October 2015 - Test - lists.nanog.org

Global Crossing contact
by Jim McBurnett 28 Oct '15

28 Oct '15

Hi folks, Sorry to add to the noise level, but need to reach someone at level2/3 at Global crossing for a pathing issue. Please contact me offlist so we can figure out where some traffic is being lost. Thanks, Jim [cid:image321144.PNG@13411130.448fc74e]<http://TGASolutions.com><http://tgasolutions.com> Jim McBurnett | Senior Network Engineer TGA Solutions 13891 Asheville Highway | Inman, SC 29349 Tel (864) 473-1200 | Support 864-708-0616 Website<http://www.tgasolutions.com/> | Email<mailto:jim@tgasolutions.com> <https://twitter.com/tgasolutions> [cid:image48ea14.GIF@cce627af.4c881bf4] <https://twitter.com/tgasolutions> [cid:image0cd093.GIF@9be97be4.4185bb9a] <https://www.facebook.com/pages/TGA-Solutions/171403666251238> <https://www.facebook.com/pages/TGA-Solutions/171403666251238> [cid:image334971.GIF@85a3af4d.489311ca] <https://www.linkedin.com/company/247020?trk=tyah/in/rexweston/> [cid:image6b6966.GIF@ef589bf0.4db7e941] <https://twitter.com/tgasolutions> <https://www.linkedin.com/company/247020?trk=tyah/in/rexweston/> [cid:image2cf82a.PNG@a3058521.419c8c19]<http://tgasolutions.com>

1 0

DNSSEC broken for login.microsoftonline.com
by Bruce Curtis 28 Oct '15

28 Oct '15

FYI our DNS requests to resolve login.microsoftonline.com are failing because of a DNSSEC error. http://dnssec-debugger.verisignlabs.com/login.microsoftonline.com http://dnsviz.net/d/login.microsoftonline.com/dnssec/ ns1 domain]$ drill -DT login.microsoftonline.com Warning: No trusted keys were given. Will not be able to verify authenticity! ;; Domain: . ;; Signature ok but no chain to a trusted key or ds record [S] . 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b} . 172800 IN DNSKEY 256 3 8 ;{id = 62530 (zsk), size = 1024b} Checking if signing key is trusted: New key: . 172800 IN DNSKEY 256 3 8 AwEAAbgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNMioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaRF2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXl ;{id = 62530 (zsk), size = 1024b} [S] com. 86400 IN DS 30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766 ;; Domain: com. ;; Signature ok but no chain to a trusted key or ds record [S] com. 86400 IN DNSKEY 256 3 8 ;{id = 51797 (zsk), size = 1024b} com. 86400 IN DNSKEY 257 3 8 ;{id = 30909 (ksk), size = 2048b} [S] Existence denied: microsoftonline.com. DS ;; No ds record for delegation ;; Domain: microsoftonline.com. ;; No DNSKEY record found for microsoftonline.com. ;; No DS for login.microsoftonline.com.;; No ds record for delegation ;; Domain: login.microsoftonline.com. ;; No DNSKEY record found for login.microsoftonline.com. [U] No data found for: login.microsoftonline.com. type A ;;[S] self sig OK; [B] bogus; [T] trusted [ns1 domain]$ [ns1 domain]$ drill -DT medicare.gov Warning: No trusted keys were given. Will not be able to verify authenticity! ;; Domain: . ;; Signature ok but no chain to a trusted key or ds record [S] . 172800 IN DNSKEY 256 3 8 ;{id = 62530 (zsk), size = 1024b} . 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b} Checking if signing key is trusted: New key: . 172800 IN DNSKEY 256 3 8 AwEAAbgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNMioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaRF2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXl ;{id = 62530 (zsk), size = 1024b} [S] gov. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe gov. 86400 IN DS 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ;; Domain: gov. ;; Signature ok but no chain to a trusted key or ds record [S] gov. 86400 IN DNSKEY 256 3 8 ;{id = 13175 (zsk), size = 1024b} gov. 86400 IN DNSKEY 257 3 8 ;{id = 7698 (ksk), size = 2048b} Checking if signing key is trusted: New key: gov. 86400 IN DNSKEY 256 3 8 AQPCY4NZARQ0HDzGismy6sZdJ17o2+yzmZSkw6d9PeeJ8NCnw9atj4PGHO50LX1Hy0n4YimUcDEXHu+sI4MBaeTkHY3ilsC2kpWGGOFW2fkXn6XNvvPVRjwk04hDsEFphOXPPdoXWjXtQiTVYkFpgUbxJYo24/JxM5JuC4v0+qDmLQ== ;{id = 13175 (zsk), size = 1024b} [S] medicare.gov. 3600 IN DS 16500 7 1 ea88786ecaa04e66322e4405b1c1a55e31485281 medicare.gov. 3600 IN DS 16500 7 2 43a0e12df89bb342c15229495cd2bc18dddce0d9fb315aeb5b06b0d849b9a3ee ;; Domain: medicare.gov. ;; Signature ok but no chain to a trusted key or ds record [S] medicare.gov. 7200 IN DNSKEY 256 3 7 ;{id = 58988 (zsk), size = 1024b} medicare.gov. 7200 IN DNSKEY 256 3 7 ;{id = 41714 (zsk), size = 1024b} medicare.gov. 7200 IN DNSKEY 257 3 7 ;{id = 16500 (ksk), size = 2048b} [S] medicare.gov. 20 IN A 23.213.71.152 ;;[S] self sig OK; [B] bogus; [T] trusted --- Bruce Curtis bruce.curtis(a)ndsu.edu Certified NetAnalyst II 701-231-8527 North Dakota State University

