September 2021 - Test - lists.nanog.org

Cisco WAE
by Mark Davis 30 Sep '21

30 Sep '21

Is anyone on the list familiar with configuring WAE to exclude specific devices from collection? Thanks -- Mark William Davis mdavis(a)gmail.com

2 2

Register Now for NANOG 83 + VIDEO | Ep.2 w/ Geoff Huston
by Nanog News 29 Sep '21

29 Sep '21

*NANOG Partners with ICANN + Internet Society* *Collaboration of Resources will Better Serve Communities* In addition to our long-standing relationship with the American Registry for Internet Numbers (ARIN), NANOG would like to also announce a new partnership with the Internet Corporation for Assigned Names and Numbers (ICANN) and the Internet Society. These partnerships will help realize common objectives, promote collaboration, and strengthen the outreach efforts of all the organizations involved. *READ MORE <https://www.nanog.org/stories/nanog-signs-a-memorandum-of-understanding-wit…>* *How will You Attend NANOG 83?* *Register Now In-Person or Virtually* Get excited for hybrid NANOG 83! Expect incredible programming, interactive expos, networking events from the comfort of your home and/or in person. The event will take place Nov. 1 - 3 in Minneapolis, MN, and all programming + networking events will stream live for real-time engagement. *REGISTER NOW <https://www.nanog.org/events/nanog-83/>* *INTERNET INNOVATORS - NEW EPISODE * *WATCH EP. 2 w/ Internet Pioneer Geoff Huston* Leave it to Internet Hall of Fame Global Connector + chief scientist for APNIC, Geoff Huston to make the hairy + scary parts of the Internet almost sound charming. Maybe it's his sparkling wit, pleasant demeanor, (or maybe even) the Australian accent that makes all pills a little easier to swallow. Ep.2 of our new web series, "Internet Innovators" Huston explains why we need to continue to address the elephants in the room. Huston also talks about the importance of developing public speaking skills + "how to make an impact on a room full of geeks." We also get to hear more about Huston's childhood in Australia and what made him the man he is today. Overall, Huston will leave you wanting to ask better questions and think more critically of the digital world around you. *WATCH EP. 2 NOW * <https://www.nanog.org/news-stories/nanog-tv/internet-innovators/geoff-husto…>

1 0

RE: uPRF strict more
by Jean St-Laurent 29 Sep '21

29 Sep '21

I understand better why some prefer acl vs uRpf. For sure, forwarding 400 Gbps of 80B frames is a sign that something bad is happening. 😉 Jean -----Original Message----- From: brad dreisbach <bradd(a)ntt.net> Sent: September 29, 2021 4:18 PM To: Jean St-Laurent <jean(a)ddostest.me> Cc: 'brad dreisbach' <bradd(a)us.ntt.net>; 'Phil Bedard' <bedard.phil(a)gmail.com>; 'North American Network Operators' Group' <nanog(a)nanog.org> Subject: Re: uPRF strict more On Wed, Sep 29, 2021 at 04:07:19PM -0400, Jean St-Laurent wrote: >Thanks a lot for sharing. > >So 100 Gbps at line rate with 80B frames is about ~150 Mpps. > >100 Gbps at line rate with 208B frames is about ~60 Mpps. > >It's a significant penalty. and keep in kind the 4x100 card is 1 port per NPU. they make an 8x100 where the NPU's are shared. it gets even worse. not to single out cisco, this is just how urpf works. juniper had similar penalties, i just cant find the numbers. -b > >Jean > >-----Original Message----- >From: brad dreisbach <bradd(a)us.ntt.net> >Sent: September 29, 2021 3:33 PM >To: Jean St-Laurent <jean(a)ddostest.me> >Cc: 'brad dreisbach' <bradd(a)us.ntt.net>; 'Phil Bedard' ><bedard.phil(a)gmail.com>; 'North American Network Operators' Group' ><nanog(a)nanog.org> >Subject: Re: uPRF strict more > >On Wed, Sep 29, 2021 at 02:54:43PM -0400, Jean St-Laurent wrote: >>Hi Brad, >> >>I'd be interested to hear more about this pps penalty. Do we talk about 5% penalty or something closer to 50%? >> >>Let me know if you still have some numbers close to you related to PPS with uRPF loose. > >iirc, strict vs loose doesnt matter, its still an extra lookup which effects the performance. i was able to find some numbers to give an example. > >the 4x100G tomahawk card was able to pass min frame size(which iirc on >ixia is >80B) at line rate with no features enabled. turn on uRPF and it is only able to pass 208B frames at line rate. > >similar results were seen with several generations of cisco and juniper line cards(if i tested nokia i cant recall, we had stopped doing urpf when they were introduced into the network). > >-b >

