- Test - lists.nanog.org

Can you help on a survey on network testing?
by Yifei Yuan 15 Sep '17

15 Sep '17

Dear Folks, My name is Yifei Yuan, and I am a researcher at Carnegie Mellon University. I am working on a research project related to testing network configurations, where I want to survey the problems that are encountered when conducting testing on networks. I would very much appreciate it, if you could participate this survey, which can be found in the following link: http://cmu.ca1.qualtrics.com/jfe/form/SV_bvE1oBeO9NI5r5X The survey is anonymous, and it would take no more than 5 mins to finish up all questions. Your participation is voluntary with no compensation, and you must be at least 18 years of age to complete the survey. Thanks, Yifei Yuan Postdoctoral researcher ECE, CMU

1 0

Operational message: DNS root zone KSK rollover to occur on October 11, 2017 at 1600 UTC
by Matt Larson 15 Sep '17

15 Sep '17

The root zone management partners, ICANN and Verisign, are working together to change the DNS root zone's key-signing key (KSK). This process is referred to as "rolling" the root zone KSK. The root zone's apex DNSKEY RRset has been signed with the same KSK, known as KSK-2010, since the root zone was first signed in July, 2010. On October 11, 2017, at approximately 1600 UTC, the root zone will be published with the apex DNSKEY RRset signed for the first time with a new KSK, known as KSK-2017. The root zone apex DNSKEY RRset will be signed with only KSK-2017 going forward. While the specific date of the KSK rollover, October 11, 2017, had been announced previously, the time of 1600 UTC on that day has not been announced until now, which is the primary purpose of this message. The public portion of the root zone KSK is configured as a trust anchor in software performing DNSSEC validation. The configuration of any software performing DNSSEC validation will need to be updated to reference KSK-2017 on or before October 11, 2017, or all DNS responses received by that software will fail DNSSEC validation, resulting ultimately in error messages to end users. In many cases, software performing DNSSEC validation supports "Automated Updates of DNS Security", the protocol defined in RFC 5011 that can automatically update a DNSSEC validator's trust anchor configuration. If the software does not support this protocol, or it is incorrectly implemented or not configured correctly, the trust anchor will need to be updated manually. Anyone operating software performing DNSSEC validation with the root zone KSK configured as a trust anchor must take action on or before October 11, 2017, to confirm that their software is configured with KSK-2017 as a trust anchor and, if not, take the necessary steps to update the configuration. Further information about the root KSK rollover, including information about how to check and update the trust anchor configuration of popular recursive resolver implementations that support DNSSEC validation, is available at https://icann.org/kskroll. For the root zone management partners, Matt Larson VP of Research, ICANN Duane Wessels Distinguished Engineer, Verisign

1 0

Find carriers that peer in two IX's
by Dovid Bender 15 Sep '17

15 Sep '17

Hi, Does anyone know of a tool like PeeringDB where I can select two exchanges say TELX 60 Hudson and then SIX (Seattle IX) and find all carriers that have a presence in both locations? TIA. Dovid

6 6

Re: IPv6 Loopback/Point-to-Point address allocation
by Owen DeLong 15 Sep '17

15 Sep '17

> On Sep 15, 2017, at 6:02 AM, Nikolay Shopik <shopik(a)nvcube.net> wrote: > > > >> On 11 Sep 2017, at 21:55, Owen DeLong <owen(a)delong.com> wrote: >> >> >>> On Sep 11, 2017, at 3:35 AM, Nikolay Shopik <shopik+lists(a)nvcube.net> wrote: >>> >>> On 10/09/2017 14:25, Saku Ytti wrote: >>>> However I don't think market would generally appreciate the >>>> implications linklocal brings to traceroute, where least bad option >>>> would be just to originate hop-limit exceeded from loop0, with no >>>> visibility on actual interface. >>> >>> rfc5837 would help but it seems market universally ignore it for some reason unknown to me (lack of interest and IPv6 adoption?) >>> >>> We find LL is simpler, operation wise at some cases. >> >> >> How’s that work out for you on routers with the same MAC address on multiple interfaces when you’re trying to troubleshoot ECMP trace routes? >> >> Owen >> > > We dont have such cases where LL used but i belive rfc i mention is exactly solve that problem It _MIGHT_ help in some circumstances if it were ubiquitously or universally implemented, however, as you yourself noted, it is not. You were offering advice to someone without investigating the characteristics of his network. That advice could well have negative tradeoffs which you neglected to mention. I felt a duty to point them out. Owen

