November 2017 - Test - lists.nanog.org

New Jersey auth servers
by Feldman, Mark 09 Nov '17

09 Nov '17

If someone responsible for or with connections to those running the state.nj.us/nj.gov auth name servers would contact me off list, it would be appreciated. We're having some resolution issues that appear to be due to DNS/network config at or near those auths. Mark Comcast T&P Core Network Servies

1 0

Out of country blocker for streaming services
by Brett A Mansfield 09 Nov '17

09 Nov '17

Anyone able to tell me who the best person/company to contact is to get my subnet unblocked by all of the streaming providers? They all say I’m using a VPN service or an unblocker. This is a subnet I just leased from another provider. Shows it is in NJ but I use the IPs in Utah. Thank you, Brett A Mansfield

2 1

Juniper QFX5100 VLAN flood input filter doesn't work
by Stanislaw 07 Nov '17

07 Nov '17

Hello, list (again), I've been trying to use VLAN BUM traffic filter on QFX5100. The configuration on the test VLAN was quite trivial: Model: qfx5100-48s-6q Junos: 17.2R2.8 # show vlans Testvlan vlan-id 4030; forwarding-options { filter { input Testvlan-ingress; } flood { input Testvlan-flood; } } I connected two linux hosts to the test VLAN: # show interfaces ge-0/0/42 unit 0 { family ethernet-switching { vlan { members Testvlan; } } } # show interfaces ge-0/0/43 unit 0 { family ethernet-switching { vlan { members Testvlan; } } } The firewall filter wwas quite simple: # show firewall family ethernet-switching filter Testvlan-ingress term accept { then accept; } The flood input filter I was trying to use. According to the documentation, only Broadcast, Unknown unicast and Multicast (BUM) traffic goes here. The regular unicast traffic should be left intact by it. # show firewall family ethernet-switching filter Testvlan-flood term allow_arp { from { ether-type arp; } then accept; } term allow_ipv6_ns { from { destination-mac-address { 33:33:ff:00:00:00/24; } ether-type 0x86dd; } then accept; } term discard_all { then discard; } I started hosts to ping (and snif) each other.. And I saw only ARP requests/responses. "show ethernet-switching table" displayed that both hosts MAC were successfully learned, thus traffic between them should be considered as regular unicast. However, the last term in Testvlan-flood filter was blocking it. If I replace it with "accept" - traffic begins to flow. Are any Juniper QFX gurus here? I would really appreciate some advice.

1 0

Re: Network nerd poker night 11/8 in Seattle
by Miles Fidelman 07 Nov '17

07 Nov '17

Doesn't anybody play real poker any more? You know, 5 card draw, 7 card stud. Oh for a good game of high-stakes 7 card high-low stud. Miles Fidelman -------- Original message --------From: Gordon Cook <cook(a)cookreport.com> Date: 11/7/17 2:08 PM (GMT-07:00) To: Avi Freedman <freedman(a)freedman.net> Cc: "nanog(a)nanog.org list" <nanog(a)nanog.org> Subject: Re: Network nerd poker night 11/8 in Seattle Hi Avi long time no talk regards Gordon > On Nov 7, 2017, at 3:22 PM, Avi Freedman <freedman(a)freedman.net> wrote: > > > If there are any network+poker nerds in the Seattle area tomorrow, we have 5 seats left at a network nerd poker night I'm hosting tomorrow night. > > Attendees are from cloud, content provider, hosting, infra services, travel, and SaaS analytics industries. > > We'll have food, drinks, a training session, and will be running ~3 single-table No Limit Texas Hold'em tournaments. > > If there's time/interest afterwards I may also initiate anyone interested into the wonders of Pot Limit Omaha. > > Prizes will be Bose head sets, to avoid corporate gift issues with playing for or awarding $. > > It's at the W Hotel in Bellevue, at 6pm tomorrow night. > > The focus is poker, socializing, and free-form network tech, business, and policy nerd discussions. Travel and gadget geeking allowed as well. Kentik is sponsoring the space, tables, and professional dealers, and we'll have a < 5 minute sponsor presentation. > > RSVP / info @ https://www.greenvelope.com/viewer/?ActivityCode=.public:ab155c3532ca4bd5ad… > > If it overflows we'll cut off RSVPs at the URL and/or let people know by email. > > We're also going to organize to do another in Seattle in Feb and larger ones in NY and the Bay area in Q1, so if you have interest or ideas for format or quick content topics we could cover, please let me know. One thing we're considering is adding a table for heads-up battles - participants to decide if they want to add peering as part of the stakes. > > Thanks, > > Avi >

