- Test - lists.nanog.org

ARIN+NANOG On The Road
by Eric C. Miller 25 Feb '15

25 Feb '15

Thank you to all who put this event on! It was fun getting to meet everyone :) Eric Miller, CCNP Network Engineering Consultant (407) 257-5115

1 0

Wisdom of using 100.64/10 (RFC6598) space in an Amazon VPC deployment
by Eric Germann 24 Feb '15

24 Feb '15

Currently engaged on a project where they’re building out a VPC infrastructure for hosted applications. Users access apps in the VPC, not the other direction. The issue I'm trying to get around is the customers who need to connect have multiple overlapping RFC1918 space (including overlapping what was proposed for the VPC networks). Finding a hole that is big enough and not in use by someone else is nearly impossible AND the customers could go through mergers which make them renumber even more in to overlapping 1918 space. Initially, I was looking at doing something like (example IP’s): Customer A (172.28.0.0/24) <—> NAT to 100.127.0.0/28 <——> VPN to DC <——> NAT from 100.64.0.0/18 <——> VPC Space (was 172.28.0.0/24) Classic overlapping subnets on both ends with allocations out of 100.64.0.0/10 to NAT in both directions. Each sees the other end in 100.64 space, but the mappings can get tricky and hard to keep track of (especially if you’re not a network engineer). In spitballing, the boat hasn’t sailed too far to say “Why not use 100.64/10 in the VPC?” Then, the customer would be allocated a /28 or larger (depending on needs) to NAT on their side and NAT it once. After that, no more NAT for the VPC and it boils down to firewall rules. Their device needs to NAT outbound before it fires it down the tunnel which pfSense and ASA’s appear to be able to do. I prototyped this up over the weekend with multiple VPC’s in multiple regions and it “appears” to work fine. From the operator community, what are the downsides? Customers are businesses on dedicated business services vs. consumer cable modems (although there are a few on business class cable). Others are on MPLS and I’m hashing that out. The only one I can see is if the customer has a service provider with their external interface in 100.64 space. However, this approach would have a more specific in that space so it should fire it down the tunnel for their allocated customer block (/28) vs. their external side. Thoughts and thanks in advance. Eric

12 18

routing issue? could someone from verizon FiOS please take a look?
by Gordon Cook 24 Feb '15

