November 2012 - Test - lists.nanog.org

Indonesian ISP Moratel announces Google's prefixes
by Anurag Bhatia 07 Nov '12

07 Nov '12

Another case of route hijack - http://blog.cloudflare.com/why-google-went-offline-today-and-a-bit-about I am curious if big networks have any pre-defined filters for big content providers like Google to avoid these? I am sure internet community would be working in direction to somehow prevent these issues. Curious to know developments so far. Thanks. -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia>| Google+ <https://plus.google.com/118280168625121532854>

9 14

AS 1668 BGP contact - possible prefix hijacking
by Ben Bartsch 07 Nov '12

07 Nov '12

Hi: Is there anyone here who can help us with a possible prefix hijacking situation through ATDN? Please contact me off list if you (or you know somebody) that can help us. I've tried the ATDN NOC and Vikas, but they have been no help whatsoever. The hijacked prefix appears to be sent to AS 1668, then propagated from there. Thanks. Ben AS 32440

2 2

Sandy seen costing telco, cable hundreds of millions of dollars
by Roy 07 Nov '12

07 Nov '12

http://www.reuters.com/article/2012/11/01/storm-sandy-telecoms-idUSL1E8M1L9…

3 2

Re: Overview on Defending DDoS attack
by Dobbins, Roland 07 Nov '12

07 Nov '12

On Nov 7, 2012, at 5:56 PM, Mohamed Al-fateh wrote: > Could you please share them with us or direct us to other good resources for that <https://www.box.com/s/4h2l6f4m8is6jnwk28cg> ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> Luck is the residue of opportunity and design. -- John Milton

1 0

Re: Indonesian ISP Moratel announces Google's prefixes
by Anurag Bhatia 07 Nov '12

07 Nov '12

OK one quick question here - Moratel leaked route and thus for a portion of internet route to Google was via Moratel but was a path. What caused 100% outage I.e all four authoritative DNS servers and open resolver service too ? Can we just guess that due to ultra high traffic path between Moratel and Google was checked ? Or there's a chance that some customer of Moratel announced prefix using Google's ASN at first place. Hard to believe why they would have set bgp session in first place with wrong asn but was curious to know if that is also a possibility? Thanks (Sent from my mobile device) Anurag Bhatia http://anuragbhatia.com On Nov 7, 2012 12:22 PM, "Patrick W. Gilmore" <patrick(a)ianai.net> wrote: > On Nov 07, 2012, at 01:29 , Anurag Bhatia <me(a)anuragbhatia.com> wrote: > > > Apologize for calling it an prefix hijack. I misunderstood in start. > Clearly it was case of prefix leaking. > > No worries. I should have read more closely. > > -- > TTFN, > patrick > >

2 1

Re: Indonesian ISP Moratel announces Google's prefixes
by Hank Nussbacher 07 Nov '12

