- Test - lists.nanog.org

Re: Time Warner Cable YouTube throttling
by John Zettlemoyer 07 Mar '13

07 Mar '13

I've been seeing the same thing and was thinking it was me. Just to add to some of the results here... Verizon FIOS 1 32 ms 3 ms 5 ms l100.cmdnnj-vfttp-27.verizon-gni.net [98.110.113.1] 2 33 ms 6 ms 7 ms g0-3-3-7.cmdnnj-lcr-22.verizon-gni.net [130.81.183.186] 3 22 ms 22 ms 21 ms xe-4-1-8-0.ny5030-bb-rtr2.verizon-gni.net [130.81.209.84] 4 22 ms 21 ms 21 ms 0.so-0-0-0.xt2.nyc4.alter.net [152.63.17.21] 5 58 ms 24 ms 24 ms tengige0-5-4-0.gw8.nyc4.alter.net [152.63.18.206] 6 * 76 ms 76 ms google-gw.customer.alter.net [152.179.72.62] 7 25 ms 21 ms 24 ms 209.85.255.68 8 21 ms 34 ms 34 ms 209.85.252.242 9 30 ms 28 ms 31 ms 209.85.249.11 10 31 ms 29 ms 29 ms 72.14.236.149 11 38 ms 36 ms 36 ms 72.14.238.173 12 31 ms 29 ms 31 ms iad23s05-in-f8.1e100.net [74.125.228.8] Comcast 1 33 ms 15 ms 25 ms 68.38.220.1 2 8 ms 10 ms 15 ms xe-11-3-0-0-sur01.burlington.nj.panjde.comcast.net [68.85.128.237] 3 10 ms 9 ms 9 ms xe-13-0-0-0-ar03.audubon.nj.panjde.comcast.net [68.85.62.89] 4 14 ms 15 ms 15 ms pos-3-6-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.92.161] 5 15 ms 13 ms 14 ms pos-0-0-0-0-pe01.ashburn.va.ibone.comcast.net [68.86.86.26] 6 * 23 ms 25 ms 75.149.231.62 7 17 ms 15 ms 14 ms 209.85.252.46 8 17 ms 16 ms 15 ms 72.14.238.173 9 17 ms 15 ms 16 ms iad23s05-in-f8.1e100.net [74.125.228.8] Our datacenter 1 <1 ms <1 ms <1 ms static.razorinc.net [70.34.208.101] 2 <1 ms <1 ms <1 ms 70.34.251.9 3 <1 ms <1 ms <1 ms xe-0-2-0.phi10.ip4.tinet.net [199.168.63.233] 4 2 ms 3 ms 2 ms xe-7-2-1.was14.ip4.tinet.net [89.149.181.174] 5 3 ms 3 ms 3 ms 72.14.213.61 6 4 ms 4 ms 4 ms 216.239.46.248 7 5 ms 5 ms 5 ms 72.14.238.173 8 5 ms 5 ms 5 ms iad23s05-in-f8.1e100.net [74.125.228.8] It would be nice if the ISPs and content providers could work out something when dealing with this much traffic and clearly needing to add capaicty. It's nice to dream too... John

6 6

Need a Level3 Contact
by Brian 07 Mar '13

07 Mar '13

Hi, I have a prefix that isn't being accepted by Level3. Can someone from Level3 could contact. Off list is fine. -brian

1 0

Dreamhost/AS26347 unauthorized bgp announcement
by Matsuzaki Yoshinobu 07 Mar '13

07 Mar '13

According to RIPE RIS, AS26347 announced a bunch of prefixes again. - http://www.ris.ripe.net/dashboard/26347 First suspicious announcement was started 2013-03-06 07:52:40 UTC, and last seen 2013-03-06 08:33:56 UTC. 195 prefixes total. It seems these unauthorized announcements have the same profile as before - AS26347 shrinks the prefix lenght of their received prefix somehow upto /20, and re-originates the prefix with origin AS26347. Any known bugs? Regards, ----- Matsuzaki Yoshinobu <maz(a)iij.ad.jp> - IIJ/AS2497 INOC-DBA: 2497*629

