September 2020 - Test - lists.nanog.org

Network Gear Seismic Tolerances
by Crist Clark 16 Sep '20

16 Sep '20

I've been living and working in earthquake country for many years. The primary focus I've always encountered for network gear is to make sure it is properly secured to the racks and the racks properly secured to the building (and hope the building is well secured). I'm working on a project now where we're doing seismic isolation for the servers. I think the main concern there is spinning disks. The cabinets are effectively "floating," well, rolling really, on the data center floor. There are various vendor solutions for this. Of course, the network gear living up close and personal with the servers is along for the ride. That's all fine. I don't think it's a problem for the network gear. But now there are people with the idea that seismic isolation is the technology we need for all of our electronics, down to network gear in IDRs. I am trying to find any real information about this, but Google-fu is not producing results for me. I asked some of our vendor sales people, they said they'd get back, but never did. I don't know if shake tolerances is something published for your typical data center and campus network gear. Anyone have some best practice info from some reliable sources or seen any shake tolerance data for network gear?

3 2

microsoft mail contact
by Nicholas Warren 15 Sep '20

15 Sep '20

We recently acquired some IP space, but it seems outlook does not want to receive email from that space. If there's someone that knows what we need to do, we would be grateful for any pointers in the right direction. nich

2 1

IP addresses on subnet edge (/24)
by Andrey Khomyakov 15 Sep '20

15 Sep '20

TL;DR I suspect there are middle boxes that don't like IPs ending in .255. Anyone seen that? Folks, We are troubleshooting a strange issue where some of our customers cannot establish a successful connection with our HTTP front end. In addition to checking the usual things like routing and interface errors and security policy configurations, hopening support tickets with the load balancer vendor so far all to no avail, we did packet captures. Based on the packet captures we receive a SYN, we reply with SYN-ACK, but the client never actually receives that SYN-ACK. In a different instance the 3-way completes, followed by TLS client hello to us, we reply with TLS Server Hello and that server hello never makes it to the client. And again, this is only affecting a small subset of customers thus suggesting it's not the load balancer or the edge routing configuration (in fact we can traceroute fine to the customer's IP). So far the only remaining theory that remains is that there are middle boxes out there that do not like IPs ending in .255. The service that the clients can't get to is hosted on two IPs ending in .255 Let's just say they are x.x.121.255 and x.x.125.255. We even stood up a basic "hello world" web server on x.x.124.255 with the same result. Standing up the very same basic webserver on x.x.124.250 allows the client to succeed. So far we have a friendly customer who has been working with us on troubleshooting the issue and we have some pcaps from the client's side somewhat confirming that it's not the customer's system either. This friendly customer is in a small 5 people office with Spectrum business internet (that's the SYN-ACK case). The same customer tried hopping on his LTE hotspot which came up as Cellco Partnership DBA Verizon Wireless with the same result (that's the TLS server hello case). That same customer with the same workstation drives a town over and he can get to the application fine (we are still waiting for the customer to let us know what that source IP is when it does work). Before you suggest that those .255 addresses are broadcasts on some VLAN, they are not. They are injected as /32s using a routing protocol, while the VLAN addressing is all RFC1918 addressing. --Andrey

9 8

curious spam...
by William Herrin 15 Sep '20

15 Sep '20

Howdy, I've noticed something odd. When I lived in Virginia, I started receiving email directly to my gmail box from my U.S. Representative. Unsolicited spam from Congressmen is nothing new but it was a little odd that they found my gmail box (which I don't give out) and not one of the hundreds of aliases at herrin.us or dirtside.com which I do give out. The gmail box exists only in mail headers; "From" is always a different address. I moved to Seattle. Today I found my grmail box subscribed to a congressman's list from a nearby Washington jurisdiction. Not some random congressman. And not any of the addresses I give out; my gmail box's address which I don't. Anyone else have a similar experience? Any idea how a hidden address is making it on to relevant congressmens' lists but not any others? That's weird right? Regards, Bill Herrin -- William Herrin bill(a)herrin.us https://bill.herrin.us/

7 7

how would draft-ymbk-opsawg-finding-geofeeds work in noam
by Randy Bush 15 Sep '20

15 Sep '20

would folk familiar with the north american RIR and IRR registries be kind enough to suggest how this might adapt? thanks. A new version of I-D, draft-ymbk-opsawg-finding-geofeeds-02.txt has been successfully submitted by Randy Bush and posted to the IETF repository. Name: draft-ymbk-opsawg-finding-geofeeds Revision: 02 Title: Finding and Using Geofeed Data Document date: 2020-09-11 Group: Individual Submission Pages: 16 URL: https://www.ietf.org/id/draft-ymbk-opsawg-finding-geofeeds-02.txt Status: https://datatracker.ietf.org/doc/draft-ymbk-opsawg-finding-geofeeds/ Htmlized: https://datatracker.ietf.org/doc/html/draft-ymbk-opsawg-finding-geofeeds Htmlized: https://tools.ietf.org/html/draft-ymbk-opsawg-finding-geofeeds-02 Diff: https://www.ietf.org/rfcdiff?url2=draft-ymbk-opsawg-finding-geofeeds-02 Abstract: This document describes how to find and authenticate geofeed data.

