September 2017 - Test - lists.nanog.org

100G - Whitebox
by Mike Hammett 04 Dec '17

04 Dec '17

I first sent to an IX-specific mailing list, but as I have yet to see the message hit the list, I figured I would post it here as well. We've had multiple requests for 100G interfaces (instead of Nx10G) and no one seems to care about the 40G interfaces we have available. Looking at cost effective options brings us to whitebox switches. Obviously there's a wide range of hardware vendors and there are a few OSes available as well. Cumulus seems to be the market leader, while IPinFusion seems to be the most feature-rich. We're not doing any automation on the switches at this time, so it would still need decent manual configuration. It wouldn't need a Cisco-centric CLI as we're quite comfortable managing standard Linux-type config files. We're not going all-in on some overlay either given that we wouldn't be replacing our entire infrastructure, only supplementing it where we need 100G. I know that LINX has gone IPinfusion. What OS would be appropriate for our usage? I'm not finding many good comparisons of the OSes out there. I'm assuming any of them would work, but there may be gotchas that a "cheapest that meets requirements" doesn't quite unveil. Any particular hardware platforms to go towards or avoid? Broadcom Tomahawk seems to be quite popular with varying control planes. LINX went Edgecore, which was on my list given my experience with other Accton brands. Fiberstore has a switch where they actually publish the pricing vs. a bunch of mystery. Thoughts? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

10 12

IPv6 first hop security on a budget?
by Joel Whitehouse 11 Nov '17

11 Nov '17

What's a good budget option for switching a small lab or office ipv6 with RA Guard, DHCP6 snooping, and ICMP6 snooping?

5 4

Open-IX BCOP Committee Call for Volunteers
by Chris Grundemann 24 Oct '17

24 Oct '17

Pardon the interruption. There is a new effort underway to ensure that BCOP has a home in North America and your help is needed. Following the publication of the Open-IX Document Development Policy (OIX DDP) and the formation of the Best Current Operational Practices committee (BCOP) <http://www.open-ix.org/cpages/bcop-committee>, the Open-IX Board of Directors is now seeking volunteers to take on this valuable work. Open-IX Best Current Operational Practices (BCOP) Committee members are expected to seek out subject matter experts and encourage the documentation of BCOPs from the global network engineering community. This is typically done through activity on mailing lists, conversations at industry events, and leveraging personal relationships. Committee members are further expected to shepherd appropriate documents through the process from Appeal to published BCOP, including updates to existing documents as needed. If you share a passion for sharing knowledge, increasing the resiliency and efficiency of the global internet infrastructure, and have a few hours a month to dedicate to this effort, we encourage you to volunteer! Please send your name, email address, and a brief statement of interest to cgrundemann <at> open-ix.org. While we continuously seek new voices for all committees, this call is expected to close on 31 October, 2017. Please submit before that time to be considered for an immediate opening on the BCOP committee. Thank you, ~Chris

1 1

Hurricane Maria: Summary of communication status - and lack of
by Sean Donelan 10 Oct '17

10 Oct '17

This summary status is a bit different. Instead it is a report about what we don't know, and estimate how much we don't know based on official reporting. The FCC DIRS report is based on outages reported by service providers. Almost no local providers have been able to file either a positive or negative report on the DIRS website. So the data is very incomplete. Electric Services Puerto Rico: 1,569,796 customers out of service (100%) U.S. Virgin Islands: 90% of grid on St. Thomas and St. John destroyed by Hurricane Irma, a few critical facilities re-energized. 25,000 customers on St. Croix out of service after Hurricane Maria, but may be able to re-energize most of the St. Croix grid on Friday. Internet Services All submarine cables and landing stations appear operational. 2 colocation data centers on Puerto Rico appear to be operational. I couldn't tell if there any of the old Internet Exchange Points were still operating, or had ceased before the hurricanes. Puerto Rico: Approximately 880 networks out of 1200 not reachable (24 out 48 ASN). U.S. Virgin Islands: Approximately 13 networks out of 70 not reachable (2 out of 6 ASN) Public Safety Services Public Safety Answering Points (9-1-1 centers) Puerto Rico: 2 out of 2 PSAPs reporting. 2 operating normally. US Virgin Islands: 2 out of 2 PSAPs reporting. 2 operating without automatic location identifier NOAA Weather Forecast Office Puerto Rico: Office on backup generation, weather RADAR offline, 1 of 2 Weather Radio transmitters offline US Virgin Islands: Served by San Juan, PR WFO, 1 of 1 Weather Radio transmitter offline Wireless Services Puerto Rico: (1703 cell sites out of 1789) 95% of cell sites out of service. 48 out of 78 counties with 100% of cell sites out of service. U.S. Virgin Islands: (82 cell sites out of 107) 77% of cell sites out of service. Cable and Wireline Systems Puerto Rico (est. 11 companies-ILEC, CLECs and Cable in LATA) FCC summary implies no companies have reported yet. Large percentages of consumers without cable or wireline service U.S. Virgin Islands (est. 3 companies-ILEC, CLECs and Cable in LATA) FCC summary implies no companies have reported yet. Large percentage of consumers without cable or wireline service Broadcast facilities Puerto Rico 34 TV stations-not including repeaters, translators, boosters 1 TV station reporting - 1 station out of service 33 TV stations not reporting (public reports no TV stations operating on air) 141 radio stations-not including repeaters, translators 141 radio stations not reporting (public reports estimate a dozen radio stations operating on air) U.S. Virgin Islands 5 TV stations- not including repeaters, translaters, boosters 5 TV stations not reporting 26 radio stations-not including repeaters, translators 26 radio stations not reporting

