February 2014 - Test - lists.nanog.org

level3_bx4-montrealak.net consistently dropping 50% of the packets
by Nick Cameo 21 Feb '14

21 Feb '14

Hello Everyone, According to mtr command we are consistently seeing level3_bx4-montrealak.net dropping 30-50% of packets. Our ISP is Bell Canada. Any ideas on how to get this resolved are greatly appreciated. HOST: victoria Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.2.1 0.0% 10 0.5 0.8 0.4 1.6 0.5 2.|-- lns2-montrealak_lo0_LNS.n 0.0% 10 6.7 7.6 6.7 8.8 0.7 3.|-- agg1-montrealak_GE0-2-2_1 0.0% 10 6.4 6.3 5.4 7.6 0.6 4.|-- bx4-montrealak_so-0-0-0.n 0.0% 10 6.0 5.8 4.9 7.0 0.7 5.|-- level3_bx4-montrealak.net 50.0% 10 6.5 6.7 5.7 7.9 0.8 6.|-- ae-11-11.car1.Montreal2.L 0.0% 10 92.2 91.7 91.0 92.8 0.7 7.|-- ae-5-5.ebr2.NewYork1.Leve 0.0% 10 90.9 92.0 90.9 92.7 0.6 Kind Regards, Nick.

5 6

Networking folk in the San Diego area...
by John Curran 21 Feb '14

21 Feb '14

NANOGers - Just a reminder that there is a ARIN+NANOG on the Road session taking place in San Diego next week; the day long program has NANOG and ARIN speakers and is free but advance registration is recommended. If you know anyone who might benefit from attending such an event, please bring it to their attention! For more information, see Betty's announcement here: <http://mailman.nanog.org/pipermail/nanog-announce/2014-February/000215.html> Thanks! /John John Curran President and CEO ARIN

1 0

question about AS relationship
by Song Li 21 Feb '14

21 Feb '14

Hi everyone, I have one simple question: as for AS relationship, should customer tell its provider the AS# of its own customers, or the provider have the right to require its customers to do that? Thanks! -- Sky Li

5 11

spamassassin
by Randy Bush 20 Feb '14

20 Feb '14

in the last 3-4 days, a *massive* amount of spam is making it past spamassassin to my users and to me. see appended for example. not all has dkim. clue? randy From: "SmallCapStockPlays" <info(a)SmallCapStockPlays.com> Subject: Could VIIC be our biggest play in 2014? Check the stock today To: <randy(a)psg.com> Date: Tue, 18 Feb 2014 20:48:02 -0500 Return-path: <bounces+796782.50654126.285374(a)icpbounce.com> X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ran.psg.com X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,HTML_MESSAGE,MIME_QP_LONG_LINE,T_DKIM_INVALID autolearn=ham version=3.3.2 Received: from psg.com ([2001:418:1::62]) by ran.psg.com with esmtp (Exim 4.76) (envelope-from <bounces+796782.50654126.285374(a)icpbounce.com>) id 1WFwGl-0006al-Bu for randy(a)ran.psg.com; Wed, 19 Feb 2014 01:48:16 +0000 Received: from [207.254.213.223] (helo=drone166.ral.icpbounce.com) by psg.com with esmtp (Exim 4.82 (FreeBSD)) (envelope-from <bounces+796782.50654126.285374(a)icpbounce.com>) id 1WFwGZ-000Lp8-0W for randy(a)psg.com; Wed, 19 Feb 2014 01:48:04 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=icontactmail3.com; h=Mime-Version:From:To:Date:Subject:List-Unsubscribe:X-Feedback-ID:Content-Type:Message-ID; bh=iihwvTJA/ZrrgzXpk+9Muk0Sqlfk5BqD+aI+mL91kn8=; b=wKHIYdl1BdMRK0Kak5Z/2CwsfFh5Byoe9ZlHaqQz3VK4ltYtLfCI3tg6y8Wq3HuULY+ere7Fzz9Q camnKSvqcSx3u8LQWQGQSZoYkOmzcIemCHNNrsBD+WZhVA9R3W10V2NM6OTuJKFURxtmCNME29kH 5bYunRCoGolocQ5HmAw= Mime-Version: 1.0 Errors-To: bounces+796782.50654126.285374(a)icpbounce.com List-Unsubscribe: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m…>, <mailto:bounces+796782.50654126.285374@icpbounce.com> X-List-Unsubscribe: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m…> X-Unsubscribe-Web: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m…> X-Feedback-ID: 01_796782_285374:01_796782:01:vocus X-ICPINFO: X-Return-Path-Hint: bounces+796782.50654126.285374(a)icpbounce.com Content-Type: multipart/alternative; boundary="cdf82e78-582d-4a55-9037-dacf81ae37d3" Message-ID: <0.1.F.AFD.1CF2D149FE8FD9E.0(a)drone166.ral.icpbounce.com> [1 <text/plain; utf-8 (quoted-printable)>] HOME ABOUT US TRADE IDEAS PENNY STOCK ARTICLES DAILY NEWS [1][png] [2][png] [3][png]

