoftonline.com. [U] No data found for: login.microsoftonline.com. type A ;;[S] self sig OK; [B] bogus; [T] trusted [ns1 domain]$ [ns1 domain]$ drill -DT medicare.gov Warning: No trusted keys were given. Will not be able to verify authenticity! ;; Domain: . ;; Signature ok but no chain to a trusted key or ds record [S] . 172800 IN DNSKEY 256 3 8 ;{id = 62530 (zsk), size = 1024b} . 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b} Checking if signing key is trusted: New key: . 172800 IN DNSKEY 256 3 8 AwEAAbgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNMioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaRF2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXl ;{id = 62530 (zsk), size = 1024b} [S] gov. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe gov. 86400 IN DS 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ;; Domain: gov. ;; Signature ok but no chain to a trusted key or ds record [S] gov. 86400 IN DNSKEY 256 3 8 ;{id = 13175 (zsk), size = 1024b} gov. 86400 IN DNSKEY 257 3 8 ;{id = 7698 (ksk), size = 2048b} Checking if signing key is trusted: New key: gov. 86400 IN DNSKEY 256 3 8 AQPCY4NZARQ0HDzGismy6sZdJ17o2+yzmZSkw6d9PeeJ8NCnw9atj4PGHO50LX1Hy0n4YimUcDEXHu+sI4MBaeTkHY3ilsC2kpWGGOFW2fkXn6XNvvPVRjwk04hDsEFphOXPPdoXWjXtQiTVYkFpgUbxJYo24/JxM5JuC4v0+qDmLQ== ;{id = 13175 (zsk), size = 1024b} [S] medicare.gov. 3600 IN DS 16500 7 1 ea88786ecaa04e66322e4405b1c1a55e31485281 medicare.gov. 3600 IN DS 16500 7 2 43a0e12df89bb342c15229495cd2bc18dddce0d9fb315aeb5b06b0d849b9a3ee ;; Domain: medicare.gov. ;; Signature ok but no chain to a trusted key or ds record [S] medicare.gov. 7200 IN DNSKEY 256 3 7 ;{id = 58988 (zsk), size = 1024b} medicare.gov. 7200 IN DNSKEY 256 3 7 ;{id = 41714 (zsk), size = 1024b} medicare.gov. 7200 IN DNSKEY 257 3 7 ;{id = 16500 (ksk), size = 2048b} [S] medicare.gov. 20 IN A 23.213.71.152 ;;[S] self sig OK; [B] bogus; [T] trusted --- Bruce Curtis bruce.curtis(a)ndsu.edu Certified NetAnalyst II 701-231-8527 North Dakota State University

3 7

algeria
by Randy Bush 27 Oct '15

27 Oct '15

any gossip of a cable issue to algier? randy

2 2

Is anyone tracking the "Fw: New Message" joe-job spammer?
by Jay Ashworth 27 Oct '15

27 Oct '15

Cause if so I got about 100 examples from last night I can send you if you think they'll help. :-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

4 3

[Discussion] MTU mismatch and impact of data-plane traffic
by Mohamed Kamal 27 Oct '15

27 Oct '15

Suppose you have the below network topology, where PE is connected to P1, P1 is connected to P2 and P2 is connected to GW, all through 1G links. [PE]-1500------------1500-[P1]-1600------------1600-[P2]-1500------------1600-[GW] The numbers represent the MTU values configured in the following order; PE's egress interface to P1, P1 ingress interface, P1 egress interface, P2 ingress, P2 egress and eventually GW ingress. Q1: What do you think would be the impact in terms of data-plane traffic (HTTP/s browsing, Video streaming etc), traversing this network, in the direction from the Internet and going to the PE router? My answer is: If there is a client running Win7 on a machine trying to access a web server out there, the TCP MSS would be adjusted to around 1260-1460 bytes depending on the Operating System's MTU value. Hypothetically, the first packet from the web server destined to the client would be 1460-bytes and will reach the ingress interface of the GW. The GW would receive it in the input_buffer of the ingress interface, strip off the Ethernet header, and move it to the output buffer of the egress interface whose MTU is 1600. Since the largest MSS is 1460, and there is always a one-to-one mapping between segments received from the TCP module and the packets constructed in the IP module, I believe that the largest IP packet would be 1480. GW would cram the Ethernet frame with the 1480-bytes of IP payload data and send it to the P2, which would in the other end, pass it on its way. Q2: However, what about larger MSS sizes? example; above 1500? and larges chunks of payload from a connectionless protocols that don't exchange MSS? UDP for example? or Google's QUIC (which is HTTP over UDP)? -- Mohamed Kamal

2 1

Fiber in\near Hoopeston, IL
by Mike Hammett 27 Oct '15

27 Oct '15

Can we talk about something not SPAM for a minute? Looking for fiber in or near Hoopeston, IL that's not the incumbent. Frontier is the ILEC and it looks like New Wave is the MSO, but New Wave doesn't appear to go to Chicago. I know of networks near 57 and 65 and also McLeod's route to the south. Any other ideas for networks in that area? I'm assuming there aren't any others, but figured I'd ping here before going with the incumbent. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

1 0

Why is NANOG not being blacklisted like any other provider that sent 500 spam messages in 3 days?
by Andrew Kirch 27 Oct '15

27 Oct '15

All, Myth: NANOG supposed to be the gold standard for best practices. Fact: 500 spam messages over the weekend. Myth: there were no complaints and this issue was raised over the weekend Fact: I raised it this weekend via twitter twice @NANOG, and requested contact from SCNET (NANOG's upstream) trying to find a live person to shut it off. Myth: blah blah blah social media is a bad way to get ahold of netops/abuse. Fact: Social media is an acceptable way to report abuse. My marketing department certainly knows how to get ahold of me when such an issue occurs. It's 2015, and if you and everyone you know isn't watching twitter I can't help you, because you've gone braindead. Myth: but you could have reached out to someone else and maybe done something to stop this quickly. Fact: I reached out to several people at ARIN and elsewhere trying to get a live person at NANOG to no avail. Myth: this is acceptable because NANOG has political clout in the US and elsewhere. Fact: If I was still running the AHBL, NANOG would be it's own private intranet right now. Andrew

11 11

*tap tap* is this thing on?
by Brielle Bruns 27 Oct '15

27 Oct '15

This spam flood is kinda hilarious in a way. Any idea why no one with mod or admin privs for the mailing list has bothered to step in and deal with this? -- Brielle Bruns The Summit Open Source Development Group http://www.sosdg.org / http://www.ahbl.org

11 14