- Test - lists.nanog.org

Question about mismatch of origin ASN in parent and more specific route object
by Anurag Bhatia 18 Sep '19

18 Sep '19

Hello everyone Trying to understand the case from operators here who generate IRR based filters. Say if a given example: AS X originating 2001:DB8::/32 with IRR route object having AS X in the origin AS X originating 2001:DB8::/48 with IRR route object having AS Y in the origin Now for folks who are generating filters, will your tools filter 2001:DB8::/48 because there's a more specific IRR route object which says AS Y while prefix is coming from AS X? Or since generation is based on ASNs (as known directly or resolved via AS SETs) your tools will just generate filter for AS X allowing 2001:DB8::/32 (upto say /48) and won't really for mismatching route object for 2001:DB8::/48? Thanks. -- Anurag Bhatia anuragbhatia.com

2 1

Contact at OLM LLC or Windstream Communications
by Brice Lopez 18 Sep '19

18 Sep '19

Hello, Anyone would have a contact at OLM LLC (AS19916)? They are still announcing a /24, part of a /22 we bought a few months ago. I guess it's a misconfiguration on their side, but I'm unable to reach them. I'm now trying to reach their transit, Windstream Communications (AS7029), because they could filter that illegitimate announce. If anyone has a contact at OLM or Windstream, it would be very helpful. Regards, Brice Lopez

1 0

diversity in the RIPE Route Collectors
by Emile Aben 17 Sep '19

17 Sep '19

Hi NANOG, in light of a recent discussion on RIS-live, and a question on where best have RIS peers, this might be of interest to the NANOG crowd: https://labs.ripe.net/Members/emileaben/how-diverse-is-ris best regards, Emile Aben RIPE NCC

2 1

Consistent routing policy?
by Ben Logan 17 Sep '19

17 Sep '19

Hello, In reviewing our BGP routing policies last week, I realized that we are advertising our address space upstream in slightly different ways to our two upstream providers. For example, we might advertise a /21 to one provider and break that into two /22s when advertising it to the other. (The reason this was done was to help with traffic engineering--we'd prepend one of the /22s to help balance the traffic. Prepending the entire /21 might have been too much.) I'm just wondering if that's acceptable practice, or if we should advertise consistent prefixes between providers? Thanks, Ben -- <https://img.beta.newoldstamp.com/r/13887/p> Ben Logan Senior Network Engineer | Working Lead Wilkes Communications | RiverStreet Networks Address: 1400 River St Wilkesboro, NC 28697 Email: benlogan(a)myriverstreet.net Phone: 336-973-9075 Mobile: 336-452-8072 wilkes.net <https://www.wilkes.net> myriverstreet.net <https://www.myriverstreet.net> <https://img.beta.newoldstamp.com/r/13833/facebook> <https://img.beta.newoldstamp.com/r/13833/twitter> <https://img.beta.newoldstamp.com/r/13887/youtube> <https://img.beta.newoldstamp.com/r/13833/linkedin> <https://img.beta.newoldstamp.com/r/13833/instagram> This email transmission contains information which may be confidential and/or privileged. The information is intended to be for the use of the individual or entity named on this transmission. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this email information is prohibited. If you have received this email in error, please notify the sender to arrange for retrieval of the original documents. Thank you.

8 13

Security alert aggregator?
by David Hubbard 16 Sep '19

16 Sep '19

Curious if anyone knows of a security alert aggregation service? For example, go and plug in all the various vendors hardware and software packages your enterprise uses, and then the service subscribes to all the random RSS feeds, CVE lists, vendor mailing lists, etc. to feed you the data instead of needing staff to write something custom, and then have checks to ensure the custom thing is still pulling from the right location, etc. Thanks

3 2

Geolocation\VPN Assistance
by Mike Hammett 16 Sep '19

16 Sep '19

I'm building a page that has links and contact information for various IP geolocation services as well as contacts and links at companies that people often have issues with. There used to be a wiki page on CluePon that had some information, but that's been gone a few years. My intent is to direct people there whenever Netflix, Hulu, whatever says that they can't get content due to a country restriction... or a VPN restriction (if they're not using a VPN), etc. Then we don't have to rehash everything every time. BTW: This comes up a lot more often in different circles, more focused on eyeball ISPs. http://thebrotherswisp.com/index.php/geo-and-vpn/ Please provide OFFLIST constructive feedback and additions. Please note the, "This page is very incomplete and poorly organized. With time, hopefully, that gets corrected." ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

