- NANOG - lists.nanog.org

Re: NANOG Digest, Vol 90, Issue 1
by Ramy Hashish 17 Jul '15

17 Jul '15

Hello Dennis, I am very happy because somebody is on the same page. > Message: 20 > Date: Tue, 30 Jun 2015 14:37:55 -0400 > From: Dennis B <infinityape(a)gmail.com> > To: Roland Dobbins <rdobbins(a)arbor.net> > Cc: nanog(a)nanog.org > Subject: Re: GRE performance over the Internet - DDoS cloud mitigation > Message-ID: > < > CAPr+j8J4vs2y8C6AB3FWGhrVF-GLt02inzvxsPs86m2-ChN6eg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Depends on what performance considerations you are trying to address, > technically. > > The question is how can we guarantee the GRE/BGP performance (control > traffic) during the time between detection and mitigation? > > Exactly > GRE decapsulation? > IE: Hardware vs Software? > Software. > Routing of the Protocol over the internet? > IE: If the inbound path is saturated, what is the availability of the GRE > tunnel? > Yes. > User-experience with GRE packet overhead? > IE: TCP Fragmentation causing PMTUD messages for reassembly? > > Not the main concern right now, however I would like to hear from you in this ponit as well. > I've worked at Prolexic for 7 years and now Akamai for 1.4 yrs, post > acquisition. > > We are contacting AKamai for the solution by the way, and we are contacting the Prolexic's founders acquired company defense.net (now F5) as well :) > Immediately, I can think of mul > tiple scenarios' (3) that come to mind on > how to solve any one of these categories. > > Would you like to learn more? lol > > Sure I would love to :) Message: 23 > Date: Tue, 30 Jun 2015 16:32:54 -0400 > From: Dennis B <infinityape(a)gmail.com> > To: Roland Dobbins <rdobbins(a)arbor.net> > Cc: nanog(a)nanog.org > Subject: Re: GRE performance over the Internet - DDoS cloud mitigation > Message-ID: > < > CAPr+j8LC7h_LLU+j5kwQcvxwLd8Pd+jwP5W7f62Ph2i7g6ZsTg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Roland, > > Agreed, Ramy's scenario was not truly spot on, but his question still > remains. Perf implications when cloud security providers time to > detect/mitigate is X minutes. How stable can GRE transports and BGP > sessions be when under load? > > This is the question. > In my technical opinion, this is a valid argument, which deems wide > opinion. Specifically, use-cases about how to apply defense in depth > logically in the DC vs Hybrid vs Pure Cloud. > > Our defense model will be your so called "in depth logically in the DC", however, we are protecting our NW infrastructure, and we are trying to reach a wholesale agreement in order to protect our customer accordingly. One more thing to elaborate, we have our own DDoS mitigation equipment, and it is located in the edge of the network nearest to the high capacity Internet circuits to minimize the local transit cost. I hope it is clear now. Thanks, Ramy

4 4

Prefix-Hijack by AS7514
by Jürgen Jaritsch 17 Jul '15

17 Jul '15

Hi, does anyone else see some prefix hijacks from AS7514? They started to announce some of our /24 .... Thanks & best regards Jürgen Jaritsch Head of Network & Infrastructure ANEXIA Internetdienstleistungs GmbH Telefon: +43-5-0556-300 Telefax: +43-5-0556-500 E-Mail: jj(a)anexia.at<mailto:jj@anexia.at> Web: http://www.anexia.at<http://www.anexia.at/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

10 18

ISP in NYC
by Dovid Bender 17 Jul '15

17 Jul '15

Hi, We are looking to peer with another ISP in NY. My options are: Telia Tata Cogent We currently have (and will keep): HE NTT TELX (They use NTT and HE and we are looking to replace them). We need an ISP that has a good peering/connectivity in Europe and Asia (Israel specific). Any advice on who to go with?

5 4

IPv6 CPE best practices
by Chuck Church 16 Jul '15

16 Jul '15

So, I've been following this IPv6 discussion for a while now. Putting much more thought into it than ever before. What I've gathered so far: We need both SLAAC and DHPCv6 on CPE router to support all end clients. Android and some other platforms still have some issues with a v6-addressed DNS server (or don't use DHCPv6 at all), so you really need your v4-addressed DNS server to hand out both AAAA and A records together. Is that close? So giving each customer a /48 is the way to go. How does one go about configuring CPEs for devices to use this? I'm aware of how DHCP-PD can dish out a /48 of a larger block. Should I move to a standard CPE that supports DHCP-PD (here is a list: https://getipv6.info/display/IPv6/Broadband+CPE , some mention PD)? Or should I just allow them to use any IPv6 compatible router, and issue each customer a /48, but only configure a /64 of that block for each CPE's inside interface (manual config). Is there anything other than DHCP-PD that can do this auto-magically? I support a small WISP occasionally, it's all wireless and Ethernet. Several hundred small business customers. Nothing super complicated. Been playing with an HE tunnel the last few days and found my netflow collector works fine with FNF and IPv6, so making some progress. Just wanting to avoid any big mistakes when we think about getting some customers on it. Thanks, Chuck

