October 2019 - Test - lists.nanog.org

Contacts at Three.co.uk
by John Von Essen 08 Oct '19

08 Oct '19

I know this is a North America list, but anyone here connected with Three or have a contact there? I am investigating an issue related to the default adult filter settings that are becoming more common (maybe required now?) in the UK on mobile data networks. I work at a large search engine, not Google or Bing, but like #4 or 5 in the world, and a portion of our site is being blocked by Three - and we’ve determined its related to their adult filter settings on mobile or mifi devices. We’d like to get in contact with them to understand how/why it was blocked and what we can do to resolve it. Thanks John Von Essen

2 1

Re: Chicago Equinix IX LAN oddity
by JASON BOTHE 08 Oct '19

08 Oct '19

Got it, thanks for that. I’ll have to give the big E a call and see how to sort this one out. J~ > On Oct 8, 2019, at 13:55, James Cornman <james(a)atlanticmetro.net> wrote: > > > There was a subnet expansion/migration there earlier this year (maybe late last year?) > > We have an old and new address on our interface.. The 208.x is the new range (aka bigger) > > ip address 206.223.119.124/24 > ip address 208.115.136.124/23 > > -James > >> On Tue, Oct 8, 2019 at 2:47 PM JASON BOTHE via NANOG <nanog(a)nanog.org> wrote: >> Hi all >> >> I realize this might not be the right list but I have a request to peer on the Chicago Equinix IX to a 206.223.119 IP but we and many others are on the 208.115.137 network. While I await a response from the peering partner, I’d curious to know if this is an error, perhaps there was a renumber at one time or I’m flat out just missing something. >> >> Cheers! >> >> J~ > > > -- > James Cornman > jcornman(a)atlanticmetro.net > 212.792.9950 > > Atlantic Metro Communications > 4 Century Drive, Parsippany NJ 07054 > > Cloud Hosting • Colocation • Network Connectivity • Managed Services > Follow us on Twitter: @atlanticmetro • Like us on Facebook > www.atlanticmetro.net

2 1

Update to BCP-38?
by Stephen Satchell 08 Oct '19

08 Oct '19

Is anyone working on an update to include IPv6?

12 35

Spoofer Report for NANOG for Sep 2019
by CAIDA Spoofer Project 08 Oct '19

08 Oct '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Sep 2019: ASN Name Fixed-By 13427 SOFTCOM-INTERNET-COMMUNICATION 2019-09-12 3807 UMTNET-ASN 2019-09-16 8047 GCI 2019-09-16 225 VIRGINIA 2019-09-18 16787 CHARTER-16787-DC 2019-09-23 22402 NEXTCO 2019-09-23 2828 XO-AS15 2019-09-26 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Sep 2019: ASN Name First-Spoofed Last-Spoofed 40065 CNSERVERS 2016-05-01 2019-09-04 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-09-25 6128 CABLE-NET-1 2016-09-03 2019-09-25 27364 ACS-INTERNET 2016-09-27 2019-09-19 20412 CLARITY-TELECOM 2016-09-30 2019-09-27 6181 FUSE-NET 2016-10-10 2019-09-29 15305 SYRINGANETWORKS 2016-10-21 2019-09-19 14971 PINETEL 2016-10-21 2019-09-19 25787 ROWE-NETWORKS 2016-10-21 2019-09-29 174 COGENT-174 2016-10-21 2019-09-26 32440 LONI 2016-11-03 2019-09-26 12083 WOW-INTERNET 2016-11-09 2019-09-30 39939 RISE-CO-AS39939 2016-11-11 2019-09-12 1403 EBOX 2016-11-12 2019-09-27 2828 XO-AS15 2016-11-21 2019-09-11 9009 M247 2017-01-10 2019-09-04 701 UUNET 2017-06-14 2019-09-30 63296 AMARILLO-WIRELESS 2017-09-01 2019-09-27 546 PARSONS-PGS-1 2017-11-20 2019-09-12 54540 INCERO-HVVC 2018-01-15 2019-09-16 12222 AKAMAI 2018-02-14 2019-09-30 4201 ORST 2018-04-19 2019-09-25 11827 WSU 2018-05-07 2019-09-26 19016 WCG 2018-05-19 2019-09-01 225 VIRGINIA 2018-06-18 2019-09-27 33452 RW 2018-09-19 2019-09-28 20448 VPNTRANET-LLC 2018-09-20 2019-09-10 63275 RADIOWIRE 2019-02-07 2019-09-23 15290 ALLST-15290 2019-04-09 2019-09-19 8047 GCI 2019-04-11 2019-09-24 10745 ARIN-ASH-CHA 2019-04-29 2019-09-30 38235 MEKONGNET-ADC 2019-05-09 2019-09-22 32 STANFORD 2019-08-21 2019-09-24 21709 IMPLEX-NET 2019-09-24 2019-09-24 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