2 2

Comcast route server not reflecting their reality
by Will Orton 11 Sep '19

11 Sep '19

I'm seeing odditiies when trying to traffic-engineering my way around an AS 3356-to-7922 performance issue. I buy transit from 3356 and announce my /19 to 3356. I set traffic engineering community 65000:7922 to supress announcement of it from 3356 to 7922. When I do that, at route-server.newyork.ny.ibone.comcast.net I see the AS-path for my /19 change from: 3356 <me> to: 2914 <me> which makes sense as I also have transit from 2914. So that's great, 7922 should be routing to me via 2914 or, any path not via 3356. But then if I go to a customer location on 7922's network, and traceroute to my /19, it still goes via 7922 3356 <me> ! Is 7922's looking glass no longer reflecting actual route selection in their network? Does Comcast do traffic engineering that is not otherwise reflected at their looking glass? If I deaggregate my /19 and announce a /24 from it to 2914, I can draw the inbound traffic to me away from the 7922 3356 path. Which is not a real nice long-term solution... -Will

4 5

Bahamas: Hurricane Dorian recovery status
by Sean Donelan 11 Sep '19

11 Sep '19

Telecommunications and mobile services have been restored in about 90% of the Grand Bahama island area, however network capacity is still limited. Only about 10% of mobile and telecommunication service has been restored on the Abaco island. Over 60% of the housing and buildings on Abaco was destroyed. Four critical communications points have been established on Abaco for relief efforts. BTC and Aliv, the two major mobile providers in the Bahamas, have entered into a free roaming agreement for the next 30 days allowing customers to connect to either working cell towers without roaming charges. The Emergency Telecommunications Cluster partnered CISCO TacOps, Ericsson Response, NetHope, TSF and Vodafone Foundation are providing connectivity for humanitarian responders in four sites: - The Marsh Harbour port and international airport (set up by Ericsson Response, CISCO TacOps and WFP); - Maxwell Supermarket, used as the military EOC (set up by TSF); - A healthcare facility (set up by Vodafone Foundation). Equipment has been provided by the ETS partners on the ground as well as by Eutelsat and Hispasat ‒ and services by Inmarsat ‒ as part of the Crisis Connectivity Charter.

1 0

rr.level3.net on autopilot?
by Jon Lewis 10 Sep '19

10 Sep '19

I was doing some IRR clean-up and after a few successful updates, I'm no longer able to alter or delete our objects in rr.level3.com. Emails to rpsl(a)level3.com result in no action and no response. I've tried reaching out to the Level3 (Centurylink) NOC via email and phone, and can't seem to find anyone who knows what rr.level3.com is, much less knows who to talk to about troubleshooting. Anyone know who (if anyone) keeps the wheels spinning on the Level3 IRR? ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

4 5

Google DNS Oddity
by Chip Marshall 09 Sep '19

09 Sep '19

Hello, I'm seeing an oddity when doing DNS lookups for www.google.com from our London datacenter, and I'm curious if other people are seeing the same behavior. It appears that when we ask for www.google.com. we sometimes get an answer that only contains records for www-anycast.google.com., which our resolver ignores as they don't match the query. As seen with dig: ``` # dig @ns1.google.com. www.google.com. aaaa ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @ns1.google.com. www.google.com. aaaa ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42641 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;www.google.com. IN AAAA ;; ANSWER SECTION: www-anycast.google.com. 300 IN AAAA 2001:4860:4802:34::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:38::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:36::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:32::75 ;; Query time: 7 msec ;; SERVER: 216.239.32.10#53(216.239.32.10) ;; WHEN: Fri Sep 06 19:05:32 UTC 2019 ;; MSG SIZE rcvd: 167 ``` So far I've observed this with A and AAAA queries. It's my understanding that without a CNAME record in the answer, the resolver is doing the right thing by ignoring the answer, as there's no linkage between www and www-anycast. Is this broken, or is this just some weird DNS trick I've not come across before? -- Chip Marshall <chip(a)2bithacker.net>

6 9