- Test - lists.nanog.org

Cisco Crosswork Network Insights - or how to destroy a useful service
by Hank Nussbacher 16 May '19

16 May '19

I have started to use Cisco Crosswork Network Insights which is the replacement for BGPmon and I am shocked at how Cisco has managed to destroy a useful tool.I have had a paid 50 prefix account since the day BGPmon became available and helped two clients implement a 500 prefix license over the past 4 years.None will be buying Cisco Crosswork Network Insights, based on my recommendation. I really don’t know where to begin since there is so much to dislike in this new GUI.I will try to give you just a small taste but I suggest you request a 90 day trial license and try it out for yourself. This was not designed by someone who deals with BGP hijacks or who manages a network.It was probably given to some GUI developer with a minimal understanding of what the users needed.How do I know this?Take for example the main configuration menu: https://crosswork.cisco.com/#/configuration with the first tab of “prefixes”.On that page there is *no* mention of which ASN the prefix is associated with.That of course was fundamental in the BGPmon menu: https://portal.bgpmon.net/myprefixes.php Or take for example its “express configuration”, where you insert an ASN and it automatically finds all prefixes and creates a policy.But does it know the name of the ASN?Nope.Something again that was basic in BGPmon via: https://portal.bgpmon.net/myasn.php is non-existent in CNI. Or how about the alarms one gets to an email?Want to see how that looks? From: Crosswork Admin [mailto:admin@crosswork.cisco.com] Sent: 15 May 2019 11:39 To: Hank Nussbacher <Hank(a)mail.iucc.ac.il> Subject: CCNI Notification Active alarm count 1 starting at 2019-05-15 08:34:42.960762315 +0000 UTC. Please click on the link for each alarm below: https://crosswork.cisco.com/#/alarm/ba7c5084-f05d-4c12-a17f-be9e815d6647 Compare that with what we used to get: ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix:99.201.0.0/16: Prefix Description:Kuku net Update time:2018-08-12 17:50 (UTC) Detected by #peers:140 Detected prefix:99.201.131.0/24 Announced by:AS222246 (BGP hijacking Ltd) Upstream AS:AS111111 (Clueless ISP allowing customer hijacking Ltd) ASpath:555555 444444 333333 111111 222246 Alert details:https://portal.bgpmon.net/alerts.php?details&alert_id=830521190 Mark as false alert:https://portal.bgpmon.net/fp.php?aid=830521190 That is just a small sampling.Maybe two years down the road, Cisco will speak to customers first before destroying a useful service. Anyone else trying this out and feels the same or feels differently? Disappointed, Hank

10 11

FCC Hurricane Michael after-action report
by Sean Donelan 16 May '19

16 May '19

The FCC has released its report and analysis of Hurricane Michael impact on communications: preparation, effect and recovery. https://www.fcc.gov/document/fcc-releases-report-communication-impacts-hurr… Conclusions and Recommendations 51. Backhaul outages loomed large as an impediment to communications recovery. Uncoordinated post-storm recovery efforts between and among communications, utility, and debris removal teams created unnecessary delays to a speedy return to service. Customers who had communications service restored – only to lose it again almost immediately because of a fiber cut – provide a clear example of how better cross-sector coordination could have improved the restoration process.

10 11

ARIN v4 revocations with followup felony indictments
by Martin Hannigan 15 May '19

15 May '19

ARIN revokes fraudulently obtained IPv4 numbers: http://www.circleid.com/posts/20190514_735k_fraudulently_obtained_ip_addres… USAO indicts Micfo founder in South Carolina. https://www.justice.gov/usao-sc/pr/charleston-man-and-business-indicted-fed… Relevant threads over at ARIN on PPML. Cheers, -M<

