February 2014 - Test - lists.nanog.org

VMware Training
by Phil Gardner 21 Feb '14

21 Feb '14

Not sure if this list is the best place, but it is probably the only list that I'm on that won't give me a bunch of grief about the chosen technology. I looked at VMware's site, and there are a ton of options. I'm wondering if anyone has some basic suggestions or experiences. I'm a Linux admin by trade (RH based), with "ok" networking ability. I'm sufficiently versed in deploying scripted ESXi (including 5.x) installations for a specific environment, including vswitches/SAN config (but only with NFS datastores backed by a NetApp, unfortunately, no blockbased stores). I'd like to get experience deploying VCenter clusters, down to DRS/HA config, other block based storage, and anything else a large environment needs. Thoughts or experiences? -- _____________________ Phil Gardner PGP Key ID 0xFECC890C OTR Fingerprint 6707E9B8 BD6062D3 5010FE8B 36D614E3 D2F80538

7 16

comcast business service
by shawn wilson 21 Feb '14

21 Feb '14

A while ago I got Comcast's business service. Semi-idle connections are get dropped (I haven't really diagnosed this - I just no that it isn't the client or server but some network in between). However the second and most obvious issue is that intermittently, the service will grind to a halt: --- 8.8.8.8 ping statistics --- 37 packets transmitted, 34 received, 8% packet loss, time 36263ms rtt min/avg/max/mdev = 398.821/5989.160/14407.055/3808.068 ms, pipe 15 After a modem reboot, it goes normal: --- 8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3003ms rtt min/avg/max/mdev = 23.181/23.920/24.298/0.474 ms This seems to happen about once or twice a day. I can't attribute it to any type of traffic or number of connections. All of the rest of the network equipment is the same and the behavior persists when a computer is plugged directly into the modem. I called Comcast and they said they didn't see anything even when I was experiencing ridiculous ping times. I tend to think it's an issue with the 'modem' but I'm not sure what the issue might be or how to reproduce it when asked to if I tell them to look at it.

7 8

level3_bx4-montrealak.net consistently dropping 50% of the packets
by Nick Cameo 21 Feb '14

21 Feb '14

Hello Everyone, According to mtr command we are consistently seeing level3_bx4-montrealak.net dropping 30-50% of packets. Our ISP is Bell Canada. Any ideas on how to get this resolved are greatly appreciated. HOST: victoria Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.2.1 0.0% 10 0.5 0.8 0.4 1.6 0.5 2.|-- lns2-montrealak_lo0_LNS.n 0.0% 10 6.7 7.6 6.7 8.8 0.7 3.|-- agg1-montrealak_GE0-2-2_1 0.0% 10 6.4 6.3 5.4 7.6 0.6 4.|-- bx4-montrealak_so-0-0-0.n 0.0% 10 6.0 5.8 4.9 7.0 0.7 5.|-- level3_bx4-montrealak.net 50.0% 10 6.5 6.7 5.7 7.9 0.8 6.|-- ae-11-11.car1.Montreal2.L 0.0% 10 92.2 91.7 91.0 92.8 0.7 7.|-- ae-5-5.ebr2.NewYork1.Leve 0.0% 10 90.9 92.0 90.9 92.7 0.6 Kind Regards, Nick.

5 6

Networking folk in the San Diego area...
by John Curran 21 Feb '14

21 Feb '14

NANOGers - Just a reminder that there is a ARIN+NANOG on the Road session taking place in San Diego next week; the day long program has NANOG and ARIN speakers and is free but advance registration is recommended. If you know anyone who might benefit from attending such an event, please bring it to their attention! For more information, see Betty's announcement here: <http://mailman.nanog.org/pipermail/nanog-announce/2014-February/000215.html> Thanks! /John John Curran President and CEO ARIN

1 0

question about AS relationship
by Song Li 21 Feb '14

21 Feb '14

Hi everyone, I have one simple question: as for AS relationship, should customer tell its provider the AS# of its own customers, or the provider have the right to require its customers to do that? Thanks! -- Sky Li

