- Test - lists.nanog.org

Changes to ARIN Online - Routing Security Dashboard - RPKI & IRR integration (was: Fwd: [arin-announce] New Features Added to ARIN Online)
by John Curran 10 Aug '23

10 Aug '23

NANOGers - We have made some fairly significant changes for those customers using ARIN Online for routing security administration – see attached message for specifics. FYI, /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net> Subject: [arin-announce] New Features Added to ARIN Online Date: August 7, 2023 at 1:37:51 PM EDT To: <arin-announce(a)arin.net> ARIN is pleased to present the latest version of ARIN Online, including improvements, new features, and updates. Full release notes are included at the end of this message. All ARIN systems have been restored and are now operating normally. We thank you for your patience. If you have additional questions, comments, or issues, please submit an Ask ARIN ticket using your ARIN Online account or contact the Registration Services Help Desk by phone Monday through Friday, 7:00 AM to 7:00 PM ET at +1.703.227.0660. Regards, Mark Kosters Chief Technology Officer American Registry for Internet Numbers (ARIN) Release Notes - Navigation and eligibility status for ARIN’s routing security services, the Resource Public Key Infrastructure (RPKI), and Internet Routing Registry (IRR) have been condensed into a single Routing Security Dashboard in ARIN Online. We have also made the navigation of the IRR pages consistent with the RPKI portions of the website. - Abuse, Network Operation Center (NOC), and DNS Points of Contact now have read-only viewing privileges for RPKI details in both ARIN Online and the RESTful API. - Creating a new Route Origin Authorization (ROA) in ARIN Online now automatically creates and manages the matching IRR Route Objects based on the ROA prefix and max length configuration. If the creation of a ROA would result in more than 256 IRR Route Objects, no managed IRR Route Objects will be created. Managed IRR Route Objects may not be removed independently of their covering ROAs. Deleting a ROA in ARIN Online will automatically delete its corresponding managed IRR Route Objects. In the coming weeks, ARIN will create managed IRR Route Objects for all preexisting ROAs that do not currently have matching IRR Route Objects. Preexisting IRR Route Objects that match ROAs will be associated with the covering ROA. - To create feature parity with templates, we have added the capability to modify reassignment information within ARIN Online without any changes to the registration date. - Customers can begin the application process for the Qualified Facilitator Program in ARIN Online. ARIN Qualified Facilitators serve as resources for the community by assisting organizations seeking to acquire or transfer IPv4 or Autonomous System Number (ASN) resources. _______________________________________________ ARIN-Announce You are receiving this message because you are subscribed to the ARIN Announce Mailing List (ARIN-announce(a)arin.net) Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-announce Please contact info(a)arin.net if you experience any issues.

4 7

Is there anyone from Bell Mobility to help us unblock a routing issue?
by Raphael Grenier 10 Aug '23

10 Aug '23

Hi, We are looking for someone from Bell mobility NOC. We are a VoIP service provider: Cloudli Communication ASN#18637. We are peering with Bell ISP and advertising the IP block 198.38.7.0/24. We have connectivity problems with our customers, when they are on the Bell LTE networks in the Lac Saint-Jean region. For information, when customers move to another region, everything works fine. This disorder started in April. Thank you Raphael Grenier

1 0

Last Mile ISP Quality Measurements
by Mike Hammett 09 Aug '23

09 Aug '23

What are other last mile ISPs doing to measure the quality of their connections? We all know pinging various destinations. We also all know that pinging a destination doesn't necessarily tell you the whole quality story. I currently have Smokeping pulling the HTTPS for about 20 - 25 of the "top" websites, per the old Alexa rankings. I feel as though I could be doing more. I am more closely wanting to emulate the end-user experience in a repeatable, quantifiable fashion. I'd like to do A/B comparisons as well. When I make X change, how does it change? If I'm already doing the low-hanging fruit path, then so be it. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

6 7

VIDEO - NANOG Talks to Seattle Community Network + Guest Column: Geoff Huston
by Nanog News 09 Aug '23