5 6

Re: Time Warner Cable YouTube throttling
by Derek Ivey 07 Mar '13

07 Mar '13

On Mar 6, 2013, at 10:30 PM, "Robert M. Enger" <enger(a)enger.us> wrote: > > 1) You can use wireshark or other monitor to determine the IP address that your video stream is originating from. I just used the Developer Tools in Google Chrome to figure this out. > > 2) Upstream traceroutes to that address are probably not of that much interest. The downstream path (carrying the video from the server to your house) can follow a different path. Downstream traceroute is what is needed. Good point. > > 3) Before pointing fingers at anyone, you need to get your own house (literally) in order. Get off wifi, that is just muddying the water. Shutdown wifi so there are no other users. Get off MocA. You need to be all hard-wired and totally error free and reliable in your local LAN before you can cast stones at carriers and/or inter-carrier interconnection Agreed. My trace routes were straight from my pfsense firewall, which is connected to my ONT via ethernet (I specifically asked Verizon to turn the ethernet port on instead of MoCA when I had it setup over 2 years ago). Derek

1 0

Re: Time Warner Cable YouTube throttling
by Grant Ridder 07 Mar '13

07 Mar '13

One thing to keep in mind is that youtube may be anycast. Google's distributed file system is pretty amazing and it could be traffic to one specific datacenter that is possibly slow. -Grant On Wed, Mar 6, 2013 at 8:47 PM, Min <qiu.min98(a)gmail.com> wrote: > I use FIOS. In my case, I suspected two things. > > 1. congestion (my first hub appeared over subscribed) > 2. packet out of order (high packet drop in alternet-google could be > a symptom of multipath) > > Not sure which has bigger performance impact to youtube. > > Min > > On Wed, Mar 6, 2013 at 9:35 PM, Grant Ridder <shortdudey123(a)gmail.com> > wrote: > > The 1st one gets slow at XO and the 2nd and 3rd get slow at Sprint. > > > > Now the interesting one with XO is that it is routed in a /30 that is > > assigned to Google by XO. > > > > network:Class-Name:network > > network:ID:NET-XO-NET-d1302a54 > > network:Auth-Area:209.48.0.0/15 > > network:Network-Name:XO-NET-d1302a54 > > network:Organization;I:GOOGLE INC. (328874-1) > > network:IP-Network:209.48.42.84/30 > > network:Admin-Contact;I:XCIA-ARIN > > network:Tech-Contact;I:XCIA-ARIN > > network:Created:20120917 > > network:Updated:20121018 > > network:Updated-By:ipadmin@eng.xo.com > > > > -Grant > > > > On Wed, Mar 6, 2013 at 8:25 PM, Min <qiu.min98(a)gmail.com> wrote: > >> > >> 3 traces all indicated the last hub are 80~100ms faster than the > >> second last hub. Interesting. > >> > >> Min > >> > >> On Wed, Mar 6, 2013 at 9:07 PM, Derek Ivey <derek(a)derekivey.com> wrote: > >> > I just got home and tested with quite a few 1080p videos. No issues > over > >> > my > >> > Hurricane Electric IPv6 tunnel. I did notice frequent stops to buffer > on > >> > my > >> > FiOS IPv4 connection. I have a 50 Mbps down connection and don't even > >> > come > >> > close to maxing it when watching Youtube videos. > >> > > >> > Here are a few traceroutes: > >> > > >> > [2.1-BETA0][root@pfsense]/root(1): traceroute > >> > r19---sn-p5qlsm7d.c.youtube.com > >> > traceroute to r19.sn-p5qlsm7d.c.youtube.com (208.117.251.184), 64 > hops > >> > max, > >> > 40 byte packets > >> > 1 L100.HRBGPA-VFTTP-12.verizon-gni.net (98.117.0.1) 1.222 ms > 1.348 ms > >> > 0.834 ms > >> > 2 G10-0-8-112.HRBGPA-LCR-01.verizon-gni.net (130.81.184.148) 2.839 > ms > >> > 2.589 ms 2.443 ms > >> > 3 P12-0-0.HRBGPA-LCR-02.verizon-gni.net (130.81.27.185) 14.880 ms > >> > 14.614 > >> > ms 14.698 ms > >> > 4 so-12-1-0-0.RES-BB-RTR1.verizon-gni.net (130.81.28.254) 14.647 ms > >> > 14.696 ms 14.552 ms > >> > 5 0.xe-3-1-1.BR1.IAD8.ALTER.NET (152.63.37.141) 15.027 ms 15.004 > ms > >> > 15.064 ms > >> > 6 te9-2-0d0.cir1.ashburn-va.us.xo.net (206.111.0.201) 38.517 ms > >> > 36.033 > >> > ms 34.816 ms > >> > 7 216.156.8.189.ptr.us.xo.net (216.156.8.189) 31.958 ms 30.994 ms > >> > 29.194 ms > >> > 8 209.48.42.86 (209.48.42.86) 124.931 ms 126.117 ms 124.303 ms > >> > 9 208.117.251.184 (208.117.251.184) 26.483 ms 27.792 ms 27.974 ms > >> > > >> > [2.1-BETA0][root@pfsense]/root(2): traceroute > >> > r15---sn-p5qlsm76.c.youtube.com > >> > traceroute to r15.sn-p5qlsm76.c.youtube.com (208.117.251.148), 64 > hops > >> > max, > >> > 40 byte packets > >> > 1 L100.HRBGPA-VFTTP-12.verizon-gni.net (98.117.0.1) 1.077 ms > 0.863 ms > >> > 