1 0

Verizon Wireless IPv6 deployment contact?
by Randy Carpenter 15 Sep '17

15 Sep '17

Is there anyone from Verizon Wireless that I can talk to regarding IPv6 deployment? I am getting nonsensical answers from my local contacts. Please contact me off-list. thanks, -Randy

1 0

Re: 2017 NANOG Elections General Information
by Dave Temkin 14 Sep '17

14 Sep '17

Hi NANOG Community, Nominations are rapidly coming to a close - September 8th is the last day to submit nominees. Unfortunately, to follow up on my paragraph about diversity: So far, every single candidate that has completed the nomination process is a white male. Having sat in on sessions such as Women in Technology lunch, I know that this community is passionate about diversity. If you, or a friend, would like to discuss what it takes to be on the NANOG board, I or my colleagues would love to speak about it. If you're ready to enter the nomination process, you can see details below. Best Regards, -Dave Temkin, for the NANOG Board of Directors On Mon, Aug 7, 2017 at 2:54 PM, Dave Temkin <dave(a)temk.in> wrote: > Hello NANOGers! > > We are once again approaching the annual NANOG election > <http://nanog.org/elections/2017/general> and appointment time. Board > candidate nominations open August 7th and the complete Election timeline > can be found here <http://nanog.org/elections/2017/general>. We encourage > those in the community who are not currently NANOG members to consider > becoming members of NANOG and to consider standing for a position in our > leadership. Through membership and voting, you will be an active > participant in directing all NANOG activities. > > Only NANOG members are eligible to nominate, be a candidate, vote, and > serve in the NANOG Board of Directors and Committees. Click here > <https://www.nanog.org/membership> to become a member today! **If you > are not a member and wish to vote in this election, your membership must > be received by 9:00 a.m. Pacific Time on Wednesday, October 4, 2017.** > > Why? > > NANOG is at its strongest and best when there is an engaged group of > members. If you care about NANOG and would like to take a turn at > volunteering your time, please consider becoming part of the team by taking > part in the nomination and election process. If you know someone else > that you believe would be interested in serving on the Board of Directors, > nominate them by completing the Online Process > <https://www.bigpulse.com/138028/signin> beginning August 7, 2017. Any > questions should be submitted to elections(a)nanog.org. > > As I spoke about during my opening at NANOG 70, diversity is key to the > viability of the NANOG community. Personally, it concerns me that our only > non-white, non-male elected member of the Board is leaving the board this > year, having served the maximum allowable number of terms. While everyone > is welcome, it is important that we represent our community well at all > levels and so if you or someone you know could help improve that > representation, please consider the nomination process. > > As NANOG continues to evolve, our Board of Directors and Committees will > continue to play an increasingly important role in our success. By joining > now, you can be an integral part of the process. > > For more information about the role of a Board of Director or any > Committee Member, or to find out more about what's involved in serving, > please consult the current NANOG Bylaws > <https://nanog.org/sites/default/files/sites/default/files/NANOG-Bylaws-Octo…> > or follow the links to the Board and Committee pages from the General > 2017 NANOG Elections Page <https://www.nanog.org/elections/2017/general>. > > > Best regards, > > Dave Temkin > On behalf of the NANOG Board of Directors >