3 7

algeria
by Randy Bush 27 Oct '15

27 Oct '15

any gossip of a cable issue to algier? randy

2 2

Is anyone tracking the "Fw: New Message" joe-job spammer?
by Jay Ashworth 27 Oct '15

27 Oct '15

Cause if so I got about 100 examples from last night I can send you if you think they'll help. :-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

4 3

[Discussion] MTU mismatch and impact of data-plane traffic
by Mohamed Kamal 27 Oct '15

27 Oct '15

Suppose you have the below network topology, where PE is connected to P1, P1 is connected to P2 and P2 is connected to GW, all through 1G links. [PE]-1500------------1500-[P1]-1600------------1600-[P2]-1500------------1600-[GW] The numbers represent the MTU values configured in the following order; PE's egress interface to P1, P1 ingress interface, P1 egress interface, P2 ingress, P2 egress and eventually GW ingress. Q1: What do you think would be the impact in terms of data-plane traffic (HTTP/s browsing, Video streaming etc), traversing this network, in the direction from the Internet and going to the PE router? My answer is: If there is a client running Win7 on a machine trying to access a web server out there, the TCP MSS would be adjusted to around 1260-1460 bytes depending on the Operating System's MTU value. Hypothetically, the first packet from the web server destined to the client would be 1460-bytes and will reach the ingress interface of the GW. The GW would receive it in the input_buffer of the ingress interface, strip off the Ethernet header, and move it to the output buffer of the egress interface whose MTU is 1600. Since the largest MSS is 1460, and there is always a one-to-one mapping between segments received from the TCP module and the packets constructed in the IP module, I believe that the largest IP packet would be 1480. GW would cram the Ethernet frame with the 1480-bytes of IP payload data and send it to the P2, which would in the other end, pass it on its way. Q2: However, what about larger MSS sizes? example; above 1500? and larges chunks of payload from a connectionless protocols that don't exchange MSS? UDP for example? or Google's QUIC (which is HTTP over UDP)? -- Mohamed Kamal

2 1

Fiber in\near Hoopeston, IL
by Mike Hammett 27 Oct '15

27 Oct '15

Can we talk about something not SPAM for a minute? Looking for fiber in or near Hoopeston, IL that's not the incumbent. Frontier is the ILEC and it looks like New Wave is the MSO, but New Wave doesn't appear to go to Chicago. I know of networks near 57 and 65 and also McLeod's route to the south. Any other ideas for networks in that area? I'm assuming there aren't any others, but figured I'd ping here before going with the incumbent. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

