April 2021 - Test - lists.nanog.org

Cloudflare OCTO RPKI Validator - LACNIC CAs issues
by Douglas Fischer 23 Apr '21

23 Apr '21

Does anybody else have problems with Cloudflare's RPKI Validator with prefixes from LACNIC? Customers were sending us some reports of issues with LACNIC's IPBlocks using Cloudflare RPKI as source of validation. A friend and I did some checks. And looks like that some issue is happening on the Lacnic Trust Anchor, specifically on OctoRPKI. We took the Registro.Br Prefix to do the tests -> 200.160.0.0/20 -> AS22548 -> On Cloudflare https://rpki.cloudflare.com/?view=validator&validateRoute=22548_200.160.0.0… AS22548_200.160.0.0/20 is Unknown at 19:30 20201-04-22 https://pasteboard.co/JYy8fjI.png -> On Ripe https://rpki-validator.ripe.net/bgp-preview AS22548_200.160.0.0/20 is Valid at 19:30 20201-04-22 https://pasteboard.co/JYycsd4.png An interesting thing is that on the graph of ROAs over Timer of the Lacnic Trust Anchor shows a big drop on 20201/04/19. https://rpki.cloudflare.com/?ohlcTa=LACNIC "Volume Removed: 14.761" "ROAs Removed: 13.392" https://pasteboard.co/JYyeSaw.png Any idea of possible causes? Any suggestions on how to solve it? -- Douglas Fernando Fischer Engº de Controle e Automação

2 2

RE: Cloudflare OCTO RPKI Validator - LACNIC CAs issues
by Colin McIntosh 22 Apr '21

22 Apr '21

> Does anybody else have problems with Cloudflare's RPKI Validator with prefixes from LACNIC? We (Netflix) briefly saw Cloudflare's public instance of OctoRPKI missing some ~13,000 ROAs on 2021-03-24 at ~12:30pm PT while our internal instance of OctoRPKI had a complete list. Upon comparing the two lists Cloudflare's instance seemed to be missing ROAs from only LACNIC so I'm thinking we saw the same issue that you did. I haven't had a chance to really look into it and AFAIK we haven't noticed the issue since but my guess for what's happening is that OctoRPKI hits an error while downloading the ROAs from LACNIC but then continues to collect ROAs from the other RIRs resulting in an incomplete list. This seems to be the case from a quick glance at the code: https://github.com/cloudflare/cfrpki/blob/master/cmd/octorpki/octorpki.go#L… This could probably be changed to instead break out of that loop and propagate the error up to the main loop to let it continue without building an incomplete ROA list, but that's just a quick guess... it's possible that it's built this way for a reason or there may be a better way to handle that failure mode. -Colin

1 0

Re: Submitting Fake Geolocation for blocks to Data Brokers and RIRs
by nanoguser100 22 Apr '21

22 Apr '21

William, The plan is to carve out a /24 for "Estonia" and have special servers on it. This would be the same /24 I'd have to use if I were to put a legitimate POP there. This also means I don't conflict with the real Germany. I am just worried about violating the 'rules' of these providers and getting myself blacklisted from submitting corrections. Afterall the traceroute will still show us hitting a router in Germany before it hits my network. Traceroutes aren't the end all be all but it's a tell-tale sign. I guess this is all ISP-reported info so it's not "illegal" or a violation in any way. -Nanoguser100 Sent with ProtonMail Secure Email. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Wednesday, April 21, 2021 4:31 PM, William Herrin <bill(a)herrin.us> wrote: > On Wed, Apr 21, 2021 at 12:35 PM nanoguser100 > nanoguser100(a)protonmail.com wrote: > > > providing cloud hosted desktop solutions for end users. > > I missed this on the first read. Virtual Desktop along the lines of > Azure Virtual Desktop, Google VDI or Amazon Workspaces. > > I would emphasize this; it'll help folks on the group offer better information. > > > We are not a VPN per-se, it's more of a cloud hosted remote desktop service. We do have a VPN service as well which provides security services. > > That's a really interesting question. Some uses of geolocation will > give suboptimal results if you pick Estonia since the packets need to > go to Germany. Others, like content restriction, won't work right > unless the IPs reflect the users' location. > > Generally, I think the geolocation is represented as the rough region > where the servers are, with services that care about geolocation for > content restriction intentionally disallowing them. That's the safe > answer. For the alternative, I expect the different consumers of > geolocation services will have different opinions about it. > > > With that being said is it proper for transit providers to advertise the IP of their end users? > > Yes. > > > Are we considered a true transit provider since we are not an ISP per-se? > > No. It's not whether you're an ISP, the IP packets are stopping at > your network; you're not transiting them onward. > > Regards, > Bill Herrin > > -------------------------------------------------------------------------------------------------------------------------------------------- > > William Herrin > bill(a)herrin.us > https://bill.herrin.us/

