May 2019 - Test - lists.nanog.org

Spoofer Report for NANOG for Apr 2019
by CAIDA Spoofer Project 08 May '19

08 May '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Apr 2019: ASN Name Fixed-By 53597 HOYOS-CONSULTING-LLC 2019-04-09 2828 XO-AS15 2019-04-10 33523 ROWANUNIVERSITY 2019-04-24 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Apr 2019: ASN Name First-Spoofed Last-Spoofed 6939 HURRICANE 2016-02-22 2019-04-04 5650 FRONTIER-FRTR 2016-02-22 2019-04-15 7029 WINDSTREAM 2016-06-21 2019-04-06 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-04-30 6128 CABLE-NET-1 2016-09-03 2019-04-11 20412 CLARITY-TELECOM 2016-09-30 2019-04-27 6181 FUSE-NET 2016-10-10 2019-04-30 25787 ROWE-NETWORKS 2016-10-21 2019-04-27 174 COGENT-174 2016-10-21 2019-04-02 30341 SCTA-ASN 2016-10-31 2019-04-16 32440 LONI 2016-11-03 2019-04-24 12083 WOW-INTERNET 2016-11-09 2019-04-25 13427 SOFTCOM-INTERNET-COMMUNICATION 2016-11-14 2019-04-30 21832 KELLINCOM-1 2017-02-03 2019-04-29 18451 LESNET 2017-02-22 2019-04-05 36007 KAMATERA 2017-04-21 2019-04-26 19624 SERVERROOM 2017-06-02 2019-04-30 6461 ZAYO-6461 2017-06-21 2019-04-15 63296 AMARILLO-WIRELESS 2017-09-01 2019-04-25 33523 ROWANUNIVERSITY 2017-10-29 2019-04-17 12222 AKAMAI 2018-02-14 2019-04-26 4201 ORST 2018-04-19 2019-04-30 393564 SPOKANE 2018-06-05 2019-04-17 225 VIRGINIA 2018-06-18 2019-04-26 40911 L2NC 2018-08-31 2019-04-24 33452 RW 2018-09-19 2019-04-11 20448 VPNTRANET-LLC 2018-09-20 2019-04-10 11215 LOGIXCOMM 2018-09-20 2019-04-02 11996 LOBOIS 2018-09-24 2019-04-02 13825 TROYCABLE-NET 2018-11-21 2019-04-11 393437 KLAYER 2018-12-21 2019-04-27 62957 HOSPITALITY-NETWORK 2018-12-30 2019-04-06 63275 RADIOWIRE 2019-02-07 2019-04-29 19531 NODESDIRECT 2019-03-14 2019-04-25 11297 LIPSCOMB 2019-03-29 2019-04-12 14813 BB-COLUMBUS 2019-04-08 2019-04-11 15290 ALLST-15290 2019-04-09 2019-04-10 8047 GCI 2019-04-11 2019-04-30 10745 ARIN-ASH-CHA 2019-04-29 2019-04-29 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Re: NTP for ASBRs?
by John Kristoff 08 May '19

08 May '19

On Wed, 8 May 2019 07:56:33 +0000 Lars Prehn <lprehn(a)mpi-inf.mpg.de> wrote: > do you NTP sync your AS boundary routers? If so, what are incentives for > doing so? Are there incentives, e.g. security considerations, not to do it? In addition to what others have mentioned, if these systems are to perform route origin validation (ROV), an accurate notion of time would be desirable. From section 6 in IETF RFC 7115 / BCP 185 - Origin Validation Operation Based on the Resource Public Key Infrastructure (RPKI): As a router must evaluate certificates and ROAs that are time dependent, routers' clocks MUST be correct to a tolerance of approximately an hour. John

1 0

historical BGP announcements? (pre-1997)
by John Osmon 08 May '19

08 May '19

I've got a need to look for some announcements from the mid 1990s. The oldest I've found at at the University of Oregon Route Views Project, but the earliest I can find there appears to be November of 1997. Anyone have pointers to date from earlier?

7 8

Re: EXERCISE: 2019 IAA Planetary Defence Conference - Day 5 Scenario
by Scott Weeks 08 May '19

08 May '19

--- sean(a)donelan.com wrote: From: Sean Donelan <sean(a)donelan.com> Of course, any fictional scenario is more likely to hit an ocean...But that makes for a dull exercise. ------------------------------------- Not for some of us... ;-) scott

1 0

any interesting/useful resources available to IPv6 only?
by Brian J. Murrell 07 May '19

07 May '19

Hi, I am trying to make a case (to old fuddy-duddies, which is why I even need to actually make a case) for IPv6 for my own selfish reasons. :-) I wonder if anyone has any references to interesting/useful/otherwise resources on are only available to IPv6 users that they can forward to me. Cheers, b.