07 Nov '12

At 21:21 06/11/2012 -0800, Jian Gu wrote: If Google announces 8.8.8.0/24 to you and you in turn start announcing to the Internet 8.8.8.0/24 as originating from you, then a certain section of the Internet will believe your announcement over Google's. This has happened many times before due to improper filters, but this is the first time I have seen the victim being blamed. Interesting concept. -Hank >I don't know what Google and Moratel's peering agreement, but "leak"? >educate me, Google is announcing /24 for all of their 4 NS prefix and >8.8.8.0/24 for their public DNS server, how did Moratel leak those routes >to Internet? > >On Tue, Nov 6, 2012 at 9:13 PM, Patrick W. Gilmore <patrick(a)ianai.net>wrote: > > > On Nov 07, 2012, at 00:07 , Jian Gu <guxiaojian(a)gmail.com> wrote: > > > > > Where did you get the idea that a Moratel customer announced a > > google-owned > > > prefix to Moratel and Moratel did not have the proper filters in place? > > > according to the blog, all google's 4 authoritative DNS server networks > > and > > > 8.8.8.0/24 were wrongly routed to Moratel, what's the possiblity for a > > > Moratel customers announce all those prefixes? > > > > Ah, right, they just leaked Google's prefix. I thought a customer > > originated the prefix. > > > > Original question still stands. Which attribute do you expect Google to > > set to stop this? > > > > Hint: Don't say No-Advertise, unless you want peers to only talk to the > > adjacent AS, not their customers or their customers' customers, etc. > > > > Looking forward to your answer. > > > > -- > > TTFN, > > patrick > > > > > > > On Tue, Nov 6, 2012 at 9:02 PM, Patrick W. Gilmore <patrick(a)ianai.net > > >wrote: > > > > > >> On Nov 06, 2012, at 23:48 , Jian Gu <guxiaojian(a)gmail.com> wrote: > > >> > > >>> What do you mean hijack? Google is peering with Moratel, if Google does > > >> not > > >>> want Moratel to advertise its routes to Moratel's peers/upstreams, then > > >>> Google should've set the correct BGP attributes in the first place. > > >> > > >> That doesn't make the slightest bit of sense. > > >> > > >> If a Moratel customer announced a Google-owned prefix to Moratel, and > > >> Moratel did not have the proper filters in place, there is nothing > > Google > > >> could do to stop the hijack from happening. > > >> > > >> Exactly what attribute do you think would stop this? > > >> > > >> -- > > >> TTFN, > > >> patrick > > >> > > >> > > >>> On Tue, Nov 6, 2012 at 3:35 AM, Anurag Bhatia <me(a)anuragbhatia.com> > > >> wrote: > > >>> > > >>>> Another case of route hijack - > > >>>> > > >> > > http://blog.cloudflare.com/why-google-went-offline-today-and-a-bit-about > > >>>> > > >>>> > > >>>> > > >>>> I am curious if big networks have any pre-defined filters for big > > >> content > > >>>> providers like Google to avoid these? I am sure internet community > > >> would be > > >>>> working in direction to somehow prevent these issues. Curious to know > > >>>> developments so far. > > >>>> > > >>>> > > >>>> > > >>>> > > >>>> Thanks. > > >>>> > > >>>> > > >>>> -- > > >>>> > > >>>> Anurag Bhatia > > >>>> anuragbhatia.com > > >>>> > > >>>> Linkedin <http://in.linkedin.com/in/anuragbhatia21> | > > >>>> Twitter<https://twitter.com/anurag_bhatia>| > > >>>> Google+ <https://plus.google.com/118280168625121532854> > > >>>> > > >>> > > >> > > >> > > >> > > > > > >

4 4

Re: Indonesian ISP Moratel announces Google's prefixes
by Hank Nussbacher 07 Nov '12

07 Nov '12

At 20:48 06/11/2012 -0800, Jian Gu wrote: Ahhh...blame the victim. Google - shame on you. -Hank >What do you mean hijack? Google is peering with Moratel, if Google does not >want Moratel to advertise its routes to Moratel's peers/upstreams, then >Google should've set the correct BGP attributes in the first place. > >On Tue, Nov 6, 2012 at 3:35 AM, Anurag Bhatia <me(a)anuragbhatia.com> wrote: > > > Another case of route hijack - > > http://blog.cloudflare.com/why-google-went-offline-today-and-a-bit-about > > > > > > > > I am curious if big networks have any pre-defined filters for big content > > providers like Google to avoid these? I am sure internet community would be > > working in direction to somehow prevent these issues. Curious to know > > developments so far. > > > > > > > > > > Thanks. > > > > > > -- > > > > Anurag Bhatia > > anuragbhatia.com > > > > Linkedin <http://in.linkedin.com/in/anuragbhatia21> | > > Twitter<https://twitter.com/anurag_bhatia>| > > Google+ <https://plus.google.com/118280168625121532854> > >

1 0

p2p addresses for point-to-point connections with customers
by Tassos Chatzithomaoglou 07 Nov '12

07 Nov '12

I've been trying hard to come up with a solution regarding this, but i haven't decided yet which one is the best. >From the perspective of an ISP, how do you characterize the p2p addresses given for a point-to-point connection to a) customers with their own ASN b) customers without an ASN? These are ip addresses configured on your router's border interface and on the customer's peer router interface (old WAN-style), so they actually are both infrastructure and customer addresses. So... Do you consider them infrastructure addresses or customer addresses? Do you put them in your IGP or in BGP? Do you filter them on your border routers (via iACLs) and if yes, how? -- Tassos

5 8

Unable to reach www.t-online.de over IPv6 since late September
by Frank Bulk 07 Nov '12

