March 2019 - Test - lists.nanog.org

criterio
by Randy Bush 27 Mar '19

27 Mar '19

a bit of research has led us to wonder about some (non-hostile or worrisome) net activity of criterio autonomous systems. do any friends of the family know these folk and could introduce me so i can try to learn a bit of ground truth? thanks. randy

3 2

Re: residential.smb internet access in 2019 - help?
by Kovich Greg 27 Mar '19

27 Mar '19

Good luck David. Even up here in the Chicagoland Comcast footprint, I had a horror story when I moved into my home in 2002 wrt ATT. Anyway, I’m not sure how far you are from Ocala, but they do offer residential internet via their municipal fiber. https://www.ocalafl.org/government/city-departments/telecommunications/resi… $60/month for 300 Mbps… ------- Greg Kovich Director, Global Education Sales Alcatel-Lucent Enterprise ALE USA 3015 Abby Lane | Suite 301-B Schererville, IN 46375 t: +1-818-878-4667<tel:+1-818-878-4667> m: +1-219-276-2320<tel:+1-219-276-2320> e: Greg.Kovich(a)al-enterprise.com<mailto:greg.kovich@al-enterprise.com> w: www.al-enterprise.com<https://www.al-enterprise.com/en> @ALUEnterprise [LinkedIn]<https://www.linkedin.com/company/alcatellucententerprise> [Twitter] <https://twitter.com/aluenterprise> [YouTube] <https://www.youtube.com/user/EnterpriseALU> [Facebook] <https://www.facebook.com/ALUEnterprise> [Rainbow] <https://web.openrainbow.com/app/1.31.7/index.html#/login> [https://www.al-enterprise.com/en/-/media/assets/internet/images/logo.png]<https://www.al-enterprise.com/en> The Alcatel-Lucent name and logo are trademarks of Nokia used under license by ALE. This communication is intended to be received only by the individual or entity to whom or to which it is addressed and may contain information that is privileged/confidential or subject to copyright. Any unauthorized use, copying, review or disclosure of this communication is strictly prohibited. If you have received this communication in error, please delete this message from your e-mail box and information system (including all files and documents attached) and notify the sender by reply email. On Mar 27, 2019, at 7:00 AM, nanog-request(a)nanog.org<mailto:nanog-request@nanog.org> wrote: Message: 7 Date: Wed, 27 Mar 2019 01:30:34 -0400 From: Ross Tajvar <ross(a)tajvar.io<mailto:ross@tajvar.io>> To: Mike Bolitho <mikebolitho(a)gmail.com<mailto:mikebolitho@gmail.com>> Cc: david raistrick <drais(a)icantclick.org<mailto:drais@icantclick.org>>, "North American Network Operators' Group" <nanog(a)nanog.org<mailto:nanog@nanog.org>> Subject: Re: residential/smb internet access in 2019 - help? Message-ID: <CA+FDdDR-8teoFrGCuWGzN4WWdJv8ZgjsuKUFAMJ8Qo2m7C+wqw(a)mail.gmail.com<mailto:CA+FDdDR-8teoFrGCuWGzN4WWdJv8ZgjsuKUFAMJ8Qo2m7C+wqw@mail.gmail.com>> Content-Type: text/plain; charset="utf-8" On Wed, Mar 27, 2019, 12:30 AM Mike Bolitho <mikebolitho(a)gmail.com<mailto:mikebolitho@gmail.com>> wrote: Agreed....this is why monopolies are bad and municipal fiber is good. It's not like municipal fiber has some magic spell to make last mile affordable though. On OP's instance he would run into the same issue and would be paying that five figure amount to bring FTTP. Municipal fiber is only good if you happen to live where a municipality has already buried conduit. I'm not saying we should support monopolistic practices, but "municipal fiber everywhere!" isn't necessarily the answer either. That's fair. What I really meant, and didn't take the time to think through and express properly, was this: financing a large fiber buildout like it's a long-term investment, rather than something that should make back its capital cost in 1-3 years, gets fiber to more people. Most commercial ISPs do not want to do this because they want immediate profit. Municipalities are used to making long-term infrastructure investments (like bridges, etc.) and are more amenable to doing it with fiber. Even if there were a municipality which had done a fiber buildout near OP's desired house, he may have still run into the same issue of no fiber being close enough to be financially viable. But the more fiber plant there is, the less likely that scenario becomes.

1 0

A variety of opportunities to sponsor NANOG 76 and beyond!
by NANOG Support 27 Mar '19

27 Mar '19

Our 76th community-wide gathering is June 9-12 in Washington, DC. As one of the largest communities of network engineers, architects, and operators in North America, a NANOG sponsorship provides the greatest level of exposure to our industry’s innovators — all in one place. >From espresso/breakfast/lunch/breaks and evening socials, to a presence at our coveted Beer ‘N Gear event, sponsorships start at just $3,000, and provide a variety of opportunities for you to connect and engage with our community. View premium partnerships <https://nanog.org/sites/default/files/sites/default/files/NANOG-premium-par…> View individual meeting sponsorships <https://nanog.org/sites/default/files/sites/default/files/NANOG-indvidual-s…> Have questions? Contact Shawn Winstead, Business Development Specialist: swinstead(a)nanog.org +1.866.902.1336 ext. 108

1 0

AS112 contact
by Elmar K. Bins 26 Mar '19

26 Mar '19

Hi guys, I hope this is only slightly off-topic... I'm looking for the correct address for AS112, 112(a)root-servers.org keeps bouncing whatever I try. If anybody can drop me a line...much appreciated. Cheers, Elmar.