3 2

Geo location Contacts
by Brian 21 Apr '21

21 Apr '21

Good day all. I am trying to find contacts at ipdata.co and ipinfo.io. I recently acquired new ip space and most places have updated. But the above 2 have not and still show CA as the location for this ip space. Please feel free to email me off the list. Thank you Brian

4 3

BGP and The zero window edge
by Jean St-Laurent 21 Apr '21

21 Apr '21

Nice article explaining a specific BGP corner case not removing routes when TCP window reaches 0. https://blog.benjojo.co.uk/post/bgp-stuck-routes-tcp-zero-window The proposed solution is a new RFC for BGP with the suggestion to introduce a new timer. Fascinating! Jean St-Laurent /CISSP ddosTest me security inc site: https://ddostest.me

1 0

Malicious SS7 activity and why SMS should never by used for 2FA
by Eric Kuhnke 20 Apr '21

20 Apr '21

https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c413… https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-no… Anecdotal: With the prior consent of the DID holders, I have successfully ported peoples' numbers using nothing more than a JPG scan of a signature that looks like an illegible 150 dpi black and white blob, pasted in an image editor on top of a generic looking 'phone bill'.

15 47

Zayo or HE for IP transit
by James Lumby 20 Apr '21

20 Apr '21

What is the current experience with Zayo or HE? I'm looking at possibly adding one of them into a mix of cogent and a mix from my datacenter. Would be using BGP full routes. Any experiences would be appreciated. Sincerely, James

8 7

Carriers need to independently verify LOAs
by Sean Donelan 19 Apr '21

19 Apr '21

On Sat, 17 Apr 2021, Eric Kuhnke wrote: > Anecdotal: With the prior consent of the DID holders, I have successfully > ported peoples' numbers using nothing more than a JPG scan of a signature > that looks like an illegible 150 dpi black and white blob, pasted in an > image editor on top of a generic looking 'phone bill'. All carriers should independently verify any LOAs received for account changes. Documents received from third-parties, without independently verifying with the customer of record, using the carriers own records, are just junk papers. Almost no carriers verify LOAs by contacting the customer of record. Worse, they call the phone number on the letterhead provide by the scammer for "verification." The U.S. Postal Service used to let random people change mail forwarding orders, without verifying with the original and new addresses. As you can guess, there were lots of fake forwarding orders and criminal activity. After USPS begin verifying mail forwarding orders by sending a letter to the ORIGINAL address and NEW address, mail forwarding fraud declined. Not zero, but declined.

4 4

Anyone from Proof Point or Comcast on this list?
by Matt Hoppes 19 Apr '21

19 Apr '21

It seems we are having trouble sending e-mail to some Comcast customers and getting a relaying denied message, even though the mail should be being accepted, not relayed. Below is a copy of a transcript. Could someone from Proof Point or Comcast e-mail please contact me to resolve this? [root@account ~]# dig mx comcast.com ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> mx comcast.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32690 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;comcast.com. IN MX ;; ANSWER SECTION: comcast.com. 9 IN MX 5 mxb-00143702.gslb.pphosted.com. comcast.com. 9 IN MX 5 mxa-00143702.gslb.pphosted.com. ;; Query time: 0 msec ;; SERVER: 172.16.0.21#53(172.16.0.21) ;; WHEN: Mon Apr 19 12:33:57 EDT 2021 ;; MSG SIZE rcvd: 112 [root@account ~]# telnet mxb-00143702.gslb.pphosted.com 25 Trying 148.163.141.77... Connected to mxb-00143702.gslb.pphosted.com. Escape character is '^]'. 220 mx0b-00143702.pphosted.com ESMTP mfa-m0184889 helo rivervalleyinternet.net 250 mx0b-00143702.pphosted.com Hello [192.81.87.236], pleased to meet you mail from:info@rivervalleyinternet.net 250 2.1.0 Sender ok rcpt to:dr[redacted]@comcast.net 550 5.7.1 Relaying denied

4 3

BGP Graceful Restart
by Graham Johnston 17 Apr '21

17 Apr '21

I do believe that I understand the intended purpose of BGP graceful-restart. With that said, I was watching a video of a talk given by someone respected in the industry the other day on the use of graceful-shutdown and at the beginning of the talk there was a quick disclaimer that his topic had nothing to do with graceful-restart along with some text on the slide that provided me a clear indication that he was not a fan of graceful-restart. Largely, I suspect that his point was that if you otherwise do the right things during maintenance that graceful-restart has the potential of being really problematic if things go wrong, and thus he was discouraging the use of it. Is there consensus as to whether graceful-restart has any place in a service provider network? Thanks, Graham

5 4