- Test - lists.nanog.org

Fkiws with destination port 0 and TCP SYN flag set
by Maqbool Hashim 17 Jun '15

17 Jun '15

Hi, I am doing some flow analysis within our network primarily for understanding application flows to aid in network segregation activity and mainly understand what is going on inside the network. To do this I have been using netflow where the switches/firewalls support it. In some cases I have used a monitor port and fed full packet capture into the nfdump toolset for conversion into flows. There is a portion of our network where the switches only support sflow which is not ideal, but hopefully will be able to gather enough data over time to be useful. One of the things I was trying to identify was flow initiation, i.e. the client and server in the flow- so filtered for TCP packets with SYN flag set. It was at this point that I saw TCP SYN packets with a destination port of 0. I have seen this discussed before in this thread http://www.gossamer-threads.com/lists/nanog/users/155141 It was stated in that thread that netflow reports source/dest port 0 for non-initial fragments. My question was is this what I am seeing here, so any SYN packet with dest port 0 is a non-initial fragment seen by the tool? Therefore should I always see a corresponding response with Ack and Reset flags set? I do see a set of flows with R and A set with a source port of 0, all the dest port 0 flows have the SYN flag set, but it's hard to find ones that match a SYN packet due to only receiving a sample of flows. Some notes on the setup: Capture is from inside one VLAN Switches are sending sflow back to analysis tools, sampling rate of 1/1024 packets Using nfdump suite of tools for analysis. sfcapd as as the collector Thinking about this, is what I am seeing a symptom of the fact that the tools don't see all packets, i.e. the tools don't see the initial fragment due to sampling. However I still don't quite understand it appearing with the SYN flag set? I am starting to think that for these purposes I might be better abandoning sflow and go with setting up collectors on the switches to get full flow information for my purposes. Any clarification/input much appreciated. Regards MH

5 14

Unified Layer contact
by Chuck Church 16 Jun '15

16 Jun '15

Anyone on here from Unified Layer? Having an issue with a small ISP I help out occasionally. Some of their IP Space can reach a hosted web server, but their other prefixes cannot reach the destination. Traceroute from working IP space to destination web server (a bank) : 15 162-144-240-55.unifiedlayer.com (162.144.240.55) [AS 46606] 68 msec 162-144-240-43.unifiedlayer.com (162.144.240.43) [AS 46606] 68 msec 68 msec 16 grandsouth.com (162.144.109.184) [AS 46606] 76 msec 76 msec 72 msec >From non-working IP space: 15 162-144-240-51.unifiedlayer.com (162.144.240.51) [AS 46606] 80 msec 162-144-240-43.unifiedlayer.com (162.144.240.43) [AS 46606] 80 msec 162-144-240-47.unifiedlayer.com (162.144.240.47) [AS 46606] 84 msec 16 * * * 17 * * * 18 * * * We're not a customer of Unified Layer whom the bank uses for hosting, not getting much help via normal channels. Thanks, Chuck

1 0

[NANOG-announce] NANOG On The Road Comes to Herndon!!
by Valerie Wittkop 16 Jun '15

16 Jun '15

We are very excited to be holding the next NOTR event in the great city of Herndon, VA next Tuesday, and we invite you to join us! Are you interested in Internet networking/peering? Do you work at a colocation, hosting or data center facility? Are you a provider of hardware/software solutions for the Internet industry? If so, the NANOG On The Road <https://www.nanog.org/meetings/road7/home> Herndon event is perfect for you! Date: June 23, 2015 Time: Registration Desk opens at 8:30am and Program is from 9:00 AM - 5:00 PM Location: Westin Dulles Airport Hotel <https://www.nanog.org/meetings/road7/hotel> - 2520 Wasser Terrace, Herndon, VA 20171 The FREE to attend event is open for registration. Register Now! <https://www.cvent.com/events/notr-herndon-va/registration-8c87c541134e4d2eb…> The agenda <https://www.nanog.org/meetings/road7/agenda> is posted - topics to be discussed include: - Recent & Future Developments in DNS Security - International Network Supply, Traffic & Pricing - DNSSEC & RPKI - High fibre-coaxial networks - Optical Networking Tutorial - IPv6 Tutorial - BGP Tutorial If you are, or will be, in the Herndon area, we invite you to attend. And don’t forget to share the invitation with your colleagues or others you feel may benefit from attending. Make NANOG On The Road your first step toward learning how you can take the wheel and steer the future of the Internet. Learn more about On The Road events here <https://www.nanog.org/meetings/road/home>. Feel free to contact us at nanog-support(a)nanog.org <mailto:nanog-support@nanog.org> if you have any questions. Regards, Valerie Valerie Wittkop NANOG Program Director Tel: +1 866 902 1336, ext 103 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

