October 2016 - Test - lists.nanog.org

Sling Media on list?
by Shon Elliott 03 Oct '16

03 Oct '16

Anyone from Sling Media on NANOG? If so, can you please contact me off-list? We have a net block that you guys have incorrect information for which is causing grief for our mutual customers. Kind Regards, Shon Elliott, KK6TOO selliott(a)getunwired.com<mailto:selliott@getunwired.com>

1 0

Root Zone DNSSEC Operational Update -- ZSK length change
by Wessels, Duane 03 Oct '16

03 Oct '16

As you may know, Verisign, in its role as the Root Zone Maintainer is also the operator of the root zone Zone Signing Key (ZSK). Later this year, we will increase the size of the ZSK from 1024-bits to 2048-bits. The root zone ZSK is normally rolled every calendar quarter, as per our “DNSSEC Practice Statement for the Root Zone ZSK operator.”[1] The ZSK public keys are signed at quarterly key signing ceremonies by ICANN in its role as the IANA Functions Operator. On September 20, 2016 the 2048-bit ZSK will be pre-published in the root zone, following the standard ZSK rollover procedure. We intend to begin publishing root zones signed with the first 2048-bit ZSK on October 1, 2016. Some details of the ZSK size transition have recently been presented at the DNS-OARC, NANOG, RIPE, ICANN, and IETF meetings.[2] If you have any questions or concerns, please feel free to contact us at zms(a)verisign.com. Please feel free to forward this message to anyone who might not have seen it here. [1] https://www.verisign.com/assets/dps-zsk-operator-1532.pdf [2] https://ripe72.ripe.net/wp-content/uploads/presentations/168-verisign-zsk-c…

2 4

Any ISPs using AS852 for IP Transit?
by Jason Lixfeld 03 Oct '16

03 Oct '16

If there are any ISPs who use TELUS/AS852 for IP Transit over BGP, I’d be interested in hearing from you. I’d like to compare notes to see if you are also paying $250 for each BGP prefix filter updated request, or if we’re the only ones… Thanks in advance!

8 10

nexus N3K-C3064PQ vs juniper ex4500 in order to protect against ddos
by Pedro 03 Oct '16

03 Oct '16

Hello, I have some idea to put switch before bgp router in order to terminate isp 10G uplinks on switch, not router. Main reason is that could be some kind of 1st level of defence against ddos, second reason, less important, save cost of router ports, do many port mirrors. I think about N3K-C3064PQ or Juniper ex4500 because there are quite cheap and a lot of on Ebay. I would like on nexus or juniper try use some feature: - limit udp, icmp, bum packets (bandwith,pps) at ingress tagged port or vlan - create counters: passed and dropped packets, best way to get this counters via snmp oid, sent snmp traps, syslog etc in order to monitor or even as a action shut down port - port mirror from many ports/vlans to multiple port (other anty ddos solutions) - limited bgp but with flowspec to comunicate with another anty ddos devices I'm also wondering how this feature above impact on cpu/whole switch. It can be some performance degradation ot all of this feature are done in hardware, with wirespeeed ? Which model will better to do this ? Thanks for any advice, Pedro --- Ta wiadomość została sprawdzona na obecność wirusów przez oprogramowanie antywirusowe Avast. https://www.avast.com/antivirus

7 11

Re: Request for comment -- BCP38
by Hugo Slabbert 02 Oct '16

02 Oct '16

On Mon 2016-Sep-26 12:25:58 -0400, John R. Levine <johnl(a)iecc.com> wrote: >>>>I gather the usual customer response to this is "if you don't want our >>>>$50K/mo, I'm sure we can find another ISP who does." > >>I myself am talking about the latter and included the option of PI >>space to cover that (although I guess at some point this can be >>made fly with PA space from another provider if both providers are >>willing enough to play ball), though from the $50/mo figure John >>listed, I'm assuming he's talking about the latter. > >Who said $50/mo? Apparently I need even more caffeine that I first imagined... If we're talking about networks with that kind of MRC, is it really that far of a stretch to require PI space for this? Then again: If we're talking about that kind of MRC, then I'm assuming ISP A can be coaxed to allow explicit and well-defined exceptions on the customer's links. This discussion started wrt to COTS dual-ISP routers though, as mentioned in Ken Chase's message, no? Where I'm assuming we're talking about mom-and-pop operations rather than a $50K/mo business account. > >Regards, >John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", >Please consider the environment before reading this e-mail. https://jl.ly -- Hugo Slabbert | email, xmpp/jabber: hugo(a)slabnet.com pgp key: B178313E | also on Signal

