May 2015 - Test - lists.nanog.org

Is anyone working on an RFC for standardized maintenance notifications
by Robert Drake 22 May '15

22 May '15

Like the "Automated Copyright Notice System" (http://www.acns.net/spec.html) except I don't think they went through any official standards body besides their own MPAA, or whatever. I get circuits from several vendors and get maintenance notifications from them all the time. Each has a different format and each supplies different details for their maintenance. Most of the time there are core things that everyone wants and it would be nice if it were automatically readable so automation could be performed (i.e., our NOC gets the email into our ticketing system. It is recognized as being part of an existing maintenance due to maintenance id# (or new, whatever) and fields are automatically populated or updated accordingly. If you're uncomfortable with the phrase "automatically populated accordingly" for security reasons then you can replace that with "NOC technician verifies all fields are correct and hits update ticket." or whatever. The main fields I think you would need: 1. Company Name 2. Maintenance ID 3. Start Date 4. Expected length 5. Circuits impacted (if known or applicable) 6. Description/Scope of Work (free form) 7. Ticket Number 8. Contact

4 3

bing on v6
by Bajpai, Vaibhav 21 May '15

21 May '15

Dear NANOG, We do not see AAAA entries for www.bing.com since Sep 2013 anymore [1]. For sure this is only from our measurement vantage points, so may not be true globally. Does anybody know the backstory of what happened? [1] http://goo.gl/K1Zx4u (see: slide 23/32) Thanks! Best, Vaibhav ===================================================== Vaibhav Bajpai Research I, Room 91 Computer Networks and Distributed Systems (CNDS) Lab School of Engineering and Sciences Jacobs University Bremen, Germany www.vaibhavbajpai.com =====================================================

4 4

Cisco NX 5548UP Monitoring
by sathish kumar Ippani 21 May '15

21 May '15

Hi All, Thanks for reviewing my query. I am very new to NX OS, and I would like to know, what are the entities that we can monitor. Currently we are doing basic monitoring like interface, bandwidth usage -- With Regards, Sathish Kumar Ippani 9177166040

1 0

Low Cost 10G Router
by Colton Conor 21 May '15

21 May '15

What options are available for a small, low cost router that has at least four 10G ports, and can handle full BGP routes? All that I know of are the Juniper MX80, and the Brocade CER line. What does Cisco and others have that compete with these two? Any other vendors besides Juniper, Brocade, and Cisco to look at?

40 81

Re: Low Cost 10G Router
by Bryan Fields 20 May '15

20 May '15

On 5/19/15 1:22 PM, Colton Conor wrote: > What options are available for a small, low cost router that has at least > four 10G ports, and can handle full BGP routes? All that I know of are the > Juniper MX80, and the Brocade CER line. What does Cisco and others have > that compete with these two? Any other vendors besides Juniper, Brocade, > and Cisco to look at? In the same price range as the MX80 there is the Alcatel SRa-4/8 router. These will do 100g in and out, and handle full tables. You get redundant control modules vs. a single on the juniper. BGP is multi-threaded on the box, does RPKI for route verification, and it's got extensive HQoS functionality amongst other features. -- Bryan Fields 727-409-1194 - Voice 727-214-2508 - Fax http://bryanfields.net

2 1

AT&T/Telia issue
by Tyler Applebaum 20 May '15

20 May '15

Seeing this on AS7018 to AS1299. Anyone out there at either provider know anything about this? HOST: PC-002 Loss% Snt Last Avg Best Wrst StDev 1.|-- 172.31.255.1 0.0% 10 1 0.7 0 3 0.9 2.|-- 10.98.0.3 0.0% 10 1 1.0 1 1 0.0 3.|-- 67.51.253.17 0.0% 10 2 2.5 2 4 0.7 4.|-- 67.51.253.3 0.0% 10 1 1.2 1 2 0.4 5.|-- v202.core1.pdx1.he.net 0.0% 10 7 10.5 7 12 1.9 6.|-- 10ge12-4.core1.sea1.he.net 0.0% 10 5 5.0 5 5 0.0 7.|-- sea-b1-link.telia.net 0.0% 10 5 5.8 5 12 2.2 8.|-- den-b1-link.telia.net 0.0% 10 108 107.3 106 108 0.7 9.|-- sjo-b21-link.telia.net 20.0% 10 137 134.9 134 137 1.0 10.|-- 192.205.33.45 40.0% 10 136 136.2 135 138 1.2 11.|-- cr1.sffca.ip.att.net 10.0% 10 141 141.9 139 145 1.9 12.|-- 12.122.2.77 20.0% 10 140 140.1 137 142 2.0 13.|-- 12.122.160.149 10.0% 10 138 141.1 137 164 8.6 14.|-- 12.117.131.214 30.0% 10 139 141.0 139 145 1.9 15.|-- 199.103.47.2 30.0% 10 51 128.0 51 142 34.0 HOST: PC-002 Loss% Snt Last Avg Best Wrst StDev 1.|-- 172.31.255.1 0.0% 20 1 1.1 0 3 0.6 2.|-- 10.98.0.4 0.0% 20 1 1.3 1 4 0.7 3.|-- 67.51.253.17 0.0% 20 3 4.9 2 48 10.2 4.|-- 67.51.253.1 0.0% 20 2 1.1 1 2 0.3 5.|-- 67.51.253.11 0.0% 20 1 1.4 1 2 0.5 6.|-- v202.core1.pdx1.he.net 0.0% 20 6 9.1 1 12 3.2 7.|-- 10ge12-4.core1.sea1.he.net 0.0% 20 5 6.5 5 11 1.7 8.|-- sea-b1-link.telia.net 0.0% 20 5 5.1 5 6 0.3 9.|-- att-ic-153030-sea-b1.c.telia.net 0.0% 20 9 7.7 6 9 1.2 10.|-- cr83.st0wa.ip.att.net 5.0% 20 118 119.7 117 123 1.5 11.|-- cr2.ptdor.ip.att.net 0.0% 20 119 120.1 118 122 1.4 12.|-- cr2.sffca.ip.att.net 0.0% 20 120 119.2 117 121 1.4 13.|-- cr2.sc1ca.ip.att.net 0.0% 20 119 121.1 118 149 6.6 14.|-- 12.122.151.129 0.0% 20 118 119.8 117 122 1.5 15.|-- ??? 100.0% 20 0 0.0 0 0 0.0 16.|-- 71.157.120.39 75.0% 20 119 118.6 118 119 0.5 17.|-- 108-248-29-59.lightspeed.renonv.sbcglobal.net 5.0% 20 139 137.1 135 146 2.5 18.|-- 108-241-228-42.lightspeed.renonv.sbcglobal.net 5.0% 20 143 139.2 135 152 4.9 Attention: Information contained in this message and or attachments is intended only for the recipient(s) named above and may contain confidential and or privileged material that is protected under State or Federal law. If you are not the intended recipient, any disclosure, copying, distribution or action taken on it is prohibited. If you believe you have received this email in error, please contact the sender, delete this email and destroy all copies.

