- Test - lists.nanog.org

Ingress filtering from an external cloud service to the internal network
by Torres, Matt 05 May '17

05 May '17

NANOG, We have a hybrid cloud model that includes an external cloud service that needs to reach back into our internal network. The application documentation states that this connection cannot go through a proxy server. I am not in a position to redesign this solution or change the parameters. My question to NANOG is how to manage (filter/secure) the ingress traffic from the external cloud service. Past network guy managed inbound firewall rules based on the cloud-providers source IP address, but this wasn't sustainable and led to multiple outages as the external (source) IP has changed from time to time. I can define the destination ports well enough, but not the source IP addresses. Any ideas on how I can filter this type of inbound traffic from an internet-based service? Thanks Matt

4 7

Question about experiences with BGP remote-AS
by LF OD 05 May '17

05 May '17

We have a number of small routers in co-lo sites that peer with B2B partners. As more of our partners move to cloud, we are considering a consolidation effort and putting all of our peering routers in a cloud exchange site on a single HA pair of routers. Now, each existing B2B peering router uses a unique private ASN to EBGP peer with partners and they, in turn, EBGP peer with our extranet perimeter ASNs for security vetting and other stuff. We looked for a medium-density router (or L3-switch) that can replace multiple small routers (b2b-only, no internet), but we need to retain all of our existing ASNs and peerings. As it turns out, there are many routers that can do VRFs but you cannot put a unique ASN on each VRF so replicating the old environment isn't quite that straightforward. The BGP remote-as looks to be a possible alternative solution, but we've never used it in production and we are unsure of the caveats. Taken at face value, it looks like we can mimic the multi-router/unique-ASN environment we have today on a single platform. However, networking is rarely as smooth as that so I'm asking some of the BGP gurus... what are the pros/cons of doing using remote-as? If anyone here uses it extensively, we could really use some feedback if you run into challenges or hidden surprises that we wouldn't normally think of beforehand. Thanks in advance! LFOD

