August 2012 - Test - lists.nanog.org

BGPttH. Neustar can do it, why can't we?
by jamie rishaw 23 Oct '12

23 Oct '12

discuss.

16 31

DNS caches that support partitioning ?
by John Levine 14 Oct '12

14 Oct '12

Are there DNS caches that allow you to partition the cache for subtrees of DNS names? That is, you can say that all entries from say, in-addr.arpa, are limited to 20% of the cache. The application I have in mind is to see if it helps to keep DNSBL traffic, which caches poorly, from pushing other stuff out of the cache, but there are doubtless others. R's, John

19 34

Verizon's New Repair Method: Plastic Garbage Bags
by Eric Wieling 11 Oct '12

11 Oct '12

For a while we have had a customer with some lines which go down every time it rains. We put in the trouble ticket, a couple of days later Verizon says the issue is resolved...until the next time it rains. The customer sent us some pictures today of the pole outside their office. The repair appears to be wrapping some plastic bags around something up on the pole. Here is link to the pictures the customer sent us, in case anyone in the mood for a good scare. http://rock.nyigc.net/verizon/

28 34

Another LTE network turns up as IPv4-only squat space + NAT
by Cameron Byrne 11 Oct '12

11 Oct '12

FYI http://www.dslreports.com/forum/r27324698-LTE-access-early- So much for next generation technology ... CB

17 26

Real world sflow vs netflow?
by David Hubbard 24 Sep '12

24 Sep '12

Can anyone on or off list give me some real world thoughts on sflow vs netflow for border routers? (multi-homed, BGP, straight v4 & v6 only for web hosting, no mpls, vpns, vlans, etc.) Finding it hard to decipher the vendor version of the answer to that question. We use netflow v9 currently but are considering hardware that would be sflow. We don't use it for billing purposes, mostly for spotting malicious remote hosts doing things like scans, spotting traffic such as weird ports in use in either direction that warrant further investigation, watching for ddos/dos destinations to act on mitigation, or investigating the nature of unusual levels of traffic on switch ports that set off alarms. I'm concerned things like port scans, etc. won't be picked up by the NMS if fed by sflow due to the sampling nature, or similar concern if 500 ssh connections by the same remote host are sampled as 1 connection, etc. Of course these concerns were put in my head by someone interested in me continuing to use equipment that happens to output netflow data, hence me wanting some real people answers. :-) Thanks!

15 34

"Circuit of the americas" aka COTA
by Chris McDonald 08 Sep '12

08 Sep '12

Trendy name for the new racetrack/event venue outside austin. Does anyone know how one might get connectivity there? I figure there must be a few folks here prepping the place for the upcoming formula 1. The place seems to be a black hole to all the usual suspects. tia, chris -- Sent from my mobile device

3 2

Level 3 BGP Advertisements
by Nick Olsen 05 Sep '12

05 Sep '12

Greetings all. In practice, We've always advertised our space all the way down to /24's but also the aggregate block (the /20 or the /21). Just so there was still reachability to our network in the event that someone made the foolish mistake of filtering lets say prefixes smaller /23... Anyways, I've always thought that was standard practice. And its never been a problem. Until we brought up peering with level 3.. I noticed that while the /24's made it out to the world. The larger counterparts (2 /21's and a /20) did not. So, I start sniffing around. Find that I do indeed see the prefixes in Level 3's looking glass but they aren't handing it off to peers. So, Naturally, I land on this being some kind of prefix filtering issue and open a ticket with Level 3. They tell me this is standard practice. And If I want to see the /20 or /21's make it out to the rest of the world, I need to stop sending the /24's. Does this sound normal? Is what I'm doing (Advertising the aggregate prefix) a good rule of thumb? Any other thoughts? Nick Olsen Network Operations (855) FLSPEED x106

