July 2016 - Test - lists.nanog.org

Report on Airtel (Indian Mobile Operator) Sniffing Cloudfare
by Sharath Chandra 15 Jul '16

15 Jul '16

Dear List Last week, this report has now created bit of a stir within the net-neutrality policy circles and ISPs in India. I was hoping anyone here could see if this analysis and hunch about Airtel India’s sneaky practices is indeed correct : https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflare… <https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflare…> Regards Sharath Chandra Ram Twitter: @AgentSpock Signal Lab: http://goo.gl/rssCdH <http://goo.gl/rssCdH>

1 0

SAFNOG-3: Just 3 Weeks Left
by Mark Tinka 15 Jul '16

15 Jul '16

Hello all. With a little over 3 weeks left to SAFNOG-3, the program is shaping up to be very exciting. You can view it here: http://www.safnog.org/event-name/ If you are interested in participating in SAFNOG-3 as a speaker or panelist, there are still a few slots left in the agenda. Kindly review the details of the CfP and submit your talk at the link below: http://www.safnog.org/#callforpapers Travel and hotel venue information about Windhoek, Namibia, can be found here: http://www.safnog.org/travel-information For the social events at this year's SAFNOG meeting, we have organized welcome drinks from 1700hrs by the pool side at the hotel venue on the 7th August: https://www.safarihotelsnamibia.com/safari-court-hotel/ On the 8th August, an opening cocktail in the evening has been planned for at Joe's Beer House: http://www.joesbeerhouse.com/home.html Our closing social will take place on the 9th August, with a braai and dinner at the hotel venue. On the 10th August, a game drive has been prepared at the Okapuka Ranch: http://www.okapuka-ranch.com/main.html All social events will be complimentary to our SAFNOG-3 delegates. We look forward to seeing you in Windhoek. Cheers, Mark Tinka On Behalf of the SAFNOG Management Committee

1 0

Canadian Internet Registration Authority (CIRA)
by Ryan Finnesey 14 Jul '16

14 Jul '16

Is anyone from the Canadian Internet Registration Authority (CIRA) monitoring the list? I was hoping they can ping me off list. I have a few questions around there policy's and a program we would like to put in place. Cheers Ryan

