July 2018 - Test - lists.nanog.org

Mark Tinka ping request
by Eric Tykwinski 12 Jul '18

12 Jul '18

Mark, Kevin does work for Apache and was asking about OSS usage rates in Africa/other places as well. Since I know you are very involved in SAFNOG, et al, I figured you’d be a good resource for contacts over there for data. I’m CCing Kevin McGrail, so more of an intro if you know of anyone. Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300

2 1

Looking for Incapsula contact
by Frank Bulk 11 Jul '18

11 Jul '18

Emails to NOC have gone unanswered (I did have success with that a year or two ago). Have had a handful of business customers in the last week contact us about B2B web sites they can't reach anymore ... of the eight documented websites, five are using Incapusla address space and others might be using Incapusla's service. Packet traces are showing the remote (web) site is issuing a TCP RST. Frank CTO, Premier Communications

1 1

Verizon/Azure communication issue
by Ross Tajvar 11 Jul '18

11 Jul '18

We have a customer on Fios who (as far as I can tell) can't reach any IP announced by Microsoft. I tried calling both NOCs listed on PeeringDB but Verizon's number didn't work and the Microsoft guy hung up on me. Is there anyone here who has a better contact at either group? Note: It's not a Fios-wide problem, as my office is also on Fios and can reach the IPs fine. It's just 0.ae13.gw9.iad8.alter.net [140.222.236.139] that seems to be having a problem. Thanks, Ross

1 0

SE Mediacom reporting complete internet outage FL GA AL
by Kraig Beahn 10 Jul '18

10 Jul '18

SE Mediacom reporting complete internet outage FL GA AL 114800 EDT 07/10/2018 —————— FROM MEDIACOM: big issue in GA, AL, FL atm - currently under investigation... sounds like a major fiber cut

1 1

AS3266: BitCanal hijack factory, courtesy of Cogent, GTT, and Level3
by Ronald F. Guilmette 10 Jul '18

10 Jul '18

Sometimes I see stuff that just makes me shake my head in disbelief. Here is a good example: https://bgp.he.net/AS3266#_prefixes I mean seriously, WTF? As should be blatantly self-evident to pretty much everyone who has ever looked at any of the Internet's innumeriable prior incidents of very deliberately engineered IP space hijackings, all of the routes currently being announced by AS3266 (Bitcanal, Portugal) except for the ones in 213/8 are bloody obvious hijacks. (And to their credit, even Spamhaus has a couple of the U.S. legacy /16 blocks explicitly listed as such.) That's 39 deliberately hijacked routes, at least going by the data visible on bgp.he.net. But even that data from bgp.he.net dramatically understates the case, I'm sorry to say. According to the more complete and up-to-the-minute data that I just now fetched from RIPEstat, the real number of hijacked routes is more on the order of 130 separate hijacked routes for a total of 224,512 IPv4 addresses: https://pastebin.com/raw/Jw1my9Bb In simpler terms, Bitcanal has made off with the rough equivalent of an entire /14 block of IPv4 addresses that never belonged to them. (And of course, they haven't paid a dime to anyone for any of that space.) Of couse we could all be shocked (Shocked!) at this turn of events if it were not for the fact that Bitcanal already has a rich, longstanding, and sordid history of involvement with IP space hijacks. All one has to do is google for "Bitcanal" and "hijack" to find that out. This isn't exactly a state secret. In fact if you lookup "IP space hijacking" in any modern Internet dictionary you'll find Mr. Joao Silveira's picture next to the definition: https://twitter.com/bitcanal :-) This guy Silveira has obviously decided that he is a law unto himself, and can grab whatever IP space happens to be lying around for his own purposes... and no need to fill out any tedious forms -or- pay any fees for using any of this space to any of those annoying Regional Internet Registries. As usual, and as I have said here previously, I generally don't mind too much when these kinds of greedy idiots decide to color outside the lines. As long as they just confine themselves to hijacking abandoned IP blocks belonging to banks and/or government agencies, well then it's no skin off my nose. But when they start reselling their stolen IP space to spammers, as Mr. Silveira is apparently in the habit of doing, then I get ticked off. And actually, Mr. Silveira must be *exceptionally* greedy in that he is apparently not satisfied to just sub-lease his own legitimate IP space to snowshoe spammers, as he is clearly doing: https://pastebin.com/raw/5P5rnQ2y Obviously, merely hosting snowshoe spammers in his own IP space isn't enough to keep Mr. Silveira in the style to which he has become accustomned, so he has to go out and rip off other people's IP space and then resell that to spammers also. The fact that there exists a jerk like this on the Internet isn't really all that surprising. What I personally -do- find rather surprising is that three companies that each outght to know better, namely Cogent, GTT, and Level3 are collectively supplying more than 3/4ths of this guy's IPv4 connectivity, at least according to the graph displayed here: https://bgp.he.net/AS197426 Without the generous support of Cogent, GTT, and Level3 this dumbass lowlife IP address space thief would be largely if not entirely toast. So what are they waiting for? Why don't their turf this jackass? Are they waiting for an engraved invitation or what? As I always ask, retorically, in cases like this: Where are the grownups? I would like everyone reading this who is a customer of Cogent, GTT, or Level3 to try to contact these companies and ask them why they are providing connectivity/peering to a hijacking jerk like this Silveira character. Ask them why -you- have to endure more spam in your inbox just so that -they- can make another one tenth of one percent profit by peering with this hijacking, spammer-loving miscreant. I would ask them myself, but I personally am not a direct customer of any of them, so they would all, most probably, just tell me to go pound sand. If you do manage to make contact, please be sure to mention all three of Mr. Silveira's ASNs, i.e. AS42229, AS197426, and AS3266. And don't let whoever you talk to try to weasel out of responsibility for this travesty, e.g. by claiming that they don't know anything about what's been going on with all those hijacks announced by AS3266, and/or that they only provide peering for AS197426. The hijacks may all be originating from Mr. Silveira's AS3266, but bgp.he.net makes clear that AS3266 has one, and only one peer, i.e. Mr. Silveira's AS197426: https://bgp.he.net/AS3266 So basically, Cogent, GTT, and Level3 are the prime enablers of this massive theft of IP space. (They might try to claim that BitCanal's historical propensity to engage in hijacks is sonmething "brand new" or at least that -they- may not have been aware of it until now, in which case you should ask them if they have anybody on staff who is paying attention. As noted above, it isn't as if Bitcanal just started pulling this crap yesterday. Far from it.) Oh! And you might also mention the fact that Spamhaus, and, I would guess, at least a few of the oether public blacklists already have most or all of Mr. Silveira's IP space... hijacked or otherwise... blacklisted, presumably for good and ample cause. As long as Cogent, GTT, and Level3 are willing to go along with this nonsense, i.e. by selling peering to this Silveira thief, crime on the Internet -does- pay, and the theft of other people's IP space will continue to be rewarded rather than punished, as it should be. If that becomes the new normal for Internet behavior, then god help us all. Regards, rfg

