- Test - lists.nanog.org

cgnat ams0 vrf-aware flow data export help
by Aaron Gould 14 Feb '19

14 Feb '19

Need assistance with exporting flow data for inside interface of cgnat ams0 aggregated multiservice interface I have MX960 with MS-MPC-128G doing cgnat using AMS0 (aggregated multiservice of underlying mams interfaces) using next-hop-style vrf-aware cgnat. I need the cgnat inside domain interface (ams0.551) to be configured to export flow data (jflow, sflow, ipfix, whichever version i can use) to a flow collector server, this is important so we can have flow data of *pre-nat) private ip traffic. Anyone know how ? -Aaron

1 0

adding graphs for actually unreachable RPKI INVALID prefixes to RPKI Monitor?
by nusenu 14 Feb '19

14 Feb '19

Dear NIST RPKI Monitor Team, thanks for creating and maintaining the RPKI Monitor https://rpki-monitor.antd.nist.gov/#rpki_adopters I've seen your graphs in multiple routing security presentations :) What do you think about adding graphs that show the amount of actually unreachable prefixes and IP space? (prefix where no alternative valid/unknown announcement exists) I think such graphs would help us focus on those prefixes that we should have to tackle first. This page contains examples of INVALID prefixes that would still be reachable in a route origin validating environment (see the RPKI validator screenshots): https://medium.com/@nusenu/towards-cleaning-up-rpki-invalids-d69b03ab8a8c kind regards, nusenu -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

5 8

Fwd: wither cyclops?
by william manning 14 Feb '19

14 Feb '19

---------- Forwarded message --------- From: william manning <chinese.apricot(a)gmail.com> Date: Sat, Feb 9, 2019 at 9:34 PM Subject: wither cyclops? To: <nanog(a)nanog.org> Did this tool die on the vine? https://cyclops.cs.ucla.edu/ /Wm

2 1

AT&T/as7018 now drops invalid prefixes from peers
by Jay Borkenhagen 14 Feb '19

14 Feb '19

FYI: The AT&T/as7018 network is now dropping all RPKI-invalid route announcements that we receive from our peers. We continue to accept invalid route announcements from our customers, at least for now. We are communicating with our customers whose invalid announcements we are propagating, informing them that these routes will be accepted by fewer and fewer networks over time. Thanks to those of you who are publishing ROAs in the RPKI. We would also like to encourage other networks to join us in taking this step to improve the quality of routing information in the Internet. Thanks! Jay B.

17 24

VPS providers contacts
by Mehmet Akcin 14 Feb '19

14 Feb '19

Hey there I am looking to get in touch with VPS providers (like vultr.com etc.) which has all automated control panel to ask few questions regarding BGP implementation and overall automated control panel related stuff. I have been trying to get a hold of someone from virtkick.com which on paper sounded like exactly what i needed but unfortunately got no response from them. thanks in advance mehmet

6 6

skype attack
by Randy Bush 13 Feb '19

13 Feb '19

an update to skype will pop up and ask you deny. you will have to deny repeatedly. there is no reason in the world skype should have access to your icloud, contacts, ... randy

5 11

Latency question - Juniper MX960 vs the Tellabs 8860
by Steve Danello 13 Feb '19

13 Feb '19

Looking for two latency profiles, best/worst cast would be great for the Telllabs 8860 and Juniper MX960. Looks like the Juniper may be in the 15us range Both cases would be a 10Gb -1Gb and 1Gb - 10Gb We’d understand the serialization piece; really looking to provide a customer the hardware latency, we don’t have a great means to test them Thanks all! Steve

2 2

Route Filtering Update
by Christopher Morrow 13 Feb '19

13 Feb '19

Howdy! At Nanog74 in Vancouver I mentioned (along with some other folk in the security track) that we are planning on filtering peerings to AS15169 'by chrismas 2018', roughly speaking. A few folk(bcc'd, hi!) noticed that I'm late on that work item... yes I am, sorry. I'm hopeful I'll get the ducks[0[ lined up to get this accomplished this quarter instead. I'll be at the Nanog meeting next week and I'm hoping to get a lightning talk slot to chat about this, progress and next steps. Worse case operations folk interested should feel free to corner me at the venue to chat about this topic directly. other topics are also fine to chat about :) thanks, -chris 0: https://www.digitaltrends.com/wp-content/uploads/2013/02/1-duck-sized-horse…

1 0

Re: AT&T/as7018 now drops invalid prefixes from peers
by John Sweeting 12 Feb '19

