May 2017 - Test - lists.nanog.org

TCP over fragmented IPv6 dropped in Comcast's network
by Clint Armstrong 05 May '17

05 May '17

In troubleshooting why a DNS zone transfer fails over IPv6 from a DNS master hosted on a Comcast connection, I've discovered that a router in Comcast's network is IPv6 Fragments with TCP headers. More specifically it appears that this router silently drops any packet with a non-zero fragment offset, followed by a tcp header. Packets with a fragment offset followed by a udp header, or anything else, are passed just fine. Also, fragments sent in the opposite direction, from outside Comcast coming in, are passed just fine. I believe I was able to determine the problematic router by using the sendip tool to generate these dropped packets and increasing the TTL on the packet until I no longer got an ICMPv6 unreachable response from the next hop. If anyone else with a Comcast IPv6 connection would like to test and see if your connections are affected by this issue, here is how you can test. First you need sendip version 2.5-mec-3a2 with the frag.so module. Start tcpdump or wireshark looking for ICMPv6 Time Exceeded messages. Then send test packets to any destination IP you'd like to test a route to using the command `sendip <dest_addr> -p ipv6 -6s <source_addr> -6h 2 -p frag -Fo 1 -p tcp` Increment the 6h value until you no longer get an ICMPv6 Time Exceeded response. At that point try removing the `-p tcp` parameter and see if that works. In my case, it does, demonstrating that this problematic router successfully passes IPv6 fragments without a TCP header. If anyone at Comcast would like to contact me off-list, I'll share more details of my findings, including the source address where I'm testing from, and what I believe is the problematic router.

1 0

Geolocation of o3b satellite end user terminals
by Eric Kuhnke 04 May '17

04 May '17

Since today seems like the day for IP geolocation related topics... Does anyone have direct experience with third-party IP geolocation services and o3b served enterprise/ISP-type high capacity customers? For those who are not familiar with them, o3b satellite terminals can be located literally anywhere in the world below 45 degrees north or south latitude, served from a fleet of MEO satellites. Each terminal is a twin pair of motorized/tracking antennas and associated modems, etc with an IP/Ethernet hand off to the customer. Their gateways to the Internet are located in about a dozen places around the globe and ordinarily go out to the Internet through o3b's own IP network.

2 1

Need someone from CenturyLink to fix urgent routing issue
by John Neiberger 04 May '17

04 May '17

Could someone from CenturyLink reach out to me off-list, please? You are currently hijacking some of our space and it is causing an active outage for many customers. We have someone calling in to CL support, as well, but we typically get a basic help desk that is slow to respond and this is a bit more urgent. Thanks! John

1 0

Financial services BGP hijack last week?
by valdis.kletnieks＠vt.edu 04 May '17

04 May '17

I didn't see any mention of this here. Any comments? "On Wednesday, large chunks of network traffic belonging to MasterCard, Visa, and more than two dozen other financial services companies were briefly routed through a Russian government-controlled telecom under unexplained circumstances that renew lingering questions about the trust and reliability of some of the most sensitive Internet communications." https://arstechnica.com/security/2017/04/russian-controlled-telecom-hijacks…

11 14

Question regarding geolocation
by Lars Andersson 04 May '17

04 May '17

Hello, I am helping a small Service Provider in Sweden and we have some issues with IP addresses having the wrong country in geolocation. They show up as Norwegian even though they should be Swedish. The site we have most problems with and try to solve is HBO. Can anyone maybe give some input as to how HBO update their geolocation info? Maybe a certain geolocation provider? We have contacted RIPE and they have acknowledged our addresses in the RIPE database as correctly setup with country object as SE. Furthermore the geolocation providers/sites we checked which show the correct info are ip2location, amakai, maxmind, ipinfo.io and EurekAPI. If anyone from HBO see this mail I would appreciate an off list response. Best regards Lars Andersson, Fiberdata

1 0

GEO LOCATION
by Chris Lane 03 May '17

03 May '17

All We have several direct allocations from ARIN which we then provide smaller prefixes to our customers across the country. Our HQ is on the East coast, but many of our customers are on the West Coast. Trying to understand and fix some of my west coast customers GEO LOCATION issues as they are reporting for instance when running "speed tests" to Internet sites the location pops up as an East Coast server instead of West and more local. Any help would be appreciated Thank you Chris

3 2

Frontier
by Matt Hoppes 03 May '17

03 May '17

I need a network administrator from Frontier to contact me ASAP regarding BGP advertisement of a block that needs to stop please. We are down. Have been told it will be several days until restoration. And frontier is advertising our ips so I can't even advertise them out a different route. The NOC had been completely unhelpful. 570-707-3000 mhoppes(a)rivervalleyinternet.net

2 2

Akamai contact
by James Harr 02 May '17

02 May '17

Hi, Can someone from Akamai contact me off-list? We're having a problems accessing a testing website served from the Akamai CDN during finals week. -- James Harr Lead Network Engineer University of Nebraska at Omaha 402-554-4925 M:402-660-5466

1 1

intel remote management exploit
by Ken Chase 02 May '17

02 May '17

How we all feeling about this? Trying hard to get a bead on how freaked out we're all sposta be right this second. (Most of my gear is AMD, but as the article indicates, your toaster probably has Intel in it too.) https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&lang… some analysis: http://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platf… 01:41 < azend|vps> Better hope your pfsense firewall isn't Intel based see? and just before bed... (why do i check mail before bed...) /kc -- Ken Chase - math(a)sizone.org Guelph Canada

1 0

AWS us-west-2 routed through Europe from NY?
by Florin Andrei 01 May '17

01 May '17

I've seen a few strange instances where IP addresses in the AWS us-west-2 region (Oregon) are routed through Europe if you start the traceroute from some providers in the northern East Coast (Quebec, New York). Any idea what's going on? I assume it's temporary. -- Florin Andrei http://florin.myip.org/

6 8