07 Nov '12

For 42 days we have not been able to reach www.t-online.de over IPv6. C:\>tracert -6 www.t-online.de Tracing route to www.t-online.de [2003:2:2:40:62:153:159:92] over a maximum of 30 hops: 1 4 ms 3 ms 2 ms router-core.mtcnet.net [2607:fe28:11:1000::2] 2 3 ms 3 ms 2 ms sxct.sxcy.mtcnet.net [2607:fe28:11:1002::197] <snip> 8 24 ms 23 ms 22 ms sl-crs2-chi-te1-2-0-1.v6.sprintlink.net [2600:4::6] 9 31 ms 30 ms 30 ms sl-crs2-akr-bu-2.v6.sprintlink.net [2600:0:2:1239:144:232:20:186] 10 41 ms 41 ms 39 ms sl-crs2-rly-bu-2.v6.sprintlink.net [2600:0:2:1239:144:232:4:187] 11 40 ms 40 ms 39 ms sl-crs2-dc-po0-9-0-0.v6.sprintlink.net [2600:0:2:1239:144:232:25:128] 12 42 ms 42 ms 41 ms sl-st31-ash-po0-2-0-0.v6.sprintlink.net [2600:0:2:1239:144:232:25:15] 13 * * * Request timed out. 14 * * * Request timed out. 15 * * * Request timed out. DT (Deutsche Telekom) is not learning our routes (AS53347) or the routes of our upstream provider (AS5056). DT's looking glass (https://f-lga1.f.de.net.dtag.de/index.php?pageid=lg) confirms that: sh ipv6 bgp 2607:fe28::/32 % Network not in table sh ipv6 bgp 2001:05f8::/32 % Network not in table Our prefix goes over our upstream provider's transit link with Sprint, so on September 26 our upstream provider opened up a ticket with Sprint. From what our upstream provider tells us, Sprint is advertising our routes to DT but DT has an IPv6 prefix that is blocking all of Sprint's customer prefixes. It's almost been a month since the last substantive update from DT (via our upstream provider, via Sprint). If anybody is able to help and shake something loose at DT, that would be appreciated. For the right people, I can provide both Sprint and DT's ticket numbers. Thanks, Frank

1 0

UK Scientists Claim to Develop 2000 Times Faster Broadband via Fibre Optic
by Eugen Leitl 06 Nov '12

06 Nov '12

http://www.ispreview.co.uk/index.php/2012/11/uk-scientists-claim-to-develop… UK Scientists Claim to Develop 2000 Times Faster Broadband via Fibre Optic Posted Tuesday, November 6th, 2012 (11:08 am) by Mark Jackson (Score 746) A team of scientists working out of Bangor University in Wales has developed a commercially affordable method of using Optical Orthogonal Frequency Division Multiplexing (OOFDM) over fibre optic lines, which could deliver broadband ISP speeds that are 2,000 times faster than current services. But the three-year project (OCEAN) is not the first to make use of OOFDM, which typically splits a laser down to multiple different optical frequencies. The data can then be broken up and sent in parallel streams via the different frequencies. Last year a team of Sydney University scientists found an energy-efficient way of using a single laser to transfer data down a 50km long single-mode fibre optic cable at speeds of up to 26Tbps (Terabits per second). The key difference with OCEAN is that this work is capable of “significantly saving the network installation and maintenance cost for both [ISPs] and equipment vendors” by using low-cost off-the-shelf components and end-to-end real-time OOFDM transceivers via currently installed fibre networks (FTTH etc.). It also provides a “Green” solution due to the “significant reduction in electrical power consumption“. The work is also more targeted towards home and business connections, as opposed to undersea cables, most of which tend to offer broadband speeds of less than 100Mbps; currently only a few UK FTTH ISPs offer up to 1Gbps and most suffer from very limited coverage. Professor Jianming Tang explained: “Compared to today’s commercially available broadband connections, the technology is expected to provide end-users with both downloading and uploading speeds up to 2,000 times faster than current speeds and with a guaranteed quality of services at a price that subscribers are currently paying for their current 20Mb/s services, regardless of subscribers’ home location. Obviously, this will revolutionise communication technology.” However there’s still the little matter of capacity supply costs and Traffic Management measures to consider, although the university’s efforts bode well for the future and could help a new generation of truly fibre optic ISPs to improve their service without incurring excessive additional costs. On the other hand most of today’s connections are still being delivered over older and slower copper based broadband lines. This is gradually beginning to change and the situation could look very different in another ten or twenty years’ time. According to Bangor University, OCEAN is a partnership project (funded by the European Union (3m Euros+)) that includes several major global telecoms firms; Fujitsu Semiconductors Europe, Finisar Israel, Fraunhofer Heinrich Hertz Institute and VPIsystems GmbH.

1 0