0.968 ms > >> > 2 G10-0-8-112.HRBGPA-LCR-01.verizon-gni.net (130.81.184.148) 2.429 > ms > >> > 2.265 ms 2.456 ms > >> > 3 P12-0-0.HRBGPA-LCR-02.verizon-gni.net (130.81.27.185) 14.788 ms > >> > 14.666 > >> > ms 14.643 ms > >> > 4 so-12-1-0-0.RES-BB-RTR1.verizon-gni.net (130.81.28.254) 14.591 ms > >> > 14.479 ms 16.041 ms > >> > 5 0.xe-10-0-0.BR2.IAD8.ALTER.NET (152.63.38.165) 15.007 ms 15.109 > ms > >> > 14.975 ms > >> > 6 144.232.8.209 (144.232.8.209) 187.038 ms 115.363 ms 117.669 ms > >> > 7 sl-st31-ash-0-4-0-0.sprintlink.net (144.232.28.6) 116.263 ms > >> > sl-st31-ash-0-8-0-2.sprintlink.net (144.232.1.19) 116.491 ms > >> > sl-st31-ash-0-4-0-0.sprintlink.net (144.232.28.6) 116.934 ms > >> > 8 sl-googl10-584821-0.sprintlink.net (144.228.205.34) 122.521 ms > >> > 122.780 > >> > ms 121.535 ms > >> > 9 208.117.251.148 (208.117.251.148) 33.669 ms 37.652 ms 38.478 ms > >> > > >> > [2.1-BETA0][root@pfsense]/root(6): traceroute > >> > r10---sn-p5qlsm7l.c.youtube.com > >> > traceroute to r10.sn-p5qlsm7l.c.youtube.com (208.117.251.47), 64 hops > >> > max, > >> > 40 byte packets > >> > 1 L100.HRBGPA-VFTTP-12.verizon-gni.net (98.117.0.1) 1.159 ms > 0.831 ms > >> > 0.806 ms > >> > 2 G9-0-4-212.HRBGPA-LCR-02.verizon-gni.net (130.81.139.126) 2.396 > ms > >> > 2.435 ms 2.167 ms > >> > 3 so-12-1-0-0.RES-BB-RTR1.verizon-gni.net (130.81.28.254) 14.497 ms > >> > 14.767 ms 14.695 ms > >> > 4 0.xe-11-0-0.BR2.IAD8.ALTER.NET (152.63.38.169) 15.001 ms 15.074 > ms > >> > 15.024 ms > >> > 5 144.232.8.209 (144.232.8.209) 118.582 ms 116.717 ms 113.669 ms > >> > 6 sl-st31-ash-0-4-0-3.sprintlink.net (144.232.3.169) 114.433 ms > >> > 117.698 > >> > ms > >> > sl-st31-ash-0-4-0-0.sprintlink.net (144.232.28.6) 115.981 ms > >> > 7 sl-googl10-584821-0.sprintlink.net (144.228.205.34) 123.912 ms > >> > 124.402 > >> > ms 125.384 ms > >> > 8 208.117.251.47 (208.117.251.47) 30.591 ms 30.676 ms 29.528 ms > >> > > >> > Derek > >> > > >> > On 3/6/2013 8:31 PM, Grant Ridder wrote: > >> >> > >> >> Can any one provide traceroutes to youtube to see if there is any > >> >> correlation between last mile providers? > >> >> > >> >> -Grant > >> >> > >> >> On Wed, Mar 6, 2013 at 6:37 PM, Derek Ivey <derek(a)derekivey.com > >> >> <mailto:derek@derekivey.com>> wrote: > >> >> > >> >> I don't think it's just Time Warner. Definitely looks like XO. I > >> >> have > >> >> Verizon FiOS and it was pretty bad for me as well (not sure if it > >> >> still is > >> >> since I'm not home right now). There's also atleast two threads > in > >> >> the > >> >> Verizon FiOS section on Broadband Reports: > >> >> > >> >> > http://www.dslreports.com/forum/r28027601-Horrible-youtube-speeds > >> >> > >> >> > >> >> > http://www.dslreports.com/forum/r28071070-How-to-Reddit-YouTube-firewall-ru… > >> >> > >> >> Derek > >> >> > >> >> > >> >> On Wed, Mar 6, 2013 at 5:56 PM, Rick Coloccia > >> >> <coloccia(a)geneseo.edu <mailto:coloccia@geneseo.edu>> wrote: > >> >> > >> >> > I'd like to help, too, I'm from a TWC business class site with > >> >> 650 Mbps > >> >> > bandwidth and still regularly poor performance with YouTube. > >> >> > > >> >> > -Rick > >> >> > > >> >> > Sent from my iPhone 4S > >> >> > > >> >> > On Mar 6, 2013, at 4:10 PM, Christopher Morrow > >> >> <morrowc.lists(a)gmail.com <mailto:morrowc.lists@gmail.com>> > >> >> > wrote: > >> >> > > >> >> > > On Wed, Mar 6, 2013 at 3:34 PM, Randy Carpenter > >> >> <rcarpen(a)network1.net <mailto:rcarpen@network1.net>> > >> >> > wrote: > >> >> > >> > >> >> > >> ----- Original Message ----- > >> >> > >>> On Wed, Mar 6, 2013 at 3:11 PM, Randy Carpenter > >> >> > >>> <rcarpen(a)network1.net <mailto:rcarpen@network1.net>> > wrote: > >> >> > >>>> > >> >> > >>>> We have recently been having some serious speed issues > with > >> >> YouTube > >> >> > >>>> on our home connections, which are all Time Warner Cable. > >> >> > >>>> Some searching on forums and such revealed a work around: > >> >> > >>>> > >> >> > >>>> Block 206.111.0.0/16 <http://206.111.0.0/16> at the > router. > >> >> > >>> > >> >> > >>> this was reported elsewhere... it seems odd, since that's > XO > >> >> space, > >> >> > >>> not Google and not TWC space. Would you care to engage in > >> >> some > >> >> > >>> troubleshooting to help everyone out? :) > >> >> > >> > >> >> > >> I'll be happy to help troubleshoot in any way I can. > >> >> > > > >> >> > > excellent.. I'll arrange my ducks, let's chat offlist? > >> >> > > > >> >> > > >> >> > > >> >> > >> >> > >> > > > > > >