9 19

NTP DRDos Blog post
by Harlan Stenn 20 Feb '14

20 Feb '14

Folks, I just posted http://nwtime.org/ntp-winter-2013-network-drdos-attacks/ . In general we've never allowed comments to blog posts on that site; we're currently discussing if we should allow them for this post. I'd love to hear any feedback about the post. Thanks... -- Harlan Stenn <stenn(a)ntp.org> http://networktimefoundation.org - be a member!

13 18

prefix advertisement
by Russell, Ben 20 Feb '14

20 Feb '14

Can someone from Comcast BGP team contact me off list? I am seeing AS 33491 advertising one of our prefixes. Thanks -Ben

2 1

Re: "Everyone should be deploying BCP 38! Wait, they are …."
by Larry Sheldon 20 Feb '14

20 Feb '14

On 2/18/2014 11:20 AM, Jay Ashworth wrote: > Here's a piece which uses the MIT ANA data to assert that the job is > mostly done already. > > Unless I'm very much mistaken, it appears that a large percentage of > the failed BCP 38 spoofing tests listed in that data are actually due > to customer side NAT routers dropping packets... > > which is of course egress filtering rather than ingress filtering, > and thus doesn't actually apply to our questions. > > Am I interpreting that correctly? The date seems a little past "buy by" in light of the very recent observations and comments here. > http://www.senki.org/everyone-should-be-deploying-bcp-38-wait-they-are/ -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

5 5

random dns queries with random sources
by Joe Maimon 20 Feb '14

20 Feb '14

Hey all, DNS amplification spoofed source attacks, I get that. I even thought I was getting mitigation down to acceptable levels. But now this. At different times during the previous days and on different resolvers, routers with proxy turned on, etc... Thousand of queries with thousands of source ip addresses. According to my logs, sources are not being repeated (or not with any significant frequency) What is the purpose of this? 18-Feb-2014 21:45:24.982 queries: info: client 38.89.3.12#19391: query: swe.5kkx.com IN A + (66.199.132.5) 18-Feb-2014 21:45:25.067 queries: info: client 4.109.210.187#55190: query: ngqrbwuzquz.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.105 queries: info: client 91.82.209.221#33924: query: bgbtqcdtzen.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.106 queries: info: client 6.29.8.224#4379: query: uehkaiy.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.106 queries: info: client 67.27.41.169#44000: query: yqv.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.107 queries: info: client 45.207.31.218#30585: query: e.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.644 queries: info: client 95.217.89.95#5396: query: bfpofpj.5kkx.com IN A + (66.199.132.5) 18-Feb-2014 21:45:25.823 queries: info: client 89.47.129.187#12316: query: aocdesguijxym.5kkx.com IN A + (66.199.132.5) 18-Feb-2014 21:45:26.021 queries: info: client 15.205.106.62#34265: query: xqgyahfugnt.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:26.057 queries: info: client 128.64.33.29#7584: query: ijwhqfmpohmj.5kkx.com IN A + (216.222.148.103) 18-Feb-2014 21:45:26.330 queries: info: client 102.206.85.254#8093: query: ibojknsrqjohib.5kkx.com IN A + (216.222.148.103) 18-Feb-2014 21:45:26.333 queries: info: client 40.121.221.81#10822: query: ebb.5kkx.com IN A + (66.199.132.5) 18-Feb-2014 21:45:26.752 queries: info: client 104.55.169.43#30108: query: l.5kkx.com IN A + (66.199.132.7)

18 38

Re: level3_bx4-montrealak.net consistently dropping 50% of the packets
by Nick Cameo 20 Feb '14

20 Feb '14

| Since you dont see packet loss on the subsequent hops, this is likely just ICMP rate limiting on the control plane. MTR | sends quite a bit of ICMP so this is very common when using MTR. Not a "possible" reason for the degradation of voip from us to our service provider? Is there a more accurate test that will render more explanation? Thanks for the prompt Chris.