1 0

Why is NANOG not being blacklisted like any other provider that sent 500 spam messages in 3 days?
by Andrew Kirch 27 Oct '15

27 Oct '15

All, Myth: NANOG supposed to be the gold standard for best practices. Fact: 500 spam messages over the weekend. Myth: there were no complaints and this issue was raised over the weekend Fact: I raised it this weekend via twitter twice @NANOG, and requested contact from SCNET (NANOG's upstream) trying to find a live person to shut it off. Myth: blah blah blah social media is a bad way to get ahold of netops/abuse. Fact: Social media is an acceptable way to report abuse. My marketing department certainly knows how to get ahold of me when such an issue occurs. It's 2015, and if you and everyone you know isn't watching twitter I can't help you, because you've gone braindead. Myth: but you could have reached out to someone else and maybe done something to stop this quickly. Fact: I reached out to several people at ARIN and elsewhere trying to get a live person at NANOG to no avail. Myth: this is acceptable because NANOG has political clout in the US and elsewhere. Fact: If I was still running the AHBL, NANOG would be it's own private intranet right now. Andrew

11 11

*tap tap* is this thing on?
by Brielle Bruns 27 Oct '15

27 Oct '15

This spam flood is kinda hilarious in a way. Any idea why no one with mod or admin privs for the mailing list has bothered to step in and deal with this? -- Brielle Bruns The Summit Open Source Development Group http://www.sosdg.org / http://www.ahbl.org

11 14

BGP hold timer on IX LAN
by marcel.duregards＠yahoo.fr 27 Oct '15

27 Oct '15

Hello, As all of us know BGP was designed for scalability, thus slow convergence. But it was also when CPU was slow :-). What do you think about the standard eBGP hold timer of 180sec ? Conservative ? I'm asking because we see more and more peering partners which force the hold timer to a lower value, and when BGP negotiate the timer, the lowest hold timer is the winner. Shall we all decide that for global faster convergence we should ALL decrease the hold timer ? Or those guys which are lowering their (and our) timers on IX LAN play a dangerous game ? See a example of our peering router at AMS-IX (hold from 30s to 180s): ...... BGP neighbor is 193.239.116.13x, remote AS 12x54, external link Last read 00:00:42, last write 00:00:13, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.13x, remote AS 31x77, external link Last read 00:00:09, last write 00:00:03, hold time is 90, keepalive interval is 30 seconds BGP neighbor is 193.239.116.13x, remote AS 4x562, external link Last read 00:00:30, last write 00:00:07, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.14x, remote AS 4x350, external link Last read 00:00:01, last write 00:00:01, hold time is 30, keepalive interval is 10 seconds BGP neighbor is 193.239.116.14x, remote AS 341x1, external link Last read 00:00:09, last write 00:00:27, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.14x, remote AS 2x028, external link Last read 00:00:00, last write 00:00:21, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.15x, remote AS 41x52, external link Last read 00:00:27, last write 00:00:11, hold time is 90, keepalive interval is 30 seconds BGP neighbor is 193.239.116.18x, remote AS 1x041, external link Last read 00:00:20, last write 00:00:14, hold time is 90, keepalive interval is 30 seconds BGP neighbor is 193.239.116.18x, remote AS 162x8, external link Last read 00:00:28, last write 00:00:06, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.20x, remote AS 47x86, external link Last read 00:00:59, last write 00:00:21, hold time is 180, keepalive interval is 60 seconds BGP neighbor is 193.239.116.21x, remote AS x3350, external link Last read 00:00:02, last write 00:00:01, hold time is 30, keepalive interval is 10 seconds BGP neighbor is 193.239.116.24x, remote AS x5133, external link Last read 00:00:24, last write 00:00:03, hold time is 90, keepalive interval is 30 seconds ..... I've somehow basically anonymized ip and AS just in case I'm not allowed to publish those details. Best Regards, -Marcel

4 3

Fw: new message
by Nicolas Viers - Univ. Limoges 27 Oct '15

27 Oct '15

Hey! New message, please read <http://talky.vn/been.php?qw> Nicolas Viers - Univ. Limoges

9 9