- Test - lists.nanog.org

xtube.com/ultradns/dynect zone issues
by Feldman, Mark 30 Mar '18

30 Mar '18

If folks from xtube.com/ultradns/dynect are on the list, it appears that there’s a discrepancy in the xtube.com zone being served by the some auths. At least one of the CNAMEs required for resolution is missing from the zone being served by at least some ultra instances. No idea where the breakdown is, but we’ve got customers telling the world that we’re blocking access to porn. I’ll also note that the SOA ttl and ncache are on the large side, so we’re caching those NXDOMAINs for quite a while. Flushing is just playing whack-a-mole at the moment. Also, if folks from any large auths want to provide me with contact info, we’ll happily reach out to you privately/directly should something similar occur in the future . Mark Comcast TPX Core Network Services

1 0

Network Services Forms/methods for tracking
by Craig 30 Mar '18

30 Mar '18

Could anyone that operates in a ISP or large enterprise that deals with many different customers/clients discuss some methods you handle network service requests. - Do you have/use an online form? - How is it tracked, IE a service request #, circuit ID, etc? - Can the customer look up the info to see if their request is completed? - Can engineers reference this info when issues arrise, and customers call in for support? - Pros/cons about the method you are using now? once the information is gathered how is it verified? (sometimes clients/customers don't know what they need....) and finally what information does the engineer receive to complete the build of the network service? does the engineer update the information when the network service is build out so its tracked? I am looking to get some feedback on some better ways to handle network requests, service providers would probably have good feedback on this that can facilitate collecting all the info needed, adding to the info once the build is completed and then having something that can be accessed when any t-shooting is required, and also if the service is to be decommissioned. Any feedback is appreciated; craig

1 0

new diffserv code point LE PHB
by Mikael Abrahamsson 30 Mar '18

30 Mar '18

Hi, I would like to bring attention to the following IETF draft: https://tools.ietf.org/html/draft-ietf-tsvwg-le-phb-04 I believe this is well under way through the IETF process, and if someone has strong opinions on it they should speak up. I am one of the proponents, as I posted to this list back in 2015: https://mailman.nanog.org/pipermail/nanog/2015-July/077040.html I think it's a great idea to have a diffserv code point that is supposed to be treated less than best effort (for backup traffic for instance), but it would be nice if someone would be willing to deploy support for it as well. Thoughts? -- Mikael Abrahamsson email: swmike(a)swm.pp.se

3 2

Fwd: [vicky@isc.org: Planning to stop exporting BIND libraries]
by Rich Kulawiec 29 Mar '18

29 Mar '18

Forwarding here to expose it to a larger, possibly-interested audience. ---rsk ----- Forwarded message from Victoria Risk <vicky(a)isc.org> ----- > From: Victoria Risk <vicky(a)isc.org> > Date: Fri, 23 Mar 2018 12:30:26 +0000 > To: bind-announce(a)lists.isc.org > Subject: Planning to stop exporting BIND libraries > > BIND currently exports number of libraries, including libisc, libisccfg, libirs, libisccc, libdns and libbind9. > > We don???t know of any external projects that use these libraries. Keeping the ABI and API stable is big burden, and we are exploring the possibility of merging all the libraries into a tightly-coupled private library that wouldn't be used outside of BIND (and tools). This change would effectively make those libraries private. > > BIND 9.14 in 2019 would be the first release that would drop the libraries. > > The BIND 9.11 ESV would keep those libraries until 2022, so any external users would have enough time to migrate to other DNS libraries. > > Known external users of libisc and friends: > - ISC DHCP (will continue using BIND 9.11 libraries) > - dnsperf (either use BIND 9.11 libraries, or offer ISC project) > > Please let us know if you see a significant problem with this plan, including which library you are using and how you are using it. > > Thank you > > Vicky > > ------------- > Victoria Risk > Product Manager > Internet Systems Consortium > vicky(a)isc.org > > ----- End forwarded message -----

1 0

RIPE NCC Global IPv6 Deployment Survey
by Massimiliano Stucchi 29 Mar '18

29 Mar '18

Hi, just a little reminder that there are a few days left to help the RIPE NCC by filling up our Global IPv6 Deployment Survey. We have already received a considerable amount of responses, but would like to hear from more people. The goal of the survey is to get an overview of IPv6 deployment across the world, and to assess how this is seen from the perspective of ISPs and Enterprise users. The 2018 survey is a follow up to similar surveys run between 2008 and 2013, and will serve as a comparison with the data acquired back then. You can find the survey at the following address: https://www.surveymonkey.com/r/GlobalIPv6survey2018 Responses can be submitted until 31 March 2018. We will then collect the data with the aim of presenting the preliminary results during the upcoming RIPE 76 meeting in Marseille. If you have any question about the survey, please feel free to email us at: ipv6survey2018(a)ripe.net. Thank you very much in advance for your participation! -- Massimiliano Stucchi IPv6 Programme Manager RIPE NCC mstucchi(a)ripe.net Follow us on Twitter for the fastest and latest RIPE NCC Training news! @TrainingRIPENCC

1 0

aol login problems - my.screenname.aol.com
by Aaron Gould 29 Mar '18

29 Mar '18

When going to aol.com and click "login/join" in top-right corner, brings you to a login page. when I try to login, I get nothing. just tries and tries to take me to the next page, which seems to be my.screenname.aol.com. but it never gets there. If I try from different subnets in my network, it does work. But from other subnets it does not. Has anyone ever heard/seen this problem ? Anyone from aol here that can assist with this please ? You can contact me directly if you can assist. -Aaron

