May 2013 - Test - lists.nanog.org

Looking for Netflow analysis package
by Erik Sundberg 15 May '13

15 May '13

Does anyone know of a netflow collector that will do the following. *Graph/List Destination Networks By Top AS *Graph/List Destination Networks By Top IP Address *AS Path Analysis *Traffic Type (ICMP, TCP, UDP, IPSEC, HTTP, SSH, SMTP, etc..) We will be using this to help us decide who to Peer with and what transit Providers to look at. I am familiar with Arbor Network's Peak Flow utility but it's a little too pricy. I also found AS-Stats https://neon1.net/as-stats/ look promising from the power point on their page. Thanks Erik ________________________________ CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must destroy the original transmission and its attachments without reading or saving in any manner. Thank you.

14 13

Borrow request (Chicago): Cat 4900M copper interface(s)
by ryan＠u13.net 15 May '13

15 May '13

Hello all, I'll spare you the details, but we are in need of some means to temporarily get a copper interface on at least one of our 4900M switches to narrow down a network performance issue. Does anyone have a 4900M half card with copper ports, or a Cisco TwinGig X2 adapter in the Chicago area? We would love to borrow one or two for a few days until we can locate and resolve this issue. Ryan

1 0

The BGP Visibility Scanner
by Andra Lutu 15 May '13

15 May '13

Dear all, We have built a tool that checks the visibility of IPv4 prefixes at the interdomain level. The tool is available at *http://visibility.it.uc3m.es/* and you can use it to retrieve the Limited Visibility Prefixes (LVPs) (i.e., prefixes that are not present in all the global routing tables we analyse) injected by a certain originating AS. The query is very simple, it just requires to input the AS number for which you want to retrieve the originated LVPs, if any. After checking the limited-visibility prefixes, we would appreciate any feedback that you can provide on the cause of the limited visibility (we provide a form with a few very short questions which you could fill in and submit). Using a dataset from May 2nd 2013, we generated a list with the ASes which are originating LVPs: *http://visibility.it.uc3m.es/fullASlist.html* We would like to hear from any operator who might find this project interesting, and, in particular, from these large contributors to the LVPs set. Please note that advertising prefixes with limited visibility does not mean that the originating AS is necessarily doing something wrong. The ASes might be generating the LVPs knowingly (e.g., scoped advertisements). However, there might be cases where the origin AS might be unaware that some prefixes are not globally visible (when they should) or that others are leaking as a consequence of mis-configurations/slips. Our purpose is to spread awareness about these latter phenomena, help eliminate the cause of unintended/accidental LVPs and upgrade this tool to an anomaly detection mechanism. For more information on the definition and characteristics of a Limited Visibility prefix, please check the Frequently Asked Questions section of the webpage, available here: *http://visibility.it.uc3m.es/Q_and_A_latest.html* The tool works with publicly available BGP routing data, retrieved from the RIPE NCC RIS and RouteViews Projects. The results are updated on a daily basis. For more information on the methodology we refer you to the slides of the NANOG57 presentation about the BGP Visibility Scanner: http://www.nanog.org/meetings/nanog57/presentations/Wednesday/wed.general.L… Also, you can check the RIPE labs article about the BGP Visibility Scanner, available here: https://labs.ripe.net/Members/andra_lutu/the-bgp-visibility-scanner We are looking forward to your feedback! Thank you, best regards, Andra

3 4

CDN server log
by Djamel Sadok 15 May '13

15 May '13

Hi, Anyone knows of any public CDN server log trace. I am looking for object popularity, hit rate information, ... Thanks, Djamel

1 0

RE: Looking for Netflow analysis package
by Harry Hoffman 15 May '13

15 May '13

1 0

Could not send email to office 365
by ISHII, Yuji 15 May '13

15 May '13

Hello folks, Have you ever seen DNS issues on Office 365? MX record of Office 365 is example.mail.eo.outlook.com. I can get the MX record, however, I could not get the A record of the MX record, got Timeout. Does anyone have the same issue? Sincerely, Yuji

