January 2017 - Test - lists.nanog.org

S: Contact Qwest DNS Admin / Recovery Point Systems => Re Broken DNSSEC chain / unreachable DNS Addresses: www.bea.gov
by Benoit Panizzon 20 Jan '17

20 Jan '17

Hello There are several DNS issues with www.bea.gov (Bureau of Economic Analysis) which prevent our customers to reach that site (we have DNSSEC and IPv6 enabled resolvers). http://dnsviz.net/d/www.bea.gov/dnssec/ I did send emails to the the SOA contact records the bea.gov www.bea.gov and the DNS Server Domains. I did send emails to the tech contacts found in the ARIN IP Ranges of those DNS servers. I did send email to contacts found on the website itself. I did receive several read confirmations, during the last month. So I know my emails are being read. But nobody replies and the problem is not being fixed. bea.gov name server sauthns1.qwest.net. bea.gov name server sauthns2.qwest.net. sauthns1.qwest.net has address 63.150.72.5 sauthns1.qwest.net has IPv6 address 2001:428::7 sauthns2.qwest.net has address 208.44.130.121 sauthns2.qwest.net has IPv6 address 2001:428::8 Operated by: Qwest Communications Company, LLC www.bea.gov name server ns1.recoverypoint.net. www.bea.gov name server ns3.recoverypoint.net. ns1.recoverypoint.net has address 204.14.132.35 ns1.recoverypoint.net has IPv6 address 2607:f478:0:4005::35 ns3.recoverypoint.net has address 204.14.132.36 ns3.recoverypoint.net has IPv6 address 2607:f478:0:4005::36 CIDR: 204.14.132.0/22 NetName: RECOVERYPOINTSYSTEMS CIDR: 2607:F478::/32 NetName: RECOVERY-POINT-SYSTEMS So as a last resort I try the nanog list now, hoping that somebody reads this who is able to forward this email to the right person, or point me to the person in charge. Any Help appreciated. -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

1 0

External BGP Controller for L3 Switch BGP routing
by Faisal Imtiaz 20 Jan '17

20 Jan '17

Hello, A while back there was a discussion on how to do optimized (dynamic) BGP routing on a L3 switch which is only capable of handing a subset of BGP Routing table. Someone has pointed out that there was a project to do just that, and had posted a link to a presentation on a European operator (Ireland ? ) who had done some code to take Exabgp and create such a setup.. (I am going by memory... )... Needless to say I am trying to find that link, or name of that project. Anyone who can help in refreshing my memory with the link (my search skill are failing to find that presentation !) would be greatly appreciated. Many Thanks in Advance. Faisal Imtiaz

12 19

Re: [outages] ntp.org DNS lookups failing
by Alarig Le Lay 18 Jan '17

18 Jan '17

Hi, On Wed Jan 18 21:25:23 2017, Gert Doering via Outages wrote: > Trying to query directly, ns1/ns2.ntp.org return SERVFAIL as well, > and ns1/ns2.everett.org do not reply at all... so pure guesswork on > my side says "the original set is broken / under attack / ..., so > new servers have been added, but as long as the old NS records are > still being cached, things keep failing". I see the same behaviour: alarig@pikachu ~ % dig -t NS ntp.org ; <<>> DiG 9.11.0-P2 <<>> -t NS ntp.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 44422 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;ntp.org. IN NS ;; Query time: 52 msec ;; SERVER: 2a00:5884:8218::1#53(2a00:5884:8218::1) ;; WHEN: Wed Jan 18 21:28:08 CET 2017 ;; MSG SIZE rcvd: 36 alarig@pikachu ~ % ssh alarig(a)log.bzh alarig@log:~$ sudo unbound-control flush_zone ntp.org [sudo] password for alarig: ok removed 8 rrsets, 0 messages and 0 key entries ^D alarig@log:~$ déconnexion Connection to log.bzh closed. alarig@pikachu ~ % dig -t NS ntp.org ; <<>> DiG 9.11.0-P2 <<>> -t NS ntp.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53621 ;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;ntp.org. IN NS ;; ANSWER SECTION: ntp.org. 3600 IN NS ns1.everett.org. ntp.org. 3600 IN NS ns2.everett.org. ntp.org. 3600 IN NS ns4.p20.dynect.net. ntp.org. 3600 IN NS dns2.udel.edu. ntp.org. 3600 IN NS anyns.pch.net. ntp.org. 3600 IN NS dns1.udel.edu. ntp.org. 3600 IN NS ns1.p20.dynect.net. ntp.org. 3600 IN NS ns2.p20.dynect.net. ntp.org. 3600 IN NS ns3.p20.dynect.net. ;; Query time: 178 msec ;; SERVER: 2a00:5884:8218::1#53(2a00:5884:8218::1) ;; WHEN: Wed Jan 18 21:31:51 CET 2017 ;; MSG SIZE rcvd: 236 -- alarig