1 0

Re: validating reachability via an ISP
by Baldur Norddahl 29 Mar '18

29 Mar '18

Also the only traffic you will be receiving on the other provider will be from parties that did not pick up the more specific prefix. It should therefore be really obvious. You should not receive any traffic at all, not even from the transit provider. Regards, Baldur Den tor. 29. mar. 2018 10.41 skrev Baldur Norddahl < baldur.norddahl(a)gmail.com>: > If your prefix is larger than /24 you can test with a more specific prefix > such as a /24. Announce the test prefix on just one transit provider. Then > check with BGP services such as the looking glass service provided by the > NLNOG RING network. > > There will be no interruption in the traffic as it will follow the less > specific prefix everywhere the test prefix was not picked up. > > If you only have a /24 you will need to test in a service window. > > Regards > > Baldur > > > Den tor. 29. mar. 2018 01.24 skrev Andy Litzinger < > andy.litzinger.lists(a)gmail.com>: > >> Hi all, >> I have an enterprise network and do not provide transit. In one of our >> datacenters we have our own prefixes and rely on two ISPs as BGP neighbors >> to provide global reachability for our prefixes. One is a large regional >> provider and the other is a large global provider. >> >> Recently we took our link to the global provider offline to perform >> maintenance on our router. Nearly immediately we were hit with alerts >> that >> our prefix was unreachable and BGPMon alerted that nearly 80 AS's noted >> our >> route had been withdrawn. We were not unreachable from every AS, but we >> certainly were from some of the largest. >> >> The root cause is that the our prefix is not being adequately >> re-distributed globally by the regional ISP. This is unexpected and we >> are >> working through this with them now. >> >> My question is, how can I monitor global reachability for a prefix via >> this >> or any specific provider I use over time? Are there various route-servers >> I can programmatically query for my prefix and get results that include AS >> paths? Then I could verify that an "acceptable" number of paths exist that >> include the AS of the all the ISPs I rely upon. And what would an >> "acceptable" number of alternate paths be? >> >> >> thanks in advance, >> -andy >> >

1 0

Québec Sales tax
by Jean-Francois Mezei 28 Mar '18

28 Mar '18

Not quite networking but probably relevant. The Canadian province of Québec just introduced a new budget with basically the intent to force foreign digital companies who sell services to Québekers to collect the local value added sales tax and remit those to the QC government. The goal is to capture tax from Netflix who has so far escaped taxation in Canada by having no legal/physical presence in Canada, no cache servers of its own etc. Netflix does not currently collect province information from customers (or any address info for that matter). They based many of their arguments on an OECD study (which ironically the Canadian federal government says is not completed yet (as excuse for not proceeding with similar tax). So foreign digital services will be required to require subscibers enter AND VALIDATE their address so that they have an accurate province field (validation remains to be finalized), and IF they sell more than $30,000 to Québec residents, will be required to self register with QC government to collect local sales tax (and remit to QC government). The Québec budget expects that validation of address will be based on IP address geolocation or custoemrs send paper bills to prove place of residence. (Although requiring full address/phone number and sendint this to credit card network for authorization might constitute a better means to validate address). I suspect the big winners will be VPN services in the USA :-) Because many ISPs span multiple provinces, IP geolocation generally points to their HQ address, not necessarily the province of the subscriber. (This is especially true for DSL in bell Canada wholesale where currently a single point of connection between Bell and ISP allows full reach of all of its DSL territory in QC/ON. For Cable, ISPs require different IP pools for Rogers in Ontario and Vidéotron in Ontario (with a couple of exceptions where Vidéotron has service in a couple fo Ontario towns). In Western Canada, things are harder as Shaw serves BC, AB, SASK and MB.

4 7

Firewall as a Service.
by Daniel Corbe 27 Mar '18

27 Mar '18

Are there any vendors that have hardware firewalls and maintain their own Openstack nova/neutron driver set? I’m looking for something that I can offer to my VPS customers as a self-managed service. At the moment, I’m using the default firewall driver. Which is nothing but a wrapper for iptables; and while seamless, I can’t imagine it’s going to scale very well. I’m looking for something that has 10 gig client connectivity and either 100G or 40G uplinks. -Daniel

1 0

Re: Québec Sales tax
by Eric Dugas 27 Mar '18

27 Mar '18

Replied off-list since it's a bit off-topic. On Tue, Mar 27, 2018, 18:47 Jean-Francois Mezei <jfmezei_nanog(a)vaxination.ca (mailto:jfmezei_nanog@vaxination.ca)> wrote: > On 2018-03-27 18:28, Eric Dugas wrote: > > On the IP geoloc subject, we (EBOX) actually have multiple pools for QC-based and ON-based customers. > > You may all have different IP pools, but are they registered such that > geolocation services show them with different provinces, or do they all > point to your > > OrgName: EBOX > OrgId: QUEBE-50 > Address: 1225 St-Charles Ouest, Suite 1100 > City: Longueuil > StateProv: QC > PostalCode: J4K 0B9 > Country: CA > > address ? > (there were complains in the past of some of your ON customers unable to > access Sport Check and being directed to Sport Experts store web sites > due to geolocation.

1 0