20 29

A.W.S. Product / Services Inquiry...
by Michael Bullut 10 Jul '18

10 Jul '18

Greetings Team, Anyone from the Amazon Web Services Team here? I have an inquiry regarding your virtual server offerings. Warm regards, Michael Bullut. --- *Cell:* *+254 723 393 114.**Skype Name:* *Michael Bullut.* *Twitter:* * @Kipsang <http://twitter.com/Kipsang/>* *Blog: http://www.kipsang.com/ <http://www.kipsang.com/>* *E-mail:* *main(a)kipsang.com <main(a)kipsang.com>* *---*

1 0

Re: Time to add 2002::/16 to bogon filters?
by Gary McArtor 09 Jul '18

09 Jul '18

Hi Youssef, My original reply wasn't sent to the Nanog list. Team Cymru considers 2002::/16 and 192.88.99.0/24 to be legitimate prefixes at this time, and will be not be adding them to our bogon filters. Our interpretation of the 6to4 anycast rfc is that while these are encouraged to be made obsolete, in practice they may still be in use, excluding them from being universally defined as a bogon in our feed. The RFC in question: https://tools.ietf.org/html/rfc7526 The rule, as it always should be, is to know your network, and know what is best for it. As noted in the RFC you are encouraged to review any current deployments and any existing filtering and adjust based on your own discretion. Regards, Gary McArtor Team Cymru On 6/28/18 2:32 PM, Rabbi Rob Thomas wrote: > FYI, the question has been raised. I'm not sure if this is wise or not. > Gary, what are your thoughts? > > > -------- Forwarded Message -------- > Subject: Re: Time to add 2002::/16 to bogon filters? > Date: Thu, 28 Jun 2018 21:11:22 +0200 > From: Youssef Bengelloun-Zahr <bengelly(a)gmail.com> > To: Job Snijders <job(a)ntt.net> > CC: NANOG [nanog(a)nanog.org] <nanog(a)nanog.org> > > Hello Job, > > Thank you for this feedback. I guess that NTT adopting this as a best > practice will ring some bells around. > > Do you know if Team Cymru has updated their filters accordingly ? > > Best regards. > > > >> Le 28 juin 2018 à 20:58, Job Snijders <job(a)ntt.net> a écrit : >> >> Dear alll, >> >> Thank you all for your input. Just a heads-up - we deployed a few days ago. >> >> NTT / AS 2914 now considers “2002::/16 le 128” and “192.88.99.0/24 le 32” >> to be bogon prefixes, and no longer accepts announcements for these >> destinations from any EBGP neighbor. >> >> Kind regards, >> >> Job >