5 11

spamassassin
by Randy Bush 21 Feb '14

21 Feb '14

in the last 3-4 days, a *massive* amount of spam is making it past spamassassin to my users and to me. see appended for example. not all has dkim. clue? randy From: "SmallCapStockPlays" <info(a)SmallCapStockPlays.com> Subject: Could VIIC be our biggest play in 2014? Check the stock today To: <randy(a)psg.com> Date: Tue, 18 Feb 2014 20:48:02 -0500 Return-path: <bounces+796782.50654126.285374(a)icpbounce.com> X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ran.psg.com X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,HTML_MESSAGE,MIME_QP_LONG_LINE,T_DKIM_INVALID autolearn=ham version=3.3.2 Received: from psg.com ([2001:418:1::62]) by ran.psg.com with esmtp (Exim 4.76) (envelope-from <bounces+796782.50654126.285374(a)icpbounce.com>) id 1WFwGl-0006al-Bu for randy(a)ran.psg.com; Wed, 19 Feb 2014 01:48:16 +0000 Received: from [207.254.213.223] (helo=drone166.ral.icpbounce.com) by psg.com with esmtp (Exim 4.82 (FreeBSD)) (envelope-from <bounces+796782.50654126.285374(a)icpbounce.com>) id 1WFwGZ-000Lp8-0W for randy(a)psg.com; Wed, 19 Feb 2014 01:48:04 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=icontactmail3.com; h=Mime-Version:From:To:Date:Subject:List-Unsubscribe:X-Feedback-ID:Content-Type:Message-ID; bh=iihwvTJA/ZrrgzXpk+9Muk0Sqlfk5BqD+aI+mL91kn8=; b=wKHIYdl1BdMRK0Kak5Z/2CwsfFh5Byoe9ZlHaqQz3VK4ltYtLfCI3tg6y8Wq3HuULY+ere7Fzz9Q camnKSvqcSx3u8LQWQGQSZoYkOmzcIemCHNNrsBD+WZhVA9R3W10V2NM6OTuJKFURxtmCNME29kH 5bYunRCoGolocQ5HmAw= Mime-Version: 1.0 Errors-To: bounces+796782.50654126.285374(a)icpbounce.com List-Unsubscribe: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m…>, <mailto:bounces+796782.50654126.285374@icpbounce.com> X-List-Unsubscribe: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m…> X-Unsubscribe-Web: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m…> X-Feedback-ID: 01_796782_285374:01_796782:01:vocus X-ICPINFO: X-Return-Path-Hint: bounces+796782.50654126.285374(a)icpbounce.com Content-Type: multipart/alternative; boundary="cdf82e78-582d-4a55-9037-dacf81ae37d3" Message-ID: <0.1.F.AFD.1CF2D149FE8FD9E.0(a)drone166.ral.icpbounce.com> [1 <text/plain; utf-8 (quoted-printable)>] HOME ABOUT US TRADE IDEAS PENNY STOCK ARTICLES DAILY NEWS [1][png] [2][png] [3][png]

9 19

NTP DRDos Blog post
by Harlan Stenn 21 Feb '14

21 Feb '14

Folks, I just posted http://nwtime.org/ntp-winter-2013-network-drdos-attacks/ . In general we've never allowed comments to blog posts on that site; we're currently discussing if we should allow them for this post. I'd love to hear any feedback about the post. Thanks... -- Harlan Stenn <stenn(a)ntp.org> http://networktimefoundation.org - be a member!

13 18

prefix advertisement
by Russell, Ben 20 Feb '14

20 Feb '14

Can someone from Comcast BGP team contact me off list? I am seeing AS 33491 advertising one of our prefixes. Thanks -Ben

2 1

Re: "Everyone should be deploying BCP 38! Wait, they are …."
by Larry Sheldon 20 Feb '14

20 Feb '14

On 2/18/2014 11:20 AM, Jay Ashworth wrote: > Here's a piece which uses the MIT ANA data to assert that the job is > mostly done already. > > Unless I'm very much mistaken, it appears that a large percentage of > the failed BCP 38 spoofing tests listed in that data are actually due > to customer side NAT routers dropping packets... > > which is of course egress filtering rather than ingress filtering, > and thus doesn't actually apply to our questions. > > Am I interpreting that correctly? The date seems a little past "buy by" in light of the very recent observations and comments here. > http://www.senki.org/everyone-should-be-deploying-bcp-38-wait-they-are/ -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

5 5

random dns queries with random sources
by Joe Maimon 20 Feb '14

20 Feb '14

Hey all, DNS amplification spoofed source attacks, I get that. I even thought I was getting mitigation down to acceptable levels. But now this. At different times during the previous days and on different resolvers, routers with proxy turned on, etc... Thousand of queries with thousands of source ip addresses. According to my logs, sources are not being repeated (or not with any significant frequency) What is the purpose of this? 18-Feb-2014 21:45:24.982 queries: info: client 38.89.3.12#19391: query: swe.5kkx.com IN A + (66.199.132.5) 18-Feb-2014 21:45:25.067 queries: info: client 4.109.210.187#55190: query: ngqrbwuzquz.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.105 queries: info: client 91.82.209.221#33924: query: bgbtqcdtzen.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.106 queries: info: client 6.29.8.224#4379: query: uehkaiy.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.106 queries: info: client 67.27.41.169#44000: query: yqv.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.107 queries: info: client 45.207.31.218#30585: query: e.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:25.644 queries: info: client 95.217.89.95#5396: query: bfpofpj.5kkx.com IN A + (66.199.132.5) 18-Feb-2014 21:45:25.823 queries: info: client 89.47.129.187#12316: query: aocdesguijxym.5kkx.com IN A + (66.199.132.5) 18-Feb-2014 21:45:26.021 queries: info: client 15.205.106.62#34265: query: xqgyahfugnt.5kkx.com IN A + (66.199.132.7) 18-Feb-2014 21:45:26.057 queries: info: client 128.64.33.29#7584: query: ijwhqfmpohmj.5kkx.com IN A + (216.222.148.103) 18-Feb-2014 21:45:26.330 queries: info: client 102.206.85.254#8093: query: ibojknsrqjohib.5kkx.com IN A + (216.222.148.103) 18-Feb-2014 21:45:26.333 queries: info: client 40.121.221.81#10822: query: ebb.5kkx.com IN A + (66.199.132.5) 18-Feb-2014 21:45:26.752 queries: info: client 104.55.169.43#30108: query: l.5kkx.com IN A + (66.199.132.7)

18 38