24 Feb '15

Verizon Fios cannot connect me to lavra.spb.ru This is the Russian site of the second most important monastery in Russia. It is reachable from Boston avra.spb.ru (91.218.229.131), 64 hops max, 52 byte packets 1 192.168.100.1 (192.168.100.1) 2.293 ms 0.815 ms 0.764 ms 2 100.64.0.129 (100.64.0.129) 1.108 ms 3.013 ms 1.068 ms 3 10.16.28.1 (10.16.28.1) 1.411 ms 1.277 ms 1.068 ms 4 10.16.13.1 (10.16.13.1) 4.796 ms 2.301 ms 5.207 ms 5 69.46.226.129.lightower.net (69.46.226.129) 4.380 ms 3.138 ms 4.630 ms 6 ae2.bstpmallj42.lightower.net (64.72.64.113) 3.768 ms 6.008 ms 3.888 ms 7 xe-4-0-2.bar2.boston1.level3.net (4.53.56.153) 6.030 ms 4.890 ms 7.058 ms 8 ae-231-3607.edge4.london1.level3.net (4.69.166.25) 91.525 ms 81.571 ms ae-232-3608.edge4.london1.level3.net (4.69.166.29) 81.327 ms 9 ae-231-3607.edge4.london1.level3.net (4.69.166.25) 78.121 ms ae-232-3608.edge4.london1.level3.net (4.69.166.29) 79.734 ms 78.890 ms 10 195.50.122.186 (195.50.122.186) 173.491 ms 133.054 ms 198.495 ms 11 * * * 12 oversun-gw.transtelecom.net (217.150.54.25) 210.399 ms 138.519 ms 139.291 ms 13 mr-o-rtc1-rsw-2.oversun.ru (94.198.48.154) 131.070 ms 131.007 ms 129.553 ms 14 mr-o-rtc5-rsw-2.oversun.ru (94.198.48.110) 140.012 ms 208.023 ms 145.352 ms 15 vip-h5.ihc-ru.net (91.218.229.131) 131.485 ms 133.319 ms 129.822 ms and from comcast and other locations apparently it has v6 routing info as well ..someone much more knowledgable than i suggested that this can be a source of reachability problems but here is what happens on my machine ordons-mac-pro:~ gordoncook$ traceroute lavra.spb.ru traceroute to lavra.spb.ru (92.242.140.21), 64 hops max, 52 byte packets 1 wireless_broadband_router (192.168.1.1) 0.654 ms 0.351 ms 0.295 ms 2 l100.cmdnnj-vfttp-26.verizon-gni.net (98.110.50.1) 4.607 ms 4.326 ms 7.869 ms 3 g0-1-0-0.cmdnnj-lcr-22.verizon-gni.net (130.81.223.100) 12.172 ms 9.502 ms 7.242 ms 4 xe-9-1-6-0.ny5030-bb-rtr2.verizon-gni.net (130.81.199.226) 15.080 ms xe-9-1-2-0.ny5030-bb-rtr2.verizon-gni.net (130.81.209.144) 8.986 ms xe-4-1-8-0.ny5030-bb-rtr2.verizon-gni.net (130.81.209.84) 22.085 ms 5 * * * 6 0.ae1.br2.nyc4.alter.net (140.222.229.91) 79.467 ms 77.046 ms 74.729 ms 7 204.255.168.114 (204.255.168.114) 85.591 ms 86.899 ms 204.255.168.110 (204.255.168.110) 87.011 ms 8 be2061.ccr42.jfk02.atlas.cogentco.com (154.54.3.69) 96.323 ms be2060.ccr41.jfk02.atlas.cogentco.com (154.54.31.9) 84.779 ms be2061.ccr42.jfk02.atlas.cogentco.com (154.54.3.69) 85.063 ms 9 be2482.ccr21.cle04.atlas.cogentco.com (154.54.27.157) 31.562 ms 31.990 ms be2483.ccr22.cle04.atlas.cogentco.com (154.54.29.201) 27.548 ms 10 be2351.ccr41.ord01.atlas.cogentco.com (154.54.44.85) 37.087 ms be2185.ccr42.ord01.atlas.cogentco.com (154.54.43.177) 42.273 ms be2351.ccr41.ord01.atlas.cogentco.com (154.54.44.85) 39.590 ms 11 be2157.ccr22.mci01.atlas.cogentco.com (154.54.6.117) 49.793 ms be2156.ccr21.mci01.atlas.cogentco.com (154.54.6.85) 50.583 ms be2157.ccr22.mci01.atlas.cogentco.com (154.54.6.117) 49.492 ms 12 be2133.ccr22.sfo01.atlas.cogentco.com (154.54.30.65) 77.446 ms be2132.ccr21.sfo01.atlas.cogentco.com (154.54.30.53) 77.060 ms be2133.ccr22.sfo01.atlas.cogentco.com (154.54.30.65) 77.001 ms 13 be2164.ccr21.sjc01.atlas.cogentco.com (154.54.28.34) 74.999 ms 74.569 ms be2165.ccr22.sjc01.atlas.cogentco.com (154.54.28.66) 74.852 ms 14 be2063.rcr21.b001848-1.sjc01.atlas.cogentco.com (154.54.1.162) 74.377 ms be2095.rcr21.b001848-1.sjc01.atlas.cogentco.com (154.54.3.138) 77.126 ms 89.476 ms 15 c1.sj.mpt.fiberinternetcenter.net (66.201.58.2) 82.483 ms 86.964 ms 80.094 ms 16 sanjose2.barefruit.co.uk (66.201.32.134) 125.112 ms 106.932 ms 124.778 ms 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * 31 * * * 32 * * * 33 * * * 34 * * * 35 * * * 36 * * * 37 * * * 38 * * * 39 * * * 40 * unallocated.barefruit.co.uk (92.242.140.21) 111.898 ms * gordons-mac-pro:~ gordoncook$ PS: my FIOS contract is up in april. Any suggestion of how to avoid a $30 per month price increase would be greatly appreciated OFF list of course many thanks Gordon Cook COOK Report on Internet Protocol

