April 2013 - Test - lists.nanog.org

Wells Fargo getting DDoSed ?
by Jayram Déshpandé 05 Apr '13

05 Apr '13

I observed that since morning Wells Fargo web services are either not reachable or are really slow. I think they are getting DDoSed again. Any official information yet ? Regards, -Jay. -- "Subvert the paradigm." - C.K. Prahlad

3 2

Re: route for linx.net in Level3?
by Brian Dickson 05 Apr '13

05 Apr '13

Leo Bicknell wrote: Even if the exchange does not advertise the exchange LAN, it's probably the case that it is in the IGP (or at least IBGP) of everyone connected to it, and by extension all of their customers with a default route pointed at them. Actually, that may not be the case, and probably *should* not be the case. Here's why, in a nutshell: If two regional ISPs on either side of the planet, point default to the same Global ISP, even if they do not peer with that ISP, by using the IX next-hop at IX A (for ISP A), and IX B (for ISP B), then the Global ISP is now giving free on-net transit to A and B. So, it turns out that pretty much the only way to prevent this at a routing level, is to not carry IXP networks (in IGP or IBGP), but rather to do next-hop-self. The other way is to filter at a packet level on ingress, based on Layer 2 information, which on many kinds of IX-capable hardware, is actually impossible. So, when it comes to IXPs: Next-Hop-Self. (BCP 38 actually doesn't even enter into it, oddly enough.) Brian

6 7

route for linx.net in Level3?
by John Kemp 04 Apr '13

04 Apr '13

Having trouble reaching route-views.linx.routeviews.org from AS3582. I'm assuming that some folks stopped carrying this particular linx.net address prefix as of this morning. ?!? $ whois -h whois.cymru.com " -v 195.66.241.146" AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name 5459 | 195.66.241.146 | 195.66.240.0/22 | GB | ripencc | 1997-12-01 | LINX-AS London Internet Exchange Ltd. $ dig +short 146.241.66.195.peer.asn.cymru.com TXT "1299 2914 3257 10310 | 195.66.240.0/22 | GB | ripencc | 1997-12-01" -- John Kemp (kemp(a)routeviews.org) RouteViews Engineer NOC: noc(a)routeviews.org MAIL: help(a)routeviews.org WWW: http://www.routeviews.org

9 9

Microsoft Email Admin
by Cody Grosskopf 04 Apr '13

04 Apr '13

Can a Microsoft email admin contact me off list in regards to issues emailing a few of our domains? Thanks, Cody

1 0

Re: Speedtest Results speedtest.net vs Mikrotik bandwidth test
by Scott Weeks 04 Apr '13

04 Apr '13

--- nick(a)foobar.org wrote: From: Nick Hilliard <nick(a)foobar.org> >> They may do some magic with bandwidth delay products.. If that was the case, >> they may have written it for a standard latency versus something that is >> unreasonable by interweb standards. I don't know how they calculate bandwidth, but I was surprised that their system gave such wrong results under what were effectively lab conditions. ------------------------------------------ It'd be nice to know if NDT was not accurate as well. Anyone tested it? scott

4 3

RFC 1149
by Ed Schweitzer 04 Apr '13

04 Apr '13

Given we are moving into the hurricanes season in a few months, I was wondering if this is now an accepted standard. I haven't seen many updates - it appears to be complete as is. Thanks,

15 22

Re: public consultation on root zone KSK rollover
by Brandon Butterworth 04 Apr '13

04 Apr '13

> The topic at hand and the specific questions that have been > asked as part of the consultation are important ones; Do it when you feel like, nobody should notice. Anything this important should be routine procedure, make it daily. > the decisions taken will have operational consequences to any > user of the Internet who validates DNS responses with DNSSEC. That will not motivate people to deploy it brandon

2 1

MikroTik + EAP-TLS + Non-Channel 1 / Apple iOS issues
by Thomas York 03 Apr '13

03 Apr '13

I know a few of you guys are using MikroTik offerings in the enterprise, so I hope to pick your brain(s). I have many, many RB433UAH's deployed worldwide as simple WAPs. I've been looking to move to 802.1x EAP-TLS via an external FreeRadius server. I have our HP Procurves using the FreeRadius server without issue. Infact, the only devices that seem to have issues are the MikroTik devices. For one, only channel 1 seems to work with 802.1x. If I change the channel to ANYTHING else, clients refuse to auth. Secondly, newer iOS devices (iOS 5 and newer, I believe) refuse to auth entirely. I have an older iPod touch that is on iOS4 that can authenticate on channel 1. Have any of you guys seen issues like this? Thanks. -- Thomas York

2 1

Mikrotik visibility
by Beavis 03 Apr '13

03 Apr '13

Hello All, I would like to ask if there are any folks out there that use any specific tool (OpenSource/Closed) that is used for mikrotik routers. I need packet visibility (ala netflow) or anything similar to that effect. any suggestions are greatly appreciated. cheers, -Beavis -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Disclaimer: http://goldmark.org/jeff/stupid-disclaimers/

4 4

public consultation on root zone KSK rollover
by Joe Abley 03 Apr '13

03 Apr '13

Hi all, As advised a month or so ago, the following public comment period is open: http://www.icann.org/en/news/public-comment/root-zone-consultation-08mar13-… We have received a small number of responses which are accessible from that page. The topic at hand and the specific questions that have been asked as part of the consultation are important ones; the decisions taken will have operational consequences to any user of the Internet who validates DNS responses with DNSSEC. If you have experience, opinions or expertise to contribute, it would be greatly appreciated. The window for being able to submit comments closes on 12 April 2013 at 23:59 UTC. Many thanks, Joe

1 0