March 2019 - Test - lists.nanog.org

Help on setting up a new block
by John Alcock 20 Mar '19

20 Mar '19

Odd Issues We recently went through an IP Broker and bought a /18 worth of IP's I am listing all my information below. Should be public record. AS Number/Range 395437 AS Handle AS395437 AS Name HIGHLANDTEL RPKI Certified Yes As for the IP Block Net Range 138.43.128.0 - 138.43.191.255 CIDR 138.43.128.0/18 Net Name HCL-73 Net Handle NET-138-43-128-0-1 Net Type Direct Allocation Parent NET-138-0-0-0-0 (VR-ARIN) RPKI Certified Yes In addition, I believe I got all the information in the IRR. I am unclear on this part, but I do know ATT is happy now. I can pass traffic through their network. whois -h whois.bgpmon.net " --roa 395437 138.43.128.0/24" 0 - Valid ------------------------ ROA Details ------------------------ Origin ASN: AS395437 Not valid Before: 2019-02-13 05:00:00 Not valid After: 2029-02-01 05:00:00 Expires in 9y318d10h46m2.39999997615814s Trust Anchor: rpki.arin.net Prefixes: 138.43.128.0/18 (max length /24) So here is my problem. There are certain sites I can not get to on the new ip block. clover.com - They are a large POS vendor catering to small business idrive.com - Online backup heart.org - american heart association onlineproviderservices.com - Looks like an outsourced group that handles medicare landstar.com - trucking company I am working on trying to contact the companies above, but I have started resorting to public shaming on social media. Not an ideal solution. My thought, could I be missing something? Perhaps I need to add a specfic entry in the IRR or anything? Just seems like a lot of sites will not accept my traffic. Any experts like to chime in? John

10 12

Facebook dropping MSS on congestion
by Denys Fedoryshchenko 20 Mar '19

20 Mar '19

Good day, I am writing here, as in technical support ticket I will most likely end up to the outsourcing guys, who will try to write some formal reply and close the ticket quickly to keep KPI high:) I have a faint hope that someone will read and listen. It may also be useful to colleagues. I noticed at last few month, if some congestion occurs on the network (specific subnet), facebook reduces the maximum segment size (MSS), even down to 256 bytes. Purely academically, on paper - this will reduce latency. In reality - it will cause avalanche effect. If ISP have CGNAT, or some other appliances - with great probability they will encounter the fact that pps will increase 4-5 times, and might hit pps limit on hardware. Additionally, overhead on IP headers will increase significantly, especially on ipv6, and this will further aggravate the congestion. Facebook don't do that, please. And thank you, if you listen to suggestions. Denys

1 0

Contacts wanted: OVH, DigitalOcean, and Microsoft (Deutschland)
by Ronald F. Guilmette 20 Mar '19

