May 2019 - Test - lists.nanog.org

Any current comments on PacketViper?
by Allen McKinley Kitchen (gmail) 17 May '19

17 May '19

Users? Detractors? Off-list responses preferred. Will summarize if there’s an indication of interest. ..Allen Allen.McKinley.Kitchen(a)gmail.com Butler, PA

1 0

Re: BGP prefix filter list
by Jared Brown 17 May '19

17 May '19

There are a few approaches to culling the routing table. You can do it either statically or dynamically, according to your needs. 1. Filtering based on upstream communities Slimming down the Internet routing table https://www.redpill-linpro.com/sysadvent/2016/12/09/slimming-routing-table.… 2. Filtering based on region BGP filter for North American routes http://gregsowell.com/?p=5505 Substitute prefixes for applicable region(s). Each region is about 200k prefixes. For more granularity use a geolocation service to select prefixes and/or ASNs. 3. Using flow information to install only top routes SDN Internet Router – Part 2 https://labs.spotify.com/2016/01/27/sdn-internet-router-part-2/ https://blog.ipspace.net/2015/01/sdn-router-spotify-on-software-gone-wild.h… 4. Aggregate the routing table According to the weekly routing table report you can aggregate announcements to about half the number of prefixes. You need to roll your own software to preprocess the BGP feed. There are some tools out there, but I couldn't find a blog post about it with a quick search. If you have one, please share! Jared On 05/15/19 13:43 +0200, Baldur Norddahl wrote: >Hello > >This morning we apparently had a problem with our routers not handling >the full table. So I am looking into culling the least useful prefixes >from our tables. I can hardly be the first one to take on that kind of >project, and I am wondering if there is a ready made prefix list or >similar? > >Or maybe we have a list of worst offenders? I am looking for ASN that >announces a lot of unnecessary /24 prefixes and which happens to be >far away from us? I would filter those to something like /20 and then >just have a default route to catch all. > >Thanks, > >Baldur >

2 1

Comcast Contact
by matt＠mattfreitag.com 16 May '19

16 May '19

Hi all, I'm looking for a contact at Comcast, been having an issue in the Baltimore area for about three weeks and am getting stonewalled by front line support. Thank you for your time. Matt Freitag

2 1

Re: [proj-bgp] adding graphs for actually unreachable RPKI INVALID prefixes to RPKI Monitor?
by Montgomery, Douglas (Fed) 16 May '19

16 May '19

Our effort to get our new monitor transitioned to a public facing system ran into a wall for ~35 days. Unfortunately during that time, the visa of a visiting researcher leading that effort expired. We have almost recovered from all of that. Unfortunately, we have a bit of a bureaucracy to deploying public facing systems. So I would guess it will take ~end of March to get it on-line. Thanks DougM -- Doug Montgomery, Manager Internet & Scalable Systems Research @ NIST Date: Thu, 14 Feb 2019 21:39:00 +0000 From: nusenu <nusenu-lists(a)riseup.net> To: "Sriram, Kotikalapudi (Fed)" <kotikalapudi.sriram(a)nist.gov> Cc: rpki-monitor <rpki-monitor(a)nist.gov>, "nanog(a)nanog.org" <nanog(a)nanog.org>, "Montgomery, Douglas (Fed)" <dougm(a)nist.gov> Subject: Re: [proj-bgp] adding graphs for actually unreachable RPKI INVALID prefixes to RPKI Monitor? Message-ID: <2b8f9b07-27a7-08ba-ac51-afd39b30f769(a)riseup.net> Content-Type: text/plain; charset="utf-8" Sriram, Kotikalapudi (Fed) (2018-09-18):> I also found your analysis very interesting and useful. Thanks for that. > >> What do you think about adding graphs that show the amount of actually >> unreachable prefixes and IP space? (prefix where no alternative valid/unknown announcement exists) > > I am also part of the NIST BGP team. > Doug has already responded with information that we will soon have a new version of the NIST Monitor > which will provide the kind of graphs that you requested. Can you share an estimate for when you plan to publish the new version of the NIST Monitor? thanks, nusenu

2 2

Cisco Crosswork Network Insights - or how to destroy a useful service
by Hank Nussbacher 16 May '19

