November 2017 - Test - lists.nanog.org

TWC/Charter/Spectrum contact off-list ? (Reverse DNS issue)
by Brandon Applegate 17 Mar '18

17 Mar '18

Hello, I had success with this issue about 2 years ago when some TWC folks contacted me. I don’t know if those folks are still with TWC/Charter here in the end of 2017 - hence posting on NANOG. The tl;dr is IPv6 reverse DNS issues. It was broken, got fixed, and seems to have broken again recently. Thanks in advance. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 0641 D285 A36F 533A 73E5 2541 4920 533C C616 703A "For thousands of years men dreamed of pacts with demons. Only now are such things possible."

2 2

ticketmaster.com 403 Forbidden
by Manser, Charles J 08 Feb '18

08 Feb '18

List, It seems that browsing to ticketmaster.com or any of the associated IP addresses results in a 403 Forbidden for our customers today. Is anyone else having this issue? If anyone from Ticketmaster could reach out to me off-list, it would be helpful. Charles Manser | Principal Engineer I, Network Security Charles.Manser(a)charter.com E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

15 18

Re: AS PATH limits
by Ken Chase 23 Dec '17

23 Dec '17

If you're on cogent, since 22:30 UTC yesterday or so this has been happening (or happened). *> 186.177.184.0/23 38.*.*.* 45050 0 174 262206 262206 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 ? oddly, i see other pops with 174 sources giving a more sane route (even 6939 is giving us a route that goes thru 174 after 2 hops). 'Sup, 174? Wonder if this is just stuck in the router Im looking at and the update process is failing because the route is too long to process properly for removal or something. mmm, bugs!) /kc -- Ken Chase - math(a)sizone.org Guelph Canada

9 19

WiFi - login page redirection not working
by Ramy Hashish 06 Dec '17

06 Dec '17

Good day all, A lot have been said on this topic, however I want to make sure I am not missing something. Two points with this problem: 1)Is there a "non client" solution to the problem of the WiFi login notification not showing up on the clients after connecting to the WiFi network? Second, anything to be done from the AP to show the landing page even if the page requested is HTTPs? Thanks, Ramy

8 12

100G - Whitebox
by Mike Hammett 04 Dec '17

04 Dec '17

I first sent to an IX-specific mailing list, but as I have yet to see the message hit the list, I figured I would post it here as well. We've had multiple requests for 100G interfaces (instead of Nx10G) and no one seems to care about the 40G interfaces we have available. Looking at cost effective options brings us to whitebox switches. Obviously there's a wide range of hardware vendors and there are a few OSes available as well. Cumulus seems to be the market leader, while IPinFusion seems to be the most feature-rich. We're not doing any automation on the switches at this time, so it would still need decent manual configuration. It wouldn't need a Cisco-centric CLI as we're quite comfortable managing standard Linux-type config files. We're not going all-in on some overlay either given that we wouldn't be replacing our entire infrastructure, only supplementing it where we need 100G. I know that LINX has gone IPinfusion. What OS would be appropriate for our usage? I'm not finding many good comparisons of the OSes out there. I'm assuming any of them would work, but there may be gotchas that a "cheapest that meets requirements" doesn't quite unveil. Any particular hardware platforms to go towards or avoid? Broadcom Tomahawk seems to be quite popular with varying control planes. LINX went Edgecore, which was on my list given my experience with other Accton brands. Fiberstore has a switch where they actually publish the pricing vs. a bunch of mystery. Thoughts? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

10 12

Incoming SMTP in the year 2017 and absence of DKIM
by Eric Kuhnke 02 Dec '17

02 Dec '17

For those who operate public facing SMTPd that receive a large volume of incoming traffic, and accordingly, a lot of spam... How much weight do you put on an incoming message, in terms of adding additional score towards a possible value of spam, for total absence of DKIM signature?

18 53

aggregate6 - a fast versatile prefix list compressor
by Job Snijders 01 Dec '17

01 Dec '17

Dear NANOG, I re-implemented the venerable 'aggregate' tool (by Joe Abley & co) in python under the name of 'aggregate6'. The 'aggregate6' tool is faster and also has IPv6 support. https://github.com/job/aggregate6 Installation is can be done through 'pip', or your operating system's package manager (if they carry the 'aggregate6' tool). $ pip install aggregate6 Example use: $ echo 10.0.0.0/16 10.0.0.0/24 2000::/4 3000::/4 | aggregate6 10.0.0.0/16 2000::/3 Note that 'aggregate6' can also be imported as module in your own python project: >>> import from aggregate6 import aggregate >>> aggregate(["10.0.0.0/8", "10.0.0.0/24"]) ['10.0.0.0/8'] >>> Related to the above example, NTT uses 'aggregate6' as library in their network automation toolchain to help compress firewall rules. When using a dump from the IPv4 Default-Free Zone, it appears that 'aggregate6' can deaggregate that list ~ 50 times faster than 'aggregate'. However the tradeoff is that 'aggregate6' uses a bit more memory. Aggregate6 has been tested with pypy, python2 and python3; and can be used both from the command line or as python module. Aggregate6 is published under the 2-Clause BSD license. Kind regards, Job

5 7

Subnet being blocked by Level3 due to prior owner's misuse
by Brock Tice 30 Nov '17

30 Nov '17

We have a subnet that used to belong to someone else. One of our business customers that was recently moved to that subnet is being blocked from accessing one of their supplier's web site that's hosted by Level3. Our attempts to work through the supplier to resolve the issue have not worked as they are not aware of what's happening at that level. Our other attempts to resolve this have not worked. Would someone from Level3 be able to help resolve this off-list, or does someone have the appropriate contact information? Thanks, --Brock

1 0

Re: Incoming SMTP in the year 2017 and absence of DKIM
by Brian Kantor 29 Nov '17

29 Nov '17

As I see it, the problem isn't with DKIM, it's with the implementation of DMARC and other such filters. Almost all of them TEST THE WRONG FROM ADDRESS. They compare the Author's address (the header From: line) instead of the Sender's address, (the SMTP Mail From: transaction or Sender: header line). For personal mail, these are almost always the same, but for properly-functioning mailing lists, the Author address is the email address of the person submitting the posting to the mailing list, and the Sender address is the error-return ("bounce") address of the mailing list. If the filter checked the Sender address of mail instead of the Author address, mailing lists wouldn't be broken! - Brian On Wed, Nov 29, 2017 at 10:12:05AM -0800, Michael Thomas wrote: > I've been saying for years that it should be possible to create the concept > of DKIM-friendly mailing lists. In such > a case, you could have your nines. Until then, the best you can hope for is > the list re-signing the mail and blaming > the list owner instead. > > Mike

4 4

tracking TCP session hop by hop
by Yifeng Zhou 29 Nov '17

29 Nov '17

Hi Experts, Is there any way that we can track TCP session hop by hop? Say we have 10 ECMP between A and Z point, what's the easiest way to track specific session is using which path? How we can check between servers(Linux/Unix) and between Routers(Cisco/Juniper etc)? Thanks -Yifeng

6 6