- Test - lists.nanog.org

RIPE Atlas probe available on SpaceX Starlink beta terminal
by Eric Kuhnke 11 Feb '21

11 Feb '21

https://atlas.ripe.net/probes/1001821/ I am running what I believe to be the first RIPE Atlas probe on a Starlink beta test terminal. When searching the index of public probes I did not find any other probes with "spacex" or "starlink" in the descriptions. This probe is at present not contained within AS14593 (Starlink). All beta test terminals that I am aware of right now, including my own, are in cgnat IP space and meet the public Internet via AS36492 (Google). This particular terminal is topologically closest to things at major IX points in the metro Seattle area. The absolute lowest ping time I've seen to something at the Westin is 15.85ms, with averages more often between 21-32ms. The site where this is installed will occasionally conduct other, non Atlas related tests which result in full saturation of the upstream or downstream connection, simulating a number of different types of real world use cases. This means that occasionally the RTT ping to things in Seattle may rise as high as 150ms, and artificially-induced packet loss will be introduced into the connection. Please feel free to contact me off-list with any questions.

1 0

2021.02.10 community meeting unofficial notes
by Matthew Petach 11 Feb '21

11 Feb '21

It was mentioned in the chat this morning that there was no link to slides or anything on the agenda for the community meeting that happened this morning, so I offered to share the notes I was jotting down during the meeting, to give an idea of what was covered for those in timelines not as friendly to the meeting time, or to those with conflicts. ^_^; Thanks so much to the staff, Elizabeth, Steve, and Ed for the great presentations this morning! Matt 2021.02.10 NANOG81 community meeting Speaker Edward McNair, NANOG Steve Feldman, ViacomCBS Elizabeth Culley, Comcast NOTES: Michael Voity kicks off the meeting at 0901 hours Pacific time to go over the agenda for the day. special announcements: fill out surveys! The PC reads all of them! And if you're a lucky winner, you'll get a $100 gift card! Looking for presentation proposals for NANOG82! check out sponsors at virtual expo both; sponsors have stepped up to the challenge with interesting offerings. first talk today is hosted by edward mcnair, with Elizabeth Culley and Steve Feldman. Ed Mcnair has been with nanog since 2005, and has been ED since 2018; Steve has been contributing to nanog since its inception since 1994, and has been involved with PC for the last 20 years. Elizabeth Culley is peering coordinator with comcast, and is completing her first year on the PC; this is her first time presenting to NANOG. welcome edward, steve and elizabeth, it's great to have you here. Edward takes a few moments to give some updates on the organization; strategic plan narrowed to 3 areas; education, meeting experience, online collaboration, another piece built out is the strategic timeline; encompasses from NANOG73 to NANOG 85. purpose is to see what we are aiming to achieve and what we will put forward. we always like to hear your comments, there is a feedback button that goes to NANOG staff, and he reads them all. Take a moment to honor the nanog staff; counting himself, there are 6.5 staff members, as Claudia works with them halftime. Claudia, Leigh, Valerie, Shawn, Darrieux (Dee), and Brandi all work very hard to ensure that we can have a quality program. Our 2020 annual report will be coming out soon; to give a linear record of what we've accompished over the course of 2020; we'll do polls at the end of the section; log into the polls at pollEV.com/nanog Over to Steve feldman; at end of every NANOG, there is a Program commitee get together; after SF, decided to have retreat in 2020; planned to