June 2016 - Test - lists.nanog.org

Bad firewall/nameserver behaviour causing timeouts of DNS queries.
by Mark Andrews 22 Jun '16

22 Jun '16

The following nameservers for Alexa top 1M names fail to respond to EDNS queries with EDNS options specified or fail to respond to consecutive EDNS queries. These have been run through the checks multiple times to reduce the probability of false positives as timeout can be the due to multiple causes. For many there are other errors that should also be addressed. This misbehaviour can cause DNSSEC validation to FAIL when the servers serve signed zones. This misbehaviour does result in significantly slower DNS resolution (multiple seconds). You can test your servers at https://ednscomp.isc.org/ This is sent here because both SOA and whois contact details are wrong too often to bother trying to send to these addresses even if whois was easy to parse. Please fix your firewalls / nameservers as they are causing operational problems. Mark lb.pagofacil.com.ar lb.pagofacil.com.ar lb.pagofacil.com.ar server.inet.edu.ar siet.inet.edu.ar ns2.pillar.com.au ns1.agric.wa.gov.au ns2.agric.wa.gov.au ns3.agric.wa.gov.au ns1.win.be ns2.win.be ns.ahlia.edu.bh lb3.ache.com.br ns2.bibliomed.com.br ns3.caixaseguros.com.br sdccd01.light.com.br ns1.poupex.com.br ns3.poupex.com.br ns1.semparar.com.br ns2.semparar.com.br creaprw12.crea-pr.org.br dns5.allstate.ca ns1.bellnhs.ca ns3.bellnhs.ca ns5.bellnhs.ca ns1.cpr.ca ns2.cpr.ca ns1.cnsc-ccsn.gc.ca ns2.cnsc-ccsn.gc.ca ns1.knowledgeone.ca ns2.knowledgeone.ca ns3.mmms.ca gemini.hrsb.ns.ca ns.city.windsor.on.ca ns2.city.windsor.on.ca ns1.thomascookgroup.ca ns2.thomascookgroup.ca ns1.bger.ch ns2.bger.ch dn2.1.cl ns.autopistacentral.cl peumo.bancoconsorcio.cl roble.bancoconsorcio.cl dns.bci.cl dns2.bci.cl ns.subtel.cl nsaut.tie.cl ns2.sina.com.cn name.srit.com.cn dns.hncj.edu.cn dns2.hncj.edu.cn dns.hut.edu.cn dns2.hut.edu.cn dns.jju.edu.cn dns.lit.edu.cn dns.by.gov.cn dns2.gxeea.cn ns1.coscologistics.sh.cn ariadne.presidencia.gov.co bdpalacio.presidencia.gov.co ns3.360safe.com ns4.360safe.com ns5.360safe.com ns2.51dns.com ns8.91989.com ns9.91989.com ns1.advisorlynx.com ns2.advisorlynx.com ns1.aegis-k.com ns2.aegis-k.com ns1.affinity-petcare.com ns01.airliquide.com ns03.airliquide.com ns1.alidns.com ns1.alidns.com ns2.alidns.com ns2.alidns.com ns2.alidns.com vip1.alidns.com vip1.alidns.com vip1.alidns.com vip1.alidns.com vip1.alidns.com vip1.alidns.com vip2.alidns.com vip2.alidns.com vip2.alidns.com vip2.alidns.com vip2.alidns.com vip2.alidns.com vip2.alidns.com ns1.amaes.com ns2.amaes.com ns1.amatteroffax.com ns3.amvescap.com ns5.amvescap.com ns1.arcatapet.com office.arcatapet.com pridns.ascendas.com ns01.avanade.com ns02.avanade.com ns2.avastkorea.com det.dns.bbdo.com ns1.bcbsmn.com ns2.bcbsmn.com harris-ns.bcharrispub.com harris-ns2.bcharrispub.com bor-cp01.borouge.com bvdns.broadviewnet.com bvdns2.broadviewnet.com ns5.carbonlogic.com ns2.ccmnyc.com ns1.cmsbiztech.com ns1.corsicaferries.com ns3.corsicaferries.com ns4.corsicaferries.com ns1.credibanco.com ns2.credibanco.com cscdnscph002d.csc.com cscdnshyd002d.csc.com