August 2019 - Test - lists.nanog.org

How often does Google's Safe Browsing system expire URLs that are 404?
by Landon Stewart 08 Aug '19

08 Aug '19

Hello, Numerous customers that have had phishing issues reported to them as a result of Google’s Safe Browsing program have taken care of said issues. The URL(s) reported to them either return a 404 or 5xx error but the URL stays listed, according to the GSB’s API, for weeks afterwards. Does anyone know: 1) Is there some kind of expiry time on URLs flagged as unsafe by GSB 2) Is there some way for *us* (the provider) to trigger a review of the URL to speed this process up? Harassing the client to login to the webmaster portal and request a review can be a cat herding exercise. Thanks for any info you might have. — Landon Stewart Lead Analyst - Abuse and Security Management INAP® 📧 lstewart(a)inap.com 🌍 www.inap.com

1 0

Research project on blacklists
by Anushah Hossain 08 Aug '19

08 Aug '19

Hi all, My colleagues and I at UC Berkeley and the International Computer Science Institute are working on a project evaluating third-party blacklists. As part of that, we're interested in hearing how you utilize them, and what you perceive as their strengths and weaknesses. If you have five to ten minutes and are interested in sharing your thoughts, you can fill out our anonymous survey here, or respond to me directly off-list: https://berkeley.qualtrics.com/jfe/form/SV_200mg5hnQiAOgUl There is also an option in the survey to opt-in to receiving a notification once the research is made public. Apologies if you received this message before! We've tried to minimize cross-posting as we realize several groups share members. Best, Anushah -- Anushah Hossain, PhD Student Energy and Resources Group, UC Berkeley

7 7

Spoofer Report for NANOG for Jul 2019
by CAIDA Spoofer Project 08 Aug '19

08 Aug '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Jul 2019: ASN Name Fixed-By 2828 XO-AS15 2019-07-12 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jul 2019: ASN Name First-Spoofed Last-Spoofed 6939 HURRICANE 2016-02-22 2019-07-27 577 BACOM 2016-03-09 2019-07-06 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-07-31 6128 CABLE-NET-1 2016-09-03 2019-07-30 27364 ACS-INTERNET 2016-09-27 2019-07-25 20412 CLARITY-TELECOM 2016-09-30 2019-07-29 6181 FUSE-NET 2016-10-10 2019-07-27 25787 ROWE-NETWORKS 2016-10-21 2019-07-27 32440 LONI 2016-11-03 2019-07-26 2828 XO-AS15 2016-11-08 2019-07-29 12083 WOW-INTERNET 2016-11-09 2019-07-29 13427 SOFTCOM-INTERNET-COMMUNICATION 2016-11-14 2019-07-31 21832 KELLINCOM-1 2017-02-03 2019-07-31 18451 LESNET 2017-02-22 2019-07-23 26253 SCINTERNET 2017-06-30 2019-07-08 63296 AMARILLO-WIRELESS 2017-09-01 2019-07-25 546 PARSONS-PGS-1 2017-11-20 2019-07-30 54540 INCERO 2018-01-15 2019-07-29 12222 AKAMAI 2018-02-14 2019-07-10 4201 ORST 2018-04-19 2019-07-30 225 VIRGINIA 2018-06-18 2019-07-30 33452 RW 2018-09-19 2019-07-28 20448 VPNTRANET-LLC 2018-09-20 2019-07-25 393437 KLAYER 2018-12-21 2019-07-17 63275 RADIOWIRE 2019-02-07 2019-07-31 8047 GCI 2019-04-11 2019-07-31 10745 ARIN-ASH-CHA 2019-04-29 2019-07-25 6058 NORTHWESTEL-INC 2019-05-06 2019-07-31 46573 AS-GLobalf 2019-05-16 2019-07-01 138576 2019-05-21 2019-07-27 19751 CCRTC 2019-06-06 2019-07-29 33387 DATASHACK 2019-06-06 2019-07-26 16787 CHARTER-16787 2019-06-17 2019-07-29 29933 OFF-CAMPUS-TELECOMMUNICATIONS 2019-07-15 2019-07-15 36728 EMERYTELCOM 2019-07-26 2019-07-26 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Re: [j-nsp] MX10003 rack size
by Anderson, Charles R 08 Aug '19

