December 2017 - mice-discuss - lists.micemn.net

Re: Attribute Length Error today

by Jeremy Lumby

Didn't Akamai stop using the route servers? Therefore it wouldn't really matter. Jeremy LumbyMinnesota VoIP9217 17th Ave SSuite 216Bloomington MN 55425Main 612-355-7740Direct 612-392-6814EFax 952-873-7425jlumby(a)mnvoip.com <div> </div><div> </div><div>-------- Original message --------</div><div>From: Richard Laager <rlaager(a)WIKTEL.COM> </div><div>Date: 12/14/17 2:18 PM (GMT-06:00) </div><div>To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET </div><div>Subject: Re: [MICE-DISCUSS] Attribute Length Error today </div><div> </div>-------- Original message --------From: Richard Laager <rlaager(a)WIKTEL.COM> Date: 12/14/17 2:18 PM (GMT-06:00) To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Attribute Length Error today At the last UG, we discussed IRR-based filtering. Does Akamai publish IRR records? -- Richard

Dec. 14, 2017

Re: Attribute Length Error today

by Richard Laager

At the last UG, we discussed IRR-based filtering. Does Akamai publish IRR records? -- Richard

Dec. 14, 2017

Re: Attribute Length Error today

by DeLong, Owen

Akamai has no plans to publish ROAs at this time. The reality is that in its current state RPKI is a high overhead method for explaining to the world which origin ASN to prepend in order to more convincingly hijack routes. Owen > On Dec 13, 2017, at 12:46 , Doug McIntyre <merlyn(a)IPHOUSE.NET> wrote: > > On Fri, Dec 08, 2017 at 11:06:50PM -0600, Richard Laager wrote: >> Zero length is a subset of “doesn’t start with their AS”, so if we filter on that condition, hopefully we will catch that too. > > > BIRD is probably the best tool for the job for doing the import BGP filtering for > conditions based on either AS Path = 0 or start with their AS. > It sounds like people want the BGP import function to change to include something like > > function route_import(int asn) > { > .... > if bgp_path.first != asn then return false; > if bgp_path.len > 25 then return false; > if bgp_next_hop != from then return false; > return true; > } > > Are there other conditions that should be filtered on? (this is taken > mostly from Ondřej Surý's examples). > > As for doing RPKI, it looks like BIRD v2.0 supports that in some fashion, but that > would have to be tested out in a lab. How many members would have an ROA already? > > > -- > Doug McIntyre <merlyn(a)iphouse.net> > ~.~ ipHouse ~.~ > Network Engineer/Provisioning/Jack of all Trades

Dec. 14, 2017

Re: Attribute Length Error today

by Richard Laager

On 12/13/2017 02:46 PM, Doug McIntyre wrote: > if bgp_path.first != asn then return false; > if bgp_path.len > 25 then return false; > if bgp_next_hop != from then return false; While I am not familiar with BIRD's syntax, if I am reading these correctly, they seem like reasonable conditions. -- Richard

Dec. 13, 2017

Re: Attribute Length Error today

by Jason Hanke

This is the tool we're using at IX Denver: https://arouteserver.readthedocs.io/en/latest/index.html RPKI is currently turned off at IX Denver. Doug,If you're interested then I'll unicast you the output of the script. It's a bit large for the list. On Wed, Dec 13, 2017 at 2:46 PM, Doug McIntyre <merlyn(a)iphouse.net> wrote: > On Fri, Dec 08, 2017 at 11:06:50PM -0600, Richard Laager wrote: >> >> Zero length is a subset of “doesn’t start with their AS”, so if we filter >> on that condition, hopefully we will catch that too. > > > > BIRD is probably the best tool for the job for doing the import BGP > filtering for > conditions based on either AS Path = 0 or start with their AS. > It sounds like people want the BGP import function to change to include > something like > > function route_import(int asn) > { > .... > if bgp_path.first != asn then return false; > if bgp_path.len > 25 then return false; > if bgp_next_hop != from then return false; > return true; > } > > Are there other conditions that should be filtered on? (this is taken > mostly from Ondřej Surý's examples). > > As for doing RPKI, it looks like BIRD v2.0 supports that in some fashion, > but that > would have to be tested out in a lab. How many members would have an ROA > already? > > > > -- > Doug McIntyre <merlyn(a)iphouse.net> > ~.~ ipHouse ~.~ > Network Engineer/Provisioning/Jack of all Trades -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Dec. 13, 2017