1 0

RE: GEO location issue with google
by Praveen Unnikrishnan 19 Feb '14

19 Feb '14

Hi Heather, Thanks you very much for sorting out this issue. Praveen Unnikrishnan Network Engineer PMGC Technology Group Ltd T: 020 3542 6401 M: 07827921390 F: 087 1813 1467 E: piu(a)pmgroupuk.com<mailto:piu@pmgroupuk.com> [cid:image004.png@01CF2D72.C52965E0] [cid:image002.jpg@01CE1663.96B300D0] www.pmgroupuk.com<http://www.pmgroupuk.com/> | www.pmgchosting.com <http://www.pmgchosting.com/> How am I doing? Contact my manager, click here<mailto:shazad@pmgroupuk.com?subject=How's%20Praveen%20doing?>. ________________________________ [cid:image003.jpg@01CE1663.96B300D0] PMGC Managed Hosting is now live! After a successful 2012, PMGC continues to innovate and develop by offering tailored IT solutions designed to empower you through intelligent use of technologies. www.pmgchosting.com<http://www.pmgchosting.com/>. PMGC Technology Group Limited is a company registered in England and Wales. Registered number: 7974624 (3/F Sutherland House, 5-6 Argyll Street, London. W1F 7TE). This message contains confidential (and potentially legally privileged) information solely for its intended recipients. Others may not distribute copy or use it. If you have received this communication in error please contact the sender as soon as possible and delete the email and any attachments without keeping copies. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company or its associated companies unless otherwise specifically stated. All incoming and outgoing e-mails may be monitored in line with current legislation. It is the responsibility of the recipient to ensure that emails are virus free before opening. PMGC® is a registered trademark of PMGC Technology Group Ltd. From: Heather Schiller [mailto:has@google.com] Sent: 13 February 2014 05:43 To: Praveen Unnikrishnan Cc: nanog(a)nanog.org Subject: Re: GEO location issue with google Reported to the appropriate folks. Going to www.google.co.uk<http://www.google.co.uk> directly, should return you English language results. Appending /en to the end of a google url should also return you English language results. You should also be able to set your language preference in your search settings. --Heather On Fri, Feb 7, 2014 at 10:20 AM, Praveen Unnikrishnan <piu(a)pmgroupuk.com<mailto:piu@pmgroupuk.com>> wrote: Hi, We are an ISP based in UK. We have got an ip block from RIPE which is 5.250.176.0/20<http://5.250.176.0/20>. All the main search engines like yahoo shows we are based in UK. But Google thinks we are from Saudi Arabia and we redirected to www.google.com.sa<http://www.google.com.sa><http://www.google.com.sa> instead of googlw.co.uk<http://googlw.co.uk>. I have sent lot of emails to google but no luck. All the information from google are in Arabic and youtube shows some weird videos as well. Could anyone please help me to sort this out? Would be much appreciated for your time. Praveen Unnikrishnan Network Engineer PMGC Technology Group Ltd T: 020 3542 6401 M: 07827921390 F: 087 1813 1467 E: piu(a)pmgroupuk.com<mailto:piu@pmgroupuk.com><mailto:piu@pmgroupuk.com<mailto:piu@pmgroupuk.com>> [cid:image001.png@01CF2418.27F29CA0] [cid:image002.jpg@01CE1663.96B300D0] www.pmgroupuk.com<http://www.pmgroupuk.com><http://www.pmgroupuk.com/> | www.pmgchosting.com<http://www.pmgchosting.com> <http://www.pmgchosting.com/> How am I doing? Contact my manager, click here<mailto:shazad@pmgroupuk.com<mailto:shazad@pmgroupuk.com>?subject=How's%20Praveen%20doing?>. ________________________________ [cid:image003.jpg@01CE1663.96B300D0] PMGC Managed Hosting is now live! After a successful 2012, PMGC continues to innovate and develop by offering tailored IT solutions designed to empower you through intelligent use of technologies. www.pmgchosting.com<http://www.pmgchosting.com><http://www.pmgchosting.com/>. PMGC Technology Group Limited is a company registered in England and Wales. Registered number: 7974624 (3/F Sutherland House, 5-6 Argyll Street, London. W1F 7TE). This message contains confidential (and potentially legally privileged) information solely for its intended recipients. Others may not distribute copy or use it. If you have received this communication in error please contact the sender as soon as possible and delete the email and any attachments without keeping copies. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company or its associated companies unless otherwise specifically stated. All incoming and outgoing e-mails may be monitored in line with current legislation. It is the responsibility of the recipient to ensure that emails are virus free before opening. PMGC(r) is a registered trademark of PMGC Technology Group Ltd.

2 1