cscdnsklm002d.csc.com cscdnsmds002d.csc.com cscdnsnoi002d.csc.com cscdnssng002d.csc.com palladium.csc.com wserver.cyberdental.com webmail.dbfsindia.com ns1.deseretdigital.com ns2.deseretdigital.com huey.disney.com huey11.disney.com a.dnspod.com a.dnspod.com c.dnspod.com c.dnspod.com ns1.dnsv2.com ns1.dnsv2.com ns1.dnsv2.com ns1.dnsv2.com ns1.dnsv2.com ns2.dnsv2.com ns2.dnsv2.com ns2.dnsv2.com ns2.dnsv2.com ns1.dnsv3.com ns1.dnsv3.com ns1.dnsv3.com ns1.dnsv3.com ns1.dnsv3.com ns1.dnsv3.com ns2.dnsv3.com ns2.dnsv3.com ns1.dnsv4.com ns1.dnsv4.com ns1.dnsv4.com ns1.dnsv4.com ns1.dnsv4.com ns2.dnsv4.com ns2.dnsv4.com ns2.dnsv4.com ns2.dnsv4.com ns2.dnsv4.com ns2.dnsv4.com ns2.dnsv4.com ns1.dnsv5.com ns1.dnsv5.com ns1.dnsv5.com ns1.dnsv5.com ns1.dnsv5.com ns1.dnsv5.com ns1.dnsv5.com ns1.dnsv5.com ns1.dnsv5.com ns2.dnsv5.com ns2.dnsv5.com ns2.dnsv5.com ns2.dnsv5.com ns2.dnsv5.com ns2.dnsv5.com ns2.dnsv5.com ns2.dnsv5.com ns2.dnsv5.com ns03.dominos.com ns04.dominos.com ns05.dominos.com ns1.dynalifedx.com ns1.dynamex.com ns2.dynamex.com name1.eidebailly.com name2.eidebailly.com ns1.evaair.com ns2.evaair.com ns3.evaair.com ns4.evaair.com ns.excodaegu.com ns.fanforum.com ns1.fanforum.com leo.generator.com ns1.gesnetwork.com ns01.globalexchangetechnology.com ns02.globalexchangetechnology.com gtmgrin.gmrc.com gtmnew.gmrc.com ns3.gmrc.com ns4.gmrc.com ns2.greensburgdailynews.com dns.heffel.com dns1.hichina.com dns1.hichina.com dns1.hichina.com dns10.hichina.com dns10.hichina.com dns10.hichina.com dns11.hichina.com dns11.hichina.com dns11.hichina.com dns13.hichina.com dns13.hichina.com dns13.hichina.com dns14.hichina.com dns14.hichina.com dns14.hichina.com dns17.hichina.com dns17.hichina.com dns18.hichina.com dns18.hichina.com dns2.hichina.com dns2.hichina.com dns21.hichina.com dns21.hichina.com dns21.hichina.com dns22.hichina.com dns22.hichina.com dns22.hichina.com dns25.hichina.com dns25.hichina.com dns25.hichina.com dns26.hichina.com dns26.hichina.com dns26.hichina.com dns29.hichina.com dns29.hichina.com dns29.hichina.com dns30.hichina.com dns30.hichina.com dns30.hichina.com expirens3.hichina.com expirens4.hichina.com ns1.hichina.com ns1.hichina.com ns1.hichina.com ns2.hichina.com ns2.hichina.com ns2.hichina.com dns-na-1.hill-rom.com dns-na-2.hill-rom.com dns-na-3.hill-rom.com dns5.hkinventory.com ns2.webhost.hm-software.com ns1.hotelbb.com ns10.huntington.com ns11.huntington.com ns12.huntington.com ns13.huntington.com ns.ied.com dns3.ifrontiers.com ns2.illumen.com ns1.inet-svcs.com ns2.inet-svcs.com ns4a.inet-web.com ukdns.integralis.com dns3.integramed.com ns2.jaxsheriff.com dns1.k-line.com ns1.kds.com ns2.kds.com dns2.kline.com ns.krunis.com ns.kumkang.com labattdns2.labattfood.com ns3.lallemand.com ns4.lallemand.com ns5.lfg.com ns6.lfg.com gltb-ns1.srv.lukoil.com gltb-ns2.srv.lukoil.com mbsii2.mbsii.com fox2.mightyautoparts.com ftp.munichreamerica.com dns2.mysteel.com ns1.nameaction.com ns2.nameaction.com ns2.namesv.com dns.neovi.com ns3.nextsite.com ns1.nhimidwest.com oss.oss.com ns1.page-az.com capital1.pantavanij.com slmns1.paymentech.com tamns1.paymentech.com