- Test - lists.nanog.org

Prefix hijacking by AS20115
by Seth Mattinen 29 Sep '15

29 Sep '15

I've got a problem where AS20115 continues to announce prefixes after BGP neighbors were shutdown. They claim it's a wedged BGP process but aren't in any hurry to fix it outside of a maintenance window. I'm at a loss of what else I can do. They admit the problem but won't take action saying it needs to wait for a maintenance window. Am I out of line insisting that's an unacceptable response to a problem that results in prefix/traffic hijacking? ~Seth

21 33

T1 Availability in Indianapolis
by Stetson Blake 29 Sep '15

29 Sep '15

Hey all, I am wondering if anyone has a contact for T1 availability, CLEC or otherwise. I am looking specifically around: Dividend Drive Indianapolis, IN 46241 Please contact me off list Thanks, ? Stetson Blake Network Administrator Voice: (937) 610-3514 Toll-Free: (800) 982-4539 ext. 3514 DataYard 130 West Second St. Suite 250 Dayton, OH 45402 http://datayardworks.com<http://datayardworks.com/>

1 0

Hummingbird Networks Optics
by Eric C. Miller 29 Sep '15

29 Sep '15

Does anybody have any experience with Hummingbird Networks optics? Thank you! Eric

1 0

Re: Prefix hijacking by AS20115
by Hank Nussbacher 29 Sep '15

29 Sep '15

At 23:11 28/09/2015 -0400, Josh Luthman wrote: >Start announcing their prefixes? Contact the upstreams of AS20115 - Cogent, Level3, HE and XO. -Hank >Josh Luthman >Office: 937-552-2340 >Direct: 937-552-2343 >1100 Wayne St >Suite 1337 >Troy, OH 45373 >On Sep 28, 2015 11:09 PM, "Seth Mattinen" <sethm(a)rollernet.us> wrote: > > > On 9/28/15 18:30, William Herrin wrote: > > > >> On Mon, Sep 28, 2015 at 9:01 PM, Seth Mattinen <sethm(a)rollernet.us> > >> wrote: > >> > >>> I've got a problem where AS20115 continues to announce prefixes after BGP > >>> neighbors were shutdown. They claim it's a wedged BGP process but aren't > >>> in > >>> any hurry to fix it outside of a maintenance window. > >>> > >> > >> If they weren't lying to you, they'd fix it now. That's not the kind > >> of problem that waits. > >> > >> Thing is: they lied to you. Long ago they "helpfully" programmed their > >> router to announce your route regardless of whether you sent a route > >> to them. They want to wait for a maintenance window to remove that > >> configuration. > >> > >> > >> I'm at a loss of what else I can do. They admit the problem but won't take > >>> action saying it needs to wait for a maintenance window. Am I out of line > >>> insisting that's an unacceptable response to a problem that results in > >>> prefix/traffic hijacking? > >>> > >> > >> Try dropping the link entirely. If they still announce your addresses, > >> bring it back up but report it as emergency down, escalate, and call > >> back every 10 minutes until the junior tech understands that it's time > >> to call and wake up the guy who makes the decision to fix it now. > >> > >> > > > > I'm at the tail end here almost 8 hours later since the hijacking started. > > Their NOC is just blowing me off now and they're happy to continue the > > hijacking until it's convenient for them to have a maintenance window. And > > that's apparently the final decision. > > > > ~Seth > >

3 2

Facebook - IP Engineering Contact
by Erik Sundberg 29 Sep '15

29 Sep '15

Can an IP Engineer from facebook please contact me off list. I have routing issue getting to your mai1 (Miami, FL) pop. Unrelated to the issue earlier today. Erik Sundberg Sr. Network Engineer p: 773.661.5532 c: 708.710.7419 866.892.0915 24/7 NOC 1101 W. Lake Street, 6th Floor | Chicago, IL 60607 esundberg(a)nitelusa.com<mailto:esundberg@nitelusa.com> | www.nitelusa.com<http://www.nitelusa.com/> ________________________________ CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must destroy the original transmission and its attachments without reading or saving in any manner. Thank you.

1 0

Re: Question re session hijacking in dual stack environments w/MacOS
by John Schimmel 29 Sep '15

29 Sep '15

I can¹t speak to every case, but I ran into a similar issue with our WAF product, so I can explain what was happening there. Most Web application firewalls have cross-site request forgery protection. When a form is downloaded, the firewall inserts a hidden field or cookie that contains the IP address of the request. When the form is submitted, the firewall then verifies that the post is sent from the same address. If the client does a get via IPv6, and the form contains a form action for a URL that is better reached via IPv4 then the firewall sees the post coming from a different IP address and refuses the request. This is nothing specifically to do with MacOS, it is true of any multi-homed system. The options are either to rewrite the client to guarantee that the address in a post always matches the corresponding get; to maintain different URLs on the server such that requests from IPv6 clients always return action URLs that will go to an IPv6 hostname, and vice-versa for IPv4; or to disable CSRF protection. Later, John > From: David Hubbard <dhubbard(a)dino.hostasaurus.com> > > Hey all, as we've slowly deployed IPv6 to our end users, it has begun to > cause some issues for those on Mac's specifically. Apple apparently has > an algorithm at some point in the network stack to decide whether IPv4 > or IPv6 is, perhaps, 'better' or 'faster' at any given point in time > during an ongoing session. This allows a computer talking to a dual > stack remote website to flip flop between v4 and v6 as activity is > conducted. > > Websites that require some type of authentication that is handled via > session cookies have been booting our users out randomly with "your ip > address has changed" type message. This occurs when their Mac decides > to switch between protocols because the site views it as a session > hijacking attempt when Joe User with session ID xyz switches from > 192.0.2.10 to 2001:db8::1:1:a or vice versa. > > Has anyone run into this? Our users on other platforms don't seem to > have this issue; linux and MS desktops seem to just use v6 if it's > available and v4 if not. > > Thanks, > > David