1 0

GMAIL contact
by Eric Brunner-Williams 06 Mar '13

06 Mar '13

Folks, We'd a user account compromised a couple of weeks ago, spam naturally. We're not getting any response from Gmail's set of contacts, so if anyone has a working Gmail contact, phone or mail, that they're willing to share off-list, I'd appreciate it. Eric Brunner-Williams

1 0

Cloudflare is down
by Arthur Wist 06 Mar '13

06 Mar '13

https://twitter.com/CloudFlare/status/308157556113698816 https://twitter.com/CloudFlare/status/308165820285083648 Apparently due to a routing issue... -AW

18 21

"After Being Cut From Norway, The Pirate Bay Returns From North Korea" or is it just BGP Tricks
by Bacon Zombie 05 Mar '13

05 Mar '13

The Pirate Bay have released a press release that they are now hosted out of North Korea: "The Pirate Bay has been hunted in many countries around the world. ....This is truly an ironic situation. We have been fighting for a free world, and our opponents are mostly huge corporations from the United States of America, a place where freedom and freedom of speech is said to be held high...... ...We believe that being offered our virtual asylum in Korea is a first step of this country's changing view of access to information......." http://falkvinge.net/2013/03/04/after-being-cut-from-norway-the-pirate-bay-… https://thepiratebay.se/blog/229 But there is a lot of debate on Reddit that they are not really in North Korea and just doing some BGP trickery: "Anyone can hijack an AS number and not cause any issues for the real user – In this case The Pirate Bay set up a Sat dish in Phenom Penh, Cambodia – Intelsat gives them a BGP session there. The peer net for BGP handoff is 175.45.177.217/30, .216 is Intelsats side and .217 is The Pirate Bay’s. One can use ANY IP they wish for these handoffs, internal, their own, “hijacked” – In this case The Pirate Bay “hijacked” 2 IPs from the North Korean network which does not matter for them as this is only acessible from their side, not from the internet. TBP then injected AS131279 as peer in the upstream table – so it does not look like this: AS22351 – AS51040 But instead: AS22351 – AS131279 – AS51040 This is possible because either Intelsat does not filter BGP announcements (unlikely) or TBP wrote a fake LOA for this AS (likely). Now as we traceroute the TBP IP we see the /30 subnet used for the handoff in Phenom Penh, which is why TPB says it is in North Korea – The ICMP (ping) reply from the IP makes it seem legit but does actually come from and entirely different network (aka the real Star-KP network). (Theres some more but i spare you that as it is pretty technological – for example that AS131279 does not hand over AS51040 routes to AS4737)." http://www.reddit.com/r/technology/comments/19nb00/after_being_cut_from_nor… Anybody have an input on this and able to confirm or deny the claims of BGP Hijacking? -- BaconZombie LOAD "*",8,1

