March 2019 - Test - lists.nanog.org

Nexus 9396 SNMP Issues
by Mike Hammett 28 Mar '19

28 Mar '19

Does anyone else have issues with the 9396 sending out bum SNMP responses? Seemingly all DDM information for the optic modules return just a single digit. IE: [redacted]# show int eth 1/3 trans det Ethernet1/3 transceiver is present type is 1000base-LH name is Fiberstore part number is SFP1G-LH-31 revision is A0 serial number is F16ACO17646 nominal bitrate is 1300 MBit/sec Link length supported for 9/125um fiber is 10 km cisco id is 3 cisco extended id number is 4 SFP Detail Diagnostics Information (internal calibration) ---------------------------------------------------------------------------- Current Alarms Warnings Measurement High Low High Low ---------------------------------------------------------------------------- Temperature 40.72 C 100.00 C -50.00 C 85.00 C -40.00 C Voltage 3.35 V 3.79 V 2.80 V 3.46 V 3.13 V Current 15.89 mA 90.00 mA 0.00 mA 85.00 mA 0.00 mA Tx Power -6.05 dBm -1.50 dBm -10.50 dBm -3.00 dBm -9.03 dBm Rx Power -6.32 dBm -3.00 dBm -26.98 dBm -5.00 dBm -23.97 dBm Transmit Fault Count = 0 ---------------------------------------------------------------------------- Note: ++ high-alarm; + high-warning; -- low-alarm; - low-warning [redacted]:~$ /usr/bin/snmpget -v2c -c [redacted] .1.3.6.1.4.1.9.9.91.1.1.1.1.4.300003533 .1.3.6.1.4.1.9.9.91.1.1.1.1.4.300003534 iso.3.6.1.4.1.9.9.91.1.1.1.1.4.300003533 = INTEGER: -6 iso.3.6.1.4.1.9.9.91.1.1.1.1.4.300003534 = INTEGER: -6 [redacted]:/opt/librenms# tcpdump host [redacted] tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 11:13:33.360509 IP [redacted].49594 > [redacted].snmp: C="[redacted]" GetRequest(62) E:cisco.9.91.1.1.1.1.4.300003533 E:cisco.9.91.1.1.1.1.4.300003534 11:13:33.362093 IP [redacted].snmp > [redacted].49594: C="[redacted]" GetResponse(64) E:cisco.9.91.1.1.1.1.4.300003533=-6 E:cisco.9.91.1.1.1.1.4.300003534=-6 ^C 2 packets captured 2 packets received by filter 0 packets dropped by kernel Here I have a 3064 that reports just fine. [redacted]# show int eth 1/17 trans det Ethernet1/17 transceiver is present type is 1000base-LH name is FiberStore part number is SFP1G-LX-31 revision is A0 serial number is D87B1487283 nominal bitrate is 1300 MBit/sec Link length supported for 9/125um fiber is 10 km cisco id is 3 cisco extended id number is 4 SFP Detail Diagnostics Information (internal calibration) ---------------------------------------------------------------------------- Current Alarms Warnings Measurement High Low High Low ---------------------------------------------------------------------------- Temperature 33.38 C 100.00 C -50.00 C 85.00 C -40.00 C Voltage 3.33 V 3.79 V 2.80 V 3.46 V 3.13 V Current 19.60 mA 90.00 mA 0.00 mA 85.00 mA 0.00 mA Tx Power -6.10 dBm -1.50 dBm -10.50 dBm -3.00 dBm -9.03 dBm Rx Power -6.94 dBm 0.99 dBm -30.00 dBm -1.00 dBm -26.98 dBm Transmit Fault Count = 0 ---------------------------------------------------------------------------- Note: ++ high-alarm; + high-warning; -- low-alarm; - low-warning [redacted]:/opt/librenms# /usr/bin/snmpget -v2c -c [redacted] .1.3.6.1.4.1.9.9.91.1.1.1.1.4.300028173 .1.3.6.1.4.1.9.9.91.1.1.1.1.4.300028174 iso.3.6.1.4.1.9.9.91.1.1.1.1.4.300028173 = INTEGER: -6968 iso.3.6.1.4.1.9.9.91.1.1.1.1.4.300028174 = INTEGER: -6090 [redacted]:/opt/librenms# tcpdump host [redacted] tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 11:54:01.211115 IP [redacted].36131 > [redacted].snmp: C="[redacted]" GetRequest(62) E:cisco.9.91.1.1.1.1.4.300028173 E:cisco.9.91.1.1.1.1.4.300028174 11:54:01.261027 IP [redacted].snmp > [redacted].36131: C="[redacted]" GetResponse(66) E:cisco.9.91.1.1.1.1.4.300028173=-6968 E:cisco.9.91.1.1.1.1.4.300028174=-6090 ^C 2 packets captured 2 packets received by filter 0 packets dropped by kernel ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