09 Aug '23

*VIDEO - NANOG Talks to Seattle Community Network* *NANOG Talks to SCN About Connecting the Underserved Across Puget Sound* *The Seattle Community Network (SCN) is an Internet built by the community for the community.* NANOG Executive Director Edward McNair sat down with a volunteer of SCN + Ph.D. candidate in the Department of Computer Science at the University of Washington, Esther Jang, at our most recent meeting, NANOG 88 (Seattle, Wa, 12 - 14 Jun) to discuss the mission of SCN and how they are connecting + empowering underserved regions locally. *WATCH NOW * <https://www.google.com/url?q=https://nanog.us20.list-manage.com/track/click…> *Guest Column: Geoff Huston "The Source of Time, According to a Technologist"* *Exploring the Definition of Time from Early Astronomical Observations to its use in the Internet Today* An underappreciated aspect of our digital infrastructure is how dependent we are on time. Disrupting time leads to communication disruption and can result in various forms of service compromise. A synchronized view of the time is essential to the Internet's service platform. *READ MORE * <https://www.google.com/url?q=https://nanog.us20.list-manage.com/track/click…> *Upcoming Fall Online Course* *Fundamentals of Designing and Deploying Computer Networks* *Date: *11 September – 20 October 2023 *Title:* Fundamentals of Designing and Deploying Computer Networks *Description:* This course will discuss the fundamentals of networking, Ethernet, and WIFI technologies. It will additionally teach the planning, design, and deployment of simple LANs and cover how to connect a LAN to the Internet. The course will also present the most common ways to connect a LAN to the Internet (Mobile Internet, ADSL, Fiber) and how to set up the connections. *MORE INFO * <https://www.internetsociety.org/learning/ddcn/> *Video of the Week* *Deploying a Backbone in APAC with Pierre-Yves Maunier* Maunier discusses what his team learned and changed during their multi-year journey expanding their network footprint in the Asia Pacific region. He will speak about the challenges they faced, their mistakes, and how they worked around them with various iterations of their deployment. *WATCH NOW * <https://www.youtube.com/watch?v=TS9xsOPCVHI&t=217s>

1 0

Looking for a Telus cellular last mile facilities operations contact
by Eric Kuhnke 09 Aug '23

09 Aug '23

I have observed a Telus cellular site shelter that's making a terrible, not normal ventilation noise. It's a 12+ foot length prefab assemble on site shelter located in the basement parking garage of a 23 floor tower in downtown Vancouver. I know what this POP's normal ventilation sounds like, having seen.and heard it in operation for several years now, and this isn't healthy. Based on the amount of sectors on the roof and ptp microwave links from this site I would guess this is a more important than ordinary site, so if Telus doesn't want to wait for it to overheat and die, contact me off list for the street address of the building. I have already tried spending about 45 minutes on the phone with Telus customer service (I am not a customer) and this has been making the "I am a dying ventilation blower" noise for two weeks now.

1 0

Spoofer Report for NANOG for Jul 2023
by CAIDA Spoofer Project 08 Aug '23

08 Aug '23

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Jul 2023: ASN Name Fixed-By 54825 PACKET 2023-07-02 6128 CABLE-NET-1 2023-07-03 6124 MARIST 2023-07-06 14576 HOSTING-SOLUTIONS 2023-07-16 394233 CLOUDWIFI 2023-07-21 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jul 2023: ASN Name First-Spoofed Last-Spoofed 3356 LEVEL3 2016-03-06 2023-07-14 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2023-07-27 20412 CLARITY-TELECOM 2016-09-30 2023-07-31 25787 ROWE-NETWORKS 2016-10-21 2023-07-28 11427 TWC-11427-TEXAS 2016-10-21 2023-07-25 10796 TWC-10796-MIDWEST 2016-10-24 2023-07-30 271 BCNET 2016-10-24 2023-07-29 852 ASN852 2017-04-16 2023-07-31 53274 3DB-WIRELESS 2019-01-18 2023-07-05 46997 2021-12-22 2023-07-27 394414 E2WS 2022-05-08 2023-07-26 397086 GLOBAL-FRAG-NETWORKS-HOUSTON 2022-06-16 2023-07-25 400517 2022-10-03 2023-07-10 12183 TALKIE-COMMUNICATIONS 2022-12-10 2023-07-21 964 GONET-ASN-17 2023-03-15 2023-07-07 41378 KirinoNET 2023-03-23 2023-07-28 3701 NERONET 2023-04-18 2023-07-26 400282 2023-04-27 2023-07-28 13693 NTS-ONLINE 2023-05-05 2023-07-29 46690 SNET-FCC 2023-05-20 2023-07-29 200063 CAMINI-IMPEX 2023-06-16 2023-07-21 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Fwd: NTP Sync Issue Across Tata (Europe)
by Mel Beckman 06 Aug '23