webserver.pcgitaly.com ah-ns.plex.com dv-ns.plex.com mail.ppe.com w5.ppe.com ns.procuebynet.com ns2.project-la.com ns4.regalhotel.com ns1lo6.reutersmedia.reuters.com ns1nj.reutersmedia.reuters.com ns2lo6.reutersmedia.reuters.com ns2nj.reutersmedia.reuters.com ns1.samudera.com southern1.scsnet.com southern2.scsnet.com ns4.seacomnet.com lp1000r-10194.admin.sfhs.com dns1.shift4.com dns2.shift4.com gtm.shlegal.com skyserver.skycode.com smans1.smaportal.com vm01.splendidlive.com ns1.sterling-intl.com ns2.sterling-intl.com ns1.techdev.com ns2.techdev.com dns1.teldat.com dnsserver.teldat.com mx1.telmar.com ns1.thronecomputer.com ns03.toolwire.com ns04.toolwire.com ns0.topgayblacksites.com ns1.tranguard.com ns3.tranguard.com ns2.travelbrands.com cloud3.triara.com ns1.twglobalmall.com jinx.ucbiz.com ns1.urix.com ns2.urix.com nschs.virgin-atlantic.com nsrhl.virgin-atlantic.com ns2.welcodns.com bri-ns01.wiley.com ns1.williams.com ns2.williams.com ns1.wiredviews.com web.wlio.com ns1.yourmortgageonline.com ns2.yourmortgageonline.com dns3.zeleris.com ns3.bccr.fi.cr ns4.bccr.fi.cr ns1.network.cr ns2.network.cr aragorn.autocont.cz ns.forpsi.cz ns.profireal.cz ns2.profireal.cz ns1.euv-frankfurt-o.de ns2.euv-frankfurt-o.de dns.ipsos.de ns1.suedkurier.de ns2.suedkurier-medienhaus.de dns.webtop.de dnskm.univ-km.dz lomanegra.jardinazuayo.fin.ec ns1.amberton.edu ns1.contracosta.edu ns1.gptc.edu ns1.malone.edu ns2.malone.edu ns5.regent.edu ns.sabanciuniv.edu ns2.sabanciuniv.edu muser252.scciowa.edu ns2.sidwell.edu dns.dpz.es ns2.interdigital.es crea.rae.es ns9.rae.es dns.registromercantilbcn.es ns2.tko.fi nimi1.website.fi nimi2.website.fi antares.c-strasbourg.fr erlwbi.interflora.fr proxy1-rech.univ-valenciennes.fr pulsar.univ-valenciennes.fr titan.univ-valenciennes.fr ns1.hamiltontn.gov rembrandt.masoutis.gr gslb1.tigo.com.gt gslb2.tigo.com.gt ns2.adsale.com.hk ns1.skhsslmc.edu.hk dns.matica.hr dns.plavalaguna.hr dante.univet.hu ns1.dnk.net.id ns1.lgcsb.ie ns2.lgcsb.ie ns1.modata.ie ns1.nethost.co.il ns2.nethost.co.il jbs.ac.in pdns.sit.ac.in ns1.axisbank.co.in ns1.tmc.gov.in ns2.tmc.gov.in ns1.teri.res.in ns2.teri.res.in ns1.idro.ir ns2.idro.ir ns1.isipo.ir ns1.audit.org.ir ns1.imo.org.ir dns.biesse.it dns.careca.it sct2.carontetourist.it dns.cpsoftware.it ns2.invisiblesite.it alfaterna.nuceria.it ns.sevenlab.it dns.gtt.torino.it cap.tuins.ac.jp dns-x.sinet.ad.jp dns2.aoshima-bk.co.jp ns.kew.co.jp juno.ntt-itn.co.jp vesta.ntt-itn.co.jp ns.santec.co.jp ns.toshiba-carrier.co.jp dns.mcinc.jp ns.hkr.ne.jp dns1.jcc.ne.jp ns01.netcoms.ne.jp ns.netsjapan.jp ns2.awa.or.jp lbdn.occto.or.jp lbdn2.occto.or.jp july.river.sun-inet.or.jp sakura.unep.or.jp pbant2.pba.jp pbant2.pba.jp dns2.ysu.ac.kr ns.carz.co.kr astra02.coreana.co.kr ns.kcm.co.kr ns.zakon.kz ns1.customs.gov.lk ns1.sliit.lk relay.cail.lu dns3.bkam.ma smtp-dns.douane.gov.ma dns1.onssa.gov.ma dns.dicj.gov.mo dns0.anahuac.mx dns1.anahuac.mx ns1.atento.com.mx dns1.hdi.com.mx ns2.hdi.com.mx dns.segurosatlas.com.mx ns1.tvsa.com.mx dca.cu.uabjo.mx ns.uabjo.mx aldebaran.2m-equation.net ns2.a-o-b.net ns.access-accounts.net ns2.autodata.net mail.brtk.net