11 17

[NANOG-announce] 2013 Postel Scholarship Announcement
by Betty Burke <betty＠nanog.org> 14 May '13

14 May '13

On behalf of the North American Network Operators' Group (NANOG) and the American Registry for Internet Numbers (ARIN), we would like to take this opportunity to draw your attention to the 2013 Postel <http://nanog.org/resources/scholarships/postel>Network Operator's Scholarship <http://nanog.org/resources/scholarships/postel>. The Postel Network Operator's Scholarship targets personnel from developing countries who are actively involved in Internet development, in any of the following roles: - Engineers (Network Builders) - Operational and Infrastructure Support Personnel - Educators and Trainers This is not a postgraduate fellowship or academic scholarship. Individuals may nominate themselves for the Scholarship via email. The Scholarship will be awarded annually to a recipient selected by a committee comprising representatives from the NANOG Board of Directors and the ARIN Board of Trustees. The selection committee will "whimsically" select the annual recipient exclusively in response to the question: "What Would Jon<http://en.wikipedia.org/wiki/Jon_Postel>Do?" if he were asked to select a recipient. The successful applicant will be provided with transportation to and from the NANOG and ARIN joint meeting October 7-11, 2013 in Phoenix, Arizona, USA, and a reasonable (local host standard) allowance for food and accommodation. In addition, all fees for participation in both meetings' events will be waived. The final grant size is determined according to final costs and available funding. The chosen recipient will be advised at least 2 months prior to the fall meeting date. Applications from qualified individuals are now being accepted. The deadline for application is June 7, 2013 and the awardees will be informed by July 19, 2013. Please read full information about the scholarship at: http://nanog.org/resources/scholarships/postel To apply, please submit your application in PLAIN ASCII in the BODY of the message, not as an attachment nor as a Word document, PDF, or any other form, to PostelNOS(a)nanog.org. Please be sure to include the following: - Full name and contact info - Your brief biography, including current and recent jobs held - A description of why you need and deserve this Scholarship to attend the NANOG and ARIN meetings - A description of how you plan to leverage your attendance at the meetings in your work - A brief abstract of a presentation you would give at the NANOG and/or ARIN meetings, if selected as a Scholarship winner Kind regards, Steve Gibbard and John Curran, on behalf of the Postel Scholarship Selection Committee -- Betty Burke NANOG Executive Director 48377 Fremont Boulevard, Suite 117 Fremont, CA 94538 Tel: +1 510 492 4030 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Lucent Stinger DSLAM End of Life questions
by Jean-Francois Mezei 14 May '13

14 May '13

Does anyone know when Alcatel declared the Lucent Stinger product line "end of sales" ? The Alcatel web page confirms it is discontinued but no date shown. > https://support.alcatel-lucent.com/portal/productContent.do?productId=sting… All of the PDFs I have seen (thank to my buddy Mr Google) point to Lucent documents in early 2000s. (and few discuss Stingers deployed in remotes). None have the Alcatel-Lucent name, all have Lucent only. In a regulatory Filing, Bell Canada says that it deployed 80% of them between 2006 and 2009, with the rest between 2009 and 2012. I was under the impression that Alcatel end-of-lifed the Stinger product line not long after it purchased Lucent at end of 2006. So knowing when this actually happened would greatly help understanding this. The Stinger DSLAMs deployed by Bell Canada are causing problems because they are not fully VDSL2 compatible and Bell Canada has identified only 1 modem (Sagemcom 2864) that is compatible ( a previous one Cellpipe has been end of lifed). >From the time the end of sales has been reached, how many years could a carrier expect to see firmware/software fixes for their fleet of DSLAMs installed throughout cities ? I assume that while the end of life .PDF on the web site is restrictive, that Alcatel would still value carriers and provide them with "mature product" support ? Are there precedents of other carriers who deployed Stingers and have since replaced them due to their being end of life and not so compatible with VDSL2 ? Bell Canada stated that it has no plans to replace them, but this could be just regulatory talk. Any background information would be appreciated.