4 3

Weekly Routing Table Report
by cscora＠apnic.net 05 May '17

05 May '17

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, MENOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 06 May, 2017 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 647110 Prefixes after maximum aggregation (per Origin AS): 252103 Deaggregation factor: 2.57 Unique aggregates announced (without unneeded subnets): 311926 Total ASes present in the Internet Routing Table: 57065 Prefixes per ASN: 11.34 Origin-only ASes present in the Internet Routing Table: 49371 Origin ASes announcing only one prefix: 21886 Transit ASes present in the Internet Routing Table: 7694 Transit-only ASes present in the Internet Routing Table: 219 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 40 Max AS path prepend of ASN ( 55644) 36 Prefixes from unregistered ASNs in the Routing Table: 71 Numnber of instances of unregistered ASNs: 75 Number of 32-bit ASNs allocated by the RIRs: 18434 Number of 32-bit ASNs visible in the Routing Table: 14310 Prefixes from 32-bit ASNs in the Routing Table: 57955 Number of bogon 32-bit ASNs visible in the Routing Table: 45 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 409 Number of addresses announced to Internet: 2843460964 Equivalent to 169 /8s, 123 /16s and 197 /24s Percentage of available address space announced: 76.8 Percentage of allocated address space announced: 76.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.6 Total number of prefixes smaller than registry allocations: 216869 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 176804 Total APNIC prefixes after maximum aggregation: 50891 APNIC Deaggregation factor: 3.47 Prefixes being announced from the APNIC address blocks: 175990 Unique aggregates announced from the APNIC address blocks: 72729 APNIC Region origin ASes present in the Internet Routing Table: 8063 APNIC Prefixes per ASN: 21.83 APNIC Region origin ASes announcing only one prefix: 2243 APNIC Region transit ASes present in the Internet Routing Table: 1131 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 40 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2888 Number of APNIC addresses announced to Internet: 763094372 Equivalent to 45 /8s, 123 /16s and 229 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 197305 Total ARIN prefixes after maximum aggregation: 94097 ARIN Deaggregation factor: 2.10 Prefixes being announced from the ARIN address blocks: 199402 Unique aggregates announced from the ARIN address blocks: 91373 ARIN Region origin ASes present in the Internet Routing Table: 17899 ARIN Prefixes per ASN: 11.14 ARIN Region origin ASes announcing only one prefix: 6640 ARIN Region transit ASes present in the Internet Routing Table: 1780 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1953 Number of ARIN addresses announced to Internet: 1108934048 Equivalent to 66 /8s, 24 /16s and 253 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 174832 Total RIPE prefixes after maximum aggregation: 85064 RIPE Deaggregation factor: 2.06 Prefixes being announced from the RIPE address blocks: 170401 Unique aggregates announced from the RIPE address blocks: 102059 RIPE Region origin ASes present in the Internet Routing Table: 23966 RIPE Prefixes per ASN: 7.11 RIPE Region origin ASes announcing only one prefix: 11062 RIPE Region transit ASes present in the Internet Routing Table: 3404 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 28 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5787 Number of RIPE addresses announced to Internet: 711675008 Equivalent to 42 /8s, 107 /16s and 76 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 81148 Total LACNIC prefixes after maximum aggregation: 18204 LACNIC Deaggregation factor: 4.46 Prefixes being announced from the LACNIC address blocks: 82370 Unique aggregates announced from the LACNIC address blocks: 38448 LACNIC Region origin ASes present in the Internet Routing Table: 5852 LACNIC Prefixes per ASN: 14.08 LACNIC Region origin ASes announcing only one prefix: 1620 LACNIC Region transit ASes present in the Internet Routing Table: 1079 Average LACNIC Region AS path length visible: 5.4 Max LACNIC Region AS path length visible: 31 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 3370 Number of LACNIC addresses announced to Internet: 169866464 Equivalent to 10 /8s, 31 /16s and 244 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 16916 Total AfriNIC prefixes after maximum aggregation: 3786 AfriNIC Deaggregation factor: 4.47 Prefixes being announced from the AfriNIC address blocks: 18538 Unique aggregates announced from the AfriNIC address blocks: 6966 AfriNIC Region origin ASes present in the Internet Routing Table: 1039 AfriNIC Prefixes per ASN: 17.84 AfriNIC Region origin ASes announcing only one prefix: 321 AfriNIC Region transit ASes present in the Internet Routing Table: 207 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 23 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 312 Number of AfriNIC addresses announced to Internet: 89454848 Equivalent to 5 /8s, 84 /16s and 249 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5567 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3785 393 271 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2932 901 79 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2762 11150 758 KIXS-AS-KR Korea Telecom, KR 9829 2732 1499 539 BSNL-NIB National Internet Backbone, IN 9808 2212 8698 33 CMNET-GD Guangdong Mobile Communication 4755 2079 421 222 TATACOMM-AS TATA Communications formerl 45899 1983 1388 110 VNPT-AS-VN VNPT Corp, VN 7552 1588 1101 55 VIETEL-AS-AP Viettel Corporation, VN 9583 1573 121 541 SIFY-AS-IN Sify Limited, IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 4008 2969 153 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3361 1333 80 SHAW - Shaw Communications Inc., CA 18566 2182 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2069 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 2006 2153 405 