1 0

Identifying submarine links via traceroute
by PAUL R BARFORD 29 Sep '21

29 Sep '21

Hello, I am a researcher at the University of Wisconsin. My colleagues at Northwestern University and I are studying submarine cable infrastructure. Our interest is in identifying submarine links in traceroute measurements. Specifically, for a given end-to-end traceroute measurement, we would like to be able to identify when two hops are separated by a submarine cable. Our initial focus has been on inter-hop latency, which can expose long links. The challenge is that terrestrial long-haul links may have the same or longer link latencies as short submarine links. So, we're interested in whether there may be other features (e.g., persistent congestion, naming conventions in router interfaces, peering details, etc.) or techniques that would indicate submarine links. Any thoughts or insights you might have would be greatly appreciated - off-list responses are welcome. Thank you. Regards, PB Paul Barford University of Wisconsin - Madison

4 4

Admin for .tk (not a spam/abuse complaint!)
by Tim Harman 29 Sep '21

29 Sep '21

Hi, If anyone has contact details for the operators of the .tk TLD, could you contact me off-list please? We are unable to contact the authoritive NS for this TLD - it seems our range is on a blacklist or they have some odd route back to us that isn't working. Thus our customers can't resolve any .tk names. I've tried mailing a few @dot.tk (from a host that has no trouble resolving the domain!) but have heard nothing back. Specifically after a contact for whoever maintains ;; ADDITIONAL SECTION: a.ns.tk. 172800 IN A 194.0.38.1 b.ns.tk. 172800 IN A 194.0.39.1 c.ns.tk. 172800 IN A 194.0.40.1 d.ns.tk. 172800 IN A 194.0.41.1 {11:58}~ ➭ dig @194.0.41.1 test.tk ; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> @194.0.41.1 test.tk ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached Many Thanks, Tim

2 1

100GbE beyond 40km
by Randy Carpenter 28 Sep '21

28 Sep '21

How is everyone accomplishing 100GbE at farther than 40km distances? Juniper is saying it can't be done with anything they offer, except for a single CFP-based line card that is EOL. There are QSFP "ZR" modules from third parties, but I am hesitant to try those without there being an equivalent official part. The application is an ISP upgrading from Nx10G, where one of their fiber paths is ~35km and the other is ~60km. thanks, -Randy

18 21

Robocall Mitigation Database Call Blocking Deadline Is Today
by Sean Donelan 28 Sep '21

28 Sep '21

According to the FCC, 4,798 companies had filed in the Robocall Mitigation Database with many hundreds of carriers, including all of the largest phone carriers, certifying to implementation of STIR/SHAKEN standards on their IP networks. Beginning today, if a voice service provider’s certification and other required information does not appear in the FCC’s Robocall Mitigation Database, intermediate providers and voice service providers will be prohibited from directly accepting that provider’s traffic. Note the word "directly." Guess what's going to happen? https://www.fcc.gov/document/fcc-robocall-mitigation-database-call-blocking…

1 0

What happens when you don't validate/scrub data on input from whois
by Eric Kuhnke 28 Sep '21

28 Sep '21

https://research.securitum.com/fail2ban-remote-code-execution/ What happens if you put the following in your whois entry: drop table prefixes; Or anything similar... https://xkcd.com/327/

1 0

VoIP Provider DDoSes
by Mike Hammett 28 Sep '21

28 Sep '21

As many may know, a particular VoIP supplier is suffering a DDoS. https://twitter.com/voipms Are your garden variety DDoS mitigation platforms or services equipped to handle DDoSes of VoIP services? What nuances does one have to be cognizant of? A WAF doesn't mean much to SIP, IAX2, RTP, etc. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

10 15

Rack rails on network equipment
by Andrey Khomyakov 27 Sep '21

27 Sep '21

Hi folks, Happy Friday! Would you, please, share your thoughts on the following matter? Back some 5 years ago we pulled the trigger and started phasing out Cisco and Juniper switching products out of our data centers (reasons for that are not quite relevant to the topic). We selected Dell switches in part due to Dell using "quick rails'' (sometimes known as speed rails or toolless rails). This is where both the switch side rail and the rack side rail just snap in, thus not requiring a screwdriver and hands of the size no bigger than a hamster paw to hold those stupid proprietary screws (lookin at your, cisco) to attach those rails. We went from taking 16hrs to build a row of compute (from just network equipment racking pov) to maybe 1hr... (we estimated that on average it took us 30 min to rack a switch from cut open the box with Juniper switches to 5 min with Dell switches) Interesting tidbit is that we actually used to manufacture custom rails for our Juniper EX4500 switches so the switch can be actually inserted from the back of the rack (you know, where most of your server ports are...) and not be blocked by the zero-U PDUs and all the cabling in the rack. Stock rails didn't work at all for us unless we used wider racks, which then, in turn, reduced floor capacity. As far as I know, Dell is the only switch vendor doing toolless rails so it's a bit of a hardware lock-in from that point of view. *So ultimately my question to you all is how much do you care about the speed of racking and unracking equipment and do you tell your suppliers that you care? How much does the time it takes to install or replace a switch impact you?* I was having a conversation with a vendor and was pushing hard on the fact that their switches will end up being actually costlier for me long term just because my switch replacement time quadruples at least, thus requiring me to staff more remote hands. Am I overthinking this and artificially limiting myself by excluding vendors who don't ship with toolless rails (which is all of them now except Dell)? Thanks for your time in advance! --Andrey

31 44