4 3

cannot access some popular websites from Linode, geolocation is wrong, ARIN is to blame?
by Constantine A. Murenin 05 Mar '13

05 Mar '13

Dear NANOG@, I've had a Linode in Fremont, CA (within 173.230.144.0/20 and 2600:3c01::/32) for over a year, and, in addition to some development, I sometimes use it as an ssh-based personal SOCKS-proxy when travelling and having to use any kind of public WiFi. Since doing so, I have noticed that most geolocation services think that I'm located in NJ (the state of the corporate headquarters of Linode), instead of Northern California (where my Linode is physically from, and, coincidentally or not, where I also happen to live, hence renting a Linode from a very specific location). Additionally, it seems like both yelp.com and retailmenot.com block the whole 173.230.144.0/20 from their web-sites, returning some graphical "403 Forbidden" pages instead. ... I would like to point out that 173.230.144.0/20 and 2600:3c01::/32, announced out of AS6939, are allocated by Linode from their own ARIN-assigned allocations, 173.230.128.0/19 and 2600:3C00::/30, which Linode, in turn with their other ARIN-assigned space, allocates to 4 of their distinct DCs in the US, in Dallas, Fremont, Atlanta and Newark. However, Linode does not maintain any individual whois records of which DC they announce a given sub-allocation from. They also do not document their IPv6 assignments, either: if one of their customers misbehaves, the offended network would have no clue how to block just one customer, so, potentially, a whole set of customers may end up being blocked, through a wrong prefixlen assumption. I've tried contacting Linode in regards to whois, giving an example of some other smaller providers (e.g. vr.org) that label their own sub-allocations within their ARIN-assigned space to contain an address of the DC where the subnet is coming from, and asked whether Linode could do the same; however, Linode informed me that they don't have any kind of mail service from the DCs they're at, and that their ARIN contact, effectively, said that they're already doing everything right in regards not having any extra whois entries with the addresses of their DC, since that would actually be wrong, as noone will be expecting mail for Linode at those addresses. (In turn, it's unclear whether a much smaller vr.org has mail service at nearly a dozen of the DCs that they have their servers at, and which they provide as the addresses in ARIN's whois, but I would guess that they do not.) This would seem like a possible shortcoming of ARIN's policies and the whois database: with RIPE, every `netname` has a `country` associated with it, seemingly without any requirements of a mailing address where mail could be received; but with ARIN, no state is ever provided, only a mailing address. (I've also just noticed that RIPE whois now has an optional `geoloc` field in addition to the non-optional `country`.) Now, back to ARIN: is Linode doing it right? Is vr.org doing it wrong? Are they both doing it correct, or are they both wrong? And in regards to yelp and retailmenot; why are they blocking Linode customers in 173.230.144.0/20? I've tried contacting both on multiple occasions, and have never received any replies from yelp, but retailmenot has replied several times with a blanket "someone may have tried to scrap, spam or proxy our site from this network". I have repeatedly asked retailmenot if they'd block Verizon or AT&T if someone tries to scrap or spam their web-site from those networks, too, but have never received any replies. I have also tried contacting Linode regarding this issue, and although they were very patient and tried troubleshooting the problem, reporting that it appears that other addresses within 173.230.144.0/20 are likewise blocked, but some of their other address ranges at another DC are not, they have not been able to get in touch with anyone at yelp or retailmenot to isolate the problem. Now, if you were operating yelp or rmn, would you not block an address range with a fishy geoloc like that of Linode? I'm somewhat convinced that 403 Forbidden stems entirely out of some logic that notes that the geoloc data is likely fishy, or which [erroneously] concludes that the address range is used for anonymity purposes. Anyhow. How do I get my geoloc to show Fremont, CA? And to have yelp stop returning 403 Forbidden? Cheers, Constantine.

13 15

whois.radb.net returning blank results
by Nick Hilliard 04 Mar '13

04 Mar '13

Looks like whois.radb.net is returning blank results. > pancake:/home/nick> whois -h whois.radb.net 198.41.0.0 | wc -l > 0 > pancake:/home/nick> Those people who use the RADB IRRDB for generating filters / configuring routers might like to do some runs in their testing environment to ensure that no kittens lose their lives. (thanks to Kevin Loch for pointing this out). Nick

4 4