CHARTER-NET-HKY-NC - Charter Communicat 209 1828 5067 633 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 16509 1786 3422 571 AMAZON-02 - Amazon.com, Inc., US 30036 1751 322 338 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 6983 1692 854 230 ITCDELTA - Earthlink, Inc., US 701 1567 10579 639 UUNET - MCI Communications Services, In Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3338 187 22 ALJAWWALSTC-AS, SA 8551 3224 377 41 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2880 1006 2063 AKAMAI-ASN1, US 9121 2659 1691 18 TTNET, TR 34984 2007 328 385 TELLCOM-AS, TR 13188 1596 99 56 TRIOLAN, UA 12479 1566 1044 52 UNI2-AS, ES 12389 1484 1357 610 ROSTELECOM-AS, RU 9198 1322 352 25 KAZTELECOM-AS, KZ 6849 1226 355 21 UKRTELNET, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3536 544 172 Telmex Colombia S.A., CO 8151 2517 3396 562 Uninet S.A. de C.V., MX 11830 2081 369 57 Instituto Costarricense de Electricidad 7303 1557 1005 247 Telecom Argentina S.A., AR 6503 1540 437 53 Axtel, S.A.B. de C.V., MX 6147 1267 377 27 Telefonica del Peru S.A.A., PE 28573 1083 2286 179 CLARO S.A., BR 3816 1018 495 186 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 921 126 80 Alestra, S. de R.L. de C.V., MX 18881 892 1052 23 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1209 398 48 LINKdotNET-AS, EG 36903 712 357 134 MT-MPLS, MA 37611 704 67 7 Afrihost, ZA 36992 625 1375 26 ETISALAT-MISR, EG 24835 496 722 14 RAYA-AS, EG 37492 408 319 74 ORANGE-, TN 8452 407 1730 17 TE-AS TE-AS, EG 29571 367 36 10 CITelecom-AS, CI 15399 348 35 7 WANANCHI-, KE 2018 287 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5567 4190 74 ERX-CERNET-BKB China Education and Rese 22773 4008 2969 153 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 7545 3785 393 271 TPG-INTERNET-AP TPG Telecom Limited, AU 10620 3536 544 172 Telmex Colombia S.A., CO 6327 3361 1333 80 SHAW - Shaw Communications Inc., CA 39891 3338 187 22 ALJAWWALSTC-AS, SA 8551 3224 377 41 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 17974 2932 901 79 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2880 1006 2063 AKAMAI-ASN1, US 4766 2762 11150 758 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 4008 3855 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7545 3785 3514 TPG-INTERNET-AP TPG Telecom Limited, AU 10620 3536 3364 Telmex Colombia S.A., CO 39891 3338 3316 ALJAWWALSTC-AS, SA 6327 3361 3281 SHAW - Shaw Communications Inc., CA 8551 3224 3183 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 17974 2932 2853 TELKOMNET-AS2-AP PT Telekomunikasi Indonesia, I 9121 2659 2641 TTNET, TR 9829 2732 2193 BSNL-NIB National Internet Backbone, IN 9808 2212 2179 CMNET-GD Guangdong Mobile Communication Co.Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65602 UNALLOCATED 8.225.192.0/24 30372 SUNESYS2 - Sunesys, LLC, US 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65001 PRIVATE 46.237.32.0/20 13118 ASN-YARTELECOM PJSC Rostelecom Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.167.128.0/24 395774 UNKNOWN 27.100.7.0/24 56096 UNKNOWN 36.255.248.0/24 64091 CORONET-BD Coronet Corporation Ltd., BD 36.255.250.0/24 64091 CORONET-BD Coronet Corporation Ltd., BD 41.76.232.0/21 203496 AB-TELECOM, RU 41.77.248.0/21 203496 AB-TELECOM, RU 41.78.12.0/23 203496 AB-TELECOM, RU 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.242.132.0/23 203496 AB-TELECOM, RU 43.224.140.0/24 38197 SUNHK-DATA-AS-AP Sun Network (Hong Kong) Limited - Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:15 /9:13 /10:36 /11:103 /12:280 /13:545 /14:1043 /15:1841 /16:13455 /17:7571 /18:13417 /19:24717 /20:38416 /21:41248 /22:76405 /23:63583 /24:362203 /25:846 /26:620 /27:627 /28:44 /29:29 /30:25 /31:1 /32:27 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 22773 3162 4008 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 6327 3155 3361 SHAW - Shaw Communications Inc., CA 39891 2898 3338 ALJAWWALSTC-AS, SA 8551 2686 3224 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 18566 2075 2182 MEGAPATH5-US - MegaPath Corporation, US 9121 1905 2659 TTNET, TR 30036 1554 1751 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 11830 1475 2081 Instituto Costarricense de Electricidad y Telec 10620 1464 3536 Telmex Colombia S.A., CO 6389 1375 2069 BELLSOUTH-NET-BLK - BellSouth.net Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1607 2:817 4:26 5:2438 6:34 8:1077 12:1833 13:116 14:1786 15:26 16:2 17:121 18:120 19:1 20:56 23:2256 24:1864 25:2 27:2412 31:1915 32:89 33:7 35:20 36:398 37:2581 38:1348 39:44 40:97 41:3006 42:468 43:1909 44:72 45:2565 46:2744 47:116 49:1195 50:976 51:18 52:807 54:360 55:4 56:4 57:41 58:1581 59:1039 60:387 61:1907 62:1532 63:1919 64:4580 65:2212 66:4556 67:2239 68:1227 69:3350 70:1317 71:583 72:2193 74:2666 75:382 76:427 77:1484 78:1657 79:2067 80:1376 81:1410 82:985 83:729 84:869 85:1798 86:481 87:1159 88:836 89:2078 90:169 91:6162 92:1009 93:2386 94:2328 95:2859 96:606 97:359 98:1005 99:85 100:156 101:1260 103:14549 104:2862 105:177 106:498 107:1640 108:811 109:3421 110:1330 111:1738 112:1174 113:1216 114:1036 115:1785 116:1777 117:1724 118:2157 119:1581 120:1006 121:1101 122:2236 123:1786 124:1540 125:1870 128:744 129:627 130:440 131:1391 132:526 133:190 134:620 135:219 136:515 137:435 138:1932 139:476 140:375 141:564 142:741 143:972 144:780 145:177 146:1036 147:659 148:1387 149:568 150:710 151:957 152:754 153:297 154:793 155:740 156:581 157:621 158:448 159:1444 160:581 161:748 162:2488 163:524 164:793 165:1201 166:385 167:1246 168:2608 169:779 170:3197 171:300 172:979 173:1855 174:819 175:735 176:1840 177:4109 178:2468 179:1144 180:2196 181:1857 182:2330 183:983 184:856 185:9555 186:3202 187:2231 188:2631 189:1793 190:8149 191:1317 192:9380 193:5785 194:4651 195:3847 196:2080 197:1239 198:5516 199:5881 200:7340 201:4332 202:10342 203:9865 204:4468 205:2798 206:3009 207:3129 208:4015 209:3970 210:3957 211:2134 212:2815 213:2496 214:878 215:65 216:5768 217:2079 218:839 219:608 220:1653 221:908 222:758 223:1177 End of report