1 0

Re: Charter and Cox contacts
by daniel＠pyranah.com 15 May '19

15 May '19

First off, I apologize for the list. I didn't realize my replies included the entire original email... Mark, we do not run a mail server. The issue is a lot of our customers have their 2nd homes here, so when they come up they are using their email provided by their 1st home ISP. A number of our customers use Cox, Charter, and Spectrum and can receive email just fine but cannot send. Report from a mac book pro email client showed Cox to be blocking the IP that we NAT most customers through. Message: 7 Date: Tue, 14 May 2019 11:22:41 -0700 (PDT) From: Mark Milhollan <mlm(a)pixelgate.net> To: NANOG list <nanog(a)nanog.org> Subject: Re: Charter and Cox contacts Message-ID: <alpine.LNX.2.00.1905141115120.5030(a)arcghar.ybpny> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Mon, 13 May 2019, Stephen Satchell wrote: >On 5/13/19 12:11 PM, daniel(a)pyranah.com wrote: >>Does anyone have contacts at Charter (Spectrum) and Cox? For some reason, >>our IP has been blocked by them and our customers are unable to send email >>via their charter/cox accounts. Thanks > >Would you be talking about port 25/tcp outbound? Lots of ISPs will >block port 25 as a rule; If this is the case, that your customers cannot use your mail servers to relay mail then provide port 587/TCP (SUBMISSION) or even 465/TCP (SMTPS, deprecated). If you mean that your mail servers can't send mail to Charter and Cox addresses, then indeed you need to find out what happened, fix it then request removal from their (and other) blacklists for which contacts there would be helpful (I am not one). /mark Daniel Temple VP of Operations Pyranah Communications, LLC 828-743-2470 ext.205 Pyranah.com Like us on Facebook!

1 0

Re: Cisco Crosswork Network Insights - or how to destroy a useful service
by Patrick McEvilly 15 May '19

15 May '19

https://honestnetworker.net/2019/01/31/recent-bgpmon-net-announcement/ From: NANOG <nanog-bounces+patrick_mcevilly=harvard.edu(a)nanog.org> on behalf of Mike Hammett <nanog(a)ics-il.net> Date: Wednesday, May 15, 2019 at 8:35 AM To: Hank Nussbacher <hank(a)efes.iucc.ac.il> Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: Re: Cisco Crosswork Network Insights - or how to destroy a useful service Resent-From: Patrick McEvilly <patrick_mcevilly(a)harvard.edu> Cisco ruins everything they touch. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com From: "Hank Nussbacher" <hank(a)efes.iucc.ac.il> To: nanog(a)nanog.org Sent: Wednesday, May 15, 2019 4:50:10 AM Subject: Cisco Crosswork Network Insights - or how to destroy a useful service I have started to use Cisco Crosswork Network Insights which is the replacement for BGPmon and I am shocked at how Cisco has managed to destroy a useful tool. I have had a paid 50 prefix account since the day BGPmon became available and helped two clients implement a 500 prefix license over the past 4 years. None will be buying Cisco Crosswork Network Insights, based on my recommendation. I really don’t know where to begin since there is so much to dislike in this new GUI. I will try to give you just a small taste but I suggest you request a 90 day trial license and try it out for yourself. This was not designed by someone who deals with BGP hijacks or who manages a network. It was probably given to some GUI developer with a minimal understanding of what the users needed. How do I know this? Take for example the main configuration menu: https://crosswork.cisco.com/#/configuration with the first tab of “prefixes”. On that page there is no mention of which ASN the prefix is associated with. That of course was fundamental in the BGPmon menu: https://portal.bgpmon.net/myprefixes.php Or take for example its “express configuration”, where you insert an ASN and it automatically finds all prefixes and creates a policy. But does it know the name of the ASN? Nope. Something again that was basic in BGPmon via: https://portal.bgpmon.net/myasn.php is non-existent in CNI. Or how about the alarms one gets to an email? Want to see how that looks? From: Crosswork Admin [mailto:admin@crosswork.cisco.com] Sent: 15 May 2019 11:39 To: Hank Nussbacher <Hank(a)mail.iucc.ac.il> Subject: CCNI Notification Active alarm count 1 starting at 2019-05-15 08:34:42.960762315 +0000 UTC. Please click on the link for each alarm below: https://crosswork.cisco.com/#/alarm/ba7c5084-f05d-4c12-a17f-be9e815d6647 Compare that with what we used to get: ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 99.201.0.0/16: Prefix Description: Kuku net Update time: 2018-08-12 17:50 (UTC) Detected by #peers: 140 Detected prefix: 99.201.131.0/24 Announced by: AS222246 (BGP hijacking Ltd) Upstream AS: AS111111 (Clueless ISP allowing customer hijacking Ltd) ASpath: 555555 444444 333333 111111 222246 Alert details: https://portal.bgpmon.net/alerts.php?details&alert_id=830521190 Mark as false alert: https://portal.bgpmon.net/fp.php?aid=830521190 That is just a small sampling. Maybe two years down the road, Cisco will speak to customers first before destroying a useful service. Anyone else trying this out and feels the same or feels differently? Disappointed, Hank