1 0

Re: New Office, New Network. Questions.
by Nikolai Petrov 13 Jul '16

13 Jul '16

Here are my replies on this e-mail. Sorry for the late replies! > On Sun, 10 Jul 2016 21:53:52 +0300, Nikolai Petrov said: > >> 1. Currently we do not have IPv6 in our network but I have seen the ISP is >> giving us a "/56 Block" which from what I understand is a couple hundred "/64 >> Subnets". I think you can only have /64 subnets in IPv6. In our IPv4 setup we > > You can have other sized subnets, but 64 is very handy if you intend to use > SLAAC auto-configure. There's also the danger of running into broken equipment > that doesn't understand other sized subnets (similar to very old IPv4 gear that > understood a /24, but exploded if told about a /23 or /25). I really like SLAAC and its design and I would very much like to use it. Therefore we will be using /64 IP Ranges. Is there any way to limit the amount of devices in a subnet to avoid problems and attacks? I don't think the equipment will work with 2^64 devices in a single subnet.. > >> have 32 addresses, four of which I will use for NAT and the remaining needed >> for online services and servers. In IPv6 we have a lot of addresses but I am >> not sure whether I should give an address of the ISP to every device. I found > > Assign a /64 to everyplace that you would assign a subnet in IPv4. Give each > device on that subnet its own address. Use DHCPv6 or SLAAC or both, whatever > gets the job done in your situation. Don't worry about NAT anymore, you have > enough addresses. > >> that there is an organization that can help avoid collisions in private IPs: >> https://www.sixxs.net/tools/grh/ula/ . From what I can tell it is just a >> registry, but I am thinking of registering the ranges there and then use these >> subnets and NAT them to the IPv6 address of the router. > > Don't do that. NAT was invented to fix a problem that IPv6 doesn't have. Feel > free to give every single device a global address. (You'll still want a > stateful firewall someplace, but it doesn't have to do NAT, it just has to keep > track of legitimate versus malicious traffic). So why are these addresses there? For installations not connected to the Internet? > > And don't freak out if a device has more than one address. As I'm writing this > from the sofa in my living room, my laptop wireless has: > > ra0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 > inet 192.168.1.150 netmask 255.255.255.224 broadcast 192.168.1.159 > inet6 2601:5c0:c100:6431:cad7:19ff:fe37:c02 prefixlen 64 scopeid 0x0<global> > inet6 2601:5c0:c100:6431:c01:a589:19a4:236e prefixlen 64 scopeid 0x0<global> > inet6 2601:5c0:c100:6431::d67 prefixlen 128 scopeid 0x0<global> > inet6 2601:5c0:c100:6431:1dc3:657:eda6:8abf prefixlen 64 scopeid 0x0<global> > inet6 fe80::cad7:19ff:fe37:c02 prefixlen 64 scopeid 0x20<link> > inet6 2601:5c0:c100:6431:ad68:c60c:583:19e9 prefixlen 64 scopeid 0x0<global> > ether c8:d7:19:37:0c:02 txqueuelen 1000 (Ethernet) > > (One DHCPv6 - ::d67. One SLAAC - the one with ff:fe in it. And 4 different > RFC3041 privacy addresses that it's chunked out over the weekend. It works > just fine that way - and it's *designed* to do so. (Of course, in a corporate > environment, you may want to turn the privacy addresses off, and only use > one of DHCPv6/SLAAC - I do it this way because it tests for broken software...) Thanks for letting me know ahead of time. I have looked up about the privacy addresses and we don't need them as you say. Is there a reason you use DHCPv6 and SLAAC? Is it for compatibility? Can I use the DHCPv4 to give out DNSv6 addresses? > > Oh, and don't block ICMPv6. :) I was never a fan of blocking ICMP except the redirects in some cases.. > >> something strange. The WAN port of our router gets a /64 IPv6 address which is >> not in our IPv6. Should I use this for NAT or one of "our" addresses? > > You use it for the IP address of the provider-facing interface of your router. > Assign the "inside" interface(s) addresses on the appropriate /64 subnet that > they will be on. Oh, so this is like BGP.. In my previous company we had BGP connections and we used an IPv4 /30 for these connections which was not within our IP range. I thought they would give us a /126 and not a full /64 so I did not think that was it.. Thanks!

4 3

IX in Iran by TIC
by Shahab Vahabzadeh 13 Jul '16

13 Jul '16

Hello Everybody, I am here to announce that TIC in Iran launched Neutral Internet Exchange Points. Right now we have four in: - Tehran (tehran-ix.ir) - Shiraz (shiraz-ix.ir) - Tabriz (tabriz-ix.ir) - Mashhad (mashhad-ix.ir) Currently we have near 45Gbps traffic on it but it will increase to 100Gbps within two months. Content Providers activating their BGP peering with members one by one. Also I have something interesting for you around the world, TIC is launching a International IX in Chabahar called Chabahar IX (chabahar-ix.ir) which can be interesting for T1 ISPs or Content Providers like Akamai, Amazon, Google, Limelight, Cloudflare and etc. We are able to give anyone colocation space or ground for building their own Datacenter. As you know Iran is cheapest country in Middle East for Energy and Electricity reasons so we are the best opportunity for having a node there. Cables we have there right now are POI, FALCON and GCX. Please share this with your friends or your Business Development departments. If anyone have question regard this you can contact me via this email or peering(a)tic.ir. Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator PGP Key Fingerprint = 1C43 988E 01A8 4D95 B662 9118 CD94 9F10 4DF4 6163

8 11

Softlayer
by Joe Carroll 13 Jul '16

13 Jul '16

Is there an admin from the softlayer network ? We're experiencing routing issues getting traffic to the softlayer network.