3 16

why not use dns for draft-ymbk-opsawg-finding-geofeeds?
by Randy Bush 14 Sep '20

14 Sep '20

[ am i going to regret cross-posting? ] a friend raised in private the question of whether the dns could be used instead of rpsl. essentially, dns does not search down-tree for you. it only answers exact specific queries. for some reason lost in time, well at least lost in my mind, rpsl servers give you the nearest enclosing object. e.g., if i query for the ip address of psg.com, 147.28.0.62, i get the encompassing inetnum: object. ryuu.rg.net:/Users/randy> whois -h whois.ripe.net 147.28.0.62 inetnum: 147.28.0.0 - 147.28.31.255 netname: RGNET-RSCH-147-0 country: EE org: ORG-RO47-RIPE admin-c: RB45695-RIPE tech-c: RB45695-RIPE abuse-c: AR52766-RIPE status: LEGACY mnt-by: MAINT-RGNET remarks: Geofeed https://rg.net/geofeed created: 2020-09-03T22:23:37Z last-modified: 2020-09-13T20:16:05Z source: RIPE # Filtered and now i know not to query further in the range 147.28.0.0/19. note the geofeed pointer is not at the exact ip, or at the /24, or at the /16. and have fun getting the magic of knowing it is the /19 into the dns. one does not want to query the dns for an RR 62.0.28.147.in-addr.arpa because, for this to be useful, either o you need the geoloc data with every PTR record (think ipv6 and slaac) o you need some non-existent magic to get you the geoloc data for some unspecified less specific granularity if netflix wants to collect the geofeeds once a month. do we propose they dns query all ipv4 and ipv6 host addresses? i suspect there are also cultural issues. in most isps of scale, dns is close to customer service, a different 'silo' from provisioning. rpsl not so much. i am sure massimo is learning more about the silos in ntt than he would care to. but he was able to deploy this hack in a week. i would bet that he could never get a dns hack deployed. possibly amusing tangential note: we once tried to do rpki in the dns, see https://tools.ietf.org/html/draft-bates-bgp4-nlri-orig-verif-00 aside from other issues, dns only allows a single delegation, which would preclude two owners in a make before break transition. randy

1 0

sr - spring - what's the deal with 2 names
by aaron1＠gvtc.com 14 Sep '20

14 Sep '20

Please forgive if this has already been spoken to. if so, you can simply send the link to old mail list entries and that will suffice. otherwise. Does anyone know the scope on why we have 2 names for this ? Seriously, was it one of those things where a vendor started doing it first (pre-standard) as sr, and then ietf started standardizing it as spring ? .or was it always being standardized pre-vendor implementation and there was a disagreement within ietf or elsewhere ? or. was there a conscious decision amongst the inventors to actually call it both sr and spring ? or is their actually something different about each one and I'm wrong in thinking they are 2 names for the same technology. I'm taking stabs at this and presenting multiple choice just as I sit back and wonder why the 2 names I mean there must be a reason why someone thought that we should call this 2 different names. I would think within this NANOG maillist, someone will have the answer or at least some pretty good insights into why the 2 names. Aaron aaron1(a)gvtc.com

6 13

Softbank Contact
by Evan M. Gillman 14 Sep '20

14 Sep '20

Hello, Can someone from Sofbank sales contact me off list? Thanks, Evan Evan M. Gillman | transitbroker.com | P. 212.420.1222 | M. 917.664.0707

2 1

Wildfires: Reminder smart devices don't include emergency warnings while streaming
by Sean Donelan 13 Sep '20

13 Sep '20

As some of the largest wildfires burn along the West Coast, and over 500,000 people evacuate, a reminder that streaming devices do not include local emergency alerts. Cord-cutters using Alphabet Android TV, Amazon Fire TV, Apple TV "smart" devices should remember they don't have emergency alerts while streaming. FCC requires cellular phones support Wireless Emergency Alerts, including when using streaming Apps. But not in-home "smart" devices like smart TVs and smart speakers. You should also have an traditional AM/FM or weather radio at home. And your DTV may still have a connection for an over-the-air antenna. Nevertheless, while you are watching Netflix or listening to Spotify on a non-cell phone smart device, you won't get emergency alerts on those streaming devices. Amazon Fire TV, Apple TV and Alphabet Android TV executives don't see a need to support emergency alerts on their products.

8 9

Wildfires: Clear fuel from hilltop and remote area communications towers
by Eric Kuhnke 12 Sep '20

12 Sep '20

Over the past week I think I've seen about 20 to 30 photos of burnt out communications sites in Oregon and California. Due to the often remote and unstaffed nature of many of these sites, there's a natural tendency for brush, shrubs, grass and small trees to grow close to the tower compounds on many hilltop sites. Many of these sites also support emergency communications services. In the subject line I'm using "fuel" as defined by firefighters, not literally meaning petroleum fuels, but anything flammable. In some places there are ecological or political concerns with maintaining a cleared perimeter around telecom tower sites. This might be a time to re-visit the logical purpose of some of these policies, if allowing fuel to grow right up to the tower and telecom equipment shelters greatly increases the likelihood of the whole thing going up in flames.

3 2