1 0

Charter and Cox contacts
by daniel＠pyranah.com 14 May '19

14 May '19

Does anyone have contacts at Charter (Spectrum) and Cox? For some reason, our IP has been blocked by them and our customers are unable to send email via their charter/cox accounts. Thanks Daniel Temple VP of Operations Pyranah Communications, LLC 828-743-2470 ext.205 <http://www.pyranah.com/> Pyranah.com <https://www.facebook.com/cashiersvalleyelectronics/> Like us on Facebook!

3 2

IPv6 ingress filter
by Amos Rosenboim 14 May '19

14 May '19

Hello, As we are trying to tighten the security for IPv6 traffic in our network, I was looking for a reference IPv6 ingress filter. I came up with Job Snijders suggestion (thank you Job) that can be conveniently found at whois -h whois.ripe.net fltr-martian-v6 After applying the filter I noticed some traffic from 6to4 addresses (2002::/16) to our native IPv6 prefixes (residential users in this case). The traffic is a mix of both UDP and TCP but all on high port numbers on both destination and source. It seems to me like some P2P traffic, but I really can’t tell. This got me thinking, why should we filter these addresses at all ? I know 6to4 is mostly dead, but is it inherently bad ? And if so, why is the prefix (2002::/16) still being routed ? I would love to hear some thoughts on this, and understand if others are actually filtering this at both data plane and control plane. Thanks, Amos Rosenboim --