12 Feb '19

From: TJ Trout <tj(a)fdisturlock.com> Date: Monday, February 11, 2019 at 6:49 PM To: <valdis.kletnieks(a)vt.edu> Cc: Jay Borkenhagen <jayb(a)braeburn.org>, nanog <nanog(a)nanog.org> Subject: Re: AT&T/as7018 now drops invalid prefixes from peers How does one register their routes in the Rpki? If the routes are in the Arin database under the proper company name is that sufficient? *Ducks* TJ and all, To participate in RPKI with ARIN, your organization would need to have Internet number resources directly registered and those Internet number resources must be covered under a Registration Services Agreement (RSA) or a Legacy RSA. In addition, participation in RPKI will require that you have an ARIN Online account, linked to an Admin or Tech Point of Contact (POC) on the Organization Identifier (Org ID) that contains the Internet number resources to be certified. Our “Resource Public Key Infrastructure (RPKI)” is a great jumping off point to get started with certifying your Internet number resources. If you would like any assistance verifying your eligibility for RPKI participation or would like additional information on getting started with RPKC, please call our Registration Services Helpdesk at 703.227.0660. Our hours of operation are Monday – Friday, from 7:00 am to 7:00 pm eastern time. On Mon, Feb 11, 2019, 3:09 PM <valdis.kletnieks(a)vt.edu<mailto:valdis.kletnieks@vt.edu> wrote: On Mon, 11 Feb 2019 09:53:45 -0500, Jay Borkenhagen said: > The AT&T/as7018 network is now dropping all RPKI-invalid route > announcements that we receive from our peers. Congrats! Are you able to comment on what amount of routes are getting dropped?

3 2

Clueful Contact at IPVolume.net ?
by Colin Johnston 12 Feb '19

12 Feb '19

Anyone know knowledgeable contact at IPvolume.net <http://ipvolume.net/> ? Having weird advance threat protection events from 93.174.93.73 and unable to get abuse contact to answer. Must be nice monitoring kit in London/NL/Frankfurt from Seychelles :( inetnum: 93.174.93.0 - 93.174.93.255 <https://apps.db.ripe.net/db-web-ui/#/lookup?source=ripe&key=93.174.93.0 - 93.174.93.255&type=inetnum> netname: NET-3-93 descr: IPV NETBLOCK country: NL geoloc: 52.370216 4.895168 org: ORG-IVI1-RIPE <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=ORG-IVI1-RIPE&t…> admin-c: IVI24-RIPE <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IVI24-RIPE&type…> tech-c: IVI24-RIPE <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IVI24-RIPE&type…> status: ASSIGNED PA mnt-by: IPV <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IPV&type=mntner> mnt-lower: IPV <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IPV&type=mntner> mnt-routes: IPV <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IPV&type=mntner> created: 2008-06-29T21:36:16Z last-modified: 2019-02-04T13:12:31Z source: RIPE Highlight RIPE NCC managed values Login to update <https://apps.db.ripe.net/db-web-ui/#/webupdates/modify/ripe/organisation/OR…> organisation: ORG-IVI1-RIPE <https://apps.db.ripe.net/db-web-ui/#/lookup?source=ripe&key=ORG-IVI1-RIPE&t…> org-name: IP Volume inc org-type: OTHER address: Suite 9 address: Victoria, Mahe address: Seychelles e-mail: abuse(a)ipvolume.net <mailto:abuse@ipvolume.net> abuse-c: IVNO1-RIPE <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IVNO1-RIPE&type…> mnt-ref: IPV <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IPV&type=mntner> mnt-by: IPV <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IPV&type=mntner> created: 2018-05-14T11:46:50Z last-modified: 2019-01-31T14:39:36Z source: RIPE Login to update <https://apps.db.ripe.net/db-web-ui/#/webupdates/modify/ripe/role/IVI24-RIPE> role: IPV address: Suite 9 address: Victoria, Mahe address: Seychelles e-mail: abuse(a)ipvolume.net <mailto:abuse@ipvolume.net> nic-hdl: IVI24-RIPE <https://apps.db.ripe.net/db-web-ui/#/lookup?source=ripe&key=IVI24-RIPE&type…> mnt-by: IPV <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IPV&type=mntner> created: 2018-05-16T13:28:41Z last-modified: 2019-01-31T21:21:20Z source: RIPE Login to update <https://apps.db.ripe.net/db-web-ui/#/webupdates/modify/ripe/route/93.174.93…> RIPEstat <https://stat.ripe.net/93.174.93.0/24?sourceapp=ripedb> route: 93.174.93.0/24 <https://apps.db.ripe.net/db-web-ui/#/lookup?source=ripe&key=93.174.93.0/24A…> origin: AS202425 remarks: +----------------------------------------------- remarks: | For abuse e-mail abuse(a)ipvolume.net <mailto:abuse@ipvolume.net> remarks: | We do not always reply to abuse. remarks: | But we do take care your report is dealt with! remarks: +----------------------------------------------- mnt-by: IPV <https://apps.db.ripe.net/db-web-ui/#/lookup?source=RIPE&key=IPV&type=mntner> created: 2019-02-08T16:07:14Z last-modified: 2019-02-08T16:07:14Z source: RIPE Colin

2 1