1 0

TestIT app to measure rural broadband access
by Courtney Smith 27 Mar '19

27 Mar '19

Saw this today in a press release from my county. https://www.naco.org/resources/press/naco-rural-lisc-and-rcap-launch-mobile… Washington, DC (February 26, 2019) – The National Association of Counties (NACo), the Rural Community Assistance Partnership (RCAP) and Rural LISC (Local Initiatives Support Corporation) have partnered to address the critical need for affordable high-speed internet for rural communities across the country. Together, the three organizations developed a mobile app that gives mobile phone users the power to accurately identify areas with low or no internet connectivity and share that information to push for change. Armed with that data, the organizations will advocate for adequate funding for broadband infrastructure across the country.

1 0

Contacts wanted: OVH, DigitalOcean, and Microsoft (Deutschland)
by Ronald F. Guilmette 27 Mar '19

27 Mar '19

OVH, DigitalOcean, and Microsoft... Is there anybody awake and conscious at any of these places? I mean anybody who someone such as myself... just part of the Great Unwashed Masses... could actually speak to about a real and ongoing problem? Maybe most of you here will think that this is just a trivial problem, and one that's not even worth mentioning on NANOG. So be it. Make up you own minds. Here is the problem... For some time now, there has been an ongoing campaign of bitcoin extortion spamming going on which originates primarily or perhaps exclusively from IPv4 addresses owned by OVH and DigitalOcean. These scam spams have now been publicised in multiple places: https://myonlinesecurity.co.uk/fake-cia-sextortion-scam/ Yea, that's just one place, I know, but there's also no shortage of people tweeting about this crap also, in multiple languages even! https://twitter.com/SpamAuditor/status/1107365604636278784 https://twitter.com/dvk01uk/status/1107510553621266433 https://twitter.com/bortzmeyer/status/1107737034049900544 https://twitter.com/ariestess69/status/1107468838596038656 https://twitter.com/bernhard_mahr/status/1107513313020297216 https://twitter.com/jzmurdock/status/1107679858945974272 https://twitter.com/gamamb/status/1107384186548207617 https://twitter.com/davidgsIoT/status/1107725201331097606 https://twitter.com/cybers_guards/status/1107675396076560384 https://twitter.com/ThatHostingCo/status/1107588660831105024 https://twitter.com/fladna9/status/1107554090765242368 https://twitter.com/JUSTADACHI/status/1107549777607184384 https://twitter.com/okhin/status/1107627379650908160 https://twitter.com/Purple_Wyrm/status/1107454618705887232 https://twitter.com/LadyOFyre/status/1107349022220550144 https://twitter.com/laurelvail/status/1107345980062523392 https://twitter.com/Alex__Rubio/status/1107595560440217600 The thing of it is that ALL of this crap... al of these scam spams... are quite obviously originating out of the networks of OVH and DigitalOcean. And it's not even all that hard to figure out where from, exactly and specifically. I generated the following survey, on the fly, last night, based on a simple reverse DNS scan of the evidently relevant addrdess ranges: https://pastebin.com/raw/WtM0Y5yC As anyone who isn't as blind as a bat can easily see, there's a bit of a pattern here. All of the spam source IPs are on just two ASNs: AS16276 - OVH SAS AS4061 - DigitalOcean, LLC It's equally clear that there have already been numerous reports about this ongoing and blatantly criminal activity that have been sent to the low-level high school dropout interns that these companies, like most others on the Internet these days, choose to employ as their first-level minions