2 1

ControlNow / MailEssentials Admin Requested
by Jason Hellenthal 24 Feb '15

24 Feb '15

1 0

Quality of ROAs in RPKI repositories
by Daniele Iamartino 24 Feb '15

24 Feb '15

Hi all, As part of my master thesis and research work at IIJ, I've created a page to monitor the "quality" of ROAs in all RIR's RPKI repositories. http://rpki.me/quality.html Overall, the ROAs are quite good. Of course there are problems: I found out some ROAs which are very likely to be mis-registrations and make several BGP announcements invalid. On the page you can see the list of those ROAs, and the list of BGP announcements related to each of them. I would suggest to check if any of your prefixes are on this list. These problems could be easily fixed by registering correct ROAs. What I do is basically origin-validating BGP announcements that I find in a RIB dump from LINX node of route-views, using ROAs taken from a validated RPKI cache (using rcynic). You can find other information on under the "what does this table mean?" button. I'm also keeping updated a page monitoring which DNS root servers have their BGP announcements covered by a valid ROA: http://rpki.me/dns.html I would appreciate to hear any comment or suggestion. Regards -- Daniele Iamartino Student at Politecnico di Milano, Italy

1 0

What would you do about questionable domain pointing A record to your IP address?
by Anne P. Mitchell, Esq. 23 Feb '15

23 Feb '15

All, We have a rather strange situation (well, strange to me, at least). We have an email reputation accreditation applicant, who otherwise looks clean, however there is a very strange and somewhat concerning domain being pointed to one of the applicant's IP addresses Let's call the domain example.com, and the IP address 127.0.0.1, for these purposes. Applicant is assigned 127.0.0.1. the rDNS correctly goes to their own domain. However, example.com (which in reality is a concerning domain name) claims 127.0.0.1 as their A record. Of course, example.com is registered privately, and their DNS provider is one who is...umm... "known to provide dns for domains seen in spam." As I see it, the applicant's options are: a) just not worry about it and keep an eye on it b) publish a really tight spf record on it, so if they are somehow compromised, email appearing to come from example.com and 127.0.0.1 should be denied c) not use the IP address at all (it's part of a substantially larger block) d) two or more of the above. Thoughts? What would you do? Thanks! Anne Anne P. Mitchell, Esq. CEO/President ISIPP SuretyMail Email Reputation, Accreditation & Certification Your mail system + SuretyMail accreditation = delivered to their inbox! http://www.SuretyMail.com/ http://www.SuretyMail.eu/ Author: Section 6 of the Federal CAN-SPAM Act of 2003 Member, California Bar Cyberspace Law Committee Ret. Professor of Law, Lincoln Law School of San Jose 303-731-2121 | amitchell(a)isipp.com | @AnnePMitchell | Facebook/AnnePMitchell

4 4

Re: [j-nsp] draft-ietf-mpls-ldp-ipv6-16
by Tim Durack 21 Feb '15

21 Feb '15

On Fri, Feb 20, 2015 at 6:02 PM, Adam Vitkovsky <Adam.Vitkovsky(a)gamma.co.uk> wrote: > Alright so would you mind sharing the business drivers that would make > you migrate your current production infrastructure to this new unproven > possibly buggy LDPv6 and 4PE/4VPE setup please? > > > > adam > Businesses bigger than me think there is a business driver for IPv6: http://meetings.ripe.net/ripe-54/presentations/IPv6_management.pdf http://www.internetsociety.org/deploy360/wp-content/uploads/2014/04/WorldIP… IPv6 management of equipment is relatively easy. Once you've started down that path, you start looking at the protocol stuff, and wondering what to do about that. Maybe I should leave it alone until the business people figure it out for me :-) Tim:>