do it in Boston or Seattle; but then things changed, and they couldn't get together in person; so they had a virtual retreat, 2 days, dec 16 2020, and jan 13 2021 to go over various items. some of the items covered: PC structure new member onboarding PC handbook update mentorship leadership review roles, responsibliities need to document them better subcommittees are we optiimizing our effort? some don't seem to do much. will add some new ones. diversity of skills and perspectives need to get people who have different industry perspectives. other topics at virutal retreat meeting format how to do hybrid meetings we optimize time for training and tutorial we focus on human interaction; need to accomodate people in different timezones. talk solicitation and selection attracting new speakers expanding the audience standardize voting content review PC's strategic vision. Liz, chairing our data analysis effort; for past 20 years, we've been building a repository of tracks, tutorials, keynote speeches, lightning talks; we have a long history of hosting the voices of those building the internet. what comes up in NANOG is often in the leading edge of technology trends; this effort will be to mine the repository, to help us keep up with the onslaught of demand. cataloging NANOG; we are recording the details of every presentation, tutoria and keynote; tagging each record with relevant metadata provide intuitive web page of popular topics porovide data to potential speakers on history of any topic which topics are asked for most often which videos are most viewed. use surveys and data on view counts to project topics that will be of most interest. looking at last 5 years of NANOG data; how many times this topic 44 topics on DNS 40 requests for automation, but 26 talks on automation Geoff Huston comes up a lot look at how many times talks are viewed on youtube; 27K views of 44 DNS talks on youtube; 26 automation videos got 77K views. A lot of people would say they're experts in a field; how can they talk about their job when it's 100% proprietary, and they can't talk about their day job; take a look at the request counts, how many presentations we get, so even doing a 101 intro class is a great way to get your feet wet. 66% of presentations are on top 20 subjects. 115 categoreis in presentations and requests match the survey requests. if we watched all the talks and presentations, 8 hours a day, it woud take 8 weeks to watch the all 550 prsentations, 357 speakers, 218 organizations. 90% of speakers present 1 or 2 times. looking forward; want to give huge thanks to Jeff Bartig, Anna Valsami, and Valerie Wittkop for doing the work to move it forwrd; and thank you to PC for creating the new data analysis committee, and providing the sunlight and support to make this a reality. we have 1300 recorded and tagged; we expect 2100 items; easy part is done, now we're getting into the hard part. Jeff Bartig wrote scripts to download from youtube; there's a lot of stuff in agendas that have to be gone through one at a time. in midst of the project; would love to hear from you; what else would you like to see? now, for polls--what topic would you like to see? and you can always put feedback in the web feedback form. Seems that Geoff Huston, IPv6, Automation, Cloud, Virtualization are hot topics! are you planning to attend minnapolis nanog82 in person? most are undecided or will attend virtually. most seem to lean to attending virtually. likewise for toronto, nanog83 it looks like most people are waiting for vaccines to be available before they will come. So far, most have not yet taken the vaccine, but also most are planning to take the vaccine once they are able to. Over to you, Michael; Thank you to Edward, Steve and Elizabeth for their time. Network Automation treasure hunt without a map is up next.

