May 2023 - Test - lists.nanog.org

NANOG 88 Peering Forum + Sponsorships + More
by Nanog News 11 May '23

11 May '23

*Have You Signed Up For the Peering Forum Yet?* *A 90-minute Session to be Held on 12-Jun During NANOG 88 Conference* NANOG 88 Peering Coordination Forum applications open! The forum allows attendees to meet and network with others in the peering community present at NANOG. Applications will remain open until 20 applications are received or 5-Jun-2023, whichever is first. *MORE INFO * <https://nanog.org/events/nanog-88/peering-forum/> *Seattle Sponsorships Still Available! * *Invest in the Strength of the Community We've Built* - Showcase your newest technologies + solutions - Increase your brand’s visibility + reach - Amplify your organization’s message - Connect with industry influencers + decision-makers - Empower people + inspire change *MORE INFO <https://nanog.org/participate/nanog-sponsorship-opportunities-working/>* *Did You Know There is a Running Affinity Group at NANOG?* *Find Community in our Online Discussion Threads* The NANOG Affinity Groups are part of the Community Forum and allow our members to connect over shared interests. We need your voice! Connect with others in the tech industry and find mentorship and support while sharing your experiences. *MORE INFO * <https://community.nanog.org/c/running/40>

1 0

Best Linux (or BSD) hosted BGP?
by Bryan Fields 11 May '23

11 May '23

I know best subjective, but I'm looking at a project to announce some IP space that's between uses now and see what's there. I'm planing to run a flow logger and ntop on the VM and see what is coming in if anything. I'm looking at the options for BGP out there, and there's quite a few (other than running a VM with a router doing BGP), but most data I've seen is focused on scale and filtering use, or RPKI. My use case is a bit different, and I can't find any best practices for this use case from what I've found. That said, is there a better solution other than linux/ntop/ipt-netflow? -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net

18 37

Aptum refuses to SWIP
by Lyndon Nerenberg (VE7TFX/VE6BBM) 10 May '23

10 May '23

It seems Aptum has decided they will no longer SWIP any of their address space. I've been trying to get a SWIP for a /48 that we were allocated in 2017, but they refuse. And I also see they have pro-actively gone in and un-SWIPed both our /24s. Since you are ignoring my tickets about this, maybe somebody from Aptum would care to speak up in public and defend this "policy?" --lyndon

11 17

webex.com DNS Contact - Possibly Broken DNSSEC?
by Reuben Farrelly 10 May '23

10 May '23

Does anyone know of a contact of someone (presumably at Webex/Cisco) who can take a look at the DNS for webex.com? It has been for some time now, logging a lot of DNSSEC warnings on my resolver: dnssec: validating external-media75.public.wnrtm-a-2.prod.infra.webex.com/NSEC: no valid signature found: 1 Time(s) dnssec: validating external-media75.public.wsinm-a-3.prod.infra.webex.com/NSEC: no valid signature found: 1 Time(s) dnssec: validating external-media78.public.wbomm-a-2.prod.infra.webex.com/NSEC: no valid signature found: 1 Time(s) dnssec: validating external-media8.public.wnrtm-a-2.prod.infra.webex.com/NSEC: no valid signature found: 1 Time(s) (and a whole lot more hostnames in the same domain). Some basic DNSSec analysis indicates something in the middle of the trust chain is broken: https://dnssec-analyzer.verisignlabs.com/external-media26.public.wjfkm-a-3.… It looks to me like the subdomains have DS records but the other parts of the subdomain don't and I guess there's no point in having DS records on host records, if the parent domain doesn't have them too. I wouldn't bother if it was one or two entries, but it looks like the whole domain is affected and this probably is a fairly widely utilised domain. Thanks, Reuben