1 0

draft-ietf-mpls-ldp-ipv6-16
by Tim Durack 20 Feb '15

20 Feb '15

I notice draft-ietf-mpls-ldp-ipv6-16 was posted February 11, 2015. What is the chance of getting working code this decade? I would quite like to play with this new fangled IPv6 widget... (Okay, I'd like to stop using IPv4 for infrastructure. LDP is the last piece for me.) -- Tim:>

7 11

Interesting BFD discussion on reddit
by Dave Waters 20 Feb '15

20 Feb '15

http://www.reddit.com/r/networking/comments/2vxj9u/very_elegant_and_a_simpl… Authentication mechanisms defined for IGPs cannot be used to protect BFD since the rate at which packets are processed in BFD is very high. Dave

7 12

BGP Update Report
by cidr-report＠potaroo.net 20 Feb '15

20 Feb '15

BGP Update Report Interval: 12-Feb-15 -to- 19-Feb-15 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS61894 367710 7.2% 122570.0 -- FreeBSD Brasil LTDA,BR 2 - AS23752 271684 5.3% 1983.1 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 3 - AS27194 218890 4.3% 109445.0 -- REALLYFAST - ReallyFast.net,US 4 - AS9829 119288 2.3% 70.5 -- BSNL-NIB National Internet Backbone,IN 5 - AS577 109681 2.1% 40.6 -- BACOM - Bell Canada,CA 6 - AS36947 71643 1.4% 312.9 -- ALGTEL-AS,DZ 7 - AS53563 57400 1.1% 5740.0 -- XPLUSONE - X Plus One Solutions, Inc.,US 8 - AS13188 40017 0.8% 38.1 -- BANKINFORM-AS CONTENT DELIVERY NETWORK LTD,UA 9 - AS8402 30288 0.6% 21.7 -- CORBINA-AS OJSC "Vimpelcom",RU 10 - AS8452 27196 0.5% 14.1 -- TE-AS TE-AS,EG 11 - AS3816 25388 0.5% 27.4 -- COLOMBIA TELECOMUNICACIONES S.A. ESP,CO 12 - AS42337 23301 0.5% 143.0 -- RESPINA-AS Respina Networks & Beyond PJSC,IR 13 - AS10620 22359 0.4% 7.2 -- Telmex Colombia S.A.,CO 14 - AS23342 22359 0.4% 588.4 -- UNITEDLAYER - Unitedlayer, Inc.,US 15 - AS28573 21680 0.4% 8.9 -- NET Serviços de Comunicação S.A.,BR 16 - AS197914 21019 0.4% 7006.3 -- STOCKHO-AS Stockho Hosting SARL,FR 17 - AS2734 18761 0.4% 694.9 -- CORESITE - CoreSite,US 18 - AS42081 18413 0.4% 312.1 -- SPEEDY-NET-AS Speedy net EAD,BG 19 - AS28024 18284 0.4% 304.7 -- Nuevatel PCS de Bolivia S.A.,BO 20 - AS14709 17921 0.3% 779.2 -- Telefonica Moviles Panama S.A.,PA TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS61894 367710 7.2% 122570.0 -- FreeBSD Brasil LTDA,BR 2 - AS27194 218890 4.3% 109445.0 -- REALLYFAST - ReallyFast.net,US 3 - AS61039 16564 0.3% 16564.0 -- ZMZ OAO ZMZ,RU 4 - AS46336 8839 0.2% 8839.0 -- GOODVILLE - Goodville Mutual Casualty Company,US 5 - AS50104 7629 0.1% 7629.0 -- SATORP-AS SAUDI ARAMCO TOTAL Refining