ns2.cengage.net dnssdc.dagangnet.net ns1.digitalimpact.net ns2.digitalimpact.net bizcn1.dnspod.net bizcn1.dnspod.net bizcn1.dnspod.net bizcn1.dnspod.net bizcn2.dnspod.net bizcn2.dnspod.net dns12.duckwood.net dns20.duckwood.net ns1.ecolon.net ns1.ecsd.net cobra.endless.net cebudns.epldt.net enyo2.ez2.net ns.forpsi.net pro2.gfdns.net dns1.hemsida.net ns1.host-web.net dns2.hostingsolutions.net ns1.knibs.net dev.labellum.net dns01.mathbox.net ns1.netlinksys.net ns30.netsupport.net ns2.oxi.net ns3.pasporte.net ns4.pasporte.net ns01.reyrey.net ns02.reyrey.net ns2.rj2t.net ns1.safetyhost.net dns1.sge.net dns2.sge.net dns3.sge.net dns4.sge.net ns.telanet.net ns-amers-1.thomsonreuters.net ns-amers-2.thomsonreuters.net ns-apac-1.thomsonreuters.net ns-apac-2.thomsonreuters.net ns-emea-1.thomsonreuters.net ns-emea-2.thomsonreuters.net ns4.traddns.net ns1.vologic.net ns2.vologic.net ns6.wgn.net ns3.xodeportal.net ns4.xodeportal.net ss-ns02.infocare.no ns01.prioritytelecom.no ns1.spsor.no ns2.spsor.no ns.freightways.co.nz dns1.clear.net.nz dns2.clear.net.nz kirsty.paradise.net.nz rachel.paradise.net.nz ns1.abp.org mc-dc-gtm1.act.org mc-dc-gtm2.act.org ns1.ecusd7.org ns1.jaxsheriff.org ns2.jcboe.org dc1gtm01.mercywny.org dc2gtm01.mercywny.org dns1.mkcl.org ns1.mozilla.org trl-dns1.tricore.org reinberger.wrhs.org dns1.dge.gob.pe ns1.asiaunited.com.ph ns1.asiaunited.com.ph ns2.asiaunited.com.ph ns2.aub.com.ph ns1.cityschoolnetwork.edu.pk ns0.bdm.com.pl ns2.am.szczecin.pl ns.aip.pt anje01.anje.pt ns2.drealentejo.pt ns3.drealentejo.pt ns1.ipad.mne.gov.pt farolim.min-edu.pt ns1.qiib.com.qa ns2.qiib.com.qa ns1.mfinante.ro ns2.mfinante.ro ns2.550550.ru ns2.croc.ru ns1.izh.ru ns2.izh.ru ns01.nakolesah.ru ns1.primbank.ru ns2.primbank.ru santa.veb.ru ns.securityservice.se pridns.dlink.com.sg pridns.stee.com.sg secdns.stee.com.sg merlion.iseas.edu.sg merlion2.iseas.edu.sg ns.aktifbank.com.tr ns.mngturizm.com.tr ns1.sarar.com.tr ns2.sarar.com.tr ns.kepez-bld.gov.tr inter-dns.mfa.gov.tr inter2-dns.mfa.gov.tr ns10.is.net.tr ns3.is.net.tr istasr.isbank.net.tr alfa.atso.org.tr beta.atso.org.tr cmgcdns.china-motor.com.tw ns1.clco.com.tw dnsc.credit.com.tw dns2.fullon-hotels.com.tw dns1.gigatms.com.tw dns1.him.com.tw dns1.himax.com.tw dns2.himax.com.tw sunntb.infiniti.com.tw dns.investor.com.tw dns1.krtco.com.tw dns2.krtco.com.tw ns1.luxgen-motor.com.tw ns2.luxgen-motor.com.tw idc-dns1.megasec.com.tw dns.scsb.com.tw dns1.tkbtv.com.tw ymtadc01.yamaha-motor.com.tw ymtadc02.yamaha-motor.com.tw acts.pct.org.tw lcotextdns.leeds-lcot.ac.uk unixa.nerc-swindon.ac.uk muppet.s-cheshire.ac.uk ns2.uxbridge.ac.uk ns1.skipton.co.uk ns2.skipton.co.uk ns2.smartkonect.co.uk ns-f5-01.spicerhaart.co.uk ns-f5-02.spicerhaart.co.uk smodns01.hackney.gov.uk ns.forpsi.us dl9rv21.ldol.state.la.us ns1.mcps.k12.md.us ns2.mcps.k12.md.us ns1.pacourts.us ns2.pacourts.us dns1.pittcounty.us dns2.pittcounty.us cronos.scotiabank.com.uy hestia.scotiabank.com.uy cedns.corteelectoral.gub.uy lancelot.dgr.gub.uy ingenio03.latu.org.uy dns1.hnue.edu.vn -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org ------- End of Forwarded Message