2 1

Spoofer Report for NANOG for Apr 2023
by CAIDA Spoofer Project 08 May '23

08 May '23

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Apr 2023: ASN Name Fixed-By 41378 KirinoNET 2023-04-02 14361 HOPONE-GLOBAL 2023-04-11 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Apr 2023: ASN Name First-Spoofed Last-Spoofed 6939 HURRICANE 2016-02-22 2023-04-18 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2023-04-27 6128 CABLE-NET-1 2016-09-03 2023-04-22 20412 CLARITY-TELECOM 2016-09-30 2023-04-29 6181 FUSE-NET 2016-10-10 2023-04-02 25787 ROWE-NETWORKS 2016-10-21 2023-04-27 10796 TWC-10796-MIDWEST 2016-10-24 2023-04-29 271 BCNET 2016-10-24 2023-04-29 1403 EBOX 2016-11-12 2023-04-11 852 ASN852 2017-04-16 2023-04-30 7122 MTS-ASN 2017-05-16 2023-04-30 6461 ZAYO-6461 2017-06-21 2023-04-04 12222 AKAMAI 2018-02-14 2023-04-03 33452 RW 2018-09-19 2023-04-09 398836 2021-03-12 2023-04-24 22773 ASN-CXA-ALL-CCI-22773-RDC 2021-10-24 2023-04-27 26231 SFIA-ASN 2021-10-27 2023-04-29 46997 2021-12-22 2023-04-26 394414 E2WS 2022-05-08 2023-04-25 59 WISC-MADISON 2022-06-14 2023-04-25 397086 GLOBAL-FRAG-NETWORKS-HOUSTON 2022-06-16 2023-04-30 11976 FIDN 2022-11-16 2023-04-25 12183 TALKIE-COMMUNICATIONS 2022-12-10 2023-04-27 399852 2023-02-16 2023-04-27 211380 2023-03-15 2023-04-26 964 GONET-ASN-17 2023-03-15 2023-04-28 41378 KirinoNET 2023-03-23 2023-04-27 23352 SERVERCENTRAL 2023-04-04 2023-04-22 15305 SYRINGANETWORKS 2023-04-05 2023-04-05 14361 HOPONE-GLOBAL 2023-04-11 2023-04-11 395418 ARIN-CHA 2023-04-14 2023-04-16 3701 NERONET 2023-04-18 2023-04-25 855 CANET-ASN-4 2023-04-26 2023-04-29 18615 MAINSTREAM-FIBER 2023-04-30 2023-04-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

SAFNOG-8 Programme Committee - Call For PC Volunteers
by Mark Tinka 07 May '23

07 May '23

Hi all. The SAFNOG-8 Organizing Committee would like to welcome everyone to join us in Lusaka, Zambia, 29th - 30th August, 2023. The SAFNOG-8 Programme Committee (PC) are responsible for the solicitation and selection of suitable presentation and tutorial content for the SAFNOG-8 conference (https://safnog.org/) We are now seeking nominations from the community to join the SAFNOG-8 PC to assist with the development of the programme for SAFNOG-8. Eligible PC candidates must have attended recent SAFNOG events, have broad technical knowledge of Internet operations, and have good familiarity with the format of SAFNOG. Having constructive opinions and ideas about how the programme content might be improved is of high value too. PC members are expected to work actively to solicit content and review submissions for technical merit. The PC meets by conference call, weekly in frequency during the three months leading up to SAFNOG. If you are interested in joining the PC and meet the above eligibility criteria, please send a brief note to: safnog-pc-chairs at lists.safnog.org The note must include affiliation (if any) and a brief description about why you would make a good addition to the PC. The PC Chairs will accept nominations received by 1600hrs UTC+2 on Friday 26th May, 2023, and will announce the new PC shortly thereafter. Thanks. Mark Tinka For the SAFNOG-8 Organizing Committee

1 0

Cisco Nexus 3k Route Selection\Packet Forwarding Debugging
by Mike Hammett 06 May '23

06 May '23

We have a Nexus 3064 that is setup with partial BGP tables and is routing based on that. I've done a show ip bgp for an IP of interest and it has an expected next hop IP. I show ip arp on that next hop IP and it has the expected interface. However, sFlows show the packets leaving on a different interface, the one that would carry the default route for routes not otherwise known. If the next hop IP is expected and the ARP of that next hop IP is expected, why are packets leaving out an unexpected interface? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