4 4

NANOG 74 Call for Presentations is open
by Ryan Woolley 09 Jul '18

09 Jul '18

NANOG Community, The NANOG Program Committee is excited to announce that we are now accepting proposals for all sessions at NANOG 74 in Vancouver, BC, Canada, October 1-3, 2018. Below is a summary of key details and dates from the Call For Presentations on the NANOG website, which can be found at: http://www.cvent.com/d/qgqs03/6K The NANOG Program Committee seeks proposals for presentations, panels, tutorials, and track sessions for the NANOG 74 program. We welcome suggestions of speakers or topic ideas. Presentations may cover current technologies already deployed or soon-to-be deployed in the Internet. Vendors are welcome to submit talks which cover relevant technologies and capabilities, but presentations must not be promotional or discuss proprietary solutions. NANOG 74 submissions can be entered on the NANOG Program Committee Tool at https://pc.nanog.org The primary speaker, moderator, or author should submit a presentation proposal and an abstract in the Program Committee Tool. - Select “Propose Talk” from the Talks menu - Select NANOG 74 from the Meeting menu - Select the appropriate *Session* the talk will be presented in (General Session 30-45 minutes; Tutorial 90-120 minutes; Track 90-120 minutes) Timeline for submission and proposal review: - Submitter enters abstract (and draft slides if possible) in Program Committee Tool: any time following Call for Presentations and prior to CFP deadline for slide submission - PC performs initial review and assigns a “shepherd” to help develop the submission: within 2 weeks - Submitter develops draft slides of talk. Please submit initial draft slides early. Panel and Track submissions should provide topic list and intended/confirmed participants - PC reviews slides and continues to work with Submitter as needed to develop topic - Draft presentation slides should be submitted prior to published deadline for slides - PC accepts or declines submission - Agenda assembled and posted - Submitters notified If you think you have an interesting topic but want feedback or suggestions for developing an idea into a presentation, please email the Program Committee, and a representative of the Program Committee will respond. Otherwise, submit your talk, keynote, track, or panel proposal to the Program Committee Tool without delay! We look forward to reviewing your submission. Key Dates for NANOG 74: Monday, 07/09/18 Registration for NANOG 74 Opens Monday, 07/09/18 Agenda Outline for NANOG 74 Posted Tuesday, 09/04/18 CFP Deadline: Presentation Slides Due Tuesday, 09/04/18 CFP Topic List and NANOG Highlights Page Monday, 09/24/18 Speaker FINAL presentation Slides to PC Tool Sunday, 09/30/18 Lightning Talk Submissions Open (Abstracts Only) Sunday, 09/30/18 On-site Registration Final slides must be submitted by Monday, September 24, 2018, and no changes will be accepted between that date and the conference. Materials received after that date will be updated on the web site after the completion of the conference. We look forward to seeing you in October in Vancouver! Sincerely, Ryan Woolley NANOG PC

1 0

Re: [c-nsp] Leaked Video or Not (Linux and Cisco for internal Sales folks)
by Tails Pipes 09 Jul '18

09 Jul '18

No, things changed there as well. Lookup merchant sillicon, and revise this post every 6 months. have you heard of Barefoot networks? The days of ASICs from Cisco are gone and we are glad, we tested the P4 DSL (cisco never got that right with mantel) on Nexus and its wonderful. The asics you speak of are no longer important or valuable because people realized that in many networking planets and galaxies, the asic is reflects the network design, they are related, and specifically for the data center, the clos fabric design won, and that does not require fancy asics. I guess your knowledge is out dated a bit. Cisco itself is using those merchant sillicon ASICs happily. (lookup Chuck's comments on nexus9000, best selling cisco switch ever)...guess it is a good switch, because bright box pushed cisco to do that, and if any one on this list can disagree with me here, i'm up to that challenge. What i have discovered recently is that things happen in following way. Your boss or his boss picks a work culture (no one gets fired for buying IBM/Cisco), that culture (buying the shiny suits) impacts how you do work, it makes you select vendors (the ones that sends me to vegas every year) and not the right network design, you select cisco and you are stuck there for life, because once they tell you how things should work (aka : certificates), things are worse, now every time you make a new network purchase (afraid of new CLI ), you will not be able to look the other way because you just dont know any thing else (and loosing your certificate value). I wish the culture would change to, no one got fired for buying closed but didnt get promoted either. change requires boldness. https://toolr.io/2018/06/18/stop-abusing-the-word-open/ On Wed, Jun 27, 2018 at 9:41 AM, <adamv0025(a)netconsultings.com> wrote: > > Tails Pipes > > Sent: Friday, June 22, 2018 3:00 PM > > > > can you easily answer this question ? why packets are not pushed in > linux ? > > is it because of big switch, cumulus, pica8 ? > > > > can you push packets in linux without writing code to do that ? who is > writing > > that code ? > > > > this is supposedly a community effort, something that older generations > > dont understand. > > > If pure linux as NOS has some legs it'll fly regardless of cisco blessing, > don't worry no single company owns the whole industry. > Also we can argue that this is only about the OS but in reality it's also > the quality of apps running on top and the quality of the underlying HW > that plays a major role. > The quality of BGP app for instance, or the ability of the forwarding ASIC > to deliver the stated pps rate even if multiple features are enabled or > protect high priority traffic even if ASIC is overloaded. > > > Oh and with regards to: > < I am sick of having to learn all the cisco specific terms to all sorts > of different boxes and technologies > I'd recommend you read all the cisco books on networking to get yourself > educated on the topic and to get the difference between SW and HW > forwarding ( -on why packets are not routed in linux) > And while on that I suggest you read all Stanford university lectures on > how routers work too, it'll help you understand why Cisco and Juniper ASICs > are so much more expensive than white-box ASICs. > > adam > > netconsultings.com > ::carrier-class solutions for the telecommunications industry:: > > >