1 0

Re: IX in Iran by TIC
by Scott Weeks 12 Jul '16

12 Jul '16

------------------------------------------ > Might be worthwhile to also look at throwing your fabric/IX on XXXXX www.xxxxxx.com . ------------------------------------------ https://www.nanog.org/list "5.Product marketing is prohibited" It appears from a web search that you are affiliated with the company you're speaking about. scott

3 2

packet loss question
by Phillip Lynn 12 Jul '16

12 Jul '16

Hi all, I am writing because I do not understand what is happening. I ran mtr against our email server and www.teco.comand below are the results. I am not a network engineer so I am at a loss. I think what I am seeing is maybe a hand off issue, between Frontier and Level3Miami2. If I am correct then what can I do? My system is running Centos 6.5 Linux. Thanks, Phillip (! 1011)-> sudo mtr -r netwolves.securence.com HOST: xxxxx(a)netwolves.comLoss% Snt Last Avg Best Wrst StDev 1. 172.24.109.1 0.0% 10 0.6 0.6 0.6 0.7 0.0 2. lo0-100.TAMPFL-VFTTP-322.gni 0.0% 10 3.2 2.0 1.0 4.3 1.2 3. 172.99.44.214 0.0% 10 4.0 4.9 2.3 6.9 1.5 4. ae8---0.scr02.mias.fl.fronti 0.0% 10 9.3 9.1 7.5 9.8 1.0 5. ae1---0.cbr01.mias.fl.fronti 0.0% 10 8.9 9.1 7.6 9.7 0.7 6. lag-101.ear3.Miami2.Level3.n 80.0% 10 9.0 8.9 8.8 9.0 0.1 7. 10ge9-14.core1.mia1.he.net 0.0% 10 14.3 13.0 7.6 18.1 4.3 8. 10ge1-1.core1.atl1.he.net 0.0% 10 25.6 33.2 22.4 99.7 23.6 9. 10ge10-4.core1.chi1.he.net 0.0% 10 45.6 51.8 45.5 82.7 12.5 10. 100ge14-2.core1.msp1.he.net 0.0% 10 53.6 63.9 53.6 125.2 21.8 11. t4-2-usi-cr02-mpls-usinterne 0.0% 10 53.2 73.1 53.2 225.6 54.0 12. v102.usi-cr04-mtka.usinterne 0.0% 10 53.2 53.9 53.2 55.3 0.6 13. netwolves.securence.com 0.0% 10 53.4 53.9 53.4 55.4 0.7 (! 1014)-> sudo mtr -r www.teco.com HOST: xxxxx(a)netwolves.comLoss% Snt Last Avg Best Wrst StDev 1. 172.24.109.1 0.0% 10 0.6 0.6 0.6 0.7 0.0 2. lo0-100.TAMPFL-VFTTP-322.gni 0.0% 10 104.8 81.4 1.1 113.2 43.2 3. 172.99.47.198 0.0% 10 115.0 77.8 2.9 115.0 40.2 4. ae7---0.scr01.mias.fl.fronti 0.0% 10 111.1 80.2 8.5 113.5 41.3 5. ae0---0.cbr01.mias.fl.fronti 0.0% 10 105.9 82.2 7.6 115.4 33.8 6. lag-101.ear3.Miami2.Level3.n 70.0% 10 116.1 80.2 8.5 116.1 62.0 7. NTT-level3-80G.Miami.Level3. 0.0% 10 110.0 81.5 9.0 120.3 41.9 8. ae-3.r20.miamfl02.us.bb.gin. 0.0% 10 119.8 84.0 10.0 119.8 38.5 9. ae-4.r23.asbnva02.us.bb.gin. 10.0% 10 137.4 107.6 30.1 142.7 45.7 10. ae-2.r05.asbnva02.us.bb.gin. 0.0% 10 135.0 109.9 36.6 140.0 39.1 11. xe-0-9-0-8.r05.asbnva02.us.c 0.0% 10 147.5 125.6 49.4 165.5 41.1 12. 24.52.112.21 0.0% 10 158.6 124.0 49.6 161.3 41.5 13. 24.52.112.42 0.0% 10 151.0 127.7 52.2 159.0 41.2 14. ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 -- Phillip Lynn Software Engineer III NetWolves Phone:813-579-3214 Fax:813-882-0209 Email: phillip.lynn(a)netwolves.com www.netwolves.com

12 19

Comcast postmaster?
by Brian Rak 12 Jul '16

12 Jul '16

Is there anyone here that can put me in touch with a Comcast mail server administrator? It seems that they've firewalled off some of our IPv6 space, and I can't seem to find any contact information. Interestingly, I can't even fill out their blocklist removal form, because it only accepts IPv4 addresses.

