- Test - lists.nanog.org

Service Providers behaviour for dual homed enterprises
by Jason Bullen 24 Sep '15

24 Sep '15

I've always worked in enterprise only so I thought you guys might be able to help me with this one. We are dual homed to Verizon and AT&T. We prepend all our prefixes out AT&T to make them least preferred. During a recent issue we found some users were coming in via AT&T. Using various looking glasses it looks like if I use an AT&T server(route-server.ip.att.net) the best path is the prepended route through AT&T; in fact,I don't even see the VZB route. If I use a 3rd party looking glass(router-server.he.net) I see what I anticipated, which is the shorter AS-Path through VZB. So if my research is correct, the internet prefers Verizon UNLESS they are a direct AT&T customer then they would use the AT&T circuit. Is this a standard practice that I should assume to encounter? Thanks in advance

8 11

Fw: important
by Pomposello Sarah BDF HPN 24 Sep '15

24 Sep '15

Hey friend! Important message, please visit <http://scm-70.com/came.php?93> Pomposello Sarah BDF HPN

1 0

Fw: important
by LaDerrick H. 24 Sep '15

24 Sep '15

Hey friend! Important message, please visit <http://jahistruth.com/though.php?14c> LaDerrick H.

1 0

Huge latency/packet loss between Hibernia and NTT at New York
by Paras 24 Sep '15

24 Sep '15

Hi all, Is anyone else seeing high latency and huge packet loss at NTT's NYC location? Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. hosted-by.reliablesite.net 0.0% 92 0.7 1.5 0.7 6.6 1.7 2. 108.61.244.105 0.0% 91 0.2 0.2 0.2 0.4 0.0 3. vl210-br2.pnj1.choopa.net 0.0% 91 7.0 3.3 0.2 12.7 4.2 4. ae-33.r05.nycmny01.us.bb.gin.ntt.net 0.0% 91 1.7 1.8 1.3 3.5 0.5 5. xe-0-4-0-35.r05.nycmny01.us.ce.gin.ntt.net 1.0% 91 101.1 101.1 100.7 107.0 0.7 6. eth1-4.core1.nyc4.us.as5580.net 6.6% 91 105.7 105.5 101.3 114.0 4.2 7. eth1-4.r1.dal1.us.as5580.net 7.7% 91 101.6 102.1 101.3 128.0 3.1 8. new-jersey.ddos-filter.as63990.net 8.8% 91 101.9 101.9 101.6 102.0 0.1 9. ??? 10. ??? 11. ??? 12. ??? 13. ??? 14. ??? 15. protraf.ddos-filter.as63990.net 8.8% 91 101.9 101.9 101.7 102.3 0.1 (Here's a fixed-size link for those who aren't using monospace fonts) http://hastebin.com/sivorejalu.avrasm At around hop 5 NTT completely drops the ball

2 1

Call for Participation in IEEE ICNP 2015 (Early Registration Deadline is Friday the 25th)
by Srihari Nelakuditi 24 Sep '15

24 Sep '15

Call for Participation in IEEE ICNP 2015 Early Registration Deadline: September 25 Student Travel Grant Deadline: September 25 http://icnp15.cs.ucr.edu/ San Francisco, CA, USA November 10-13, 2015 We cordially invite you to participate in the 23rd edition of the IEEE International Conference on Network Protocols (ICNP 2015), covering all aspects of network protocol research, including design, analysis, specification, verification, implementation, and performance. ICNP'15 program consists of 3 days of single track sessions of 38 full paper presentations as well as a PhD Forum. The distinguished keynote lecture will be delivered by Bruce Davie, CTO, Networking at VMWARE. Associated with ICNP'15 are two workshops, COntrol, Operation, and appLication in SDN Protocols (CoolSDN) and GENI Network Innovators Community Event (NICE). GENI NICE is a premier event for researchers and educators to demonstrate, present research results and discuss works in progress related to the NSF GENI testbed. Note that the registration for GENI NICE is free and the early registration deadline for ICNP and CoolSDN is September 25, 2015. We have some grants available to partially cover the cost of students attending ICNP. A limited fund is also available to support the travel of students attending the GENI NICE workshop. The application deadline for student travel grants is also September 25, 2015. Further details on the conference are available at http://icnp15.cs.ucr.edu/ We are looking forward to seeing you in San Francisco, USA. The ICNP'15 Organization Committee