1 0

Juniper MX80 strange dst MAC address behavior
by Stanislaw 07 Nov '17

07 Nov '17

Today I was investigating strange unknown unicast traffic in LAN of IX which I operate. It was about 200 kbps of constant unknown unicast load. Unknown unicast is a rare ocasion in IX LAN as participants MAC addresses are almost persistent. I added a server in the vlan and started sniffing: all the unicast was coming from one participant MAC. One of the frames: XX:XX:XX:XX:ee:98 > 5e:5c:ab:31:c0:cb, ethertype IPv4 (0x0800), length 1434: XX.XX.16.30.80 > XX.XX.76.137.41934: Flags [.], seq 1619512599:1619513967, ack 3595347045, win 235, options [nop,nop,TS val 3650267181 ecr 1841068329], length 1368: HTTP Okay, destination MAC 5e:5c:ab:31:c0:cb isn't really in switches FDB table. I looked up the routing table and figured out that router announcing the bestpath for XX.XX.76.137 has MAC 5e:5e:ab:31:c0:cb. So customers sent a frame to: 5e:*5c*:ab:31:c0:cb The right address should be : 5e:*5e*:ab:31:c0:cb I tried next packet in dump, the same story: customer sends to: *90*:c6:9a:*e5*:2f:c1 right mac is : *b0*:c6:9a:*e4*:2f:c1 I converted differencing bytes to binary representation: 90: 10010000 b0: 10110000 e5: 11100101 e4: 11100100 I guess all the unknown unicast frames MAC addresses were having the same slightly difference from the right ones. So the router in general works fine (it has several gigabits of traffic in the IX) but sometimes it changes one or two bits in frame's destination MAC address. My guess it is caused by a large ARP table on customer's router. The router may have some tricky lookup algorithm preceding constant calculating speed over accuracy. I called their NOC, they said it is Juniper MX80 and also confirmed that it has more than 4k ARPs. Have anybody encountered with that kind of issue?

3 2

Network nerd poker night 11/8 in Seattle
by freedman＠freedman.net 07 Nov '17

07 Nov '17

If there are any network+poker nerds in the Seattle area tomorrow, we have 5 seats left at a network nerd poker night I'm hosting tomorrow night. Attendees are from cloud, content provider, hosting, infra services, travel, and SaaS analytics industries. We'll have food, drinks, a training session, and will be running ~3 single-table No Limit Texas Hold'em tournaments. If there's time/interest afterwards I may also initiate anyone interested into the wonders of Pot Limit Omaha. Prizes will be Bose head sets, to avoid corporate gift issues with playing for or awarding $. It's at the W Hotel in Bellevue, at 6pm tomorrow night. The focus is poker, socializing, and free-form network tech, business, and policy nerd discussions. Travel and gadget geeking allowed as well. Kentik is sponsoring the space, tables, and professional dealers, and we'll have a < 5 minute sponsor presentation. RSVP / info @ https://www.greenvelope.com/viewer/?ActivityCode=.public:ab155c3532ca4bd5ad… If it overflows we'll cut off RSVPs at the URL and/or let people know by email. We're also going to organize to do another in Seattle in Feb and larger ones in NY and the Bay area in Q1, so if you have interest or ideas for format or quick content topics we could cover, please let me know. One thing we're considering is adding a table for heads-up battles - participants to decide if they want to add peering as part of the stakes. Thanks, Avi

3 2

GO DADDY Person?
by Ilissa Miller 07 Nov '17

07 Nov '17

Is there a GoDaddy person on this list? There is a domain that has been created that is 100% a bot and need to flag it immediately. Already contacted GoDaddy directly but it is still active. Please contact me off list Thanks!

2 1

media are reporting "major Internet outage"
by Miles Fidelman 07 Nov '17

07 Nov '17

Folks, It seems like various media outlets are reporting a "major Internet outage" - some going so far as to call it an "attack." A few headlines that crossed Facebook today: "Major internet outage hits the U.S." (Mashable via AOL News) "Widespread Comcast internet outage across U.S. includes Massachusetts customers" (WHDH, Channel 7 News, Boston) A couple of more detailed sources reported that issues at L3 were effecting Comcast, specifically. Kind of interesting that there's been no mention here on nanog, nor have I personally noticed any issues (as a user or a hosting provider). Tempest in a teapot? Miles Fidelman -- In theory, there is no difference between theory and practice. In practice, there is. .... Yogi Berra

6 5

Re: media are reporting "major Internet outage"
by Scott Weeks 07 Nov '17

07 Nov '17

--- cb.list6(a)gmail.com wrote: From: Ca By <cb.list6(a)gmail.com> Outages go outage list https://puck.nether.net/pipermail/outages/2017-November/010952.html --------------------------------------- Be sure to use outages-discussion(a)outages.org for this one as outages(a)outages.org is just for reporting the initial problem. The list had a *major* "me too" blow up on this one. scott

2 1

someone from easydns here? dns3.easydns.org. 2620:49:3::10 unreachable from AS8560 and 6939
by Thomas Mieslinger 07 Nov '17

07 Nov '17

Hi, can someone operating easydns nameserver check whether 2620:49:3::10 is answering? I create a atlas measurement https://atlas.ripe.net/measurements/10137819 and I can see that some AS still can reach 2620:49:3::10 but many many timeouts. For me, it stops working after 2a00:dd80:9:3::2 (AS42210) Cheers Thomas

1 0