16 May '19

I have started to use Cisco Crosswork Network Insights which is the replacement for BGPmon and I am shocked at how Cisco has managed to destroy a useful tool.I have had a paid 50 prefix account since the day BGPmon became available and helped two clients implement a 500 prefix license over the past 4 years.None will be buying Cisco Crosswork Network Insights, based on my recommendation. I really don’t know where to begin since there is so much to dislike in this new GUI.I will try to give you just a small taste but I suggest you request a 90 day trial license and try it out for yourself. This was not designed by someone who deals with BGP hijacks or who manages a network.It was probably given to some GUI developer with a minimal understanding of what the users needed.How do I know this?Take for example the main configuration menu: https://crosswork.cisco.com/#/configuration with the first tab of “prefixes”.On that page there is *no* mention of which ASN the prefix is associated with.That of course was fundamental in the BGPmon menu: https://portal.bgpmon.net/myprefixes.php Or take for example its “express configuration”, where you insert an ASN and it automatically finds all prefixes and creates a policy.But does it know the name of the ASN?Nope.Something again that was basic in BGPmon via: https://portal.bgpmon.net/myasn.php is non-existent in CNI. Or how about the alarms one gets to an email?Want to see how that looks? From: Crosswork Admin [mailto:admin@crosswork.cisco.com] Sent: 15 May 2019 11:39 To: Hank Nussbacher <Hank(a)mail.iucc.ac.il> Subject: CCNI Notification Active alarm count 1 starting at 2019-05-15 08:34:42.960762315 +0000 UTC. Please click on the link for each alarm below: https://crosswork.cisco.com/#/alarm/ba7c5084-f05d-4c12-a17f-be9e815d6647 Compare that with what we used to get: ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix:99.201.0.0/16: Prefix Description:Kuku net Update time:2018-08-12 17:50 (UTC) Detected by #peers:140 Detected prefix:99.201.131.0/24 Announced by:AS222246 (BGP hijacking Ltd) Upstream AS:AS111111 (Clueless ISP allowing customer hijacking Ltd) ASpath:555555 444444 333333 111111 222246 Alert details:https://portal.bgpmon.net/alerts.php?details&alert_id=830521190 Mark as false alert:https://portal.bgpmon.net/fp.php?aid=830521190 That is just a small sampling.Maybe two years down the road, Cisco will speak to customers first before destroying a useful service. Anyone else trying this out and feels the same or feels differently? Disappointed, Hank

10 11

FCC Hurricane Michael after-action report
by Sean Donelan 16 May '19

16 May '19

The FCC has released its report and analysis of Hurricane Michael impact on communications: preparation, effect and recovery. https://www.fcc.gov/document/fcc-releases-report-communication-impacts-hurr… Conclusions and Recommendations 51. Backhaul outages loomed large as an impediment to communications recovery. Uncoordinated post-storm recovery efforts between and among communications, utility, and debris removal teams created unnecessary delays to a speedy return to service. Customers who had communications service restored – only to lose it again almost immediately because of a fiber cut – provide a clear example of how better cross-sector coordination could have improved the restoration process.

10 11

ARIN v4 revocations with followup felony indictments
by Martin Hannigan 15 May '19

15 May '19

ARIN revokes fraudulently obtained IPv4 numbers: http://www.circleid.com/posts/20190514_735k_fraudulently_obtained_ip_addres… USAO indicts Micfo founder in South Carolina. https://www.justice.gov/usao-sc/pr/charleston-man-and-business-indicted-fed… Relevant threads over at ARIN on PPML. Cheers, -M<

1 0

Re: Charter and Cox contacts
by daniel＠pyranah.com 15 May '19

15 May '19

First off, I apologize for the list. I didn't realize my replies included the entire original email... Mark, we do not run a mail server. The issue is a lot of our customers have their 2nd homes here, so when they come up they are using their email provided by their 1st home ISP. A number of our customers use Cox, Charter, and Spectrum and can receive email just fine but cannot send. Report from a mac book pro email client showed Cox to be blocking the IP that we NAT most customers through. Message: 7 Date: Tue, 14 May 2019 11:22:41 -0700 (PDT) From: Mark Milhollan <mlm(a)pixelgate.net> To: NANOG list <nanog(a)nanog.org> Subject: Re: Charter and Cox contacts Message-ID: <alpine.LNX.2.00.1905141115120.5030(a)arcghar.ybpny> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Mon, 13 May 2019, Stephen Satchell wrote: >On 5/13/19 12:11 PM, daniel(a)pyranah.com wrote: >>Does anyone have contacts at Charter (Spectrum) and Cox? For some reason, >>our IP has been blocked by them and our customers are unable to send email >>via their charter/cox accounts. Thanks > >Would you be talking about port 25/tcp outbound? Lots of ISPs will >block port 25 as a rule; If this is the case, that your customers cannot use your mail servers to relay mail then provide port 587/TCP (SUBMISSION) or even 465/TCP (SMTPS, deprecated). If you mean that your mail servers can't send mail to Charter and Cox addresses, then indeed you need to find out what happened, fix it then request removal from their (and other) blacklists for which contacts there would be helpful (I am not one). /mark Daniel Temple VP of Operations Pyranah Communications, LLC 828-743-2470 ext.205 Pyranah.com Like us on Facebook!

