- Test - lists.nanog.org

Anyone from NTT America here?
by Stephen Satchell 23 Oct '19

23 Oct '19

Routing loop > 11.|-- 129.250.24.196 0.0% 1 28.9 28.9 28.9 28.9 0.0 > 12.|-- 129.250.130.254 0.0% 1 29.0 29.0 29.0 29.0 0.0 > 13.|-- 129.250.130.253 0.0% 1 29.4 29.4 29.4 29.4 0.0 > 14.|-- 129.250.130.254 0.0% 1 29.6 29.6 29.6 29.6 0.0 > 15.|-- 129.250.130.253 0.0% 1 28.5 28.5 28.5 28.5 0.0 > 16.|-- 129.250.130.254 0.0% 1 29.0 29.0 29.0 29.0 0.0 > 17.|-- 129.250.130.253 0.0% 1 28.6 28.6 28.6 28.6 0.0 > 18.|-- 129.250.130.254 0.0% 1 27.9 27.9 27.9 27.9 0.0 > 19.|-- 129.250.130.253 0.0% 1 28.4 28.4 28.4 28.4 0.0 > 20.|-- 129.250.130.254 0.0% 1 27.9 27.9 27.9 27.9 0.0 > 21.|-- 129.250.130.253 0.0% 1 28.2 28.2 28.2 28.2 0.0 > 22.|-- 129.250.130.254 0.0% 1 29.0 29.0 29.0 29.0 0.0 > 23.|-- 129.250.130.253 0.0% 1 27.9 27.9 27.9 27.9 0.0 > 24.|-- 129.250.130.254 0.0% 1 28.6 28.6 28.6 28.6 0.0 > 25.|-- 129.250.130.253 0.0% 1 28.7 28.7 28.7 28.7 0.0

3 2

Request comment: list of IPs to block outbound
by Stephen Satchell 23 Oct '19

23 Oct '19

The following list is what I'm thinking of using for blocking traffic between an edge router acting as a firewall and an ISP/upstream. This table is limited to address blocks only; TCP/UDP port filtering, and IP protocol filtering, is a separate discussion. This is for an implementation of BCP-38 recommendations. I'm trying to decide whether the firewall should just blackhole these addresses in the routing table, or use rules in NFTABLES against source and destination addresses, or some combination. If NFTABLES, the best place to put the blocks (inbound and outbound) would be in the FORWARD chain, both inbound and outbound. (N.B. for endpoint boxes, they go into the OUTPUT chain.) In trying to research what would constitute "best practice", the papers I found were outdated, potentially incomplete (particularly with reference to IPv6), or geared toward other applications. This table currently does not have exceptions -- some may need to be added as a specific "allow" route or list. The Linux rp_filter knob is effective for endpoint servers and workstations, and I turn it on religiously (easy because it's the default). For a firewall router without blackhole routes, it's less effective because, for incoming packets, a source address matching one of your inside netblocks will pass. A subset of the list would be useful in endpoint boxes to relieve pressure on the upstream edge router -- particularly if a ne'er-do-well successfully hijacks the endpoint box to participate in a DDoS flood. IPv4 Address block Scope Description 0.0.0.0/8 Software Current network (only valid as source address). 10.0.0.0/8 Private network Used for local communications within a private network. 100.64.0.0/10 Private network Shared address space[3] for communications between a service provider and its subscribers when using a carrier-grade NAT. 127.0.0.0/8 Host Used for loopback addresses to the local host. 169.254.0.0/16 Subnet Used for link-local addresses between two hosts on a single link when no IP address is otherwise specified, such as would have normally been retrieved from a DHCP server. 172.16.0.0/12 Private network Used for local communications within a private network. 192.0.0.0/24 Private network IETF Protocol Assignments. 192.0.2.0/24 Documentation Assigned as TEST-NET-1, documentation and examples. 192.88.99.0/24 Internet Reserved. Formerly used for IPv6 to IPv4 relay 192.168.0.0/16 Private network Used for local communications within a private network. 198.18.0.0/15 Private network Used for benchmark testing of inter-network communications between two separate subnets. 198.51.100.0/24 Documentation Assigned as TEST-NET-2, documentation and examples. 203.0.113.0/24 Documentation Assigned as TEST-NET-3, documentation and examples. 224.0.0.0/4 Internet In use for IP multicast. 240.0.0.0/4 Internet Reserved for future use. 255.255.255.255/32 Subnet Reserved for the "limited broadcast" destination address. IPv6 Address block Usage Purpose ::/0 Routing Default route. ::/128 Software Unspecified address. ::1/128 Host Loopback address to local host. ::ffff:0:0/96 Software IPv4 mapped addresses. ::ffff:0:0:0/96 Software IPv4 translated addresses. 64:ff9b::/96 Global Internet IPv4/IPv6 translation. 100::/64 Routing Discard prefix. 2001::/32 Global Internet Teredo tunneling. 2001:20::/28 Software ORCHIDv2. 2001:db8::/32 Documentation Addresses used in documentation and example source code. 2002::/16 Global Internet The 6to4 addressing scheme fc00::/7 Private network Unique local address. fe80::/10 Link Link-local address. ff00::/8 Global Internet Multicast address.