20 Mar '19

Nikolas Geyer <nik at neko.id.au> wrote: >I have passed your email on to the relevant team within DO to have a look at. Thank you, but that wasn't what I requested, I asked for a contact there. (I know that this may be hard to understand, but it's like the difference between giving a man a fish, and teaching him how to fish. I'm sure that you would make a fine long term conduit between me and whatever mystery people you think you have made contact with at DigitalOcean, but really, it would be best if you would simply introduce me to those people directly. That way, if you die or go on vacation, incidents like these won't need to be put on hold until you get back and resume your role as our designated go-between.) >I'd like to thank you for your deriding commentary to bring attention >to this problem. No problem. My pleasure. >I am not sure it is the most effective way to try and engage the wider >industry on a public list, but each to their own. I am not sure that there is any other way that a lone outsider can or could engage either OVH or DigitalOcean in a way that would actually cause either company to take action on the issues I've reported on. Complaints from ordinary Internet end-lusers about this, which both companies must surely be drowing in by now, don't seem to be doing the job. In any case, I would be more than happy to have you tell me the "right way" to engage with any actual live human beings at either of these companies, especially if you also are able to identify one or more such receptive individuals by name and email address, which is what I was requesting in the first place. >Oh, and additionally, as an Australian citizen with many Aussie and >Kiwi colleagues working at DO of various religious persuasions; your >postscript relating this back to the recent terror attacks is abhorrent >and disgusting. You should be completely ashamed. It's pretty clear to me that you have rather dramatically misread my the aforementioned postscript to my earlier post, and that a fair and clear-eyed reading of that should be quite entirely inoffensive to all, with the possible exception of some few people who work in mass media and/or the "news" business, such as it currently is. In that postscript, I merely used a recent mass media controversy relating specifically and only to the social media -handling- of recent events to illustrate two blatant absurdities at opposite ends of a spectrum, neither of which itself has anything at all do do with those recent news events specifically, much less with the race, creed, color or gender of any of the people who have, most sadly and regretably, been caught up in those events. Please consider again the two polar opposite absurdities that I was actually attempting to call attention to. One the one hand, we have TV talking heads, with essentially no technical knowledge whatsoever, wondering aloud why social media tech companies cannot do what is clearly technically impossible, and even more absurdly, why they can't do it in real time no less. On the other hand, and in contrast to that absurdity, we have the present example of this spamming operation that appears to be well and truly ensconsed on the networks of both OVH and DigitalOcean, where even large multi-billion dollar Internet hosting companies seem utterly unable to spot even trivial and easily identifiable patterns of bad behavior, in and among their own respective customer bases, even though, as I have now illustrated, a single lone unpaid volunteer guy, sitting in his basement and in his sweaty underwear and a bathrobe -can- easily and quickly spot the problem, within just a couple of hours in fact, provided that he has access to a decent quality passive DNS service and an ample supply of electricity, margaritas and cigarettes. I'm only kidding, of course. I don't actually have a basement. Regards, rfg P.S. Your apparent misreading of my earlier postscript is entirely understandable and forgiveable in light of the rather unfortunate quip that I made just prior to that, about sending this specific miscreant to Guantanamo if his skin color was sufficiently dark. I seriously regret and apologize for that inartful phrasing, and ask every charitable person to believe me when I say that that was said entirely in jest (albeit a bad one), and that if anything, it was intended to be an expression of my own personal outrage about my own country's abundant inequity and unfairness when dealing with people of color, either within our so-called justice system or elsewhere. Our justice system should be color blind. Alas, there is much evidence that it falls far short of this goal at the present time.

8 10

Webzilla
by Ronald F. Guilmette 18 Mar '19

18 Mar '19

[[ My apologies to thos eof you who may see this twice. I have posted the message below also to the RIPE Anti-Abuse Working Group mailing list, so any of you who are on that list also will see this twice. But I believe that it is relevant here also. ]] ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Perhaps some folks here might be interested to read these two reports, the first of which is a fresh news report published just a couple of days ago, and the other one is a far more detailed investigative report that was completed some time ago now. https://www.buzzfeednews.com/article/kenbensinger/dossier-gubarev-russian-h… https://www.documentcloud.org/documents/5770258-Fti.html Please share these links widely. The detailed technical report makes it quite abundantly clear that Webzilla, and all of its various tentacles... many of which even I didn't know about until seeing this report... most probably qualifies as, and has qualified as a "bullet proof hosting" operation for some considerable time now. As the report notes, the company has received over 400,000 complaints or reports of bad behavior, and it is not clear to me, from reading the report, if anyone at the company even bothered to read any more than a small handful of those. I have two comments about this. First, I am inclined to wonder aloud why anyone is even still peering with any of the several ASNs mentioned in the report. To me, the mere fact that any of these ASNs still have connectivity represents a clear and self-evident failure of "self policing" in and among the networks that comprise the Internet. Second, its has already been a well know fact, both to me and to many others, for some years now, that Webzilla is by no means alone in the category commonly refered to as "bullet proof hosters". This fact itself raises some obvious questions. It is clear and apparent, not only from the report linked to above, but from the continuous and years-long existance of -many- "bullet proof hosters" on the Internet that there is no shortage of a market for the services of such hosting companies. The demand for "bullet proof" services is clearly there, and it is not likely to go away any time soon. In addition to the criminal element, there are also various mischevious governments, or their agents, that will always be more than happy to pay premium prices for no-questions-asked connectivity. So the question naturally arises: Other than de-peering by other networks, are there any other steps that can be taken to disincentivize networks from participating in this "bullet proof" market and/or to incentivize them to give a damn about their received network abuse complaints? I have no answers for this question myself, but I felt that it was about time that someone at least posed the question. The industry generally, and especially in the RIPE region, has a clear and evident problem that traditional "self policing" is not solving. Worse yet, it is not even discussed much, and that is allowing it to fester and worsen, over time. It would be Good if there was some actual leadership on this issue, at least from -some- quarter. So far I have not noticed any such worth mentioning. And even looking out towards the future horizon, I don't see any arriving any time soon. Regards, rfg