2 2

Re: Charter and Cox contacts
by daniel＠pyranah.com 14 May '19

14 May '19

"On 5/13/19 12:11 PM, daniel(a)pyranah.com wrote: > Does anyone have contacts at Charter (Spectrum) and Cox? For some reason, > our IP has been blocked by them and our customers are unable to send email > via their charter/cox accounts. Thanks Would you be talking about port 25/tcp outbound? Lots of ISPs will block port 25 as a rule; you have to call to have it opened. At the same time, you can request the PTR record you need to keep big mail receivers happy." It's the outgoing smtp ports, 587 for charter and 465 for cox. They are open on my end but our IP address that most of our customers are natted through is blocked by the email servers. Daniel Temple VP of Operations Pyranah Communications, LLC 828-743-2470 ext.205 Pyranah.com Like us on Facebook! -----Original Message----- From: NANOG <nanog-bounces(a)nanog.org> On Behalf Of nanog-request(a)nanog.org Sent: Tuesday, May 14, 2019 8:00 AM To: nanog(a)nanog.org Subject: NANOG Digest, Vol 136, Issue 14 Send NANOG mailing list submissions to nanog(a)nanog.org To subscribe or unsubscribe via the World Wide Web, visit https://mailman.nanog.org/mailman/listinfo/nanog or, via email, send a message with subject or body 'help' to nanog-request(a)nanog.org You can reach the person managing the list at nanog-owner(a)nanog.org When replying, please edit your Subject line so it is more specific than "Re: Contents of NANOG digest..." Today's Topics: 1. Issues with SIP packets between VZ Fios and NTT (Dovid Bender) 2. Re: Ownership of Routers on Both Ends of Transnational Links (Pengxiong Zhu) 3. Re: Issues with SIP packets between VZ Fios and NTT (Brielle Bruns) 4. Re: Ownership of Routers on Both Ends of Transnational Links (Christopher Morrow) 5. Re: Issues with SIP packets between VZ Fios and NTT (Dovid Bender) 6. Re: Ownership of Routers on Both Ends of Transnational Links (Pengxiong Zhu) 7. Re: Issues with SIP packets between VZ Fios and NTT (Brielle Bruns) 8. Re: Issues with SIP packets between VZ Fios and NTT (Dovid Bender) 9. Re: Ownership of Routers on Both Ends of Transnational Links (Christopher Morrow) 10. Re: Issues with SIP packets between VZ Fios and NTT (Dovid Bender) 11. Re: Issues with SIP packets between VZ Fios and NTT (Jared Mauch) 12. Re: Issues with SIP packets between VZ Fios and NTT (Dovid Bender) 13. Re: Issues with SIP packets between VZ Fios and NTT (Pete Rohrman) 14. Charter and Cox contacts (daniel(a)pyranah.com) 15. Mostly name and shame... (bzs(a)theworld.com) 16. Re: Ownership of Routers on Both Ends of Transnational Links (Randy Bush) 17. Re: Charter and Cox contacts (Stephen Satchell) 18. RE: FCC Hurricane Michael after-action report (frnkblk(a)iname.com) 19. Re: FCC Hurricane Michael after-action report (Mike Bolitho) 20. Re: Issues with SIP packets between VZ Fios and NTT (Saku Ytti) 21. Re: NTP for ASBRs? (Mark Tinka) 22. Re: NTP for ASBRs? (colin johnston) 23. Fwd: [afnog] SAFNOG-5 & iWeek 2019 Registrations Open (Mark Tinka) 24. Re: Issues with SIP packets between VZ Fios and NTT (Dovid Bender) ---------------------------------------------------------------------- Message: 1 Date: Mon, 13 May 2019 11:21:12 -0400 From: Dovid Bender <dovid(a)telecurve.com> To: NANOG <nanog(a)nanog.org> Subject: Issues with SIP packets between VZ Fios and NTT Message-ID: <CAM3TTh2qpkWOD2DPy2GU-9hHkKUX8GVExfjYmmq0YEeCyubaKw(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hi, Over the last 48 hours we have been getting a lot of alerts of customers phones losing registrations to us. All the complaints are coming from customers that are on VZ Fios in the NYC area. Anyone else see anything strange going on? TIA. Dovid

1 0

Issues with SIP packets between VZ Fios and NTT
by Dovid Bender 14 May '19

14 May '19

Hi, Over the last 48 hours we have been getting a lot of alerts of customers phones losing registrations to us. All the complaints are coming from customers that are on VZ Fios in the NYC area. Anyone else see anything strange going on? TIA. Dovid

5 10

Fwd: [afnog] SAFNOG-5 & iWeek 2019 Registrations Open
by Mark Tinka 14 May '19

14 May '19

FYI. Mark. -------- Forwarded Message -------- Subject: [afnog] SAFNOG-5 & iWeek 2019 Registrations Open Date: Mon, 13 May 2019 11:06:53 +0000 From: Portia Rabonda <portia.rabonda(a)safnog.net> To: afnog(a)afnog.org <afnog(a)afnog.org> Greetings All, It gives us great pleasure to announce that the SAFNOG-5 & iWeek 2019 event registration is now open! SAFNOG, in collaboration with iWeek, is proud to announce that this year’s event registration is free of charge. SAFNOG-5 and iWeek 2019 will be held between the 26th- 28th August, 2019, in Johannesburg, South Africa. SAFNOG-5 seats are limited to 120 people, to reserve your spot, register through our website: http://safnog.org/. Please take note to select “SAFNOG-5” as the main event of attendance to secure your free seat. Information about the event programme, the venue, travel information and other important updates will be made available on http://safnog.org/ in due time. We are officially 105 days from the big showdown in Jozi! We look forward to seeing you there! Regards, Portia Rabonda on Behalf of SAFNOG MC

1 0