1 0

Re: Cisco Crosswork Network Insights - or how to destroy a useful service
by Patrick McEvilly 15 May '19

15 May '19

https://honestnetworker.net/2019/01/31/recent-bgpmon-net-announcement/ From: NANOG <nanog-bounces+patrick_mcevilly=harvard.edu(a)nanog.org> on behalf of Mike Hammett <nanog(a)ics-il.net> Date: Wednesday, May 15, 2019 at 8:35 AM To: Hank Nussbacher <hank(a)efes.iucc.ac.il> Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: Re: Cisco Crosswork Network Insights - or how to destroy a useful service Resent-From: Patrick McEvilly <patrick_mcevilly(a)harvard.edu> Cisco ruins everything they touch. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com From: "Hank Nussbacher" <hank(a)efes.iucc.ac.il> To: nanog(a)nanog.org Sent: Wednesday, May 15, 2019 4:50:10 AM Subject: Cisco Crosswork Network Insights - or how to destroy a useful service I have started to use Cisco Crosswork Network Insights which is the replacement for BGPmon and I am shocked at how Cisco has managed to destroy a useful tool. I have had a paid 50 prefix account since the day BGPmon became available and helped two clients implement a 500 prefix license over the past 4 years. None will be buying Cisco Crosswork Network Insights, based on my recommendation. I really don’t know where to begin since there is so much to dislike in this new GUI. I will try to give you just a small taste but I suggest you request a 90 day trial license and try it out for yourself. This was not designed by someone who deals with BGP hijacks or who manages a network. It was probably given to some GUI developer with a minimal understanding of what the users needed. How do I know this? Take for example the main configuration menu: https://crosswork.cisco.com/#/configuration with the first tab of “prefixes”. On that page there is no mention of which ASN the prefix is associated with. That of course was fundamental in the BGPmon menu: https://portal.bgpmon.net/myprefixes.php Or take for example its “express configuration”, where you insert an ASN and it automatically finds all prefixes and creates a policy. But does it know the name of the ASN? Nope. Something again that was basic in BGPmon via: https://portal.bgpmon.net/myasn.php is non-existent in CNI. Or how about the alarms one gets to an email? Want to see how that looks? From: Crosswork Admin [mailto:admin@crosswork.cisco.com] Sent: 15 May 2019 11:39 To: Hank Nussbacher <Hank(a)mail.iucc.ac.il> Subject: CCNI Notification Active alarm count 1 starting at 2019-05-15 08:34:42.960762315 +0000 UTC. Please click on the link for each alarm below: https://crosswork.cisco.com/#/alarm/ba7c5084-f05d-4c12-a17f-be9e815d6647 Compare that with what we used to get: ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 99.201.0.0/16: Prefix Description: Kuku net Update time: 2018-08-12 17:50 (UTC) Detected by #peers: 140 Detected prefix: 99.201.131.0/24 Announced by: AS222246 (BGP hijacking Ltd) Upstream AS: AS111111 (Clueless ISP allowing customer hijacking Ltd) ASpath: 555555 444444 333333 111111 222246 Alert details: https://portal.bgpmon.net/alerts.php?details&alert_id=830521190 Mark as false alert: https://portal.bgpmon.net/fp.php?aid=830521190 That is just a small sampling. Maybe two years down the road, Cisco will speak to customers first before destroying a useful service. Anyone else trying this out and feels the same or feels differently? Disappointed, Hank

1 0

Charter and Cox contacts
by daniel＠pyranah.com 14 May '19

14 May '19

Does anyone have contacts at Charter (Spectrum) and Cox? For some reason, our IP has been blocked by them and our customers are unable to send email via their charter/cox accounts. Thanks Daniel Temple VP of Operations Pyranah Communications, LLC 828-743-2470 ext.205 <http://www.pyranah.com/> Pyranah.com <https://www.facebook.com/cashiersvalleyelectronics/> Like us on Facebook!

3 2