August 2019 - Test - lists.nanog.org

SLA language about monitoring route leaks and inter-connection issues
by Sean Donelan 26 Aug '19

26 Aug '19

Do any major ISPs have SLA language about monitoring inter-provider agreements for route hijacking, route leaks, address spoofing, and so on? I'm looking for something more proactive than waiting for a customer to notice a problem and open a trouble ticket.

3 3

DNS cache hold of SERVFAIL responses
by Stephen Satchell 26 Aug '19

26 Aug '19

This is for any Google admin on this list: When you receive a SERVFAIL from a name server listed as authoritative for a given domain, how long is that negative look-up cached? When you receive a SERVFAIL from the root servers, how long is that negative lookup cached? Does Google follow RFC 2308? Is there a common cache for all resolvers, or do each resolver in your DNS server corps maintain a local cache? When a SOA (when you see one) says 14400 for the minimum TTL (or negative cache TTL) does Google honor that hold time?

1 0

report domains found in malware distrabution
by james jones 25 Aug '19

25 Aug '19

just quick question: is the abuse emails still best way to report domains that are being used in malware scripts? or is there a more central place to report such things? -James

3 2

Asset management recommendations
by Mehmet Akcin 24 Aug '19

24 Aug '19

Hey there I am looking for a tool recommendation for network and server asset management which can scale in multiple sites and integrate with other platforms like nagios, librenms. Being able to do patch management is plus. Mostly linux and juniper shop Any recommendations? -- Mehmet +1-424-298-1903

6 6

Re: Tiered operations support
by Clayton Zekelman 23 Aug '19

23 Aug '19

Find a new job. At 02:40 PM 23/08/2019, harbor235 wrote: >Hi noggers, > >First some background; > >I have inherited a real-time services delivery >infrastructure that while technically functional >is absent of a wworking tiered operational >support structure. In addition, the >infrastructure was not implemented with >technology best practices and has some remaining >single points of failure. T3/engineering handles >engineering, operational support, testing, and >development. T1 and T2 perform some tasks but >not what is expected of a traditional support >structure, As we are attempting to scale our >program our limitations are obvious. > >We are trying to scale the program and need to >remedy all single points of failure and >implement technical and management best >practices. While we try to remedy all of the >above, our customer expects routine capability enhancements. > >Question(s) >1) how to pivot to a tiered operational support >structure and set expectations for each tier >level. How do I do that without having my entire staff leave? >Â Â Â Â Â Â Current staff is not a professional >organization and are used to a purely reactive state. > >2) ITIL process are great and we have started to >implement what makes sense but I need a >operational support stucture/model to support and manage this effort. > >3) How do you manage your engineering and >operational projects? Currently I am using Excel >for all projects short and long term and also >use a seperate spreadsheet for my short term >project sprints? Basic project tracking with no mature processes involve. > >How are you pulling this all together? > >I would like to hire key positions that can >bring essential capabilities to my project but I am limited hiring new staff. > >thoughts, suggestions > >Mike

4 3

Re: Tiered operations support
by Scott Weeks 23 Aug '19

23 Aug '19

--- harbor235(a)gmail.com wrote: How do I do that without having my entire staff leave? Current staff is not a professional organization and are used to a purely reactive state. ----------------------------------------------------- Maybe you want some of them to leave, if they're "not a professional organization". Get some fresh folks from professional minded organizations and see if the others quit being reactionary only and step up their game. scott

1 0

Tiered operations support
by harbor235 23 Aug '19

23 Aug '19

Hi noggers, First some background; I have inherited a real-time services delivery infrastructure that while technically functional is absent of a wworking tiered operational support structure. In addition, the infrastructure was not implemented with technology best practices and has some remaining single points of failure. T3/engineering handles engineering, operational support, testing, and development. T1 and T2 perform some tasks but not what is expected of a traditional support structure, As we are attempting to scale our program our limitations are obvious. We are trying to scale the program and need to remedy all single points of failure and implement technical and management best practices. While we try to remedy all of the above, our customer expects routine capability enhancements. Question(s) 1) how to pivot to a tiered operational support structure and set expectations for each tier level. How do I do that without having my entire staff leave? Current staff is not a professional organization and are used to a purely reactive state. 2) ITIL process are great and we have started to implement what makes sense but I need a operational support stucture/model to support and manage this effort. 3) How do you manage your engineering and operational projects? Currently I am using Excel for all projects short and long term and also use a seperate spreadsheet for my short term project sprints? Basic project tracking with no mature processes involve. How are you pulling this all together? I would like to hire key positions that can bring essential capabilities to my project but I am limited hiring new staff. thoughts, suggestions Mike