5 5

NANOG 76 call for presentations is open
by Benson Schliesser 18 Mar '19

18 Mar '19

NANOG Community, The NANOG Program Committee (PC) is excited to announce that we are now accepting proposals for all sessions at NANOG 76 in Washington, DC, June 10-12, 2019. Below is a summary of key details and dates from the Call For Presentations on the NANOG website, which can be found at http://www.cvent.com/d/s6qzk4/6K Given by many of the industry’s top minds, presentations at NANOG meetings are meant to spark the imagination, encourage dialog, and drive new solutions to our greatest networking challenges. The PC is currently seeking proposals, and also welcomes suggestions for speakers and topics. Presentations may cover current technologies, soon-to-be deployed technologies, and industry innovation. Vendors are welcome to submit talks which cover relevant technologies and capabilities, but presentations should not be promotional, or discuss proprietary solutions. The primary speaker, moderator, or author should submit a presentation proposal and abstract via the PC Tool at: https://pc.nanog.org - Select “Propose Talk” from the “Talks” menu - Select NANOG 76 from the Meeting menu - Select the appropriate *Session* the talk will be presented in - General Session (30-45 minutes) - Tutorial (90-120 minutes) - Track (90-120 minutes) Timeline for submission and proposal review: - Submitter enters abstract (and draft slides if possible) in PC Tool prior to the deadline for slide submission. - PC performs initial review and assigns a “shepherd” to help develop the submission — within 2 weeks. - Submitter develops draft slides of talk if not already submitted with the initial proposal. Please submit initial draft slides early — the PC typically does not accept submissions until draft slides are available for review. NANOG Staff is available to assist with slide templates upon request from the submitter. - Panel and Track submissions should provide a topic list and intended/confirmed participants in the abstract. - PC reviews the slides and continues to work with Submitter as needed to develop the topic. - Draft presentation slides should be submitted prior to the published deadline for slides (May 06, 2019). - PC accepts or declines the submission. - Agenda assembled and posted. - Submitters notified. - Final presentation slides must be submitted prior to the published deadline for slides (Jun. 03, 2019). If you think you have an interesting topic but want feedback or suggestions for developing an idea into a presentation, please email the PC ( nanogpc(a)nanog.org) and a representative will respond to you in a timely manner. Otherwise, submit your talk, keynote, track, or panel proposal to the PC Tool at your earliest convenience. We look forward to reviewing your submission! Key dates for NANOG 76: Date Event/Deadline Mar. 18, 2019 CFP Opens & Agenda Outline Posted, Early Registration Begins Apr. 15, 2019 Standard Registration Begins May 06, 2019 CFP Deadline: Presentation Slides Due May 13, 2019 CFP Topic List & NANOG Meeting HIghlights Page posted May 28, 2019 NANOG 76 Agenda Posted, Late Registration Begins Jun. 03, 2019 Speaker FINAL presentations DUE (NO CHANGES accepted after this date) Jun. 09, 2019 Lightning Talk Submissions Open, Onsite Registration Begins Final slides must be submitted by Monday, June 3, 2019, and no changes will be accepted between that date and the conference. Materials received after that date may be updated on the website after the completion of the conference. We look forward to seeing you in June in Washington, DC! Sincerely, Benson Schliesser On behalf of the NANOG PC

1 0

Yahoo/Oath GeoDNS Issue (AS36647)
by John Von Essen 17 Mar '19

17 Mar '19

If anyone from Yahoo/Oath is here, please email me off-list. Have a GeoDNS issue with yahoo API URLs in Australia, DNS results are returning IPs that are not ideal for the region (like on the other side of the world), it so bad (excess latency), we have to override them locally which I really rather not have to do. This is related to operations of a major/global search engine platform. In Australia, these Yahoo URLs should be resolving to Singapore, but instead are resolving to central USA. The issue started a few weeks back, prior to that DNS resolution was working to Singapore. Thanks John