1 0

Level3 Internet service, out of order packets causing issues
by Mark Wicker 18 Jan '17

18 Jan '17

Hi, I have 1G Level3 ethernet dedicated internet service as one of my ISP's at my company based in the Los Angeles (Inland Empire) area. After seeing strange application behavior while using this circuit, I failed it out of service and have been troubleshooting it with a directly connected machine (publically addressed, no firewall, nothing between this machine and our Level3 router). I have taken several packet captures while accessing various sites and have noticed large numbers of out of order packets which are wreaking havoc with TCP connections and other traffic. In my experience, per-packet load balancing across various different links can cause this issue. I do not see this behavior with my other ISP's. I have had several tickets opened with Level3 but have had no success. Any help here? Anyone out there seen this and have any contacts that may be able to help? FYI - we own our own public IP space and advertise via BGP to Level3. Currently I am using a dedicated /24 of our space advertised to Level3 only to ensure that the return path is through Level3 and not another ISP. Also, everything is single linked from a layer 2 and 3 perspective from the router to the test machine to ensure that the cause of any out of order packets is not on our end. Thanks, -- Mark Wicker | Senior Network Engineer Esri | 380 New York St | Redlands, CA 92354 | USA T 909 793 2853 x2741 | mwicker(a)esri.com<mailto:mwicker@esri.com> | esri.com<http://www.esri.com/>

2 3

Safe IPv4 Was: Re: premiumcolo.net IP address rental
by Martin Hannigan 18 Jan '17

18 Jan '17

On Mon, Jan 9, 2017 at 11:20 AM, Matt Freitag <mlfreita(a)mtu.edu> wrote: > Joel, > > I can't speak to "premiumcolo.net" > Neither can I, but that may not mean much. Perhaps someone else can validate that they're reputable and can execute a transaction end to end? If you need IPv4 addresses for your network: 1. Make sure you have an IPV6 allocation from your favorite RIR and are using it 2. Apply for and receive a last /22 from RIPE. EVERYONE can do this. 3. Contact a reputable broker. The ones I have experience with (Alphabetical): A. Peter Thimmesch at Addrex http://www.addrex.net B. Amy Cooper at Hilco Streambank http://www.ipv4auctions.com/ C. Mike Burns at http://www.IPTrading.com ARIN also publishes a list (which is not a requirement to be able to transact or support transfers): https://www.arin.net/resources/transfer_listing/facilitator_list.html Network operators have many choices for answering their IP numbering needs these days. Including IPv6. Sorry to be a broken record on this topic, but it seems to come up a lot. And if you search the archives I'll suspect you'll find something similar to this a few time now. An educated network operator is the best kind. That's why we are here. YMMV and Best, -M<

6 7

Questions on IPv6 deployment
by Matthew Crocker 17 Jan '17

17 Jan '17

Hello, I’m AS7849 and I have an IP problem. I’m running IPv4 ( /16 legacy + /20) and have enough space to last me for a while, multi-homed, BGP4 full tables + peering, ect. I have some new shiny Juniper MX480s (RE-S-2X00x6, 64MB RAM) in my core. I want to start building my IPv6 infrastructure. I have a /32 assigned from ARIN (2001:4918::/32) I’m looking for some direction/reading list of how to properly configure IPv6. I’ve read to use a /64 for PtP interfaces and I’ve read use a /128 instead. Assign all loopbacks from the same /64, use a different /64 for each loopback. Ect, ect. I’m trying not to light a religious war but what is the current best practice for IPv6 deployment in a service provider network? PS. I’ll be at NANOG69 in DC next month, 1st NANOG for me after 22 years. ☺ -Matt -- Matthew Crocker Crocker Communications, Inc. President