1 0

Dallas Peering Issues
by Meshier, Brent 13 May '13

13 May '13

Was alerted by our MSSP of connectivity issues, looks like something big is happening right now that's affecting Level3, Savvis, Cogent, Verizon and Century Link. Take a look at Internet Health Report, never seen it this bad. Anyone have more information? --Brent **************************************************************************************************************************************************************************************** The material contained herein is for informational purposes only and is not intended as an offer or solicitation with respect to the purchase or sale of securities. The decision of whether to adopt any strategy or to engage in any transaction and the decision of whether any strategy or transaction fits into an appropriate portfolio structure remains the responsibility of the customer and/or its advisors. Past performance on the underlying securities is no guarantee of future results. This material is intended for use by institutional clients only and not for use by the general public. Portions of this material may incorporate information provided by third party market data sources. Although this information has been obtained from and based upon sources believed to be reliable, neither Amherst Holdings, LLC nor any of its affiliates guarantee the accuracy or completeness of the information contained herein, and cannot be held responsible for inaccuracies in such third party data or the data supplied to the third party by issuers or guarantors. This report constitutes Amherst's views as of the date of the report and is subject to change without notice. This information does not purport to be a complete analysis of any security, company or industry, including but not limited to any claim as to the prepayment consistency and/or the future performance of any securities or structures. To the extent applicable, change in prepayment rates and/or payments may significantly affect yield, price, total return and average life. Our affiliate, Amherst Securities Group, L.P., may have a position in securities discussed in this material.

2 1

Illegal usage of AS51888 (and PI 91.220.85.0/24) from AS42989 and AS57954 (in ukraine)
by Xavier Beaudouin 11 May '13

11 May '13

Hello there, Seems there is some people in Ukraine that love to use IP and AS that doesn't belong to them. See : #sh ip bgp 91.220.85.0/24 BGP routing table entry for 91.220.85.0/24, version 6661169 Paths: (2 available, best #1, table Default-IP-Routing-Table) Advertised to update-groups: 1 174 8359 8359 13249 57954 42989 51888, (received & used) 149.11.xx.xx from 149.11.xxx.xxx (38.28.xx.xx) Origin IGP, metric 14050, localpref 100, valid, external, best Community: 11424365 11425269 24990 21371 8359 13249 57954 42989 51888, (received & used) 185.3.25.1 (metric 10) from 185.17.xxx.xxx (185.17.xxx.xxx) Origin IGP, metric 0, localpref 100, valid, internal, not synchronized According to RIPE database : aut-num: AS51888 as-name: PILOTSYSTEMS-AS descr: Pilot Systems consulting SARL org: ORG-PS74-RIPE import: from AS16128 accept ANY import: from AS29075 accept ANY import: from AS35189 accept ANY export: to AS16128 announce AS51888 export: to AS29075 announce AS51888 export: to AS35189 announce AS51888 admin-c: DS7922-RIPE tech-c: GLM89-RIPE tech-c: XB80-RIPE mnt-by: RIPE-NCC-END-MNT mnt-by: MNT-KAZAR mnt-by: MNT-PILOTSYSTEMS mnt-routes: MNT-KAZAR mnt-routes: MNT-PILOTSYSTEMS source: RIPE #Filtered Seems that there is no AS42989 as upstream.... So we can consider that AS42989 is handle illicit activities, and does not filter prefixes (same also for AS57954). That's cool but those people in UA, use that prefix to send spam, as LIR member I got thousands of mails from people that get thoses IP as spam source. Needs really that rpki and other stuff to be deployed massively. If some people from those UA AS can do their job instead of getting the honeypot of spammers, this should be better for everyone. I have already tried to contact abuse / email from ripe data base : no MX, mailbox doesn't exist, even the domain doesn't exist... Maybe AS-MTU doesn't lookaround the quality of their customers ? So bad... People there that have some PI and unused AS, have a look if your ressources are not used by someone that should not use them. Xavier

9 17