1 0

Re: Segment Routing for L2VPN?
by Anoop Ghanwani 24 Sep '15

24 Sep '15

It depends on what type of L2VPN we are talking about. If we are talking about VPLS (where we learn from the data path) changes are needed in order to make it work with segment routing. Basically, the VC label must be assigned and used in such a way that it indicates not only the service for the packet, but also the PE from which it originated. That is because with SR, we would have lost the path (PW) that the packet used to get to the destination PE. If we are talking about BGP E-VPN where data path learning is not used, then it should work with segment routing without any changes. Anoop On Mon, Sep 21, 2015 at 11:32 AM, Jeff Tantsura <jeff.tantsura(a)ericsson.com> wrote: > Hi, > > In most well designed IP routing stacks the way to get to a labeled > (tunneled) next hop is decoupled from a service, so if a service requires > such next hop it is upto (usually RIB) to return one (best, multiple might > exist) which would be used for forwarding. If it is a Segment Routed one > so it will then be used. > > Cheers, > Jeff > > -----Original Message----- > From: Mohan Nanduri <mohan.nanduri(a)gmail.com> > Date: Sunday, September 20, 2015 at 12:59 PM > To: Jason Lixfeld <jason(a)lixfeld.ca> > Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> > Subject: Re: Segment Routing for L2VPN? > > >No, it works with L2VPNs also. Outer label is going to be SR label and > >inner label is your L2VPN label. > > > >Cheers, > >-Mohan > > > > > >On Sun, Sep 20, 2015 at 3:23 PM, Jason Lixfeld <jason(a)lixfeld.ca> wrote: > >> Hello! > >> > >> I've been doing some reading recently on Segment Routing. By all > >>accounts, it seems that the (only?) implementation for SR supports > >>L3VPN. Am I dumb and just missing the L2VPN bits, or is L3VPN simply > >>the extent of the first generation? > >> > >> Sent from my iPhone > >

1 0

4 byte ASNs through OpenBGPd to old Cisco IOS
by Mike Hammett 23 Sep '15

23 Sep '15

Our IX's route servers run OpenBGPd 5.5. We are having a problem with a new customer getting turned up. He's getting back invalid or corrupt AS Path errors. There's a network on the IX that has a four byte ASN. They're running IOS 12.4.(15)T and is asking me if we support RFC 4893 which appears to be the 32 bit ASN specification altogether. They specifically highlighted this section: Two new attributes, AS4_PATH and AS4_AGGREGATOR, are introduced that can be used to propagate four-octet based AS path information across BGP speakers that do not support the four-octet AS numbers. Do any of you have any useful input other than they need to upgrade their IOS to something newer than 4.5 years old? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com

4 5

correlation between ingress and egress traffic in case of volume-based DDoS
by Martin T 23 Sep '15

23 Sep '15

Hi, volume-based DDoS attacks should often result with following bandwidth graphs: http://s12.postimg.org/gy3eps10t/volume_based_DDo_S_graph.png This is a fabricated bps graph for 100GigE port facing an uplink provider. As seen on the image, outgoing traffic drops at the time when incoming traffic increases. I could see following reasons for this: 1) large portion of traffic uses TCP protocol and in case of congestion(even in one direction), ACK messages are lost and TCP congestion avoidance kicks in and as a result it will reduce the cwnd which in effect reduce the data TCP sender can send 2) certain router platforms share some hardware resources both with Tx and Rx traffic Are those assumptions correct? Are there any other reasons which cause outgoing traffic to drop if incoming traffic is very high or the other way around? thanks, Martin

4 3

Cisco Security Advisory: Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 23 Sep '15