in their "not a profit center" abuse handling departments. So, guess what? Surprise, surprise! None of those clue-deprived flunkies have apparently yet managed to figure out that there's a pattern here. Duh!. As a result, the scamming and the spamming just go on and on and on, and the spammer-scammer just keeps on getting fresh new IP addresess on both of these networks... and fresh (and utterly free) new domain names from the equally careless company called Freenom. So, you know, I really would appreciate it if someone could either put me in touch with some actual sentient being at either OVH or DigitalOcean... assuming that any such actually exist... or at the very least, try to find one to whom clue may be passed about all this, because although these scam spams were kind of humorous and novel at first, the novelty has now worn off and they're really not all that funny anymore. Oh! And while we are on the subject, I'd also like to obtain a contact, preferbly one which is also and likewise in possession of something roughly approximating clue, at this place: AS200517 - Microsoft Deutschland MCIO GmbH The reason is that although MS Deutschland is most probably not the source of any of the spams, they, or at least their 51.18.39.107 address, do appear to be mixed up in all of this somehow: https://pastebin.com/raw/ziVNCmZ8 I dunno. Maybe Microsoft has managed to engineer a merger with the CIA (?) If not, then maybe they would be so kind as to rat out this specific criminal customer of their's to appropriate authorities. Don't get me wrong. I heartily applaud Microsoft's Digital Crimes Unit for all of the admirable work they do, but you know the old saying... charity begins at home. So my hope is that they will seek to get this low-life off their network immediately, if not sooner, and then also seek to arrange suitable long term accomodations for him in, say, Florence, Colorado, or, if he/she/it has a higher than average level of tan, I hope that they will make all necessary inquiries to find out if there are still any open bunks available in Gitmo. Regards, rfg P.S. In recent days, the popular media has fanned the flames of controversy, as it is their habit to do, over the question of whether or not the various social media companies could have somehow automagically spotted and deleted, in real time, with some sort of yet-to-be-invented artificial intelligence wizardry, the shooter videos from New Zealand. Of course, none of the TV personalities who so cavalierly offer up their totally uninformed opinions on this question have ever themselves gotten within a country mile of the kinds of AI that could, perhaps in another decade or three, reliably distinguish between a video of a msss shooting and a video of a particularly raucous birthday party. It's a hard problem. In contrast to that hard problem, spotting the kind of trivial reverse DNS pattern I've noted above is child's play and a no brainer. Why then, one might reasonbly ask, have the combined abuse departments of both OVH and DigitalOcean been either utterly unable or else utterly unwilling to do so? Solving these kinds of trivial problems does not await the development of some advanced new artificial intelligence. It just requires the judicious application of a small bit of the non-artificial kind of intelligence. But the industry, it seems, can't, or won't, even manage that.

9 11

criterio
by Randy Bush 27 Mar '19

27 Mar '19

a bit of research has led us to wonder about some (non-hostile or worrisome) net activity of criterio autonomous systems. do any friends of the family know these folk and could introduce me so i can try to learn a bit of ground truth? thanks. randy