19 21

91.201.64.0/22 hijacked?
by Jeroen van Aart 05 Sep '12

05 Sep '12

The below email exchange may be of interest to some of you. The practical upshot is that it appears "the 91.201.64.0/22 range was hijacked and should be included into the DROP list". As an interesting aside, quoting a friend: "the original company (that performed dangerous waste utilization) may have been a shady thing in and of itself (..) what most companies calling themselves "ecoservice" (with variations) do is take money for "safe utilisation" of hazardous waste, and then dump it in some old quarry out in the remote (or not so remote) corner of a forest or other natural area (..) they always have criminal links and protection from corrupts officials (often co-owners) and security/law enforcement services" > From: Jeroen van Aart > there is > nothing but crap coming from 91.201.64.0/24. Amongst other things > attempts to spam (through) wordpress sites. > inetnum: 91.201.64.0 - 91.201.67.255 > netname: Donekoserv > descr: DonEkoService Ltd Don - name of the nearby large river. "EkoService" means ecological service. > country: RU > org: ORG-DS41-RIPE > > person: Haralevich Piotr > address: novocherkassk, ul stremyannaya d.6 > mnt-by: MNT-DONECO > phone: +74951000000 nic-hdl: HP2220-RIPE changed: admin(a)donecoserv.ru 20101117 The company performed dangerous waste utilization: http://donekoservis.alloy.ru/contacts/ http://www.idbo.ru/view/72321/ But domains donecoserv.ru and donekoservis.ru don't exist anymore. traceroute 91.201.64.14 ... 11 router02.spbbm18.ru.edpnet.net (212.71.11.26) 65.979 ms 65.971 ms 66.182 ms 12 77.109.110.62.static.edpnet.net (77.109.110.62) 88.868 ms 47.809 ms 47.715ms 13 195.2.240.234 (195.2.240.234) 48.235 ms 48.546 ms 48.664 ms 14 ajursrv.parohod.biz (95.215.0.206) 47.957 ms 47.752 ms 47.606 ms 15 mail.rx-helps.com (91.201.64.14) 48.206 ms 48.302 ms 48.237 ms SPb (Sankt-Peterburg) is 1500 km from Novocherkassk. parohod.biz also is in Sankt-Peterburg, they offer SEO (which I consider fraud, spamming websites and search engines). Also, see http://support.clean-mx.de/clean-mx/viruses.php?email=admin@donecoserv.ru&r… http://www.spambotsecurity.com/forum/viewtopic.php?f=7&t=795 http://unapprovedpharmacy.wordpress.com/2011/01/03/whois-www-canadianmedssh… | January 3, 2011 ... | inetnum: 91.201.64.0 91.201.67.255 | netname: Donekoserv | descr: DonEkoService Ltd | country: RU | org: ORG-DS41-RIPE ... | organisation: ORG-DS41-RIPE | org-name: DonEko Service | org-type: OTHER | address: novocherkassk, ul stremyannaya d.6 | e-mail: admin(a)bulletproof-web.com Note "bulletproof". Therefore, the 91.201.64.0/22 range was hijacked and should be included into the DROP list.

3 2

Regarding smaller prefix for hijack protection
by Anurag Bhatia 04 Sep '12

04 Sep '12

Hello everyone! I tried looking on net but couldn't found direct answer, so thought to ask here for some advise. Is using /24 a must to protect (a bit) against route hijacking? We all remember case of YouTube 2008 and hijacking in Pakistan. At that time YouTube was using /22 and thus /24 (more specific) announcement took almost all of Google's traffic even when AS path was long. So Google's direct also likely sent packets to Pakistan. Later Google too used /24 (and I guess /25 too to effect some region of internet). Similar case I remember for issue reported between Altus and hijacking by someone connected to Cleaveland exchange when ISP was using /23 and spammer used /24. So can we conclude that one should always use /24 to make sure that they loose as little as possible traffic during prefix hijacking? Also, if one uses /22 and /24 - will both prefixes will show in Global routing table? I know /24 will be prefered but will ISP see /22 as well or it will pop up only when /24 is filtered? For one of IP's of Google.com, it seems it is coming from /16 and /24 http://bgp.he.net/ip/74.125.224.137 How can one print similar result from a route server like say Oregon route views or any ISP's server? I always /24 when looking for that IP. (in simple words - how bgp.he.net does this magic of popping both prefixes? I failed to do get same result from HE's route server) Thanks! -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia>| Google+ <https://plus.google.com/118280168625121532854>

9 9

Re: Color vision for network techs
by William Astle 04 Sep '12

04 Sep '12

On 12-08-31 08:15 AM, Berry Mobley wrote: > Hello, > > Do any of you do any color vision screening in your interview process? > How do those of you with color vision impairments compensate? I'd never > considered this until I was in one of our facilities with my son (who > has limited color vision) and we had a discussion about the LEDs. He > could only determine on/off - not amber/red/green on the equipment we > had. I'm wondering if we need a color vision requirement (or test) as > part of our hiring requirements. I'm red/green deficient. It's not total - I can identify high saturation reds and greens that cover a large enough area. However, it is enough that when I look at a multi-colour status indicator, I'm left scratching my head. Many times, I've said to myself, "There ought to be a law against using only the colour of light to indicate status." Of course, you know what they say about "there ought to be a law...." Screening for colour vision is dubious, no matter how much it would help with grokking the status lights. Even without the discrimination angle, consider that a very nontrivial proportion of men are colour deficient (on the order of 5% if my information is correct). You would be reducing your possible talent pool. Instead of a colour vision requirement or policy, I would start screaming at equipment manufacturers for using only the colour of an indicator to show information. A tristate can easily be shown with steady, slow blink, and fast blink if there really is some compelling reason not to have multiple indicators. If everyone, especially large organizations, put pressure on equipment manufacturers, the problem could be largely eliminated.

9 8