15 30

vz deep routing clue?
by Randy Bush 23 Oct '19

23 Oct '19

would appreciate unicast contact with someone withq 70x deep routing clue. researchers want to confirm possible causes of some phemnomona we think we see. thanks. randy

1 1

Fwd: SLAAC renum: Problem Statement & Operational workarounds
by Fernando Gont 23 Oct '19

23 Oct '19

Folks, Your input would be very welcome. Preferably on the v6ops wg mailing-list (https://www.ietf.org/mailman/listinfo/v6ops) but also on this list or multicast to us (authors). Thanks! -------- Forwarded Message -------- Subject: SLAAC renum: Problem Statement & Operational workarounds Date: Wed, 23 Oct 2019 03:51:32 -0500 From: Fernando Gont <fgont(a)si6networks.com> To: IPv6 Operations <v6ops(a)ietf.org> Folks, Earlier this year there was a lot of discussion about slaac renumbering problems. Our original I-D covered everything from the problem statement to proposed protocol updates and operational workarounds. Based on the comments received while discussing this topic on this list and other forums, and in order to keep the discussion better focused on specific aspects of the problem, we have posted a v6ops-targetted document that focuses on: * The problem statement * Discussion of operational workarounds, and associated constraints The document is available at: https://tools.ietf.org/html/draft-gont-v6ops-slaac-renum We'd like to hear from the wg whether we have missed anything, whether the document is useful to the community, etc. Thanks! Cheers, -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

1 0

Is anybody else getting spam from cytranet.com?
by Rich Kulawiec 22 Oct '19

22 Oct '19

I'm guessing -- because spammer Ben Reynolds (breynolds(a)cytranet.com) wrote to me about voice/data services -- that it's possible they've been scraping addresses from here. ---rsk

4 3

RE: BGP over TLS
by Jakob Heitz (jheitz) 22 Oct '19

22 Oct '19

The article linked says no mainstream BGP implementation supports TCP-AO. IOS-XE and IOS-XR support it. While I do not represent the Cisco view, personally I like the idea of BGP over TLS. Regards, Jakob. -----Original Message----- Date: Mon, 21 Oct 2019 19:21:03 +1100 From: Julien Goodwin <nanog(a)studio442.com.au> On 21/10/19 6:30 pm, Bjørn Mork wrote: > Christopher Morrow <morrowc.lists(a)gmail.com> writes: > >> isn't julien's idea more akin to DOT then DOH ? > > Yes, and I really like Julien's proposal. It even looks pretty > complete. There are just a few details missing around how to make the > MD5 => TLS transition smooth. At least for those systems that run on Linux (which is most all of the major's except Juniper) I suspect if we went to the relevant kernel folk with a clear plan on how handling TCP-MD5 in a way that would make transitions much easier they'd listen. The troll response at the top of my post was actually based on a response from one of the kernel folk, who dislike TCP options even more than network operators. > Sorry for any confusion caused by an attempt to make a joke on DoH. I > didn't anticipate the sudden turn to serious discussion :-) Which > obviously was a good one. I am all for BGP over TLS, so let's discuss > https://laptop006.livejournal.com/60532.html If anyone is at all interested in this I'm happy to discuss and flesh out anything that's not clear. After I wrote this (over a few bottles of red on the flight to linux.conf.au this year) I sent it to a bunch of people that had expressed interest, including a few BGP implementations, but nobody bit.

2 1

AWS issues with 172.0.0.0/12
by Mehmet Akcin 21 Oct '19

21 Oct '19

Hey there AT&T is using 172.0.0.0/12 block as public IP for customers in USA. AWS seems to be blocking this block, I can reach to many sites just fine but i can’t get to some sites hosted on AWS such as reolink.com If someone from AWS is reading the list, please fix this issue Mehmet -- Mehmet +1-424-298-1903

9 17

Twitter contact?
by Bryan Holloway 21 Oct '19

21 Oct '19

Anyone from Twitter lurking? Trying to resolve a peering issue and not getting far through published contacts. Thanks! - bryan

1 1

CenturyLink vs L3 and Enterprise Product Offerings
by Nick Bogle 20 Oct '19

20 Oct '19

NANOG, I have been looking into getting an enterprise fiber connection from Centurylink (original provider at the location was TW Telecom, then L3, now CenturyLink). When speaking to my rep, he said I had the options listed below. Does anyone know the difference between their Consumer Grade, their Enterprise Grade IQ network, and their Enterprise DIA network? I am guessing Fiber + Data is CenturyLink backbone delivered over GPON, Enterprise Data is CenturyLink Enterprise backbone delivered over GPON, and IQ Data Bundle is CenturyLink backbone delivered over a dedicated pair of fiber/wavelength/etc, and DIA is L3 backbone delivered over a dedicated pair of fiber/wavelength/etc? Fiber + Data only – This is a fiber connection with symmetrical bandwidth > delivered on a shared fiber facility. This service connects to our > consumer grade DSL internet network at our Central office. Bandwidth > options 50M, 100M, 500M and 1G > Fiber + Enterprise Data only – This is a fiber connection with symmetrical > bandwidth delivered on a shared fiber facility. The service connects to > our enterprise grade IQ network at our Central office. This service has > BGP capabilities but it is limited by the amount of memory in AdTran 5660 > device that is included with the service. Bandwidth options 50M, 100M, > 500M and 1G. > IQ Data Bundle – This is a fiber connection with symmetrical bandwidth > delivered on a dedicated fiber facility. This service connects to our > enterprise grade IQ network at the Central Office and comes with our > industry leading SLA’s and 99.999% uptime guarantee. This service has full > BGP capabilities with an AdTran 908e that is included with the service. > Bandwidth options are 10M to 10G. > Dedicated Internet Access - This is a fiber connection with symmetrical > bandwidth delivered on a dedicated fiber facility. This service connects > our enterprise grade network and comes with our Industry leading SLA’s and > 99.999% uptime guarantee. This service can do BGP but the customer will > need to provide the router as CenturyLink does not include one with this > service. Bandwidth options are 10 to 6G. Thank you!

1 0

abha
by Randy Bush 20 Oct '19

20 Oct '19

abha ahuja died this day in 2001. we miss her. randy http://www.neebu.net/~khuon/abha/

2 1