3 2

Re: residential.smb internet access in 2019 - help?
by Kovich Greg 27 Mar '19

27 Mar '19

Good luck David. Even up here in the Chicagoland Comcast footprint, I had a horror story when I moved into my home in 2002 wrt ATT. Anyway, I’m not sure how far you are from Ocala, but they do offer residential internet via their municipal fiber. https://www.ocalafl.org/government/city-departments/telecommunications/resi… $60/month for 300 Mbps… ------- Greg Kovich Director, Global Education Sales Alcatel-Lucent Enterprise ALE USA 3015 Abby Lane | Suite 301-B Schererville, IN 46375 t: +1-818-878-4667<tel:+1-818-878-4667> m: +1-219-276-2320<tel:+1-219-276-2320> e: Greg.Kovich(a)al-enterprise.com<mailto:greg.kovich@al-enterprise.com> w: www.al-enterprise.com<https://www.al-enterprise.com/en> @ALUEnterprise [LinkedIn]<https://www.linkedin.com/company/alcatellucententerprise> [Twitter] <https://twitter.com/aluenterprise> [YouTube] <https://www.youtube.com/user/EnterpriseALU> [Facebook] <https://www.facebook.com/ALUEnterprise> [Rainbow] <https://web.openrainbow.com/app/1.31.7/index.html#/login> [https://www.al-enterprise.com/en/-/media/assets/internet/images/logo.png]<https://www.al-enterprise.com/en> The Alcatel-Lucent name and logo are trademarks of Nokia used under license by ALE. This communication is intended to be received only by the individual or entity to whom or to which it is addressed and may contain information that is privileged/confidential or subject to copyright. Any unauthorized use, copying, review or disclosure of this communication is strictly prohibited. If you have received this communication in error, please delete this message from your e-mail box and information system (including all files and documents attached) and notify the sender by reply email. On Mar 27, 2019, at 7:00 AM, nanog-request(a)nanog.org<mailto:nanog-request@nanog.org> wrote: Message: 7 Date: Wed, 27 Mar 2019 01:30:34 -0400 From: Ross Tajvar <ross(a)tajvar.io<mailto:ross@tajvar.io>> To: Mike Bolitho <mikebolitho(a)gmail.com<mailto:mikebolitho@gmail.com>> Cc: david raistrick <drais(a)icantclick.org<mailto:drais@icantclick.org>>, "North American Network Operators' Group" <nanog(a)nanog.org<mailto:nanog@nanog.org>> Subject: Re: residential/smb internet access in 2019 - help? Message-ID: <CA+FDdDR-8teoFrGCuWGzN4WWdJv8ZgjsuKUFAMJ8Qo2m7C+wqw(a)mail.gmail.com<mailto:CA+FDdDR-8teoFrGCuWGzN4WWdJv8ZgjsuKUFAMJ8Qo2m7C+wqw@mail.gmail.com>> Content-Type: text/plain; charset="utf-8" On Wed, Mar 27, 2019, 12:30 AM Mike Bolitho <mikebolitho(a)gmail.com<mailto:mikebolitho@gmail.com>> wrote: Agreed....this is why monopolies are bad and municipal fiber is good. It's not like municipal fiber has some magic spell to make last mile affordable though. On OP's instance he would run into the same issue and would be paying that five figure amount to bring FTTP. Municipal fiber is only good if you happen to live where a municipality has already buried conduit. I'm not saying we should support monopolistic practices, but "municipal fiber everywhere!" isn't necessarily the answer either. That's fair. What I really meant, and didn't take the time to think through and express properly, was this: financing a large fiber buildout like it's a long-term investment, rather than something that should make back its capital cost in 1-3 years, gets fiber to more people. Most commercial ISPs do not want to do this because they want immediate profit. Municipalities are used to making long-term infrastructure investments (like bridges, etc.) and are more amenable to doing it with fiber. Even if there were a municipality which had done a fiber buildout near OP's desired house, he may have still run into the same issue of no fiber being close enough to be financially viable. But the more fiber plant there is, the less likely that scenario becomes.

1 0

A variety of opportunities to sponsor NANOG 76 and beyond!
by NANOG Support 27 Mar '19

27 Mar '19

Our 76th community-wide gathering is June 9-12 in Washington, DC. As one of the largest communities of network engineers, architects, and operators in North America, a NANOG sponsorship provides the greatest level of exposure to our industry’s innovators — all in one place. >From espresso/breakfast/lunch/breaks and evening socials, to a presence at our coveted Beer ‘N Gear event, sponsorships start at just $3,000, and provide a variety of opportunities for you to connect and engage with our community. View premium partnerships <https://nanog.org/sites/default/files/sites/default/files/NANOG-premium-par…> View individual meeting sponsorships <https://nanog.org/sites/default/files/sites/default/files/NANOG-indvidual-s…> Have questions? Contact Shawn Winstead, Business Development Specialist: swinstead(a)nanog.org +1.866.902.1336 ext. 108

1 0

AS112 contact
by Elmar K. Bins 26 Mar '19

26 Mar '19

Hi guys, I hope this is only slightly off-topic... I'm looking for the correct address for AS112, 112(a)root-servers.org keeps bouncing whatever I try. If anybody can drop me a line...much appreciated. Cheers, Elmar.