1 0

Static IP allocation schemes for end users (commercial)
by Graham Johnston 05 May '17

05 May '17

I work for a cable MSO, meaning that our access network is DOCSIS based. 15 years ago when we had way more IP addresses than customers we had a static IP allocation scheme wherein we aligned a /24 with each node and reserved the first 20 or so IPs for static assignment, the rest being left for dynamic assignment. The primary reason behind this scheme was that as the network grew and a node moved from one CMTS to another we could pull the /24 with it and customers wouldn't have to re-address. As our network has grown, in terms of the number of nodes, as well as the number of IPs in use we've come to the obvious conclusion that the old scheme isn't workable into the future. For instance I will soon have more nodes in service than I have /24s allocated to me. Instead we are entertaining two basic options as an alternative. * Create static reservations, as required, within the otherwise dynamic range. * Whether or not the customer continues to DHCP or assigns the IP statically doesn't matter to me. * Move to having a single subnet, or portion therein, per CMTS. This keeps the process more or less identical to what we do now. Both of the schemes above would require the customer to undergo addressing changes in the event that we move their node between CMTSs in the future. Can anyone else share what they are doing or otherwise identify if there is a best practice in this area? Thanks, Graham

1 0

Retarus (AS 48328)
by Martin Hannigan 05 May '17

05 May '17

I hate to do this, but I have exhausted _all of my sources of data including the SOA (points at VRSN) and domain name contact addresses for: Registrant Name: Retarus GmbH Registrant Organization: Retarus GmbH Registrant Street: Aschauerstrasse 30 Registrant City: Muenchen Registrant State/Province: Bav Registrant Postal Code: 81549 Registrant Country: DE I worked backwards from a domain name of RMX.DE. I don't know what the distinction is other than this name perhaps being an operational domain for their mail security services. If someone has a pointer or can do an offline introduction to someone in tech-ops or networking there, I'd appreciate it. Best, -M<

