May 2014 - Test - lists.nanog.org

BGP route flapping
by Gus Crichton 14 May '14

14 May '14

Hi there, Hope you networking experts can shed some light on a concern I have please. I am multihoming using 2 ISPs to the internet, due to reasons outside my control, my primary preferred link keeps dropping a number of times a day forcing traffic to my backup and vice-versa when the primary comes back up. The route calculations by the upstream tier 1s and 2s handle the route calculations but if I do this too many times consuming their resources, is there a penalty/blackmark on my AS? Is this monitored even by the tier1s and 2s? Thanks. Regards, Gus C. ________________________________ Notice of Confidentiality: The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by responding to this email and then delete it from your system.

3 2

New Zealand Spy Agency To Vet Network Builds, Provider Staff
by Paul Ferguson 14 May '14

14 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I realize that New Zealand is *not* in North America (hence NANOG), but I figure that some global providers might be interested here. This sounds rather... dire (probably not the right word). "The new Telecommunications (Interception Capability and Security) Act of 2013 is in effect in New Zealand and brings in several drastic changes for ISPs, telcos and service providers. One of the country's spy agencies, the GCSB, gets to decide on network equipment procurement and design decisions (PDF), plus operators have to register with the police and obtain security clearance for some staff. Somewhat illogically, the NZ government pushed through the law combining mandated communications interception capabilities for law enforcement, with undefined network security requirements as decided by the GCSB. All network operators are subject to the new law, including local providers as well as the likes of Facebook, Google, Microsoft, who have opposed it, saying the new statutes clash with overseas privacy legislation." http://yro.slashdot.org/story/14/05/13/005259/new-zealand-spy-agency-to-vet… FYI, - - ferg - -- Paul Ferguson VP Threat Intelligence, IID PGP Public Key ID: 0x54DC85B2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iF4EAREIAAYFAlNyHw4ACgkQKJasdVTchbLwDgD/WVHo2iTapJ90l8MRcwUZ5OQ7 QfJ5cI1v4t2bUXZp1hQBAKHCP0hyxg6naGOzRLt/vHjgxXnl3+yiWoj0ENxQyIr9 =0yLu -----END PGP SIGNATURE-----

14 22

CERT and ISO 27001
by DjinnS C. 14 May '14

14 May '14

Hi, I'm searching a service/company doing continuos review of security alerts for various tools, software and hardware (Apache, PHP, Cisco IOS, Juniper JunOS, Netapp Ontap, etc ...). I think the right way is to use a CERT offering commercial services with daily notifications about a list of specifics choosen subjects. I found some companies with a commercial CERT offering this services: Lexsi, XMCO, Intrinsec. Do you know or use a service link this ? We need this for our implementation of ISO 27001 standard. Thank you in advance. Regards, -- Guillaume

2 1

This is me venting.... OVH/lvl3
by Mr. Queue 13 May '14

13 May '14

Almost a week of this now.. OVH/lvl3 at dal-1-6k. Thank you sir may I have another...... http://weathermap.ovh.net/usa

2 2

Re: Observations of an Internet Middleman (Level3) (was: RIP Network Neutrality)
by Joel M Snyder 13 May '14

13 May '14

Shouldn't there be a rule against using "RIP" in the subject line of a NANOG post? Every time I see that, a shudder goes down *my* spine. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

3 2

level3 dia egress filtering?
by Christopher Rogers 13 May '14

13 May '14

Does anyone have any experience dealing with level3 in trying to get egress filters applied to an internet dia link with them? I've been trying to get them to apply an egress filter to drop all of udp to a certain /25 on my network that's been getting hammered by a dns amplification attack, and I am being told that they can only 'drop an entire protocol, and not to a specific ip address or range.' Can anyone confirm if that's the case? cheers -chris

8 10

Re: Residential CPE suggestions
by Scott Weeks 13 May '14

13 May '14

--- gary.buhrmaster(a)gmail.com wrote: From: Gary Buhrmaster <gary.buhrmaster(a)gmail.com> On Mon, May 5, 2014 at 11:59 PM, Deepak Jain <deepak(a)ai.net> wrote: > > Any recommendation for a residential CPE that supports dual > SFP uplinks <snip> Have you looked at the EdgeRouter Pro? 2 SFP links, routing capability. http://www.ubnt.com/edgemax ----------------------------------------------- It looks like everyone here should start looking for a new career: "Next-generation user experience allows anyone to quickly become a routing expert." ;-) scott

8 9

How the NSA tampers with US-made Internet routers
by Paul Ferguson 12 May '14

12 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Just an FYI: "For years, the US government loudly warned the world that Chinese routers and other internet devices pose a "threat" because they are built with backdoor surveillance functionality that gives the Chinese government the ability to spy on anyone using them. Yet what the NSA's documents show is that Americans have been engaged in precisely the activity that the US accused the Chinese of doing." Much more: http://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us… Enjoy! - - ferg - -- Paul Ferguson VP Threat Intelligence, IID PGP Public Key ID: 0x54DC85B2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iF4EAREIAAYFAlNw+6cACgkQKJasdVTchbJvwAD9GySSpd3dpSMNkJM0y6GjWRzC +Ys/giaX2FcjtSu2qwgA/jzxiz5h69e8Vw/3MBgp3YcpjrauC1Olz3mFmxSseF33 =gc8p -----END PGP SIGNATURE-----

1 0

Re: Observations of an Internet Middleman (Level3) (was: RIP Network Neutrality
by Clayton Zekelman 12 May '14

12 May '14

Actually, I've done a bit of overbuild, and it does "omg cost a lot". We don't know how much Google Fiber has paid to build the network. They're Google, they can do it just because they feel like it. Of course I don't have any proof, but the rest of your points may not be far off the mark. At 09:44 AM 12/05/2014, Nick B wrote: >Google Fiber and various other FTTH services disprove the "omg it costs a >lot" theory. This is purely a money grab by a monopoly, sanctioned by the >FCC because.. the people doing the money grab own the FCC. It helps to >keep in mind that several of the parties involved in this grab *HAVE >ALREADY BEEN PAID TO EXPAND THEIR NETWORKS BY THE PUBLIC, AND HAVE FAILED >TO DO SO*. I'm not really sure how anyone could view this whole thing as >fair, honest or even legal. I also fully expect the FCC to sign off on it >as the receipt says "Paid by Verizon." >Nick --- Clayton Zekelman Managed Network Systems Inc. (MNSi) 3363 Tecumseh Rd. E Windsor, Ontario N8W 1H4 tel. 519-985-8410 fax. 519-985-8409

2 1

Local Loop Provider Boston Natick
by Pui Edylie 12 May '14

12 May '14

Dear Nanog, I am sorry for wide distribution. We are looking for a local loop provider in Boston Natick area to either 1. our POP in New Jersey OR 2. to Singapore Equinix SG1 We are looking for 100Mbps Layer 2 (MTU Size 2000 and above) and able to carry our SVLAN and CVLAN. Please kindly unicast the reply to me. Thanks much! Best Regards, Edy

1 0