06 Aug '23

Or one can read recent research papers that thoroughly document the incredible fragility of the existing NTP hierarchy and soberly consider their recommendations for remediation: https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1A-2_24302_paper… Or simply use non-Internet NTP servers based on a Stratum-0 GPS source for mission-critical network timing. Until then, we may all wake up one morning and discover massive data breaches traced to an unfounded reliance on insecure public NTP servers. Then the game truly will be over, but not in our favor. -mel On Aug 6, 2023, at 2:35 PM, Rubens Kuhl <rubensk(a)gmail.com> wrote: Or one can select NTS-capable NTP servers, like those 5: a.st1.ntp.br b.st1.ntp.br c.st1.ntp.br d.st1.ntp.br gps.ntp.br Or any other NTP server that has NTS deployed. Game-over for NTP impersonation. Rubens On Sun, Aug 6, 2023 at 4:41 PM Mel Beckman <mel(a)beckman.org> wrote: In a nutshell, no. Refer to my prior cites for detailed explanations. For a list of real-world attack incidents, see https://en.m.wikipedia.org/wiki/NTP_server_misuse_and_abuse# -mel On Aug 6, 2023, at 12:03 PM, Royce Williams <royce(a)techsolvency.com> wrote: Naively, instead of abstaining ;) ... isn't robust diversity of NTP peering a reasonable mitigation for this, as designed? Royce On Sun, Aug 6, 2023 at 10:21 AM Mel Beckman <mel(a)beckman.org> wrote: William, Due to flaws in the NTP protocol, a simple UDP filter is not enough. These flaws make it trivial to spoof NTP packets, and many firewalls have no specific protection against this. in one attack the malefactor simply fires a continuous stream of NTP packets with invalid time at your firewall. When your NTP client queries the spoofed server, the malicious packet is the one you likely receive. That’s just one attack vector. There are several others, and all have complex remediation. Why should people bother being exposed to the risk at all? Simply avoid Internet-routed NTP. there are many solutions, as I’ve already described. Having suffered through such attacks more than once, I can say from personal experience that you don’t want to risk it.

