June 2016 - Test - lists.nanog.org

RPKI and offline routes
by Theodore Baschak 14 Jun '16

14 Jun '16

Can RPKI be used with routes that are not being advertised at the moment? As in to sign a route that *could* be there, but is not there presently. There's been several BGP hijacks that I've followed closely that involved hijacking IP space as well as the ASN that would normally originate it. I'm wondering if having valid ROAs/RPKI would have helped in this case or not. Theodore Baschak - AS395089 - Hextet Systems

3 3

Appeals court upholds Network Neutrality rules
by Patrick W. Gilmore 14 Jun '16

14 Jun '16

Presented without comment: https://www.washingtonpost.com/news/the-switch/wp/2016/06/14/the-fcc-just-w… Seems topical to NANOG audience. -- TTFN, patrick

1 0

Re: Netflix VPN detection - actual engineer needed
by Owen DeLong 14 Jun '16

14 Jun '16

> On Jun 7, 2016, at 11:50 AM, Davide Davini <davide.davini(a)doppiad.com> wrote: > > On 04/06/2016 20:46, Owen DeLong wrote: >> Get your own /48 and advertise to HE Tunnel via BGP. Problem solved. > > Even though that sounds like an awesome idea it does not seem trivial to > me to obtain your own /48. It’s trivial in the ARIN region. Other regions are YMMV. > I mean: "You can only request IPv6 assignments and Autonomous System > Numbers through a Sponsoring LIR (a RIPE NCC member)" > https://www.ripe.net/manage-ips-and-asns/resource-management/number-resourc… I would suggest trying to work through the RIPE PDWG to get that policy changed if you feel it is a hinderance to your deployment. I do know that RIPE has this (rather silly IMHO) process for keeping PI end users at arms length, but as I understand it, it’s also not very hard to find an LIR that will charge you a fee to acquire the addresses and pass them along to you. > But you know, my knowledge on the matter is half an hour old, I might be > dead wrong. I think you’re right, but my understanding is that it is fairly trivial to comply with that requirement. I’ll be surprised if some LIRs don’t contact you as a result of this email. Owen

2 1

Re: Netflix VPN detection - actual engineer needed
by Baldur Norddahl 14 Jun '16

14 Jun '16

Den 4. jun. 2016 01.26 skrev "Cryptographrix" <cryptographrix(a)gmail.com>: > > The information I'm getting from Netflix support now is explicitly telling > me to turn off IPv6 - someone might want to stop them before they > completely kill US IPv6 adoption. Not allowing he.net tunnels is not killing ipv6. You just need need native ipv6. On the other hand it would be nice if Netflix would try the other protocol before blocking.

44 127

Enough about Netflix banning HE tunnels [really: IPv6 adoption]
by STARNES, CURTIS 14 Jun '16

14 Jun '16

NANOG members; First things first - PLEASE NOTE: This is just an opinion from one old IT guy who used to have to use a dial-up connection from a small town in central Texas to connect to my "ISP" (term used loosely for the very early 1990's) in Dallas, Oklahoma City, and sometimes Shreveport, LA with my trusty Slackware box (with its screaming i386 processor/2MB RAM and 900 BAUD modem) just to get my FidoNet/UUCP email fix (just for those of us who remember the old "bang path" email via UUCP!) via UUNet. This passion grew into running multi-node Wildcat! BBS systems in early 1992 to small ISP's in the mid-1990's until which time my Southwestern Bell phone bills and customer churn killed this hobby quick and I had to turn to a full time IT professional to feed the family. As the Internet continues to grow exponentially with the explosion of the IoT movement, let's see how every one's IPv4 boxes connect to an IPv6 only network (or their refrigerator) without the support of the IT community such as NANOG members to mangle the packets and push their packets through some sort of IPv4 to IPv6 transitional technology. This thread is really getting on my nerves and old eyes as it fills my mailbox daily and I am sure I am not the only one. Between the content providers that are complaining about there is not enough IPv6 traffic to justify the migration, vendors pushing products that do not support IPv6, to the carriers that do not support dual stack to the last mile customer, then the end-user that you hear saying "IPvWhaaaat?" on the end of the phone; it is up to us, the network engineers, network administrators, "Packet Pushers", and whatever title is bestowed upon us, to just make it work. That is what I hear day in and day out; "The sales team said it could be done so what is the problem? Get if fixed or we will find someone who can!" and I am in the public education space! I feel for the network engineers, NOC operators, and cable/fiber teams of our great nation. Just as an FYI: I remember when IPv4 was a "Fad" and took patience of Job (the biblical Job, not job) just to get the Win32's loaded on Windows 3.1 so it would handle a 32-bit address. This is not including the mastery of the AT commands that Trumpet Winsock required since each manufacturer put their own spin in their interpretation of what AT command should do what (I still can remember what "squeals and tones" were negotiating at what speed and the occasional nightmare that ATZ & AT&E1 just sit there with a blank terminal and silent modem). Netflix can ban and block all they want. Carriers can complain "Streaming media is using too much bandwidth", never mind that each and every one pays for transit bandwidth, even public schools! We must remember our technology history; - Ma Bell said that they were too big to be broken up - IBM would always be king - Unix such as System V/BSD/Open Systems/AIX/SCO/HP-UX/Sun Solaris would each rule the world. - and my personal favorite - "No one would want to own a personal PC!" Bottom line, whether we keep pushing onward with what we have, IPv4 and IPv6 or we adopt another protocol to replace the archaic IPv4. The Layer 1-7 technologies which we all work with daily, were never designed with security as the primary concern when RFC 675 was created in 1974 by the Network Working Group with Vince Cerf and others. I do not think Vince Cerf and the other members of the Network Working Group had Cryptolocker, Ransomware, on his mind when TCP/IP was "born" from this RFC. We must keep pressing onward and pushing the envelope of our segment of the modern and some not so modern Internet. Where would we be without the Vince Cerf's, Steve Job's, Bill Gates', Paul Allen's, DARPA, US Military, the fiber tech's that run, fuse, and terminate miles of fiber while others sleep, the network techs, net admins, programmers, and too many others to mention. Where would and would there be IPv4, IPv6, or an Internet at all. Whether we are doing this as our jobs or as a hobby, driven out of passion for technology. We owe the next generation(s) the benefit of our best work so that they have to opportunity to do their best as well. Thank you NANOG community for the platform for me to express this rant/reflections; and the freedoms our country provides so I can do so freely. Curtis Starnes Senior Network Administrator Granbury Independent School District Granbury, Texas IEEE Member since 2012 (Just for the record, these are my opinions and ramblings/rants, not my employers) -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of bzs(a)theworld.com Sent: Friday, June 10, 2016 1:13 PM To: Karl Auer <kauer(a)biplane.com.au> Cc: nanog(a)nanog.org Subject: Re: Netflix banning HE tunnels [really: IPv6 adoption] This is sort of whacky. IPv4 was so successful, let's say post 1990, because it got people from nothing to internet or as some say Internet. IPv6 cannot duplicate that. So continuing to rely on this idea that "hey a coupla billion people went for IPv4, and even that was slow at first, so it's just a matter of time"...is...I'll be kind...unwise. This is no longer engineering. This is marketing. Hand the problem over to a professional marketing organization and go back to what you were trained to do. Give them your phone number and tell them to please call if they think you can help, maybe a product endorsement spot on prime-time TV or to consider some technical improvement. Hi! I'm Barry Shein! I helped invent the internet. But I am about to explain to you a NEW development, IPv6, which is going to improve your internet experience more than you may have thought possible! And stay tuned for a special secret offer we're including for the first 250 million adopters! -- -Barry Shein Software Tool & Die | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*