RE: Greenfield ISP (In January)
by Nicholas Warren 16 Jun '15

16 Jun '15

Does anyone beside Cisco do MAP? Brocade, Juniper, Huawei? Thank you, - Nich Warren -----Original Message----- From: Tore Anderson [mailto:tore@fud.no] Sent: Friday, June 12, 2015 12:15 AM To: Baldur Norddahl Cc: Nicholas Warren; nanog(a)nanog.org Subject: Re: Greenfield 464XLAT (In January) * Baldur Norddahl <baldur.norddahl(a)gmail.com> > The high tech solution is stuff like MAP where you move the cost out > to the CPE. But then you need to control the CPE - if you have that > then great. You would still want to sell a non-NAT (and MAP is NAT) to > users that require a public IPv4 address, so you still need to go dual > stack or use some tunnelling for that. Hi Baldur, MAP is *not* NAT; that's what's so neat about it. The users do get a public IPv4 address (or prefix!) routed to their CPE's WAN interface, towards which they can accept inbound unsolicited connections. The public IPv4 address could be port-restricted if the operator wants address sharing, but it does not have to be. You could do both at the same time, e.g., giving your "premium" users a /32 or /28, while the standard subscription includes a /32 with 4k ports. I will grant you that MAP-T performs NAT (i.e., protocol translation) internally, but the translations that happens when a packet enters the MAP domain are reversed when it exits. So the IPv4 addresses are transparent end-to-end. MAP-E (and lw4o6 for that matter), on the other hand, has no form of NAT anywhere. (Unless you count the NAPT44 that sits between the subscriber's RFC1918 LAN segment and the CPE's WAN interface, but that's not exactly something that's unique to MAP.) Nicholas: If I were you, before going down the 464XLAT route, I'd first look closely at these technologies, in the order given: 1) MAP (because it is fully stateless) 2) lw4o6 (because it is mostly stateless, i.e., no session tracking) 3) DS-Lite (which, like 464XLAT, is stateful, but you'll have way more CPEs to choose from than with 464XLAT, which is mostly for mobile) Tore

1 0

ZTE GPON Configuration
by DJ Anderson 16 Jun '15

16 Jun '15

Good Morning All, I am not sure if this is the right place to ask this question or not, so here it goes. I am looking for someone that has experience programming a ZTE GPON OLT and setting up some ONU profiles to go with it. I have just about everything figured out except some issues with the sip configuration and updating things like the country code so that it plays the right dial tone. I guess really I am looking for a ZTE GPON expert. I am willing to pay for anyone's time I really just either need some CLI examples or just to pick someone's brain. Any help that could be provided is greatly appreciated. Please contact me off list. Thanks! DJ Anderson Techwebhosting.com dj at techwebhosting.com

1 0

2.4Ghz 40Mhz 802.11n wifi and Apple Macbook
by Anurag Bhatia 15 Jun '15

15 Jun '15

Hello everyone, I am running a TP Link TL-WR1043N which (as TP Link says is a) 802.11n router working on 2.4Ghz (no support for 5Ghz). I am running it with flashed OpenWRT. While using option to pick 40Mhz, I see my Mac only gets 20Mhz to use and speed is always 130Mbps. There's no other SSID nearby and I am sitting next to router for testing. This brings me to question - Has anyone successfully used 40Mhz with 2.4Ghz on 802.11n standard with Apple Macbook? I wonder if it's limitation on the chipset or something else. Thanks. -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter <https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2