3 2

Comcast XB6 Blocking TFTP
by Mike Hammett 25 Mar '19

25 Mar '19

Have any of you seen the Comcast XB6 modem blocking TFTP and some SIP requests? We put the modem into bridge mode and TFTP requests are successful. Reset it, set security to the lowest setting, disable the firewall... no TFTP requests pass. Modem\Router - cable - laptop. Of course we can't call into support because the customer is out of town and thus we're unable to authenticate ourselves to support (not that we tried). ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

2 1

Bay Area: Help test Earthquake Early Warning System
by Sean Donelan 25 Mar '19

25 Mar '19

This is being covered on local San Francisco Bay Area media, but if network engineers aren't paying attention to the local news. Here is an opportunity for tech folks in the Oakland area to participate in the Earthquake Early Warning Test. TEST INFORMATION Date: Wednesday, March 27th, 2019 Time: 11:00AM Message: “TEST of the CA Earthquake Warning System. No action required. THIS IS A TEST.” Location: Downtown Oakland (Lakeside commercial neighborhood) with bleedover into adjacent areas depending on cell tower RF propagation. Part of this year's test is measuring how quickly earthquake warning alerts are propagated through different emergency alert channels. The future goal is transmitting earthquake alerts in less than 3 seconds. That is unlikely with current systems. Instead the test will help measure current alert system propagation delays. If you have access to accurate clocks, and a cell phone, and are in the Oakland area on Wednesday. https://www.caloes.ca.gov/cal-oes-divisions/earthquake-tsunami-volcano-prog… Please participate in a citizen science test to see how fast these alerts can be transmitted to cell phones. For this test to be effective, you need to take the following steps: 1) Before the test starts, using either your cell phone or your desktop computer go to www.time.is. 2) Starting a few minutes in advance of the scheduled alert time (11:00AM Pacific), keep a close watch on your cell phone and www.time.is note the exact time--to the nearest second, if you can--at which the alert first arrives on your phone. This alert will have the heading "Emergency Alert", and this message: “TEST of the CA Earthquake Warning System. No action required. THIS IS A TEST.” 3) Please take this survey, armed with the time (to the second) you received the alert. https://www.surveymonkey.com/r/WEATESTSHAKEALERT Yeah, I know. Some folks on this list likely have nano-second synchronized clocks and will debate whether the propagation delay is taking into account the correct einstein relativity offset of the earth's surface in the oakland bay area (I just made that techno-babble up). Just do the reasonable thing, and help out the scientists :-)

1 0

Incoming SSDP UDP 1900 filtering
by marcel.duregards＠yahoo.fr 25 Mar '19

25 Mar '19

Dear Community, We see more and more SSDP 'scan' in our network (coming from outside into our AS). Of course our client have open vulnerables boxes (last one is an enterprise class Synology with all defaults ports open:-)) which could be used as a reflection SSDP client. As SSDP is used with PnP for local LAN service discovery, we are thinking of: 1) educate our client (take a lot of time) 2) filter incoming SSDP packets (UDP port 1900 at least) in our bgp border We see option 2 as a good action to remove our autonomous systeme from potential sources of DDOS SSDP source toward the Internet. Of course this might (very few chance) open others problems with clients which use this port as an obfuscation port, but anyhow it would not be a good idea as it is a registered IANA port. We could think of filtering also incoming port 5000 (UPnP), but it is the default port that Synology decide to use (WHY???? so many trojan use this) for the DSM login into the UI. What do you think ? Thank, best regards, -- Marcel

10 14