1 0

Re: NTP Sync Issue Across Tata (Europe)
by Rubens Kuhl 06 Aug '23

06 Aug '23

The paper suggests the compromise of critical infrastructure. So, besides not using NTP, why not stop using DNS ? Just populate a hosts file with all you need. BTW, the stratum-0 source you suggested is known to have been manipulated in the past (https://www.gps.gov/systems/gps/modernization/sa/) so you need to bet on that specific state actor not returning to old habits. OTOH, 4 of the 5 servers I suggested have their own atomic clock, and you can keep using GPS as well. If GPS goes bananas on timing, that source will just be disregarded (one of the features of the NTP architecture that has been pointed out over and over in this thread and you keep ignoring it). Rubens Rubens On Sun, Aug 6, 2023 at 8:20 PM Mel Beckman <mel(a)beckman.org> wrote: > Or one can read recent research papers that thoroughly document the > incredible fragility of the existing NTP hierarchy and soberly consider > their recommendations for remediation: > > [image: preview.png] > > ndss2021_1A-2_24302_paper > <https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1A-2_24302_paper…> > PDF Document · 1.7 MB > <https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1A-2_24302_paper…> > > <https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1A-2_24302_paper…> > > Or simply use non-Internet NTP servers based on a Stratum-0 GPS source for > mission-critical network timing. > > Until then, we may all wake up one morning and discover massive data > breaches traced to an unfounded reliance on insecure public NTP servers. > Then the game truly will be over, but not in our favor. > > -mel > > On Aug 6, 2023, at 2:35 PM, Rubens Kuhl <rubensk(a)gmail.com> wrote: > > Or one can select NTS-capable NTP servers, like those 5: > a.st1.ntp.br > b.st1.ntp.br > c.st1.ntp.br > d.st1.ntp.br > gps.ntp.br > > Or any other NTP server that has NTS deployed. Game-over for NTP > impersonation. > > > Rubens > > On Sun, Aug 6, 2023 at 4:41 PM Mel Beckman <mel(a)beckman.org> wrote: > > > In a nutshell, no. Refer to my prior cites for detailed explanations. For > a list of real-world attack incidents, see > > > https://en.m.wikipedia.org/wiki/NTP_server_misuse_and_abuse# > > > > -mel > > > On Aug 6, 2023, at 12:03 PM, Royce Williams <royce(a)techsolvency.com> > wrote: > > > > > Naively, instead of abstaining ;) ... isn't robust diversity of NTP > peering a reasonable mitigation for this, as designed? > > > Royce > > > On Sun, Aug 6, 2023 at 10:21 AM Mel Beckman <mel(a)beckman.org> wrote: > > > William, > > > Due to flaws in the NTP protocol, a simple UDP filter is not enough. These > flaws make it trivial to spoof NTP packets, and many firewalls have no > specific protection against this. in one attack the malefactor simply fires > a continuous stream of NTP packets with invalid time at your firewall. When > your NTP client queries the spoofed server, the malicious packet is the one > you likely receive. > > > That’s just one attack vector. There are several others, and all have > complex remediation. Why should people bother being exposed to the risk at > all? Simply avoid Internet-routed NTP. there are many solutions, as I’ve > already described. Having suffered through such attacks more than once, I > can say from personal experience that you don’t want to risk it. > > >

1 0

SMS Email Gateway - sms.myboostmobile.com discontinued
by Matthew McGehrin 06 Aug '23

06 Aug '23

Hello. For the past few weeks I have been noticing that various emails were bouncing when sending to sms.myboostmobile.com, which has been a reliable SMS gateway for 10+ years. I contacted "Advanced Support" on Saturday who said that Boost Mobile has discontinued their SMS Email Gateway after the DISH merger. Just a heads up if you have any SMS email gateways being used that you should also periodically test them, to ensure they are still active. Matthew

2 1

Re: NTP Sync Issue Across Tata (Europe)
by Mel Beckman 06 Aug '23

06 Aug '23

Niels, You’re the first person to mention neutral collocation facilities as a requirement. The OP only talked about servers generally. Obviously, building your own GPS-based NTP network requires you have visibility to the sky. However, that need not be rooftop access. We routinely locate GPS antennae for time synch at CLEC colos in an available window, behind the glass. Nobody has yet charged us anything more than a one-time cabling fee for that. But most carrier-neutral colos already have their own GPS-derived, non-Internet time source to which you can subscribe. There is thus no reason to build your own airgapped network, as one is already available from the facility. If you don’t need PTP 50-μs-precise timing for SONET and whatnot, ordinary NTP is very cost effective. For example: <https://docs.equinix.com/en-us/Content/Edge-Services/EPT/EPT.htm> About Equinix Precision Time<https://docs.equinix.com/en-us/Content/Edge-Services/EPT/EPT.htm> docs.equinix.com<https://docs.equinix.com/en-us/Content/Edge-Services/EPT/EPT.htm> [favicon-16x16.png]<https://docs.equinix.com/en-us/Content/Edge-Services/EPT/EPT.htm> Most colos also offer their own Stratum-1 public NTP servers for free. For example, Hurricane Electric (https://www.he.net/adm/ntp.html) Being you’re already on-net in the colo, that would still give you NTP that doesn’t transit the Internet. Still way better than pool.ntp.org! -mel On Aug 6, 2023, at 4:53 AM, Niels Bakker <niels=nanog(a)bakker.net> wrote: * mel(a)beckman.org (Mel Beckman) [Sun 06 Aug 2023, 04:26 CEST]: if you can eliminate such security problems for $400, I say it’s cheap at twice the price. You must be unfamiliar with the prices neutral colocation facilities charge for roof access. -- Niels.

1 0