8 9

Setting Up a Looking Glass
by Mike Hammett 15 Jun '15

15 Jun '15

What's out there for setting up your own looking glass? I saw lots of lists of dead projects or projects that hadn't received any love in years. Being as most the people I work with don't run Cisco, Juniper, etc. for routers, likely having those capabilities with the LG would be nice. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com

11 16

Paging Versaweb!
by Andy Blanchard 15 Jun '15

15 Jun '15

Is there anyone from Versaweb on the list, or anyone in the NOC at all? Firstly, both the contact addresses you have listed in WHOIS (ipadmin@ and abuse-reports@) are bouncing emails - no such user. More urgently, while trialling a new SIEM tool I've identified literally thousands of unique IPs spread across at least nine separate ARIN PI allocations scanning for MS DS / TCP:445 going back several months. 162.255.180.0/24 would be a good place to start looking for the common link - I've logged over 150 unique IPs in that block alone, but the rest are not much better. I hate to think what else might have slipped through the net - inbound or outbound... -- Andy The only person to have all his work done by Friday was Robinson Crusoe

1 0

Apple ECN, Bufferbloat, CoDel (fwd)
by Mikael Abrahamsson 15 Jun '15

15 Jun '15

Hi, I just want to bring to your attention the below talk (I am too lazy to re-write the whole email for this slightly different audience). Takeaway: We'll see a lot of ECN enabled traffic in a few months. This shouldn't be a problem. I've been doing it to all my machines for 3-5 years without ill effects. More people will become interested in how TCP works, from application, through the host stack, to the AQM (or lack thereof) in the router etc. If you don't do AQM towards your customers, be prepared that they're going to start complaining in a more informed manner in the not so distant future. IPv6 only with NAT64+DNS64 will become a lot more feasible going forward. I am not a fan of breaking DNSSEC, but perhaps if we can do the DNS64 in the host (as it seems Apple is doing, at least for IPv4 literals), then that might be possible to work around. ---------- Forwarded message ---------- Date: Sat, 13 Jun 2015 18:07:57 +0200 (CEST) From: Mikael Abrahamsson <swmike(a)swm.pp.se> To: bloat(a)lists.bufferbloat.net Subject: Apple ECN, Bufferbloat, CoDel I highly encourage people to take a look at: https://developer.apple.com/videos/wwdc/2015/?id=719 (you might have to reigster as an apple developer to watch it, I don't know) "Your App and Next Generation Networks IPv6 is growing exponentially and carriers worldwide are moving to pure IPv6 APNs. Learn about new tools to test your apps for compatibility and get expert advice on making sure your apps work in all network environments. iOS 9 and OS X 10.11 now support the latest TCP standards. Hear from the experts on TCP Fast Open and Explicit Congestion Notification, and find out how it benefits your apps." Being on this list you might not learn much from the talk, but I really appreciate a talk aimed at a wider (developer) audience which so clearly outlines the benefits of ECN, CoDel and TCP host opimization to reduce end-to-end experienced application communication latency. One of the major takeaways is that Apple is planning to by default enable ECN in iOS9 and OSX 10.11. This would mean hundreds of millions of devices will be using ECN in a few months. You can skip to 16 minutes into the talk if you're not interested in the new requirement for applications to support an environment where it's Internet access is IPv6 only behind NAT64+DNS64 (I'm myself super excited about this). Let's hope this brings a lot of buzz and requests towards device manufacturers to start supporting ECN marking and AQM. Apple is usually a good megaphone to bring attention to these kinds of issues... -- Mikael Abrahamsson email: swmike(a)swm.pp.se

4 3

Looking for reputable seller of SFPs
by Hank Nussbacher 15 Jun '15

15 Jun '15

Looking for a reputable seller of SFPs in the US that ships overseas. Please reply off-list. Thanks, Hank

2 1