2 1

Speaking of NTP...
by Matthew Huff 16 Jul '15

16 Jul '15

We have 5 NTP server: 2 x stratum 1 rubidium oscillator time servers with GPS sync, and 3 servers running NTP 4.2.6p5-3 synced to external internet based NTP stratum 1 servers. We monitor our NTP environment closely, and over the last 10+ years, normally all of our NTP servers are sync'ed within +/- 2 msec. Starting last Friday, we started seeing some remote NTP servers with GPS reference consistently offset by 10 msec. Any one else seeing this? ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-694-5669

4 4

Re: 'gray' market IPv4
by Seth Mos 16 Jul '15

16 Jul '15

We had the same thing finding a broker for a /24 pi in the RIPE region. Not all of the brokers have the size you want, eg a /20 when you need a /24. It ends up being between 2500 to 4000 euros depending on notary fees and if you already have a LIR agreement. Cheers -------- Oorspronkelijk bericht --------Van: Nicholas Warren <nwarren(a)barryelectric.com> Datum: 14-07-2015 15:19 (GMT+01:00) Aan: nanog(a)nanog.org Onderwerp: 'gray' market IPv4 Where is one of these v4 markets that we can buy some IPv4 space from? I would prefer to have a place where we could see recent transactions, something along the lines of x amount of addresses for y amount of monies. Google search is failing me for some reason.. - Thanks, Nich

8 9

Re: Remember "Internet-In-A-Box"?
by Seth Mos 16 Jul '15

16 Jul '15

So, if i get this right. The problem is not quite as bad to fix. It just needs a dnscache/dnsproxy process bound to the ipv4 localhost that uses the ipv6 dns server. Basically what dnsmasq does. Biggest problem is that it wouldn't follow autoconfigure and thus require manual intervention. That is a no go for dynamic networks of any sort. Cheers-------- Oorspronkelijk bericht --------Van: Owen DeLong <owen(a)delong.com> Datum: 16-07-2015 08:51 (GMT+01:00) Aan: Mark Andrews <marka(a)isc.org> Cc: nanog(a)nanog.org Onderwerp: Re: Remember "Internet-In-A-Box"? > On Jul 15, 2015, at 19:32 , Mark Andrews <marka(a)isc.org> wrote: > > > In message <55A682E6.1050607(a)matthew.at>, Matthew Kaufman writes: >> On 7/14/2015 11:22 PM, Mark Andrews wrote: >>> >>> Yet I can take a Windows XP box. Tell it to enable IPv6 and it >>> just works. Everything that a node needed existed when Windows XP >>> was released. The last 15 years has been waiting for ISP's and CPE >>> vendors to deliver IPv6 as a product. This is not to say that every >>> vendor deployed all the parts of the protocol properly but they >>> existed. >> >> This is only true for dual-stacked networks. I just tried to set up an >> IPv6-only WiFi network at my house recently, and it was a total fail due >> to non-implementation of relatively new standards... starting with the >> fact that my Juniper SRX doesn't run a load new enough to include RDNSS >> information in RAs, and some of the devices I wanted to test with >> (Android tablets) won't do DHCPv6. > > You can blame the religious zealots that insisted that everything > DHCP does has to also be done via RA's. This means that everyone > has to implement everything twice. Something Google should have > realised when they releases Android. Actually, no. In this case, the problem isn’t the things RA does, but the things his implementation of RA doesn’t do (RDNSS). Without RDNSS, android would still be brain-damaged and unable to figure out what an IPv6 nameserver is. The only way it would be able to talk to the IPv6 internet was if it got nameservers from DHCP4. At least with RDNSS, a thin lightweight client can get nameservers on IPv6. At least with RDNSS, a network administrator that doesn’t want to have to do DHCPv6 doesn’t have to in most cases. >> The XP box is in an even worse situation if you try to run it on a >> v6-only network. > > Which is fixable with a third party DHCPv6 client / manual configuration > of the nameservers. Nope… XP’s resolver is utterly and completely incapable of transmitting an IPv6 DNS request. You _HAVE_ to have an IPv4 resolver reachable to the box or forego any idea of using DNS. Owen

2 1

M$ no v6 or just me?
by Nicholas Warren 16 Jul '15

16 Jul '15

Surely Microsoft has IPv6 connectivity? Is there a problem with my dns, or is Microsoft not available over v6? Thanks, Nich

13 19

ARIN IPV4 Countdown
by Scott, Robert D. 15 Jul '15

15 Jul '15

If you have been keeping an eye on the ARIN IPV4 countdown, they allocated their last /23 yesterday. There are only 400 /24s in the pool now. https://www.arin.net/resources/request/ipv4_countdown.html Robert D. Scott Robert(a)ufl.edu Network Engineer 3 352-273-0113 Phone UF Information Technology 321-663-0421 Cell Network Services 352-273-0743 FAX University of Florida Florida Lambda Rail 352-294-3571 FLR NOC Gainesville, FL 32611 3216630421(a)messaging.sprintpcs.com

15 20

BIS re-regulating crypto is on the table...
by manning 15 Jul '15

15 Jul '15

if you use crypto (antivirus, mmap, etc.) or encrypt your data, use VPNs, etc… you might want to read and comment. Comment period closes next week. https://www.federalregister.gov/articles/2015/05/20/2015-11642/wassenaar-ar… manning bmanning(a)karoshi.com PO Box 12317 Marina del Rey, CA 90295 310.322.8102

2 1