17 62

isp/cdn caching
by Aaron Gould 02 Oct '17

02 Oct '17

Hi, I've been aware of a few caching providers for a few years now, but I'm learning of others as time goes on. which makes me curious if there are more springing up and gaining popularity. I'm speaking of ISP-type caching whereas the cache provider sends hardware servers and perhaps a switch to the local ISP to install locally in their network. Can someone please send a simple list of what they know is the current players in this ISP Caching space? I'll list the ones I know about and you please let me know of others. This seems to be an evolving/growing thing and I'm curious of where we are today for significant providers and possibly up-and-coming ones that I should know about. (amazon prime has my wondering also.) Google (GGC) Netflix (OCA) Akamai (AANP) Facebook (FNA) Apple (I heard this isn't isp-located like the others, but unsure) ? others ? ? others ? ? others ? -Aaron Gould

5 4

Long BGP AS paths
by William Herrin 02 Oct '17

02 Oct '17

To the chucklehead who started announcing a 2200+ byte AS path yesterday around 18:27 EDT, I beg of you: STOP. You've triggered a bug in Quagga that's present in all versions released in the last decade. Your announcement causes routers based on Quagga to send a malformed update to their neighbors, collapsing the entire BGP session. Every 30 seconds or so. For everyone else: please consider filtering BGP announcements with stupidly long AS paths. There's no need nor excuse for them to be present in the DFZ and you could have saved me a painful Saturday. Cisco: router bgp XXX bgp maxas-limit 50 Juniper: https://kb.juniper.net/InfoCenter/index?page=content&id=KB29321 Quagga: ip as-path access-list maxas-limit50 deny ^([{},0-9]+ ){50} ip as-path access-list maxas-limit50 permit .* Regards, Bill Herrin -- William Herrin ................ herrin(a)dirtside.com bill(a)herrin.us Dirtside Systems ......... Web: <http://www.dirtside.com/>

9 11

Re: AS PATH limits
by Ken Chase 02 Oct '17

02 Oct '17

I dont see that as the solution. Someone else will offend again. However, I also don't see trusting major backbones as our filters (for many other reasons). Our software should be handling what's effectively a buffer overflow or equivalent (beware long paths that are actually shellcode). Quagga among others seems to be subject to this bug, pre 0.99.23 or so (.99.24+ seems ok). So upgrading is a solution. There was also some chatter on the quagga mailing list on how it's more pleasant to stab your eyeballs out rather than constructing extremely long regexp's that might work as a filter. https://lists.quagga.net/pipermail/quagga-users/2017-September/thread.html /kc On Sat, Sep 30, 2017 at 05:30:03PM +0200, Niels Raijer said: >My message to NANOG about this from 12:31 UTC today is still in the moderation queue. I had opened a support case with Cogent before writing my message to NANOG and Cogent has let me know approximately 40 minutes ago that they have contacted their customer. > >Niels > > > >On 30 Sep 2017, at 17:09, sthaug(a)nethelp.no wrote: > >>> If you're on cogent, since 22:30 UTC yesterday or so this has been happening >>> (or happened). >> >> Still happening here. I count 562 prepends (563 * 262197) in the >> advertisement we receive from Cogent. I see no good reason why we >> should accept that many prepends. >> >> Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no > -- Ken Chase - math(a)sizone.org Guelph Canada

7 7

Peering at public exchange authentication
by craig washington 30 Sep '17

30 Sep '17

Hello all, Wondering your views or common practices for using authentication via BGP at public exchange locations. Just for example, lets say you peer with 5 people in the TELX in Atlanta, do you require them to all use authentication for the BGP session? Ive seem some use it and some not use it, is it just a preference?

6 5

CPE that support 1G with BGP multihomed
by marcel.duregards＠yahoo.fr 30 Sep '17

30 Sep '17

Dear Nanoger, Anyone have an advice on CPE which can support the following features, please: 1) 1 Gigabits/s ipv4 or ipv6 forwarding IMIX or Internet traffic, full duplex (not sure if cisco or miercom are conducting bidirectionals traffic flows at the same time). 2) with ACLs and with uRPF with prefix filtering with bgp ext-communities (rfc 8092 would be a ++, but not mandatory) 3) with BGP full route, 1 eBGP session + 1 iBGP (--> multihomed, single attached solution, so there is 2 CPE connected to 2 bgp transit)) 4) vrf light and SNMP + telnet/ssh with ACLs Currently on Cisco side, we see the following candidates: - ASR 1001-x - ASR 1002 - ISR 4431, 4451 - ISR G2 2921 + 2951 + 3925(E) (EoL soon, so we are currently in the process of evaluating other solution). But we would like also to include other manufacturer : juniper, mikrotik , etc.... Thank for your help, - Marcel

4 3

AT&T-twtelecom LA issue
by Andrew Stern 29 Sep '17

29 Sep '17

Hello. We are experiencing traffic issues between AT&T and twtelecom between SF and LA (5-7% dropped and out-of-order packets, increased latency RTT). Issue occurs only during business hours pacific time. We are on the AT&T enterprise side of the equation. My personal guess is oversubscribed peering, but what do I know? If anyone from att or twtelecom sees this, help! Andrew Stern, CBNE | Broadcast Engineer Cumulus Media San Francisco KFOG | KNBR | KSAN | KTCT | KGO | KSFO office: 415-995-5740 andrew.stern(a)cumulus.com<mailto:andrew.stern@cumulus.com> 750 Battery St. | 2nd Floor | San Francisco | CA 94111 ________________________________ Cumulus Media Disclaimer This message contains confidential information and is intended only for the individual(s) named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0