7 12

SAFNOG-3: Conference Report
by Mark Tinka 14 Sep '17

14 Sep '17

Hello all. With the SAFNOG-3 event - recently held in Durban, South Africa - just concluded, the SAFNOG-3 MC (Management Committee) would like to extend its gratitude and appreciation to all the delegates, speakers, sponsors, partners and iWeek, for your support in producing yet another successful SAFNOG conference. SAFNOG-3 recorded 172 registered participants, with 160 shows in Durban. Furthermore, we attracted 1,009 unique views via the live stream throughout the 2-day conference. Each of the presentations that were given during the meeting are now available online to download at: http://www.safnog.org/#section-agenda Videos of each of the presentations are catalogued and available on the SAFNOG Youtube channel at: https://www.youtube.com/channel/UCLRItGb8Y2HXIu_EUdp3Sag/playlists High-resolution photographs of both conference days as well as the exhibition room, closing social dinner and whisky BoF are also all available at: http://www.safnog.org/ For those who attended the meeting (remotely or in-person), we welcome your feedback to help us understand what worked, what didn't, what you'd like to see for the next meeting(s), and how we can improve. Kindly spend some time completing the online survey for this at: https://www.surveymonkey.com/r/G2QGX5D SAFNOG now moves back into its normal schedule of April, with the upcoming SAFNOG-4 meeting. Details about this event will be shared on our mailing list and with the wider community in the coming weeks. We look forward to seeing you all (again) in April, 2018. Cheers, Mark Tinka On Behalf of the SAFNOG Management Committee

1 0

Verizon issues | Looking glass
by Van Dyk, Donovan 14 Sep '17

14 Sep '17

Hello, Has anyone else been seeing issues today from routes being learnt through the Verizon network, AS 701? Does anyone know if they have a looking glass? I can’t find one. Thanks -- Donovan Van Dyk SOC Network Engineer Fort Lauderdale, FL USA [cid:image001.png@01D32CD1.73DBD490] The information contained in this electronic mail transmission and its attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient (or an individual responsible for delivery of the message to such person), you are strictly prohibited from copying, disseminating or distributing this communication. If you have received this communication in error, please notify the sender immediately and destroy all electronic, paper or other versions.

3 2

Re: Protocol 17 floods from Vietnam & Mexico?
by Large Hadron Collider 13 Sep '17

13 Sep '17

Yes, I'm being UDP flooded. I worked that out by grepping /etc/protocols. On 12/09/2017 18:24, Matt Harris wrote: > Protocol 17 is UDP. UDP is pretty common on the internet. Not sure > why source and destination ports aren't being shown by your tool > there, might be malformed UDP packets designed to obscure themselves > from or otherwise evade some intrusion detection or firewall systems. > > > On Tue, Sep 12, 2017 at 8:08 PM, Large Hadron Collider > <large.hadron.collider(a)gmx.com <mailto:large.hadron.collider@gmx.com>> > wrote: > > 18:04:32.391082 IP 138-122-97-251.internet.static.ientc.mx > <http://138-122-97-251.internet.static.ientc.mx> > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391088 IP 138-122-97-251.internet.static.ientc.mx > <http://138-122-97-251.internet.static.ientc.mx> > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391110 IP 115.75.50.106.35180 > umbrellix.net.10454: UDP, > bad length 65500 > 1464 > 18:04:32.391145 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391152 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391158 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391164 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391170 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391176 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391182 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391188 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391194 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391199 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391205 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391211 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391217 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391223 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391229 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391234 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391248 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391255 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391261 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391266 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391272 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391278 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391284 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391289 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391295 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391313 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391319 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391325 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391331 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391336 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391342 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391348 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391354 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391367 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391374 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391379 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391385 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391391 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391396 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391402 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391408 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391414 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391420 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > 18:04:32.391426 IP 115.75.50.106 > umbrellix.net > <http://umbrellix.net>: ip-proto-17 > > Some stupidity has me wondering... protocol 17? Huh? > > > Is this some attempt to exploit me while at the same time flooding > me at over 800Mbit/s? > > > Needless to say, I've shut my computer down to avoid going over my > data allowance. > > > > > -- > Matt Harris - Chief Security Officer > Main: +1 855.696.3834 ext 103 > Mobile: +1 908.590.9472 > Email:matt@netfire.net <mailto:matt@netfire.net>

5 4

Getting an RADB entry removed that was added by a previous peer
by Matthew Huff 13 Sep '17

13 Sep '17

It appears that Reliance Globalcom (AS6157) added an RADB entry for our prefix (129.77.0.0/16) when we were a peer of theirs years ago, and it was never removed when we ended the relationship. We are ASN 14607. I've reached out to their support, but does anyone have a suggestion on how I could get this cleaned up if they don't respond?

4 3