2 1

Facebook invisible in Italy
by Marco Paesani 28 Sep '15

28 Sep '15

Hi, some issues from FB network ?? Do you have some info ? Regards, -- Marco Paesani MPAE Srl Skype: mpaesani Mobile: +39 348 6019349 Success depends on the right choice ! Email: marco(a)paesani.it

13 12

Important - Register for NANOG 65 _by 1 October_ to Vote in the NRO NC Election
by John Curran 28 Sep '15

28 Sep '15

NANOGers - Meeting attendees who register for NANOG 65 by 1 October will be eligible to vote online in the Number Resource Organization Number Council (NRO NC) election for the ARIN region. If you are also an ARIN eligible voting contact, please note that you will vote in this same election beginning 8 October when voting opens for the ARIN Board and ARIN Advisory Council elections. The 2015 candidates for the one open seat are: - Louie Lee, Equinix - Timothy McGinnis, Unaffiliated You can view candidate questionnaires and see/make statements of support at: https://www.bigpulse.com/p35820/ You can learn more about the role of the NRO NC at: https://www.arin.net/about_us/nronc.html Note that all eligible NANOG 65 registered attendees will receive an email at 10:00 AM ET on Monday 5 October with instructions on how to cast your ballot. The election closes at 3:00 PM EDT Friday 16 October and results will be announced the following week. Please visit the ARIN Elections Helpdesk onsite in Montreal if you have issues voting or contact us via email at: info(a)arin.net. Thank you for participating! /John John Curran President and CEO American Registry for Internet Numbers (ARIN)

1 0

Recent trouble with QUIC?
by Sean Hunter 28 Sep '15

28 Sep '15

Hi all, I work for a 2500 user university and we've seen some odd behavior recently. 2-4 weeks ago we started seeing Google searches that would fail for ~2 minutes, or disconnects in Gmail briefly. This week, and particularly in the last 2-3 days, we've had reports from numerous users on campus, even those who generally do not complain unless an issue has been ongoing for a while. Those reports include Drive disconnecting, searches failing, Gmail presenting a "007" error, and calendar failing to create events. In fact, the issue became so widespread today, that the campus paper is writing about it as a last minute article before they're weekly publication's deadline this evening. (Important in our little world where we try to look good.) We aren't really staffed or equipped to figure out exactly what's happening (and issues are sporadic, so packet captures are difficult, to say the least), but we found that disabling QUIC dramatically and immediately improved the experience of a couple of users on campus. We're recommending via the paper that others do so as well. What I'm curious about is: a) Has anyone here had a similar experience? Was the root cause QUIC in your case? b) Has anyone noticed anything remotely similar in the last few weeks/days/today? We're an Apps domain, so this may be specific to universities in the Apps universe. If anyone has any useful information or hints, or if someone from Google would like more information, please feel free to contact me, on or off list. Thanks for reading and have a great night everyone! Happy Wednesday!

14 18

CHP website returning 503
by Grant Ridder 28 Sep '15

28 Sep '15

Hey, If anyone from CHP (california highway patrol) is listening, your website is returning a 503. curl -v https://www.chp.ca.gov * Rebuilt URL to: https://www.chp.ca.gov/ * Hostname was NOT found in DNS cache * Trying 168.145.114.48... * Connected to www.chp.ca.gov (168.145.114.48) port 443 (#0) * TLS 1.2 connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA * Server certificate: *.chp.ca.gov * Server certificate: Entrust Certification Authority - L1K * Server certificate: Entrust Root Certification Authority - G2 > GET / HTTP/1.1 > User-Agent: curl/7.37.1 > Host: www.chp.ca.gov > Accept: */* > < HTTP/1.1 503 Service Unavailable < Content-Type: text/html; charset=us-ascii < Date: Mon, 28 Sep 2015 02:48:23 GMT < X-Cnection: close < Content-Length: 326 < <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"" http://www.w3.org/TR/html4/strict.dtd"> <HTML><HEAD><TITLE>Service Unavailable</TITLE> <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD> <BODY><h2>Service Unavailable</h2> <hr><p>HTTP Error 503. The service is unavailable.</p> </BODY></HTML> * Connection #0 to host www.chp.ca.gov left intact -Grant

9 12