February 2018 - Test - lists.nanog.org

Contact inside of Time Warner/Spectrum NOC?
by Andy Dills 07 Feb '18

07 Feb '18

As of this past weekend, we've had numerous customers that are all on TWT/Spectrum/Charter's network complain to us about frequent slowness and dropped connections to our address space when using standard ports, as well as failed IPsec connections. Traffic on non-standard ports flows fine (for example a website on 8080). Doing wiresharks, we've determined the packets are hanging on the way back to the end user on Spectrum's network. It would appear traffic from our address space is being subjected to an overworked content inspection system. I can't seem to find a way to contact somebody technical without being a customer. Help? Thanks, Andy -- ----------------------------------------------------- ANDY DILLS - XECUNET, LLC 5744-R Industry Lane Frederick MD 21704 www.xecu.net [1] P: 301-682-9972 P: 1-877-XECUNET F: 240-215-0351 Twitter [2] Facebook [3] ----------------------------------------------------- Links: ------ [1] http://www.xecu.net/ [2] https://twitter.com/Xecunet [3] http://www.facebook.com/xecunet

1 0

Looking for colocation in NY or NJ
by Matthew Crocker 07 Feb '18

07 Feb '18

Hello, I’m looking to establish a POP in the area with the purpose of connecting to exchanges (DE-CIX, Equinix New York, NYIIX). I’ll need access to Lightower or Level(3) for transport back to Springfield (1 Federal St), & Boston MA (1 Summer St). I’ll need a cabinet, 208v power, planning on a Juniper MX480 but my go with a couple MX204s Initially I was looking at 111 8th. I’m getting pricing from Equinix for NY2 that will save $$ on space & power. Is it really ‘all the same’ and I can get anywhere to anywhere in NY Metro? Would I be handicapping myself by going across the river into NJ? Thanks -Matt -- Matthew Crocker Crocker Communications, Inc. President

3 2

Contact at archive.org
by Ben McGinnes 07 Feb '18

07 Feb '18

Hello, If there's anyone involved with archive.org's systems team lurking around here, I'd appreciate being contacted off list. Regards, Ben -- | GPG Made Easy (GPGME) Python 3 API Maintainer, GNU Privacy Guard | | GPG key: 0x321E4E2373590E5D http://www.adversary.org/ben-key.asc | | GPG key fpr: DB47 24E6 FA42 86C9 2B4E 55C4 321E 4E23 7359 0E5D | | https://www.gnupg.org/ https://securetheinternet.org/ |

1 1

Dark Fiber Providers - Domestic
by Rod Beck 06 Feb '18

06 Feb '18

Who regulates and licenses dark fiber providers? Or does no one? Roderick Beck Director of Global Sales United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-30-859-5144 [1467221477350_image005.png]

3 2

Embratel / Claro AS4230
by Faisal Imtiaz 06 Feb '18

06 Feb '18

Hello All, Looking for a Technical Contact / IP NOC Engineer for EmbraTel/Claro AS4230 ? We are seeing some of the routes we are announcing not showing up in there route tables. (170.80.188.0/24 and 170.80.190.0/24 and 170.80.191.0/24) Off list contact will be great. Thanks Faisal Imtiaz Snappy Internet & Telecom http://www.snappytelecom.net Tel: 305 663 5518 x 232 Help-desk: (305)663-5518 Option 2 or Email: Support(a)Snappytelecom.net

1 0

Re: improving signal to noise ratio from centralized network syslogs
by Scott Weeks 06 Feb '18

06 Feb '18

--- tarko(a)lanparty.ee wrote: > This is done with the 'logging facility' > command on the devices: > > After defining your syslog server's IP > address and the level of messaging you want > (I set it to debug because I want to see > everything): > > on the routers: logging facility local0 > on the switches: logging facility local1 Alternative, and more universal, way to do it is to use multiple IPs for syslog server. Then configure correct syslog server IP on the device. syslog-ng and others can all do filtering to different destinations based on the IP where message was received. ------------------------------------------------ The nice thing about the simple way is you see everything that's happening on the network, except what you 'egrep -v' out, which you already know about. Then you find things you weren't expecting. You don't go looking for stuff. You just watch the network events scroll by in real time ans see what shows up. I have no knowledge of syslog-ng. Does it do the real time scrolling like I mention? scott