4 3

Spoofer Report for_NANOG for Jun 2018
by CAIDA Spoofer Project 08 Jul '18

08 Jul '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Jun 2018: ASN Name Fixed-By 40764 DNA-DKLB 2018-06-05 29384 Qatar-Foundation 2018-06-06 11796 AIRSTREAMCOMM-NET 2018-06-08 2828 XO-AS15 2018-06-11 11427 SCRR-11427 2018-06-12 5056 AUREON-5056 2018-06-14 20082 ABSNOC1 2018-06-17 6181 FUSE-NET 2018-06-22 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jun 2018: ASN Name First-Spoofed Last-Spoofed 577 BACOM 2016-03-09 2018-06-24 20115 CHARTER-NET-HKY-NC 2016-06-09 2018-06-15 19230 NANOG 2016-06-13 2018-06-27 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2018-06-27 6128 CABLE-NET-1 2016-09-03 2018-06-27 20412 CLARITY-TELECOM 2016-09-30 2018-06-25 6181 FUSE-NET 2016-10-10 2018-06-29 25787 ROWE-NETWORKS 2016-10-21 2018-06-26 174 COGENT-174 2016-10-21 2018-06-27 271 BCNET 2016-10-24 2018-06-25 2828 XO-AS15 2016-10-25 2018-06-29 32440 LONI 2016-11-03 2018-06-29 33182 DimeNOC 2016-11-08 2018-06-27 12083 WOW-INTERNET 2016-11-09 2018-06-29 1403 EBOX 2016-11-12 2018-06-27 20105 URICHMOND 2016-11-15 2018-06-28 2152 CSUNET-NW 2017-02-02 2018-06-29 21832 KELLINCOM-1 2017-02-03 2018-06-27 7276 UNIVERSITY-OF-HOUSTON 2017-03-09 2018-06-26 133481 AIS-Fibre 2017-04-20 2018-06-06 6461 ZAYO-6461 2017-06-21 2018-06-29 26253 SCINTERNET 2017-06-30 2018-06-01 63296 AMARILLO-WIRELESS 2017-09-01 2018-06-27 7233 YAHOO-US 2017-09-07 2018-06-28 546 PARSONS-PGS-1 2017-11-20 2018-06-05 54540 INCERO 2018-01-15 2018-06-25 12222 AKAMAI 2018-02-14 2018-06-30 55236 CBC 2018-03-03 2018-06-25 3257 GTT-BACKBONE 2018-03-06 2018-06-25 29384 Qatar-Foundation 2018-03-08 2018-06-28 23148 TERRENAP 2018-03-15 2018-06-27 15176 AS-INOC 2018-04-09 2018-06-15 20009 WADSNET 2018-04-13 2018-06-27 11827 WSU 2018-04-19 2018-06-21 54412 RCC-GRANITE-1 2018-06-04 2018-06-04 393564 SPOKANE 2018-06-05 2018-06-20 35911 BNQ-1 2018-06-06 2018-06-28 4 ISI 2018-06-06 2018-06-06 17402 CENTURYLINK-LEGACY-EMBARQ-CHSK 2018-06-10 2018-06-10 12028 MMINTERNET 2018-06-14 2018-06-14 225 VIRGINIA 2018-06-18 2018-06-18 6576 SUMMITCOMM 2018-06-21 2018-06-21 16837 VABB 2018-06-22 2018-06-22 33509 CASCADE-ACCESS-LLC-CA-ESTOR1 2018-06-22 2018-06-22 394548 NETBLAZR-BOS 2018-06-23 2018-06-28 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0