7 21

Re: Routed optical networks
by Jared Brown 05 May '23

05 May '23

On 5/5/23, Mark Tinka wrote: > Juxtapose that against 100Gbps pricing: > > * EUR473 @ 10km. > * EUR1,300 @ 25km. > * EUR1,500 @ 30km. > * EUR2,600 @ 40km. > * EUR3,925 @ 80km. You can get 100G optics for less than half those prices. For reference, here are publicly listed prices for optics from an European vendor I have in production: 100G 4WDM & CLR4 QSFP28 * 10 km * 225€ 100GBASE-LR4 & OTU4 & 128GFC QSFP28 * 20km *305€ 100GBASE-ER4 Lite & OTU4 & 128GFC QSFP28 * 40 km * 1030€ 100GBASE-ZR4 QSFP28 * 80 km * 1650€ 100GBASE-ZR4+ QSFP28 * 100 km * 2100€ These prices are for single units without discounts. - Jared

2 1

RE: Routed optical networks
by Vasilenko Eduard 05 May '23

05 May '23

> Yeah, you sound like an equipment vendor whose main customers are incumbent telco's in a few rich markets :-). You are right. My message was pretty much geared toward incumbents. But the majority of the access/aggregation is in their possessions, isn’t it? They typically have ducts that were huge for copper that is already extracted. One more fiber cable would be easy. Agree that for competitive carriers DWDM would be more often needed. Even for competitive carriers, it makes sense to evaluate the cost to put fiber into the duct of incumbents. Especially because in some countries the price would be regulated. It would solve the problem forever – no need for the DWDM speed upgrade. I am calling to just not forget to evaluate this option too. Reminder: dark fiber is the best technical solution, for sure. Ed/ From: Mark Tinka [mailto:mark@tinka.africa] Sent: Wednesday, May 3, 2023 11:39 AM To: Vasilenko Eduard <vasilenko.eduard(a)huawei.com>; nanog(a)nanog.org Subject: Re: Routed optical networks On 5/3/23 08:20, Vasilenko Eduard wrote: I would risk to say a little more on this. Indeed, maybe the situation (in many countries) when the Carrier sells a lot of TDM services. But in general, packet services are enough these days for many carriers/regions. There aren't enough TDM services to warrant DWDM, nowadays. The reason for DWDM is mainly being driven by Ethernet, and IP. At any reasonable scale, it's actually pretty hard to buy a TDM service, in most markets. Additionally, I am sure that in many countries/Metro it is cheaper to lay down a new fiber than to provision DWDM, even if it is a pizza box. I disagree. Existing fibre may be cheap because it was laid down a decade or more ago, en masse, by several operators. So the market would be experiencing a glut, not because it is cheap to open up the roads and plant more fibre, but because there is so much of it to begin with. At worst, there is still enough duct space that the operator can blow more fibre. But when that duct gets full, and there are no more free ducts available, or another route needs to get built for whatever reason, it is a rather costly affair to open up the roads and trunk some fibre, in any market. So no, DWDM is not more expensive, if you are delivering services at scale. It is actually cheaper. It is only more expensive if you are small scale, because in some markets, the fibre glut means you can buy dark fibre for cheaper than you can light it with DWDM. But this is a situation unique to small operators, not large ones. The colored interface is still very expensive. This only matters for the line side. For client-facing, it's not a drama. And you typically buy more optics for the client side than you do the line side. Of course, there are some Cities (not “towns”) where it is very expensive or maybe even impossible to lay down a new fiber. Yes, in the majority of cases, it is cheaper to lay down fiber. I think what you mean to say is that in the majority of cases where there is fibre glut, and dark fibre is a market option, buying fibre is cheaper than lighting it with DWDM. This is true. But I think that on a global scale, this is the exception, not the rule. In general, you are not likely to be able to buy dark fibre, cheaply or otherwise, if you look at all markets in the world. Hence, the importance of DWDM for the Metro is overestimated. Again, only if you are small scale. If you are a large scale operator with as many IP/Ethernet customers as you have Transport, DWDM is essential. Use only routers. Provision enough fiber. Have always 1 router hop to the aggregation (hub-spoke topology), no routers chaining in the ring. If fiber is not enough – then use normal DWDM with an external transponder. Routers would be still in hub-spoke topology. Yeah, you sound like an equipment vendor whose main customers are incumbent telco's in a few rich markets :-). The life of the average operator, around the world, is far less glamorous. Mark.