1 0

Google Geolocation issue
by Chris Boyd 22 Jun '16

22 Jun '16

Dear list readers, please forgive the noise, but if there's anyone here from Google who can fix a geolocation issue I'd appreciate a reply. 208.81.245.226 is not in the UAE, it's in Austin, Texas. Yes, I have filled out the form to request a fix, but the AI or whatever that's supposed to fix it has not, and we're well into 3 months after the first report. Thanks, --Chris

3 2

Timeouts Loading Major Websites
by Matt Hoppes 21 Jun '16

21 Jun '16

Is anyone else seeing sporadic timeouts trying to load major websites like Google or Facebook or SpeedTest.net? I'm seeing it come and go on both Frontier and Level3 on the east coast.

5 4

Recommendations, Colo Reno, Albuquerque, Phoenix, Las Vegas
by Eric A Louie 21 Jun '16

21 Jun '16

Does anyone have recommendations for Colocation space in any of those 4 cities? thanks Eric

4 3

Measuring the quality of Internet access
by Max Tulyev 21 Jun '16

21 Jun '16

Hi All, I know there are many people from many countries. Do you know something about mandatory measurements of Internet access quality from country telecom regulators? If yes, could you please share that information with me? I found ETSI EG 202 057-4 standard (http://www.etsi.org/deliver/etsi_eg/202000_202099/20205704/01.02.01_60/eg_2…) but in fact it is about measurements inside operator's network, not Internet access itself. Is it possible in general to measure the quality of Internet access? And if yes - how?