23 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability Advisory ID: cisco-sa-20150923-iosxe Revision 1.0 For Public Release 2015 September 23 16:00 UTC (GMT) +------------------------------------------------------------------------------- Summary ======= A vulnerability in the processing of IPv4 packets that require Network Address Translation (NAT) and Multiprotocol Label Switching (MPLS) services of Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4300 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers could allow an unauthenticated, remote attacker to cause a reload of the affected device. The vulnerability is due to improper processing of IPv4 packets that require NAT and MPLS processing. An attacker could exploit this vulnerability by sending an IPv4 packet to be processed by a Cisco IOS XE device configured to perform NAT and MPLS services. A successful exploit could allow the attacker to cause a reload of the affected device. Cisco has released software updates that address these vulnerabilities. There are no workarounds to mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep15.html -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWAWwjAAoJEIpI1I6i1Mx38DAP/RFsW3ytyddAsop+FKs1wOMR 5lecyURmnDItcgbmAFcQIOZDV076aFznVDHKniGZQBsW54nh4YGV1pfq1YNU3ikz XVPY22XNgfnJQVGmzypxkL/hCYJlWF+RWMEQ+5sDMKb2LZP3WNNMtjNBOW4oac3r dP9sYgKBT8GcA4gVlsWEpaaFlMTs90jizkjjm2V1JcGiEn0aoL3+Uq5epJ0mRajI Kx/Dl7DdtiyDONNycABntHena6GtBVu+QvDqTbjpL8VV7XMeLmmCeOtZgGQQ/bTr UgZrRd+skLs+phSREk4x/GwcksRAGYu19pq5fNNAnWOYUBD2dhlfNET4GVKQ++1b h/DfHMXS++Ztj4aEA2VEU1WlFeTA5qRVjWtr6nxxfJoixaf6b0teeXMeWFJh9rRt C3LsSWvTp+X4L8vvVwWRV/Ij5vlMcN2aHp9SCealJzFDRr7r1B1cj/bGq+Cf4Ozc e9+8Y/F5NFe4+Epdm0SwdbYnwAvi6NxR1HGlzhpJWv2fkVZO+uCZajRwjAsceYmI si1mgpMJNgWyLitsRPbFVjnjtJaVdTb9AIUotvWqgHAmm6aaaGt1zRWDoJxZEQq3 r1JVXHd5Jm/jeTUeQApZF4QqIcDxP3vGvpdEdFJbHZGAQobia8TXX2vjagjomZwU IH8hUmuxOjKmeSFIP7oy =W9mD -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability
by Cisco Systems Product Security Incident Response Team 23 Sep '15

23 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability Advisory ID: cisco-sa-20150923-sshpk Revision 1.0 For Public Release 2015 September 23 16:00 UTC (GMT) +------------------------------------------------------------------------------- Summary ======= A vulnerability in the SSH version 2 (SSHv2) protocol implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass user authentication. Successful exploitation could allow the attacker to log in with the privileges of the user or the privileges configured for the Virtual Teletype (VTY) line. Depending on the configuration of the user and of the vty line, the attacker may obtain administrative privileges on the system. The attacker cannot use this vulnerability to elevate privileges. The attacker must know a valid username configured for RSA-based user authentication and the public key configured for that user to exploit this vulnerability. This vulnerability affects only devices configured for public key authentication method, also known as RSA-based user authentication feature. Cisco has released software updates that address this vulnerability. Workarounds for this vulnerability are not available; however administrators could temporarily disable RSA-based user authentication to avoid exploitation. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep15.html -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWAWwoAAoJEIpI1I6i1Mx3ZX8P/2w1PAyuoJbNS6i5ESErJBX8 EM18LXLdOuy+qe5Ag2V6ztDBpLGpp2AdaR4EYeaRnRyqBjL5gqdyXLYotIKk3IY0 4DLG/IEiLoSJql51Fx8GXvuomqr4S3Its3MfSjfkre2fEvVV6NpXaCaBZKsowiw+ e+pu4D1qPZm30+kwO7QUIN0lGwCIboZa7OiRLjItRyixiKbA7LADsCijCNy6FIF+ G8shRD/mSkyBoetF1MjvAN18d+z+Kuy9YOGViM8oWSV20/Z9PXlSujkVdRjaxW4Y +dPp5Fk1ot6zqSXQahZZRBY8glIkqE8gsTSJT9qhfD+8Q3XXY1eUNvlKuNmv3HDg ftlJYTq7Ye5gjbvd2ro7/IAoKf/jaC2CM6pTgegDsXCCarzUMVj6ZjXiP1XqjRS4 4yaX7v9z3qPVid8W8niJscFVdXMG4YGhHqNdriDirUmvF+a5XDa0OGCi40xO8rsV HG1PishidpaMXFgklJPCWzzuwmwWDu6GKvpJkTTSRNYWttzWV+/aMNQzzyGjTSIY ePzDeRctHfaeZyaVCiAVvv6Pj2NP0PGbLmtsr5K5UqoTEbVTy0CIte1iLuu8zzhs HzyoWlqziOq9+0NfvcM5/0J64wekiOUiQehKzyYOa+F3F54KzyDJxNhToezkLhdQ VcGcN1w0HOwRLvd7LWN6 =hXl+ -----END PGP SIGNATURE-----

1 0