4 4

DNSSEC question
by Randy Carpenter 10 Feb '21

10 Feb '21

Any DNSSEC experts that could help with a question about a specific domain? Off-list please. thanks, -Randy

1 0

cogent issues in texas?
by aaron1＠gvtc.com 09 Feb '21

09 Feb '21

Anyone else having cogent internet issues in south central Texas or the region? I called Cogent and they mentioned a few spans down between el paso, fort worth, san Antonio and Houston My 100 gig link to them took a lot of loss. I had to bring down bgp for preferring other sp Aaron aaron1(a)gvtc.com

2 1

Problems with newish IP block assignment issues from ARIN
by Justin Wilson (Lists) 08 Feb '21

08 Feb '21

Folks, Have a gremlin we have been chasing around for several months now and it’s becoming a major issue as we are getting tighter on IPV4 and needing to give some provider assigned space back. In June we received a /22 from ARIN. As is my workflow I started announcing it but waited a month while I checked out the geolocation databases for correct info, did testing ,etc. All this time our test accounts could browse web-sites, etc. We put one of the pools into production and things ran good for awhile. Then we started getting the occasional web-site was not working. After several of these we started assigning the customer an IP out of one of our other ARIN blocks and the web-site would be fine and reachable. The issue seems to reside just on this /22. We have other blocks from ARIN and they are just fine. We can assign an IP out of this new block and can’t reach certain web-sites. We turn around and assign out of another block and web-site works just fine. We have two upstreams and an IX on this network. We have tried withdrawing the route on this particular /22 and isolating to one upstream alone and the problems still persist. Many of the web-sites in question are government (both state and local), online universities, and the occasional local news station. They are diverse enough to not be traced down to a common point, except the IP block. We announce the IP block via BGP the same exact way we announce the other blocks. Traceroutes show the path going the same way no matter what IP block the customer has. It acts like the IP block was blacklisted at some point and got on some bad lists but I don’t want ti limit myself to that theory. I have opened up a ticket with ARIN asking for any guidance. Has anyone ran into this with new space assigned? Any tools, sites, etc. I can use to do further troubleshooting. The IP block does not appear to have any blacklisted IPs according to MX toolbox, and some others. The block in question is 134.195.44.0/22. It has been RPKI certified and has IRR entries. Thanks in advance Justin Wilson j2sw(a)mtin.net — https://j2sw.com - All things jsw (AS209109) https://blog.j2sw.com - Podcast and Blog

8 9

Retalitory DDoS
by Mike Hammett 08 Feb '21

08 Feb '21

Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

5 10

Internet Routing Registry folks - Important - (Fwd: [arin-announce] Consultation Now Open on the Future of ARIN’s IRR)
by John Curran 08 Feb '21

08 Feb '21

NANOGers - If you make use of ARIN’s unauthenticated IRR service or the NONAUTH data stream in your route filtering, please take note of the following ARIN consultation. Thanks! /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] Consultation Now Open on the Future of ARIN’s IRR Date: 8 February 2021 at 10:46:18 AM EST To: "arin-announce(a)arin.net<mailto:arin-announce@arin.net>" <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> ARIN has been engaged in a multi-year project to create and deploy a new and improved Internet Routing Registry (IRR). On 10 June 2020 (https://www.arin.net/announcements/20200610-irr/) we launched IRR-online, an authenticated and web-based service designed to make it simple for users to publish routing information via ARIN’s website. At that time, the existing IRR-email system was temporarily left in place to allow organizations to continue using email-based updates to publish routing information (in the ARIN-NONAUTH data stream). On 1 February 2021 (https://www.arin.net/announcements/20210201-rn/) we deployed a RESTful API to provide a way to securely automate updates to objects in ARIN’s authenticated IRR service. With the availability of automation for ARIN’s new IRR system, we intend to retire ARIN’s previous non-authenticated, email-based IRR service at the end of September 2021. We are providing advance notice of this plan so that organizations using the non-authenticated and email-based IRR will have time to switch publication of their routing registry information to a more current solution. Similarly, by establishing a firm end date for the non-authenticated and email-based IRR, organizations making use of the outdated and non-authenticated IRR data stream can be ready for when ARIN ceases publishing the ARIN-NONAUTH data stream. The authenticated IRR is available to all ARIN resource holders that have resources covered by a signed Registration Services Agreement (RSA) or Legacy Registration Services Agreement (LRSA). Organizations with resources not currently under an RSA/LRSA that wish to use the authenticated IRR may contact ARIN’s Registration Services Department for assistance with bringing those registrations under an RSA/LRSA. We recognize that this change will have significant impacts on our customers and, as always, we’re interested in your feedback regarding this proposed transition. In particular, we would appreciate hearing from the ARIN community regarding these aspects of the proposed transition: 1. For those using ARIN’s email-based and non-authenticated IRR system, does the proposed shutdown date of 30 September 2021 provide sufficient time for migration to another IRR system? 2. For those making use of the ARIN-NONAUTH data stream, is there any reason to provide this information beyond the system shutdown date? The community feedback provided during this consultation will help inform how we move forward. Please provide comments to arin-consult(a)arin.net<mailto:arin-consult@arin.net>. You can subscribe to this mailing list at: http://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on Monday, 8 March. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN)