1 1

Re: New Office, New Network. Questions.
by Nikolai Petrov 12 Jul '16

12 Jul '16

Please find my replies inline. Thanks for your time! > hi nikolai > > - oops.. this got long based on my experiences/opinions :-) > > On 07/10/16 at 09:53pm, Nikolai Petrov wrote: > >> We are moving to our new offices in two months and I have access to the building already. >> My task is to set up the entire network for the company. >> The previous administrator has left the company and I thought of taking the chance to remove some "technical debt" and make everything from scratch again. > > all good ... > >> I was told to move the networks this week > > do you have the routers, switches, cables, few servers for testing ? > has your ISP installed their internet uplink connectivity to the bldg ? > > if so, than the above management is on their toes > otherwise, you'd need to rattle some $$$ loose to buying missing hw :-) Since we have received funding for this scale up of the company the management decided I should buy all the hardware new. I have a large budget and I could even make the network 10 Gb/s with that money. I guess I am a lucky person. Large budget to do a network without using old stuff! The uplink is installed already from our ISP and the entire building is available to me to install the network. > >> and I have spent a lot of time thinking about how I should do it. > > good ... now's the chance to fix the problems if any .. This is what I thought! > >> 1. Currently we do not have IPv6 in our network > > implies a learning IPv6 curve ( red flag for possible time-wasting hogs ) > > if the task is to mvoe the entire "mid-sized" from current bldg to new bdlg, > i'd suggest use "known/good/working/best-practices" methodology to move > the company. first get the new bldg with new test servers working > with IPv4 ( the way you want it done ) and "working" the current bldg > which should take a few hours :-) > > than work with IPv6 issues This is my plan. I have designed the IPv4 network already but I also want to install the IPv6 network right after it and not "some time in the future". > >> but I have seen the ISP is giving us a "/56 Block" > > good > >> which from what I understand is a couple hundred "/64 Subnets". >> I think you can only have /64 subnets in IPv6. > > nah ... you can subnet your /56 into whatever you want > >> In our IPv4 setup we have 32 addresses, >> four of which I will use for NAT >> and the remaining needed for online services and servers. > > good ... use that to test everything > > since you want or going to use NAT, you have the standard > internal LAN for the bldg can use the standard 10/8 or > 192.168/16 or 172.16/12 > > so far.. nothing new/special/problematic Exactly. I intend to keep the same IP range as before since I do not have problems with it.. I may change 1-2 subnet sizes but that's it.. I want to avoid issues with DNS servers, static IP configurations since these are not 100% under my control and I do not know if the server team knows all places where an IP is located.. > >> In IPv6 we have a lot of addresses but I am not sure whether >> I should give an address of the ISP to every device. > > why would you want to complicate time-restricted ( 1month ) > to get the new bldg working with IPv6 w/out having prior > IPv6 experience ? > > remember, "all eyes" will be looking to you to move the > whole company from current bldg to new bldg without delay I think I can do the IPv4 part sooner than needed so I should use the remaining time for IPv6 + testing.. > >> I found that there is an organization that can help avoid collisions >> in private IPs: https://www.sixxs.net/tools/grh/ula/ . > > there should never be any collision in IP#, ipv4 or ipv6 Of course. I meant global collisions in case of a network merge or something.. > >> From what I can tell it is just a registry, but I am thinking of >> registering the ranges there and then use these subnets and >> NAT them to the IPv6 address of the router. > > the ISP provides you the range of IPv6 assigned to you > > if your current bldg does NOT have IPv6, you might not be > able to easily test the new IPv6 stuff in the new bldg The new building has full connectivity and when I add our router it gets the IPv4 and IPv6 addresses. The optical fiber of the ISP comes to the building directly. > > you might be able to test your new IPv6 connections > at the local coffee shop or other public places but > that's a major security violation since your new IPv6 > has no security pre-cautions installed yet > I am not sure I understand this part. How can I test our IPv6 company set up in a coffee shop? > you should be paranoid about trojans/worms/mailware piggie > backing into your new un-secured new bldg IPv6 infrastructure > or IPv4 infrastructure > >> However, I noticed something strange. The WAN port of our >> router gets a /64 IPv6 address which is not in our IPv6. > > why strange ?? > > routers get its IP# from