3 2

Comcast XB6 Blocking TFTP
by Mike Hammett 25 Mar '19

25 Mar '19

Have any of you seen the Comcast XB6 modem blocking TFTP and some SIP requests? We put the modem into bridge mode and TFTP requests are successful. Reset it, set security to the lowest setting, disable the firewall... no TFTP requests pass. Modem\Router - cable - laptop. Of course we can't call into support because the customer is out of town and thus we're unable to authenticate ourselves to support (not that we tried). ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

2 1

Bay Area: Help test Earthquake Early Warning System
by Sean Donelan 25 Mar '19

25 Mar '19

This is being covered on local San Francisco Bay Area media, but if network engineers aren't paying attention to the local news. Here is an opportunity for tech folks in the Oakland area to participate in the Earthquake Early Warning Test. TEST INFORMATION Date: Wednesday, March 27th, 2019 Time: 11:00AM Message: “TEST of the CA Earthquake Warning System. No action required. THIS IS A TEST.” Location: Downtown Oakland (Lakeside commercial neighborhood) with bleedover into adjacent areas depending on cell tower RF propagation. Part of this year's test is measuring how quickly earthquake warning alerts are propagated through different emergency alert channels. The future goal is transmitting earthquake alerts in less than 3 seconds. That is unlikely with current systems. Instead the test will help measure current alert system propagation delays. If you have access to accurate clocks, and a cell phone, and are in the Oakland area on Wednesday. https://www.caloes.ca.gov/cal-oes-divisions/earthquake-tsunami-volcano-prog… Please participate in a citizen science test to see how fast these alerts can be transmitted to cell phones. For this test to be effective, you need to take the following steps: 1) Before the test starts, using either your cell phone or your desktop computer go to www.time.is. 2) Starting a few minutes in advance of the scheduled alert time (11:00AM Pacific), keep a close watch on your cell phone and www.time.is note the exact time--to the nearest second, if you can--at which the alert first arrives on your phone. This alert will have the heading "Emergency Alert", and this message: “TEST of the CA Earthquake Warning System. No action required. THIS IS A TEST.” 3) Please take this survey, armed with the time (to the second) you received the alert. https://www.surveymonkey.com/r/WEATESTSHAKEALERT Yeah, I know. Some folks on this list likely have nano-second synchronized clocks and will debate whether the propagation delay is taking into account the correct einstein relativity offset of the earth's surface in the oakland bay area (I just made that techno-babble up). Just do the reasonable thing, and help out the scientists :-)

1 0

Incoming SSDP UDP 1900 filtering
by marcel.duregards＠yahoo.fr 25 Mar '19

25 Mar '19

Dear Community, We see more and more SSDP 'scan' in our network (coming from outside into our AS). Of course our client have open vulnerables boxes (last one is an enterprise class Synology with all defaults ports open:-)) which could be used as a reflection SSDP client. As SSDP is used with PnP for local LAN service discovery, we are thinking of: 1) educate our client (take a lot of time) 2) filter incoming SSDP packets (UDP port 1900 at least) in our bgp border We see option 2 as a good action to remove our autonomous systeme from potential sources of DDOS SSDP source toward the Internet. Of course this might (very few chance) open others problems with clients which use this port as an obfuscation port, but anyhow it would not be a good idea as it is a registered IANA port. We could think of filtering also incoming port 5000 (UPnP), but it is the default port that Synology decide to use (WHY???? so many trojan use this) for the DSM login into the UI. What do you think ? Thank, best regards, -- Marcel

10 14

webauthn
by Michael Thomas 25 Mar '19

25 Mar '19

I know it's a little tangential, but it's a huge operational issue for network operations too. Have any NANOG folks been paying attention to webauthn? i didn't know about until yesterday, though i wrote a proof of concept of something that looks a lot like webauthn in 2012. The thing that is kind of concerning to me is that there seems to be some amount of misconception (I hope!) that you need hardware or biometric or some non-password based authentication on the user device in the many write ups i've been reading. i sure hope that misconception doesn't take hold because there is nothing wrong with *local* password based authentication to unlock your credentials. i fear that if the misconception takes hold, it will cause the entire effort to tank. the issue with passwords is transmitting them over the wire, first and foremost. strong *local* passwords that unlock functionality is still perfectly fine for many many applications, IMO. Which isn't to say that hardware/biometric is bad, it's just to say that they are separable problems with their own set of tradeoffs. NANOG folks sound like prime examples of who should be using 2 factor, etc. But we don't want to discourage, oh say, Epicurious to implement webauthn to get to my super-secret recipe box because they don't think people will buy id dongles. Mike

4 4

QFX5k question
by Mehmet Akcin 24 Mar '19

24 Mar '19

Hey there, I am trying to get my hands on some QFX5000s and I have a rather quick question. In the past, I often used MX + EX where MX did routing and I connected all uplinks/peering and EX, and EX did switching, i connected my servers to ex. in QFX, I am trying to see if I need EX or not? more importantly (besides from what juniper papers say) are there any known issues people run into for a small scale deployment. (100mbps-1gbps range 1 rack, 20 servers) my plan is to have QFX to it all, but i am worried, if this is too much for QFX, if you have relative experience on this , feel free to let me know thanks in advance mehmet

9 9

contact for idrive.com
by Michael Crapse 23 Mar '19

23 Mar '19

Trying to find a NOC contact for idrive.com . Whois of the URL doesn't show any owner, whois of the IP for the site(not service) just shows centurylink Customers from a major subnet of ours cannot utilise the service.

1 0