3 4

Thinking Methodically about building a PoC
by Kasper Adel 13 Jun '16

13 Jun '16

hi, I am asked to build a large lab/test it. I'm provided crazy scale numbers for lots of technologies (L*VPN, IPv*, IGP*, All Tunnels flavors...etc). It took me a lot of time to build this lab, because when I got the request/test plan handed over to me, I did not verify that these scaled numbers are even possible, not to mention the combination. I assumed some thought/research were done before. I'm trying to put together a list of the lessons learned, and the right way to do this for future reference, specially that this project was time critical and I got beaten hard because I did not deliver on time. So my question is, in your extensive experience, what is the right method/approach to this kind of task: 1) Get started immediately (MVP), things will break, tune it along the way. 2) Do some planning and research first. I'd appreciate any references to 'software engineering' or other industries/ Thanks

8 8

Re: Sunday night social?
by Matt Ryanczak 13 Jun '16

13 Jun '16

Remember that social != sociable! ~Matt On Jun 12, 2016 15:22, "Todd Underwood" <toddunder(a)gmail.com> wrote: huh. today we learn that social is subject to particular people's view of social. please author an RFC to explain the scope that counts as social. thanks! t On Sun, Jun 12, 2016 at 6:18 PM, Randy Bush <randy(a)psg.com> wrote: > This may surprise some, but social != frat boys. > > randy, on a phone > >> On Jun 12, 2016, at 15:08, Todd Underwood <toddunder(a)gmail.com> wrote: >> >> surely this is not the same randy bush that loves to point out that >> humans are social animals! >> >> t >> >> On Sun, Jun 12, 2016 at 2:31 PM, Randy Bush <randy(a)psg.com> wrote: >>>>> Is Wednesday night the only social? >>>> Yes. >>> >>> damn! if i had known there was a chance of folk acting more like sober >>> adults than the usual frat boys i might have scheduled chicago. >>> >>> randy

1 0

Fwd: Sunday night social?
by Matthew Petach 12 Jun '16

12 Jun '16

> I just finished registering for NANOG 67, and answered Yes to "Will you be attending the sunday evening social" and booked my flight accordingly...but now i can't seem to find any details on what time it starts on the website. Does anyone know what time it starts? > > Thanks! > > Matt > >

6 8

phish platform ?
by Julien T 12 Jun '16

12 Jun '16

Hello, I'm reviewing the process how to manage phish report at a customer and am looking for tools ideally opensource. Recently, OVH released https://github.com/ovh/cerberus-ux and maybe AbuseHelper can do http://abusehelper.be/ I also checked APWG but didn't find reference to such a tool. Quick constraints: multiple types of input+garbage, metrics, API, SIEM integration Any advices of a public tool? or mostly in-house dev? Thanks a lot. Cheers, Jul

1 0

Netflix VPN detection - actual engineer needed
by Matthew Kaufman 12 Jun '16

12 Jun '16

Every device in my house is blocked from Netflix this evening due to their new "VPN blocker". My house is on my own IP space, and the outside of the NAT that the family devices are on is 198.202.199.254, announced by AS 11994. A simple ping from Netflix HQ in Los Gatos to my house should show that I'm no farther away than Santa Cruz, CA as microwaves fly. Unfortunately, when one calls Netflix support to talk about this, the only response is to say "call your ISP and have them turn off the VPN software they've added to your account". And they absolutely refuse to escalate. Even if you tell them that you are essentially your own ISP. So... where's the Netflix network engineer on the list who all of us can send these issues to directly? Matthew Kaufman

31 70