3 4

RE: Routed optical networks
by Vasilenko Eduard 05 May '23

05 May '23

Hi Mark, Thanks a lot for many of your valuable comments I almost always agree. 1. I agree that 50GE has not got the same popularity as 100GE. Many vendors did ignore it for some time. Looks like not many ignore it now. 2. Even in your example for 40km, 100GE is about twice more expensive than 50GE. 3. Hence, I have to google for the cheaper proposition in 10km. For obvious reasons, I could not reference my employer (my assumption about the cost is based on this comparison). https://opticswave.com/collections/50g-qsfp28 https://www.compufox.com/50G_QSFP28_Transceivers_s/3036.htm https://www.genuinemodules.com/033030600050 Looks like I have found twice cheaper in public information. 4. Pay attention that bidirectional is available too. 5. The public price is not what you get in the real tender. We are talking about big networks, hence, big tenders. Eduard From: Mark Tinka [mailto:mark@tinka.africa] Sent: Friday, May 5, 2023 1:17 PM To: Vasilenko Eduard <vasilenko.eduard(a)huawei.com>; nanog(a)nanog.org Subject: Re: Routed optical networks On 5/5/23 10:54, Vasilenko Eduard wrote: 50GE is better just because it is half of the cost of 100GE and it is enough now for the great majority of cases. Money is very important these days for this industry. 100GE single mode is more expensive than the best router port itself. Routers have been deprecated 10x for the decade (almost 100x for 2 decades). Pluggable optics is not that much deprecated. Not sure where your pricing is coming from, but if I look at Flexoptix's 50Gbps QSFP28 optics pricing, I am getting: * EUR724 @ 10km. * EUR1,246 @ 40km. They are also selling an SFP56 LR for EUR925. Juxtapose that against 100Gbps pricing: * EUR473 @ 10km. * EUR1,300 @ 25km. * EUR1,500 @ 30km. * EUR2,600 @ 40km. * EUR3,925 @ 80km. Doesn't immediately seem to me that 50Gbps is cheaper than 100Gbps. There also don't seem to be as many deployments of 50Gbps in the metro (same could be said for 25Gbps and 40Gbps), but others on the list can chime in with what they are seeing/doing. I do not think that content provider guys call their DCI “Metro”, not very often. Well, whatever they call it, the concept is the same - move lots of traffic across town between data centres. I agree that 100GE for DCI is the minimum, 400GE is probably already needed in some places. IMHO: it is a different story. Very interested too. Most content providers have no choice but to run DWDM, for even very short spans between data centres. That is because it is just cheaper and simpler to pack Tbps of capacity in DWDM for the price than you can in a router. And besides, most routers don't need to carry Tbps of traffic in a single line card, which would be a waste of a fibre pair over that distance. In such cases, better to use DWDM and drop capacity on individual routers and/or line cards as you see fit. PS: By the way, even if some ISP has 50% of revenue from Enterprise services (it is probably the biggest number, typically 30%-40%), it is still just 5% compare to residential traffic. Traffic to enterprises is still sold 4x-10x (depending on the country). That is why residential Access networks tend to be 2nd class citizens :-). Hence, Enterprise does not make sense to mention in the traffic discussion. It is a “rounding error”. Enterprise business created a huge demand for oversubscribed ports to connect Enterprises. And QoS/QoE. Not traffic. Well, not all operators that offer enterprise services also do consumer broadband, or vice versa. To a network doing only one or the other, whatever traffic they are carrying means the world to them. It's not ours to decide what is high or low traffic... that priviledge always remains with the network operator. Mark.

2 1