1 0

Fwd: [safnog] SAFNOG-5 Is Ready For You
by Mark Tinka 23 Aug '19

23 Aug '19

FYI - SAFNOG-5 in Johannesburg, next week. Mark. -------- Forwarded Message -------- Subject: [safnog] SAFNOG-5 Is Ready For You Date: Thu, 22 Aug 2019 13:30:12 +0000 From: Portia Rabonda <portia.rabonda(a)safnog.net> To: safnog(a)safnog.org <safnog(a)safnog.org> Hello All, With just 4 days to go to SAFNOG-5 in Johannesburg, South Africa, we are excited to have you join us for what is going to be a very informative, educational and fun agenda. Highlights from the program include: * 3 keynotes: o Sunil Tagare (OpenCables), talking about the impact of the submarine cables - on Africa - that Facebook and Google have announced, and what it could mean for the continent. o Byron Clatterbuck (SEACOM), also speaking about submarine cable realities in Africa, how to make them sustainable and help effect change in the region. o Jerome Fleury (Cloudflare), who will be going into detail about the outage his organization faced on June 24th of this year, due to a massive BGP leak. * The first carrier-neutral data centre that will go live in Kampala, Uganda, at the end of 2019. * A panel on the relevance (or lack of thereof) of generalized speed tests in 2019 as minimum bandwidth increases for consumers, enterprises and service providers. * South Africa's first FTTH service provider that is delivering native IPv6 to home users. * Numerous tutorials/workshops that will provide training on: o IPv6 deployment. o IRR, RPKI and ROV for a secure, global BGP. o Critical infrastructure vis a vis what the Internet should be, and what it actually is. There will also be a number of social events taking place, which will connect all participants to further network with one another and create opportunities on helping further grow the Internet within the region, and the rest of the world. To register for the event, and for more details on the agenda, please visit: http://www.safnog.org/ We look forward to seeing you in Johannesburg. Regards, SAFNOG-5 Programme Committee

1 0

FCC Takes Action Against WISPs That Interfered with FCC Weather Radar
by Sean Donelan 23 Aug '19

23 Aug '19

I haven't been paying attention to the WISP market, so I'm not up to speed on these issues. https://www.fcc.gov/document/fcc-proposes-fines-against-wisps-and-issues-wa… The Federal Communications Commission’s Enforcement Bureau today announced proposed fines and issued a formal industry warning related to devices that apparently caused interference to the Federal Aviation Administration’s terminal doppler weather radar station in San Juan, Puerto Rico. The Enforcement Bureau proposed three separate $25,000 fines against wireless Internet service providers Boom Solutions, Integra Wireless, and WinPR. [...] In addition to the proposed fines, the Bureau’s Enforcement Advisory warned operators, manufacturers, and marketers of Unlicensed National Information Infrastructure devices that these devices must be certified under FCC rules. Such devices that operate in the 5.25 GHz to 5.35 GHz and 5.47 GHz to 5.725 GHz bands risk interfering with radar systems if not properly configured to share the spectrum [...]

5 8

Re: syn flood attacks from NL-based netblocks
by Jakob Heitz (jheitz) 20 Aug '19

20 Aug '19

The source address in the SYN is spoofed. What if the real owner of the source address wanted to connect to you? Then your penaltybox would block him. An attacker could now use your penaltybox to cause a DoS to the real owner of the IP address. > Date: Sun, 18 Aug 2019 08:48:08 -0700 > From: Mike <mike-nanog(a)tiedyenetworks.com> > > My idea is to maintain a penaltybox for any client IP that initiated a > connection but did not complete, while also maintaining a whitelist of > 'frequent fliers' who have previously completed their connections > successful. The penalty could simply be to drop traffic sourced from > those client ips that do not complete the handshake, for some > configurable timeout period. The whitelisting feature could give a pass > to good clients and allow these to bypass the penalty filtering, for a > longer timeout period (but of course, passing it along so other ACL's > can take effect). I'd say, perhaps, a 5 minute timeout would be > sufficient for a penalty, while 1 day or longer would be sufficient for > whitelisting. It would depend on your traffic of course, and definitely > you would want something efficient such as linux ipset as opposed to > individual iptables rules. > > While looking around, I came across the SYNPROXY netfilter module.. it > appears to be very complete but missing the above functionality to avoid > responding to spoofed clients. I'm going to see about hacking up a proof > of concept. I'll post here if I come up with something to play with. > > Mike-

1 0