2 2

TCP over fragmented IPv6 dropped in Comcast's network
by Clint Armstrong 05 May '17

05 May '17

In troubleshooting why a DNS zone transfer fails over IPv6 from a DNS master hosted on a Comcast connection, I've discovered that a router in Comcast's network is IPv6 Fragments with TCP headers. More specifically it appears that this router silently drops any packet with a non-zero fragment offset, followed by a tcp header. Packets with a fragment offset followed by a udp header, or anything else, are passed just fine. Also, fragments sent in the opposite direction, from outside Comcast coming in, are passed just fine. I believe I was able to determine the problematic router by using the sendip tool to generate these dropped packets and increasing the TTL on the packet until I no longer got an ICMPv6 unreachable response from the next hop. If anyone else with a Comcast IPv6 connection would like to test and see if your connections are affected by this issue, here is how you can test. First you need sendip version 2.5-mec-3a2 with the frag.so module. Start tcpdump or wireshark looking for ICMPv6 Time Exceeded messages. Then send test packets to any destination IP you'd like to test a route to using the command `sendip <dest_addr> -p ipv6 -6s <source_addr> -6h 2 -p frag -Fo 1 -p tcp` Increment the 6h value until you no longer get an ICMPv6 Time Exceeded response. At that point try removing the `-p tcp` parameter and see if that works. In my case, it does, demonstrating that this problematic router successfully passes IPv6 fragments without a TCP header. If anyone at Comcast would like to contact me off-list, I'll share more details of my findings, including the source address where I'm testing from, and what I believe is the problematic router.

1 0

Geolocation of o3b satellite end user terminals
by Eric Kuhnke 04 May '17

04 May '17

Since today seems like the day for IP geolocation related topics... Does anyone have direct experience with third-party IP geolocation services and o3b served enterprise/ISP-type high capacity customers? For those who are not familiar with them, o3b satellite terminals can be located literally anywhere in the world below 45 degrees north or south latitude, served from a fleet of MEO satellites. Each terminal is a twin pair of motorized/tracking antennas and associated modems, etc with an IP/Ethernet hand off to the customer. Their gateways to the Internet are located in about a dozen places around the globe and ordinarily go out to the Internet through o3b's own IP network.

2 1

Need someone from CenturyLink to fix urgent routing issue
by John Neiberger 04 May '17

04 May '17

Could someone from CenturyLink reach out to me off-list, please? You are currently hijacking some of our space and it is causing an active outage for many customers. We have someone calling in to CL support, as well, but we typically get a basic help desk that is slow to respond and this is a bit more urgent. Thanks! John

1 0

Financial services BGP hijack last week?
by valdis.kletnieks＠vt.edu 04 May '17

04 May '17

I didn't see any mention of this here. Any comments? "On Wednesday, large chunks of network traffic belonging to MasterCard, Visa, and more than two dozen other financial services companies were briefly routed through a Russian government-controlled telecom under unexplained circumstances that renew lingering questions about the trust and reliability of some of the most sensitive Internet communications." https://arstechnica.com/security/2017/04/russian-controlled-telecom-hijacks…

11 14

Question regarding geolocation
by Lars Andersson 04 May '17

04 May '17

Hello, I am helping a small Service Provider in Sweden and we have some issues with IP addresses having the wrong country in geolocation. They show up as Norwegian even though they should be Swedish. The site we have most problems with and try to solve is HBO. Can anyone maybe give some input as to how HBO update their geolocation info? Maybe a certain geolocation provider? We have contacted RIPE and they have acknowledged our addresses in the RIPE database as correctly setup with country object as SE. Furthermore the geolocation providers/sites we checked which show the correct info are ip2location, amakai, maxmind, ipinfo.io and EurekAPI. If anyone from HBO see this mail I would appreciate an off list response. Best regards Lars Andersson, Fiberdata

1 0