dns cache beyond ttl - viasat / exede
by Mike 08 Oct '19

08 Oct '19

Hello, I am moving a number of web sites from one colo to another, re-numbering them in the process, and I have run into an interesting issue I'd like to solicit feedback on. My dns TTL's are all 300 seconds, and I have noticed that once I update the A records with the new addresses, most (but not all) web clients begin using the new address within 5 minutes or so. However, there is a persistent set of stragglers who continue accessing the site(s) on their old addresses for far in excess of this - up to a week in fact. And, what I have noted, all of these clients have something in common - they all appear to be satellite users of viasat/exede. This is based on whois lookups of the ip addresses of the clients. Note, I am NOT expecting 'turn on a time' - just looking for clients to refresh within a reasonable time. I am wondering if perhaps this is due to some kind of (known?) bug in the embedded dns cache/client in the client satellite modem, or if there is another plausible explanation I am not seeing. It compounds my problem slightly since I have to continue running the web sites at both the old and new addresses while these things time out I guess and it's just inconvenient. Thanks. MIke-

7 11

Automated Abuse Reports
by Matt Corallo 08 Oct '19

08 Oct '19

How do people view the automated generation of abuse reports? I’ve seen lots of (understandable) moaning about large providers not handling abuse reports, and lots of (understandable) suggestions that ARIN test for the reachability of abuse contacts. On the flip side, I run a Tor exit node (as well as bridge nodes, which appear to be used exclusively by Chinese, Russian, and Iranian IPs, indicating Tor is, contrary to popular belief, used in large part for its intended purpose). Because people seem to include “you tried three to log in three times and got the password wrong” in their definition of abuse, I’ve had to provide bogus abuse contacts (and include actual abuse comments in the comments section). I’ve tried reaching out to other operators suggesting that they cut it out, as they are the reason many operators do not provide functional abuse contacts, usually with a response of “so stop attacking my serverz!!!1one”. Is it time to have ARIN add a “abuse contact available only after captcha” option? Matt

3 2

Re: Poor mans TAP
by John Kristoff 07 Oct '19

07 Oct '19

On Mon, 7 Oct 2019 14:16:31 +0000 Dovid Bender <dovid(a)telecurve.com> wrote: > Funds at my 9-5 are limited. Has anyone tried this and how well does > it work? We plan on mirroring about 800 megs of traffic at peak. > https://www.amazon.com/Dualcomm-1000Base-T-Ethernet-Regeneration-Network/dp… I don't know if it still works on modern switches, but many years ago I was able to have Cisco LAN switches configured such that a single L2 MAC address could be statically associated with multiple interfaces (i.e. router interface). This made it possible to duplicate all traffic to destined to one station to appear on two (maybe more?) ports. You might try this also if you have an unused and available switch. John

4 5

This DNS over HTTP thing
by Jay R. Ashworth 07 Oct '19

07 Oct '19

I've been embroiled in my first house-move in 28 years, and just got back to the table. I don't see any threads here about whatever this thing-which- appears-to-me-to-be-a-monstrosity; has it been discussed here and I missed it? Is there an official name for it I should be searching for? Is it in fact not a monstrosity, and I'm just not smart enough? :-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

39 86

Poor mans TAP
by Dovid Bender 07 Oct '19

07 Oct '19

Hi, Funds at my 9-5 are limited. Has anyone tried this and how well does it work? We plan on mirroring about 800 megs of traffic at peak. https://www.amazon.com/Dualcomm-1000Base-T-Ethernet-Regeneration-Network/dp… TIA. Dovid

2 1

Equipment needed plea!
by James Laszko 07 Oct '19

07 Oct '19

Probably gonna get yelled at for this, but does anyone by chance have a Cisco N5548P-FAN module in the Atlanta area? We have a customer with critical infrastructure down and can’t find one anywhere! Any assistance would be appreciated. Thanks, James Laszko Mythos Technology Inc jamesl(a)mythostech.com

1 0