November 2017 - Test - lists.nanog.org

Re: AS PATH limits
by Ken Chase 23 Dec '17

23 Dec '17

If you're on cogent, since 22:30 UTC yesterday or so this has been happening (or happened). *> 186.177.184.0/23 38.*.*.* 45050 0 174 262206 262206 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 262197 ? oddly, i see other pops with 174 sources giving a more sane route (even 6939 is giving us a route that goes thru 174 after 2 hops). 'Sup, 174? Wonder if this is just stuck in the router Im looking at and the update process is failing because the route is too long to process properly for removal or something. mmm, bugs!) /kc -- Ken Chase - math(a)sizone.org Guelph Canada

9 19

WiFi - login page redirection not working
by Ramy Hashish 06 Dec '17

06 Dec '17

Good day all, A lot have been said on this topic, however I want to make sure I am not missing something. Two points with this problem: 1)Is there a "non client" solution to the problem of the WiFi login notification not showing up on the clients after connecting to the WiFi network? Second, anything to be done from the AP to show the landing page even if the page requested is HTTPs? Thanks, Ramy

8 12

100G - Whitebox
by Mike Hammett 04 Dec '17

04 Dec '17

I first sent to an IX-specific mailing list, but as I have yet to see the message hit the list, I figured I would post it here as well. We've had multiple requests for 100G interfaces (instead of Nx10G) and no one seems to care about the 40G interfaces we have available. Looking at cost effective options brings us to whitebox switches. Obviously there's a wide range of hardware vendors and there are a few OSes available as well. Cumulus seems to be the market leader, while IPinFusion seems to be the most feature-rich. We're not doing any automation on the switches at this time, so it would still need decent manual configuration. It wouldn't need a Cisco-centric CLI as we're quite comfortable managing standard Linux-type config files. We're not going all-in on some overlay either given that we wouldn't be replacing our entire infrastructure, only supplementing it where we need 100G. I know that LINX has gone IPinfusion. What OS would be appropriate for our usage? I'm not finding many good comparisons of the OSes out there. I'm assuming any of them would work, but there may be gotchas that a "cheapest that meets requirements" doesn't quite unveil. Any particular hardware platforms to go towards or avoid? Broadcom Tomahawk seems to be quite popular with varying control planes. LINX went Edgecore, which was on my list given my experience with other Accton brands. Fiberstore has a switch where they actually publish the pricing vs. a bunch of mystery. Thoughts? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

10 12

Incoming SMTP in the year 2017 and absence of DKIM
by Eric Kuhnke 02 Dec '17

02 Dec '17

For those who operate public facing SMTPd that receive a large volume of incoming traffic, and accordingly, a lot of spam... How much weight do you put on an incoming message, in terms of adding additional score towards a possible value of spam, for total absence of DKIM signature?

18 53

aggregate6 - a fast versatile prefix list compressor
by Job Snijders 01 Dec '17

01 Dec '17

Dear NANOG, I re-implemented the venerable 'aggregate' tool (by Joe Abley & co) in python under the name of 'aggregate6'. The 'aggregate6' tool is faster and also has IPv6 support. https://github.com/job/aggregate6 Installation is can be done through 'pip', or your operating system's package manager (if they carry the 'aggregate6' tool). $ pip install aggregate6 Example use: $ echo 10.0.0.0/16 10.0.0.0/24 2000::/4 3000::/4 | aggregate6 10.0.0.0/16 2000::/3 Note that 'aggregate6' can also be imported as module in your own python project: >>> import from aggregate6 import aggregate >>> aggregate(["10.0.0.0/8", "10.0.0.0/24"]) ['10.0.0.0/8'] >>> Related to the above example, NTT uses 'aggregate6' as library in their network automation toolchain to help compress firewall rules. When using a dump from the IPv4 Default-Free Zone, it appears that 'aggregate6' can deaggregate that list ~ 50 times faster than 'aggregate'. However the tradeoff is that 'aggregate6' uses a bit more memory. Aggregate6 has been tested with pypy, python2 and python3; and can be used both from the command line or as python module. Aggregate6 is published under the 2-Clause BSD license. Kind regards, Job

5 7

Subnet being blocked by Level3 due to prior owner's misuse
by Brock Tice 29 Nov '17

29 Nov '17

We have a subnet that used to belong to someone else. One of our business customers that was recently moved to that subnet is being blocked from accessing one of their supplier's web site that's hosted by Level3. Our attempts to work through the supplier to resolve the issue have not worked as they are not aware of what's happening at that level. Our other attempts to resolve this have not worked. Would someone from Level3 be able to help resolve this off-list, or does someone have the appropriate contact information? Thanks, --Brock

1 0

Re: Incoming SMTP in the year 2017 and absence of DKIM
by Brian Kantor 29 Nov '17

29 Nov '17

As I see it, the problem isn't with DKIM, it's with the implementation of DMARC and other such filters. Almost all of them TEST THE WRONG FROM ADDRESS. They compare the Author's address (the header From: line) instead of the Sender's address, (the SMTP Mail From: transaction or Sender: header line). For personal mail, these are almost always the same, but for properly-functioning mailing lists, the Author address is the email address of the person submitting the posting to the mailing list, and the Sender address is the error-return ("bounce") address of the mailing list. If the filter checked the Sender address of mail instead of the Author address, mailing lists wouldn't be broken! - Brian On Wed, Nov 29, 2017 at 10:12:05AM -0800, Michael Thomas wrote: > I've been saying for years that it should be possible to create the concept > of DKIM-friendly mailing lists. In such > a case, you could have your nines. Until then, the best you can hope for is > the list re-signing the mail and blaming > the list owner instead. > > Mike

4 4

tracking TCP session hop by hop
by Yifeng Zhou 29 Nov '17

29 Nov '17

Hi Experts, Is there any way that we can track TCP session hop by hop? Say we have 10 ECMP between A and Z point, what's the easiest way to track specific session is using which path? How we can check between servers(Linux/Unix) and between Routers(Cisco/Juniper etc)? Thanks -Yifeng

6 6

Anyone from Earthlink here?
by Anne P. Mitchell Esq. 29 Nov '17

29 Nov '17

If anybody is here from Earthlink - or knows anyone at Earthlink, could you pretty please connect with me? Thank you! Anne Anne P. Mitchell, Attorney at Law Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law) Legislative Consultant CEO/President, Institute for Social Internet Public Policy Legal Counsel: The CyberGreen Institute Member, Cal. Bar Cyberspace Law Committee Member, Colorado Cyber Committee Member, Elevations Credit Union Member Council Member, Board of Directors, Asilomar Microcomputer Workshop Ret. Professor of Law, Lincoln Law School of San Jose Ret. Chair, Asilomar Microcomputer Workshop

1 0

ATT AVPN BGP Communities
by Ryan, Spencer 29 Nov '17

29 Nov '17

Hey All, Does anyone know if AVPN lets end users set/add their own communities to routes? I see that they stamp several on the routes we originate (Community: 13979:2741 13979:2943 13979:5000 13979:6551) and curious if anyone had luck adding their own before I go start mucking around. Thanks! Spencer Ryan | Senior Systems Administrator | sryan(a)arbor.net<mailto:sryan@arbor.net> Arbor Networks | The security division of NETSCOUT +1.734.794.5033 (d) | +1.734.846.2053 (m) www.arbornetworks.com<http://www.arbornetworks.com/>

2 1