2 4

Re: [EXTERNAL] Re: Retalitory DDoS
by Compton, Rich A 08 Feb '21

08 Feb '21

FYI, that looks like a Web Services Dynamic Discovery UDP amplification DDoS attack. https://blogs.akamai.com/sitr/2019/09/new-ddos-vector-observed-in-the-wild-… Very easily executed by a booter service. You may want to have your hosting provider block all inbound traffic from reaching your server IP except TCP port 443 (or 80 or whatever port you actually use) somewhere upstream. This can help reduce the impact of DDoS attacks on your server. -Rich From: NANOG <nanog-bounces+rich.compton=charter.com(a)nanog.org> on behalf of Mike Hammett <nanog(a)ics-il.net> Date: Monday, February 8, 2021 at 10:58 AM To: Jean St-Laurent <jean(a)ddostest.me> Cc: NANOG list <nanog(a)nanog.org> Subject: [EXTERNAL] Re: Retalitory DDoS CAUTION: The e-mail below is from an external source. Please exercise caution before opening attachments, clicking links, or following guidance. I don't have RTBH, no. It's just a web server. Now how my hosting provider handled it, I'm not sure. I don't know if they just dropped me internally, or if they used RTBH with their upstreams and peers. Only being 2.5 gigs, that should be well within their ability to handle internally, but I guess why would you if you didn't have to? ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Jean St-Laurent" <jean(a)ddostest.me> To: "Mike Hammett" <nanog(a)ics-il.net> Cc: "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 11:53:43 AM Subject: RE: Retalitory DDoS You got RTBH? From: Mike Hammett <nanog(a)ics-il.net> Sent: February 8, 2021 12:50 PM To: Jean St-Laurent <jean(a)ddostest.me> Cc: NANOG list <nanog(a)nanog.org> Subject: Re: Retalitory DDoS In my case, it was against a server not on my own network, so my impact was a blackhole for an hour at 4 AM local time. I likely wouldn't have even noticed it, had I not received the threat email, nor the ticket my web host's NOC opened. ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Jean St-Laurent" <jean(a)ddostest.me> To: "Mike Hammett" <nanog(a)ics-il.net>, "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 11:42:12 AM Subject: RE: Retalitory DDoS Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me(a)nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog(a)nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437<callto:1259961437> Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Mike Hammett" <nanog(a)ics-il.net> To: "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

3 2

Spoofer Report for NANOG for Jan 2021
by CAIDA Spoofer Project 08 Feb '21

08 Feb '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Jan 2021: ASN Name Fixed-By 54825 PACKET 2021-01-12 7859 PAIR-NETWORKS 2021-01-31 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jan 2021: ASN Name First-Spoofed Last-Spoofed 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2021-01-25 7459 GRANDECOM-AS1 2016-09-26 2021-01-28 20412 CLARITY-TELECOM 2016-09-30 2021-01-31 6181 FUSE-NET 2016-10-10 2021-01-31 14971 PINETEL 2016-10-21 2021-01-30 11427 TWC-11427-TEXAS 2016-10-21 2021-01-27 30036 MEDIACOM-ENTERPRISE-BUSINESS 2016-11-16 2021-01-29 63296 AWBROADBAND 2017-09-01 2021-01-27 12222 AKAMAI 2018-02-14 2021-01-14 393564 SPOKANE 2018-06-05 2021-01-26 33452 RW 2018-09-19 2021-01-30 20448 VPNTRANET-LLC 2018-09-20 2021-01-28 8047 GCI 2019-04-11 2021-01-29 6391 URBAN-15 2020-05-29 2021-01-09 11814 DISTRIBUTEL-AS11814 2020-11-22 2021-01-16 208188 PUGET-SOUND-NETWORKS 2020-12-04 2021-01-30 13886 CLOUD-SOUTH 2021-01-05 2021-01-05 33749 ATMC 2021-01-05 2021-01-05 7885 YUKONCOLLEGE 2021-01-14 2021-01-22 53703 KWIKOM 2021-01-17 2021-01-26 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Merhaba
by M. Omer GOLGELI 06 Feb '21

06 Feb '21

Selamlar M. Omer GOLGELI --- AS202365 https://as202365.peeringdb.com https://bgp.he.net/AS202365 NOC: Phone: +90-533-2600533 Email: omer(a)chronos.com.tr

1 0