9 15

Anyone from Frontier? Reachability Issues to AS5650
by Matt Peterman 17 Jan '17

17 Jan '17

Hello all! I have been unable to find a good contact for Frontier’s NOC, so I am hoping to have success here. I have reached out to the listed contacts in AS5650’s ARIN record to no avail. I am having issues reaching seemingly all IPs announced from AS5650. I am an AT&T customer with IP block 76.233.227.0/25 assigned to me. My connectivity seems to die somewhere in the handoff between AT&T and Frontiers network. Looking glasses show that AT&T is announcing my IPs as the aggregate 76.224.0.0/11, however bgp.he.net seems to also show that Frontier is announcing 76.233.226.0/23 somewhere (although all looking glasses show the only route to me is 76.224.0.0/11). I’m thinking somewhere in the AT&T/Frontier DSL sell-off Frontier is either not accepting the /11 from AT&T or has a hold down route for 76.233.226.0/23 somewhere in their network. Any help or contacts are appreciated as there are a number of sites and services I am unable to reach. All MTRs to networks in AS5650 die at the edge of AT&Ts network. Matt MTR to 107.191.134.73 from 76.233.227.54 Jan 16 20:26:35 2017 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. 76.233.227.1 0.0% 27 1.6 2.0 1.2 4.1 0.7 2. 10.11.8.1 0.0% 27 2.2 2.1 1.0 4.6 1.0 3. 172.17.17.129 0.0% 27 1.9 3.2 1.6 14.8 2.7 4. ??? 5. 71.145.0.184 0.0% 27 22.6 23.6 20.2 47.0 5.3 6. 12.83.39.177 0.0% 27 24.4 24.9 21.0 34.7 3.0 7. 12.123.15.125 0.0% 27 33.6 45.6 21.0 154.1 37.1 8. ???

1 0

Apple Caching Server question
by Lane Powers 17 Jan '17

17 Jan '17

11 11

IPv6 BGP prefix filters
by Alistair Mackenzie 16 Jan '17

16 Jan '17

Hi, So recently I've come across an issue with a large ISP announcing a /22 and /25 of IPv6 space. We are currently filtering <28 and >48 which until now has worked fine for us. What are others using as their prefix filters in the DFZ? Thanks, Alistair

3 2

Fwd: APRICOT 2017 programme reminder
by Mark Tinka 16 Jan '17

16 Jan '17

Hello all. FYI. Mark. -------- Forwarded Message -------- Subject: [apnic-talk] APRICOT 2017 programme reminder Date: Sun, 15 Jan 2017 16:51:22 -1000 From: Philip Smith <pfsinoz(a)gmail.com> To: apnic-talk(a)apnic.net <apnic-talk(a)apnic.net> Hi everyone, Just a reminder that APRICOT 2017 begins in around one month from now, and that we still have some presentation opportunities available! If you or a colleague would like to present something of interest and relevant at APRICOT 2017, be it a conference talk or a tutorial, or host a BoF, please submit on-line at: http://papers.apricot.net/user/login.php?event=48 The deadline for submissions is 30th January, as we mentioned in the CfP. However we are filling presentation slots on a first come first served basis, so if you would like to ensure your place on the programme please submit your presentation asap. More information at the CfP page for APRICOT 2017: https://2017.apricot.net/program/call-for-papers/ Looking forward to hearing from you! Philip Smith & Mark Tinka APRICOT 2017 Programme Chairs -- _______________________________________________ apnic-talk mailing list apnic-talk(a)lists.apnic.net https://mailman.apnic.net/mailman/listinfo/apnic-talk .

1 0