4 4

40G reforming
by Baldur Norddahl 06 Feb '18

06 Feb '18

Hello Is it possible to reform a 40G signal as individual 10G links? The idea is to use a 40G QSFP multimode MTP module such as https://www.fs.com/products/44058.html. Then connect it using a MTP breakout cable such as https://www.fs.com/products/68049.html to get four dual fiber connectors. These are then connected to four 10G SFP+ multimode modules such as https://www.fs.com/products/11589.html. The reformer could be https://www.fs.com/products/43721.html. And finally the reformed signal can be transported using anything including DWDM modules such as https://www.fs.com/products/44058.html. Just using fs.com as a reference to the kind of equipment I am talking about. Many other vendors offer simelar products. The motivation for doing this is to get access to the many options that are available for 10G optics but not possible with 40G. Regards, Baldur

7 10

Re: improving signal to noise ratio from centralized network syslogs
by Scott Weeks 05 Feb '18

05 Feb '18

--- jmaimon(a)jmaimon.com wrote: Centralized logging is a good thing. However, what happens is that every repetitive, annoying but not (usually) important thing fills up the log with reams of what you are not looking for. --------------------------------------- Apologies, I'm late to the party. But I just want to add one thing for the archives. It's along with what Rich Kulawiec said, "it forces you to look at your own data, which is really helpful. You'll be surprised at what you find if you've never done it before." This is accurate. It's fun to see what your network is putting out. This is all from memory (I've done it so many times it's in there permanently... :-) as I don't have a unix server or a router in front of me to use, so don't hold me to exact details... And it's mainly for the newbies. Have all the routers send to one syslog file, switches to another and other devices to a third on a *nix box: For example, send the router messages to /var/log/router.log and the switch messages to /var/log/switch.log This is done with the 'logging facility' command on the devices: After defining your syslog server's IP address and the level of messaging you want (I set it to debug because I want to see everything): on the routers: logging facility local0 on the switches: logging facility local1 on the logging server in: /etc/rsyslog.conf local0.* /var/log/router.log local1.* /var/log/switch.log Use logrotate to manage the log files as they can get quite large. Then, you can watch your network in real time like so (below is all one line): tail -f /var/log/router.log /var/log/switch.log | egrep -vi 'term1|term2|termN' 'egrep -v' takes out all the lines you don't want to see while the syslog messages scroll across the screen. Say there is a battery condition on router1 and a duplex mismatch on a switch I don't want to see: tail -f /var/log/router.log /var/log/switch.log | egrep -vi 'router1.*battery|switch1.*duplex.*mismatch' For me, N can get to 40-50 sometimes, so I put it into a shell script like so: vi log.sh --------------------------- #! /bin/sh tail -f /var/log/router.log /var/log/switch.log | egrep -v 'term1|term2|termN' --------------------------- then, run it like so: ./log.sh It's all netgeek fun-n-games from there on. :) scott

5 4

Akamai caches hammering Sophos XG firewalls
by Jeremy Parr 05 Feb '18

05 Feb '18

Somewhat OT, but before I was a jack of all trades enterprise sysadmin, I was a jack of all trades ISP sysadmin. I'm seeing an issue at a few sites where I have Sophos XG firewalls deployed where the XG gets hammered on it's WAN interface by Akamai hosts with TCP re-transmissions. Anyone at Akamai who may have some background on this issue please reach out to me. The hosts currently in question are 24.244.145.137 and 24.244.145.139, but I suspect that is only due to these being closest to me, colocated at my ISP AS15146.

2 1

Re: improving signal to noise ratio from centralized network syslogs
by Scott Weeks 05 Feb '18

05 Feb '18

--- shane(a)short.id.au wrote: In addition to that, you can use some fancy awk colour coding, so you can make it highlight certain lines based on content.. I use this for my e-mail logs, but I’m sure it could be adapted: tail -n 1000 -f /var/log/mail-submission.log | grep smtp.*relay | awk ' /sent/ {print "\033[32m" $0 "\033[39m"} /bounced/ {print "\033[31m" $0 "\033[39m"} /deferred/ {print "\033[33m" $0 "\033[39m"} ---------------------------------------------------- The main thing for me is to find things that your network is doing that you weren't aware of. Not normal things you want to see that a monitoring system will alert you about. scott

1 0