and Petrochemical Company,SA 6 - AS197914 21019 0.4% 7006.3 -- STOCKHO-AS Stockho Hosting SARL,FR 7 - AS53563 57400 1.1% 5740.0 -- XPLUSONE - X Plus One Solutions, Inc.,US 8 - AS25563 16309 0.3% 4077.2 -- WEBLAND-AS Webland AG, Autonomous System,CH 9 - AS33721 3832 0.1% 3832.0 -- CCL-ASN2 - CARNIVAL CRUISE LINES,US 10 - AS33440 12758 0.2% 3189.5 -- WEBRULON-NETWORK - webRulon, LLC,US 11 - AS62174 2979 0.1% 2979.0 -- INTERPAN-AS INTERPAN LTD.,BG 12 - AS198053 2641 0.1% 2641.0 -- AMTEL VECTRA S.A.,PL 13 - AS23752 271684 5.3% 1983.1 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 14 - AS47680 9237 0.2% 1847.4 -- NHCS EOBO Limited,IE 15 - AS201149 1660 0.0% 1660.0 -- ITSNS ITS Network Solution sp z o o,PL 16 - AS9581 1565 0.0% 1565.0 -- TELSTRAGLOBAL-ID-AS-AP TTPL,HK 17 - AS56169 1560 0.0% 1560.0 -- SCOMM-AS-AP SEDCO COMMUNICATIONS SDN BHD,MY 18 - AS197957 1539 0.0% 1539.0 -- KERBB Ker Broadband Communications Ltd,IE 19 - AS262149 4046 0.1% 1348.7 -- Sistemas Fratec S.A.,CR 20 - AS45606 6636 0.1% 1327.2 -- TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 177.10.158.0/24 367707 7.0% AS61894 -- FreeBSD Brasil LTDA,BR 2 - 202.70.88.0/21 136788 2.6% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 3 - 202.70.64.0/21 134332 2.5% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 4 - 162.246.92.0/22 109482 2.1% AS27194 -- REALLYFAST - ReallyFast.net,US 5 - 162.208.40.0/22 109408 2.1% AS27194 -- REALLYFAST - ReallyFast.net,US 6 - 105.96.0.0/22 64808 1.2% AS36947 -- ALGTEL-AS,DZ 7 - 199.38.164.0/23 57376 1.1% AS53563 -- XPLUSONE - X Plus One Solutions, Inc.,US 8 - 64.29.130.0/24 22287 0.4% AS23342 -- UNITEDLAYER - Unitedlayer, Inc.,US 9 - 130.0.192.0/21 21017 0.4% AS197914 -- STOCKHO-AS Stockho Hosting SARL,FR 10 - 23.34.208.0/21 18151 0.3% AS577 -- BACOM - Bell Canada,CA 11 - 91.235.169.0/24 16564 0.3% AS61039 -- ZMZ OAO ZMZ,RU 12 - 184.84.32.0/20 16281 0.3% AS577 -- BACOM - Bell Canada,CA 13 - 23.34.220.0/23 16254 0.3% AS577 -- BACOM - Bell Canada,CA 14 - 184.84.184.0/22 16222 0.3% AS577 -- BACOM - Bell Canada,CA 15 - 23.34.216.0/22 16213 0.3% AS577 -- BACOM - Bell Canada,CA 16 - 184.28.42.0/23 16203 0.3% AS577 -- BACOM - Bell Canada,CA 17 - 91.193.202.0/24 15662 0.3% AS42081 -- SPEEDY-NET-AS Speedy net EAD,BG 18 - 42.83.48.0/20 11802 0.2% AS18135 -- BTV BTV Cable television,JP 19 - 192.58.232.0/24 9587 0.2% AS6629 -- NOAA-AS - NOAA,US 20 - 88.87.160.0/19 9203 0.2% AS47680 -- NHCS EOBO Limited,IE Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0