2 1

OT: friday fun - geko outsge
by Scott Weeks 16 Mar '19

16 Mar '19

I thought some here might enjoy this. ------------------------------------------ Technician arrived onsite and found no issue with the fiber connection back to the CO. Tech then attempted to reseat the SM-A card and found a gecko in the card slot. Technician removed the gecko and verified that equipment was back in service after slotting back the card. ------------------------------------------ Troubleshooting in the tropics... :-) scott

3 2

Proposed National Emergency Communications Plan Updates
by Sean Donelan 16 Mar '19

16 Mar '19

2019 Update to the NECP https://www.dhs.gov/cisa/national-emergency-communications-plan CISA is seeking feedback on proposed updates to the NECP — the Nation’s strategic plan to improve emergency communications. Informed by last year’s SAFECOM Nationwide Survey, the NECP provides guidance to those that plan for, coordinate, invest in, and use communications to support response and recovery operations. This includes traditional emergency responder disciplines (e.g., law enforcement, fire, emergency medical services, dispatch) and other entities that share information during emergencies, such as medical facilities, utilities, nongovernmental organizations, as well as the media and private citizens. To prepare stakeholders for a rapidly evolving emergency communications landscape, CISA is leading a national effort to update the NECP (last published in 2014). Proposed updates reflect the expanding ecosystem of people, technologies, and functions involved in supporting emergency communications to aid public safety entities with addressing today's challenges while also planning for future advancements. To provide comments on the updated NECP, complete the feedback form on the DHS website and submit it to OECNECP(a)hq.dhs.gov by March 22, 2019.

1 0

sending again in case Zoom didn't email it correctly
by Casey Russell 15 Mar '19

15 Mar '19

SIP failover call. Casey Russell is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://kanren.zoom.us/j/7858569809 <https://www.google.com/url?q=https%3A%2F%2Fkanren.zoom.us%2Fj%2F7858569809&…> One tap mobile +16699006833,,7858569809# US (San Jose) +16465588656,,7858569809# US (New York) Dial by your location +1 669 900 6833 US (San Jose) +1 646 558 8656 US (New York) Meeting ID: 785 856 9809 Find your local number: https://zoom.us/u/adjAi5zj6Y <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FadjAi5zj6Y&sa=D&us…> Sincerely, Casey Russell Network Engineer [image: KanREN] <http://www.kanren.net> [image: phone]785-856-9809 2029 Becker Drive, Suite 282 Lawrence, Kansas 66047 [image: linkedin] <https://www.linkedin.com/company/92399?trk=tyah&trkInfo=clickedVertical%3Ac…> [image: twitter] <https://twitter.com/TheKanREN> [image: twitter] <http://www.kanren.net/feed/> need support? <support(a)kanren.net>

5 6

Re: Analysing traffic in context of rejecting RPKI invalids using pmacct
by Sriram, Kotikalapudi (Fed) 15 Mar '19

15 Mar '19

Jay: >When we (as7018) were preparing to begin dropping invalid routes >received from peers earlier this year, that is exactly the kind of >analysis we did. In our case we rolled our own with a two-pass >process: we first found all the traffic to/from invalid routes by a >bgp community we gave them, then outside of our flow analysis tool we >further filtered the traffic for invalid routes which were covered by >less-specific not-invalid routes. What remained was the traffic we >would lose once invalid routes were dropped. Had the pmacct >capability existed at that time, we would have used it. We (NIST) did a detailed analysis of Invalid routes (with Routeviews data) that was presented at IETF 101: https://datatracker.ietf.org/meeting/101/materials/slides-101-sidrops-origi… See slides 10-13. We tried to drill down on Invalid routes which were covered by less-specific not-invalid routes. We examined questions like: how often does the less-specific route have the same origin AS (OAS) as the Invalid, and, if not, then how frequently is the OAS of the less specific route a transit provider of the OAS of the Invalid route? We plan to update the results periodically. Sriram

3 3