17 21

DNS and QNAME MINIMISATION
by Mark Andrews 07 May '19

07 May '19

Recursive servers that perform QNAME MINIMISATION are being deployed and they are exposing broken delegations like this one. % dig -x 142.136.234.134 ;; BADCOOKIE, retrying. ; <<>> DiG 9.15.0-dev+hotspot+add-prefetch+marka <<>> -x 142.136.234.134 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 39443 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: d4d342d1c371c244772e3c725cd0e9163bc9f7112443be2b (good) ;; QUESTION SECTION: ;134.234.136.142.in-addr.arpa. IN PTR ;; Query time: 4140 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue May 07 12:10:30 AEST 2019 ;; MSG SIZE rcvd: 85 % Now you may think, so what? But when you do a dig +trace you find this at the end ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27732 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;134.234.136.142.in-addr.arpa. IN PTR ;; AUTHORITY SECTION: 136.142.in-addr.arpa. 86400 IN NS ns1.twcable.com. 136.142.in-addr.arpa. 86400 IN NS ns2.twcable.com. 136.142.in-addr.arpa. 10800 IN NSEC 137.142.in-addr.arpa. NS RRSIG NSEC 136.142.in-addr.arpa. 10800 IN RRSIG NSEC 5 4 10800 20190521003550 20190506233550 3402 142.in-addr.arpa. CErPYfRum0q2On4+XSc3avPzzqYa98oxYFp+8NRblUnbgAQ02Jta/FWS NcpBBvMnw6sTIfsVY0TqgAC6MCMj8ojHca3+IgVFqa2gSPISewvH1ajl rNLPAiIgiOjIwdQFe2FRd9UaKnl3XKGsYYLFmAe4yn3wL5aIRaVKjFAi y0w= ;; Query time: 373 msec ;; SERVER: 2001:67c:e0::10#53(2001:67c:e0::10) ;; WHEN: Tue May 07 12:11:46 AEST 2019 ;; MSG SIZE rcvd: 322 ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59480 ;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;134.234.136.142.in-addr.arpa. IN PTR ;; ANSWER SECTION: 134.234.136.142.in-addr.arpa. 14400 IN PTR nce.mail.chartercom.com. ;; AUTHORITY SECTION: 234.136.142.in-addr.arpa. 500 IN NS cdp-wn-tm-5-01.inf.twcable.com. ;; Query time: 1009 msec ;; SERVER: 165.237.86.252#53(165.237.86.252) ;; WHEN: Tue May 07 12:11:47 AEST 2019 ;; MSG SIZE rcvd: 135 % And I’m pretty sure Charter/TWCable want email to be delivered to/from them. The reason for the failure is that cdp-wn-tm-5-01.inf.twcable.com does not exist and qname minimisation results in the recursive server discovering the NS record and as there is no A or AAAA records for this name the PTR lookup fails. % dig cdp-wn-tm-5-01.inf.twcable.com ;; BADCOOKIE, retrying. ; <<>> DiG 9.15.0-dev+hotspot+add-prefetch+marka <<>> cdp-wn-tm-5-01.inf.twcable.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48170 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: d39d81ee2cc4f57c8558cf475cd0eaa7f5079768e7dfb548 (good) ;; QUESTION SECTION: ;cdp-wn-tm-5-01.inf.twcable.com. IN A ;; AUTHORITY SECTION: twcable.com. 3600 IN SOA ns1.twcable.com. hostmaster.pblpdns01.twcable.com. 2019042503 14400 7200 604800 3600 ;; Query time: 610 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue May 07 12:17:11 AEST 2019 ;; MSG SIZE rcvd: 170 % -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

1 0

NTP question
by Mehmet Akcin 07 May '19

07 May '19

hey there Nanog, I am trying to buy a GPS based NTP server like this one https://timemachinescorp.com/product/gps-time-server-tm1000a/ but I will be placing this inside a data center, do these need an actual view of a sky to be able to get signal or will they work fine inside a data center building? if you have any other hardware requirements to be able to provide stable time service for hundreds of customers, please let me know. mehmet

33 79

Re: Fibre provider in Starkville, MS
by Marshall, Quincy 06 May '19

06 May '19

-------- Original message -------- From: Mehmet Akcin Date: 5/6/19 09:02 (GMT-05:00) To: Theo Voss Cc: nanog(a)nanog.org Subject: Re: Fibre provider in Starkville, MS "hi Theo, Looks like Earthlink (now Windstream) has fiber there. You can visit www.infrapedia.com<http://www.infrapedia.com> to look at what is available. <snipped>" Hasn't windstream filed for Chapter 11/13 protection? Not certain that's the best choice. LQ Marshall --------------------------------------------------------------------------------------- This email has been scanned for email related threats and delivered safely by Mimecast. For more information please visit http://www.mimecast.com ---------------------------------------------------------------------------------------

5 6

Fibre provider in Starkville, MS
by Theo Voss 06 May '19

06 May '19

Hi all, we’re looking for a regional (and agile) ISP who can provide 1 Gbps full-transparent layer2 connectivity from an office building in Starkville, MS (address on request) to our PoP in Atlanta (https://www.peeringdb.com/fac/562) – does anyone has recommendations? :-) Thanks in advance! Best regards, Theo Voss

4 4

Access to raw network data
by lobna gouda 06 May '19

06 May '19

Hello, Does anyone know if there is public sources for network data that can be use to train model? If not public, can someone provide access for research and all data confidentially rights will be preserved. Brgds, LG

2 1