- Test - lists.nanog.org

Comcast Outage - East Coast?
by John Von Essen 27 Jun '19

27 Jun '19

I just saw a 40% traffic drop on my routing core (East Coast based) across all my BGP peers. None of my transit peers flapped or had any issues other than the traffic drop. Almost all the complaints of connectivity issues were people using Comcast, so right now thats the only common thread. Anyone else see this? It appears to have resolved after about 5 mins. -John

1 0

Bestel/AS18734 Contact
by Christopher Smalling 26 Jun '19

26 Jun '19

Does anyone have a contact for Bestel/AS18734? We've been having peering issues with them on and off for a while now, and can't seem to get any response through their contacts listed with ARIN or on PeeringDB. Calls to support are fruitless, with nobody knowing where to direct us. -- Chris Smalling Network Operations NeoNova

1 1

Anyone from AT&T/AS7018 available?
by Christopher Rogers 26 Jun '19

26 Jun '19

I'm a customer of 7018 and am currently struggling to get anyone to look at a bgp misconfiguration within 7018- it's like pissing into a hurricane. If anyone is available could you kindly ping me offlist? cheers -chris

5 5

Re: FCC workshop: Security vulnerabilities within our communications networks
by Scott Weeks 26 Jun '19

26 Jun '19

--- sean(a)donelan.com wrote: From: Sean Donelan <sean(a)donelan.com> If they come up with a better idea, that's great. I'll take good ideas from anywere. ------------------------------------ FCC. gov't. Design by committee. Never seen good design come out of these, but like Chris said, maybe today's the day... </smirk> ;-) scott

2 1

FCC workshop: Security vulnerabilities within our communications networks
by Sean Donelan 26 Jun '19

26 Jun '19

Federal Communications Commissioner Geoffrey Starks is holding a workshop next week, June 27, 2019, to hear from interested parties on how to address the national security threats posed by insecure equipment within our communications networks. https://www.fcc.gov/document/commr-starks-announces-june-27-public-workshop… Panel 1: Find It – The Scope of the Problem This panel will focus on how to identify which equipment poses a threat and where it is located. Panel 2: Fix It – How to Ensure that Networks are Secure This panel will consider options for fixing identified security problems, including discussion of what equipment needs to be fixed, whether replacing equipment is the best approach, or whether monitoring or other measures can be part of the solution. Panel 3: Fund It – National Problems Require National Solutions This panel will address questions regarding funding, including the amount required for equipment replacement and threat mitigation, pote

4 6

Issue with point to point VPNs behind NAT and asymmetric traffic
by Anurag Bhatia 26 Jun '19

26 Jun '19

Hello everyone, Trying to get my head around a certain unexpected behaviour. I am running two site to site VPNs (wireguard now, OpenVPN earlier) between my home and a remote server over two different WAN links. Both WAN links are just consumer connections - one with public IP and one with CGNATed IP. The redundancy here is taken care of by the OSPF running via FRR on both ends. The unexpected behaviour I get is that if I set OSPF cost to prefer say link1 between home -> server and prefer link 2 between server -> home then connectivity completely breaks between the routed pools. The point to point IPs stay reachable (which is over expected links i.e symmetric via both ends). As long as both ends prefer link1 or link2, it works fine. At first, I thought it had to do something with NAT but still can't understand how. Since VPN tunnels have a keep-alive timer (for 10 seconds), the tunnel is always up. Any idea why asymmetric packets are being dropped here? This exact behaviour was in case of earlier OpenVPN + bird + iBGP and is still the same when I moved everything to Wireguard for VPN + FRR for routing + OSPF. Thanks. -- Anurag Bhatia anuragbhatia.com

6 8

Public Subnet re-assignments
by Scott 26 Jun '19

26 Jun '19

First, sorry if this is a bit of a noob question. I'm trying to find a way of preventing a slew of traffic to an IP, or IP's, when I join two /30 public subnets to a /29. It appears that while the ranges are /30 someone is trying to brute-force the network and/or broadcast addresses for the ranges. When I change them to be a /29, now the router sees the traffic and starts dropping packets. Are there any suggestions for mitigating this behavior or is it just the nature of the beast? -- 101010

3 6

80.67.75.0/24 (Akamai) announced by Kazakhtelecom
by Eric Dugas 25 Jun '19

25 Jun '19

Got alerts for 80.67.75.0/24 (Akamai) normally announced by Tier1 providers routed by a long AS path from our of our peers: 80.67.75.0/24 AS path: 9002 9198 43727 6762 2914 23454 23454 I, validation-state: unknown 80.67.64.0/19 AS path: 1299 3257 34164 I just got home and it seems Akamai already reacted: 80.67.75.0/24 AS path: 174 2914 23454 23454 AS path: 1299 2914 23454 23454 Less damage (as far as I can see) but what a bad week for BGP so far...

2 1

Re: Public Subnet re-assignments
by Scott Weeks 25 Jun '19

25 Jun '19

--- scott(a)viviotech.net wrote: From: Scott <scott(a)viviotech.net> To your previous question, yes .0 and .3 are unused. Once I change the subnet .3 becomes a usable IP and it's getting hammered with traffic, causing packet loss. -------------------------------------- Is it legitimate traffic or DDoS stuff? scott

1 0

BGP filtering study resources (Was: CloudFlare issues?)
by Job Snijders 25 Jun '19

25 Jun '19

Dear Stephen, On Tue, Jun 25, 2019 at 07:04:12AM -0700, Stephen Satchell wrote: > On 6/25/19 2:25 AM, Katie Holly wrote: > > Disclaimer: As much as I dislike Cloudflare (I used to complain > > about them a lot on Twitter), this is something I am absolutely > > agreeing with them. Verizon failed to do the most basic of network > > security, and it will happen again, and again, and again... > > I used to be a quality control engineer in my career, so I have a > question to ask from the perspective of a QC guy: what is the Best > Practice for minimizing, if not totally preventing, this sort of > problem? Is there a "cookbook" answer to this? > > (I only run edge networks now, and don't have BGP to worry about. If > my current $dayjob goes away -- they all do -- I might have to get > back into the BGP game, so this is not an idle query.) > > Somehow "just be careful and clueful" isn't the right answer. Here are some resources which maybe can serve as a starting point for anyone interested in the problem space: presentation: Architecting robust routing policies pdf: https://ripe77.ripe.net/presentations/59-RIPE77_Snijders_Routing_Policy_Arc… video: https://ripe77.ripe.net/archive/video/Job_Snijders-B._BGP_Policy_Update-201… presentation: Practical Everyday BGP filtering "Peerlocking" pdf: http://instituut.net/~job/NANOG67_NTT_peerlocking_JobSnijders.pdf video: https://www.youtube.com/watch?v=CSLpWBrHy10 RFC 8212 ("EBGP default deny") and why we should ask our vendors like Cisco IOS, IOS XE, NX-OS, Juniper, Arista, Brocade, etc... to be compliant with this RFC: slides 2-14: http://largebgpcommunities.net/presentations/ITNOG3-Job_Snijders_Recent_BGP… skip to the rfc8212 part: https://youtu.be/V6Wsq66-f40?t=854 compliance tracker: http://github.com/bgp/RFC8212 The NLNOG Day in Fall 2018 has a wealth of RPKI related presentations and testimonies: https://nlnog.net/nlnog-day-2018/ Finally, there is the NLNOG BGP Filter Guide: http://bgpfilterguide.nlnog.net/ If you spot errors or have suggestions, please submit them via github https://github.com/nlnog/bgpfilterguide Please let me or the group know should you require further information, I love talking about this topic ;-) Kind regards, Job

4 3