Re: Attribute Length Error today

by Doug McIntyre

On Fri, Dec 08, 2017 at 11:06:50PM -0600, Richard Laager wrote: >Zero length is a subset of “doesn’t start with their AS”, so if we filter on that condition, hopefully we will catch that too. BIRD is probably the best tool for the job for doing the import BGP filtering for conditions based on either AS Path = 0 or start with their AS. It sounds like people want the BGP import function to change to include something like function route_import(int asn) { .... if bgp_path.first != asn then return false; if bgp_path.len > 25 then return false; if bgp_next_hop != from then return false; return true; } Are there other conditions that should be filtered on? (this is taken mostly from Ondřej Surý's examples). As for doing RPKI, it looks like BIRD v2.0 supports that in some fashion, but that would have to be tested out in a lab. How many members would have an ROA already? -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Dec. 13, 2017

Re: Please Welcome SW MN Broadband to MICE!

by Doug McIntyre

On Wed, Dec 13, 2017 at 11:20:34AM -0600, Jason Hanke wrote: >Name: Southwest MN Broadband >Port: xe-0/0/12 (NP Remote) >ASN: 25715 >IPv4: 206.108.255.40/24 >IPv6: 2001:504:27:0:0:6473::1/64 >Peering Contact: support(a)mysmbs.com > >Route Server: Yes The route servers are all set for them. Welcome! -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Dec. 13, 2017

Please Welcome SW MN Broadband to MICE!

by Jason Hanke

Name: Southwest MN Broadband Port: xe-0/0/12 (NP Remote) ASN: 25715 IPv4: 206.108.255.40/24 IPv6: 2001:504:27:0:0:6473::1/64 Peering Contact: support(a)mysmbs.com Route Server: Yes BFD: No Welcome aboard! -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Dec. 13, 2017

Re: Attribute Length Error today

by Frank Bulk

Here’s a tweet to the list that Jay is referring to: https://twitter.com/JobSnijders/status/939280110607327232 Frank From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Jason Hanke Sent: Saturday, December 9, 2017 7:01 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Attribute Length Error today it's time for secure route servers. Job sent out a list of ixp and quite a few of them are already doing rpki or irr filtering. On Dec 8, 2017 11:06 PM, "Richard Laager" <rlaager(a)wiktel.com<mailto:rlaager@wiktel.com>> wrote: Zero length is a subset of “doesn’t start with their AS”, so if we filter on that condition, hopefully we will catch that too. -- Richard > On Dec 8, 2017, at 23:04, Frank Bulk <fbulk(a)MYPREMIERONLINE.COM<mailto:fbulk@MYPREMIERONLINE.COM>> wrote: > > If the issue was that the AS PATH was zero length, can BIRD filter those out? > > Frank > > -----Original Message----- > From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>] On Behalf Of Doug McIntyre > Sent: Friday, December 8, 2017 6:15 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> > Subject: Re: [MICE-DISCUSS] Attribute Length Error today > >> On Fri, Dec 08, 2017 at 06:03:21PM -0600, Andrew Hoyos wrote: >> The more important question - why didn’t the route servers drop that? I’d assume there should be inbound filters to drop bogons+default+$otherbadstuff. > > They do have filters for bogons + default route. > > I suspect bad AS attribute processing is part of what made it get leaked onwards. > The BIRD servers were logging that as well during this period. > >> On a larger scale, this sort of thing begs the question - do we need to have folks in some sort of isolated VLAN with test sessions to the route servers upon turnup? SIX does this, as well as others, I suspect to prevent these exact issues from happening. > > Possibly. > > > -- > Doug McIntyre <merlyn(a)iphouse.net<mailto:merlyn@iphouse.net>> > ~.~ ipHouse ~.~ > Network Engineer/Provisioning/Jack of all Trades > ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 12, 2017

Re: Super Bowl Change Freeze

by DeLong, Owen

If you aren’t yet peering with Akamai and would like to before this event starts streaming, please get your peering requests in to us soon. Don’t count on a route-server session to cover this. It is greatly preferable to peer directly with our router. Details are in peeringdb and we encourage you to peer both IPv4 and IPv6. Owen > On Dec 11, 2017, at 16:19 , Richard Laager <rlaager(a)WIKTEL.COM> wrote: > > As you have probably heard, the Super Bowl is being held in Minneapolis > on February 4. We discussed at UG 26 that it would be a good idea to > institute a change freeze for a few days to a week before. > > If you need to upgrade your port capacity or make other changes at MICE, > please plan to have those *complete* by January 26th. > > If it were me, I wouldn't even cut it that close. > > -- > Richard

Dec. 12, 2017