9 12

Netflix banning HE tunnels
by Davide Davini 21 Jun '16

21 Jun '16

Today I discovered Netflix flagged my IPv6 IP block as "proxy/VPN" and I can't use it if I don't disable the HE tunnel, which is the only way for me to have IPv6 at the moment. But the fun part has been Netflix tech support: "Oh I see, yeah we have been receiving reports of some other members with ipv6 having this issues, at the moment Netflix is not really designed to work with ipv6 connections, in this case I can recommend you two things, one is to turn off the ipv6 and the other one will be to contact directly with Hurricane Electric, there are some customers that were able to use Netflix with an ipv6 under some specific settings set by Hurricane Electric." I don't obviously expect HE to fix it, I don't pay for shit, it's a free service, why should they? But it's fun to know that " Netflix is not really designed to work with ipv6 connections ". Who did it say on this ML that the best way to solve these issues is Netflix tech support? :) Ciao, Davide Davini

42 99

Sri Lanka options
by Gavin Henry 20 Jun '16

20 Jun '16

Dear all, One of our partners[1] customers is based in Sri Lanka and we're having issues with latency creeping up to them. We're usually good via our tier 1 transits (Level3 and NTT) at around 180ms, but it's now up to 260ms and causing issues for their tunnels into the kit our partner hosts for them in one of our UK racks in Telehouse East. We've reached out directly to SLT.LK who provide their leased line out there and they adjusted routing into Telia, then into Level3 the last time this happened. We've tried again with no response. So I'm looking for options. They are on AMX-IX, but not sure about being on the RS. That may not improve anything as we'd need to get up there first. I'll contact our tier ones and companies we already have NNI's with but wanted to check if anyone can offer me anything? I know this is a US list, but hoping others have done something like this. Not many ideas from UKNOF apart from a kind email from Rod Beck, which I'm pursuing: ======== There is a surprising amount of connectivity into Sri Lanka. http://www.submarinecablemap.com/#/country/sri-lanka SeaMeWe-5 Bay of Bengal Gateway (BBG) SeaMeWe-3 SeaMeWe-4 Bharat Lanka Cable System Dhiraagu-SLT Submarine Cable Network WARF Submarine Cable ======== We need a guaranteed 5mb/s pipe with < 200ms or something similar. Ideas? Thanks for reading, Gavin. [1] http://www.surevoip.co.uk/partners/partner -- Kind Regards, Gavin Henry. Winner of the Best Business ITSP (Medium Enterprise) 2016! http://www.surevoip.co.uk/2016-best-provider OpenPGP (GPG/PGP) Public Key: 0x8CFBA8E6 - Import from hkp://pool.subkeys.pgp.net or http://www.suretecgroup.com/0x8CFBA8E6.gpg

1 0

RPKI implementation
by Jakob Heitz (jheitz) 20 Jun '16

20 Jun '16

During the RPKI presentation there was a question about resilience of the router if the RPKI cache loses connectivity. The IOS-XR implementation allows multiple caches to be configured. When a cache loses connectivity, the entries from that cache are purged after a time interval. Default is 60 seconds and it is configurable. A lookup of a prefix that is not loaded will return not-found. 5 seconds after the latest RPKI database update, a refresh request is sent to each neighbor, provided that the neighbor either: - dropped any received route due to a policy that contains validation-state, or - received a route, the validation state of which changed. If soft reconfiguration inbound is configured, then the refresh is avoided, because the received paths are stored. Thanks, Jakob.

3 7

NOC Contact Megafon AS31133
by Marco Paesani 20 Jun '16

20 Jun '16

Hi, I need a contact person NOC Megafon AS31133, can you help me ? Thanks ! Kind regards, Marco Paesani Skype: mpaesani Mobile: +39 348 6019349 Success depends on the right choice ! Email: marco(a)paesani.it

1 0

Re: cross connects and their pound of flesh
by Brandon Butterworth 19 Jun '16

19 Jun '16

Dave Temkin <dave(a)temk.in> wrote: > And as colo operators get freaked out over margin compression on the > impending 10->100G conversion (which is happening exponentially faster than > 100->1G & 1G->10G) they'll need to move those levers of spend around > regardless. If they've based their model on extracting profit proportional to technology speed then they've misunderstood Moore's law brandon

7 7