08 Aug '19

1000mm deep. APC AR3100 racks are 600mm x 1070mm. APC also makes 1200mm deep ones, and 750mm wide ones, and both together. On Wed, Aug 07, 2019 at 04:12:26PM +0000, Richard McGovern wrote: > Pete "1000 deep rack"?? Is that fathoms __ > > Richard McGovern > Sr Sales Engineer, Juniper Networks > 978-618-3342 > > I’d rather be lucky than good, as I know I am not good > I don’t make the news, I just report it > > > On 8/7/19, 6:20 AM, "Pete Webb" <Pete.Webb(a)virtual1.com> wrote: > > No mate, > I made the same mistake. > Minimum you can get away with is 1000 deep racks, and even then you have to leave the front air filter off. > > Pete > > -----Original Message----- > From: juniper-nsp <juniper-nsp-bounces(a)puck.nether.net> On Behalf Of Sander Steffann > Sent: 30 July 2019 13:32 > To: nanog <nanog(a)nanog.org>; Juniper List <juniper-nsp(a)puck.nether.net> > Subject: [j-nsp] MX10003 rack size > > Hi, > > Has anyone ever managed to fit a Juniper MX10003 in a 90cm deep rack? Without applying power tools to either the rack or the router ;) > > Cheers, > Sander

2 1

GEO IP Updates
by Colin Legendre 08 Aug '19

08 Aug '19

Hi, We've leased some new IP blocks, but are having issues with customers complaining they can't access some Geo Restricted content. We updated all the GEO IP databases we can think of.. but are still having issues... 2 services people have complained about are... Crave TV Amazon Prime We are located in Canada as are all our clients, and they are getting notices that they are located in the US. We updated... Maxmind, DB-IP, IP Info, IP Geolocation, IPHub. IP2location Any others we should update? --- Colin

5 5

What can ISPs do better? Removing racism out of internet
by Mehmet Akcin 08 Aug '19

08 Aug '19

Ok, two mass shootings, touchy topic, lots of emotions this weekend. Going straight to the point. Most of us who operate internet services believe in not being the moderator of internet. We provide a service and that’s it. Obviously there are some established laws around protecting copyrights, and other things which force us to legally take action and turn things down when reported. What can we do better as network operators about hate sites like 8Chan? I applaud cloudflare’s (perhaps slightly late) decision on kicking 8chan off its platform today after El Paso attack. https://blog.cloudflare.com/terminating-service-for-8chan/ I am sure there are many sites like this out there, but could network operators do anything to make these sites “not so easy” to be found, reached, and used to end innocent lives? Mehmet -- Mehmet +1-424-298-1903

29 69

Next Generation Lan
by Greg Grabowski 07 Aug '19

07 Aug '19

Hello Networkers, We are looking for something to manage our LAN. This would include all the usual suspects. PSIRT or similar notifications on code, automation of networks, micro segmentation all in an overlay fabric, streaming telemetry. Of course Cisco has DNA Center which is not to impressive at this time. Maybe when it's more mature, we would also like to be vendor neutral if possible. Just wondering what other folks are doing to accommodate the next generation lan. EVPN, VXLAN? etc. We are running routed access as well. Thanks in advance, Greg

1 0

Salliemae.com
by Brian Ellwood 07 Aug '19

07 Aug '19

Any domain/DNS administrators for Salliemae on the list that could contact me directly or perhaps take a look at the DNSSEC implementation on the domain? Resolvers validating DNSSEC are unable to resolve the domain: http://dnsviz.net/d/salliemae.com/dnssec/ — Brian Ellwood Senior Systems Engineer INOC Data Centers O: 518-689-4350

1 0

Contact in ATU
by DaKnOb 07 Aug '19

07 Aug '19

Hello, Anyone by any chance has any contact info for ATU in Albania? Any type of contact should probably be fine, from what I’ve seen, not necessarily technical. Thanks, Antonis

1 0

netstat -s
by Randy Bush 07 Aug '19

07 Aug '19

do folk use `netstat -s` to help diagnose on routers/switches? randy

15 18