3 3

Spamhaus BGP feed experiences?
by Mike Lyon 20 May '15

20 May '15

Howdy! Any ISPs out there (big or small) ever used the Spamhaus BGP feed to prevent against botnet, spam, etc? If so, how has your experience been? Is it worthwhile? Has it helped? On / off list responses are appreciated in advance. Thank You, Mike -- Mike Lyon 408-621-4826 mike.lyon(a)gmail.com http://www.linkedin.com/in/mlyon

6 5

Re: your mail
by Larry Sheldon 19 May '15

19 May '15

On 5/19/2015 15:37, Jared Mauch wrote: > Can someone fix the DMARC settings to something > more sensible? I've had to deal with this on the outages list > already and it's simple to have it work in a more predictable way for > users than injecting this text. > > > The best settings are Munge From, (dmarc_moderation_action) > as it will preserve the thread in a sensible way. I feel it's quite > damaging to keep injecting this into the thread. One should also clear > the dmarc_wrapped_message_text setting. Blank subject lines get routed to the spam sump here. As a matter of policy, I do not open unexpected attachments, and strong suggest that opening an unexpected attachment may be the most dangerous thing you can do with an email reader is some environments. -- sed quis custodiet ipsos custodes? (Juvenal)

1 0

Re: your mail
by Jared Mauch 19 May '15

19 May '15

On Tue, May 19, 2015 at 03:53:19PM +0000, Ryan Shea via NANOG wrote: > This post was from a subscriber whose From: address domain has a DMARC > policy of reject or quarantine. The NANOG mailing list has > automatically wrapped this message to prevent other subscribers mail > systems from rejecting it. Can someone fix the DMARC settings to something more sensible? I've had to deal with this on the outages list already and it's simple to have it work in a more predictable way for users than injecting this text. The best settings are Munge From, (dmarc_moderation_action) as it will preserve the thread in a sensible way. I feel it's quite damaging to keep injecting this into the thread. One should also clear the dmarc_wrapped_message_text setting. - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Re:
by Christopher Morrow 19 May '15

19 May '15

(-direct-ryan) yikes formatting for this got wonky... On Tue, May 19, 2015 at 11:53 AM, Ryan Shea via NANOG <nanog(a)nanog.org> > ---------- Forwarded message ---------- > From: Ryan Shea <ryanshea(a)google.com> > To: nanog list <nanog(a)nanog.org> > Cc: > Date: Tue, 19 May 2015 15:53:15 +0000 > Subject: Unified Security Vulnerability Management > > Manually setting up and parsing email notifications for security > vulnerabilities for all vendors is mighty annoying. It looks like the ICASI > CVRF <http://www.icasi.org/cvrf> Working Group thought the same thing back > in 2011 when they came up with this handy XML schema. I had not known of > this until yesterday and noticed that Cisco does a good job > <http://tools.cisco.com/security/center/cvrfListing.x> posting their > vulnerabilities in CVRF. Word on the streets is that Juniper > <https://twitter.com/junipersirt/status/70627418737610752> was at least > partially involved in CVRF as well. Brocade may have looked into it as well. > > This does not seem like a difficult thing for vendors to do, but the > missing piece may be customer interest. I am hoping to drum up some > interest here -- maybe a few support requests would entice them to hand > this off to an intern and we could collectively do better at managing > vendor notifications. A tool <https://github.com/mschiffm/cvrfparse> to > parse CVRF is already floating about as well (mschiffm). I bet if we can get FR/PR numbers for some vendors we might be able to get a bunch of people to add support through a central set of points per vendor. Can we put the PR for juniper here? (and if other folk have a PR/FR for their pet vendor(s) add those to the list?)

1 0