3 3

Request for comment -- BCP38
by Stephen Satchell 02 Oct '16

02 Oct '16

Is this an accurate thumbnail summary of BCP38 (ignoring for the moment the issues of multi-home), or is there something I missed? > The basic philosophy of BCP38 boils down to two axioms: > > Don't let the "bad stuff" into your router > Don't let the "bad stuff" leave your router > > The original definition of "bad stuff" is limited to source- > address grooming both inbound and outbound. I've expanded on the > original definition by including rule generation to control > broadcast address abuse.

17 36

Kudos to Rogers Wireless on IPv6 deployment
by Hugo Slabbert 02 Oct '16

02 Oct '16

So frequently on this list we hear people asking/begging their providers for IPv6 roadmaps or chastising them for the lack of same, that I thought it might be nice to actually give props to a provider actually moving the needle. I was pleasantly surprised today to notice an IPv6 address on my Android smartphone on the Rogers Wireless LTE network. I had to do a double-take and poke through test-ipv6.com to make sure something wasn't amiss, but there it was: honest-to-$deity dual stack service on a Canadian mobile provider, with a dual-stack resolver and everything! ;) So, kudos, Rogers Wireless! So that's Rogers on the wireless side (with Telus Mobility at last check being in early stages but not yet fully rolled out), and basically Rogers, Telus and a bunch of smaller or regional ISPs that have deployed IPv6 on residential and/or business wired service. Shaw? Bell? (FYI Bell, your IPv6 Starter Kit linked from http://ipv6.bell.ca/ currently hits a 404. -- Hugo Slabbert | email, xmpp/jabber: hugo(a)slabnet.com pgp key: B178313E | also on Signal

4 3

BCP38 adoption "incentives"?
by Stephen Satchell 02 Oct '16

02 Oct '16

Does anyone know if any upstream and tiered internet providers include in their connection contracts a mandatory requirement that all directly-connected routers be in compliance with BCP38? Does anyone know if large ISPs like Comcast, Charter, or AT&T have put in place internal policies requiring retail/business-customer-aggregating routers to be in compliance with BCP38? Does any ISP, providing business Internet connectivity along with a block of IP addresses, include language in their contracts that any directly connected router must be in compliance with BCP38? I've seen a lot of moaning and groaning about how BCP38 is pretty much being ignored. Education is one way to help, but that doesn't hit anyone in the wallet. You have to motivate people to go out of their way to *learn* about BCP38; most business people are too busy with things that make them money to be concerned with "Internet esoterica" that doesn't add to the bottom line. You have to make their ignorance SUBTRACT from the bottom line. Contracts, properly enforced, can make a huge dent in the problem of BCP38 adoption. At a number of levels. Equipment manufacturers not usually involved in this sort of thing (home and SOHO market) would then have market incentive to provide equipment at the low end that would provide BCP38 support. Especially equipment manufacturers that incorporate embedded Linux in their products. They can be creative in how they implement their product; let creativity blossom. I know, I know, BCP38 was originally directed at Internet Service Providers at their edge to upstreams. I'm thinking that BCP38 needs to be in place at any point -- every point? -- where you have a significant-sized collection of systems/devices aggregated to single upstream connections. Particular systems/devices where any source address can be generated and propagated -- including compromised desktop computers, compromised light bulbs, compromised wireless routers, compromised you-name-it. (That is one nice thing about NAT -- the bad guys can't build spoofed packets. They *can* build, um, "other" packets...which is a different subject entirely.) (N.B.: Now you know why I'm trying to get the simplest possible definition of BCP38 into words. The RFCs don't contain "executive summaries".)

16 25