October 2015 - Test - lists.nanog.org

configuration sanity check
by marcel.duregards＠yahoo.fr 29 Oct '15

29 Oct '15

Hi Nanogers, Any recommendation about a software which check the live config of cisco/juniper devices against some templates ? The goal is to have a template about different function device, like: - CORE device must have this bloc and this clock - PE device must have at least that and that - CPE must have this and that - Distrib switch block 1 and block2 - etc... And the software run once every day to check which device do not comply with those rules and generate an alert. Thank, - Marcel

12 11

[CenturyLink][Proto UDP] Blockage of UDP Outbound from Source Port 53
by Jason Hellenthal 29 Oct '15

29 Oct '15

Could a CenturyLink network admin/engineer contact me off list. We have multiple locations receiving DNS queries over UDP where we see the connections making into our server and back out to our CenturyLink edge routers but never completes back to the connecting client at multiple locations. Connections Failing From Digital Ocean NY, Time Warner WI, Rackspace DFW TX (Hartford CT)# dig +short +novc @208.46.135.X domain.com A (Cleveland OH)# dig +short +novc @65.112.236.X domain.com A Connections from Chicago Rackspace to the above locations work as expected. CenturyLink Orlando FL to Hartford CT or Cleveland OH, CenturyLink circuits work as expected. Contact off list for domain and ip information used above. Thanks -- Jason Hellenthal JJH48-ARIN

1 0

DDoS mitigation for ISPs
by Mike 29 Oct '15

29 Oct '15

Hello, Is there any DDoS mitigation service provider that can scrub traffic for an ISP network? I have an ASN and BGP and my own netblocks, and I have a 1gbps pipe. I was thinking the scenario would be during attack, we could bring up a tunnel and run bgp over it and advertise some portion of our ip space thru it. I realise getting it setup while attack is taking place would be a little hard and that we likely could expect at least some down time. What we have seen so far has been reflection attacks (dns and ssdp) and we have been able to do rate limiting on these and other protocols to sane values. This has worked well, although the primary risk is once the traffic flow exceeds the link capacity such limiting won't have any net effect. But if we could farm this out during times of trouble to a mitigation services provider, they could advertise our block(s) and rate limit and scrub for us and send us the result, it would be a far better than what we have now (which is effectively nothing). I asked cloudflare this and they stated they are focused on web traffic. My upstream can't help me, doesn't support RTBH and won't install filters anyways unless it's impacting THEIR network. Just wondering if anyone has any other ideas (short of ditching my provider, which I also can't do due at this time due to lack of competitive choice). Mike-

4 5

Re: All in favor or.....
by Larry Sheldon 28 Oct '15

28 Oct '15

On 10/28/2015 19:15, Matthew Petach wrote: > I work 8 hours a day... > > ...and then I work another 8. A long time ago, in a place far, far away, the PTB determined that we should change from a three-team, three-8-hour shifts, 5 days a week ("days", "evenings", and "nights" (aka "graves" or "graveyard") for 7 x 24 coverage, to a four-team, 12 1/2 hour day 3 day week (and you know, I have forgotten how we covered the 7th day!). For the 2nd-level managers like me, the reaction was "Wow! I will only have to work 12-18 hours three days a week! -- sed quis custodiet ipsos custodes? (Juvenal)

1 0

speedtest vs geo-coding IP info
by lorell＠hathcock.org 28 Oct '15

28 Oct '15

Legions of NANOG: Here's an interesting problem. My customers are running speedtests from Ookla's speedtest.net site. The default site is in Kansas and not in Texas where we receive our internet connection. Questions: 1. How do I go about viewing the geo-coded data that accompanies my IP addresses? This is obviously a database that is kept for geo-coding purposes. The whois info for the block in question traces back to a superblock formerly owned by PSINet, Inc and has a Washington, DC address. I conclude that the geo-coding used by speedtest.net is not from the whois database. 2. If I pestered my carrier to SWIP the IP address block to me (as they should have?) would that help me solve my problem? 3. Is there anything else I need to be thinking of that would help me have better control of my geo-coding info? Are there third-party self sign up/volunteer database which house geo-coding info? Thanks in advance! Sincerely, Lorell Hathcock Chief Technology Officer SolStar Network, LLC Communications FIBER - VOIP - SECURITY - TV FTTH - Commercial - Residential Burglar - Access Control 956-478-5955 (cell) - 956-316-4090 (main) <mailto:lorell@SolStarNetwork.com> lorell(a)SolStarNetwork.com <http://www.solstarnetwork.com/> www.SolStarNetwork.com TX License #B19998

4 4

Uptick in spam
by anthony kasza 28 Oct '15

28 Oct '15

Has there been a recent uptick in crap sent to the list or is it just me? Is there anything that we can do to filter these messages with junk links? -AK

24 34

Anyone here from Orbitz?
by Andy Ringsmuth 28 Oct '15

28 Oct '15

Any chance someone on the list from Orbitz? Car rentals are suddenly impossible to book. It seems there’s a session timeout set to essentially zero. Selecting a vehicle returns this URL: http://www.orbitz.com/shop/home?errorId=3207 And an error of “We’ve noticed you’ve been away from this page for a while and your session has timed out. Please try again.” ---- Andy Ringsmuth andy(a)newslink.com News Link – Manager Travel, Technology & Facilities 2201 Winthrop Rd., Lincoln, NE 68502-4158 (402) 475-6397 (402) 304-0083 cellular

1 0

spam smackdown?
by Scott Weeks 28 Oct '15

28 Oct '15

It looks like someone's trying to make a point. --------------------------------- New message, please read <http://xxxxxxxxx> ----------------------------------- scott

10 9

Re: *tap tap* is this thing on?
by Dovid Bender 28 Oct '15

28 Oct '15

The reason they are the big boys is because they don't fund such operations. They see money before what you call obligations. Right or wrong they will sell a product if they think they can make it work. Making it work is all subjective. You say it means handling abuse complaints while they say it means the client being connected and able to ping the world. ------Original Message------ From: Rich Kulawiec Sender: NANOG To: nanog(a)nanog.org Subject: Re: *tap tap* is this thing on? Sent: Oct 27, 2015 06:30 On Mon, Oct 26, 2015 at 02:48:59PM -0600, Brielle Bruns wrote: > I get it that it is hard for large providers to be proactive about > things going on due to the sheer size of their networks, but come > on. That excuse only works for so long. 1. It's not hard. It's far easier for large providers than small ones, although many of them flat-out lie and claim the opposite. 2. Whatever happened to "never build what you can't control?" If you can't stop your operation from emitting abuse, you should shut it down. Immediately. That's what professionals do. 3. Large providers pretend to be "leaders", but are among the worst in terms of actually leading by example. Just try getting a response from them via postmaster@ or abuse@. Of course these large operations should individually answer *every* message to those addresses promptly, 24x7, and initiate immediate investigation/remediation on *every* complaint. That's baseline operational competence 101, and given their enormous financial and personnel resources, it would require only a tiny amount of resources. But they don't -- and everyone else pays the price for it. ---rsk Regards, Dovid

1 0

IPligence?
by Dennis Burgess 28 Oct '15

28 Oct '15

Anyone have a contact for Ipligence, looks like a company out of Spain that does geoip database work. They have some issues with their database, and can't find a way to get in contact with them. They don't answer their support e-mails. Thanks, [DennisBurgessSignature] www.linktechs.net<http://www.linktechs.net/> - 314-735-0270 x103 - dmburgess(a)linktechs.net<mailto:dmburgess@linktechs.net>

2 1