dhcpv6 or statically assigned Because it is a /64 range and not a /126. In my previous company we used an IPv4 /30 for our BGP. Isn't a /64 a waste? > >> Should I use this for NAT or one of "our" addresses? > > you need to fix this problem before continuing .. > ( explain why the IPv6/64 is not what you're expecting ) > > NAT is NOT the solution ... > >> 2. The previous administrator did some bad job in some parts of the network. > > :-) that will always be true 90% of the time :-) > > some things are always gonna be "bad" > >> We have an internal router protocol to move traffic between routers, >> but in some cases he used NAT instead of adding these subnets to the >> router protocol. Everything works and all things that have to be >> reached are reachable, > > if it works .. why is is "bad" ?? > > there might be dozens of different ways to make things work > ( "things that have to be reachable are reachable" ) > >> however I think this is bad > > not necessarily a bad thing > >> and we should use the router protocol for all parts of the network. > > why ? Well, currently we have issues with this: NAT makes all computers communicate with all computers but we need to give users access to the routers ( ! ) so they can port forward so employees from other departments can reach their computers and we also do UPnP. Currently there are employees with access to three routers so they can port forward the port forward of the port forward to reach other workstations.. If we used the router protocols it would be direct host to host communication. > >> I have found two protocols in our router that are good and support >> IPv6 and they are OSPF and BGP. > > there might be more :-) I have found some more like RIP but it is not good enough I think. I also found ISIS but I don't think it provides much benefit over OSPF and it is not supported by all routers.. > >> I did not manage to have BGP work > > what part is not working ? I can successfully peer with the other router using IPv6 but unfortunately no IPv6 routes are exchanged between the routers or propagated to others if I set the IP ranges manually. > > google/yahoo the error messages :-) > >> and it is slow so I am thinking of OSPF. > > sometimes, which works first/better/easiest might be > a good option, thus trying other things is good, but > that can also create more headaches too .. more problems > to (fun) solve > >> Do uou think it is a good choice for IPv6 and IPv4? > > i'd work with IPv4 first ... > and more importantly... there is NO excuse why IPv4 doesn't > or cannot work in the new bldg > > after IPv4 works in the new bldg as good as it does in the current > bldg, you have time for "( IPv6 ) learning experiements" > >> If I have two separate paths of 1 Gb/s, will I transfer files at 2 Gb/s? > > no ... you will be able to transfer 1Gb/s each .. Let me clarify this is not transfer to the Internet but between two hosts in the internal network.. > > if you "channel bond" the two 1Gb/s into "one link", > than you might be able to see 1.9Gb/s uplinks .. never 2G/s > > if you have 2 1G/s uplinks ... you should have the 2 routers > crosslinked for failover unless uplink speed is more > important than failover > >> 3. In our old network we use "VRRP" which from what I know >> is a system for routers to shae IPs and load balance or "failover" the traffic. > > good > >> I have seen that IPv6 has a built-in system which is similar >> and has something like priorities, etc. What happens if I have >> two routers with same priority? > > same rules/issues apply to IPv4 > > one router/path should always have priority over the other > depending on destinations .... lots of testing to see which > packets goes thru which uplinks > >> Whic is used as default gateway? > > depends.. > > engineering/manufacturing uses router1 > hr/accting uses router2 > > or > > public DMZ uses router1 > corp LAN uses router2 > > but in either case, router1 and rotuer2 should be crosslinked > if failover is important > >> Is it load balancing? Also, can I use "VRRP" to load balance traffic >> to our DNS look-up "recursor"? > > dozen ways to do load balancing ... more problems to resolvea > and prioritize based on your company visibility online > > load balancing should be worried about: > - dns, www traffic, email traffic, DVD/video/music downloading, > > also always have 3 hot-swap complete infrastrucure and backups > fw1 + dns1 + www1 + mail1 + NAT1 > fw2 + dns2 + www2 + mail2 + NAT2 > fw3 + dns3 + www3 + mail3 + NAT3 > > fw only runs iptables for inline fw for entire dmz/localLan > dns only runs bind and iptables and nothing else > www only runs apache and iptables and nothing else > mail only runs sendmail and iptables and nothing else > nat only runs NAT + iptables > > each backup its bind/sendmail/apache data to the other 2 boxes, but > bind/sendmail/apache itself is turned off on the other hot backups > > magic pixie dust > alvin > # > # DDoS-Mitigator.net > #

1 0